diff --git a/.cvsignore b/.cvsignore index 5fc0d13..6361df5 100644 --- a/.cvsignore +++ b/.cvsignore @@ -216,3 +216,4 @@ serefpolicy-3.8.3.tgz serefpolicy-3.8.4.tgz serefpolicy-3.8.5.tgz serefpolicy-3.8.6.tgz +serefpolicy-3.8.7.tgz diff --git a/modules-minimum.conf b/modules-minimum.conf index e90c4e9..59f04a0 100644 --- a/modules-minimum.conf +++ b/modules-minimum.conf @@ -532,13 +532,6 @@ git = module # gpm = module -# Layer: apps -# Module: ethereal -# -# Ethereal packet capture tool. -# -ethereal = module - # Layer: services # Module: fail2ban # @@ -1743,11 +1736,18 @@ vhostmd = module wine = module # Layer: apps -# Module: telepathy_sofiasip +# Module: wireshark +# +# wireshark executable +# +wireshark = module + +# Layer: apps +# Module: telepathy # -# telepathy-sofiasip - Telepathy connection manager for SIP +# telepathy - Policy for Telepathy framework # -telepathysofiasip = module +telepathy = module # Layer: admin # Module: tzdata diff --git a/modules-mls.conf b/modules-mls.conf index 3fc955a..27eefa3 100644 --- a/modules-mls.conf +++ b/modules-mls.conf @@ -504,13 +504,6 @@ gpsd = module # gpm = module -# Layer: apps -# Module: ethereal -# -# Ethereal packet capture tool. -# -ethereal = module - # Layer: services # Module: fail2ban # @@ -1566,6 +1559,13 @@ ulogd = module # wine = module +# Layer: apps +# Module: wireshark +# +# wireshark executable +# +wireshark = module + # Layer: admin # Module: tzdata # @@ -1806,11 +1806,11 @@ portreserve = module rpcbind = module # Layer: apps -# Module: telepathy_sofiasip +# Module: telepathy # -# telepathy-sofiasip - Telepathy connection manager for SIP +# telepathy - Policy for Telepathy framework # -telepathysofiasip = module +telepathy = module # Layer: apps # Module: vmware diff --git a/modules-targeted.conf b/modules-targeted.conf index e90c4e9..59f04a0 100644 --- a/modules-targeted.conf +++ b/modules-targeted.conf @@ -532,13 +532,6 @@ git = module # gpm = module -# Layer: apps -# Module: ethereal -# -# Ethereal packet capture tool. -# -ethereal = module - # Layer: services # Module: fail2ban # @@ -1743,11 +1736,18 @@ vhostmd = module wine = module # Layer: apps -# Module: telepathy_sofiasip +# Module: wireshark +# +# wireshark executable +# +wireshark = module + +# Layer: apps +# Module: telepathy # -# telepathy-sofiasip - Telepathy connection manager for SIP +# telepathy - Policy for Telepathy framework # -telepathysofiasip = module +telepathy = module # Layer: admin # Module: tzdata diff --git a/nsadiff b/nsadiff index b9ccd80..bbe03f5 100755 --- a/nsadiff +++ b/nsadiff @@ -1 +1 @@ -diff --exclude-from=exclude -N -u -r nsaserefpolicy serefpolicy-3.8.6 > /tmp/diff +diff --exclude-from=exclude -N -u -r nsaserefpolicy serefpolicy-3.8.7 > /tmp/diff diff --git a/policy-F14.patch b/policy-F14.patch index 7cf4b62..241cf07 100644 --- a/policy-F14.patch +++ b/policy-F14.patch @@ -1,6 +1,6 @@ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.8.6/Makefile ---- nsaserefpolicy/Makefile 2009-08-18 11:41:14.000000000 -0400 -+++ serefpolicy-3.8.6/Makefile 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.8.7/Makefile +--- nsaserefpolicy/Makefile 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/Makefile 2010-07-14 14:08:02.000000000 -0400 @@ -244,7 +244,7 @@ appdir := $(contextpath) user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts) @@ -10,9 +10,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.8.6/M net_contexts := $(builddir)net_contexts all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/git_selinux.8 serefpolicy-3.8.6/man/man8/git_selinux.8 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/git_selinux.8 serefpolicy-3.8.7/man/man8/git_selinux.8 --- nsaserefpolicy/man/man8/git_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/man/man8/git_selinux.8 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/man/man8/git_selinux.8 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,109 @@ +.TH "git_selinux" "8" "27 May 2010" "domg472@gmail.com" "Git SELinux policy documentation" +.de EX @@ -123,9 +123,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/git_selinux.8 seref +This manual page was written by Dominick Grift . +.SH "SEE ALSO" +selinux(8), git(8), chcon(1), semodule(8), setsebool(8) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.8.6/policy/global_tunables +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.8.7/policy/global_tunables --- nsaserefpolicy/policy/global_tunables 2009-07-23 14:11:04.000000000 -0400 -+++ serefpolicy-3.8.6/policy/global_tunables 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/global_tunables 2010-07-14 14:08:02.000000000 -0400 @@ -61,15 +61,6 @@ ## @@ -161,17 +161,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref +## +gen_tunable(mmap_low_allowed, false) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/accountsd.fc serefpolicy-3.8.6/policy/modules/admin/accountsd.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/accountsd.fc serefpolicy-3.8.7/policy/modules/admin/accountsd.fc --- nsaserefpolicy/policy/modules/admin/accountsd.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/admin/accountsd.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/accountsd.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,4 @@ + +/usr/libexec/accounts-daemon -- gen_context(system_u:object_r:accountsd_exec_t,s0) + +/var/lib/AccountsService(/.*)? gen_context(system_u:object_r:accountsd_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/accountsd.if serefpolicy-3.8.6/policy/modules/admin/accountsd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/accountsd.if serefpolicy-3.8.7/policy/modules/admin/accountsd.if --- nsaserefpolicy/policy/modules/admin/accountsd.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/admin/accountsd.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/accountsd.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,164 @@ +## policy for accountsd + @@ -337,9 +337,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/account + + accountsd_manage_var_lib($1) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/accountsd.te serefpolicy-3.8.6/policy/modules/admin/accountsd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/accountsd.te serefpolicy-3.8.7/policy/modules/admin/accountsd.te --- nsaserefpolicy/policy/modules/admin/accountsd.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/admin/accountsd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/accountsd.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,62 @@ +policy_module(accountsd,1.0.0) + @@ -403,9 +403,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/account + xserver_manage_xdm_etc_files(accountsd_t) + xserver_dbus_chat_xdm(accountsd_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.8.6/policy/modules/admin/anaconda.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.8.7/policy/modules/admin/anaconda.te --- nsaserefpolicy/policy/modules/admin/anaconda.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/anaconda.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/anaconda.te 2010-07-14 14:08:02.000000000 -0400 @@ -28,8 +28,10 @@ logging_send_syslog_msg(anaconda_t) @@ -426,9 +426,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anacond ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/certwatch.te serefpolicy-3.8.6/policy/modules/admin/certwatch.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/certwatch.te serefpolicy-3.8.7/policy/modules/admin/certwatch.te --- nsaserefpolicy/policy/modules/admin/certwatch.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/certwatch.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/certwatch.te 2010-07-14 16:38:41.000000000 -0400 @@ -35,7 +35,7 @@ miscfiles_read_localization(certwatch_t) @@ -438,9 +438,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/certwat optional_policy(` apache_exec_modules(certwatch_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.8.6/policy/modules/admin/consoletype.te +@@ -47,6 +47,7 @@ + ') + + optional_policy(` ++ pcscd_domtrans(certwatch_t) + pcscd_stream_connect(certwatch_t) + pcscd_read_pub_files(certwatch_t) + ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.8.7/policy/modules/admin/consoletype.te --- nsaserefpolicy/policy/modules/admin/consoletype.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/consoletype.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/consoletype.te 2010-07-14 14:08:02.000000000 -0400 @@ -85,6 +85,7 @@ hal_dontaudit_rw_pipes(consoletype_t) hal_dontaudit_rw_dgram_sockets(consoletype_t) @@ -449,9 +457,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-3.8.6/policy/modules/admin/dmesg.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-3.8.7/policy/modules/admin/dmesg.te --- nsaserefpolicy/policy/modules/admin/dmesg.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/dmesg.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/dmesg.te 2010-07-14 14:08:02.000000000 -0400 @@ -50,6 +50,12 @@ userdom_use_user_terminals(dmesg_t) @@ -465,33 +473,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.t seutil_sigchld_newrole(dmesg_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstboot.te serefpolicy-3.8.6/policy/modules/admin/firstboot.te ---- nsaserefpolicy/policy/modules/admin/firstboot.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/firstboot.te 2010-07-12 09:05:35.000000000 -0400 -@@ -76,6 +76,7 @@ - miscfiles_read_localization(firstboot_t) - - modutils_domtrans_insmod(firstboot_t) -+modutils_domtrans_depmod(firstboot_t) - modutils_read_module_config(firstboot_t) - modutils_read_module_deps(firstboot_t) - -@@ -120,6 +121,12 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstboot.te serefpolicy-3.8.7/policy/modules/admin/firstboot.te +--- nsaserefpolicy/policy/modules/admin/firstboot.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/firstboot.te 2010-07-14 14:08:02.000000000 -0400 +@@ -121,6 +121,7 @@ ') optional_policy(` + gnome_admin_home_gconf_filetrans(firstboot_t, dir) -+ gnome_manage_config(firstboot_t) -+') -+ -+optional_policy(` -+ xserver_domtrans(firstboot_t) - xserver_rw_shm(firstboot_t) - xserver_unconfined(firstboot_t) + gnome_manage_config(firstboot_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.8.6/policy/modules/admin/logrotate.te + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.8.7/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/logrotate.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/logrotate.te 2010-07-14 14:08:02.000000000 -0400 @@ -119,6 +119,7 @@ userdom_use_user_terminals(logrotate_t) userdom_list_user_home_dirs(logrotate_t) @@ -509,9 +504,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.fc serefpolicy-3.8.6/policy/modules/admin/logwatch.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.fc serefpolicy-3.8.7/policy/modules/admin/logwatch.fc --- nsaserefpolicy/policy/modules/admin/logwatch.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/logwatch.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/logwatch.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,7 +1,11 @@ /usr/sbin/logcheck -- gen_context(system_u:object_r:logwatch_exec_t,s0) +/usr/sbin/epylog -- gen_context(system_u:object_r:logwatch_exec_t,s0) @@ -524,9 +519,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc /var/log/logcheck/.+ -- gen_context(system_u:object_r:logwatch_lock_t,s0) + +/var/run/epylog\.pid gen_context(system_u:object_r:logwatch_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.8.6/policy/modules/admin/logwatch.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.8.7/policy/modules/admin/logwatch.te --- nsaserefpolicy/policy/modules/admin/logwatch.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/logwatch.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/logwatch.te 2010-07-14 14:08:02.000000000 -0400 @@ -19,6 +19,9 @@ type logwatch_tmp_t; files_tmp_file(logwatch_tmp_t) @@ -563,9 +558,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc ifdef(`distro_redhat',` files_search_all(logwatch_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te serefpolicy-3.8.6/policy/modules/admin/mrtg.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te serefpolicy-3.8.7/policy/modules/admin/mrtg.te --- nsaserefpolicy/policy/modules/admin/mrtg.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/mrtg.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/mrtg.te 2010-07-14 14:08:02.000000000 -0400 @@ -115,6 +115,7 @@ userdom_use_user_terminals(mrtg_t) userdom_dontaudit_read_user_home_content_files(mrtg_t) @@ -574,15 +569,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te netutils_domtrans_ping(mrtg_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool.fc serefpolicy-3.8.6/policy/modules/admin/ncftool.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool.fc serefpolicy-3.8.7/policy/modules/admin/ncftool.fc --- nsaserefpolicy/policy/modules/admin/ncftool.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/admin/ncftool.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/ncftool.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,2 @@ + +/usr/bin/ncftool -- gen_context(system_u:object_r:ncftool_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool.if serefpolicy-3.8.6/policy/modules/admin/ncftool.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool.if serefpolicy-3.8.7/policy/modules/admin/ncftool.if --- nsaserefpolicy/policy/modules/admin/ncftool.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/admin/ncftool.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/ncftool.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,74 @@ + +## policy for ncftool @@ -658,9 +653,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool + allow $2 ncftool_t:process signal; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool.te serefpolicy-3.8.6/policy/modules/admin/ncftool.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool.te serefpolicy-3.8.7/policy/modules/admin/ncftool.te --- nsaserefpolicy/policy/modules/admin/ncftool.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/admin/ncftool.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/ncftool.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,79 @@ +policy_module(ncftool, 1.0.0) + @@ -741,9 +736,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/ncftool +optional_policy(` + dbus_system_bus_client(ncftool_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.8.6/policy/modules/admin/netutils.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.8.7/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/netutils.te 2010-07-12 16:42:27.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/netutils.te 2010-07-14 14:08:02.000000000 -0400 @@ -51,6 +51,8 @@ kernel_search_proc(netutils_t) @@ -826,9 +821,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil + term_dontaudit_use_all_ttys(traceroute_t) + term_dontaudit_use_all_ptys(traceroute_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.8.6/policy/modules/admin/prelink.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.8.7/policy/modules/admin/prelink.te --- nsaserefpolicy/policy/modules/admin/prelink.te 2010-06-21 08:21:16.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/prelink.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/prelink.te 2010-07-14 16:40:01.000000000 -0400 @@ -59,6 +59,7 @@ manage_files_pattern(prelink_t, prelink_var_lib_t, prelink_var_lib_t) relabel_files_pattern(prelink_t, prelink_var_lib_t, prelink_var_lib_t) @@ -837,7 +832,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink # prelink misc objects that are not system # libraries or entrypoints -@@ -99,6 +100,8 @@ +@@ -73,6 +74,7 @@ + corecmd_read_bin_symlinks(prelink_t) + + dev_read_urand(prelink_t) ++dev_getattr_all_chr_files(prelink_t) + + files_list_all(prelink_t) + files_getattr_all_files(prelink_t) +@@ -99,6 +101,8 @@ miscfiles_read_localization(prelink_t) userdom_use_user_terminals(prelink_t) @@ -846,7 +849,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink optional_policy(` amanda_manage_lib(prelink_t) -@@ -129,6 +132,7 @@ +@@ -129,6 +133,7 @@ read_files_pattern(prelink_cron_system_t, prelink_cache_t, prelink_cache_t) allow prelink_cron_system_t prelink_cache_t:file unlink; @@ -854,9 +857,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink domtrans_pattern(prelink_cron_system_t, prelink_exec_t, prelink_t) allow prelink_cron_system_t prelink_t:process noatsecure; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.8.6/policy/modules/admin/readahead.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.8.7/policy/modules/admin/readahead.te --- nsaserefpolicy/policy/modules/admin/readahead.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/readahead.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/readahead.te 2010-07-14 14:08:02.000000000 -0400 @@ -51,6 +51,7 @@ files_list_non_security(readahead_t) @@ -873,15 +876,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe fs_dontaudit_search_ramfs(readahead_t) fs_dontaudit_read_ramfs_pipes(readahead_t) fs_dontaudit_read_ramfs_files(readahead_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.8.6/policy/modules/admin/rpm.fc ---- nsaserefpolicy/policy/modules/admin/rpm.fc 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/rpm.fc 2010-07-12 13:53:51.000000000 -0400 -@@ -1,17 +1,18 @@ - - /bin/rpm -- gen_context(system_u:object_r:rpm_exec_t,s0) - /usr/bin/rpm -- gen_context(system_u:object_r:rpm_exec_t,s0) -+/usr/bin/debuginfo-install -- gen_context(system_u:object_r:debuginfo_exec_t,s0) - /usr/bin/smart -- gen_context(system_u:object_r:rpm_exec_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.8.7/policy/modules/admin/rpm.fc +--- nsaserefpolicy/policy/modules/admin/rpm.fc 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/rpm.fc 2010-07-14 14:08:02.000000000 -0400 +@@ -7,6 +7,7 @@ /usr/bin/yum -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -889,14 +887,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc /usr/libexec/yumDBUSBackend.py -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/yum-complete-transaction -- gen_context(system_u:object_r:rpm_exec_t,s0) - - /usr/sbin/system-install-packages -- gen_context(system_u:object_r:rpm_exec_t,s0) - /usr/sbin/yum-updatesd -- gen_context(system_u:object_r:rpm_exec_t,s0) --/usr/sbin/packagekitd -- gen_context(system_u:object_r:rpm_exec_t,s0) - - /usr/share/yumex/yumex-yum-backend -- gen_context(system_u:object_r:rpm_exec_t,s0) - /usr/share/yumex/yum_childtask\.py -- gen_context(system_u:object_r:rpm_exec_t,s0) -@@ -23,6 +24,9 @@ +@@ -25,6 +26,9 @@ /usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/up2date -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -906,47 +897,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc ') /var/cache/yum(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.8.6/policy/modules/admin/rpm.if ---- nsaserefpolicy/policy/modules/admin/rpm.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/rpm.if 2010-07-12 09:05:35.000000000 -0400 -@@ -13,11 +13,36 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.8.7/policy/modules/admin/rpm.if +--- nsaserefpolicy/policy/modules/admin/rpm.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/rpm.if 2010-07-14 14:08:02.000000000 -0400 +@@ -13,11 +13,14 @@ interface(`rpm_domtrans',` gen_require(` type rpm_t, rpm_exec_t; -+ type debuginfo_exec_t; + attribute rpm_transition_domain; ') files_search_usr($1) corecmd_search_bin($1) domtrans_pattern($1, rpm_exec_t, rpm_t) -+ domtrans_pattern($1, debuginfo_exec_t, rpm_t) + typeattribute $1 rpm_transition_domain; -+') -+ -+######################################## -+## -+## Execute debuginfo_install programs in the rpm domain. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`rpm_domtrans_debuginfo',` -+ gen_require(` -+ type rpm_t; -+ type debuginfo_exec_t; -+ ') -+ -+ files_search_usr($1) -+ corecmd_search_bin($1) -+ domtrans_pattern($1, debuginfo_exec_t, rpm_t) ++ rpm_debuginfo_domtrans($1) ') ######################################## -@@ -66,6 +91,11 @@ +@@ -87,6 +90,11 @@ rpm_domtrans($1) role $2 types rpm_t; role $2 types rpm_script_t; @@ -958,7 +927,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if seutil_run_loadpolicy(rpm_script_t, $2) seutil_run_semanage(rpm_script_t, $2) seutil_run_setfiles(rpm_script_t, $2) -@@ -164,6 +194,41 @@ +@@ -185,6 +193,41 @@ ######################################## ## @@ -1000,7 +969,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if ## Send and receive messages from ## rpm over dbus. ## -@@ -317,7 +382,9 @@ +@@ -338,7 +381,9 @@ ') files_search_tmp($1) @@ -1010,7 +979,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if ') ##################################### -@@ -357,7 +424,9 @@ +@@ -378,7 +423,9 @@ ') files_search_tmp($1) @@ -1020,7 +989,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if ') ######################################## -@@ -440,6 +509,7 @@ +@@ -461,6 +508,7 @@ allow $1 rpm_var_lib_t:dir list_dir_perms; read_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t) read_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t) @@ -1028,14 +997,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if ') ######################################## -@@ -556,3 +626,66 @@ +@@ -577,3 +625,66 @@ - files_pid_filetrans($1, rpm_var_run_t, file) + files_pid_filetrans($1, rpm_var_run_t, file) ') + +######################################## +## -+## Allow application to transition to rpm_script domain. ++## Send a null signal to rpm. +## +## +## @@ -1043,80 +1012,75 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if +## +## +# -+interface(`rpm_transition_script',` ++interface(`rpm_inherited_fifo',` + gen_require(` -+ type rpm_script_t; + attribute rpm_transition_domain; + ') + -+ typeattribute $1 rpm_transition_domain; -+ allow $1 rpm_script_t:process transition; -+ -+ allow $1 rpm_script_t:fd use; -+ allow rpm_script_t $1:fd use; -+ allow rpm_script_t $1:fifo_file rw_fifo_file_perms; -+ allow rpm_script_t $1:process sigchld; ++ allow $1 rpm_transition_domain:fifo_file rw_inherited_fifo_file_perms; +') + ++ +######################################## +## -+## Send a null signal to rpm. ++## Make rpm_exec_t an entry point for ++## the specified domain. +## +## +## +## Domain allowed access. +## +## -+# -+interface(`rpm_inherited_fifo',` ++# ++interface(`rpm_entry_type',` + gen_require(` -+ attribute rpm_transition_domain; ++ type rpm_exec_t; + ') + -+ allow $1 rpm_transition_domain:fifo_file rw_inherited_fifo_file_perms; ++ domain_entry_file($1, rpm_exec_t) +') + -+ +######################################## +## -+## Make rpm_exec_t an entry point for -+## the specified domain. ++## Allow application to transition to rpm_script domain. +## +## +## +## Domain allowed access. +## +## -+# -+interface(`rpm_entry_type',` ++# ++interface(`rpm_transition_script',` + gen_require(` -+ type rpm_exec_t; ++ type rpm_script_t; ++ attribute rpm_transition_domain; + ') + -+ domain_entry_file($1, rpm_exec_t) ++ typeattribute $1 rpm_transition_domain; ++ allow $1 rpm_script_t:process transition; ++ ++ allow $1 rpm_script_t:fd use; ++ allow rpm_script_t $1:fd use; ++ allow rpm_script_t $1:fifo_file rw_fifo_file_perms; ++ allow rpm_script_t $1:process sigchld; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.8.6/policy/modules/admin/rpm.te ---- nsaserefpolicy/policy/modules/admin/rpm.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/rpm.te 2010-07-12 09:05:35.000000000 -0400 -@@ -1,5 +1,7 @@ - policy_module(rpm, 1.11.0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.8.7/policy/modules/admin/rpm.te +--- nsaserefpolicy/policy/modules/admin/rpm.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/rpm.te 2010-07-14 14:08:02.000000000 -0400 +@@ -1,10 +1,11 @@ + policy_module(rpm, 1.11.1) +attribute rpm_transition_domain; + ######################################## # # Declarations -@@ -14,6 +16,9 @@ - domain_interactive_fd(rpm_t) - role system_r types rpm_t; - -+type debuginfo_exec_t; -+domain_entry_file(rpm_t, debuginfo_exec_t) -+ - type rpm_file_t; - files_type(rpm_file_t) + # +- + type debuginfo_exec_t; + domain_entry_file(rpm_t, debuginfo_exec_t) -@@ -41,6 +46,7 @@ +@@ -44,6 +45,7 @@ domain_obj_id_change_exemption(rpm_script_t) domain_system_change_exemption(rpm_script_t) corecmd_shell_entry_type(rpm_script_t) @@ -1124,7 +1088,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te domain_type(rpm_script_t) domain_entry_file(rpm_t, rpm_script_exec_t) domain_interactive_fd(rpm_script_t) -@@ -74,6 +80,8 @@ +@@ -77,6 +79,8 @@ allow rpm_t self:sem create_sem_perms; allow rpm_t self:msgq create_msgq_perms; allow rpm_t self:msg { send receive }; @@ -1133,7 +1097,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te allow rpm_t rpm_log_t:file manage_file_perms; logging_log_filetrans(rpm_t, rpm_log_t, file) -@@ -81,6 +89,7 @@ +@@ -84,6 +88,7 @@ manage_dirs_pattern(rpm_t, rpm_tmp_t, rpm_tmp_t) manage_files_pattern(rpm_t, rpm_tmp_t, rpm_tmp_t) files_tmp_filetrans(rpm_t, rpm_tmp_t, { file dir }) @@ -1141,7 +1105,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te manage_dirs_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t) manage_files_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t) -@@ -88,6 +97,7 @@ +@@ -91,6 +96,7 @@ manage_fifo_files_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t) manage_sock_files_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t) fs_tmpfs_filetrans(rpm_t, rpm_tmpfs_t, { dir file lnk_file sock_file fifo_file }) @@ -1149,7 +1113,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te manage_dirs_pattern(rpm_t, rpm_var_cache_t, rpm_var_cache_t) manage_files_pattern(rpm_t, rpm_var_cache_t, rpm_var_cache_t) -@@ -103,6 +113,7 @@ +@@ -106,6 +112,7 @@ kernel_read_network_state(rpm_t) kernel_read_system_state(rpm_t) kernel_read_kernel_sysctls(rpm_t) @@ -1157,7 +1121,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te corecmd_exec_all_executables(rpm_t) -@@ -122,6 +133,8 @@ +@@ -125,6 +132,8 @@ dev_list_sysfs(rpm_t) dev_list_usbfs(rpm_t) dev_read_urand(rpm_t) @@ -1166,18 +1130,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te fs_getattr_all_dirs(rpm_t) fs_list_inotifyfs(rpm_t) -@@ -201,6 +214,10 @@ +@@ -205,6 +214,7 @@ optional_policy(` networkmanager_dbus_chat(rpm_t) ') + -+ optional_policy(` -+ dbus_system_domain(rpm_t, debuginfo_exec_t) -+ ') ') optional_policy(` -@@ -208,7 +225,7 @@ +@@ -212,7 +222,7 @@ ') optional_policy(` @@ -1186,25 +1147,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te # yum-updatesd requires this unconfined_dbus_chat(rpm_t) unconfined_dbus_chat(rpm_script_t) -@@ -219,8 +236,8 @@ - # rpm-script Local policy - # - --allow rpm_script_t self:capability { chown dac_override dac_read_search fowner fsetid setgid setuid ipc_lock sys_chroot sys_nice mknod kill }; --allow rpm_script_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; -+allow rpm_script_t self:capability { chown dac_override dac_read_search fowner fsetid setgid setuid ipc_lock sys_admin sys_chroot sys_ptrace sys_rawio sys_nice mknod kill net_admin }; -+allow rpm_script_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execheap }; - allow rpm_script_t self:fd use; - allow rpm_script_t self:fifo_file rw_fifo_file_perms; - allow rpm_script_t self:unix_dgram_socket create_socket_perms; -@@ -231,12 +248,15 @@ - allow rpm_script_t self:sem create_sem_perms; - allow rpm_script_t self:msgq create_msgq_perms; - allow rpm_script_t self:msg { send receive }; -+allow rpm_script_t self:netlink_kobject_uevent_socket create_socket_perms; - - allow rpm_script_t rpm_tmp_t:file read_file_perms; - +@@ -242,6 +252,8 @@ allow rpm_script_t rpm_script_tmp_t:dir mounton; manage_dirs_pattern(rpm_script_t, rpm_script_tmp_t, rpm_script_tmp_t) manage_files_pattern(rpm_script_t, rpm_script_tmp_t, rpm_script_tmp_t) @@ -1213,7 +1156,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te files_tmp_filetrans(rpm_script_t, rpm_script_tmp_t, { file dir }) manage_dirs_pattern(rpm_script_t, rpm_script_tmpfs_t, rpm_script_tmpfs_t) -@@ -249,6 +269,7 @@ +@@ -254,6 +266,7 @@ kernel_read_kernel_sysctls(rpm_script_t) kernel_read_system_state(rpm_script_t) kernel_read_network_state(rpm_script_t) @@ -1221,11 +1164,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te kernel_read_software_raid_state(rpm_script_t) dev_list_sysfs(rpm_script_t) -@@ -293,8 +314,11 @@ - auth_use_nsswitch(rpm_script_t) - # ideally we would not need this - auth_manage_all_files_except_shadow(rpm_script_t) -+auth_relabel_shadow(rpm_script_t) +@@ -301,6 +314,8 @@ + auth_relabel_shadow(rpm_script_t) corecmd_exec_all_executables(rpm_script_t) +can_exec(rpm_script_t, rpm_script_tmp_t) @@ -1233,15 +1173,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te domain_read_all_domains_state(rpm_script_t) domain_getattr_all_domains(rpm_script_t) -@@ -306,6 +330,7 @@ - files_exec_etc_files(rpm_script_t) - files_read_etc_runtime_files(rpm_script_t) - files_exec_usr_files(rpm_script_t) -+files_relabel_all_files(rpm_script_t) - - init_domtrans_script(rpm_script_t) - init_telinit(rpm_script_t) -@@ -324,12 +349,15 @@ +@@ -331,12 +346,15 @@ seutil_domtrans_loadpolicy(rpm_script_t) seutil_domtrans_setfiles(rpm_script_t) seutil_domtrans_semanage(rpm_script_t) @@ -1257,18 +1189,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te ') ') -@@ -342,6 +370,10 @@ - ') - - optional_policy(` -+ dbus_system_bus_client(rpm_script_t) -+') -+ -+optional_policy(` - lvm_domtrans(rpm_script_t) - ') - -@@ -355,8 +387,9 @@ +@@ -366,8 +384,9 @@ ') optional_policy(` @@ -1279,9 +1200,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te optional_policy(` java_domtrans_unconfined(rpm_script_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sectoolm.te serefpolicy-3.8.6/policy/modules/admin/sectoolm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sectoolm.te serefpolicy-3.8.7/policy/modules/admin/sectoolm.te --- nsaserefpolicy/policy/modules/admin/sectoolm.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/sectoolm.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/sectoolm.te 2010-07-14 14:08:02.000000000 -0400 @@ -84,6 +84,7 @@ sysnet_domtrans_ifconfig(sectoolm_t) @@ -1290,9 +1211,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sectool optional_policy(` mount_exec(sectoolm_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewall.if serefpolicy-3.8.6/policy/modules/admin/shorewall.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewall.if serefpolicy-3.8.7/policy/modules/admin/shorewall.if --- nsaserefpolicy/policy/modules/admin/shorewall.if 2010-03-18 10:35:11.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/shorewall.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/shorewall.if 2010-07-14 14:08:02.000000000 -0400 @@ -134,9 +134,10 @@ # interface(`shorewall_admin',` @@ -1322,9 +1243,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewa files_search_tmp($1) admin_pattern($1, shorewall_tmp_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewall.te serefpolicy-3.8.6/policy/modules/admin/shorewall.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewall.te serefpolicy-3.8.7/policy/modules/admin/shorewall.te --- nsaserefpolicy/policy/modules/admin/shorewall.te 2010-06-21 08:21:16.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/shorewall.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/shorewall.te 2010-07-14 14:08:02.000000000 -0400 @@ -80,13 +80,14 @@ init_rw_utmp(shorewall_t) @@ -1341,73 +1262,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shorewa optional_policy(` hostname_exec(shorewall_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shutdown.fc serefpolicy-3.8.6/policy/modules/admin/shutdown.fc ---- nsaserefpolicy/policy/modules/admin/shutdown.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/admin/shutdown.fc 2010-07-12 09:05:35.000000000 -0400 -@@ -0,0 +1,5 @@ -+/etc/nologin -- gen_context(system_u:object_r:shutdown_etc_t,s0) -+ -+/sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0) -+ -+/var/run/shutdown\.pid -- gen_context(system_u:object_r:shutdown_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shutdown.if serefpolicy-3.8.6/policy/modules/admin/shutdown.if ---- nsaserefpolicy/policy/modules/admin/shutdown.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/admin/shutdown.if 2010-07-12 09:05:35.000000000 -0400 -@@ -0,0 +1,136 @@ -+ -+## policy for shutdown -+ -+######################################## -+## -+## Execute a domain transition to run shutdown. -+## -+## -+## -+## Domain allowed to transition. -+## -+## -+# -+interface(`shutdown_domtrans',` -+ gen_require(` -+ type shutdown_t, shutdown_exec_t; -+ ') -+ -+ domtrans_pattern($1, shutdown_exec_t, shutdown_t) -+ -+ ifdef(`hide_broken_symptoms', ` -+ dontaudit shutdown_t $1:socket_class_set { read write }; +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shutdown.if serefpolicy-3.8.7/policy/modules/admin/shutdown.if +--- nsaserefpolicy/policy/modules/admin/shutdown.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/shutdown.if 2010-07-14 14:08:02.000000000 -0400 +@@ -19,10 +19,11 @@ + + ifdef(`hide_broken_symptoms', ` + dontaudit shutdown_t $1:socket_class_set { read write }; +- dontaudit shutdown_t $1:fifo_file { read write }; + dontaudit shutdown_t $1:fifo_file rw_inherited_fifo_file_perms; -+ ') -+') -+ -+ -+######################################## -+## -+## Execute shutdown in the shutdown domain, and -+## allow the specified role the shutdown domain. -+## -+## -+## -+## Domain allowed access -+## -+## -+## -+## -+## The role to be allowed the shutdown domain. -+## -+## -+# -+interface(`shutdown_run',` -+ gen_require(` -+ type shutdown_t; -+ ') -+ -+ shutdown_domtrans($1) -+ role $2 types shutdown_t; -+') + ') + ') + + -+######################################## -+## + ######################################## + ## + ## Execute shutdown in the shutdown domain, and +@@ -50,6 +51,73 @@ + + ######################################## + ## +## Role access for shutdown +## +## @@ -1475,101 +1349,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shutdow + +######################################## +## -+## Get attributes of shutdown executable. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`shutdown_getattr_exec_files',` -+ gen_require(` -+ type shutdown_exec_t; -+ ') -+ -+ allow $1 shutdown_exec_t:file getattr; -+') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shutdown.te serefpolicy-3.8.6/policy/modules/admin/shutdown.te ---- nsaserefpolicy/policy/modules/admin/shutdown.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/admin/shutdown.te 2010-07-12 09:05:35.000000000 -0400 -@@ -0,0 +1,61 @@ -+policy_module(shutdown,1.0.0) -+ -+######################################## -+# -+# Declarations -+# -+ -+type shutdown_t; -+type shutdown_exec_t; -+application_domain(shutdown_t, shutdown_exec_t) -+role system_r types shutdown_t; -+ -+type shutdown_etc_t; -+files_config_file(shutdown_etc_t) -+ -+type shutdown_var_run_t; -+files_pid_file(shutdown_var_run_t) -+ -+######################################## -+# -+# shutdown local policy -+# -+ -+allow shutdown_t self:capability { dac_override kill setuid sys_tty_config }; -+allow shutdown_t self:process { fork signal signull }; -+ -+allow shutdown_t self:fifo_file manage_fifo_file_perms; -+allow shutdown_t self:unix_stream_socket create_stream_socket_perms; -+ -+manage_files_pattern(shutdown_t, shutdown_etc_t, shutdown_etc_t) -+files_etc_filetrans(shutdown_t, shutdown_etc_t, file) -+ -+manage_files_pattern(shutdown_t, shutdown_var_run_t, shutdown_var_run_t) -+files_pid_filetrans(shutdown_t, shutdown_var_run_t, file) -+ -+files_read_etc_files(shutdown_t) -+files_read_generic_pids(shutdown_t) -+ + ## Get attributes of shutdown executable. + ## + ## +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/shutdown.te serefpolicy-3.8.7/policy/modules/admin/shutdown.te +--- nsaserefpolicy/policy/modules/admin/shutdown.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/shutdown.te 2010-07-14 14:08:02.000000000 -0400 +@@ -36,6 +36,8 @@ + files_read_etc_files(shutdown_t) + files_read_generic_pids(shutdown_t) + +mls_file_write_to_clearance(shutdown_t) + -+term_use_all_terms(shutdown_t) -+ -+auth_use_nsswitch(shutdown_t) -+auth_write_login_records(shutdown_t) -+ -+init_dontaudit_write_utmp(shutdown_t) -+init_read_utmp(shutdown_t) -+init_telinit(shutdown_t) -+ -+logging_send_audit_msgs(shutdown_t) -+ -+miscfiles_read_localization(shutdown_t) -+ -+optional_policy(` -+ dbus_system_bus_client(shutdown_t) -+ dbus_connect_system_bus(shutdown_t) -+') -+ -+optional_policy(` -+ xserver_dontaudit_write_log(shutdown_t) -+') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.8.6/policy/modules/admin/sudo.if ---- nsaserefpolicy/policy/modules/admin/sudo.if 2010-06-21 08:21:16.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/sudo.if 2010-07-12 09:05:35.000000000 -0400 -@@ -73,6 +73,10 @@ - # Enter this derived domain from the user domain - domtrans_pattern($3, sudo_exec_t, $1_sudo_t) + term_use_all_terms(shutdown_t) -+ ifdef(`hide_broken_symptoms', ` -+ dontaudit $1_sudo_t $3:socket_class_set { read write }; -+ ') -+ - # By default, revert to the calling domain when a shell is executed. - corecmd_shell_domtrans($1_sudo_t, $3) - corecmd_bin_domtrans($1_sudo_t, $3) -@@ -134,11 +138,11 @@ + auth_use_nsswitch(shutdown_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.8.7/policy/modules/admin/sudo.if +--- nsaserefpolicy/policy/modules/admin/sudo.if 2010-06-21 08:21:16.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/sudo.if 2010-07-14 14:08:02.000000000 -0400 +@@ -134,12 +134,16 @@ userdom_manage_user_tmp_symlinks($1_sudo_t) userdom_use_user_terminals($1_sudo_t) # for some PAM modules and for cwd @@ -1578,16 +1376,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if + userdom_search_admin_dir($1_sudo_t) + userdom_manage_all_users_keys($1_sudo_t) -- ifdef(`hide_broken_symptoms', ` -- dontaudit $1_sudo_t $3:socket_class_set { read write }; -- ') -+ mta_role($2, $1_sudo_t) + ifdef(`hide_broken_symptoms', ` + dontaudit $1_sudo_t $3:socket_class_set { read write }; + ') ++ mta_role($2, $1_sudo_t) ++ tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files($1_sudo_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.8.6/policy/modules/admin/su.if + ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.8.7/policy/modules/admin/su.if --- nsaserefpolicy/policy/modules/admin/su.if 2010-06-21 08:21:16.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/su.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/su.if 2010-07-14 14:08:02.000000000 -0400 @@ -212,7 +212,7 @@ auth_domtrans_chk_passwd($1_su_t) @@ -1605,9 +1405,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s ifdef(`distro_redhat',` # RHEL5 and possibly newer releases incl. Fedora -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.8.6/policy/modules/admin/tmpreaper.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.8.7/policy/modules/admin/tmpreaper.te --- nsaserefpolicy/policy/modules/admin/tmpreaper.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/tmpreaper.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/tmpreaper.te 2010-07-14 14:08:02.000000000 -0400 @@ -25,8 +25,11 @@ files_read_etc_files(tmpreaper_t) files_read_var_lib_files(tmpreaper_t) @@ -1645,86 +1445,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreap rpm_manage_cache(tmpreaper_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.8.6/policy/modules/admin/usermanage.if ---- nsaserefpolicy/policy/modules/admin/usermanage.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/usermanage.if 2010-07-12 09:05:35.000000000 -0400 -@@ -18,6 +18,10 @@ - files_search_usr($1) - corecmd_search_bin($1) - domtrans_pattern($1, chfn_exec_t, chfn_t) -+ -+ifdef(`hide_broken_symptoms', ` -+ dontaudit chfn_t $1:socket_class_set { read write }; -+') - ') - - ######################################## -@@ -63,6 +67,10 @@ - files_search_usr($1) - corecmd_search_bin($1) - domtrans_pattern($1, groupadd_exec_t, groupadd_t) -+ -+ifdef(`hide_broken_symptoms', ` -+ dontaudit groupadd_t $1:socket_class_set { read write }; -+') - ') - - ######################################## -@@ -113,6 +121,10 @@ - files_search_usr($1) - corecmd_search_bin($1) - domtrans_pattern($1, passwd_exec_t, passwd_t) -+ -+ifdef(`hide_broken_symptoms', ` -+ dontaudit passwd_t $1:socket_class_set { read write }; -+') - ') - - ######################################## -@@ -247,6 +259,9 @@ - files_search_usr($1) - corecmd_search_bin($1) - domtrans_pattern($1, useradd_exec_t, useradd_t) -+ifdef(`hide_broken_symptoms', ` -+ dontaudit useradd_t $1:socket_class_set { read write }; -+') - ') - - ######################################## -@@ -274,6 +289,11 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.8.7/policy/modules/admin/usermanage.if +--- nsaserefpolicy/policy/modules/admin/usermanage.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/usermanage.if 2010-07-14 14:08:02.000000000 -0400 +@@ -290,6 +290,9 @@ usermanage_domtrans_useradd($1) role $2 types useradd_t; + # Add/remove user home directories + userdom_manage_home_role($2, useradd_t) + -+ seutil_run_semanage(useradd_t, $2) -+ - optional_policy(` - nscd_run(useradd_t, $2) - ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.8.6/policy/modules/admin/usermanage.te ---- nsaserefpolicy/policy/modules/admin/usermanage.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/usermanage.te 2010-07-12 09:05:35.000000000 -0400 -@@ -208,6 +208,7 @@ - files_manage_etc_files(groupadd_t) - files_relabel_etc_files(groupadd_t) - files_read_etc_runtime_files(groupadd_t) -+files_read_usr_symlinks(groupadd_t) - - # Execute /usr/bin/{passwd, chfn, chsh} and /usr/sbin/{useradd, vipw}. - corecmd_exec_bin(groupadd_t) -@@ -255,7 +256,8 @@ - # Passwd local policy - # + seutil_run_semanage(useradd_t, $2) --allow passwd_t self:capability { chown dac_override fsetid setuid setgid sys_resource }; -+allow passwd_t self:capability { chown dac_override fsetid setuid setgid sys_nice sys_resource }; -+dontaudit passwd_t self:capability sys_tty_config; - allow passwd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; - allow passwd_t self:process { setrlimit setfscreate }; - allow passwd_t self:fd use; -@@ -293,6 +295,7 @@ + optional_policy(` +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.8.7/policy/modules/admin/usermanage.te +--- nsaserefpolicy/policy/modules/admin/usermanage.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/usermanage.te 2010-07-14 14:08:02.000000000 -0400 +@@ -295,6 +295,7 @@ term_use_all_ttys(passwd_t) term_use_all_ptys(passwd_t) @@ -1732,7 +1469,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman auth_domtrans_chk_passwd(passwd_t) auth_manage_shadow(passwd_t) -@@ -302,6 +305,9 @@ +@@ -304,6 +305,9 @@ # allow checking if a shell is executable corecmd_check_exec_shell(passwd_t) @@ -1742,7 +1479,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman domain_use_interactive_fds(passwd_t) -@@ -332,6 +338,7 @@ +@@ -334,6 +338,7 @@ # user generally runs this from their home directory, so do not audit a search # on user home dir userdom_dontaudit_search_user_home_content(passwd_t) @@ -1750,7 +1487,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman optional_policy(` nscd_domtrans(passwd_t) -@@ -426,7 +433,7 @@ +@@ -428,7 +433,7 @@ # Useradd local policy # @@ -1759,15 +1496,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman dontaudit useradd_t self:capability sys_tty_config; allow useradd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow useradd_t self:process setfscreate; -@@ -449,6 +456,7 @@ - corecmd_exec_bin(useradd_t) - - domain_use_interactive_fds(useradd_t) -+domain_read_all_domains_state(useradd_t) - - files_manage_etc_files(useradd_t) - files_search_var_lib(useradd_t) -@@ -497,12 +505,8 @@ +@@ -500,12 +505,8 @@ userdom_use_unpriv_users_fds(useradd_t) # Add/remove user home directories @@ -1781,22 +1510,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman mta_manage_spool(useradd_t) -@@ -526,6 +530,12 @@ - ') - - optional_policy(` -+ tunable_policy(`samba_domain_controller',` -+ samba_append_log(useradd_t) -+ ') -+') -+ -+optional_policy(` - puppet_rw_tmp(useradd_t) - ') - -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.8.6/policy/modules/admin/vbetool.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.8.7/policy/modules/admin/vbetool.te --- nsaserefpolicy/policy/modules/admin/vbetool.te 2010-06-21 08:21:16.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/vbetool.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/vbetool.te 2010-07-14 14:08:02.000000000 -0400 @@ -24,7 +24,10 @@ dev_rw_xserver_misc(vbetool_t) dev_rw_mtrr(vbetool_t) @@ -1808,52 +1524,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool mls_file_read_all_levels(vbetool_t) mls_file_write_all_levels(vbetool_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.if serefpolicy-3.8.6/policy/modules/admin/vpn.if ---- nsaserefpolicy/policy/modules/admin/vpn.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/vpn.if 2010-07-12 09:05:35.000000000 -0400 -@@ -110,7 +110,7 @@ - ## - ## - # --interface(`vpnc_dbus_chat',` -+interface(`vpn_dbus_chat',` - gen_require(` - type vpnc_t; - class dbus send_msg; -@@ -119,3 +119,21 @@ - allow $1 vpnc_t:dbus send_msg; - allow vpnc_t $1:dbus send_msg; - ') -+ -+######################################## -+## -+## Relabelfrom from vpnc socket. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`vpn_relabelfrom_tun_socket',` -+ gen_require(` -+ type boot_t; -+ ') -+ -+ allow $1 vpnc_t:tun_socket relabelfrom; -+') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.8.6/policy/modules/admin/vpn.te ---- nsaserefpolicy/policy/modules/admin/vpn.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/admin/vpn.te 2010-07-12 09:05:35.000000000 -0400 -@@ -30,7 +30,7 @@ - allow vpnc_t self:rawip_socket create_socket_perms; - allow vpnc_t self:unix_dgram_socket create_socket_perms; - allow vpnc_t self:unix_stream_socket create_socket_perms; --allow vpnc_t self:tun_socket create_socket_perms; -+allow vpnc_t self:tun_socket { create_socket_perms relabelfrom }; - # cjp: this needs to be fixed - allow vpnc_t self:socket create_socket_perms; - +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.8.7/policy/modules/admin/vpn.te +--- nsaserefpolicy/policy/modules/admin/vpn.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/admin/vpn.te 2010-07-14 14:08:02.000000000 -0400 @@ -107,6 +107,7 @@ userdom_use_all_users_fds(vpnc_t) @@ -1862,9 +1535,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te optional_policy(` dbus_system_bus_client(vpnc_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.te serefpolicy-3.8.6/policy/modules/apps/awstats.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.te serefpolicy-3.8.7/policy/modules/apps/awstats.te --- nsaserefpolicy/policy/modules/apps/awstats.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/awstats.te 2010-07-12 15:49:38.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/awstats.te 2010-07-14 14:08:02.000000000 -0400 @@ -47,6 +47,7 @@ files_read_etc_files(awstats_t) # e.g. /usr/share/awstats/lang/awstats-en.txt @@ -1873,16 +1546,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats. fs_list_inotifyfs(awstats_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.fc serefpolicy-3.8.6/policy/modules/apps/chrome.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.fc serefpolicy-3.8.7/policy/modules/apps/chrome.fc --- nsaserefpolicy/policy/modules/apps/chrome.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/chrome.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/chrome.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,3 @@ + /opt/google/chrome/chrome-sandbox -- gen_context(system_u:object_r:chrome_sandbox_exec_t,s0) + +/usr/lib(64)?/chromium-browser/chrome-sandbox -- gen_context(system_u:object_r:chrome_sandbox_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.if serefpolicy-3.8.6/policy/modules/apps/chrome.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.if serefpolicy-3.8.7/policy/modules/apps/chrome.if --- nsaserefpolicy/policy/modules/apps/chrome.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/chrome.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/chrome.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,90 @@ + +## policy for chrome @@ -1974,9 +1647,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.i + allow $2 chrome_sandbox_tmpfs_t:file rw_file_perms; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.te serefpolicy-3.8.6/policy/modules/apps/chrome.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.te serefpolicy-3.8.7/policy/modules/apps/chrome.te --- nsaserefpolicy/policy/modules/apps/chrome.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/chrome.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/chrome.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,86 @@ +policy_module(chrome,1.0.0) + @@ -2064,9 +1737,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.t + fs_dontaudit_append_cifs_files(chrome_sandbox_t) + fs_dontaudit_read_cifs_files(chrome_sandbox_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.8.6/policy/modules/apps/cpufreqselector.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.8.7/policy/modules/apps/cpufreqselector.te --- nsaserefpolicy/policy/modules/apps/cpufreqselector.te 2010-06-21 10:50:00.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/cpufreqselector.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/cpufreqselector.te 2010-07-14 14:08:02.000000000 -0400 @@ -27,7 +27,7 @@ miscfiles_read_localization(cpufreqselector_t) @@ -2076,9 +1749,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqs optional_policy(` dbus_system_domain(cpufreqselector_t, cpufreqselector_exec_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.fc serefpolicy-3.8.6/policy/modules/apps/execmem.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.fc serefpolicy-3.8.7/policy/modules/apps/execmem.fc --- nsaserefpolicy/policy/modules/apps/execmem.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/execmem.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/execmem.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,47 @@ + +/usr/bin/aticonfig -- gen_context(system_u:object_r:execmem_exec_t,s0) @@ -2127,9 +1800,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem. +/opt/google/chrome/chrome -- gen_context(system_u:object_r:execmem_exec_t,s0) +/opt/google/chrome/google-chrome -- gen_context(system_u:object_r:execmem_exec_t,s0) +/opt/Komodo-Edit-5/lib/mozilla/komodo-bin -- gen_context(system_u:object_r:execmem_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.if serefpolicy-3.8.6/policy/modules/apps/execmem.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.if serefpolicy-3.8.7/policy/modules/apps/execmem.if --- nsaserefpolicy/policy/modules/apps/execmem.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/execmem.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/execmem.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,110 @@ +## execmem domain + @@ -2241,9 +1914,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem. + + domtrans_pattern($1, execmem_exec_t, $2) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.te serefpolicy-3.8.6/policy/modules/apps/execmem.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.te serefpolicy-3.8.7/policy/modules/apps/execmem.te --- nsaserefpolicy/policy/modules/apps/execmem.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/execmem.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/execmem.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,10 @@ +policy_module(execmem, 1.0.0) + @@ -2255,16 +1928,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem. +type execmem_exec_t alias unconfined_execmem_exec_t; +application_executable_file(execmem_exec_t) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewallgui.fc serefpolicy-3.8.6/policy/modules/apps/firewallgui.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewallgui.fc serefpolicy-3.8.7/policy/modules/apps/firewallgui.fc --- nsaserefpolicy/policy/modules/apps/firewallgui.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/firewallgui.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/firewallgui.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,3 @@ + +/usr/share/system-config-firewall/system-config-firewall-mechanism.py -- gen_context(system_u:object_r:firewallgui_exec_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewallgui.if serefpolicy-3.8.6/policy/modules/apps/firewallgui.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewallgui.if serefpolicy-3.8.7/policy/modules/apps/firewallgui.if --- nsaserefpolicy/policy/modules/apps/firewallgui.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/firewallgui.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/firewallgui.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,23 @@ + +## policy for firewallgui @@ -2289,10 +1962,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewall + allow $1 firewallgui_t:dbus send_msg; + allow firewallgui_t $1:dbus send_msg; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewallgui.te serefpolicy-3.8.6/policy/modules/apps/firewallgui.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewallgui.te serefpolicy-3.8.7/policy/modules/apps/firewallgui.te --- nsaserefpolicy/policy/modules/apps/firewallgui.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/firewallgui.te 2010-07-12 09:05:35.000000000 -0400 -@@ -0,0 +1,65 @@ ++++ serefpolicy-3.8.7/policy/modules/apps/firewallgui.te 2010-07-14 14:08:02.000000000 -0400 +@@ -0,0 +1,66 @@ +policy_module(firewallgui,1.0.0) + +######################################## @@ -2331,6 +2004,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewall +kernel_read_network_state(firewallgui_t) +kernel_rw_net_sysctls(firewallgui_t) +kernel_rw_kernel_sysctl(firewallgui_t) ++kernel_rw_vm_sysctls(firewallgui_t) + +files_read_etc_files(firewallgui_t) +files_read_usr_files(firewallgui_t) @@ -2358,52 +2032,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/firewall + policykit_dbus_chat(firewallgui_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.fc serefpolicy-3.8.6/policy/modules/apps/gitosis.fc ---- nsaserefpolicy/policy/modules/apps/gitosis.fc 2009-09-09 09:23:16.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/gitosis.fc 2010-07-12 09:05:35.000000000 -0400 -@@ -1,3 +1,5 @@ - /usr/bin/gitosis-serve -- gen_context(system_u:object_r:gitosis_exec_t,s0) -+/usr/bin/gl-auth-command -- gen_context(system_u:object_r:gitosis_exec_t,s0) - - /var/lib/gitosis(/.*)? gen_context(system_u:object_r:gitosis_var_lib_t,s0) -+/var/lib/gitolite(/.*)? gen_context(system_u:object_r:gitosis_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.if serefpolicy-3.8.6/policy/modules/apps/gitosis.if ---- nsaserefpolicy/policy/modules/apps/gitosis.if 2010-03-23 10:55:15.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/gitosis.if 2010-07-12 09:05:35.000000000 -0400 -@@ -62,7 +62,7 @@ - files_search_var_lib($1) - read_files_pattern($1, gitosis_var_lib_t, gitosis_var_lib_t) - read_lnk_files_pattern($1, gitosis_var_lib_t, gitosis_var_lib_t) -- list_dirs_pattern(%1, gitosis_var_lib_t, gitosis_var_lib_t) -+ list_dirs_pattern($1, gitosis_var_lib_t, gitosis_var_lib_t) - ') - - ###################################### -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.te serefpolicy-3.8.6/policy/modules/apps/gitosis.te ---- nsaserefpolicy/policy/modules/apps/gitosis.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/gitosis.te 2010-07-12 09:05:35.000000000 -0400 -@@ -25,12 +25,17 @@ - manage_lnk_files_pattern(gitosis_t, gitosis_var_lib_t, gitosis_var_lib_t) - manage_dirs_pattern(gitosis_t, gitosis_var_lib_t, gitosis_var_lib_t) - -+kernel_read_system_state(gitosis_t) -+ - corecmd_exec_bin(gitosis_t) - corecmd_exec_shell(gitosis_t) - --kernel_read_system_state(gitosis_t) -+dev_read_urand(gitosis_t) - -+files_read_etc_files(gitosis_t) - files_read_usr_files(gitosis_t) - files_search_var_lib(gitosis_t) - - miscfiles_read_localization(gitosis_t) -+ -+sysnet_read_config(gitosis_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.8.6/policy/modules/apps/gnome.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.8.7/policy/modules/apps/gnome.fc --- nsaserefpolicy/policy/modules/apps/gnome.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/gnome.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/gnome.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,8 +1,28 @@ -HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:gnome_home_t,s0) +HOME_DIR/\.cache(/.*)? gen_context(system_u:object_r:cache_home_t,s0) @@ -2435,9 +2066,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc + +/usr/libexec/gnome-system-monitor-mechanism -- gen_context(system_u:object_r:gnomesystemmm_exec_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.8.6/policy/modules/apps/gnome.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.8.7/policy/modules/apps/gnome.if --- nsaserefpolicy/policy/modules/apps/gnome.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/gnome.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/gnome.if 2010-07-14 14:53:47.000000000 -0400 @@ -74,6 +74,24 @@ ######################################## @@ -2892,9 +2523,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if + allow $1 gconfdefaultsm_t:dbus send_msg; + allow gconfdefaultsm_t $1:dbus send_msg; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.8.6/policy/modules/apps/gnome.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.8.7/policy/modules/apps/gnome.te --- nsaserefpolicy/policy/modules/apps/gnome.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/gnome.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/gnome.te 2010-07-14 14:08:02.000000000 -0400 @@ -6,18 +6,33 @@ # @@ -3045,31 +2676,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te + policykit_read_lib(gnomesystemmm_t) + policykit_read_reload(gnomesystemmm_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-3.8.6/policy/modules/apps/gpg.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-3.8.7/policy/modules/apps/gpg.fc --- nsaserefpolicy/policy/modules/apps/gpg.fc 2009-07-23 14:11:04.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/gpg.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/gpg.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,4 +1,5 @@ HOME_DIR/\.gnupg(/.+)? gen_context(system_u:object_r:gpg_secret_t,s0) +/root/\.gnupg(/.+)? gen_context(system_u:object_r:gpg_secret_t,s0) /usr/bin/gpg(2)? -- gen_context(system_u:object_r:gpg_exec_t,s0) /usr/bin/gpg-agent -- gen_context(system_u:object_r:gpg_agent_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if serefpolicy-3.8.6/policy/modules/apps/gpg.if ---- nsaserefpolicy/policy/modules/apps/gpg.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/gpg.if 2010-07-12 09:05:35.000000000 -0400 -@@ -60,8 +60,10 @@ - - ifdef(`hide_broken_symptoms',` - #Leaked File Descriptors -- dontaudit gpg_t $2:socket_class_set { read write }; -+ dontaudit gpg_t $2:socket_class_set { getattr read write }; - dontaudit gpg_t $2:fifo_file rw_fifo_file_perms; -+ dontaudit gpg_agent_t $2:socket_class_set { getattr read write }; -+ dontaudit gpg_agent_t $2:fifo_file rw_fifo_file_perms; - ') - ') - -@@ -83,6 +85,43 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if serefpolicy-3.8.7/policy/modules/apps/gpg.if +--- nsaserefpolicy/policy/modules/apps/gpg.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/gpg.if 2010-07-14 14:08:02.000000000 -0400 +@@ -85,6 +85,43 @@ domtrans_pattern($1, gpg_exec_t, gpg_t) ') @@ -3113,9 +2732,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if s ######################################## ## ## Send generic signals to user gpg processes. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.8.6/policy/modules/apps/gpg.te ---- nsaserefpolicy/policy/modules/apps/gpg.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/gpg.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.8.7/policy/modules/apps/gpg.te +--- nsaserefpolicy/policy/modules/apps/gpg.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/gpg.te 2010-07-14 14:08:02.000000000 -0400 @@ -4,6 +4,7 @@ # # Declarations @@ -3201,63 +2820,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s # rlimit: gpg-agent wants to prevent coredumps allow gpg_agent_t self:process setrlimit; -@@ -223,12 +240,17 @@ - manage_sock_files_pattern(gpg_agent_t, gpg_agent_tmp_t, gpg_agent_tmp_t) - files_tmp_filetrans(gpg_agent_t, gpg_agent_tmp_t, { file sock_file dir }) +@@ -245,6 +262,7 @@ -+fs_dontaudit_list_inotifyfs(gpg_agent_t) -+ - # allow gpg to connect to the gpg agent - stream_connect_pattern(gpg_t, gpg_agent_tmp_t, gpg_agent_tmp_t, gpg_agent_t) - -+corecmd_read_bin_symlinks(gpg_agent_t) - corecmd_search_bin(gpg_agent_t) - corecmd_exec_shell(gpg_agent_t) - -+dev_read_urand(gpg_agent_t) -+ - domain_use_interactive_fds(gpg_agent_t) - - miscfiles_read_localization(gpg_agent_t) -@@ -237,6 +259,10 @@ - userdom_use_user_terminals(gpg_agent_t) - # read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d ) - userdom_search_user_home_dirs(gpg_agent_t) -+ifdef(`hide_broken_symptoms',` -+ userdom_dontaudit_read_user_tmp_files(gpg_agent_t) + ifdef(`hide_broken_symptoms',` + userdom_dontaudit_read_user_tmp_files(gpg_agent_t) + userdom_dontaudit_write_user_tmp_files(gpg_agent_t) -+') - - tunable_policy(`gpg_agent_env_file',` - # write ~/.gpg-agent-info or a similar to the users home dir -@@ -259,6 +285,10 @@ - fs_manage_cifs_symlinks(gpg_agent_t) ') -+optional_policy(` -+ mozilla_dontaudit_rw_user_home_files(gpg_agent_t) -+') -+ - ############################## - # - # Pinentry local policy -@@ -285,6 +315,7 @@ - manage_files_pattern(gpg_pinentry_t, gpg_pinentry_tmpfs_t, gpg_pinentry_tmpfs_t) - fs_tmpfs_filetrans(gpg_pinentry_t, gpg_pinentry_tmpfs_t, { file dir }) - fs_getattr_tmpfs(gpg_pinentry_t) -+fs_dontaudit_list_inotifyfs(gpg_pinentry_t) - - # read /proc/meminfo - kernel_read_system_state(gpg_pinentry_t) -@@ -309,12 +340,17 @@ - - logging_send_syslog_msg(gpg_pinentry_t) - -+auth_use_nsswitch(gpg_pinentry_t) -+ - miscfiles_read_fonts(gpg_pinentry_t) - miscfiles_read_localization(gpg_pinentry_t) - + tunable_policy(`gpg_agent_env_file',` +@@ -332,6 +350,9 @@ # for .Xauthority userdom_read_user_home_content_files(gpg_pinentry_t) userdom_read_user_tmpfs_files(gpg_pinentry_t) @@ -3267,7 +2838,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s tunable_policy(`use_nfs_home_dirs',` fs_read_nfs_files(gpg_pinentry_t) -@@ -330,11 +366,40 @@ +@@ -347,6 +368,12 @@ ') optional_policy(` @@ -3278,11 +2849,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s + +optional_policy(` pulseaudio_exec(gpg_pinentry_t) -+ pulseaudio_rw_home_files(gpg_pinentry_t) + pulseaudio_rw_home_files(gpg_pinentry_t) pulseaudio_setattr_home_dir(gpg_pinentry_t) - pulseaudio_stream_connect(gpg_pinentry_t) -+ pulseaudio_signull(gpg_pinentry_t) - ') +@@ -356,4 +383,25 @@ optional_policy(` xserver_user_x_domain_template(gpg_pinentry, gpg_pinentry_t, gpg_pinentry_tmpfs_t) @@ -3308,9 +2877,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s +tunable_policy(`gpg_web_anon_write',` + miscfiles_manage_public_files(gpg_web_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.fc serefpolicy-3.8.6/policy/modules/apps/irc.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.fc serefpolicy-3.8.7/policy/modules/apps/irc.fc --- nsaserefpolicy/policy/modules/apps/irc.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/irc.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/irc.fc 2010-07-14 14:08:02.000000000 -0400 @@ -2,10 +2,14 @@ # /home # @@ -3326,9 +2895,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.fc s /usr/bin/ircII -- gen_context(system_u:object_r:irc_exec_t,s0) +/usr/bin/irssi -- gen_context(system_u:object_r:irssi_exec_t,s0) /usr/bin/tinyirc -- gen_context(system_u:object_r:irc_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.if serefpolicy-3.8.6/policy/modules/apps/irc.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.if serefpolicy-3.8.7/policy/modules/apps/irc.if --- nsaserefpolicy/policy/modules/apps/irc.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/irc.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/irc.if 2010-07-14 14:08:02.000000000 -0400 @@ -18,9 +18,11 @@ interface(`irc_role',` gen_require(` @@ -3359,9 +2928,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.if s + relabel_files_pattern($2, irssi_home_t, irssi_home_t) + relabel_lnk_files_pattern($2, irssi_home_t, irssi_home_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.te serefpolicy-3.8.6/policy/modules/apps/irc.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.te serefpolicy-3.8.7/policy/modules/apps/irc.te --- nsaserefpolicy/policy/modules/apps/irc.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/irc.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/irc.te 2010-07-14 14:08:02.000000000 -0400 @@ -24,6 +24,30 @@ ######################################## @@ -3477,9 +3046,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.te s + nis_use_ypbind(irssi_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.8.6/policy/modules/apps/java.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.8.7/policy/modules/apps/java.fc --- nsaserefpolicy/policy/modules/apps/java.fc 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/java.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/java.fc 2010-07-14 14:08:02.000000000 -0400 @@ -9,6 +9,7 @@ # # /usr @@ -3497,17 +3066,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc ifdef(`distro_redhat',` /usr/java/eclipse[^/]*/eclipse -- gen_context(system_u:object_r:java_exec_t,s0) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.8.6/policy/modules/apps/java.if ---- nsaserefpolicy/policy/modules/apps/java.if 2010-02-22 08:30:53.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/java.if 2010-07-12 09:05:35.000000000 -0400 -@@ -72,6 +72,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.8.7/policy/modules/apps/java.if +--- nsaserefpolicy/policy/modules/apps/java.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/java.if 2010-07-14 14:08:02.000000000 -0400 +@@ -72,7 +72,8 @@ domain_interactive_fd($1_java_t) +- userdom_manage_user_tmpfs_files($1_java_t) + userdom_unpriv_usertype($1, $1_java_t) - userdom_manage_tmpfs_role($2, $1_java_t) ++ userdom_manage_tmpfs_role($2, $1_java_t) allow $1_java_t self:process { ptrace signal getsched execmem execstack }; + @@ -82,7 +83,7 @@ domtrans_pattern($3, java_exec_t, $1_java_t) @@ -3525,10 +3096,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.8.6/policy/modules/apps/java.te ---- nsaserefpolicy/policy/modules/apps/java.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/java.te 2010-07-12 09:05:35.000000000 -0400 -@@ -152,6 +152,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.8.7/policy/modules/apps/java.te +--- nsaserefpolicy/policy/modules/apps/java.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/java.te 2010-07-14 14:08:02.000000000 -0400 +@@ -82,6 +82,7 @@ + dev_read_rand(java_t) + dev_dontaudit_append_rand(java_t) + ++files_read_etc_files(java_t) + files_read_usr_files(java_t) + files_search_home(java_t) + files_search_var_lib(java_t) +@@ -143,12 +144,15 @@ + # execheap is needed for itanium/BEA jrocket + allow unconfined_java_t self:process { execstack execmem execheap }; + ++ init_dbus_chat_script(unconfined_java_t) ++ + files_execmod_all_files(unconfined_java_t) + + init_dbus_chat_script(unconfined_java_t) unconfined_domain_noaudit(unconfined_java_t) unconfined_dbus_chat(unconfined_java_t) @@ -3536,21 +3123,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te optional_policy(` rpm_domtrans(unconfined_java_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.fc serefpolicy-3.8.6/policy/modules/apps/kdumpgui.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.fc serefpolicy-3.8.7/policy/modules/apps/kdumpgui.fc --- nsaserefpolicy/policy/modules/apps/kdumpgui.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/kdumpgui.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/kdumpgui.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,2 @@ + +/usr/share/system-config-kdump/system-config-kdump-backend.py -- gen_context(system_u:object_r:kdumpgui_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.if serefpolicy-3.8.6/policy/modules/apps/kdumpgui.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.if serefpolicy-3.8.7/policy/modules/apps/kdumpgui.if --- nsaserefpolicy/policy/modules/apps/kdumpgui.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/kdumpgui.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/kdumpgui.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,2 @@ +## system-config-kdump policy + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.te serefpolicy-3.8.6/policy/modules/apps/kdumpgui.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.te serefpolicy-3.8.7/policy/modules/apps/kdumpgui.te --- nsaserefpolicy/policy/modules/apps/kdumpgui.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/kdumpgui.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/kdumpgui.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,68 @@ +policy_module(kdumpgui,1.0.0) + @@ -3605,143 +3192,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui + +miscfiles_read_localization(kdumpgui_t) + -+init_dontaudit_read_all_script_files(kdumpgui_t) -+ -+userdom_dontaudit_search_admin_dir(kdumpgui_t) -+ -+optional_policy(` -+ dev_rw_lvm_control(kdumpgui_t) -+') -+ -+optional_policy(` -+ gnome_dontaudit_search_config(kdumpgui_t) -+') -+ -+optional_policy(` -+ policykit_dbus_chat(kdumpgui_t) -+') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.fc serefpolicy-3.8.6/policy/modules/apps/livecd.fc ---- nsaserefpolicy/policy/modules/apps/livecd.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/livecd.fc 2010-07-12 09:05:35.000000000 -0400 -@@ -0,0 +1,2 @@ -+ -+/usr/bin/livecd-creator -- gen_context(system_u:object_r:livecd_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.if serefpolicy-3.8.6/policy/modules/apps/livecd.if ---- nsaserefpolicy/policy/modules/apps/livecd.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/livecd.if 2010-07-12 09:05:35.000000000 -0400 -@@ -0,0 +1,127 @@ -+ -+## policy for livecd -+ -+######################################## -+## -+## Execute a domain transition to run livecd. -+## -+## -+## -+## Domain allowed to transition. -+## -+## -+# -+interface(`livecd_domtrans',` -+ gen_require(` -+ type livecd_t; -+ type livecd_exec_t; -+ ') -+ -+ domtrans_pattern($1, livecd_exec_t, livecd_t) -+') -+ -+######################################## -+## -+## Execute livecd in the livecd domain, and -+## allow the specified role the livecd domain. -+## -+## -+## -+## Domain allowed access -+## -+## -+## -+## -+## The role to be allowed the livecd domain. -+## -+## -+# -+interface(`livecd_run',` -+ gen_require(` -+ type livecd_t; -+ ') -+ -+ livecd_domtrans($1) -+ role $2 types livecd_t; -+ -+ seutil_run_setfiles_mac(livecd_t, $2) -+ -+ optional_policy(` -+ mount_run(livecd_t, $2) -+ ') -+') -+ -+######################################## -+## -+## Dontaudit read/write to a livecd leaks -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`livecd_dontaudit_leaks',` -+ gen_require(` -+ type livecd_t; -+ ') -+ -+ dontaudit $1 livecd_t:unix_dgram_socket { read write }; -+') -+ -+######################################## -+## -+## Read livecd temporary files. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`livecd_read_tmp_files',` -+ gen_require(` -+ type livecd_tmp_t; -+ ') -+ -+ files_search_tmp($1) -+ read_files_pattern($1, livecd_tmp_t, livecd_tmp_t) -+') -+ -+######################################## -+## -+## Read and write livecd temporary files. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`livecd_rw_tmp_files',` -+ gen_require(` -+ type livecd_tmp_t; -+ ') -+ -+ files_search_tmp($1) -+ allow $1 livecd_tmp_t:file rw_file_perms; ++init_dontaudit_read_all_script_files(kdumpgui_t) ++ ++userdom_dontaudit_search_admin_dir(kdumpgui_t) ++ ++optional_policy(` ++ dev_rw_lvm_control(kdumpgui_t) +') + -+######################################## -+## -+## Allow read and write access to livecd semaphores. ++optional_policy(` ++ gnome_dontaudit_search_config(kdumpgui_t) ++') ++ ++optional_policy(` ++ policykit_dbus_chat(kdumpgui_t) ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.if serefpolicy-3.8.7/policy/modules/apps/livecd.if +--- nsaserefpolicy/policy/modules/apps/livecd.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/livecd.if 2010-07-14 14:08:02.000000000 -0400 +@@ -41,6 +41,8 @@ + + livecd_domtrans($1) + role $2 types livecd_t; ++ ++ seutil_run_setfiles_mac(livecd_t, $2) + + optional_policy(` + mount_run(livecd_t, $2) +@@ -49,6 +51,24 @@ + + ######################################## + ## ++## Dontaudit read/write to a livecd leaks +## +## +## @@ -3749,79 +3231,69 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.i +## +## +# -+interface(`livecd_rw_semaphores',` ++interface(`livecd_dontaudit_leaks',` + gen_require(` + type livecd_t; + ') + -+ allow $1 livecd_t:sem { unix_read unix_write associate read write }; ++ dontaudit $1 livecd_t:unix_dgram_socket { read write }; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.te serefpolicy-3.8.6/policy/modules/apps/livecd.te ---- nsaserefpolicy/policy/modules/apps/livecd.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/livecd.te 2010-07-12 09:05:35.000000000 -0400 -@@ -0,0 +1,34 @@ -+policy_module(livecd, 1.0.0) -+ -+######################################## -+# -+# Declarations -+# -+ -+type livecd_t; -+type livecd_exec_t; -+application_domain(livecd_t, livecd_exec_t) -+role system_r types livecd_t; -+ -+type livecd_tmp_t; -+files_tmp_file(livecd_tmp_t) -+ +######################################## -+# -+# livecd local policy -+# -+dontaudit livecd_t self:capability2 mac_admin; -+ ++## + ## Read livecd temporary files. + ## + ## +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.te serefpolicy-3.8.7/policy/modules/apps/livecd.te +--- nsaserefpolicy/policy/modules/apps/livecd.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/livecd.te 2010-07-14 14:08:02.000000000 -0400 +@@ -20,6 +20,7 @@ + + dontaudit livecd_t self:capability2 mac_admin; + +unconfined_domain_noaudit(livecd_t) -+domain_ptrace_all_domains(livecd_t) -+ -+manage_dirs_pattern(livecd_t, livecd_tmp_t, livecd_tmp_t) -+manage_files_pattern(livecd_t, livecd_tmp_t, livecd_tmp_t) -+files_tmp_filetrans(livecd_t, livecd_tmp_t, { dir file }) -+ -+optional_policy(` -+ hal_dbus_chat(livecd_t) -+') -+ -+seutil_domtrans_setfiles_mac(livecd_t) + domain_ptrace_all_domains(livecd_t) + + manage_dirs_pattern(livecd_t, livecd_tmp_t, livecd_tmp_t) +@@ -27,9 +28,6 @@ + files_tmp_filetrans(livecd_t, livecd_tmp_t, { dir file }) + + optional_policy(` +- unconfined_domain(livecd_t) +-') +- +-optional_policy(` + hal_dbus_chat(livecd_t) + ') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.8.6/policy/modules/apps/mono.if ---- nsaserefpolicy/policy/modules/apps/mono.if 2010-02-22 08:30:53.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/mono.if 2010-07-12 09:05:35.000000000 -0400 -@@ -40,16 +40,19 @@ - domain_interactive_fd($1_mono_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.8.7/policy/modules/apps/mono.if +--- nsaserefpolicy/policy/modules/apps/mono.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/mono.if 2010-07-14 14:08:02.000000000 -0400 +@@ -41,15 +41,18 @@ application_type($1_mono_t) -+ userdom_unpriv_usertype($1, $1_mono_t) - userdom_manage_tmpfs_role($2, $1_mono_t) - allow $1_mono_t self:process { ptrace signal getsched execheap execmem execstack }; - allow $3 $1_mono_t:process { getattr ptrace noatsecure signal_perms }; ++ userdom_unpriv_usertype($1, $1_mono_t) ++ userdom_manage_tmpfs_role($2, $1_mono_t) ++ domtrans_pattern($3, mono_exec_t, $1_mono_t) fs_dontaudit_rw_tmpfs_files($1_mono_t) corecmd_bin_domtrans($1_mono_t, $1_t) -+ifdef(`hide_broken_symptoms', ` -+ dontaudit $1_t $1_mono_t:socket_class_set { read write }; -+') +- +- userdom_manage_user_tmpfs_files($1_mono_t) ++ ifdef(`hide_broken_symptoms', ` ++ dontaudit $1_t $1_mono_t:socket_class_set { read write }; ++ ') optional_policy(` xserver_role($1_r, $1_mono_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.fc serefpolicy-3.8.6/policy/modules/apps/mozilla.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.fc serefpolicy-3.8.7/policy/modules/apps/mozilla.fc --- nsaserefpolicy/policy/modules/apps/mozilla.fc 2010-06-21 10:50:00.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/mozilla.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/mozilla.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,6 +1,7 @@ HOME_DIR/\.galeon(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) HOME_DIR/\.java(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) @@ -3830,9 +3302,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. HOME_DIR/\.netscape(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.8.6/policy/modules/apps/mozilla.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.8.7/policy/modules/apps/mozilla.if --- nsaserefpolicy/policy/modules/apps/mozilla.if 2010-06-21 10:50:00.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/mozilla.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/mozilla.if 2010-07-14 14:08:02.000000000 -0400 @@ -48,6 +48,12 @@ mozilla_dbus_chat($2) @@ -3855,10 +3327,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.8.6/policy/modules/apps/mozilla.te ---- nsaserefpolicy/policy/modules/apps/mozilla.te 2010-06-21 10:50:00.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/mozilla.te 2010-07-12 09:05:35.000000000 -0400 -@@ -90,6 +90,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.8.7/policy/modules/apps/mozilla.te +--- nsaserefpolicy/policy/modules/apps/mozilla.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/mozilla.te 2010-07-14 14:08:02.000000000 -0400 +@@ -25,6 +25,7 @@ + type mozilla_home_t; + typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t }; + typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t }; ++files_poly_member(mozilla_home_t) + userdom_user_home_content(mozilla_home_t) + + type mozilla_tmpfs_t; +@@ -89,6 +90,7 @@ corenet_raw_sendrecv_generic_node(mozilla_t) corenet_tcp_sendrecv_http_port(mozilla_t) corenet_tcp_sendrecv_http_cache_port(mozilla_t) @@ -3866,7 +3346,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. corenet_tcp_sendrecv_ftp_port(mozilla_t) corenet_tcp_sendrecv_ipp_port(mozilla_t) corenet_tcp_connect_http_port(mozilla_t) -@@ -239,6 +240,7 @@ +@@ -238,6 +240,7 @@ optional_policy(` gnome_stream_connect_gconf(mozilla_t) gnome_manage_config(mozilla_t) @@ -3874,7 +3354,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') optional_policy(` -@@ -259,6 +261,11 @@ +@@ -258,6 +261,11 @@ ') optional_policy(` @@ -3886,9 +3366,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. pulseaudio_exec(mozilla_t) pulseaudio_stream_connect(mozilla_t) pulseaudio_manage_home_files(mozilla_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.if serefpolicy-3.8.6/policy/modules/apps/mplayer.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.if serefpolicy-3.8.7/policy/modules/apps/mplayer.if --- nsaserefpolicy/policy/modules/apps/mplayer.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/mplayer.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/mplayer.if 2010-07-14 14:08:02.000000000 -0400 @@ -102,3 +102,39 @@ read_files_pattern($1, mplayer_home_t, mplayer_home_t) userdom_search_user_home_dirs($1) @@ -3929,10 +3409,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer. + allow $2 mplayer_exec_t:file entrypoint; + domtrans_pattern($1, mplayer_exec_t, $2) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.te serefpolicy-3.8.6/policy/modules/apps/mplayer.te ---- nsaserefpolicy/policy/modules/apps/mplayer.te 2010-06-21 10:50:00.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/mplayer.te 2010-07-12 09:05:35.000000000 -0400 -@@ -160,6 +160,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.te serefpolicy-3.8.7/policy/modules/apps/mplayer.te +--- nsaserefpolicy/policy/modules/apps/mplayer.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/mplayer.te 2010-07-14 14:08:02.000000000 -0400 +@@ -32,6 +32,7 @@ + type mplayer_home_t; + typealias mplayer_home_t alias { user_mplayer_home_t staff_mplayer_home_t sysadm_mplayer_home_t }; + typealias mplayer_home_t alias { auditadm_mplayer_home_t secadm_mplayer_home_t }; ++files_poly_member(mplayer_home_t) + userdom_user_home_content(mplayer_home_t) + + type mplayer_tmpfs_t; +@@ -159,6 +160,7 @@ manage_files_pattern(mplayer_t, mplayer_home_t, mplayer_home_t) manage_lnk_files_pattern(mplayer_t, mplayer_home_t, mplayer_home_t) userdom_user_home_dir_filetrans(mplayer_t, mplayer_home_t, dir) @@ -3940,7 +3428,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer. manage_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t) manage_lnk_files_pattern(mplayer_t, mplayer_tmpfs_t, mplayer_tmpfs_t) -@@ -223,6 +224,8 @@ +@@ -222,6 +224,8 @@ fs_search_auto_mountpoints(mplayer_t) fs_list_inotifyfs(mplayer_t) @@ -3949,7 +3437,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer. miscfiles_read_localization(mplayer_t) miscfiles_read_fonts(mplayer_t) -@@ -303,6 +306,10 @@ +@@ -302,6 +306,10 @@ ') optional_policy(` @@ -3960,14 +3448,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer. nscd_socket_use(mplayer_t) ') -@@ -310,3 +317,4 @@ - pulseaudio_exec(mplayer_t) - pulseaudio_stream_connect(mplayer_t) - ') -+ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.fc serefpolicy-3.8.6/policy/modules/apps/nsplugin.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.fc serefpolicy-3.8.7/policy/modules/apps/nsplugin.fc --- nsaserefpolicy/policy/modules/apps/nsplugin.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/nsplugin.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/nsplugin.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,10 @@ +HOME_DIR/\.adobe(/.*)? gen_context(system_u:object_r:nsplugin_home_t,s0) +HOME_DIR/\.macromedia(/.*)? gen_context(system_u:object_r:nsplugin_home_t,s0) @@ -3979,9 +3462,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin +/usr/lib(64)?/nspluginwrapper/npviewer.bin -- gen_context(system_u:object_r:nsplugin_exec_t,s0) +/usr/lib(64)?/nspluginwrapper/plugin-config -- gen_context(system_u:object_r:nsplugin_config_exec_t,s0) +/usr/lib(64)?/mozilla/plugins-wrapped(/.*)? gen_context(system_u:object_r:nsplugin_rw_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.if serefpolicy-3.8.6/policy/modules/apps/nsplugin.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.if serefpolicy-3.8.7/policy/modules/apps/nsplugin.if --- nsaserefpolicy/policy/modules/apps/nsplugin.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/nsplugin.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/nsplugin.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,391 @@ + +## policy for nsplugin @@ -4374,9 +3857,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin + allow $2 nsplugin_exec_t:file entrypoint; + domtrans_pattern($1, nsplugin_exec_t, $2) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.8.6/policy/modules/apps/nsplugin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.8.7/policy/modules/apps/nsplugin.te --- nsaserefpolicy/policy/modules/apps/nsplugin.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/nsplugin.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/nsplugin.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,299 @@ +policy_module(nsplugin, 1.0.0) + @@ -4677,17 +4160,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin +') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.fc serefpolicy-3.8.6/policy/modules/apps/openoffice.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.fc serefpolicy-3.8.7/policy/modules/apps/openoffice.fc --- nsaserefpolicy/policy/modules/apps/openoffice.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/openoffice.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/openoffice.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,4 @@ +/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0) +/usr/lib64/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0) +/opt/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.if serefpolicy-3.8.6/policy/modules/apps/openoffice.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.if serefpolicy-3.8.7/policy/modules/apps/openoffice.if --- nsaserefpolicy/policy/modules/apps/openoffice.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/openoffice.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/openoffice.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,129 @@ +## Openoffice + @@ -4818,9 +4301,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffi + allow $2 openoffice_exec_t:file entrypoint; + domtrans_pattern($1, openoffice_exec_t, $2) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.te serefpolicy-3.8.6/policy/modules/apps/openoffice.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.te serefpolicy-3.8.7/policy/modules/apps/openoffice.te --- nsaserefpolicy/policy/modules/apps/openoffice.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/openoffice.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/openoffice.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,16 @@ +policy_module(openoffice, 1.0.0) + @@ -4838,115 +4321,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffi +# Unconfined java local policy +# + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/podsleuth.te serefpolicy-3.8.6/policy/modules/apps/podsleuth.te ---- nsaserefpolicy/policy/modules/apps/podsleuth.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/podsleuth.te 2010-07-12 09:05:35.000000000 -0400 -@@ -49,6 +49,7 @@ - fs_tmpfs_filetrans(podsleuth_t, podsleuth_tmpfs_t, { dir file lnk_file }) - - kernel_read_system_state(podsleuth_t) -+kernel_request_load_module(podsleuth_t) - - corecmd_exec_bin(podsleuth_t) - -@@ -65,12 +66,14 @@ - fs_search_dos(podsleuth_t) - fs_getattr_tmpfs(podsleuth_t) - fs_list_tmpfs(podsleuth_t) -+fs_rw_removable_blk_files(podsleuth_t) - - miscfiles_read_localization(podsleuth_t) - - sysnet_dns_name_resolve(podsleuth_t) - - userdom_signal_unpriv_users(podsleuth_t) -+userdom_read_user_tmpfs_files(podsleuth_t) - - optional_policy(` - dbus_system_bus_client(podsleuth_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.8.6/policy/modules/apps/pulseaudio.if ---- nsaserefpolicy/policy/modules/apps/pulseaudio.if 2010-03-29 15:04:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/pulseaudio.if 2010-07-12 09:05:35.000000000 -0400 -@@ -104,6 +104,24 @@ - can_exec($1, pulseaudio_exec_t) - ') - -+######################################## -+## -+## dontaudit attempts to execute a pulseaudio in the current domain. -+## -+## -+## -+## Domain allowed to transition. -+## -+## -+# -+interface(`pulseaudio_dontaudit_exec',` -+ gen_require(` -+ type pulseaudio_exec_t; -+ ') -+ -+ dontaudit $1 pulseaudio_exec_t:file execute; -+') -+ - ##################################### - ## - ## Connect to pulseaudio over a unix domain -@@ -186,6 +204,25 @@ - - ######################################## - ## -+## Read and write Pulse Audio files. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`pulseaudio_rw_home_files',` -+ gen_require(` -+ type pulseaudio_home_t; -+ ') -+ -+ rw_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t) -+ userdom_search_user_home_dirs($1) -+') -+ -+######################################## -+## - ## Create, read, write, and delete pulseaudio - ## home directory files. - ## -@@ -202,4 +239,24 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.8.7/policy/modules/apps/pulseaudio.if +--- nsaserefpolicy/policy/modules/apps/pulseaudio.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/pulseaudio.if 2010-07-14 14:08:02.000000000 -0400 +@@ -35,6 +35,10 @@ + allow pulseaudio_t $2:unix_stream_socket connectto; + allow $2 pulseaudio_t:unix_stream_socket connectto; - userdom_search_user_home_dirs($1) - manage_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t) -+ read_lnk_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t) -+') -+ -+######################################## -+## -+## Send signull signal to pulseaudio -+## processes. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`pulseaudio_signull',` -+ gen_require(` -+ type pulseaudio_t; -+ ') ++ userdom_manage_home_role($1, pulseaudio_t) ++ userdom_manage_tmp_role($1, pulseaudio_t) ++ userdom_manage_tmpfs_role($1, pulseaudio_t) + -+ allow $1 pulseaudio_t:process signull; + allow $2 pulseaudio_t:dbus send_msg; + allow pulseaudio_t $2:dbus { acquire_svc send_msg }; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.8.6/policy/modules/apps/pulseaudio.te ---- nsaserefpolicy/policy/modules/apps/pulseaudio.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/pulseaudio.te 2010-07-12 09:05:35.000000000 -0400 -@@ -40,9 +40,11 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.8.7/policy/modules/apps/pulseaudio.te +--- nsaserefpolicy/policy/modules/apps/pulseaudio.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/pulseaudio.te 2010-07-14 14:08:02.000000000 -0400 +@@ -44,6 +44,7 @@ manage_dirs_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t) manage_files_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t) userdom_search_user_home_dirs(pulseaudio_t) @@ -4954,11 +4346,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaud manage_dirs_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t) manage_files_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t) -+manage_lnk_files_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t) - files_var_lib_filetrans(pulseaudio_t, pulseaudio_var_lib_t, { dir file }) +@@ -94,11 +95,6 @@ + + miscfiles_read_localization(pulseaudio_t) - manage_dirs_pattern(pulseaudio_t, pulseaudio_var_run_t, pulseaudio_var_run_t) -@@ -121,12 +123,17 @@ +-# cjp: this seems excessive. need to confirm +-userdom_manage_user_home_content_files(pulseaudio_t) +-userdom_manage_user_tmp_files(pulseaudio_t) +-userdom_manage_user_tmpfs_files(pulseaudio_t) +- + optional_policy(` + bluetooth_stream_connect(pulseaudio_t) + ') +@@ -131,6 +127,10 @@ ') optional_policy(` @@ -4969,14 +4369,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaud policykit_domtrans_auth(pulseaudio_t) policykit_read_lib(pulseaudio_t) policykit_read_reload(pulseaudio_t) - ') - - optional_policy(` -+ udev_read_state(pulseaudio_t) - udev_read_db(pulseaudio_t) - ') - -@@ -137,3 +144,7 @@ +@@ -148,3 +148,7 @@ xserver_read_xdm_pid(pulseaudio_t) xserver_user_x_domain_template(pulseaudio, pulseaudio_t, pulseaudio_tmpfs_t) ') @@ -4984,34 +4377,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaud +optional_policy(` + sandbox_manage_tmpfs_files(pulseaudio_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.fc serefpolicy-3.8.6/policy/modules/apps/qemu.fc ---- nsaserefpolicy/policy/modules/apps/qemu.fc 2010-02-22 08:30:53.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/qemu.fc 2010-07-12 09:05:35.000000000 -0400 -@@ -1,2 +1,4 @@ --/usr/bin/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0) -+/usr/bin/qemu -- gen_context(system_u:object_r:qemu_exec_t,s0) -+/usr/bin/qemu-system-.* -- gen_context(system_u:object_r:qemu_exec_t,s0) -+/usr/bin/qemu-kvm -- gen_context(system_u:object_r:qemu_exec_t,s0) - /usr/libexec/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.if serefpolicy-3.8.6/policy/modules/apps/qemu.if ---- nsaserefpolicy/policy/modules/apps/qemu.if 2010-02-22 08:30:53.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/qemu.if 2010-07-12 09:05:35.000000000 -0400 -@@ -127,12 +127,14 @@ - template(`qemu_role',` - gen_require(` - type qemu_t, qemu_exec_t; -+ type qemu_config_t, qemu_config_exec_t; - ') - - role $1 types { qemu_t qemu_config_t }; - - domtrans_pattern($2, qemu_exec_t, qemu_t) - domtrans_pattern($2, qemu_config_exec_t, qemu_config_t) -+ allow qemu_t $2:process signull; - ') - - ######################################## -@@ -273,6 +275,67 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.if serefpolicy-3.8.7/policy/modules/apps/qemu.if +--- nsaserefpolicy/policy/modules/apps/qemu.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/qemu.if 2010-07-14 14:08:02.000000000 -0400 +@@ -275,6 +275,67 @@ ######################################## ## @@ -5079,7 +4448,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.if ## Manage qemu temporary dirs. ## ## -@@ -306,3 +369,24 @@ +@@ -308,3 +369,24 @@ manage_files_pattern($1, qemu_tmp_t, qemu_tmp_t) ') @@ -5104,19 +4473,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.if +') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.te serefpolicy-3.8.6/policy/modules/apps/qemu.te ---- nsaserefpolicy/policy/modules/apps/qemu.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/qemu.te 2010-07-12 09:05:35.000000000 -0400 -@@ -49,6 +49,8 @@ - # - # qemu local policy - # -+storage_raw_write_removable_device(qemu_t) -+storage_raw_read_removable_device(qemu_t) - - userdom_search_user_home_content(qemu_t) - userdom_read_user_tmpfs_files(qemu_t) -@@ -99,6 +101,10 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.te serefpolicy-3.8.7/policy/modules/apps/qemu.te +--- nsaserefpolicy/policy/modules/apps/qemu.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/qemu.te 2010-07-14 14:08:02.000000000 -0400 +@@ -102,6 +102,10 @@ xen_rw_image_files(qemu_t) ') @@ -5127,32 +4487,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.te ######################################## # # Unconfined qemu local policy -@@ -108,7 +114,10 @@ - type unconfined_qemu_t; +@@ -112,6 +116,8 @@ typealias unconfined_qemu_t alias qemu_unconfined_t; application_type(unconfined_qemu_t) -- unconfined_domain_noaudit(unconfined_qemu_t) -+ unconfined_domain(unconfined_qemu_t) + unconfined_domain(unconfined_qemu_t) + userdom_manage_tmpfs_role(unconfined_r, unconfined_qemu_t) + userdom_unpriv_usertype(unconfined, unconfined_qemu_t) allow unconfined_qemu_t self:process { execstack execmem }; -+ allow unconfined_qemu_t qemu_exec_t:file execmod; - ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.fc serefpolicy-3.8.6/policy/modules/apps/sambagui.fc + allow unconfined_qemu_t qemu_exec_t:file execmod; +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.fc serefpolicy-3.8.7/policy/modules/apps/sambagui.fc --- nsaserefpolicy/policy/modules/apps/sambagui.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/sambagui.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/sambagui.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1 @@ +/usr/share/system-config-samba/system-config-samba-mechanism.py -- gen_context(system_u:object_r:sambagui_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.if serefpolicy-3.8.6/policy/modules/apps/sambagui.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.if serefpolicy-3.8.7/policy/modules/apps/sambagui.if --- nsaserefpolicy/policy/modules/apps/sambagui.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/sambagui.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/sambagui.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,2 @@ +## system-config-samba policy + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.te serefpolicy-3.8.6/policy/modules/apps/sambagui.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.te serefpolicy-3.8.7/policy/modules/apps/sambagui.te --- nsaserefpolicy/policy/modules/apps/sambagui.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/sambagui.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/sambagui.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,66 @@ +policy_module(sambagui,1.0.0) + @@ -5220,14 +4577,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui +optional_policy(` + policykit_dbus_chat(sambagui_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.fc serefpolicy-3.8.6/policy/modules/apps/sandbox.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.fc serefpolicy-3.8.7/policy/modules/apps/sandbox.fc --- nsaserefpolicy/policy/modules/apps/sandbox.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/sandbox.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/sandbox.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1 @@ +# No types are sandbox_exec_t -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.if serefpolicy-3.8.6/policy/modules/apps/sandbox.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.if serefpolicy-3.8.7/policy/modules/apps/sandbox.if --- nsaserefpolicy/policy/modules/apps/sandbox.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/sandbox.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/sandbox.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,314 @@ + +## policy for sandbox @@ -5543,9 +4900,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox. + + allow $1 sandbox_file_type:dir list_dir_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.te serefpolicy-3.8.6/policy/modules/apps/sandbox.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.te serefpolicy-3.8.7/policy/modules/apps/sandbox.te --- nsaserefpolicy/policy/modules/apps/sandbox.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/sandbox.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/sandbox.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,390 @@ +policy_module(sandbox,1.0.0) +dbus_stub() @@ -5937,9 +5294,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox. + mozilla_dontaudit_rw_user_home_files(sandbox_x_domain) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.if serefpolicy-3.8.6/policy/modules/apps/seunshare.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.if serefpolicy-3.8.7/policy/modules/apps/seunshare.if --- nsaserefpolicy/policy/modules/apps/seunshare.if 2009-12-04 09:43:33.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/seunshare.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/seunshare.if 2010-07-14 14:08:02.000000000 -0400 @@ -53,8 +53,14 @@ ######################################## @@ -5991,9 +5348,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshar + dontaudit $1_seunshare_t $3:socket_class_set { read write }; + ') ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.te serefpolicy-3.8.6/policy/modules/apps/seunshare.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.te serefpolicy-3.8.7/policy/modules/apps/seunshare.te --- nsaserefpolicy/policy/modules/apps/seunshare.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/seunshare.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/seunshare.te 2010-07-14 14:08:02.000000000 -0400 @@ -5,40 +5,39 @@ # Declarations # @@ -6052,165 +5409,549 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshar + mozilla_dontaudit_manage_user_home_files(seunshare_domain) ') ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.8.6/policy/modules/apps/slocate.te ---- nsaserefpolicy/policy/modules/apps/slocate.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/slocate.te 2010-07-12 09:05:35.000000000 -0400 -@@ -29,6 +29,7 @@ - manage_files_pattern(locate_t, locate_var_lib_t, locate_var_lib_t) - - kernel_read_system_state(locate_t) -+kernel_dontaudit_search_network_state(locate_t) - kernel_dontaudit_search_sysctl(locate_t) - - corecmd_exec_bin(locate_t) -@@ -47,8 +48,11 @@ - fs_getattr_all_files(locate_t) - fs_getattr_all_pipes(locate_t) - fs_getattr_all_symlinks(locate_t) -+fs_getattr_all_blk_files(locate_t) -+fs_getattr_all_chr_files(locate_t) - fs_list_all(locate_t) - fs_list_inotifyfs(locate_t) -+fs_read_noxattr_fs_symlinks(locate_t) - - # getpwnam - auth_use_nsswitch(locate_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/telepathysofiasip.fc serefpolicy-3.8.6/policy/modules/apps/telepathysofiasip.fc ---- nsaserefpolicy/policy/modules/apps/telepathysofiasip.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/telepathysofiasip.fc 2010-07-12 09:05:35.000000000 -0400 -@@ -0,0 +1,2 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/telepathy.fc serefpolicy-3.8.7/policy/modules/apps/telepathy.fc +--- nsaserefpolicy/policy/modules/apps/telepathy.fc 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.8.7/policy/modules/apps/telepathy.fc 2010-07-14 14:08:02.000000000 -0400 +@@ -0,0 +1,14 @@ ++HOME_DIR/\.mission-control(/.*)? gen_context(system_u:object_r:telepathy_mission_control_home_t, s0) ++HOME_DIR/\.cache/\.mc_connections -- gen_context(system_u:object_r:telepathy_mission_control_cache_home_t, s0) ++HOME_DIR/\.cache/telepathy/gabble(/.*)? gen_context(system_u:object_r:telepathy_gabble_cache_home_t, s0) ++ ++/usr/libexec/mission-control-5 -- gen_context(system_u:object_r:telepathy_mission_control_exec_t, s0) ++ ++/usr/libexec/telepathy-butterfly -- gen_context(system_u:object_r:telepathy_msn_exec_t, s0) ++/usr/libexec/telepathy-gabble -- gen_context(system_u:object_r:telepathy_gabble_exec_t, s0) ++/usr/libexec/telepathy-haze -- gen_context(system_u:object_r:telepathy_msn_exec_t, s0) ++/usr/libexec/telepathy-idle -- gen_context(system_u:object_r:telepathy_idle_exec_t, s0) ++/usr/libexec/telepathy-salut -- gen_context(system_u:object_r:telepathy_salut_exec_t, s0) ++/usr/libexec/telepathy-sofiasip -- gen_context(system_u:object_r:telepathy_sofiasip_exec_t, s0) ++/usr/libexec/telepathy-stream-engine -- gen_context(system_u:object_r:telepathy_stream_engine_exec_t, s0) ++/usr/libexec/telepathy-sunshine -- gen_context(system_u:object_r:telepathy_sunshine_exec_t, s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/telepathy.if serefpolicy-3.8.7/policy/modules/apps/telepathy.if +--- nsaserefpolicy/policy/modules/apps/telepathy.if 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.8.7/policy/modules/apps/telepathy.if 2010-07-14 14:08:02.000000000 -0400 +@@ -0,0 +1,204 @@ ++ ++## Telepathy framework. ++ ++####################################### ++## ++## Creates basic types for telepathy ++## domain ++## ++## ++## ++## Prefix for the domain. ++## ++## ++# ++# ++template(`telepathy_domain_template',` ++ ++ gen_require(` ++ attribute telepathy_domain; ++ attribute telepathy_executable; ++ ') ++ ++ type telepathy_$1_t, telepathy_domain; ++ type telepathy_$1_exec_t, telepathy_executable; ++ application_domain(telepathy_$1_t, telepathy_$1_exec_t) ++ ubac_constrained(telepathy_$1_t) ++ ++ type telepathy_$1_tmp_t; ++ files_tmp_file(telepathy_$1_tmp_t) ++ ubac_constrained(telepathy_$1_tmp_t) ++') ++ ++####################################### ++## ++## Role access for telepathy domains ++### that executes via dbus-session ++## ++## ++## ++## The role associated with the user domain. ++## ++## ++## ++## ++## The type of the user domain. ++## ++## ++# ++template(`telepathy_dbus_session_role', ` ++ gen_require(` ++ attribute telepathy_domain; ++ ++ type telepathy_gabble_t, telepathy_msn_t; ++ type telepathy_idle_t, telepathy_mission_control_t, telepathy_salut_t; ++ type telepathy_sofiasip_t, telepathy_stream_engine_t, telepathy_sunshine_t; ++ ++ type telepathy_gabble_exec_t, telepathy_msn_exec_t; ++ type telepathy_idle_exec_t, telepathy_mission_control_exec_t, telepathy_salut_exec_t; ++ type telepathy_sofiasip_exec_t, telepathy_stream_engine_exec_t, telepathy_sunshine_exec_t; ++ ++ ') ++ ++ dbus_session_domain(telepathy_gabble_t, telepathy_gabble_exec_t) ++ dbus_session_domain(telepathy_idle_t, telepathy_idle_exec_t) ++ dbus_session_domain(telepathy_mission_control_t, telepathy_mission_control_exec_t) ++ dbus_session_domain(telepathy_msn_t, telepathy_msn_exec_t) ++ dbus_session_domain(telepathy_salut_t, telepathy_salut_exec_t) ++ dbus_session_domain(telepathy_sofiasip_t, telepathy_sofiasip_exec_t) ++ dbus_session_domain(telepathy_stream_engine_t, telepathy_stream_engine_exec_t) ++ dbus_session_domain(telepathy_sunshine_t, telepathy_sunshine_exec_t) ++ ++ role $1 types telepathy_domain; ++ ++ allow $2 telepathy_domain:process { ptrace signal_perms }; ++ ps_process_pattern($2, telepathy_domain) ++ ++ optional_policy(` ++ telepathy_dbus_chat($2) ++ ') ++ ++ telepathy_gabble_stream_connect($2) ++ telepathy_msn_stream_connect($2) ++ telepathy_salut_stream_connect($2) ++') + -+/usr/libexec/telepathy-sofiasip -- gen_context(system_u:object_r:telepathysofiasip_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/telepathysofiasip.if serefpolicy-3.8.6/policy/modules/apps/telepathysofiasip.if ---- nsaserefpolicy/policy/modules/apps/telepathysofiasip.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/telepathysofiasip.if 2010-07-12 09:05:35.000000000 -0400 -@@ -0,0 +1,69 @@ ++######################################## ++## ++## Send DBus messages to and from ++## all Telepathy domain. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`telepathy_dbus_chat', ` ++ gen_require(` ++ attribute telepathy_domain; ++ class dbus send_msg; ++ ') + -+## policy for telepathy-sofiasip ++ allow $1 telepathy_domain:dbus send_msg; ++ allow telepathy_domain $1:dbus send_msg; ++') + +######################################## +## -+## Execute a domain transition to run telepathy-sofiasip. ++## Send DBus messages to and from ++## Telepathy Gabble. +## +## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`telepathy_gabble_dbus_chat', ` ++ gen_require(` ++ type telepathy_gabble_t; ++ class dbus send_msg; ++ ') ++ ++ allow $1 telepathy_gabble_t:dbus send_msg; ++ allow telepathy_gabble_t $1:dbus send_msg; ++') ++ ++######################################## +## -+## Domain allowed to transition. ++## Read and write Telepathy Butterfly ++## temporary files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`telepathy_butterfly_rw_tmp_files', ` ++ gen_require(` ++ type telepathy_butterfly_tmp_t; ++ ') ++ ++ allow $1 telepathy_butterfly_tmp_t:file rw_file_perms; ++ files_search_tmp($1) ++') ++ ++######################################## ++## ++## Stream connect to Telepathy Gabble +## ++## ++## ++## Domain allowed access. ++## +## +# -+interface(`telepathysofiasip_domtrans',` ++interface(`telepathy_gabble_stream_connect', ` + gen_require(` -+ type telepathysofiasip_t, telepathysofiasip_exec_t; ++ type telepathy_gabble_t, telepathy_gabble_tmp_t; + ') + -+ domtrans_pattern($1, telepathysofiasip_exec_t, telepathysofiasip_t) ++ stream_connect_pattern($1, telepathy_gabble_tmp_t, telepathy_gabble_tmp_t, telepathy_gabble_t) ++ files_search_tmp($1) ++') ++ ++####################################### ++## ++## Stream connect to telepathy MSN managers ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`telepathy_msn_stream_connect', ` ++ gen_require(` ++ type telepathy_msn_t, telepathy_msn_tmp_t; ++ ') ++ ++ stream_connect_pattern($1, telepathy_msn_tmp_t, telepathy_msn_tmp_t, telepathy_msn_t) ++ files_search_tmp($1) +') + ++ +######################################## +## -+## Send and receive messages from -+## telepathy-sofiasip over dbus. ++## Stream connect to Telepathy Salut +## +## -+## ++## +## Domain allowed access. +## +## +# -+interface(`telepathysofiasip_dbus_chat',` ++interface(`telepathy_salut_stream_connect', ` + gen_require(` -+ type telepathysofiasip_t; -+ class dbus send_msg; ++ type telepathy_salut_t, telepathy_salut_tmp_t; + ') + -+ allow $1 telepathysofiasip_t:dbus send_msg; -+ allow telepathysofiasip_t $1:dbus send_msg; ++ stream_connect_pattern($1, telepathy_salut_tmp_t, telepathy_salut_tmp_t, telepathy_salut_t) ++ files_search_tmp($1) +') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/telepathy.te serefpolicy-3.8.7/policy/modules/apps/telepathy.te +--- nsaserefpolicy/policy/modules/apps/telepathy.te 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.8.7/policy/modules/apps/telepathy.te 2010-07-14 14:08:02.000000000 -0400 +@@ -0,0 +1,302 @@ ++ ++policy_module(telepathy, 1.0.0) ++ ++######################################## ++# ++# Declarations. ++# ++ ++## ++##

++## Allow the Telepathy connection managers ++## to connect to any generic TCP port. ++##

++## ++gen_tunable(telepathy_tcp_connect_generic_network_ports, false) ++ ++attribute telepathy_domain; ++attribute telepathy_executable; ++ ++telepathy_domain_template(gabble) ++ ++type telepathy_gabble_cache_home_t; ++userdom_user_home_content(telepathy_gabble_cache_home_t) ++ ++telepathy_domain_template(idle) ++telepathy_domain_template(mission_control) ++ ++type telepathy_mission_control_home_t; ++userdom_user_home_content(telepathy_mission_control_home_t) ++ ++type telepathy_mission_control_cache_home_t; ++userdom_user_home_content(telepathy_mission_control_cache_home_t) ++ ++telepathy_domain_template(msn) ++telepathy_domain_template(salut) ++telepathy_domain_template(sofiasip) ++telepathy_domain_template(stream_engine) ++telepathy_domain_template(sunshine) + +####################################### -+## -+## Role access for telepathy-sofiasip -+## that executes via dbus-session -+## -+## -+## -+## Role allowed access -+## -+## -+## -+## -+## User domain for the role -+## -+## +# -+interface(`telepathysofiasip_role',` -+ gen_require(` -+ type telepathysofiasip_t; -+ type telepathysofiasip_exec_t; -+ ') ++# Telepathy Butterfly and Haze local policy. ++# ++ ++allow telepathy_msn_t self:process setsched; ++allow telepathy_msn_t self:netlink_route_socket create_netlink_socket_perms; ++allow telepathy_msn_t self:unix_dgram_socket { write create connect }; ++ ++manage_dirs_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t) ++manage_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t) ++exec_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t) ++files_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file}) ++ ++corenet_sendrecv_http_client_packets(telepathy_msn_t) ++corenet_sendrecv_msnp_client_packets(telepathy_msn_t) ++corenet_tcp_connect_http_port(telepathy_msn_t) ++corenet_tcp_connect_msnp_port(telepathy_msn_t) ++ ++corecmd_exec_bin(telepathy_msn_t) ++corecmd_exec_shell(telepathy_msn_t) ++corecmd_read_bin_symlinks(telepathy_msn_t) + -+ dbus_session_domain(telepathysofiasip_t, telepathysofiasip_exec_t) -+ role $1 types telepathysofiasip_t; ++dev_read_urand(telepathy_msn_t) + -+ telepathysofiasip_dbus_chat($2) ++files_read_etc_files(telepathy_msn_t) ++files_read_usr_files(telepathy_msn_t) ++ ++kernel_read_system_state(telepathy_msn_t) ++ ++logging_send_syslog_msg(telepathy_msn_t) ++ ++miscfiles_read_certs(telepathy_msn_t) ++ ++sysnet_read_config(telepathy_msn_t) ++ ++optional_policy(` ++ dbus_system_bus_client(telepathy_msn_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/telepathysofiasip.te serefpolicy-3.8.6/policy/modules/apps/telepathysofiasip.te ---- nsaserefpolicy/policy/modules/apps/telepathysofiasip.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/telepathysofiasip.te 2010-07-12 09:05:35.000000000 -0400 -@@ -0,0 +1,42 @@ -+policy_module(telepathysofiasip,1.0.0) + -+######################################## ++optional_policy(` ++ gnome_read_gconf_home_files(telepathy_msn_t) ++') ++ ++####################################### +# -+# Declarations ++# Telepathy Gabble local policy. +# + -+type telepathysofiasip_t; -+type telepathysofiasip_exec_t; -+application_domain(telepathysofiasip_t, telepathysofiasip_exec_t) ++allow telepathy_gabble_t self:netlink_route_socket create_netlink_socket_perms; ++allow telepathy_gabble_t self:tcp_socket { listen accept }; ++allow telepathy_gabble_t self:unix_dgram_socket { write read create getattr sendto }; + -+######################################## ++manage_dirs_pattern(telepathy_gabble_t, telepathy_gabble_tmp_t, telepathy_gabble_tmp_t) ++manage_sock_files_pattern(telepathy_gabble_t, telepathy_gabble_tmp_t, telepathy_gabble_tmp_t) ++files_tmp_filetrans(telepathy_gabble_t, telepathy_gabble_tmp_t, { dir sock_file }) ++ ++# ~/.cache/gabble/caps-cache.db-journal ++optional_policy(` ++ manage_dirs_pattern(telepathy_gabble_t, telepathy_gabble_cache_home_t, telepathy_gabble_cache_home_t) ++ manage_files_pattern(telepathy_gabble_t, telepathy_gabble_cache_home_t, telepathy_gabble_cache_home_t) ++ gnome_cache_filetrans(telepathy_gabble_t, telepathy_gabble_cache_home_t, { dir file }) ++') ++ ++corenet_sendrecv_commplex_client_packets(telepathy_gabble_t) ++corenet_sendrecv_http_client_packets(telepathy_gabble_t) ++corenet_sendrecv_jabber_client_client_packets(telepathy_gabble_t) ++corenet_sendrecv_vnc_client_packets(telepathy_gabble_t) ++ ++corenet_tcp_connect_commplex_port(telepathy_gabble_t) ++corenet_tcp_connect_http_port(telepathy_gabble_t) ++corenet_tcp_connect_jabber_client_port(telepathy_gabble_t) ++corenet_tcp_connect_vnc_port(telepathy_gabble_t) ++ ++dev_read_rand(telepathy_gabble_t) ++dev_read_urand(telepathy_gabble_t) ++ ++files_read_etc_files(telepathy_gabble_t) ++ ++miscfiles_read_certs(telepathy_gabble_t) ++ ++sysnet_read_config(telepathy_gabble_t) ++ ++optional_policy(` ++ dbus_system_bus_client(telepathy_gabble_t) ++') ++ ++tunable_policy(`use_nfs_home_dirs', ` ++ fs_manage_nfs_dirs(telepathy_gabble_t) ++ fs_manage_nfs_files(telepathy_gabble_t) ++') ++ ++tunable_policy(`use_samba_home_dirs', ` ++ fs_manage_cifs_dirs(telepathy_gabble_t) ++ fs_manage_cifs_files(telepathy_gabble_t) ++') ++ ++####################################### ++# ++# Telepathy Idle local policy. ++# ++ ++allow telepathy_idle_t self:netlink_route_socket create_netlink_socket_perms; ++ ++corenet_sendrecv_ircd_client_packets(telepathy_idle_t) ++corenet_tcp_connect_ircd_port(telepathy_idle_t) ++ ++files_read_etc_files(telepathy_idle_t) ++ ++sysnet_read_config(telepathy_idle_t) ++ ++####################################### ++# ++# Telepathy Mission-Control local policy. ++# ++ ++manage_dirs_pattern(telepathy_mission_control_t, telepathy_mission_control_home_t, telepathy_mission_control_home_t) ++manage_files_pattern(telepathy_mission_control_t, telepathy_mission_control_home_t, telepathy_mission_control_home_t) ++userdom_user_home_dir_filetrans(telepathy_mission_control_t, telepathy_mission_control_home_t, { dir file }) ++userdom_search_user_home_dirs(telepathy_mission_control_t) ++ ++files_read_etc_files(telepathy_mission_control_t) ++files_read_usr_files(telepathy_mission_control_t) ++ ++tunable_policy(`use_nfs_home_dirs', ` ++ fs_manage_nfs_dirs(telepathy_mission_control_t) ++ fs_manage_nfs_files(telepathy_mission_control_t) ++') ++ ++tunable_policy(`use_samba_home_dirs', ` ++ fs_manage_cifs_dirs(telepathy_mission_control_t) ++ fs_manage_cifs_files(telepathy_mission_control_t) ++') ++ ++# ~/.cache/.mc_connections. ++optional_policy(` ++ manage_files_pattern(telepathy_mission_control_t, telepathy_mission_control_cache_home_t, telepathy_mission_control_cache_home_t) ++ gnome_cache_filetrans(telepathy_mission_control_t, telepathy_mission_control_cache_home_t, file) ++') ++ ++optional_policy(` ++ gnome_read_gconf_home_files(telepathy_mission_control_t) ++ gnome_setattr_cache_home_dir(telepathy_mission_control_t) ++') ++ ++####################################### ++# ++# Telepathy Salut local policy. ++# ++ ++allow telepathy_salut_t self:netlink_route_socket create_netlink_socket_perms; ++allow telepathy_salut_t self:tcp_socket { accept listen }; ++ ++manage_sock_files_pattern(telepathy_salut_t, telepathy_salut_tmp_t, telepathy_salut_tmp_t) ++files_tmp_filetrans(telepathy_salut_t, telepathy_salut_tmp_t, sock_file) ++ ++corenet_sendrecv_presence_server_packets(telepathy_salut_t) ++corenet_tcp_bind_presence_port(telepathy_salut_t) ++corenet_tcp_connect_presence_port(telepathy_salut_t) ++ ++dev_read_urand(telepathy_salut_t) ++ ++files_read_etc_files(telepathy_salut_t) ++ ++sysnet_read_config(telepathy_salut_t) ++ ++optional_policy(` ++ dbus_system_bus_client(telepathy_salut_t) ++ ++ optional_policy(` ++ avahi_dbus_chat(telepathy_salut_t) ++ ') ++') ++ ++####################################### ++# ++# Telepathy Sofiasip local policy. ++# ++ ++allow telepathy_sofiasip_t self:netlink_route_socket create_netlink_socket_perms; ++allow telepathy_sofiasip_t self:rawip_socket { create_socket_perms listen }; ++allow telepathy_sofiasip_t self:tcp_socket { listen }; ++ ++corenet_sendrecv_sip_client_packets(telepathy_sofiasip_t) ++corenet_tcp_connect_sip_port(telepathy_sofiasip_t) ++ ++dev_read_urand(telepathy_sofiasip_t) ++ ++kernel_request_load_module(telepathy_sofiasip_t) ++ ++sysnet_read_config(telepathy_sofiasip_t) ++ ++####################################### ++# ++# Telepathy Sunshine local policy. ++# ++ ++manage_files_pattern(telepathy_sunshine_t, telepathy_sunshine_tmp_t, telepathy_sunshine_tmp_t) ++exec_files_pattern(telepathy_sunshine_t, telepathy_sunshine_tmp_t, telepathy_sunshine_tmp_t) ++files_tmp_filetrans(telepathy_sunshine_t, telepathy_sunshine_tmp_t, file) ++ ++corecmd_list_bin(telepathy_sunshine_t) ++ ++dev_read_urand(telepathy_sunshine_t) ++ ++files_read_etc_files(telepathy_sunshine_t) ++files_read_usr_files(telepathy_sunshine_t) ++ ++kernel_read_system_state(telepathy_sunshine_t) ++ ++optional_policy(` ++ xserver_read_xdm_pid(telepathy_sunshine_t) ++ xserver_stream_connect(telepathy_sunshine_t) ++') ++ ++####################################### +# -+# telepathy-sofiasip local policy ++# telepathy domains common policy +# + -+allow telepathysofiasip_t self:process signal; ++allow telepathy_domain self:process { getsched signal }; ++allow telepathy_domain self:fifo_file rw_fifo_file_perms; ++allow telepathy_domain self:tcp_socket create_socket_perms; ++allow telepathy_domain self:udp_socket create_socket_perms; ++ ++corenet_all_recvfrom_netlabel(telepathy_domain) ++corenet_all_recvfrom_unlabeled(telepathy_domain) ++corenet_raw_bind_generic_node(telepathy_domain) ++corenet_raw_sendrecv_generic_if(telepathy_domain) ++corenet_raw_sendrecv_generic_node(telepathy_domain) ++corenet_tcp_bind_generic_node(telepathy_domain) ++corenet_tcp_sendrecv_generic_if(telepathy_domain) ++corenet_tcp_sendrecv_generic_node(telepathy_domain) ++corenet_udp_bind_generic_node(telepathy_domain) + -+allow telepathysofiasip_t self:netlink_route_socket r_netlink_socket_perms; -+allow telepathysofiasip_t self:tcp_socket create_stream_socket_perms; -+allow telepathysofiasip_t self:udp_socket create_socket_perms; -+allow telepathysofiasip_t self:rawip_socket { create_socket_perms listen }; ++fs_search_auto_mountpoints(telepathy_domain) + -+kernel_request_load_module(telepathysofiasip_t) ++miscfiles_read_localization(telepathy_domain) + -+corenet_all_recvfrom_unlabeled(telepathysofiasip_t) -+corenet_all_recvfrom_netlabel(telepathysofiasip_t) -+corenet_tcp_sendrecv_generic_if(telepathysofiasip_t) -+corenet_udp_sendrecv_generic_if(telepathysofiasip_t) -+corenet_raw_sendrecv_generic_if(telepathysofiasip_t) -+corenet_tcp_sendrecv_generic_node(telepathysofiasip_t) -+corenet_udp_sendrecv_generic_node(telepathysofiasip_t) -+corenet_raw_sendrecv_generic_node(telepathysofiasip_t) -+corenet_tcp_sendrecv_all_ports(telepathysofiasip_t) -+corenet_udp_sendrecv_all_ports(telepathysofiasip_t) -+corenet_tcp_bind_generic_node(telepathysofiasip_t) -+corenet_udp_bind_generic_node(telepathysofiasip_t) -+corenet_raw_bind_generic_node(telepathysofiasip_t) ++# This interface does not facilitate files_search_tmp which appears to be a bug. ++userdom_stream_connect(telepathy_domain) ++userdom_use_user_terminals(telepathy_domain) ++ ++tunable_policy(`telepathy_tcp_connect_generic_network_ports', ` ++ corenet_tcp_connect_generic_port(telepathy_domain) ++ corenet_sendrecv_generic_client_packets(telepathy_domain) ++') ++ ++optional_policy(` ++ automount_dontaudit_getattr_tmp_dirs(telepathy_domain) ++') ++ ++optional_policy(` ++ nis_use_ypbind(telepathy_domain) ++') + -+dev_read_urand(telepathysofiasip_t) ++optional_policy(` ++ telepathy_dbus_chat(telepathy_domain) ++') + -+sysnet_read_config(telepathysofiasip_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.fc serefpolicy-3.8.6/policy/modules/apps/userhelper.fc ++optional_policy(` ++ xserver_rw_xdm_pipes(telepathy_domain) ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.fc serefpolicy-3.8.7/policy/modules/apps/userhelper.fc --- nsaserefpolicy/policy/modules/apps/userhelper.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/userhelper.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/userhelper.fc 2010-07-14 14:08:02.000000000 -0400 @@ -7,3 +7,4 @@ # /usr # /usr/sbin/userhelper -- gen_context(system_u:object_r:userhelper_exec_t,s0) +/usr/bin/consolehelper -- gen_context(system_u:object_r:consolehelper_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.8.6/policy/modules/apps/userhelper.if ---- nsaserefpolicy/policy/modules/apps/userhelper.if 2010-02-12 10:33:09.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/userhelper.if 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.8.7/policy/modules/apps/userhelper.if +--- nsaserefpolicy/policy/modules/apps/userhelper.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/userhelper.if 2010-07-14 14:08:02.000000000 -0400 @@ -25,6 +25,7 @@ gen_require(` attribute userhelper_type; @@ -6219,7 +5960,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp ') ######################################## -@@ -260,3 +261,58 @@ +@@ -256,3 +257,58 @@ can_exec($1, userhelper_exec_t) ') @@ -6278,9 +6019,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp + xserver_read_xdm_pid($1_consolehelper_t) + ') +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.te serefpolicy-3.8.6/policy/modules/apps/userhelper.te ---- nsaserefpolicy/policy/modules/apps/userhelper.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/userhelper.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.te serefpolicy-3.8.7/policy/modules/apps/userhelper.te +--- nsaserefpolicy/policy/modules/apps/userhelper.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/userhelper.te 2010-07-14 14:08:02.000000000 -0400 @@ -6,9 +6,51 @@ # @@ -6333,93 +6074,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp +optional_policy(` + xserver_stream_connect(consolehelper_domain) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.8.6/policy/modules/apps/vmware.fc ---- nsaserefpolicy/policy/modules/apps/vmware.fc 2009-09-09 09:23:16.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/vmware.fc 2010-07-12 09:05:35.000000000 -0400 -@@ -20,7 +20,7 @@ - /usr/bin/vmnet-sniffer -- gen_context(system_u:object_r:vmware_host_exec_t,s0) - /usr/bin/vmware-network -- gen_context(system_u:object_r:vmware_host_exec_t,s0) - /usr/bin/vmware-nmbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) --/usr/bin/vmware-ping -- gen_context(system_u:object_r:vmware_host_exec_t,s0) -+/usr/bin/vmware-ping -- gen_context(system_u:object_r:vmware_exec_t,s0) - /usr/bin/vmware-smbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) - /usr/bin/vmware-smbpasswd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) - /usr/bin/vmware-smbpasswd\.bin -- gen_context(system_u:object_r:vmware_host_exec_t,s0) -@@ -55,7 +55,7 @@ - /opt/vmware/(workstation|player)/bin/vmnet-netifup -- gen_context(system_u:object_r:vmware_host_exec_t,s0) - /opt/vmware/(workstation|player)/bin/vmnet-sniffer -- gen_context(system_u:object_r:vmware_host_exec_t,s0) - /opt/vmware/(workstation|player)/bin/vmware-nmbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) --/opt/vmware/(workstation|player)/bin/vmware-ping -- gen_context(system_u:object_r:vmware_host_exec_t,s0) -+/opt/vmware/(workstation|player)/bin/vmware-ping -- gen_context(system_u:object_r:vmware_exec_t,s0) - /opt/vmware/(workstation|player)/bin/vmware-smbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) - /opt/vmware/(workstation|player)/bin/vmware-smbpasswd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) - /opt/vmware/(workstation|player)/bin/vmware-smbpasswd\.bin -- gen_context(system_u:object_r:vmware_host_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.if serefpolicy-3.8.6/policy/modules/apps/vmware.if ---- nsaserefpolicy/policy/modules/apps/vmware.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/vmware.if 2010-07-12 09:05:35.000000000 -0400 -@@ -84,3 +84,22 @@ - logging_search_logs($1) - append_files_pattern($1, vmware_log_t, vmware_log_t) - ') -+ -+######################################## -+## -+## Execute vmware host executables -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`vmware_exec_host',` -+ gen_require(` -+ type vmware_host_exec_t; -+ ') -+ -+ can_exec($1, vmware_host_exec_t) -+') -+ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.8.6/policy/modules/apps/vmware.te ---- nsaserefpolicy/policy/modules/apps/vmware.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/vmware.te 2010-07-12 09:05:35.000000000 -0400 -@@ -28,6 +28,10 @@ - type vmware_host_exec_t; - init_daemon_domain(vmware_host_t, vmware_host_exec_t) - -+type vmware_host_tmp_t; -+files_tmp_file(vmware_host_tmp_t) -+ubac_constrained(vmware_host_tmp_t) -+ - type vmware_host_pid_t alias vmware_var_run_t; - files_pid_file(vmware_host_pid_t) - -@@ -78,6 +82,12 @@ - - # cjp: the ro and rw files should be split up - manage_files_pattern(vmware_host_t, vmware_sys_conf_t, vmware_sys_conf_t) -+manage_lnk_files_pattern(vmware_host_t, vmware_sys_conf_t, vmware_sys_conf_t) -+ -+manage_dirs_pattern(vmware_host_t, vmware_host_tmp_t, vmware_host_tmp_t) -+manage_files_pattern(vmware_host_t, vmware_host_tmp_t, vmware_host_tmp_t) -+manage_sock_files_pattern(vmware_host_t, vmware_host_tmp_t, vmware_host_tmp_t) -+files_tmp_filetrans(vmware_host_t, vmware_host_tmp_t, { file dir }) - - manage_files_pattern(vmware_host_t, vmware_var_run_t, vmware_var_run_t) - manage_sock_files_pattern(vmware_host_t, vmware_var_run_t, vmware_var_run_t) -@@ -86,8 +96,11 @@ - manage_files_pattern(vmware_host_t, vmware_log_t, vmware_log_t) - logging_log_filetrans(vmware_host_t, vmware_log_t, { file dir }) - -+can_exec(vmware_host_t, vmware_host_exec_t) -+ - kernel_read_kernel_sysctls(vmware_host_t) - kernel_read_system_state(vmware_host_t) -+kernel_read_network_state(vmware_host_t) - - corenet_all_recvfrom_unlabeled(vmware_host_t) - corenet_all_recvfrom_netlabel(vmware_host_t) -@@ -113,6 +126,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.8.7/policy/modules/apps/vmware.te +--- nsaserefpolicy/policy/modules/apps/vmware.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/vmware.te 2010-07-14 14:08:02.000000000 -0400 +@@ -126,6 +126,7 @@ dev_read_sysfs(vmware_host_t) dev_read_urand(vmware_host_t) dev_rw_vmware(vmware_host_t) @@ -6427,9 +6085,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.t domain_use_interactive_fds(vmware_host_t) domain_dontaudit_read_all_domains_state(vmware_host_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.fc serefpolicy-3.8.6/policy/modules/apps/wine.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.fc serefpolicy-3.8.7/policy/modules/apps/wine.fc --- nsaserefpolicy/policy/modules/apps/wine.fc 2010-02-22 08:30:53.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/wine.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/wine.fc 2010-07-14 14:08:02.000000000 -0400 @@ -2,6 +2,7 @@ /opt/cxoffice/bin/wine.* -- gen_context(system_u:object_r:wine_exec_t,s0) @@ -6438,9 +6096,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.fc /opt/google/picasa(/.*)?/bin/msiexec -- gen_context(system_u:object_r:wine_exec_t,s0) /opt/google/picasa(/.*)?/bin/notepad -- gen_context(system_u:object_r:wine_exec_t,s0) /opt/google/picasa(/.*)?/bin/progman -- gen_context(system_u:object_r:wine_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.8.6/policy/modules/apps/wine.if ---- nsaserefpolicy/policy/modules/apps/wine.if 2010-02-22 08:30:53.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/apps/wine.if 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.8.7/policy/modules/apps/wine.if +--- nsaserefpolicy/policy/modules/apps/wine.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/wine.if 2010-07-14 14:08:02.000000000 -0400 @@ -35,6 +35,8 @@ role $1 types wine_t; @@ -6450,9 +6108,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if allow wine_t $2:fd use; allow wine_t $2:process { sigchld signull }; allow wine_t $2:unix_stream_socket connectto; -@@ -103,7 +105,14 @@ +@@ -101,9 +103,16 @@ + corecmd_bin_domtrans($1_wine_t, $1_t) + userdom_unpriv_usertype($1, $1_wine_t) - userdom_manage_tmpfs_role($2, $1_wine_t) +- userdom_manage_user_tmpfs_files($1_wine_t) ++ userdom_manage_tmpfs_role($2, $1_wine_t) - domain_mmap_low($1_wine_t) + domain_mmap_low_type($1_wine_t) @@ -6466,11 +6127,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if optional_policy(` xserver_role($1_r, $1_wine_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.8.6/policy/modules/apps/wine.te ---- nsaserefpolicy/policy/modules/apps/wine.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/wine.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.8.7/policy/modules/apps/wine.te +--- nsaserefpolicy/policy/modules/apps/wine.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/wine.te 2010-07-14 14:08:02.000000000 -0400 @@ -1,5 +1,13 @@ - policy_module(wine, 1.7.0) + policy_module(wine, 1.7.1) +## +##

@@ -6511,59 +6172,43 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wm.if serefpolicy-3.8.6/policy/modules/apps/wm.if ---- nsaserefpolicy/policy/modules/apps/wm.if 2009-07-27 18:11:17.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/apps/wm.if 2010-07-12 09:05:35.000000000 -0400 -@@ -30,6 +30,7 @@ - template(`wm_role_template',` - gen_require(` - type wm_exec_t; -+ class dbus send_msg; - ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wireshark.te serefpolicy-3.8.7/policy/modules/apps/wireshark.te +--- nsaserefpolicy/policy/modules/apps/wireshark.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/wireshark.te 2010-07-14 14:08:02.000000000 -0400 +@@ -15,6 +15,7 @@ + type wireshark_home_t; + typealias wireshark_home_t alias { user_wireshark_home_t staff_wireshark_home_t sysadm_wireshark_home_t }; + typealias wireshark_home_t alias { auditadm_wireshark_home_t secadm_wireshark_home_t }; ++files_poly_member(wireshark_home_t) + userdom_user_home_content(wireshark_home_t) - type $1_wm_t; -@@ -42,6 +43,12 @@ - allow $1_wm_t self:shm create_shm_perms; + type wireshark_tmp_t; +@@ -70,6 +71,8 @@ + kernel_read_system_state(wireshark_t) + kernel_read_sysctl(wireshark_t) - allow $1_wm_t $3:unix_stream_socket connectto; -+ allow $3 $1_wm_t:unix_stream_socket connectto; -+ allow $3 $1_wm_t:process { signal sigchld }; -+ allow $1_wm_t $3:process { signull sigkill }; ++corecmd_search_bin(wireshark_t) + -+ allow $1_wm_t $3:dbus send_msg; -+ allow $3 $1_wm_t:dbus send_msg; + corenet_tcp_connect_generic_port(wireshark_t) + corenet_tcp_sendrecv_generic_if(wireshark_t) - domtrans_pattern($3, wm_exec_t, $1_wm_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wm.if serefpolicy-3.8.7/policy/modules/apps/wm.if +--- nsaserefpolicy/policy/modules/apps/wm.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/apps/wm.if 2010-07-14 14:08:02.000000000 -0400 +@@ -75,6 +75,10 @@ + miscfiles_read_fonts($1_wm_t) + miscfiles_read_localization($1_wm_t) -@@ -55,6 +62,8 @@ - files_read_etc_files($1_wm_t) - files_read_usr_files($1_wm_t) - -+ fs_getattr_tmpfs($1_wm_t) ++ userdom_manage_home_role($2, $1_wm_t) ++ userdom_manage_tmpfs_role($2, $1_wm_t) ++ userdom_manage_tmp_role($2, $1_wm_t) + - mls_file_read_all_levels($1_wm_t) - mls_file_write_all_levels($1_wm_t) - mls_xwin_read_all_levels($1_wm_t) -@@ -72,10 +81,16 @@ - optional_policy(` dbus_system_bus_client($1_wm_t) -+ dbus_session_bus_client($1_wm_t) -+ ') -+ -+ optional_policy(` -+ pulseaudio_stream_connect($1_wm_t) - ') - - optional_policy(` - xserver_role($2, $1_wm_t) -+ xserver_manage_core_devices($1_wm_t) - ') - ') - -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.8.6/policy/modules/kernel/corecommands.fc + dbus_session_bus_client($1_wm_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.8.7/policy/modules/kernel/corecommands.fc --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2010-06-08 10:35:48.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/corecommands.fc 2010-07-12 14:53:11.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/corecommands.fc 2010-07-14 14:08:02.000000000 -0400 @@ -9,8 +9,10 @@ /bin/bash2 -- gen_context(system_u:object_r:shell_exec_t,s0) /bin/fish -- gen_context(system_u:object_r:shell_exec_t,s0) @@ -6596,7 +6241,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco ifdef(`distro_gentoo',` /opt/RealPlayer/realplay(\.bin)? gen_context(system_u:object_r:bin_t,s0) /opt/RealPlayer/postint(/.*)? gen_context(system_u:object_r:bin_t,s0) -@@ -228,6 +237,8 @@ +@@ -169,6 +178,7 @@ + /usr/lib/fence(/.*)? gen_context(system_u:object_r:bin_t,s0) + /usr/lib/pgsql/test/regress/.*\.sh -- gen_context(system_u:object_r:bin_t,s0) + /usr/lib/qt.*/bin(/.*)? gen_context(system_u:object_r:bin_t,s0) ++/usr/lib(64)?/mediawiki/math/texvc.* gen_context(system_u:object_r:bin_t,s0) + /usr/lib(64)?/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:bin_t,s0) + /usr/lib(64)?/apt/methods.+ -- gen_context(system_u:object_r:bin_t,s0) + /usr/lib(64)?/ConsoleKit/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0) +@@ -228,6 +238,8 @@ /usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0) /usr/share/e16/misc(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/gedit-2/plugins/externaltools/tools(/.*)? gen_context(system_u:object_r:bin_t,s0) @@ -6605,7 +6258,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco /usr/share/gnucash/finance-quote-check -- gen_context(system_u:object_r:bin_t,s0) /usr/share/gnucash/finance-quote-helper -- gen_context(system_u:object_r:bin_t,s0) /usr/share/hal/device-manager/hal-device-manager -- gen_context(system_u:object_r:bin_t,s0) -@@ -340,3 +351,22 @@ +@@ -314,6 +326,7 @@ + /usr/share/texmf/web2c/mktexdir -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/texmf/web2c/mktexnam -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/texmf/web2c/mktexupd -- gen_context(system_u:object_r:bin_t,s0) ++/usr/share/texmf/texconfig/tcfmgr -- gen_context(system_u:object_r:bin_t,s0) + ') + + ifdef(`distro_suse', ` +@@ -340,3 +353,22 @@ ifdef(`distro_suse',` /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) ') @@ -6628,9 +6289,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco +/usr/lib(64)?/rpm/rpmv -- gen_context(system_u:object_r:bin_t,s0) + +/usr/lib(64)?/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-3.8.6/policy/modules/kernel/corecommands.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-3.8.7/policy/modules/kernel/corecommands.if --- nsaserefpolicy/policy/modules/kernel/corecommands.if 2010-03-05 17:14:56.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/kernel/corecommands.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/corecommands.if 2010-07-14 14:08:02.000000000 -0400 @@ -931,6 +931,7 @@ read_lnk_files_pattern($1, bin_t, bin_t) @@ -6647,9 +6308,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco manage_files_pattern($1, bin_t, exec_type) manage_lnk_files_pattern($1, bin_t, bin_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.fc serefpolicy-3.8.6/policy/modules/kernel/corenetwork.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.fc serefpolicy-3.8.7/policy/modules/kernel/corenetwork.fc --- nsaserefpolicy/policy/modules/kernel/corenetwork.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/corenetwork.fc 2010-07-12 14:47:57.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/corenetwork.fc 2010-07-14 14:08:02.000000000 -0400 @@ -5,3 +5,6 @@ /dev/tap.* -c gen_context(system_u:object_r:tun_tap_device_t,s0) @@ -6657,9 +6318,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene + +/lib/udev/devices/ppp -c gen_context(system_u:object_r:ppp_device_t,s0) +/lib/udev/devices/net/.* -c gen_context(system_u:object_r:tun_tap_device_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.8.6/policy/modules/kernel/corenetwork.te.in +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.8.7/policy/modules/kernel/corenetwork.te.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/corenetwork.te.in 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/corenetwork.te.in 2010-07-14 14:08:02.000000000 -0400 @@ -24,6 +24,7 @@ # type tun_tap_device_t; @@ -6668,6 +6329,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene ######################################## # +@@ -54,7 +55,7 @@ + type reserved_port_t, port_type, reserved_port_type; + + # +-# hi_reserved_port_t is the type of INET port numbers between 600-1023. ++# hi_reserved_port_t is the type of INET port numbers between 512-1023. + # + type hi_reserved_port_t, port_type, reserved_port_type, rpc_port_type; + @@ -64,6 +65,7 @@ type server_packet_t, packet_type, server_packet_type; @@ -6777,7 +6447,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene network_port(syslogd, udp,514,s0) network_port(telnetd, tcp,23,s0) network_port(tftp, udp,69,s0) -@@ -204,13 +225,14 @@ +@@ -204,23 +225,24 @@ network_port(varnishd, tcp,6081,s0, tcp,6082,s0) network_port(virt, tcp,16509,s0, udp,16509,s0, tcp,16514,s0, udp,16514,s0) network_port(virt_migration, tcp,49152-49216,s0) @@ -6794,9 +6464,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene network_port(zebra, tcp,2600-2604,s0, tcp,2606,s0, udp,2600-2604,s0, udp,2606,s0) network_port(zope, tcp,8021,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.8.6/policy/modules/kernel/devices.fc + # Defaults for reserved ports. Earlier portcon entries take precedence; + # these entries just cover any remaining reserved ports not otherwise declared. + +-portcon tcp 600-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0) +-portcon udp 600-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0) +-portcon tcp 1-599 gen_context(system_u:object_r:reserved_port_t, s0) +-portcon udp 1-599 gen_context(system_u:object_r:reserved_port_t, s0) ++portcon tcp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0) ++portcon udp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0) ++portcon tcp 1-511 gen_context(system_u:object_r:reserved_port_t, s0) ++portcon udp 1-511 gen_context(system_u:object_r:reserved_port_t, s0) + + ######################################## + # +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.m4 serefpolicy-3.8.7/policy/modules/kernel/corenetwork.te.m4 +--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.m4 2010-04-13 14:43:42.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/corenetwork.te.m4 2010-07-14 14:08:02.000000000 -0400 +@@ -80,7 +80,7 @@ + # bindresvport in glibc starts searching for reserved ports at 600 + define(`declare_ports',`dnl + ifelse(eval(range_start($3) < 1024),1,`typeattribute $1 reserved_port_type; +-ifelse(eval(range_start($3) >= 600),1,`typeattribute $1 rpc_port_type;',`dnl') ++ifelse(eval(range_start($3) >= 512),1,`typeattribute $1 rpc_port_type;',`dnl') + ',`dnl') + portcon $2 $3 gen_context(system_u:object_r:$1,$4) + ifelse(`$5',`',`',`declare_ports($1,shiftn(4,$*))')dnl +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.8.7/policy/modules/kernel/devices.fc --- nsaserefpolicy/policy/modules/kernel/devices.fc 2010-06-08 10:35:48.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/devices.fc 2010-07-12 14:40:50.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/devices.fc 2010-07-14 14:08:02.000000000 -0400 @@ -176,13 +176,12 @@ /etc/udev/devices -d gen_context(system_u:object_r:device_t,s0) @@ -6822,9 +6518,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device +# /sys +# +/sys(/.*)? gen_context(system_u:object_r:sysfs_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.8.6/policy/modules/kernel/devices.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.8.7/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2010-06-08 10:35:48.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/devices.if 2010-07-12 14:36:40.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/devices.if 2010-07-14 16:39:53.000000000 -0400 @@ -606,6 +606,24 @@ ######################################## @@ -6957,9 +6653,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.8.6/policy/modules/kernel/devices.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.8.7/policy/modules/kernel/devices.te --- nsaserefpolicy/policy/modules/kernel/devices.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/devices.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/devices.te 2010-07-14 14:08:02.000000000 -0400 @@ -100,6 +100,7 @@ # type kvm_device_t; @@ -6975,9 +6671,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device -allow devices_unconfined_type device_node:{ blk_file chr_file } *; +allow devices_unconfined_type device_node:{ blk_file chr_file lnk_file } *; allow devices_unconfined_type mtrr_device_t:file *; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.8.6/policy/modules/kernel/domain.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.8.7/policy/modules/kernel/domain.if --- nsaserefpolicy/policy/modules/kernel/domain.if 2010-03-18 06:48:09.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/domain.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/domain.if 2010-07-14 14:08:02.000000000 -0400 @@ -611,7 +611,7 @@ ######################################## @@ -7057,9 +6753,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain + + dontaudit $1 domain:socket_class_set { read write }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.8.6/policy/modules/kernel/domain.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.8.7/policy/modules/kernel/domain.te --- nsaserefpolicy/policy/modules/kernel/domain.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/domain.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/domain.te 2010-07-14 14:08:02.000000000 -0400 @@ -4,6 +4,21 @@ # # Declarations @@ -7225,9 +6921,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain + +# broken kernel +dontaudit can_change_object_identity can_change_object_identity:key link; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.8.6/policy/modules/kernel/files.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.8.7/policy/modules/kernel/files.fc --- nsaserefpolicy/policy/modules/kernel/files.fc 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/files.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/files.fc 2010-07-14 14:08:02.000000000 -0400 @@ -18,6 +18,7 @@ /fsckoptions -- gen_context(system_u:object_r:etc_runtime_t,s0) /halt -- gen_context(system_u:object_r:etc_runtime_t,s0) @@ -7269,18 +6965,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. HOME_ROOT/\.journal <> HOME_ROOT/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh) HOME_ROOT/lost\+found/.* <> -@@ -159,6 +168,10 @@ +@@ -159,6 +168,12 @@ /proc -d <> /proc/.* <> +ifdef(`distro_redhat',` +/rhev -d gen_context(system_u:object_r:mnt_t,s0) ++/rhev(/[^/]*)? -d gen_context(system_u:object_r:mnt_t,s0) ++/rhev/[^/]*/.* <> +') + # # /selinux # -@@ -172,12 +185,6 @@ +@@ -172,12 +187,6 @@ /srv/.* gen_context(system_u:object_r:var_t,s0) # @@ -7293,7 +6991,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # /tmp # /tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh) -@@ -217,7 +224,6 @@ +@@ -217,7 +226,6 @@ ifndef(`distro_redhat',` /usr/local/src(/.*)? gen_context(system_u:object_r:src_t,s0) @@ -7301,7 +6999,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. /usr/src(/.*)? gen_context(system_u:object_r:src_t,s0) /usr/src/kernels/.+/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) ') -@@ -233,6 +239,8 @@ +@@ -233,6 +241,8 @@ /var/ftp/etc(/.*)? gen_context(system_u:object_r:etc_t,s0) @@ -7310,15 +7008,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. /var/lib(/.*)? gen_context(system_u:object_r:var_lib_t,s0) /var/lib/nfs/rpc_pipefs(/.*)? <> -@@ -258,3 +266,5 @@ +@@ -249,7 +259,7 @@ + /var/spool(/.*)? gen_context(system_u:object_r:var_spool_t,s0) + /var/spool/postfix/etc(/.*)? gen_context(system_u:object_r:etc_t,s0) + +-/var/tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh) ++/var/tmp gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh) + /var/tmp/.* <> + /var/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh) + /var/tmp/lost\+found/.* <> +@@ -258,3 +268,5 @@ ifdef(`distro_debian',` /var/run/motd -- gen_context(system_u:object_r:etc_runtime_t,s0) ') +/nsr(/.*)? gen_context(system_u:object_r:var_t,s0) +/nsr/logs(/.*)? gen_context(system_u:object_r:var_log_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.8.6/policy/modules/kernel/files.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.8.7/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/files.if 2010-07-12 15:49:18.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/files.if 2010-07-14 14:08:02.000000000 -0400 @@ -1053,10 +1053,8 @@ relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 }) relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 }) @@ -7807,9 +7514,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. + + allow $1 file_type:kernel_service create_files_as; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.8.6/policy/modules/kernel/files.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.8.7/policy/modules/kernel/files.te --- nsaserefpolicy/policy/modules/kernel/files.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/files.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/files.te 2010-07-14 14:08:02.000000000 -0400 @@ -11,6 +11,7 @@ attribute mountpoint; attribute pidfile; @@ -7841,10 +7548,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. files_type(etc_runtime_t) #Temporarily in policy until FC5 dissappears typealias etc_runtime_t alias firstboot_rw_t; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.8.6/policy/modules/kernel/filesystem.if ---- nsaserefpolicy/policy/modules/kernel/filesystem.if 2010-06-08 10:35:48.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/filesystem.if 2010-07-12 09:05:35.000000000 -0400 -@@ -1207,7 +1207,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.8.7/policy/modules/kernel/filesystem.if +--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/filesystem.if 2010-07-14 14:08:02.000000000 -0400 +@@ -1233,7 +1233,7 @@ type cifs_t; ') @@ -7853,7 +7560,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ') ######################################## -@@ -1470,6 +1470,25 @@ +@@ -1496,6 +1496,25 @@ domain_auto_transition_pattern($1, cifs_t, $2) ') @@ -7879,7 +7586,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ####################################### ##

## Create, read, write, and delete dirs -@@ -1897,6 +1916,25 @@ +@@ -1923,6 +1942,25 @@ ######################################## ## @@ -7905,7 +7612,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ## Read and write hugetlbfs files. ## ## -@@ -1965,6 +2003,7 @@ +@@ -1991,6 +2029,7 @@ ') allow $1 inotifyfs_t:dir list_dir_perms; @@ -7913,7 +7620,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ') ######################################## -@@ -2361,6 +2400,25 @@ +@@ -2387,6 +2426,25 @@ ######################################## ## @@ -7939,7 +7646,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ## Append files ## on a NFS filesystem. ## -@@ -2415,7 +2473,7 @@ +@@ -2441,7 +2499,7 @@ type nfs_t; ') @@ -7948,7 +7655,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ') ######################################## -@@ -2603,6 +2661,24 @@ +@@ -2629,6 +2687,24 @@ ######################################## ## @@ -7956,82 +7663,37 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy +## +## +## -+## Domain not to audit. -+## -+## -+# -+interface(`fs_dontaudit_write_removable_files',` -+ gen_require(` -+ type removable_t; -+ ') -+ -+ dontaudit $1 removable_t:file write_file_perms; -+') -+ -+######################################## -+## - ## Read removable storage symbolic links. - ## - ## -@@ -2811,7 +2887,7 @@ - ######################################### - ## - ## Create, read, write, and delete symbolic links --## on a CIFS or SMB network filesystem. -+## on a NFS network filesystem. - ## - ## - ## -@@ -3936,6 +4012,24 @@ - - ######################################## - ## -+## dontaudit Read and write block nodes on tmpfs filesystems. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`fs_dontaudit_read_tmpfs_blk_dev',` -+ gen_require(` -+ type tmpfs_t; -+ ') -+ -+ dontaudit $1 tmpfs_t:blk_file read_blk_file_perms; -+') -+ -+######################################## -+## - ## Relabel character nodes on tmpfs filesystems. - ## - ## -@@ -4498,6 +4592,44 @@ - - ######################################## - ## -+## Get the attributes of all blk files with -+## a filesystem type. -+## -+## -+## -+## Domain allowed access. ++## Domain not to audit. +## +## +# -+interface(`fs_getattr_all_blk_files',` ++interface(`fs_dontaudit_write_removable_files',` + gen_require(` -+ attribute filesystem_type; ++ type removable_t; + ') + -+ getattr_blk_files_pattern($1, filesystem_type, filesystem_type) ++ dontaudit $1 removable_t:file write_file_perms; +') + +######################################## +## -+## Get the attributes of all chr files with -+## a filesystem type. + ## Read removable storage symbolic links. + ## + ## +@@ -2837,7 +2913,7 @@ + ######################################### + ## + ## Create, read, write, and delete symbolic links +-## on a CIFS or SMB network filesystem. ++## on a NFS network filesystem. + ## + ## + ## +@@ -3962,6 +4038,24 @@ + + ######################################## + ## ++## dontaudit Read and write block nodes on tmpfs filesystems. +## +## +## @@ -8039,22 +7701,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy +## +## +# -+interface(`fs_getattr_all_chr_files',` ++interface(`fs_dontaudit_read_tmpfs_blk_dev',` + gen_require(` -+ attribute filesystem_type; ++ type tmpfs_t; + ') + -+ getattr_chr_files_pattern($1, filesystem_type, filesystem_type) ++ dontaudit $1 tmpfs_t:blk_file read_blk_file_perms; +') + +######################################## +## - ## Do not audit attempts to get the attributes - ## of all files with a filesystem type. + ## Relabel character nodes on tmpfs filesystems. ## -@@ -4615,3 +4747,24 @@ - relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs) - relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs) + ## +@@ -4654,3 +4748,24 @@ + + typeattribute $1 filesystem_unconfined_type; ') + +######################################## @@ -8077,9 +7739,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy + dontaudit $1 filesystem_type:lnk_file { read }; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.8.6/policy/modules/kernel/filesystem.te ---- nsaserefpolicy/policy/modules/kernel/filesystem.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/filesystem.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.8.7/policy/modules/kernel/filesystem.te +--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/filesystem.te 2010-07-14 14:08:02.000000000 -0400 @@ -52,6 +52,7 @@ fs_type(anon_inodefs_t) files_mountpoint(anon_inodefs_t) @@ -8121,9 +7783,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy files_mountpoint(removable_t) # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.8.6/policy/modules/kernel/kernel.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.8.7/policy/modules/kernel/kernel.if --- nsaserefpolicy/policy/modules/kernel/kernel.if 2010-06-08 10:35:48.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/kernel.if 2010-07-12 14:45:02.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/kernel.if 2010-07-14 14:08:02.000000000 -0400 @@ -1977,7 +1977,7 @@ ') @@ -8182,9 +7844,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel + allow $1 kernel_t:unix_stream_socket connectto; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.8.6/policy/modules/kernel/kernel.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.8.7/policy/modules/kernel/kernel.te --- nsaserefpolicy/policy/modules/kernel/kernel.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/kernel.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/kernel.te 2010-07-14 14:08:02.000000000 -0400 @@ -156,6 +156,7 @@ # type unlabeled_t; @@ -8244,9 +7906,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ######################################## # # Unlabeled process local policy -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.8.6/policy/modules/kernel/selinux.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.8.7/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/selinux.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/selinux.if 2010-07-14 14:08:02.000000000 -0400 @@ -40,7 +40,7 @@ # because of this statement, any module which @@ -8304,9 +7966,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu + fs_type($1) + mls_trusted_object($1) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.8.6/policy/modules/kernel/storage.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.8.7/policy/modules/kernel/storage.fc --- nsaserefpolicy/policy/modules/kernel/storage.fc 2010-06-04 17:11:28.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/storage.fc 2010-07-12 14:46:51.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/storage.fc 2010-07-14 14:08:02.000000000 -0400 @@ -77,3 +77,6 @@ /dev/scramdisk/.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) @@ -8314,9 +7976,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag + +/lib/udev/devices/loop.* -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) +/lib/udev/devices/fuse -c gen_context(system_u:object_r:fuse_device_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.8.6/policy/modules/kernel/storage.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.8.7/policy/modules/kernel/storage.if --- nsaserefpolicy/policy/modules/kernel/storage.if 2010-06-04 17:11:28.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/storage.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/storage.if 2010-07-14 14:08:02.000000000 -0400 @@ -101,6 +101,8 @@ dev_list_all_dev_nodes($1) allow $1 fixed_disk_device_t:blk_file read_blk_file_perms; @@ -8326,9 +7988,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag typeattribute $1 fixed_disk_raw_read; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.8.6/policy/modules/kernel/terminal.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.8.7/policy/modules/kernel/terminal.if --- nsaserefpolicy/policy/modules/kernel/terminal.if 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/kernel/terminal.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/kernel/terminal.if 2010-07-14 14:08:02.000000000 -0400 @@ -292,9 +292,11 @@ interface(`term_dontaudit_use_console',` gen_require(` @@ -8369,9 +8031,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/auditadm.te serefpolicy-3.8.6/policy/modules/roles/auditadm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/auditadm.te serefpolicy-3.8.7/policy/modules/roles/auditadm.te --- nsaserefpolicy/policy/modules/roles/auditadm.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/roles/auditadm.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/roles/auditadm.te 2010-07-14 14:08:02.000000000 -0400 @@ -28,10 +28,13 @@ logging_manage_audit_config(auditadm_t) logging_run_auditctl(auditadm_t, auditadm_r) @@ -8386,26 +8048,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/auditad optional_policy(` consoletype_exec(auditadm_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/guest.te serefpolicy-3.8.6/policy/modules/roles/guest.te ---- nsaserefpolicy/policy/modules/roles/guest.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/roles/guest.te 2010-07-12 09:05:35.000000000 -0400 -@@ -15,11 +15,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/guest.te serefpolicy-3.8.7/policy/modules/roles/guest.te +--- nsaserefpolicy/policy/modules/roles/guest.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/roles/guest.te 2010-07-14 14:08:02.000000000 -0400 +@@ -14,4 +14,8 @@ + # Local policy # - optional_policy(` -- java_role_template(guest, guest_r, guest_t) -+ apache_role(guest_r, guest_t) - ') - --optional_policy(` -- mono_role_template(guest, guest_r, guest_t) --') -- -#gen_user(guest_u,, guest_r, s0, s0) ++optional_policy(` ++ apache_role(guest_r, guest_t) ++') ++ +gen_user(guest_u, user, guest_r, s0, s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/secadm.te serefpolicy-3.8.6/policy/modules/roles/secadm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/secadm.te serefpolicy-3.8.7/policy/modules/roles/secadm.te --- nsaserefpolicy/policy/modules/roles/secadm.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/roles/secadm.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/roles/secadm.te 2010-07-14 14:08:02.000000000 -0400 @@ -9,6 +9,8 @@ userdom_unpriv_user_template(secadm) @@ -8415,9 +8073,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/secadm. ######################################## # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.te serefpolicy-3.8.6/policy/modules/roles/staff.te ---- nsaserefpolicy/policy/modules/roles/staff.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/roles/staff.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.te serefpolicy-3.8.7/policy/modules/roles/staff.te +--- nsaserefpolicy/policy/modules/roles/staff.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/roles/staff.te 2010-07-14 14:08:02.000000000 -0400 @@ -8,25 +8,55 @@ role staff_r; @@ -8474,7 +8132,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.t bluetooth_role(staff_r, staff_t) ') -@@ -98,12 +128,18 @@ +@@ -94,12 +124,18 @@ oident_manage_user_content(staff_t) oident_relabel_user_content(staff_t) ') @@ -8493,7 +8151,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.t pyzor_role(staff_r, staff_t) ') -@@ -118,22 +154,27 @@ +@@ -114,22 +150,27 @@ optional_policy(` screen_role_template(staff, staff_r, staff_t) ') @@ -8521,11 +8179,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.t optional_policy(` sudo_role_template(staff, staff_r, staff_t) -@@ -145,6 +186,11 @@ +@@ -141,6 +182,11 @@ ') optional_policy(` -+ telepathysofiasip_role(staff_r, staff_t) ++ telepathy_dbus_session_role(staff_r, staff_t) +') + +ifndef(`distro_redhat',` @@ -8533,7 +8191,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.t thunderbird_role(staff_r, staff_t) ') -@@ -168,6 +214,78 @@ +@@ -164,6 +210,78 @@ wireshark_role(staff_r, staff_t) ') @@ -8612,9 +8270,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.t +optional_policy(` + userhelper_console_role_template(staff, staff_r, staff_usertype) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.te serefpolicy-3.8.6/policy/modules/roles/sysadm.te ---- nsaserefpolicy/policy/modules/roles/sysadm.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/roles/sysadm.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.te serefpolicy-3.8.7/policy/modules/roles/sysadm.te +--- nsaserefpolicy/policy/modules/roles/sysadm.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/roles/sysadm.te 2010-07-14 14:08:29.000000000 -0400 @@ -27,17 +27,29 @@ corecmd_exec_shell(sysadm_t) @@ -8723,8 +8381,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. ') optional_policy(` -@@ -164,9 +191,11 @@ - ethereal_run_tethereal(sysadm_t, sysadm_r) +@@ -159,9 +186,11 @@ + dpkg_run(sysadm_t, sysadm_r) ') +ifndef(`distro_redhat',` @@ -8735,7 +8393,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` firstboot_run(sysadm_t, sysadm_r) -@@ -176,6 +205,7 @@ +@@ -171,6 +200,7 @@ fstools_run(sysadm_t, sysadm_r) ') @@ -8743,7 +8401,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` games_role(sysadm_r, sysadm_t) ') -@@ -191,6 +221,7 @@ +@@ -186,6 +216,7 @@ optional_policy(` gpg_role(sysadm_r, sysadm_t) ') @@ -8751,7 +8409,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` hostname_run(sysadm_t, sysadm_r) -@@ -204,6 +235,9 @@ +@@ -199,6 +230,9 @@ ipsec_stream_connect(sysadm_t) # for lsof ipsec_getattr_key_sockets(sysadm_t) @@ -8761,7 +8419,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. ') optional_policy(` -@@ -211,12 +245,18 @@ +@@ -206,12 +240,18 @@ ') optional_policy(` @@ -8780,7 +8438,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` kudzu_run(sysadm_t, sysadm_r) -@@ -226,9 +266,11 @@ +@@ -221,9 +261,11 @@ libs_run_ldconfig(sysadm_t, sysadm_r) ') @@ -8792,7 +8450,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` logrotate_run(sysadm_t, sysadm_r) -@@ -251,8 +293,10 @@ +@@ -246,8 +288,10 @@ optional_policy(` mount_run(sysadm_t, sysadm_r) @@ -8803,7 +8461,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` mozilla_role(sysadm_r, sysadm_t) ') -@@ -260,6 +304,7 @@ +@@ -255,6 +299,7 @@ optional_policy(` mplayer_role(sysadm_r, sysadm_t) ') @@ -8811,7 +8469,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` mta_role(sysadm_r, sysadm_t) -@@ -274,6 +319,10 @@ +@@ -269,6 +314,10 @@ ') optional_policy(` @@ -8822,7 +8480,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. netutils_run(sysadm_t, sysadm_r) netutils_run_ping(sysadm_t, sysadm_r) netutils_run_traceroute(sysadm_t, sysadm_r) -@@ -307,8 +356,14 @@ +@@ -302,8 +351,14 @@ ') optional_policy(` @@ -8837,7 +8495,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` quota_run(sysadm_t, sysadm_r) -@@ -318,9 +373,11 @@ +@@ -313,9 +368,11 @@ raid_domtrans_mdadm(sysadm_t) ') @@ -8849,7 +8507,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` rpc_domtrans_nfsd(sysadm_t) -@@ -330,9 +387,11 @@ +@@ -325,9 +382,11 @@ rpm_run(sysadm_t, sysadm_r) ') @@ -8861,7 +8519,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` rsync_exec(sysadm_t) -@@ -357,8 +416,14 @@ +@@ -352,8 +411,14 @@ ') optional_policy(` @@ -8876,7 +8534,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` ssh_role_template(sysadm, sysadm_r, sysadm_t) -@@ -381,9 +446,11 @@ +@@ -376,9 +441,11 @@ sysnet_run_dhcpc(sysadm_t, sysadm_r) ') @@ -8888,7 +8546,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` tripwire_run_siggen(sysadm_t, sysadm_r) -@@ -392,17 +459,21 @@ +@@ -387,17 +454,21 @@ tripwire_run_twprint(sysadm_t, sysadm_r) ') @@ -8910,7 +8568,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` unconfined_domtrans(sysadm_t) -@@ -416,9 +487,11 @@ +@@ -411,9 +482,11 @@ usbmodules_run(sysadm_t, sysadm_r) ') @@ -8922,7 +8580,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` usermanage_run_admin_passwd(sysadm_t, sysadm_r) -@@ -426,9 +499,15 @@ +@@ -421,9 +494,15 @@ usermanage_run_useradd(sysadm_t, sysadm_r) ') @@ -8938,7 +8596,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. optional_policy(` vpn_run(sysadm_t, sysadm_r) -@@ -439,13 +518,30 @@ +@@ -434,13 +513,30 @@ ') optional_policy(` @@ -8969,9 +8627,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm. +kernel_read_fs_sysctls(sysadm_t) +modutils_read_module_deps(sysadm_t) +miscfiles_read_hwdata(sysadm_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.fc serefpolicy-3.8.6/policy/modules/roles/unconfineduser.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.fc serefpolicy-3.8.7/policy/modules/roles/unconfineduser.fc --- nsaserefpolicy/policy/modules/roles/unconfineduser.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/roles/unconfineduser.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/roles/unconfineduser.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,8 @@ +# Add programs here which should not be confined by SELinux +# e.g.: @@ -8981,9 +8639,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfi + +/usr/sbin/xrdp -- gen_context(system_u:object_r:unconfined_exec_t,s0) +/usr/sbin/xrdp-sesman -- gen_context(system_u:object_r:unconfined_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.if serefpolicy-3.8.6/policy/modules/roles/unconfineduser.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.if serefpolicy-3.8.7/policy/modules/roles/unconfineduser.if --- nsaserefpolicy/policy/modules/roles/unconfineduser.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/roles/unconfineduser.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/roles/unconfineduser.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,667 @@ +## Unconfiend user role + @@ -9652,9 +9310,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfi + + allow $1 unconfined_r; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.8.6/policy/modules/roles/unconfineduser.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.8.7/policy/modules/roles/unconfineduser.te --- nsaserefpolicy/policy/modules/roles/unconfineduser.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/roles/unconfineduser.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/roles/unconfineduser.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,443 @@ +policy_module(unconfineduser, 1.0.0) + @@ -10099,9 +9757,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfi + +gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unprivuser.te serefpolicy-3.8.6/policy/modules/roles/unprivuser.te ---- nsaserefpolicy/policy/modules/roles/unprivuser.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/roles/unprivuser.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unprivuser.te serefpolicy-3.8.7/policy/modules/roles/unprivuser.te +--- nsaserefpolicy/policy/modules/roles/unprivuser.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/roles/unprivuser.te 2010-07-14 14:08:02.000000000 -0400 @@ -12,10 +12,13 @@ userdom_unpriv_user_template(user) @@ -10116,7 +9774,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unprivu optional_policy(` auth_role(user_r, user_t) ') -@@ -108,11 +111,25 @@ +@@ -104,11 +107,25 @@ optional_policy(` rssh_role(user_r, user_t) ') @@ -10142,7 +9800,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unprivu optional_policy(` spamassassin_role(user_r, user_t) ') -@@ -153,6 +170,12 @@ +@@ -149,6 +166,12 @@ wireshark_role(user_r, user_t) ') @@ -10155,9 +9813,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unprivu optional_policy(` xserver_role(user_r, user_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/xguest.te serefpolicy-3.8.6/policy/modules/roles/xguest.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/xguest.te serefpolicy-3.8.7/policy/modules/roles/xguest.te --- nsaserefpolicy/policy/modules/roles/xguest.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/roles/xguest.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/roles/xguest.te 2010-07-14 14:08:02.000000000 -0400 @@ -14,7 +14,7 @@ ## @@ -10216,29 +9874,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/xguest. ') ') -@@ -80,19 +88,70 @@ +@@ -80,19 +88,74 @@ ') optional_policy(` - java_role(xguest_r, xguest_t) + apache_role(xguest_r, xguest_t) - ') - - optional_policy(` -- mozilla_role(xguest_r, xguest_t) -+ gnomeclock_dontaudit_dbus_chat(xguest_t) +') + +optional_policy(` -+ java_role_template(xguest, xguest_r, xguest_t) ++ gnomeclock_dontaudit_dbus_chat(xguest_t) +') + +optional_policy(` ++ java_role_template(xguest, xguest_r, xguest_t) + ') + + optional_policy(` +- mozilla_role(xguest_r, xguest_t) + mono_role_template(xguest, xguest_r, xguest_t) +') + +optional_policy(` + nsplugin_role(xguest_r, xguest_t) ++') ++ ++optional_policy(` ++ telepathy_dbus_session_role(xguest_r, xguest_t) ') optional_policy(` @@ -10278,23 +9940,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/xguest. + corenet_tcp_connect_speech_port(xguest_usertype) + corenet_tcp_sendrecv_transproxy_port(xguest_usertype) + corenet_tcp_connect_transproxy_port(xguest_usertype) - ') - ') - --#gen_user(xguest_u,, xguest_r, s0, s0) ++ ') ++') ++ +optional_policy(` + gen_require(` + type mozilla_t; -+ ') + ') + + allow xguest_t mozilla_t:process transition; + role xguest_r types mozilla_t; -+') -+ + ') + +-#gen_user(xguest_u,, xguest_r, s0, s0) +gen_user(xguest_u, user, xguest_r, s0, s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.fc serefpolicy-3.8.6/policy/modules/services/abrt.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.fc serefpolicy-3.8.7/policy/modules/services/abrt.fc --- nsaserefpolicy/policy/modules/services/abrt.fc 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/abrt.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/abrt.fc 2010-07-14 14:08:02.000000000 -0400 @@ -15,6 +15,7 @@ /var/run/abrt\.pid -- gen_context(system_u:object_r:abrt_var_run_t,s0) @@ -10303,9 +9965,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt /var/run/abrt(/.*)? gen_context(system_u:object_r:abrt_var_run_t,s0) /var/spool/abrt(/.*)? gen_context(system_u:object_r:abrt_var_cache_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.if serefpolicy-3.8.6/policy/modules/services/abrt.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.if serefpolicy-3.8.7/policy/modules/services/abrt.if --- nsaserefpolicy/policy/modules/services/abrt.if 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/abrt.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/abrt.if 2010-07-14 14:08:02.000000000 -0400 @@ -130,6 +130,10 @@ ') @@ -10379,9 +10041,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt ##################################### ## ## All of the rules required to administrate -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.te serefpolicy-3.8.6/policy/modules/services/abrt.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.te serefpolicy-3.8.7/policy/modules/services/abrt.te --- nsaserefpolicy/policy/modules/services/abrt.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/abrt.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/abrt.te 2010-07-14 14:08:02.000000000 -0400 @@ -5,6 +5,14 @@ # Declarations # @@ -10423,7 +10085,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt kernel_read_ring_buffer(abrt_t) kernel_read_system_state(abrt_t) -@@ -131,7 +140,7 @@ +@@ -121,6 +130,7 @@ + files_read_kernel_modules(abrt_t) + files_dontaudit_list_default(abrt_t) + files_dontaudit_read_default_files(abrt_t) ++files_dontaudit_read_all_symlinks(abrt_t) + + fs_list_inotifyfs(abrt_t) + fs_getattr_all_fs(abrt_t) +@@ -131,7 +141,7 @@ fs_read_nfs_symlinks(abrt_t) fs_search_all(abrt_t) @@ -10432,7 +10102,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt logging_read_generic_logs(abrt_t) logging_send_syslog_msg(abrt_t) -@@ -140,6 +149,11 @@ +@@ -140,6 +150,11 @@ miscfiles_read_localization(abrt_t) userdom_dontaudit_read_user_home_content_files(abrt_t) @@ -10444,7 +10114,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt optional_policy(` dbus_system_domain(abrt_t, abrt_exec_t) -@@ -150,7 +164,12 @@ +@@ -150,7 +165,12 @@ ') optional_policy(` @@ -10458,7 +10128,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt policykit_domtrans_auth(abrt_t) policykit_read_lib(abrt_t) policykit_read_reload(abrt_t) -@@ -178,6 +197,12 @@ +@@ -178,6 +198,12 @@ ') optional_policy(` @@ -10471,7 +10141,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt sssd_stream_connect(abrt_t) ') -@@ -203,6 +228,7 @@ +@@ -203,6 +229,7 @@ domain_read_all_domains_state(abrt_helper_t) files_read_etc_files(abrt_helper_t) @@ -10479,7 +10149,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt fs_list_inotifyfs(abrt_helper_t) fs_getattr_all_fs(abrt_helper_t) -@@ -217,11 +243,26 @@ +@@ -217,11 +244,26 @@ term_dontaudit_use_all_ptys(abrt_helper_t) ifdef(`hide_broken_symptoms', ` @@ -10506,9 +10176,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt + allow abrt_t domain:file write; + allow abrt_t domain:process setrlimit; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.te serefpolicy-3.8.6/policy/modules/services/afs.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.te serefpolicy-3.8.7/policy/modules/services/afs.te --- nsaserefpolicy/policy/modules/services/afs.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/afs.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/afs.te 2010-07-14 14:08:02.000000000 -0400 @@ -82,6 +82,10 @@ kernel_rw_afs_state(afs_t) @@ -10520,9 +10190,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs. corenet_all_recvfrom_unlabeled(afs_t) corenet_all_recvfrom_netlabel(afs_t) corenet_tcp_sendrecv_generic_if(afs_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.fc serefpolicy-3.8.6/policy/modules/services/aiccu.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.fc serefpolicy-3.8.7/policy/modules/services/aiccu.fc --- nsaserefpolicy/policy/modules/services/aiccu.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/aiccu.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/aiccu.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,6 @@ +/etc/aiccu.conf -- gen_context(system_u:object_r:aiccu_etc_t,s0) +/etc/rc\.d/init\.d/aiccu -- gen_context(system_u:object_r:aiccu_initrc_exec_t,s0) @@ -10530,9 +10200,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aicc +/usr/sbin/aiccu -- gen_context(system_u:object_r:aiccu_exec_t,s0) + +/var/run/aiccu\.pid -- gen_context(system_u:object_r:aiccu_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.if serefpolicy-3.8.6/policy/modules/services/aiccu.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.if serefpolicy-3.8.7/policy/modules/services/aiccu.if --- nsaserefpolicy/policy/modules/services/aiccu.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/aiccu.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/aiccu.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,118 @@ +## Automatic IPv6 Connectivity Client Utility. + @@ -10652,9 +10322,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aicc + admin_pattern($1, aiccu_var_run_t) + files_search_pids($1) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.te serefpolicy-3.8.6/policy/modules/services/aiccu.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.te serefpolicy-3.8.7/policy/modules/services/aiccu.te --- nsaserefpolicy/policy/modules/services/aiccu.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/aiccu.te 2010-07-12 15:29:32.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/aiccu.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,72 @@ +policy_module(aiccu, 1.0.0) + @@ -10728,9 +10398,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aicc +sysnet_domtrans_ifconfig(aiccu_t) +sysnet_dns_name_resolve(aiccu_t) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aisexec.te serefpolicy-3.8.6/policy/modules/services/aisexec.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aisexec.te serefpolicy-3.8.7/policy/modules/services/aisexec.te --- nsaserefpolicy/policy/modules/services/aisexec.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/aisexec.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/aisexec.te 2010-07-14 14:08:02.000000000 -0400 @@ -97,3 +97,6 @@ rhcs_rw_groupd_semaphores(aisexec_t) rhcs_rw_groupd_shm(aisexec_t) @@ -10738,9 +10408,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aise + +userdom_rw_semaphores(aisexec_t) +userdom_rw_unpriv_user_shared_mem(aisexec_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.8.6/policy/modules/services/apache.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.8.7/policy/modules/services/apache.fc --- nsaserefpolicy/policy/modules/services/apache.fc 2010-04-06 15:15:38.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/apache.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/apache.fc 2010-07-14 14:08:02.000000000 -0400 @@ -24,7 +24,6 @@ /usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0) @@ -10791,9 +10461,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +/var/www/svn/hooks(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) +/var/www/svn/conf(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.8.6/policy/modules/services/apache.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.8.7/policy/modules/services/apache.if --- nsaserefpolicy/policy/modules/services/apache.if 2010-04-06 15:15:38.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/apache.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/apache.if 2010-07-14 14:08:02.000000000 -0400 @@ -13,17 +13,13 @@ # template(`apache_content_template',` @@ -11203,9 +10873,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + dontaudit $1 httpd_t:unix_dgram_socket { read write }; + dontaudit $1 httpd_t:unix_stream_socket { read write }; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.8.6/policy/modules/services/apache.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.8.7/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/apache.te 2010-07-12 16:08:16.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/apache.te 2010-07-14 14:08:02.000000000 -0400 @@ -18,6 +18,8 @@ # Declarations # @@ -11760,9 +11430,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +typealias httpd_sys_script_t alias httpd_fastcgi_script_t; +typealias httpd_var_run_t alias httpd_fastcgi_var_run_t; + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.8.6/policy/modules/services/apcupsd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.8.7/policy/modules/services/apcupsd.te --- nsaserefpolicy/policy/modules/services/apcupsd.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/apcupsd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/apcupsd.te 2010-07-14 14:08:02.000000000 -0400 @@ -94,6 +94,10 @@ ') @@ -11774,9 +11444,28 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu mta_send_mail(apcupsd_t) mta_system_content(apcupsd_tmp_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.te serefpolicy-3.8.6/policy/modules/services/arpwatch.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apm.te serefpolicy-3.8.7/policy/modules/services/apm.te +--- nsaserefpolicy/policy/modules/services/apm.te 2010-06-18 13:07:19.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/apm.te 2010-07-14 16:43:57.000000000 -0400 +@@ -62,6 +62,7 @@ + dontaudit apmd_t self:capability { setuid dac_override dac_read_search sys_ptrace sys_tty_config }; + allow apmd_t self:process { signal_perms getsession }; + allow apmd_t self:fifo_file rw_fifo_file_perms; ++allow apmd_t self:netlink_socket create_socket_perms; + allow apmd_t self:unix_dgram_socket create_socket_perms; + allow apmd_t self:unix_stream_socket create_stream_socket_perms; + +@@ -81,6 +82,7 @@ + kernel_read_system_state(apmd_t) + kernel_write_proc_files(apmd_t) + ++dev_read_input(apmd_t) + dev_read_realtime_clock(apmd_t) + dev_read_urand(apmd_t) + dev_rw_apm_bios(apmd_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.te serefpolicy-3.8.7/policy/modules/services/arpwatch.te --- nsaserefpolicy/policy/modules/services/arpwatch.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/arpwatch.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/arpwatch.te 2010-07-14 14:08:02.000000000 -0400 @@ -63,6 +63,7 @@ corenet_udp_sendrecv_all_ports(arpwatch_t) @@ -11785,9 +11474,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpw dev_rw_generic_usb_dev(arpwatch_t) fs_getattr_all_fs(arpwatch_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.te serefpolicy-3.8.6/policy/modules/services/asterisk.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.te serefpolicy-3.8.7/policy/modules/services/asterisk.te --- nsaserefpolicy/policy/modules/services/asterisk.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/asterisk.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/asterisk.te 2010-07-14 14:08:02.000000000 -0400 @@ -99,6 +99,7 @@ corenet_tcp_bind_generic_node(asterisk_t) corenet_udp_bind_generic_node(asterisk_t) @@ -11815,9 +11504,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aste postgresql_stream_connect(asterisk_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.8.6/policy/modules/services/automount.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.8.7/policy/modules/services/automount.te --- nsaserefpolicy/policy/modules/services/automount.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/automount.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/automount.te 2010-07-14 14:08:02.000000000 -0400 @@ -145,6 +145,7 @@ # Run mount in the mount_t domain. @@ -11826,9 +11515,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto mount_signal(automount_t) userdom_dontaudit_use_unpriv_user_fds(automount_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.if serefpolicy-3.8.6/policy/modules/services/avahi.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.if serefpolicy-3.8.7/policy/modules/services/avahi.if --- nsaserefpolicy/policy/modules/services/avahi.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/avahi.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/avahi.if 2010-07-14 14:08:02.000000000 -0400 @@ -90,6 +90,7 @@ class dbus send_msg; ') @@ -11837,9 +11526,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah allow $1 avahi_t:dbus send_msg; allow avahi_t $1:dbus send_msg; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.if serefpolicy-3.8.6/policy/modules/services/bind.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.if serefpolicy-3.8.7/policy/modules/services/bind.if --- nsaserefpolicy/policy/modules/services/bind.if 2010-03-23 10:55:15.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/bind.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/bind.if 2010-07-14 14:08:02.000000000 -0400 @@ -359,9 +359,9 @@ interface(`bind_admin',` gen_require(` @@ -11862,9 +11551,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind files_list_pids($1) admin_pattern($1, named_var_run_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.te serefpolicy-3.8.6/policy/modules/services/bitlbee.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.te serefpolicy-3.8.7/policy/modules/services/bitlbee.te --- nsaserefpolicy/policy/modules/services/bitlbee.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/bitlbee.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/bitlbee.te 2010-07-14 14:08:02.000000000 -0400 @@ -27,6 +27,7 @@ # Local policy # @@ -11884,9 +11573,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitl miscfiles_read_localization(bitlbee_t) sysnet_dns_name_resolve(bitlbee_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.if serefpolicy-3.8.6/policy/modules/services/bluetooth.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.if serefpolicy-3.8.7/policy/modules/services/bluetooth.if --- nsaserefpolicy/policy/modules/services/bluetooth.if 2010-01-07 14:53:53.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/bluetooth.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/bluetooth.if 2010-07-14 14:08:02.000000000 -0400 @@ -117,6 +117,27 @@ ######################################## @@ -11934,9 +11623,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue files_list_var_lib($1) admin_pattern($1, bluetooth_var_lib_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.fc serefpolicy-3.8.6/policy/modules/services/boinc.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.fc serefpolicy-3.8.7/policy/modules/services/boinc.fc --- nsaserefpolicy/policy/modules/services/boinc.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/boinc.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/boinc.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,6 @@ + +/etc/rc\.d/init\.d/boinc_client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0) @@ -11944,9 +11633,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin +/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0) + +/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.if serefpolicy-3.8.6/policy/modules/services/boinc.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.if serefpolicy-3.8.7/policy/modules/services/boinc.if --- nsaserefpolicy/policy/modules/services/boinc.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/boinc.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/boinc.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,151 @@ + +## policy for boinc @@ -12099,9 +11788,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin + files_list_var_lib($1) + admin_pattern($1, boinc_var_lib_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.te serefpolicy-3.8.6/policy/modules/services/boinc.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.te serefpolicy-3.8.7/policy/modules/services/boinc.te --- nsaserefpolicy/policy/modules/services/boinc.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/boinc.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/boinc.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,96 @@ +policy_module(boinc,1.0.0) + @@ -12199,17 +11888,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin +sysnet_dns_name_resolve(boinc_t) + +mta_send_mail(boinc_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.fc serefpolicy-3.8.6/policy/modules/services/bugzilla.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.fc serefpolicy-3.8.7/policy/modules/services/bugzilla.fc --- nsaserefpolicy/policy/modules/services/bugzilla.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/bugzilla.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/bugzilla.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,4 @@ + +/usr/share/bugzilla(/.*)? -d gen_context(system_u:object_r:httpd_bugzilla_content_t,s0) +/usr/share/bugzilla(/.*)? -- gen_context(system_u:object_r:httpd_bugzilla_script_exec_t,s0) +/var/lib/bugzilla(/.*)? gen_context(system_u:object_r:httpd_bugzilla_rw_content_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.if serefpolicy-3.8.6/policy/modules/services/bugzilla.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.if serefpolicy-3.8.7/policy/modules/services/bugzilla.if --- nsaserefpolicy/policy/modules/services/bugzilla.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/bugzilla.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/bugzilla.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,39 @@ +## Bugzilla server + @@ -12250,9 +11939,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugz + + dontaudit $1 httpd_bugzilla_script_t:unix_stream_socket { read write }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.te serefpolicy-3.8.6/policy/modules/services/bugzilla.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.te serefpolicy-3.8.7/policy/modules/services/bugzilla.te --- nsaserefpolicy/policy/modules/services/bugzilla.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/bugzilla.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/bugzilla.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,56 @@ +policy_module(bugzilla, 1.0) + @@ -12310,9 +11999,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugz + postgresql_stream_connect(httpd_bugzilla_script_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.fc serefpolicy-3.8.6/policy/modules/services/cachefilesd.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.fc serefpolicy-3.8.7/policy/modules/services/cachefilesd.fc --- nsaserefpolicy/policy/modules/services/cachefilesd.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/cachefilesd.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cachefilesd.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,29 @@ +############################################################################### +# @@ -12343,9 +12032,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cach +/var/cache/fscache(/.*)? gen_context(system_u:object_r:cachefiles_var_t,s0) + +/var/run/cachefilesd\.pid -- gen_context(system_u:object_r:cachefiles_var_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.if serefpolicy-3.8.6/policy/modules/services/cachefilesd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.if serefpolicy-3.8.7/policy/modules/services/cachefilesd.if --- nsaserefpolicy/policy/modules/services/cachefilesd.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/cachefilesd.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cachefilesd.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,41 @@ +############################################################################### +# @@ -12388,9 +12077,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cach + allow cachefilesd_t $1:fifo_file rw_file_perms; + allow cachefilesd_t $1:process sigchld; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.te serefpolicy-3.8.6/policy/modules/services/cachefilesd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.te serefpolicy-3.8.7/policy/modules/services/cachefilesd.te --- nsaserefpolicy/policy/modules/services/cachefilesd.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/cachefilesd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cachefilesd.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,147 @@ +############################################################################### +# @@ -12539,9 +12228,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cach +fs_getattr_xattr_fs(cachefiles_kernel_t) + +dev_search_sysfs(cachefiles_kernel_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ccs.te serefpolicy-3.8.6/policy/modules/services/ccs.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ccs.te serefpolicy-3.8.7/policy/modules/services/ccs.te --- nsaserefpolicy/policy/modules/services/ccs.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ccs.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ccs.te 2010-07-14 14:08:02.000000000 -0400 @@ -118,5 +118,10 @@ ') @@ -12553,9 +12242,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ccs. +optional_policy(` unconfined_use_fds(ccs_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmaster.if serefpolicy-3.8.6/policy/modules/services/certmaster.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmaster.if serefpolicy-3.8.7/policy/modules/services/certmaster.if --- nsaserefpolicy/policy/modules/services/certmaster.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/certmaster.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/certmaster.if 2010-07-14 14:08:02.000000000 -0400 @@ -18,6 +18,25 @@ domtrans_pattern($1, certmaster_exec_t, certmaster_t) ') @@ -12582,9 +12271,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cert ####################################### ## ## read certmaster logs. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.if serefpolicy-3.8.6/policy/modules/services/certmonger.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.if serefpolicy-3.8.7/policy/modules/services/certmonger.if --- nsaserefpolicy/policy/modules/services/certmonger.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/certmonger.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/certmonger.if 2010-07-14 14:08:02.000000000 -0400 @@ -167,8 +167,8 @@ allow $2 system_r; @@ -12596,9 +12285,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cert - admin_pattern($1, cermonger_var_run_t) + admin_pattern($1, certmonger_var_run_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.te serefpolicy-3.8.6/policy/modules/services/certmonger.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.te serefpolicy-3.8.7/policy/modules/services/certmonger.te --- nsaserefpolicy/policy/modules/services/certmonger.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/certmonger.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/certmonger.te 2010-07-14 14:08:02.000000000 -0400 @@ -68,5 +68,5 @@ ') @@ -12606,28 +12295,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cert - unconfined_dbus_send(certmonger_t) + pcscd_stream_connect(certmonger_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cgroup.if serefpolicy-3.8.6/policy/modules/services/cgroup.if ---- nsaserefpolicy/policy/modules/services/cgroup.if 2010-06-08 10:35:48.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/cgroup.if 2010-07-12 09:05:35.000000000 -0400 -@@ -121,7 +121,6 @@ - gen_require(` - type cgred_t, cgconfig_t, cgred_var_run_t; - type cgconfig_etc_t, cgconfig_initrc_exec_t, cgred_initrc_exec_t; -- type cgred_etc_t; - ') - - allow $1 cgconfig_t:process { ptrace signal_perms getattr }; -@@ -131,7 +130,6 @@ - read_files_pattern($1, cgred_t, cgred_t) - - admin_pattern($1, cgconfig_etc_t) -- admin_pattern($1, cgred_etc_t) - files_search_etc($1) - - admin_pattern($1, cgred_var_run_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cgroup.te serefpolicy-3.8.6/policy/modules/services/cgroup.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cgroup.te serefpolicy-3.8.7/policy/modules/services/cgroup.te --- nsaserefpolicy/policy/modules/services/cgroup.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/cgroup.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cgroup.te 2010-07-14 14:08:02.000000000 -0400 @@ -18,8 +18,8 @@ type cgrules_etc_t; files_config_file(cgrules_etc_t) @@ -12639,9 +12309,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cgro init_daemon_domain(cgconfig_t, cgconfig_exec_t) type cgconfig_initrc_exec_t; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chronyd.if serefpolicy-3.8.6/policy/modules/services/chronyd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chronyd.if serefpolicy-3.8.7/policy/modules/services/chronyd.if --- nsaserefpolicy/policy/modules/services/chronyd.if 2010-03-29 15:04:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/chronyd.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/chronyd.if 2010-07-14 14:08:02.000000000 -0400 @@ -19,6 +19,24 @@ domtrans_pattern($1, chronyd_exec_t, chronyd_t) ') @@ -12748,9 +12418,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chro - admin_pattern($1, chronyd_tmp_t) + admin_pattern($1, chronyd_tmpfs_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chronyd.te serefpolicy-3.8.6/policy/modules/services/chronyd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chronyd.te serefpolicy-3.8.7/policy/modules/services/chronyd.te --- nsaserefpolicy/policy/modules/services/chronyd.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/chronyd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/chronyd.te 2010-07-14 14:08:02.000000000 -0400 @@ -15,6 +15,9 @@ type chronyd_keys_t; files_type(chronyd_keys_t) @@ -12780,11 +12450,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chro corenet_udp_bind_ntp_port(chronyd_t) # bind to udp/323 corenet_udp_bind_chronyd_port(chronyd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.8.6/policy/modules/services/clamav.te ---- nsaserefpolicy/policy/modules/services/clamav.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/clamav.te 2010-07-12 09:05:35.000000000 -0400 -@@ -92,7 +92,7 @@ - manage_dirs_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.8.7/policy/modules/services/clamav.te +--- nsaserefpolicy/policy/modules/services/clamav.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/clamav.te 2010-07-14 14:08:02.000000000 -0400 +@@ -89,9 +89,10 @@ + logging_log_filetrans(clamd_t, clamd_var_log_t, { dir file }) + + # pid file ++manage_dirs_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t) manage_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t) manage_sock_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t) -files_pid_filetrans(clamd_t, clamd_var_run_t, { file dir }) @@ -12792,7 +12465,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam kernel_dontaudit_list_proc(clamd_t) kernel_read_sysctl(clamd_t) -@@ -184,6 +184,7 @@ +@@ -189,6 +190,7 @@ corenet_tcp_sendrecv_all_ports(freshclam_t) corenet_tcp_sendrecv_clamd_port(freshclam_t) corenet_tcp_connect_http_port(freshclam_t) @@ -12800,7 +12473,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam corenet_sendrecv_http_client_packets(freshclam_t) dev_read_rand(freshclam_t) -@@ -202,6 +203,8 @@ +@@ -207,6 +209,8 @@ clamav_stream_connect(freshclam_t) @@ -12809,20 +12482,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam optional_policy(` cron_system_entry(freshclam_t, freshclam_exec_t) ') -@@ -257,8 +260,10 @@ - - tunable_policy(`clamd_use_jit',` - allow clamd_t self:process execmem; -+ allow clamscan_t self:process execmem; - ', ` - dontaudit clamd_t self:process execmem; -+ dontaudit clamscan_t self:process execmem; - ') - - optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmirrord.fc serefpolicy-3.8.6/policy/modules/services/cmirrord.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmirrord.fc serefpolicy-3.8.7/policy/modules/services/cmirrord.fc --- nsaserefpolicy/policy/modules/services/cmirrord.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/cmirrord.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cmirrord.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,6 @@ + +/etc/rc\.d/init\.d/cmirrord -- gen_context(system_u:object_r:cmirrord_initrc_exec_t,s0) @@ -12830,9 +12492,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmir +/usr/sbin/cmirrord -- gen_context(system_u:object_r:cmirrord_exec_t,s0) + +/var/run/cmirrord\.pid -- gen_context(system_u:object_r:cmirrord_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmirrord.if serefpolicy-3.8.6/policy/modules/services/cmirrord.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmirrord.if serefpolicy-3.8.7/policy/modules/services/cmirrord.if --- nsaserefpolicy/policy/modules/services/cmirrord.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/cmirrord.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cmirrord.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,118 @@ + +## policy for cmirrord @@ -12952,9 +12614,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmir + admin_pattern($1, cmirrord_var_run_t) + +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmirrord.te serefpolicy-3.8.6/policy/modules/services/cmirrord.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmirrord.te serefpolicy-3.8.7/policy/modules/services/cmirrord.te --- nsaserefpolicy/policy/modules/services/cmirrord.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/cmirrord.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cmirrord.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,56 @@ +policy_module(cmirrord,1.0.0) + @@ -13012,9 +12674,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cmir +optional_policy(` + corosync_stream_connect(cmirrord_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobbler.fc serefpolicy-3.8.6/policy/modules/services/cobbler.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobbler.fc serefpolicy-3.8.7/policy/modules/services/cobbler.fc --- nsaserefpolicy/policy/modules/services/cobbler.fc 2010-02-12 10:33:09.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/cobbler.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cobbler.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,7 +1,32 @@ -/etc/cobbler(/.*)? gen_context(system_u:object_r:cobbler_etc_t, s0) -/etc/rc\.d/init\.d/cobblerd -- gen_context(system_u:object_r:cobblerd_initrc_exec_t, s0) @@ -13053,9 +12715,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobb -/var/lib/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_lib_t, s0) -/var/log/cobbler(/.*)? gen_context(system_u:object_r:cobbler_var_log_t, s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobbler.if serefpolicy-3.8.6/policy/modules/services/cobbler.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobbler.if serefpolicy-3.8.7/policy/modules/services/cobbler.if --- nsaserefpolicy/policy/modules/services/cobbler.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/cobbler.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cobbler.if 2010-07-14 14:08:02.000000000 -0400 @@ -1,14 +1,4 @@ ## Cobbler installation server. -## @@ -13307,9 +12969,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobb + tftp_search_rw_content($1) + ') ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobbler.te serefpolicy-3.8.6/policy/modules/services/cobbler.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobbler.te serefpolicy-3.8.7/policy/modules/services/cobbler.te --- nsaserefpolicy/policy/modules/services/cobbler.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/cobbler.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cobbler.te 2010-07-14 14:08:02.000000000 -0400 @@ -1,3 +1,4 @@ + policy_module(cobbler, 1.1.0) @@ -13558,9 +13220,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cobb + # Something that runs in the cobberd_t domain tries to relabelfrom cobbler_content_t dir to httpd_sys_content_t. + dontaudit cobblerd_t httpdcontent:dir relabel_dir_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.8.6/policy/modules/services/consolekit.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.8.7/policy/modules/services/consolekit.te --- nsaserefpolicy/policy/modules/services/consolekit.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/consolekit.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/consolekit.te 2010-07-14 14:08:02.000000000 -0400 @@ -15,6 +15,9 @@ type consolekit_var_run_t; files_pid_file(consolekit_var_run_t) @@ -13625,9 +13287,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons + unconfined_ptrace(consolekit_t) unconfined_stream_connect(consolekit_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/corosync.fc serefpolicy-3.8.6/policy/modules/services/corosync.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/corosync.fc serefpolicy-3.8.7/policy/modules/services/corosync.fc --- nsaserefpolicy/policy/modules/services/corosync.fc 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/corosync.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/corosync.fc 2010-07-14 14:08:02.000000000 -0400 @@ -3,6 +3,7 @@ /usr/sbin/corosync -- gen_context(system_u:object_r:corosync_exec_t,s0) @@ -13636,9 +13298,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/coro /var/lib/corosync(/.*)? gen_context(system_u:object_r:corosync_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/corosync.te serefpolicy-3.8.6/policy/modules/services/corosync.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/corosync.te serefpolicy-3.8.7/policy/modules/services/corosync.te --- nsaserefpolicy/policy/modules/services/corosync.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/corosync.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/corosync.te 2010-07-14 14:08:02.000000000 -0400 @@ -5,6 +5,13 @@ # Declarations # @@ -13724,9 +13386,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/coro ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.8.6/policy/modules/services/cron.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.8.7/policy/modules/services/courier.te +--- nsaserefpolicy/policy/modules/services/courier.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/courier.te 2010-07-14 14:08:02.000000000 -0400 +@@ -48,6 +48,7 @@ + allow courier_authdaemon_t courier_tcpd_t:tcp_socket rw_stream_socket_perms; + allow courier_authdaemon_t courier_tcpd_t:unix_stream_socket rw_stream_socket_perms; + allow courier_authdaemon_t courier_tcpd_t:process sigchld; ++allow courier_authdaemon_t courier_tcpd_t:fd use; + allow courier_authdaemon_t courier_tcpd_t:tcp_socket rw_stream_socket_perms; + allow courier_authdaemon_t courier_tcpd_t:fifo_file rw_file_perms; + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.8.7/policy/modules/services/cron.fc --- nsaserefpolicy/policy/modules/services/cron.fc 2009-09-16 09:09:20.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/cron.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cron.fc 2010-07-14 14:08:02.000000000 -0400 @@ -14,7 +14,7 @@ /var/run/anacron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) /var/run/atd\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) @@ -13744,9 +13417,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron +/var/lib/glpi/files(/.*)? gen_context(system_u:object_r:cron_var_lib_t,s0) + +/var/log/mcelog.* -- gen_context(system_u:object_r:cron_log_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.8.6/policy/modules/services/cron.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.8.7/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2009-09-16 09:09:20.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/cron.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cron.if 2010-07-14 14:08:02.000000000 -0400 @@ -12,6 +12,10 @@ ## # @@ -13930,9 +13603,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron + + manage_files_pattern($1, system_cronjob_var_lib_t, system_cronjob_var_lib_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.8.6/policy/modules/services/cron.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.8.7/policy/modules/services/cron.te --- nsaserefpolicy/policy/modules/services/cron.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/cron.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cron.te 2010-07-14 14:08:02.000000000 -0400 @@ -63,9 +63,12 @@ type crond_tmp_t; @@ -14226,9 +13899,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron read_files_pattern(crond_t, user_cron_spool_t, user_cron_spool_t) tunable_policy(`fcron_crond', ` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.8.6/policy/modules/services/cups.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.8.7/policy/modules/services/cups.fc --- nsaserefpolicy/policy/modules/services/cups.fc 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/cups.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cups.fc 2010-07-14 14:08:02.000000000 -0400 @@ -71,3 +71,9 @@ /var/run/ptal-mlcd(/.*)? gen_context(system_u:object_r:ptal_var_run_t,s0) /var/run/udev-configure-printer(/.*)? gen_context(system_u:object_r:cupsd_config_var_run_t,s0) @@ -14239,9 +13912,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups +/usr/local/Printer/(.*/)?inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) + +/usr/local/linuxprinter/ppd(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.if serefpolicy-3.8.6/policy/modules/services/cups.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.if serefpolicy-3.8.7/policy/modules/services/cups.if --- nsaserefpolicy/policy/modules/services/cups.if 2009-07-28 15:51:13.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/cups.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cups.if 2010-07-14 14:08:02.000000000 -0400 @@ -314,7 +314,7 @@ interface(`cups_admin',` gen_require(` @@ -14261,9 +13934,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups admin_pattern($1, cupsd_tmp_t) files_list_tmp($1) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.8.6/policy/modules/services/cups.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.8.7/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/cups.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cups.te 2010-07-14 14:08:02.000000000 -0400 @@ -15,6 +15,7 @@ type cupsd_t; type cupsd_exec_t; @@ -14337,18 +14010,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups tunable_policy(`use_nfs_home_dirs',` fs_search_auto_mountpoints(cups_pdf_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.8.6/policy/modules/services/cvs.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.8.7/policy/modules/services/cvs.te --- nsaserefpolicy/policy/modules/services/cvs.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/cvs.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cvs.te 2010-07-14 14:08:02.000000000 -0400 @@ -112,4 +112,5 @@ read_files_pattern(httpd_cvs_script_t, cvs_data_t, cvs_data_t) manage_dirs_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t) manage_files_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t) + files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir }) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-3.8.6/policy/modules/services/cyrus.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-3.8.7/policy/modules/services/cyrus.te --- nsaserefpolicy/policy/modules/services/cyrus.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/cyrus.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/cyrus.te 2010-07-14 14:08:02.000000000 -0400 @@ -135,6 +135,7 @@ ') @@ -14357,9 +14030,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru snmp_read_snmp_var_lib_files(cyrus_t) snmp_dontaudit_write_snmp_var_lib_files(cyrus_t) snmp_stream_connect(cyrus_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.8.6/policy/modules/services/dbus.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.8.7/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/dbus.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/dbus.if 2010-07-14 14:08:02.000000000 -0400 @@ -42,8 +42,10 @@ gen_require(` class dbus { send_msg acquire_svc }; @@ -14442,9 +14115,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ifdef(`hide_broken_symptoms', ` dontaudit $1 system_dbusd_t:netlink_selinux_socket { read write }; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.8.6/policy/modules/services/dbus.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.8.7/policy/modules/services/dbus.te --- nsaserefpolicy/policy/modules/services/dbus.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/dbus.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/dbus.te 2010-07-14 14:08:02.000000000 -0400 @@ -121,6 +121,7 @@ init_use_fds(system_dbusd_t) @@ -14484,9 +14157,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus + xserver_rw_xdm_pipes(session_bus_type) + xserver_append_xdm_home_files(session_bus_type) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/denyhosts.te serefpolicy-3.8.6/policy/modules/services/denyhosts.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/denyhosts.te serefpolicy-3.8.7/policy/modules/services/denyhosts.te --- nsaserefpolicy/policy/modules/services/denyhosts.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/denyhosts.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/denyhosts.te 2010-07-14 14:08:02.000000000 -0400 @@ -25,7 +25,8 @@ # # DenyHosts personal policy. @@ -14505,7 +14178,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/deny corenet_sendrecv_smtp_client_packets(denyhosts_t) dev_read_urand(denyhosts_t) -@@ -61,9 +63,11 @@ +@@ -61,12 +63,18 @@ # /var/log/secure logging_read_generic_logs(denyhosts_t) @@ -14517,9 +14190,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/deny sysnet_manage_config(denyhosts_t) sysnet_etc_filetrans_config(denyhosts_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.8.6/policy/modules/services/devicekit.te + optional_policy(` + cron_system_entry(denyhosts_t, denyhosts_exec_t) + ') ++ ++optional_policy(` ++ gnome_dontaudit_search_config(denyhosts_t) ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.8.7/policy/modules/services/devicekit.te --- nsaserefpolicy/policy/modules/services/devicekit.te 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/devicekit.te 2010-07-12 16:35:15.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/devicekit.te 2010-07-14 14:08:02.000000000 -0400 @@ -75,10 +75,12 @@ manage_files_pattern(devicekit_disk_t, devicekit_var_lib_t, devicekit_var_lib_t) files_var_lib_filetrans(devicekit_disk_t, devicekit_var_lib_t, dir) @@ -14566,9 +14246,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devi allow devicekit_power_t self:fifo_file rw_fifo_file_perms; allow devicekit_power_t self:unix_dgram_socket create_socket_perms; allow devicekit_power_t self:netlink_kobject_uevent_socket create_socket_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.8.6/policy/modules/services/dhcp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.8.7/policy/modules/services/dhcp.te --- nsaserefpolicy/policy/modules/services/dhcp.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/dhcp.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/dhcp.te 2010-07-14 14:08:02.000000000 -0400 @@ -111,6 +111,11 @@ ') @@ -14581,9 +14261,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp dbus_system_bus_client(dhcpd_t) dbus_connect_system_bus(dhcpd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.8.6/policy/modules/services/dnsmasq.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-3.8.7/policy/modules/services/djbdns.te +--- nsaserefpolicy/policy/modules/services/djbdns.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/djbdns.te 2010-07-14 14:08:02.000000000 -0400 +@@ -22,6 +22,8 @@ + # Local policy for axfrdns component + # + ++files_config_file(djbdns_axfrdns_conf_t) ++ + daemontools_ipc_domain(djbdns_axfrdns_t) + daemontools_read_svc(djbdns_axfrdns_t) + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.8.7/policy/modules/services/dnsmasq.te --- nsaserefpolicy/policy/modules/services/dnsmasq.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/dnsmasq.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/dnsmasq.te 2010-07-14 14:08:02.000000000 -0400 @@ -92,7 +92,11 @@ userdom_dontaudit_search_user_home_dirs(dnsmasq_t) @@ -14597,9 +14289,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsm ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.8.6/policy/modules/services/dovecot.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.8.7/policy/modules/services/dovecot.fc --- nsaserefpolicy/policy/modules/services/dovecot.fc 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/dovecot.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/dovecot.fc 2010-07-14 14:08:02.000000000 -0400 @@ -25,7 +25,7 @@ ifdef(`distro_redhat', ` /usr/libexec/dovecot/auth -- gen_context(system_u:object_r:dovecot_auth_exec_t,s0) @@ -14609,9 +14301,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove /usr/libexec/dovecot/dovecot-auth -- gen_context(system_u:object_r:dovecot_auth_exec_t,s0) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.8.6/policy/modules/services/dovecot.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.8.7/policy/modules/services/dovecot.if --- nsaserefpolicy/policy/modules/services/dovecot.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/dovecot.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/dovecot.if 2010-07-14 14:08:02.000000000 -0400 @@ -93,12 +93,14 @@ # interface(`dovecot_admin',` @@ -14653,9 +14345,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove files_list_pids($1) admin_pattern($1, dovecot_var_run_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.8.6/policy/modules/services/dovecot.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.8.7/policy/modules/services/dovecot.te --- nsaserefpolicy/policy/modules/services/dovecot.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/dovecot.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/dovecot.te 2010-07-14 14:08:02.000000000 -0400 @@ -58,7 +58,7 @@ allow dovecot_t self:capability { dac_override dac_read_search chown kill net_bind_service setgid setuid sys_chroot }; @@ -14681,7 +14373,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove postfix_search_spool(dovecot_auth_t) ') -@@ -256,9 +258,15 @@ +@@ -256,16 +258,22 @@ allow dovecot_deliver_t dovecot_etc_t:file read_file_perms; allow dovecot_deliver_t dovecot_var_run_t:dir list_dir_perms; @@ -14697,15 +14389,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove files_read_etc_files(dovecot_deliver_t) files_read_etc_runtime_files(dovecot_deliver_t) + auth_use_nsswitch(dovecot_deliver_t) + + logging_send_syslog_msg(dovecot_deliver_t) +-logging_search_logs(dovecot_auth_t) ++logging_search_logs(dovecot_deliver_t) + + miscfiles_read_localization(dovecot_deliver_t) + @@ -302,4 +310,5 @@ optional_policy(` mta_manage_spool(dovecot_deliver_t) + mta_read_queue(dovecot_deliver_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.fc serefpolicy-3.8.6/policy/modules/services/exim.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.fc serefpolicy-3.8.7/policy/modules/services/exim.fc --- nsaserefpolicy/policy/modules/services/exim.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/exim.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/exim.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,3 +1,6 @@ + +/etc/rc\.d/init\.d/exim -- gen_context(system_u:object_r:exim_initrc_exec_t,s0) @@ -14713,9 +14413,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim /usr/sbin/exim[0-9]? -- gen_context(system_u:object_r:exim_exec_t,s0) /var/log/exim[0-9]?(/.*)? gen_context(system_u:object_r:exim_log_t,s0) /var/run/exim[0-9]?\.pid -- gen_context(system_u:object_r:exim_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.if serefpolicy-3.8.6/policy/modules/services/exim.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.if serefpolicy-3.8.7/policy/modules/services/exim.if --- nsaserefpolicy/policy/modules/services/exim.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/exim.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/exim.if 2010-07-14 14:08:02.000000000 -0400 @@ -20,6 +20,24 @@ ######################################## @@ -14788,9 +14488,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim + files_search_pids($1) + admin_pattern($1, exim_var_run_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.8.6/policy/modules/services/exim.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.8.7/policy/modules/services/exim.te --- nsaserefpolicy/policy/modules/services/exim.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/exim.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/exim.te 2010-07-14 14:08:02.000000000 -0400 @@ -35,6 +35,9 @@ application_executable_file(exim_exec_t) mta_agent_executable(exim_exec_t) @@ -14812,9 +14512,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim tunable_policy(`exim_can_connect_db',` mysql_stream_connect(exim_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.if serefpolicy-3.8.6/policy/modules/services/fail2ban.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.if serefpolicy-3.8.7/policy/modules/services/fail2ban.if --- nsaserefpolicy/policy/modules/services/fail2ban.if 2010-03-18 06:48:09.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/fail2ban.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/fail2ban.if 2010-07-14 14:08:02.000000000 -0400 @@ -138,6 +138,26 @@ ######################################## @@ -14842,18 +14542,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail ## All of the rules required to administrate ## an fail2ban environment ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fprintd.te serefpolicy-3.8.6/policy/modules/services/fprintd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.te serefpolicy-3.8.7/policy/modules/services/fail2ban.te +--- nsaserefpolicy/policy/modules/services/fail2ban.te 2010-06-18 13:07:19.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/fail2ban.te 2010-07-14 14:08:02.000000000 -0400 +@@ -94,5 +94,9 @@ + ') + + optional_policy(` ++ gnome_dontaudit_search_config(fail2ban_t) ++') ++ ++optional_policy(` + iptables_domtrans(fail2ban_t) + ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fprintd.te serefpolicy-3.8.7/policy/modules/services/fprintd.te --- nsaserefpolicy/policy/modules/services/fprintd.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/fprintd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/fprintd.te 2010-07-14 14:08:02.000000000 -0400 @@ -54,4 +54,5 @@ policykit_read_lib(fprintd_t) policykit_dbus_chat(fprintd_t) policykit_domtrans_auth(fprintd_t) + policykit_dbus_chat_auth(fprintd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.8.6/policy/modules/services/ftp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.8.7/policy/modules/services/ftp.te --- nsaserefpolicy/policy/modules/services/ftp.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ftp.te 2010-07-12 16:27:22.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ftp.te 2010-07-14 14:08:02.000000000 -0400 @@ -40,6 +40,13 @@ ## @@ -14991,9 +14704,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. ') tunable_policy(`sftpd_enable_homedirs && use_nfs_home_dirs',` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.fc serefpolicy-3.8.6/policy/modules/services/git.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.fc serefpolicy-3.8.7/policy/modules/services/git.fc --- nsaserefpolicy/policy/modules/services/git.fc 2010-04-05 14:44:26.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/git.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/git.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,3 +1,12 @@ +HOME_DIR/public_git(/.*)? gen_context(system_u:object_r:git_session_content_t, s0) +HOME_DIR/\.gitconfig -- gen_context(system_u:object_r:git_session_content_t, s0) @@ -15007,9 +14720,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git. /var/www/cgi-bin/cgit -- gen_context(system_u:object_r:httpd_git_script_exec_t,s0) +/var/www/git(/.*)? gen_context(system_u:object_r:httpd_git_content_t,s0) +/var/www/git/gitweb.cgi gen_context(system_u:object_r:httpd_git_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.if serefpolicy-3.8.6/policy/modules/services/git.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.if serefpolicy-3.8.7/policy/modules/services/git.if --- nsaserefpolicy/policy/modules/services/git.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/git.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/git.if 2010-07-14 14:08:02.000000000 -0400 @@ -1 +1,525 @@ -## GIT revision control system +## Fast Version Control System. @@ -15537,9 +15250,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git. + userdom_search_user_home_dirs($1) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.te serefpolicy-3.8.6/policy/modules/services/git.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.te serefpolicy-3.8.7/policy/modules/services/git.te --- nsaserefpolicy/policy/modules/services/git.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/git.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/git.te 2010-07-14 14:08:02.000000000 -0400 @@ -1,8 +1,192 @@ -policy_module(git, 1.0) +policy_module(git, 1.0.3) @@ -15736,9 +15449,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git. +git_role_template(git_shell) +gen_user(git_shell_u, user, git_shell_r, s0, s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.if serefpolicy-3.8.6/policy/modules/services/gnomeclock.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.if serefpolicy-3.8.7/policy/modules/services/gnomeclock.if --- nsaserefpolicy/policy/modules/services/gnomeclock.if 2009-09-16 10:01:13.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/gnomeclock.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/gnomeclock.if 2010-07-14 14:08:02.000000000 -0400 @@ -63,3 +63,24 @@ allow $1 gnomeclock_t:dbus send_msg; allow gnomeclock_t $1:dbus send_msg; @@ -15764,9 +15477,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnom + dontaudit $1 gnomeclock_t:dbus send_msg; + dontaudit gnomeclock_t $1:dbus send_msg; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.te serefpolicy-3.8.6/policy/modules/services/gpsd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.te serefpolicy-3.8.7/policy/modules/services/gpsd.te --- nsaserefpolicy/policy/modules/services/gpsd.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/gpsd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/gpsd.te 2010-07-14 14:08:02.000000000 -0400 @@ -56,6 +56,10 @@ miscfiles_read_localization(gpsd_t) @@ -15778,9 +15491,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd dbus_system_bus_client(gpsd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.8.6/policy/modules/services/hal.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.8.7/policy/modules/services/hal.if --- nsaserefpolicy/policy/modules/services/hal.if 2010-02-12 10:33:09.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/hal.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/hal.if 2010-07-14 14:08:02.000000000 -0400 @@ -377,6 +377,26 @@ ######################################## @@ -15808,9 +15521,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. ## Read/Write hald PID files. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.8.6/policy/modules/services/hal.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.8.7/policy/modules/services/hal.te --- nsaserefpolicy/policy/modules/services/hal.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/hal.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/hal.te 2010-07-14 14:08:02.000000000 -0400 @@ -54,6 +54,9 @@ type hald_var_lib_t; files_type(hald_var_lib_t) @@ -15905,20 +15618,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. ######################################## # # Local hald dccm policy -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hddtemp.te serefpolicy-3.8.6/policy/modules/services/hddtemp.te ---- nsaserefpolicy/policy/modules/services/hddtemp.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/hddtemp.te 2010-07-12 09:05:35.000000000 -0400 -@@ -26,6 +26,7 @@ - corenet_tcp_bind_all_nodes(hddtemp_t) - corenet_tcp_bind_hddtemp_port(hddtemp_t) - -+files_read_etc_files(hddtemp_t) - # read hddtemp db file - files_read_usr_files(hddtemp_t) - -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/icecast.te serefpolicy-3.8.6/policy/modules/services/icecast.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hddtemp.fc serefpolicy-3.8.7/policy/modules/services/hddtemp.fc +--- nsaserefpolicy/policy/modules/services/hddtemp.fc 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/hddtemp.fc 2010-07-14 14:08:02.000000000 -0400 +@@ -1,5 +1,3 @@ + /etc/rc\.d/init\.d/hddtemp -- gen_context(system_u:object_r:hddtemp_initrc_exec_t,s0) + +-/etc/sysconfig/hddtemp -- gen_context(system_u:object_r:hddtemp_etc_t,s0) +- + /usr/sbin/hddtemp -- gen_context(system_u:object_r:hddtemp_exec_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/icecast.te serefpolicy-3.8.7/policy/modules/services/icecast.te --- nsaserefpolicy/policy/modules/services/icecast.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/icecast.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/icecast.te 2010-07-14 14:08:02.000000000 -0400 @@ -37,6 +37,8 @@ manage_files_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t) files_pid_filetrans(icecast_t, icecast_var_run_t, { file dir }) @@ -15938,9 +15649,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/icec +optional_policy(` rtkit_scheduled(icecast_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inn.te serefpolicy-3.8.6/policy/modules/services/inn.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inn.te serefpolicy-3.8.7/policy/modules/services/inn.te --- nsaserefpolicy/policy/modules/services/inn.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/inn.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/inn.te 2010-07-14 14:08:02.000000000 -0400 @@ -105,6 +105,7 @@ userdom_dontaudit_use_unpriv_user_fds(innd_t) @@ -15949,9 +15660,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inn. mta_send_mail(innd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.8.6/policy/modules/services/kerberos.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.8.7/policy/modules/services/kerberos.te --- nsaserefpolicy/policy/modules/services/kerberos.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/kerberos.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/kerberos.te 2010-07-14 14:08:02.000000000 -0400 @@ -126,10 +126,13 @@ corenet_tcp_bind_generic_node(kadmind_t) corenet_udp_bind_generic_node(kadmind_t) @@ -15976,18 +15687,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb manage_dirs_pattern(krb5kdc_t, krb5kdc_tmp_t, krb5kdc_tmp_t) manage_files_pattern(krb5kdc_t, krb5kdc_tmp_t, krb5kdc_tmp_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.fc serefpolicy-3.8.6/policy/modules/services/ksmtuned.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.fc serefpolicy-3.8.7/policy/modules/services/ksmtuned.fc --- nsaserefpolicy/policy/modules/services/ksmtuned.fc 2010-03-29 15:04:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ksmtuned.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ksmtuned.fc 2010-07-14 14:08:02.000000000 -0400 @@ -3,3 +3,5 @@ /usr/sbin/ksmtuned -- gen_context(system_u:object_r:ksmtuned_exec_t,s0) /var/run/ksmtune\.pid -- gen_context(system_u:object_r:ksmtuned_var_run_t,s0) + +/var/log/ksmtuned.* gen_context(system_u:object_r:ksmtuned_log_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.if serefpolicy-3.8.6/policy/modules/services/ksmtuned.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.if serefpolicy-3.8.7/policy/modules/services/ksmtuned.if --- nsaserefpolicy/policy/modules/services/ksmtuned.if 2010-03-29 15:04:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ksmtuned.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ksmtuned.if 2010-07-14 14:08:02.000000000 -0400 @@ -60,7 +60,7 @@ ') @@ -15997,9 +15708,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmt files_list_pids($1) admin_pattern($1, ksmtuned_var_run_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.te serefpolicy-3.8.6/policy/modules/services/ksmtuned.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.te serefpolicy-3.8.7/policy/modules/services/ksmtuned.te --- nsaserefpolicy/policy/modules/services/ksmtuned.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ksmtuned.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ksmtuned.te 2010-07-14 14:08:02.000000000 -0400 @@ -9,6 +9,9 @@ type ksmtuned_exec_t; init_daemon_domain(ksmtuned_t, ksmtuned_exec_t) @@ -16037,9 +15748,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmt + miscfiles_read_localization(ksmtuned_t) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.fc serefpolicy-3.8.6/policy/modules/services/ldap.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.fc serefpolicy-3.8.7/policy/modules/services/ldap.fc --- nsaserefpolicy/policy/modules/services/ldap.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ldap.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ldap.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,6 +1,8 @@ /etc/ldap/slapd\.conf -- gen_context(system_u:object_r:slapd_etc_t,s0) @@ -16055,9 +15766,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap /var/run/slapd\.args -- gen_context(system_u:object_r:slapd_var_run_t,s0) /var/run/slapd\.pid -- gen_context(system_u:object_r:slapd_var_run_t,s0) +#/var/run/slapd.* -s gen_context(system_u:object_r:slapd_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.if serefpolicy-3.8.6/policy/modules/services/ldap.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.if serefpolicy-3.8.7/policy/modules/services/ldap.if --- nsaserefpolicy/policy/modules/services/ldap.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ldap.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ldap.if 2010-07-14 14:08:02.000000000 -0400 @@ -1,5 +1,43 @@ ## OpenLDAP directory server @@ -16159,9 +15870,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.te serefpolicy-3.8.6/policy/modules/services/ldap.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.te serefpolicy-3.8.7/policy/modules/services/ldap.te --- nsaserefpolicy/policy/modules/services/ldap.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ldap.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ldap.te 2010-07-14 14:08:02.000000000 -0400 @@ -27,9 +27,15 @@ type slapd_replog_t; files_type(slapd_replog_t) @@ -16196,9 +15907,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap manage_files_pattern(slapd_t, slapd_var_run_t, slapd_var_run_t) manage_sock_files_pattern(slapd_t, slapd_var_run_t, slapd_var_run_t) files_pid_filetrans(slapd_t, slapd_var_run_t, { file sock_file }) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lircd.te serefpolicy-3.8.6/policy/modules/services/lircd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lircd.te serefpolicy-3.8.7/policy/modules/services/lircd.te --- nsaserefpolicy/policy/modules/services/lircd.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/lircd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/lircd.te 2010-07-14 14:08:02.000000000 -0400 @@ -24,6 +24,7 @@ # @@ -16216,9 +15927,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lirc dev_read_mouse(lircd_t) dev_filetrans_lirc(lircd_t) dev_rw_lirc(lircd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/memcached.if serefpolicy-3.8.6/policy/modules/services/memcached.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.te serefpolicy-3.8.7/policy/modules/services/lpd.te +--- nsaserefpolicy/policy/modules/services/lpd.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/lpd.te 2010-07-14 14:08:02.000000000 -0400 +@@ -308,12 +308,14 @@ + ') + + tunable_policy(`use_nfs_home_dirs',` ++ files_list_home(lpr_t) + fs_list_auto_mountpoints(lpr_t) + fs_read_nfs_files(lpr_t) + fs_read_nfs_symlinks(lpr_t) + ') + + tunable_policy(`use_samba_home_dirs',` ++ files_list_home(lpr_t) + fs_list_auto_mountpoints(lpr_t) + fs_read_cifs_files(lpr_t) + fs_read_cifs_symlinks(lpr_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/memcached.if serefpolicy-3.8.7/policy/modules/services/memcached.if --- nsaserefpolicy/policy/modules/services/memcached.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/memcached.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/memcached.if 2010-07-14 14:08:02.000000000 -0400 @@ -59,6 +59,7 @@ gen_require(` type memcached_t; @@ -16227,9 +15956,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/memc ') allow $1 memcached_t:process { ptrace signal_perms }; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/milter.if serefpolicy-3.8.6/policy/modules/services/milter.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/milter.if serefpolicy-3.8.7/policy/modules/services/milter.if --- nsaserefpolicy/policy/modules/services/milter.if 2009-12-18 11:38:25.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/milter.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/milter.if 2010-07-14 14:08:02.000000000 -0400 @@ -37,6 +37,8 @@ files_read_etc_files($1_milter_t) @@ -16264,9 +15993,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/milt ## Manage spamassassin milter state ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock.fc serefpolicy-3.8.6/policy/modules/services/mock.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock.fc serefpolicy-3.8.7/policy/modules/services/mock.fc --- nsaserefpolicy/policy/modules/services/mock.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/mock.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/mock.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,6 @@ + +/usr/sbin/mock -- gen_context(system_u:object_r:mock_exec_t,s0) @@ -16274,9 +16003,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock +/var/lib/mock(/.*)? gen_context(system_u:object_r:mock_var_lib_t,s0) + +/var/cache/mock(/.*)? gen_context(system_u:object_r:mock_cache_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock.if serefpolicy-3.8.6/policy/modules/services/mock.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock.if serefpolicy-3.8.7/policy/modules/services/mock.if --- nsaserefpolicy/policy/modules/services/mock.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/mock.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/mock.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,238 @@ + +## policy for mock @@ -16516,9 +16245,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock + admin_pattern($1, mock_var_lib_t) + +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock.te serefpolicy-3.8.6/policy/modules/services/mock.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock.te serefpolicy-3.8.7/policy/modules/services/mock.te --- nsaserefpolicy/policy/modules/services/mock.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/mock.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/mock.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,98 @@ +policy_module(mock,1.0.0) + @@ -16618,9 +16347,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mock +optional_policy(` + apache_read_sys_content_rw_files(mock_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.te serefpolicy-3.8.6/policy/modules/services/modemmanager.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.te serefpolicy-3.8.7/policy/modules/services/modemmanager.te --- nsaserefpolicy/policy/modules/services/modemmanager.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/modemmanager.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/modemmanager.te 2010-07-14 14:08:02.000000000 -0400 @@ -16,7 +16,8 @@ # ModemManager local policy # @@ -16649,9 +16378,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mode +optional_policy(` udev_read_db(modemmanager_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.fc serefpolicy-3.8.6/policy/modules/services/mpd.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.fc serefpolicy-3.8.7/policy/modules/services/mpd.fc --- nsaserefpolicy/policy/modules/services/mpd.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/mpd.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/mpd.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,10 @@ + +/etc/mpd\.conf -- gen_context(system_u:object_r:mpd_etc_t,s0) @@ -16663,9 +16392,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd. +/var/lib/mpd(/.*)? gen_context(system_u:object_r:mpd_var_lib_t,s0) +/var/lib/mpd/music(/.*)? gen_context(system_u:object_r:mpd_data_t,s0) +/var/lib/mpd/playlists(/.*)? gen_context(system_u:object_r:mpd_data_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.if serefpolicy-3.8.6/policy/modules/services/mpd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.if serefpolicy-3.8.7/policy/modules/services/mpd.if --- nsaserefpolicy/policy/modules/services/mpd.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/mpd.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/mpd.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,274 @@ + +## policy for daemon for playing music @@ -16941,9 +16670,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd. + admin_pattern($1, mpd_log_t) + +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.te serefpolicy-3.8.6/policy/modules/services/mpd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.te serefpolicy-3.8.7/policy/modules/services/mpd.te --- nsaserefpolicy/policy/modules/services/mpd.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/mpd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/mpd.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,111 @@ +policy_module(mpd,1.0.0) + @@ -17056,9 +16785,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd. +optional_policy(` + udev_read_db(mpd_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.8.6/policy/modules/services/mta.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.8.7/policy/modules/services/mta.fc --- nsaserefpolicy/policy/modules/services/mta.fc 2010-01-07 14:53:53.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/mta.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/mta.fc 2010-07-14 14:08:02.000000000 -0400 @@ -13,6 +13,8 @@ /usr/bin/esmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0) @@ -17068,9 +16797,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. /usr/lib(64)?/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) /usr/lib/courier/bin/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.8.6/policy/modules/services/mta.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.8.7/policy/modules/services/mta.if --- nsaserefpolicy/policy/modules/services/mta.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/mta.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/mta.if 2010-07-14 14:08:02.000000000 -0400 @@ -220,6 +220,25 @@ application_executable_file($1) ') @@ -17140,9 +16869,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. read_lnk_files_pattern($1, mail_spool_t, mail_spool_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.8.6/policy/modules/services/mta.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.8.7/policy/modules/services/mta.te --- nsaserefpolicy/policy/modules/services/mta.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/mta.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/mta.te 2010-07-14 14:08:02.000000000 -0400 @@ -21,7 +21,7 @@ files_config_file(etc_mail_t) @@ -17234,10 +16963,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. read_files_pattern(mailserver_delivery, mail_forward_t, mail_forward_t) read_files_pattern(mailserver_delivery, system_mail_tmp_t, system_mail_tmp_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.if serefpolicy-3.8.6/policy/modules/services/munin.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.if serefpolicy-3.8.7/policy/modules/services/munin.if --- nsaserefpolicy/policy/modules/services/munin.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/munin.if 2010-07-12 09:05:35.000000000 -0400 -@@ -92,6 +92,24 @@ ++++ serefpolicy-3.8.7/policy/modules/services/munin.if 2010-07-14 14:22:01.000000000 -0400 +@@ -36,6 +36,7 @@ + # automatic transition rules from munin domain + # to specific munin plugin domain + domtrans_pattern(munin_t, $1_munin_plugin_exec_t, $1_munin_plugin_t) ++ allow munin_t $1_munin_plugin_t:process signal; + + allow $1_munin_plugin_t munin_exec_t:file read_file_perms; + allow $1_munin_plugin_t munin_t:tcp_socket rw_socket_perms; +@@ -92,6 +93,24 @@ files_search_etc($1) ') @@ -17262,9 +16999,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni ####################################### ## ## Append to the munin log. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.te serefpolicy-3.8.6/policy/modules/services/munin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.te serefpolicy-3.8.7/policy/modules/services/munin.te --- nsaserefpolicy/policy/modules/services/munin.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/munin.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/munin.te 2010-07-14 14:15:45.000000000 -0400 @@ -40,7 +40,7 @@ # Local policy # @@ -17290,7 +17027,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni ') optional_policy(` -@@ -195,6 +197,7 @@ +@@ -182,6 +184,7 @@ + # local policy for disk plugins + # + ++allow munin_disk_plugin_t self:capability { sys_admin sys_rawio }; + allow disk_munin_plugin_t self:tcp_socket create_stream_socket_perms; + + rw_files_pattern(disk_munin_plugin_t, munin_var_lib_t, munin_var_lib_t) +@@ -195,10 +198,11 @@ fs_getattr_all_fs(disk_munin_plugin_t) @@ -17298,7 +17043,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni dev_read_sysfs(disk_munin_plugin_t) dev_read_urand(disk_munin_plugin_t) -@@ -229,11 +232,13 @@ +-storage_getattr_fixed_disk_dev(disk_munin_plugin_t) ++storage_raw_read_fixed_disk(disk_munin_plugin_t) + + sysnet_read_config(disk_munin_plugin_t) + +@@ -229,11 +233,13 @@ mta_read_config(mail_munin_plugin_t) mta_send_mail(mail_munin_plugin_t) @@ -17312,7 +17062,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni ') optional_policy(` -@@ -249,6 +254,8 @@ +@@ -249,6 +255,8 @@ allow services_munin_plugin_t self:udp_socket create_socket_perms; allow services_munin_plugin_t self:netlink_route_socket r_netlink_socket_perms; @@ -17321,7 +17071,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni corenet_tcp_connect_all_ports(services_munin_plugin_t) corenet_tcp_connect_http_port(services_munin_plugin_t) -@@ -286,6 +293,10 @@ +@@ -286,6 +294,10 @@ snmp_read_snmp_var_lib_files(services_munin_plugin_t) ') @@ -17332,7 +17082,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni ################################## # # local policy for system plugins -@@ -300,6 +311,8 @@ +@@ -300,6 +312,8 @@ corecmd_exec_shell(system_munin_plugin_t) @@ -17341,15 +17091,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni fs_getattr_all_fs(system_munin_plugin_t) dev_read_sysfs(system_munin_plugin_t) -@@ -313,3 +326,5 @@ +@@ -313,3 +327,5 @@ sysnet_exec_ifconfig(system_munin_plugin_t) term_getattr_unallocated_ttys(system_munin_plugin_t) +term_getattr_all_ptys(system_munin_plugin_t) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.8.6/policy/modules/services/mysql.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.8.7/policy/modules/services/mysql.te --- nsaserefpolicy/policy/modules/services/mysql.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/mysql.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/mysql.te 2010-07-14 14:08:02.000000000 -0400 @@ -64,6 +64,7 @@ manage_dirs_pattern(mysqld_t, mysqld_db_t, mysqld_db_t) @@ -17374,9 +17124,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq files_read_etc_files(mysqld_safe_t) files_read_usr_files(mysqld_safe_t) files_dontaudit_getattr_all_dirs(mysqld_safe_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.8.6/policy/modules/services/nagios.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.8.7/policy/modules/services/nagios.if --- nsaserefpolicy/policy/modules/services/nagios.if 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/nagios.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/nagios.if 2010-07-14 14:08:02.000000000 -0400 @@ -159,6 +159,26 @@ ######################################## @@ -17404,9 +17154,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi ## Execute the nagios NRPE with ## a domain transition. ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.8.6/policy/modules/services/nagios.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.8.7/policy/modules/services/nagios.te --- nsaserefpolicy/policy/modules/services/nagios.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/nagios.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/nagios.te 2010-07-14 14:08:02.000000000 -0400 @@ -107,13 +107,11 @@ files_read_etc_runtime_files(nagios_t) files_read_kernel_symbol_table(nagios_t) @@ -17440,9 +17190,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.8.6/policy/modules/services/networkmanager.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.8.7/policy/modules/services/networkmanager.fc --- nsaserefpolicy/policy/modules/services/networkmanager.fc 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/networkmanager.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/networkmanager.fc 2010-07-14 14:08:02.000000000 -0400 @@ -2,6 +2,10 @@ /etc/NetworkManager/dispatcher\.d(/.*) gen_context(system_u:object_r:NetworkManager_initrc_exec_t,s0) @@ -17454,9 +17204,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw /usr/libexec/nm-dispatcher.action -- gen_context(system_u:object_r:NetworkManager_initrc_exec_t,s0) /sbin/wpa_cli -- gen_context(system_u:object_r:wpa_cli_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.8.6/policy/modules/services/networkmanager.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.8.7/policy/modules/services/networkmanager.if --- nsaserefpolicy/policy/modules/services/networkmanager.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/networkmanager.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/networkmanager.if 2010-07-14 14:08:02.000000000 -0400 @@ -137,6 +137,27 @@ ######################################## @@ -17536,9 +17286,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw + allow $1 NetworkManager_log_t:dir list_dir_perms; + append_files_pattern($1, NetworkManager_log_t, NetworkManager_log_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.8.6/policy/modules/services/networkmanager.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.8.7/policy/modules/services/networkmanager.te --- nsaserefpolicy/policy/modules/services/networkmanager.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/networkmanager.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/networkmanager.te 2010-07-14 14:08:02.000000000 -0400 @@ -35,7 +35,7 @@ # networkmanager will ptrace itself if gdb is installed @@ -17629,9 +17379,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.8.6/policy/modules/services/nscd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.8.7/policy/modules/services/nscd.if --- nsaserefpolicy/policy/modules/services/nscd.if 2009-09-16 09:09:20.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/nscd.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/nscd.if 2010-07-14 14:08:02.000000000 -0400 @@ -121,6 +121,24 @@ ######################################## @@ -17666,9 +17416,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.8.6/policy/modules/services/nscd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.8.7/policy/modules/services/nscd.te --- nsaserefpolicy/policy/modules/services/nscd.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/nscd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/nscd.te 2010-07-14 14:08:02.000000000 -0400 @@ -1,9 +1,16 @@ -policy_module(nscd, 1.10.0) +policy_module(nscd, 1.10.1) @@ -17732,9 +17482,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd +optional_policy(` + unconfined_dontaudit_rw_packet_sockets(nscd_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nslcd.te serefpolicy-3.8.6/policy/modules/services/nslcd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nslcd.te serefpolicy-3.8.7/policy/modules/services/nslcd.te --- nsaserefpolicy/policy/modules/services/nslcd.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/nslcd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/nslcd.te 2010-07-14 14:08:02.000000000 -0400 @@ -34,6 +34,8 @@ manage_sock_files_pattern(nslcd_t, nslcd_var_run_t, nslcd_var_run_t) files_pid_filetrans(nslcd_t, nslcd_var_run_t, { file dir }) @@ -17744,9 +17494,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nslc files_read_etc_files(nslcd_t) auth_use_nsswitch(nslcd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.8.6/policy/modules/services/ntp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.8.7/policy/modules/services/ntp.te --- nsaserefpolicy/policy/modules/services/ntp.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ntp.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ntp.te 2010-07-14 14:08:02.000000000 -0400 @@ -96,9 +96,12 @@ dev_read_sysfs(ntpd_t) # for SSP @@ -17760,9 +17510,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. term_use_ptmx(ntpd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nut.te serefpolicy-3.8.6/policy/modules/services/nut.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nut.te serefpolicy-3.8.7/policy/modules/services/nut.te --- nsaserefpolicy/policy/modules/services/nut.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/nut.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/nut.te 2010-07-14 14:08:02.000000000 -0400 @@ -103,6 +103,10 @@ mta_send_mail(nut_upsmon_t) @@ -17774,9 +17524,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nut. ######################################## # # Local policy for upsdrvctl -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.if serefpolicy-3.8.6/policy/modules/services/nx.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.if serefpolicy-3.8.7/policy/modules/services/nx.if --- nsaserefpolicy/policy/modules/services/nx.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/nx.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/nx.if 2010-07-14 14:08:02.000000000 -0400 @@ -35,6 +35,7 @@ allow $1 nx_server_var_lib_t:dir search_dir_perms; @@ -17785,9 +17535,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.i ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.te serefpolicy-3.8.6/policy/modules/services/nx.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.te serefpolicy-3.8.7/policy/modules/services/nx.te --- nsaserefpolicy/policy/modules/services/nx.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/nx.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/nx.te 2010-07-14 14:08:02.000000000 -0400 @@ -27,6 +27,9 @@ type nx_server_var_run_t; files_pid_file(nx_server_var_run_t) @@ -17808,18 +17558,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.t kernel_read_system_state(nx_server_t) kernel_read_kernel_sysctls(nx_server_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.fc serefpolicy-3.8.6/policy/modules/services/oddjob.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.fc serefpolicy-3.8.7/policy/modules/services/oddjob.fc --- nsaserefpolicy/policy/modules/services/oddjob.fc 2009-07-28 13:28:33.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/oddjob.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/oddjob.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,4 +1,5 @@ /usr/lib(64)?/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0) +/usr/libexec/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0) /usr/sbin/oddjobd -- gen_context(system_u:object_r:oddjob_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.if serefpolicy-3.8.6/policy/modules/services/oddjob.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.if serefpolicy-3.8.7/policy/modules/services/oddjob.if --- nsaserefpolicy/policy/modules/services/oddjob.if 2009-07-28 13:28:33.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/oddjob.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/oddjob.if 2010-07-14 14:08:02.000000000 -0400 @@ -44,6 +44,7 @@ ') @@ -17828,9 +17578,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-3.8.6/policy/modules/services/oddjob.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-3.8.7/policy/modules/services/oddjob.te --- nsaserefpolicy/policy/modules/services/oddjob.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/oddjob.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/oddjob.te 2010-07-14 14:08:02.000000000 -0400 @@ -99,8 +99,7 @@ # Add/remove user home directories @@ -17842,9 +17592,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj +userdom_manage_user_home_content_dirs(oddjob_mkhomedir_t) +userdom_manage_user_home_content(oddjob_mkhomedir_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oident.te serefpolicy-3.8.6/policy/modules/services/oident.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oident.te serefpolicy-3.8.7/policy/modules/services/oident.te --- nsaserefpolicy/policy/modules/services/oident.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/oident.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/oident.te 2010-07-14 14:08:02.000000000 -0400 @@ -48,6 +48,7 @@ kernel_read_network_state(oidentd_t) kernel_read_network_state_symlinks(oidentd_t) @@ -17853,9 +17603,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oide logging_send_syslog_msg(oidentd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.8.6/policy/modules/services/openvpn.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.8.7/policy/modules/services/openvpn.te --- nsaserefpolicy/policy/modules/services/openvpn.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/openvpn.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/openvpn.te 2010-07-14 14:08:02.000000000 -0400 @@ -24,6 +24,9 @@ type openvpn_etc_rw_t; files_config_file(openvpn_etc_rw_t) @@ -17884,9 +17634,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open tunable_policy(`openvpn_enable_homedirs',` userdom_read_user_home_content_files(openvpn_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.8.6/policy/modules/services/pegasus.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.8.7/policy/modules/services/pegasus.te --- nsaserefpolicy/policy/modules/services/pegasus.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/pegasus.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/pegasus.te 2010-07-14 14:08:02.000000000 -0400 @@ -29,7 +29,7 @@ # Local policy # @@ -17958,9 +17708,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega + xen_stream_connect(pegasus_t) + xen_stream_connect_xenstore(pegasus_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/piranha.fc serefpolicy-3.8.6/policy/modules/services/piranha.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/piranha.fc serefpolicy-3.8.7/policy/modules/services/piranha.fc --- nsaserefpolicy/policy/modules/services/piranha.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/piranha.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/piranha.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,21 @@ + +/etc/rc\.d/init\.d/pulse -- gen_context(system_u:object_r:piranha_pulse_initrc_exec_t,s0) @@ -17983,9 +17733,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pira +/var/run/pulse\.pid -- gen_context(system_u:object_r:piranha_pulse_var_run_t,s0) + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/piranha.if serefpolicy-3.8.6/policy/modules/services/piranha.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/piranha.if serefpolicy-3.8.7/policy/modules/services/piranha.if --- nsaserefpolicy/policy/modules/services/piranha.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/piranha.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/piranha.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,175 @@ + +## policy for piranha @@ -18162,9 +17912,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pira + manage_files_pattern($1, piranha_log_t, piranha_log_t) + manage_lnk_files_pattern($1, piranha_log_t, piranha_log_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/piranha.te serefpolicy-3.8.6/policy/modules/services/piranha.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/piranha.te serefpolicy-3.8.7/policy/modules/services/piranha.te --- nsaserefpolicy/policy/modules/services/piranha.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/piranha.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/piranha.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,188 @@ +policy_module(piranha,1.0.0) + @@ -18354,9 +18104,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pira +miscfiles_read_localization(piranha_domain) + +sysnet_read_config(piranha_domain) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouthd.te serefpolicy-3.8.6/policy/modules/services/plymouthd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouthd.te serefpolicy-3.8.7/policy/modules/services/plymouthd.te --- nsaserefpolicy/policy/modules/services/plymouthd.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/plymouthd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/plymouthd.te 2010-07-14 14:08:02.000000000 -0400 @@ -60,10 +60,14 @@ files_read_etc_files(plymouthd_t) files_read_usr_files(plymouthd_t) @@ -18380,9 +18130,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plym domain_use_interactive_fds(plymouth_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.fc serefpolicy-3.8.6/policy/modules/services/policykit.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.fc serefpolicy-3.8.7/policy/modules/services/policykit.fc --- nsaserefpolicy/policy/modules/services/policykit.fc 2009-08-18 11:41:14.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/policykit.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/policykit.fc 2010-07-14 14:08:02.000000000 -0400 @@ -6,10 +6,13 @@ /usr/libexec/polkit-read-auth-helper -- gen_context(system_u:object_r:policykit_auth_exec_t,s0) /usr/libexec/polkit-grant-helper.* -- gen_context(system_u:object_r:policykit_grant_exec_t,s0) @@ -18398,9 +18148,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/poli /var/lib/PolicyKit-public(/.*)? gen_context(system_u:object_r:policykit_var_lib_t,s0) /var/run/PolicyKit(/.*)? gen_context(system_u:object_r:policykit_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.if serefpolicy-3.8.6/policy/modules/services/policykit.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.if serefpolicy-3.8.7/policy/modules/services/policykit.if --- nsaserefpolicy/policy/modules/services/policykit.if 2009-08-18 18:39:50.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/policykit.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/policykit.if 2010-07-14 14:08:02.000000000 -0400 @@ -17,12 +17,37 @@ class dbus send_msg; ') @@ -18497,9 +18247,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/poli + + allow $1 policykit_auth_t:process signal; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.8.6/policy/modules/services/policykit.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.8.7/policy/modules/services/policykit.te --- nsaserefpolicy/policy/modules/services/policykit.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/policykit.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/policykit.te 2010-07-14 14:08:02.000000000 -0400 @@ -24,6 +24,9 @@ type policykit_reload_t alias polkit_reload_t; files_type(policykit_reload_t) @@ -18682,9 +18432,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/poli allow policykit_resolve_t self:unix_dgram_socket create_socket_perms; allow policykit_resolve_t self:unix_stream_socket create_stream_socket_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portreserve.fc serefpolicy-3.8.6/policy/modules/services/portreserve.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portreserve.fc serefpolicy-3.8.7/policy/modules/services/portreserve.fc --- nsaserefpolicy/policy/modules/services/portreserve.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/portreserve.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/portreserve.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,3 +1,6 @@ + +/etc/rc\.d/init\.d/portreserve -- gen_context(system_u:object_r:portreserve_initrc_exec_t,s0) @@ -18692,9 +18442,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port /etc/portreserve(/.*)? gen_context(system_u:object_r:portreserve_etc_t,s0) /sbin/portreserve -- gen_context(system_u:object_r:portreserve_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portreserve.if serefpolicy-3.8.6/policy/modules/services/portreserve.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portreserve.if serefpolicy-3.8.7/policy/modules/services/portreserve.if --- nsaserefpolicy/policy/modules/services/portreserve.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/portreserve.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/portreserve.if 2010-07-14 14:08:02.000000000 -0400 @@ -18,6 +18,24 @@ domtrans_pattern($1, portreserve_exec_t, portreserve_t) ') @@ -18761,9 +18511,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port + files_search_pids($1) + admin_pattern($1, portreserve_var_run_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portreserve.te serefpolicy-3.8.6/policy/modules/services/portreserve.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portreserve.te serefpolicy-3.8.7/policy/modules/services/portreserve.te --- nsaserefpolicy/policy/modules/services/portreserve.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/portreserve.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/portreserve.te 2010-07-14 14:08:02.000000000 -0400 @@ -9,6 +9,9 @@ type portreserve_exec_t; init_daemon_domain(portreserve_t, portreserve_exec_t) @@ -18780,9 +18530,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port files_read_etc_files(portreserve_t) + +userdom_dontaudit_search_user_home_content(portreserve_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.8.6/policy/modules/services/postfix.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.8.7/policy/modules/services/postfix.fc --- nsaserefpolicy/policy/modules/services/postfix.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/postfix.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/postfix.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,4 +1,5 @@ # postfix +/etc/rc\.d/init\.d/postfix -- gen_context(system_u:object_r:postfix_initrc_exec_t,s0) @@ -18802,9 +18552,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post /usr/sbin/postdrop -- gen_context(system_u:object_r:postfix_postdrop_exec_t,s0) /usr/sbin/postfix -- gen_context(system_u:object_r:postfix_master_exec_t,s0) /usr/sbin/postkick -- gen_context(system_u:object_r:postfix_master_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.8.6/policy/modules/services/postfix.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.8.7/policy/modules/services/postfix.if --- nsaserefpolicy/policy/modules/services/postfix.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/postfix.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/postfix.if 2010-07-14 14:08:02.000000000 -0400 @@ -376,6 +376,25 @@ domtrans_pattern($1, postfix_master_exec_t, postfix_master_t) ') @@ -19013,9 +18763,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post + role $2 types postfix_postdrop_t; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.8.6/policy/modules/services/postfix.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.8.7/policy/modules/services/postfix.te --- nsaserefpolicy/policy/modules/services/postfix.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/postfix.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/postfix.te 2010-07-14 14:08:02.000000000 -0400 @@ -5,6 +5,15 @@ # Declarations # @@ -19165,9 +18915,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +userdom_manage_user_home_content(postfix_virtual_t) +userdom_home_filetrans_user_home_dir(postfix_virtual_t) +userdom_user_home_dir_filetrans_user_home_content(postfix_virtual_t, {file dir }) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.8.6/policy/modules/services/ppp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.8.7/policy/modules/services/ppp.te --- nsaserefpolicy/policy/modules/services/ppp.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ppp.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ppp.te 2010-07-14 14:08:02.000000000 -0400 @@ -70,7 +70,7 @@ # PPPD Local policy # @@ -19186,18 +18936,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.fc serefpolicy-3.8.6/policy/modules/services/procmail.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.fc serefpolicy-3.8.7/policy/modules/services/procmail.fc --- nsaserefpolicy/policy/modules/services/procmail.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/procmail.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/procmail.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,3 +1,5 @@ +HOME_DIR/\.procmailrc -- gen_context(system_u:object_r:procmail_home_t, s0) +/root/\.procmailrc -- gen_context(system_u:object_r:procmail_home_t, s0) /usr/bin/procmail -- gen_context(system_u:object_r:procmail_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.8.6/policy/modules/services/procmail.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.8.7/policy/modules/services/procmail.te --- nsaserefpolicy/policy/modules/services/procmail.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/procmail.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/procmail.te 2010-07-14 14:08:02.000000000 -0400 @@ -10,6 +10,9 @@ application_domain(procmail_t, procmail_exec_t) role system_r types procmail_t; @@ -19246,9 +18996,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc pyzor_domtrans(procmail_t) pyzor_signal(procmail_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/psad.if serefpolicy-3.8.6/policy/modules/services/psad.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/psad.if serefpolicy-3.8.7/policy/modules/services/psad.if --- nsaserefpolicy/policy/modules/services/psad.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/psad.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/psad.if 2010-07-14 14:08:02.000000000 -0400 @@ -176,6 +176,26 @@ ######################################## @@ -19285,9 +19035,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/psad ') allow $1 psad_t:process { ptrace signal_perms }; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/psad.te serefpolicy-3.8.6/policy/modules/services/psad.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/psad.te serefpolicy-3.8.7/policy/modules/services/psad.te --- nsaserefpolicy/policy/modules/services/psad.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/psad.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/psad.te 2010-07-14 14:08:02.000000000 -0400 @@ -85,6 +85,7 @@ dev_read_urand(psad_t) @@ -19296,9 +19046,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/psad fs_getattr_all_fs(psad_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/puppet.te serefpolicy-3.8.6/policy/modules/services/puppet.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/puppet.te serefpolicy-3.8.7/policy/modules/services/puppet.te --- nsaserefpolicy/policy/modules/services/puppet.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/puppet.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/puppet.te 2010-07-14 14:08:02.000000000 -0400 @@ -221,6 +221,8 @@ sysnet_dns_name_resolve(puppetmaster_t) sysnet_run_ifconfig(puppetmaster_t, system_r) @@ -19308,9 +19058,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pupp optional_policy(` hostname_exec(puppetmaster_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.fc serefpolicy-3.8.6/policy/modules/services/pyzor.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.fc serefpolicy-3.8.7/policy/modules/services/pyzor.fc --- nsaserefpolicy/policy/modules/services/pyzor.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/pyzor.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/pyzor.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,6 +1,10 @@ /etc/pyzor(/.*)? gen_context(system_u:object_r:pyzor_etc_t, s0) +/etc/rc\.d/init\.d/pyzord -- gen_context(system_u:object_r:pyzord_initrc_exec_t,s0) @@ -19322,9 +19072,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo /usr/bin/pyzor -- gen_context(system_u:object_r:pyzor_exec_t,s0) /usr/bin/pyzord -- gen_context(system_u:object_r:pyzord_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.8.6/policy/modules/services/pyzor.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.8.7/policy/modules/services/pyzor.if --- nsaserefpolicy/policy/modules/services/pyzor.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/pyzor.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/pyzor.if 2010-07-14 14:08:02.000000000 -0400 @@ -88,3 +88,50 @@ corecmd_search_bin($1) can_exec($1, pyzor_exec_t) @@ -19376,9 +19126,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo +') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.8.6/policy/modules/services/pyzor.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.8.7/policy/modules/services/pyzor.te --- nsaserefpolicy/policy/modules/services/pyzor.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/pyzor.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/pyzor.te 2010-07-14 14:08:02.000000000 -0400 @@ -5,6 +5,38 @@ # Declarations # @@ -19443,9 +19193,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo userdom_dontaudit_search_user_home_dirs(pyzor_t) optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpidd.fc serefpolicy-3.8.6/policy/modules/services/qpidd.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpidd.fc serefpolicy-3.8.7/policy/modules/services/qpidd.fc --- nsaserefpolicy/policy/modules/services/qpidd.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/qpidd.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/qpidd.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,9 @@ + +/usr/sbin/qpidd -- gen_context(system_u:object_r:qpidd_exec_t,s0) @@ -19456,9 +19206,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpid + +/var/run/qpidd(/.*)? gen_context(system_u:object_r:qpidd_var_run_t,s0) +/var/run/qpidd\.pid gen_context(system_u:object_r:qpidd_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpidd.if serefpolicy-3.8.6/policy/modules/services/qpidd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpidd.if serefpolicy-3.8.7/policy/modules/services/qpidd.if --- nsaserefpolicy/policy/modules/services/qpidd.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/qpidd.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/qpidd.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,236 @@ + +## policy for qpidd @@ -19696,9 +19446,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpid + + allow $1 qpidd_t:shm rw_shm_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpidd.te serefpolicy-3.8.6/policy/modules/services/qpidd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpidd.te serefpolicy-3.8.7/policy/modules/services/qpidd.te --- nsaserefpolicy/policy/modules/services/qpidd.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/qpidd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/qpidd.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,59 @@ +policy_module(qpidd,1.0.0) + @@ -19759,9 +19509,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qpid +miscfiles_read_localization(qpidd_t) + +sysnet_dns_name_resolve(qpidd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.8.6/policy/modules/services/radius.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.8.7/policy/modules/services/radius.te --- nsaserefpolicy/policy/modules/services/radius.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/radius.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/radius.te 2010-07-14 14:08:02.000000000 -0400 @@ -36,7 +36,7 @@ # gzip also needs chown access to preserve GID for radwtmp files allow radiusd_t self:capability { chown dac_override fsetid kill setgid setuid sys_resource sys_tty_config }; @@ -19771,17 +19521,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi allow radiusd_t self:fifo_file rw_fifo_file_perms; allow radiusd_t self:unix_stream_socket create_stream_socket_perms; allow radiusd_t self:tcp_socket create_stream_socket_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.fc serefpolicy-3.8.6/policy/modules/services/razor.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.fc serefpolicy-3.8.7/policy/modules/services/razor.fc --- nsaserefpolicy/policy/modules/services/razor.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/razor.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/razor.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,3 +1,4 @@ +/root/\.razor(/.*)? gen_context(system_u:object_r:razor_home_t,s0) HOME_DIR/\.razor(/.*)? gen_context(system_u:object_r:razor_home_t,s0) /etc/razor(/.*)? gen_context(system_u:object_r:razor_etc_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.if serefpolicy-3.8.6/policy/modules/services/razor.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.if serefpolicy-3.8.7/policy/modules/services/razor.if --- nsaserefpolicy/policy/modules/services/razor.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/razor.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/razor.if 2010-07-14 14:08:02.000000000 -0400 @@ -157,3 +157,45 @@ domtrans_pattern($1, razor_exec_t, razor_t) @@ -19828,9 +19578,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razo + read_files_pattern($1, razor_var_lib_t, razor_var_lib_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.te serefpolicy-3.8.6/policy/modules/services/razor.te ---- nsaserefpolicy/policy/modules/services/razor.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/razor.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.te serefpolicy-3.8.7/policy/modules/services/razor.te +--- nsaserefpolicy/policy/modules/services/razor.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/razor.te 2010-07-14 14:08:02.000000000 -0400 @@ -5,6 +5,32 @@ # Declarations # @@ -19864,7 +19614,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razo type razor_exec_t; corecmd_executable_file(razor_exec_t) -@@ -101,6 +127,8 @@ +@@ -14,6 +40,7 @@ + type razor_home_t; + typealias razor_home_t alias { user_razor_home_t staff_razor_home_t sysadm_razor_home_t }; + typealias razor_home_t alias { auditadm_razor_home_t secadm_razor_home_t }; ++files_poly_member(razor_home_t) + userdom_user_home_content(razor_home_t) + + type razor_log_t; +@@ -100,6 +127,8 @@ manage_files_pattern(razor_t, razor_tmp_t, razor_tmp_t) files_tmp_filetrans(razor_t, razor_tmp_t, { file dir }) @@ -19873,7 +19631,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razo logging_send_syslog_msg(razor_t) userdom_search_user_home_dirs(razor_t) -@@ -119,5 +147,7 @@ +@@ -118,5 +147,7 @@ ') optional_policy(` @@ -19882,18 +19640,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razo +') + ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.fc serefpolicy-3.8.6/policy/modules/services/rgmanager.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.fc serefpolicy-3.8.7/policy/modules/services/rgmanager.fc --- nsaserefpolicy/policy/modules/services/rgmanager.fc 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/rgmanager.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rgmanager.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,3 +1,5 @@ +/etc/rc\.d/init\.d/rgmanager -- gen_context(system_u:object_r:rgmanager_initrc_exec_t,s0) + /usr/sbin/rgmanager -- gen_context(system_u:object_r:rgmanager_exec_t,s0) /var/log/cluster/rgmanager\.log -- gen_context(system_u:object_r:rgmanager_var_log_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.if serefpolicy-3.8.6/policy/modules/services/rgmanager.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.if serefpolicy-3.8.7/policy/modules/services/rgmanager.if --- nsaserefpolicy/policy/modules/services/rgmanager.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/rgmanager.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rgmanager.if 2010-07-14 14:08:02.000000000 -0400 @@ -75,3 +75,64 @@ fs_search_tmpfs($1) manage_files_pattern($1, rgmanager_tmpfs_t, rgmanager_tmpfs_t) @@ -19959,9 +19717,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgma + files_search_pids($1) + admin_pattern($1, rgmanager_var_run_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.te serefpolicy-3.8.6/policy/modules/services/rgmanager.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.te serefpolicy-3.8.7/policy/modules/services/rgmanager.te --- nsaserefpolicy/policy/modules/services/rgmanager.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/rgmanager.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rgmanager.te 2010-07-14 14:08:02.000000000 -0400 @@ -17,6 +17,9 @@ domain_type(rgmanager_t) init_daemon_domain(rgmanager_t, rgmanager_exec_t) @@ -20015,9 +19773,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgma mysql_domtrans_mysql_safe(rgmanager_t) mysql_stream_connect(rgmanager_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs.if serefpolicy-3.8.6/policy/modules/services/rhcs.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs.if serefpolicy-3.8.7/policy/modules/services/rhcs.if --- nsaserefpolicy/policy/modules/services/rhcs.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/rhcs.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rhcs.if 2010-07-14 14:08:02.000000000 -0400 @@ -14,6 +14,8 @@ template(`rhcs_domain_template',` gen_require(` @@ -20133,9 +19891,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs + + allow $1 qdiskd_tmpfs_t:file read_file_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs.te serefpolicy-3.8.6/policy/modules/services/rhcs.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs.te serefpolicy-3.8.7/policy/modules/services/rhcs.te --- nsaserefpolicy/policy/modules/services/rhcs.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/rhcs.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rhcs.te 2010-07-14 14:08:02.000000000 -0400 @@ -13,6 +13,8 @@ gen_tunable(fenced_can_network_connect, false) @@ -20224,9 +19982,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs +optional_policy(` corosync_stream_connect(cluster_domain) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.fc serefpolicy-3.8.6/policy/modules/services/ricci.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.fc serefpolicy-3.8.7/policy/modules/services/ricci.fc --- nsaserefpolicy/policy/modules/services/ricci.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ricci.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ricci.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,3 +1,6 @@ + +/etc/rc\.d/init\.d/ricci -- gen_context(system_u:object_r:ricci_initrc_exec_t,s0) @@ -20234,9 +19992,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc /usr/libexec/modcluster -- gen_context(system_u:object_r:ricci_modcluster_exec_t,s0) /usr/libexec/ricci-modlog -- gen_context(system_u:object_r:ricci_modlog_exec_t,s0) /usr/libexec/ricci-modrpm -- gen_context(system_u:object_r:ricci_modrpm_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.if serefpolicy-3.8.6/policy/modules/services/ricci.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.if serefpolicy-3.8.7/policy/modules/services/ricci.if --- nsaserefpolicy/policy/modules/services/ricci.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ricci.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ricci.if 2010-07-14 14:08:02.000000000 -0400 @@ -18,6 +18,24 @@ domtrans_pattern($1, ricci_exec_t, ricci_t) ') @@ -20310,9 +20068,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc + files_search_pids($1) + admin_pattern($1, ricci_var_run_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.8.6/policy/modules/services/ricci.te ---- nsaserefpolicy/policy/modules/services/ricci.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ricci.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.8.7/policy/modules/services/ricci.te +--- nsaserefpolicy/policy/modules/services/ricci.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ricci.te 2010-07-14 14:08:02.000000000 -0400 @@ -10,6 +10,9 @@ domain_type(ricci_t) init_daemon_domain(ricci_t, ricci_exec_t) @@ -20323,7 +20081,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc type ricci_tmp_t; files_tmp_file(ricci_tmp_t) -@@ -448,6 +451,12 @@ +@@ -241,6 +244,10 @@ + ') + + optional_policy(` ++ rgmanager_stream_connect(ricci_modclusterd_t) ++') ++ ++optional_policy(` + # XXX This has got to go. + unconfined_domain(ricci_modcluster_t) + ') +@@ -444,6 +451,12 @@ files_read_usr_files(ricci_modstorage_t) files_read_kernel_modules(ricci_modstorage_t) @@ -20336,9 +20105,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc storage_raw_read_fixed_disk(ricci_modstorage_t) term_dontaudit_use_console(ricci_modstorage_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.fc serefpolicy-3.8.6/policy/modules/services/rlogin.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.fc serefpolicy-3.8.7/policy/modules/services/rlogin.fc --- nsaserefpolicy/policy/modules/services/rlogin.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/rlogin.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rlogin.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,4 +1,7 @@ HOME_DIR/\.rlogin -- gen_context(system_u:object_r:rlogind_home_t,s0) +HOME_DIR/\.rhosts -- gen_context(system_u:object_r:rlogind_home_t,s0) @@ -20347,9 +20116,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog /usr/kerberos/sbin/klogind -- gen_context(system_u:object_r:rlogind_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.8.6/policy/modules/services/rlogin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.8.7/policy/modules/services/rlogin.te --- nsaserefpolicy/policy/modules/services/rlogin.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/rlogin.te 2010-07-12 16:36:38.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rlogin.te 2010-07-14 14:08:02.000000000 -0400 @@ -43,7 +43,6 @@ manage_dirs_pattern(rlogind_t, rlogind_tmp_t, rlogind_tmp_t) @@ -20368,9 +20137,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog remotelogin_domtrans(rlogind_t) remotelogin_signal(rlogind_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-3.8.6/policy/modules/services/rpcbind.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-3.8.7/policy/modules/services/rpcbind.if --- nsaserefpolicy/policy/modules/services/rpcbind.if 2009-12-18 11:38:25.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/rpcbind.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rpcbind.if 2010-07-14 14:08:02.000000000 -0400 @@ -141,7 +141,7 @@ allow $1 rpcbind_t:process { ptrace signal_perms }; ps_process_pattern($1, rpcbind_t) @@ -20380,9 +20149,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb domain_system_change_exemption($1) role_transition $2 rpcbind_initrc_exec_t system_r; allow $2 system_r; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.8.6/policy/modules/services/rpcbind.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.8.7/policy/modules/services/rpcbind.te --- nsaserefpolicy/policy/modules/services/rpcbind.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/rpcbind.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rpcbind.te 2010-07-14 14:08:02.000000000 -0400 @@ -71,3 +71,7 @@ ifdef(`hide_broken_symptoms',` dontaudit rpcbind_t self:udp_socket listen; @@ -20391,9 +20160,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb +optional_policy(` + nis_use_ypbind(rpcbind_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.8.6/policy/modules/services/rpc.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.8.7/policy/modules/services/rpc.if --- nsaserefpolicy/policy/modules/services/rpc.if 2010-04-06 15:15:38.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/rpc.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rpc.if 2010-07-14 14:08:02.000000000 -0400 @@ -246,6 +246,26 @@ allow rpcd_t $1:process signal; ') @@ -20427,9 +20196,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. manage_files_pattern($1, var_lib_nfs_t, var_lib_nfs_t) + allow $1 var_lib_nfs_t:file { relabelfrom relabelto }; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.8.6/policy/modules/services/rpc.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.8.7/policy/modules/services/rpc.te --- nsaserefpolicy/policy/modules/services/rpc.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/rpc.te 2010-07-12 16:35:33.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rpc.te 2010-07-14 14:08:02.000000000 -0400 @@ -97,15 +97,26 @@ seutil_dontaudit_search_config(rpcd_t) @@ -20482,9 +20251,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.8.6/policy/modules/services/rshd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.8.7/policy/modules/services/rshd.te --- nsaserefpolicy/policy/modules/services/rshd.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/rshd.te 2010-07-12 16:18:22.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rshd.te 2010-07-14 14:08:02.000000000 -0400 @@ -66,6 +66,7 @@ seutil_read_default_contexts(rshd_t) @@ -20493,9 +20262,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd tunable_policy(`use_nfs_home_dirs',` fs_read_nfs_files(rshd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.if serefpolicy-3.8.6/policy/modules/services/rsync.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.if serefpolicy-3.8.7/policy/modules/services/rsync.if --- nsaserefpolicy/policy/modules/services/rsync.if 2010-02-12 10:33:09.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/rsync.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rsync.if 2010-07-14 14:08:02.000000000 -0400 @@ -119,7 +119,7 @@ type rsync_etc_t; ') @@ -20556,9 +20325,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn + + files_etc_filetrans($1, rsync_etc_t, $2) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.8.6/policy/modules/services/rsync.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.8.7/policy/modules/services/rsync.te --- nsaserefpolicy/policy/modules/services/rsync.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/rsync.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rsync.te 2010-07-14 14:08:02.000000000 -0400 @@ -7,6 +7,13 @@ ## @@ -20618,9 +20387,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn +') + auth_can_read_shadow_passwords(rsync_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtkit.if serefpolicy-3.8.6/policy/modules/services/rtkit.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtkit.if serefpolicy-3.8.7/policy/modules/services/rtkit.if --- nsaserefpolicy/policy/modules/services/rtkit.if 2010-03-23 10:55:15.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/rtkit.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/rtkit.if 2010-07-14 14:08:02.000000000 -0400 @@ -41,6 +41,27 @@ ######################################## @@ -20649,9 +20418,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtki ## Allow rtkit to control scheduling for your process ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.8.6/policy/modules/services/samba.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.8.7/policy/modules/services/samba.fc --- nsaserefpolicy/policy/modules/services/samba.fc 2009-07-29 15:15:33.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/samba.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/samba.fc 2010-07-14 14:08:02.000000000 -0400 @@ -51,3 +51,7 @@ /var/run/winbindd(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0) @@ -20660,9 +20429,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +ifndef(`enable_mls',` +/var/lib/samba/scripts(/.*)? gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.8.6/policy/modules/services/samba.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.8.7/policy/modules/services/samba.if --- nsaserefpolicy/policy/modules/services/samba.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/samba.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/samba.if 2010-07-14 14:08:02.000000000 -0400 @@ -79,6 +79,25 @@ ######################################## @@ -20837,9 +20606,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb admin_pattern($1, winbind_var_run_t) + admin_pattern($1, samba_unconfined_script_exec_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.8.6/policy/modules/services/samba.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.8.7/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/samba.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/samba.te 2010-07-14 14:08:02.000000000 -0400 @@ -152,9 +152,6 @@ type winbind_log_t; logging_log_file(winbind_log_t) @@ -20972,9 +20741,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +',` + can_exec(smbd_t, samba_unconfined_script_exec_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.8.6/policy/modules/services/sasl.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.8.7/policy/modules/services/sasl.te --- nsaserefpolicy/policy/modules/services/sasl.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/sasl.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/sasl.te 2010-07-14 14:08:02.000000000 -0400 @@ -49,6 +49,9 @@ kernel_read_kernel_sysctls(saslauthd_t) kernel_read_system_state(saslauthd_t) @@ -20985,9 +20754,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl corenet_all_recvfrom_unlabeled(saslauthd_t) corenet_all_recvfrom_netlabel(saslauthd_t) corenet_tcp_sendrecv_generic_if(saslauthd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.fc serefpolicy-3.8.6/policy/modules/services/sendmail.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.fc serefpolicy-3.8.7/policy/modules/services/sendmail.fc --- nsaserefpolicy/policy/modules/services/sendmail.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/sendmail.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/sendmail.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,4 +1,6 @@ +/etc/rc\.d/init\.d/sendmail -- gen_context(system_u:object_r:sendmail_initrc_exec_t,s0) @@ -20995,9 +20764,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send /var/log/sendmail\.st -- gen_context(system_u:object_r:sendmail_log_t,s0) /var/log/mail(/.*)? gen_context(system_u:object_r:sendmail_log_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.8.6/policy/modules/services/sendmail.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.8.7/policy/modules/services/sendmail.if --- nsaserefpolicy/policy/modules/services/sendmail.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/sendmail.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/sendmail.if 2010-07-14 14:08:02.000000000 -0400 @@ -57,6 +57,24 @@ allow sendmail_t $1:process sigchld; ') @@ -21074,9 +20843,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send + files_search_spool($1) + admin_pattern($1, mail_spool_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.8.6/policy/modules/services/sendmail.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.8.7/policy/modules/services/sendmail.te --- nsaserefpolicy/policy/modules/services/sendmail.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/sendmail.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/sendmail.te 2010-07-14 14:08:02.000000000 -0400 @@ -19,6 +19,9 @@ mta_mailserver_delivery(sendmail_t) mta_mailserver_sender(sendmail_t) @@ -21139,9 +20908,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send - unconfined_domain(unconfined_sendmail_t) + unconfined_domain_noaudit(unconfined_sendmail_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.8.6/policy/modules/services/setroubleshoot.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.8.7/policy/modules/services/setroubleshoot.if --- nsaserefpolicy/policy/modules/services/setroubleshoot.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/setroubleshoot.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/setroubleshoot.if 2010-07-14 14:08:02.000000000 -0400 @@ -105,6 +105,25 @@ ######################################## @@ -21186,9 +20955,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr files_list_var_lib($1) admin_pattern($1, setroubleshoot_var_lib_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.8.6/policy/modules/services/setroubleshoot.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.8.7/policy/modules/services/setroubleshoot.te --- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/setroubleshoot.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/setroubleshoot.te 2010-07-14 14:08:02.000000000 -0400 @@ -32,6 +32,8 @@ allow setroubleshootd_t self:capability { dac_override sys_nice sys_tty_config }; @@ -21240,9 +21009,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr optional_policy(` rpm_signull(setroubleshoot_fixit_t) rpm_read_db(setroubleshoot_fixit_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.8.6/policy/modules/services/smartmon.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.8.7/policy/modules/services/smartmon.te --- nsaserefpolicy/policy/modules/services/smartmon.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/smartmon.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/smartmon.te 2010-07-14 14:08:02.000000000 -0400 @@ -82,6 +82,8 @@ storage_raw_read_fixed_disk(fsdaemon_t) storage_raw_write_fixed_disk(fsdaemon_t) @@ -21252,9 +21021,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar term_dontaudit_search_ptys(fsdaemon_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smokeping.te serefpolicy-3.8.6/policy/modules/services/smokeping.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smokeping.te serefpolicy-3.8.7/policy/modules/services/smokeping.te --- nsaserefpolicy/policy/modules/services/smokeping.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/smokeping.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/smokeping.te 2010-07-14 14:08:02.000000000 -0400 @@ -23,6 +23,7 @@ # smokeping local policy # @@ -21271,9 +21040,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smok logging_send_syslog_msg(smokeping_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.8.6/policy/modules/services/snmp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.8.7/policy/modules/services/snmp.fc +--- nsaserefpolicy/policy/modules/services/snmp.fc 2009-07-14 14:19:57.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/snmp.fc 2010-07-14 14:08:02.000000000 -0400 +@@ -18,7 +18,7 @@ + + /var/log/snmpd\.log -- gen_context(system_u:object_r:snmpd_log_t,s0) + +-/var/net-snmp(/.*) gen_context(system_u:object_r:snmpd_var_lib_t,s0) ++/var/net-snmp(/.*)? gen_context(system_u:object_r:snmpd_var_lib_t,s0) + + /var/run/snmpd(/.*)? gen_context(system_u:object_r:snmpd_var_run_t,s0) + /var/run/snmpd\.pid -- gen_context(system_u:object_r:snmpd_var_run_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.8.7/policy/modules/services/snmp.te --- nsaserefpolicy/policy/modules/services/snmp.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/snmp.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/snmp.te 2010-07-14 14:08:02.000000000 -0400 @@ -24,7 +24,7 @@ # # Local policy @@ -21291,9 +21072,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp auth_use_nsswitch(snmpd_t) auth_read_all_dirs_except_shadow(snmpd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snort.te serefpolicy-3.8.6/policy/modules/services/snort.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snort.te serefpolicy-3.8.7/policy/modules/services/snort.te --- nsaserefpolicy/policy/modules/services/snort.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/snort.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/snort.te 2010-07-14 14:08:02.000000000 -0400 @@ -61,6 +61,7 @@ kernel_read_proc_symlinks(snort_t) kernel_request_load_module(snort_t) @@ -21310,9 +21091,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snor # Red Hat bug 559861: Snort wants read, write, and ioctl on /dev/usbmon # Snort uses libpcap, which can also monitor USB traffic. Maybe this is a side effect? dev_rw_generic_usb_dev(snort_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.8.6/policy/modules/services/spamassassin.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.8.7/policy/modules/services/spamassassin.fc --- nsaserefpolicy/policy/modules/services/spamassassin.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/spamassassin.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/spamassassin.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,15 +1,26 @@ -HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:spamassassin_home_t,s0) +HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:spamc_home_t,s0) @@ -21342,9 +21123,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam /var/spool/spamd(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) +/var/spool/MD-Quarantine(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) +/var/spool/MIMEDefang(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.8.6/policy/modules/services/spamassassin.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.8.7/policy/modules/services/spamassassin.if --- nsaserefpolicy/policy/modules/services/spamassassin.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/spamassassin.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/spamassassin.if 2010-07-14 14:08:02.000000000 -0400 @@ -111,6 +111,45 @@ ') @@ -21471,9 +21252,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam + files_list_pids($1) + admin_pattern($1, spamd_var_run_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.8.6/policy/modules/services/spamassassin.te ---- nsaserefpolicy/policy/modules/services/spamassassin.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/spamassassin.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.8.7/policy/modules/services/spamassassin.te +--- nsaserefpolicy/policy/modules/services/spamassassin.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/spamassassin.te 2010-07-14 14:08:02.000000000 -0400 @@ -19,6 +19,35 @@ ## gen_tunable(spamd_enable_home_dirs, true) @@ -21510,7 +21291,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam type spamassassin_t; type spamassassin_exec_t; typealias spamassassin_t alias { user_spamassassin_t staff_spamassassin_t sysadm_spamassassin_t }; -@@ -50,10 +79,21 @@ +@@ -30,6 +59,7 @@ + typealias spamassassin_home_t alias { user_spamassassin_home_t staff_spamassassin_home_t sysadm_spamassassin_home_t }; + typealias spamassassin_home_t alias { auditadm_spamassassin_home_t secadm_spamassassin_home_t }; + userdom_user_home_content(spamassassin_home_t) ++files_poly_member(spamassassin_home_t) + + type spamassassin_tmp_t; + typealias spamassassin_tmp_t alias { user_spamassassin_tmp_t staff_spamassassin_tmp_t sysadm_spamassassin_tmp_t }; +@@ -49,10 +79,21 @@ typealias spamc_tmp_t alias { auditadm_spamc_tmp_t secadm_spamc_tmp_t }; files_tmp_file(spamc_tmp_t) ubac_constrained(spamc_tmp_t) @@ -21532,7 +21321,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam type spamd_spool_t; files_type(spamd_spool_t) -@@ -109,6 +149,7 @@ +@@ -108,6 +149,7 @@ dev_read_urand(spamassassin_t) fs_search_auto_mountpoints(spamassassin_t) @@ -21540,7 +21329,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam # this should probably be removed corecmd_list_bin(spamassassin_t) -@@ -149,6 +190,9 @@ +@@ -148,6 +190,9 @@ corenet_udp_sendrecv_all_ports(spamassassin_t) corenet_tcp_connect_all_ports(spamassassin_t) corenet_sendrecv_all_client_packets(spamassassin_t) @@ -21550,7 +21339,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam sysnet_read_config(spamassassin_t) ') -@@ -185,6 +229,8 @@ +@@ -184,6 +229,8 @@ optional_policy(` mta_read_config(spamassassin_t) sendmail_stub(spamassassin_t) @@ -21559,7 +21348,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam ') ######################################## -@@ -206,16 +252,33 @@ +@@ -205,16 +252,33 @@ allow spamc_t self:unix_stream_socket connectto; allow spamc_t self:tcp_socket create_stream_socket_perms; allow spamc_t self:udp_socket create_socket_perms; @@ -21593,7 +21382,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam corenet_all_recvfrom_unlabeled(spamc_t) corenet_all_recvfrom_netlabel(spamc_t) -@@ -245,9 +308,16 @@ +@@ -244,9 +308,16 @@ files_dontaudit_search_var(spamc_t) # cjp: this may be removable: files_list_home(spamc_t) @@ -21610,7 +21399,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam miscfiles_read_localization(spamc_t) # cjp: this should probably be removed: -@@ -255,27 +325,40 @@ +@@ -254,27 +325,40 @@ sysnet_read_config(spamc_t) @@ -21657,7 +21446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam ') ######################################## -@@ -287,7 +370,7 @@ +@@ -286,7 +370,7 @@ # setuids to the user running spamc. Comment this if you are not # using this ability. @@ -21666,7 +21455,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam dontaudit spamd_t self:capability sys_tty_config; allow spamd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow spamd_t self:fd use; -@@ -303,10 +386,17 @@ +@@ -302,10 +386,17 @@ allow spamd_t self:unix_stream_socket connectto; allow spamd_t self:tcp_socket create_stream_socket_perms; allow spamd_t self:udp_socket create_socket_perms; @@ -21685,7 +21474,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam files_spool_filetrans(spamd_t, spamd_spool_t, { file dir }) manage_dirs_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t) -@@ -315,10 +405,12 @@ +@@ -314,10 +405,12 @@ # var/lib files for spamd allow spamd_t spamd_var_lib_t:dir list_dir_perms; @@ -21699,7 +21488,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam files_pid_filetrans(spamd_t, spamd_var_run_t, { dir file }) kernel_read_all_sysctls(spamd_t) -@@ -368,22 +460,27 @@ +@@ -367,22 +460,27 @@ init_dontaudit_rw_utmp(spamd_t) @@ -21731,7 +21520,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam fs_manage_cifs_files(spamd_t) ') -@@ -400,34 +497,22 @@ +@@ -399,7 +497,9 @@ ') optional_policy(` @@ -21741,16 +21530,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam dcc_stream_connect_dccifd(spamd_t) ') - optional_policy(` -- milter_manage_spamass_state(spamd_t) --') -- --optional_policy(` -- corenet_tcp_connect_mysqld_port(spamd_t) -- corenet_sendrecv_mysqld_client_packets(spamd_t) -- - mysql_search_db(spamd_t) - mysql_stream_connect(spamd_t) +@@ -416,10 +516,6 @@ ') optional_policy(` @@ -21761,14 +21541,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam postfix_read_config(spamd_t) ') - optional_policy(` -- corenet_tcp_connect_postgresql_port(spamd_t) -- corenet_sendrecv_postgresql_client_packets(spamd_t) -- - postgresql_stream_connect(spamd_t) - ') - -@@ -438,6 +523,10 @@ +@@ -437,6 +533,10 @@ optional_policy(` razor_domtrans(spamd_t) @@ -21779,19 +21552,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam ') optional_policy(` -@@ -450,5 +539,9 @@ - ') - - optional_policy(` -+ milter_manage_spamass_state(spamd_t) -+') -+ -+optional_policy(` - udev_read_db(spamd_t) - ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.fc serefpolicy-3.8.6/policy/modules/services/ssh.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.fc serefpolicy-3.8.7/policy/modules/services/ssh.fc --- nsaserefpolicy/policy/modules/services/ssh.fc 2010-01-18 15:04:31.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/ssh.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ssh.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,4 +1,9 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0) +HOME_DIR/\.shosts gen_context(system_u:object_r:ssh_home_t,s0) @@ -21802,16 +21565,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. /etc/ssh/primes -- gen_context(system_u:object_r:sshd_key_t,s0) /etc/ssh/ssh_host_key -- gen_context(system_u:object_r:sshd_key_t,s0) -@@ -14,3 +19,6 @@ +@@ -14,3 +19,7 @@ /usr/sbin/sshd -- gen_context(system_u:object_r:sshd_exec_t,s0) /var/run/sshd\.init\.pid -- gen_context(system_u:object_r:sshd_var_run_t,s0) ++/var/run/sshd\.pid -- gen_context(system_u:object_r:sshd_var_run_t,s0) + +/root/\.ssh(/.*)? gen_context(system_u:object_r:home_ssh_t,s0) +/root/\.shosts gen_context(system_u:object_r:home_ssh_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.8.6/policy/modules/services/ssh.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.8.7/policy/modules/services/ssh.if --- nsaserefpolicy/policy/modules/services/ssh.if 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ssh.if 2010-07-12 13:45:03.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ssh.if 2010-07-14 14:08:02.000000000 -0400 @@ -36,6 +36,7 @@ gen_require(` attribute ssh_server; @@ -21968,9 +21732,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. ######################################## ## ## Execute the ssh client in the caller domain. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.8.6/policy/modules/services/ssh.te ---- nsaserefpolicy/policy/modules/services/ssh.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ssh.te 2010-07-12 16:18:09.000000000 -0400 +@@ -735,3 +767,22 @@ + files_search_tmp($1) + delete_files_pattern($1, sshd_tmp_t, sshd_tmp_t) + ') ++ ++######################################## ++## ++## Send a null signal to sshd processes. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`ssh_signull',` ++ gen_require(` ++ type sshd_t; ++ ') ++ ++ allow $1 sshd_t:process signull; ++') ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.8.7/policy/modules/services/ssh.te +--- nsaserefpolicy/policy/modules/services/ssh.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ssh.te 2010-07-14 14:08:02.000000000 -0400 @@ -19,6 +19,13 @@ ## gen_tunable(ssh_sysadm_login, false) @@ -22057,7 +21844,62 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. tunable_policy(`allow_ssh_keysign',` domain_auto_trans(ssh_t, ssh_keysign_exec_t, ssh_keysign_t) -@@ -281,44 +288,64 @@ +@@ -200,6 +207,54 @@ + xserver_domtrans_xauth(ssh_t) + ') + ++######################################## ++# ++# ssh_keygen local policy ++# ++ ++# ssh_keygen_t is the type of the ssh-keygen program when run at install time ++# and by sysadm_t ++ ++dontaudit ssh_keygen_t self:capability sys_tty_config; ++allow ssh_keygen_t self:process { sigchld sigkill sigstop signull signal }; ++ ++allow ssh_keygen_t self:unix_stream_socket create_stream_socket_perms; ++ ++allow ssh_keygen_t sshd_key_t:file manage_file_perms; ++files_etc_filetrans(ssh_keygen_t, sshd_key_t, file) ++ ++kernel_read_kernel_sysctls(ssh_keygen_t) ++ ++fs_search_auto_mountpoints(ssh_keygen_t) ++ ++dev_read_sysfs(ssh_keygen_t) ++dev_read_urand(ssh_keygen_t) ++ ++term_dontaudit_use_console(ssh_keygen_t) ++ ++domain_use_interactive_fds(ssh_keygen_t) ++ ++files_read_etc_files(ssh_keygen_t) ++ ++init_use_fds(ssh_keygen_t) ++init_use_script_ptys(ssh_keygen_t) ++ ++logging_send_syslog_msg(ssh_keygen_t) ++ ++userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t) ++ ++optional_policy(` ++ nscd_socket_use(ssh_keygen_t) ++') ++ ++optional_policy(` ++ seutil_sigchld_newrole(ssh_keygen_t) ++') ++ ++optional_policy(` ++ udev_read_db(ssh_keygen_t) ++') ++ + ############################## + # + # ssh_keysign_t local policy +@@ -233,44 +288,64 @@ allow sshd_t self:netlink_route_socket r_netlink_socket_perms; allow sshd_t self:key { search link write }; @@ -22131,7 +21973,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. ') optional_policy(` -@@ -332,6 +359,11 @@ +@@ -284,6 +359,11 @@ ') optional_policy(` @@ -22143,9 +21985,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. unconfined_shell_domtrans(sshd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.te serefpolicy-3.8.6/policy/modules/services/sssd.te +@@ -353,10 +433,6 @@ + userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t) + + optional_policy(` +- nscd_socket_use(ssh_keygen_t) +-') +- +-optional_policy(` + seutil_sigchld_newrole(ssh_keygen_t) + ') + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.te serefpolicy-3.8.7/policy/modules/services/sssd.te --- nsaserefpolicy/policy/modules/services/sssd.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/sssd.te 2010-07-12 14:42:46.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/sssd.te 2010-07-14 14:08:02.000000000 -0400 @@ -31,6 +31,7 @@ allow sssd_t self:capability { dac_read_search dac_override kill sys_nice setgid setuid }; allow sssd_t self:process { setfscreate setsched sigkill signal getsched }; @@ -22171,9 +22024,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd optional_policy(` dbus_system_bus_client(sssd_t) dbus_connect_system_bus(sssd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.8.6/policy/modules/services/sysstat.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.8.7/policy/modules/services/sysstat.te --- nsaserefpolicy/policy/modules/services/sysstat.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/sysstat.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/sysstat.te 2010-07-14 14:08:02.000000000 -0400 @@ -68,3 +68,8 @@ optional_policy(` logging_send_syslog_msg(sysstat_t) @@ -22183,9 +22036,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/syss + nscd_socket_use(sysstat_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/telnet.te serefpolicy-3.8.6/policy/modules/services/telnet.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/telnet.te serefpolicy-3.8.7/policy/modules/services/telnet.te --- nsaserefpolicy/policy/modules/services/telnet.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/telnet.te 2010-07-12 16:50:40.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/telnet.te 2010-07-14 14:08:02.000000000 -0400 @@ -38,7 +38,6 @@ manage_dirs_pattern(telnetd_t, telnetd_tmp_t, telnetd_tmp_t) @@ -22203,13 +22056,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/teln optional_policy(` kerberos_keytab_template(telnetd, telnetd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.if serefpolicy-3.8.6/policy/modules/services/tftp.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.if serefpolicy-3.8.7/policy/modules/services/tftp.if --- nsaserefpolicy/policy/modules/services/tftp.if 2010-02-12 10:33:09.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/tftp.if 2010-07-12 09:05:35.000000000 -0400 -@@ -20,6 +20,25 @@ ++++ serefpolicy-3.8.7/policy/modules/services/tftp.if 2010-07-14 14:08:02.000000000 -0400 +@@ -16,6 +16,26 @@ + ') - ######################################## - ## + read_files_pattern($1, tftpdir_t, tftpdir_t) ++ read_lnk_files_pattern($1, tftpdir_t, tftpdir_t) ++') ++ ++######################################## ++## +## Search tftp /var/lib directories. +## +## @@ -22225,14 +22083,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp + + search_dirs_pattern($1, tftpdir_rw_t, tftpdir_rw_t) + files_search_var_lib($1) -+') -+ -+######################################## -+## - ## Manage tftp /var/lib files. - ## - ## -@@ -40,6 +59,36 @@ + ') + + ######################################## +@@ -40,6 +60,36 @@ ######################################## ## @@ -22269,9 +22123,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp ## All of the rules required to administrate ## an tftp environment ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-3.8.6/policy/modules/services/tftp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-3.8.7/policy/modules/services/tftp.te --- nsaserefpolicy/policy/modules/services/tftp.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/tftp.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/tftp.te 2010-07-14 14:08:02.000000000 -0400 @@ -94,6 +94,10 @@ ') @@ -22283,9 +22137,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp inetd_udp_service_domain(tftpd_t, tftpd_exec_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tgtd.te serefpolicy-3.8.6/policy/modules/services/tgtd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tgtd.te serefpolicy-3.8.7/policy/modules/services/tgtd.te --- nsaserefpolicy/policy/modules/services/tgtd.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/tgtd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/tgtd.te 2010-07-14 14:08:02.000000000 -0400 @@ -59,8 +59,12 @@ files_read_etc_files(tgtd_t) @@ -22299,9 +22153,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tgtd miscfiles_read_localization(tgtd_t) + +iscsi_manage_semaphores(tgtd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor.te serefpolicy-3.8.6/policy/modules/services/tor.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor.te serefpolicy-3.8.7/policy/modules/services/tor.te --- nsaserefpolicy/policy/modules/services/tor.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/tor.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/tor.te 2010-07-14 14:08:02.000000000 -0400 @@ -100,6 +100,8 @@ auth_use_nsswitch(tor_t) @@ -22311,9 +22165,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor. miscfiles_read_localization(tor_t) tunable_policy(`tor_bind_all_unreserved_ports', ` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tuned.te serefpolicy-3.8.6/policy/modules/services/tuned.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tuned.te serefpolicy-3.8.7/policy/modules/services/tuned.te --- nsaserefpolicy/policy/modules/services/tuned.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/tuned.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/tuned.te 2010-07-14 14:08:02.000000000 -0400 @@ -24,6 +24,7 @@ # @@ -22333,9 +22187,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tune # to allow network interface tuning optional_policy(` sysnet_domtrans_ifconfig(tuned_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucspitcp.te serefpolicy-3.8.6/policy/modules/services/ucspitcp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucspitcp.te serefpolicy-3.8.7/policy/modules/services/ucspitcp.te --- nsaserefpolicy/policy/modules/services/ucspitcp.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/ucspitcp.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/ucspitcp.te 2010-07-14 14:08:02.000000000 -0400 @@ -91,3 +91,8 @@ daemontools_service_domain(ucspitcp_t, ucspitcp_exec_t) daemontools_read_svc(ucspitcp_t) @@ -22345,17 +22199,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucsp + daemontools_sigchld_run(ucspitcp_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/usbmuxd.fc serefpolicy-3.8.6/policy/modules/services/usbmuxd.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/usbmuxd.fc serefpolicy-3.8.7/policy/modules/services/usbmuxd.fc --- nsaserefpolicy/policy/modules/services/usbmuxd.fc 2010-04-05 14:44:26.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/usbmuxd.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/usbmuxd.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,3 +1,3 @@ /usr/sbin/usbmuxd -- gen_context(system_u:object_r:usbmuxd_exec_t,s0) -/var/run/usbmuxd -s gen_context(system_u:object_r:usbmuxd_var_run_t,s0) +/var/run/usbmuxd.* gen_context(system_u:object_r:usbmuxd_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/varnishd.if serefpolicy-3.8.6/policy/modules/services/varnishd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/varnishd.if serefpolicy-3.8.7/policy/modules/services/varnishd.if --- nsaserefpolicy/policy/modules/services/varnishd.if 2009-07-23 14:11:04.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/varnishd.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/varnishd.if 2010-07-14 14:08:02.000000000 -0400 @@ -56,6 +56,25 @@ read_files_pattern($1, varnishd_etc_t, varnishd_etc_t) ') @@ -22382,9 +22236,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/varn ####################################### ## ## Read varnish logs. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhostmd.if serefpolicy-3.8.6/policy/modules/services/vhostmd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhostmd.if serefpolicy-3.8.7/policy/modules/services/vhostmd.if --- nsaserefpolicy/policy/modules/services/vhostmd.if 2010-03-29 15:04:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/vhostmd.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/vhostmd.if 2010-07-14 14:08:02.000000000 -0400 @@ -42,7 +42,7 @@ ## ## @@ -22394,9 +22248,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhos ## ## # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhostmd.te serefpolicy-3.8.6/policy/modules/services/vhostmd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhostmd.te serefpolicy-3.8.7/policy/modules/services/vhostmd.te --- nsaserefpolicy/policy/modules/services/vhostmd.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/vhostmd.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/vhostmd.te 2010-07-14 14:08:02.000000000 -0400 @@ -44,6 +44,8 @@ corenet_tcp_connect_soundd_port(vhostmd_t) @@ -22406,9 +22260,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhos files_read_etc_files(vhostmd_t) files_read_usr_files(vhostmd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.fc serefpolicy-3.8.6/policy/modules/services/virt.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.fc serefpolicy-3.8.7/policy/modules/services/virt.fc --- nsaserefpolicy/policy/modules/services/virt.fc 2010-03-23 10:55:15.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/virt.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/virt.fc 2010-07-14 14:08:02.000000000 -0400 @@ -13,17 +13,18 @@ /etc/xen/.*/.* gen_context(system_u:object_r:virt_etc_rw_t,s0) @@ -22431,9 +22285,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt +/var/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:qemu_var_run_t,s0-mls_systemhigh) /var/vdsm(/.*)? gen_context(system_u:object_r:virt_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.8.6/policy/modules/services/virt.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.8.7/policy/modules/services/virt.if --- nsaserefpolicy/policy/modules/services/virt.if 2010-03-23 10:55:15.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/virt.if 2010-07-12 11:30:12.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/virt.if 2010-07-14 16:34:07.000000000 -0400 @@ -21,6 +21,7 @@ type $1_t, virt_domain; domain_type($1_t) @@ -22545,7 +22399,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt ') ######################################## -@@ -516,3 +526,32 @@ +@@ -516,3 +526,51 @@ virt_manage_log($1) ') @@ -22578,9 +22432,28 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt + ptchown_run(svirt_t, $2) + ') +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.8.6/policy/modules/services/virt.te ---- nsaserefpolicy/policy/modules/services/virt.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/virt.te 2010-07-12 14:44:33.000000000 -0400 ++ ++######################################## ++## ++## Do not audit attempts to write virt daemon unnamed pipes. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`virt_dontaudit_write_pipes',` ++ gen_require(` ++ type virtd_t; ++ ') ++ ++ dontaudit $1 virtd_t:fifo_file write; ++') ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.8.7/policy/modules/services/virt.te +--- nsaserefpolicy/policy/modules/services/virt.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/virt.te 2010-07-14 14:08:02.000000000 -0400 @@ -4,6 +4,7 @@ # # Declarations @@ -22647,21 +22520,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt fs_hugetlbfs_filetrans(svirt_t, svirt_image_t, file) list_dirs_pattern(svirt_t, virt_content_t, virt_content_t) -@@ -147,11 +154,13 @@ +@@ -147,11 +154,15 @@ tunable_policy(`virt_use_nfs',` fs_manage_nfs_dirs(svirt_t) fs_manage_nfs_files(svirt_t) -+ fs_read_nfs_symlinks(virtd_t) ++ fs_manage_nfs_named_sockets(svirt_t) ++ fs_read_nfs_symlinks(svirt_t) ') tunable_policy(`virt_use_samba',` fs_manage_cifs_dirs(svirt_t) fs_manage_cifs_files(svirt_t) ++ fs_manage_cifs_named_sockets(svirt_t) + fs_read_cifs_symlinks(virtd_t) ') tunable_policy(`virt_use_sysfs',` -@@ -160,6 +169,7 @@ +@@ -160,6 +171,7 @@ tunable_policy(`virt_use_usb',` dev_rw_usbfs(svirt_t) @@ -22669,7 +22544,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt fs_manage_dos_dirs(svirt_t) fs_manage_dos_files(svirt_t) ') -@@ -178,22 +188,29 @@ +@@ -168,28 +180,39 @@ + xen_rw_image_files(svirt_t) + ') + ++optional_policy(` ++ xen_rw_image_files(svirt_t) ++') ++ + ######################################## + # + # virtd local policy # allow virtd_t self:capability { chown dac_override fowner ipc_lock kill mknod net_admin net_raw setpcap setuid setgid sys_admin sys_nice sys_ptrace }; @@ -22702,7 +22587,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt read_files_pattern(virtd_t, virt_etc_t, virt_etc_t) read_lnk_files_pattern(virtd_t, virt_etc_t, virt_etc_t) -@@ -204,9 +221,15 @@ +@@ -200,9 +223,15 @@ manage_files_pattern(virtd_t, virt_image_type, virt_image_type) manage_blk_files_pattern(virtd_t, virt_image_type, virt_image_type) @@ -22718,7 +22603,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t) manage_files_pattern(virtd_t, virt_log_t, virt_log_t) logging_log_filetrans(virtd_t, virt_log_t, { file dir }) -@@ -224,6 +247,7 @@ +@@ -220,6 +249,7 @@ kernel_read_system_state(virtd_t) kernel_read_network_state(virtd_t) kernel_rw_net_sysctls(virtd_t) @@ -22726,7 +22611,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt kernel_request_load_module(virtd_t) kernel_search_debugfs(virtd_t) -@@ -247,18 +271,25 @@ +@@ -243,18 +273,25 @@ dev_rw_kvm(virtd_t) dev_getattr_all_chr_files(virtd_t) dev_rw_mtrr(virtd_t) @@ -22753,7 +22638,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt fs_list_auto_mountpoints(virtd_t) fs_getattr_xattr_fs(virtd_t) -@@ -267,6 +298,15 @@ +@@ -263,6 +300,15 @@ fs_manage_cgroup_dirs(virtd_t) fs_rw_cgroup_files(virtd_t) @@ -22769,7 +22654,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt mcs_process_set_categories(virtd_t) storage_manage_fixed_disk(virtd_t) -@@ -290,15 +330,22 @@ +@@ -286,15 +332,22 @@ logging_send_syslog_msg(virtd_t) @@ -22792,7 +22677,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt tunable_policy(`virt_use_nfs',` fs_manage_nfs_dirs(virtd_t) -@@ -369,6 +416,7 @@ +@@ -365,6 +418,7 @@ qemu_signal(virtd_t) qemu_kill(virtd_t) qemu_setsched(virtd_t) @@ -22800,7 +22685,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt ') optional_policy(` -@@ -406,6 +454,19 @@ +@@ -402,6 +456,19 @@ allow virt_domain self:unix_dgram_socket { create_socket_perms sendto }; allow virt_domain self:tcp_socket create_stream_socket_perms; @@ -22820,7 +22705,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt append_files_pattern(virt_domain, virt_log_t, virt_log_t) append_files_pattern(virt_domain, virt_var_lib_t, virt_var_lib_t) -@@ -426,6 +487,7 @@ +@@ -422,6 +489,7 @@ corenet_tcp_bind_virt_migration_port(virt_domain) corenet_tcp_connect_virt_migration_port(virt_domain) @@ -22828,7 +22713,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt dev_read_rand(virt_domain) dev_read_sound(virt_domain) dev_read_urand(virt_domain) -@@ -433,6 +495,7 @@ +@@ -429,6 +497,7 @@ dev_rw_ksm(virt_domain) dev_rw_kvm(virt_domain) dev_rw_qemu(virt_domain) @@ -22836,7 +22721,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt domain_use_interactive_fds(virt_domain) -@@ -444,6 +507,11 @@ +@@ -440,6 +509,11 @@ fs_getattr_tmpfs(virt_domain) fs_rw_anon_inodefs_files(virt_domain) fs_rw_tmpfs_files(virt_domain) @@ -22848,7 +22733,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt term_use_all_terms(virt_domain) term_getattr_pty_fs(virt_domain) -@@ -461,8 +529,120 @@ +@@ -457,8 +531,120 @@ ') optional_policy(` @@ -22969,9 +22854,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt + userdom_search_admin_dir(virsh_ssh_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.8.6/policy/modules/services/w3c.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.8.7/policy/modules/services/w3c.te --- nsaserefpolicy/policy/modules/services/w3c.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/w3c.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/w3c.te 2010-07-14 14:08:02.000000000 -0400 @@ -7,11 +7,18 @@ apache_content_template(w3c_validator) @@ -22997,9 +22882,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c. sysnet_dns_name_resolve(httpd_w3c_validator_script_t) + +apache_dontaudit_rw_tmp_files(httpd_w3c_validator_script_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.8.6/policy/modules/services/xserver.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.8.7/policy/modules/services/xserver.fc --- nsaserefpolicy/policy/modules/services/xserver.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/xserver.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/xserver.fc 2010-07-14 14:08:02.000000000 -0400 @@ -2,13 +2,23 @@ # HOME_DIR # @@ -23121,9 +23006,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser +/var/lib/pqsql/\.xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0) +/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.8.6/policy/modules/services/xserver.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.8.7/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2010-02-12 10:33:09.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/xserver.if 2010-07-12 15:12:17.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/xserver.if 2010-07-14 14:08:02.000000000 -0400 @@ -19,9 +19,10 @@ interface(`xserver_restricted_role',` gen_require(` @@ -23734,9 +23619,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser + + manage_files_pattern($1, user_fonts_config_t, user_fonts_config_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.8.6/policy/modules/services/xserver.te ---- nsaserefpolicy/policy/modules/services/xserver.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/xserver.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.8.7/policy/modules/services/xserver.te +--- nsaserefpolicy/policy/modules/services/xserver.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/xserver.te 2010-07-14 14:54:05.000000000 -0400 @@ -35,6 +35,13 @@ ## @@ -23795,15 +23680,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser typealias iceauth_t alias { auditadm_iceauth_t secadm_iceauth_t }; application_domain(iceauth_t, iceauth_exec_t) ubac_constrained(iceauth_t) -@@ -131,6 +153,7 @@ +@@ -131,22 +153,28 @@ type iceauth_home_t; typealias iceauth_home_t alias { user_iceauth_home_t staff_iceauth_home_t sysadm_iceauth_home_t }; typealias iceauth_home_t alias { auditadm_iceauth_home_t secadm_iceauth_home_t }; +typealias iceauth_home_t alias { xguest_iceauth_home_t }; - files_poly_member(iceauth_home_t) ++files_poly_member(iceauth_home_t) userdom_user_home_content(iceauth_home_t) -@@ -138,17 +161,20 @@ + type xauth_t; type xauth_exec_t; typealias xauth_t alias { user_xauth_t staff_xauth_t sysadm_xauth_t }; typealias xauth_t alias { auditadm_xauth_t secadm_xauth_t }; @@ -23815,7 +23700,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser typealias xauth_home_t alias { user_xauth_home_t staff_xauth_home_t sysadm_xauth_home_t }; typealias xauth_home_t alias { auditadm_xauth_home_t secadm_xauth_home_t }; +typealias xauth_home_t alias { xguest_xauth_home_t unconfined_xauth_home_t }; - files_poly_member(xauth_home_t) ++files_poly_member(xauth_home_t) userdom_user_home_content(xauth_home_t) type xauth_tmp_t; @@ -23824,7 +23709,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser typealias xauth_tmp_t alias { auditadm_xauth_tmp_t secadm_xauth_tmp_t }; files_tmp_file(xauth_tmp_t) ubac_constrained(xauth_tmp_t) -@@ -163,16 +189,21 @@ +@@ -161,15 +189,21 @@ type xdm_exec_t; auth_login_pgm_domain(xdm_t) init_domain(xdm_t, xdm_exec_t) @@ -23832,7 +23717,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser +init_system_domain(xdm_t, xdm_exec_t) xserver_object_types_template(xdm) xserver_common_x_domain_template(xdm, xdm_t) --xserver_unconfined(xdm_t) type xdm_lock_t; files_lock_file(xdm_lock_t) @@ -23849,7 +23733,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser type xdm_var_lib_t; files_type(xdm_var_lib_t) -@@ -180,13 +211,27 @@ +@@ -177,13 +211,27 @@ type xdm_var_run_t; files_pid_file(xdm_var_run_t) @@ -23878,7 +23762,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # type for /var/lib/xkb type xkb_var_lib_t; files_type(xkb_var_lib_t) -@@ -199,15 +244,9 @@ +@@ -196,15 +244,9 @@ init_system_domain(xserver_t, xserver_exec_t) ubac_constrained(xserver_t) @@ -23896,7 +23780,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser files_tmpfs_file(xserver_tmpfs_t) ubac_constrained(xserver_tmpfs_t) -@@ -237,9 +276,13 @@ +@@ -234,9 +276,13 @@ allow xdm_t iceauth_home_t:file read_file_perms; @@ -23910,7 +23794,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files(iceauth_t) -@@ -249,30 +292,64 @@ +@@ -246,30 +292,64 @@ fs_manage_cifs_files(iceauth_t) ') @@ -23978,7 +23862,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser fs_search_auto_mountpoints(xauth_t) # cjp: why? -@@ -282,17 +359,37 @@ +@@ -279,17 +359,37 @@ userdom_use_user_terminals(xauth_t) userdom_read_user_tmp_files(xauth_t) @@ -24016,7 +23900,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser optional_policy(` ssh_sigchld(xauth_t) ssh_read_pipes(xauth_t) -@@ -304,20 +401,33 @@ +@@ -301,20 +401,33 @@ # XDM Local policy # @@ -24053,7 +23937,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # Allow gdm to run gdm-binary can_exec(xdm_t, xdm_exec_t) -@@ -325,32 +435,53 @@ +@@ -322,32 +435,53 @@ allow xdm_t xdm_lock_t:file manage_file_perms; files_lock_filetrans(xdm_t, xdm_lock_t, file) @@ -24112,7 +23996,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser allow xdm_t xserver_t:unix_stream_socket connectto; allow xdm_t xserver_tmp_t:sock_file rw_sock_file_perms; -@@ -358,10 +489,13 @@ +@@ -355,10 +489,13 @@ # transition to the xdm xserver domtrans_pattern(xdm_t, xserver_exec_t, xserver_t) @@ -24126,7 +24010,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # connect to xdm xserver over stream socket stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) -@@ -370,15 +504,22 @@ +@@ -367,15 +504,22 @@ delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) @@ -24150,7 +24034,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser corecmd_exec_shell(xdm_t) corecmd_exec_bin(xdm_t) -@@ -393,11 +534,14 @@ +@@ -390,11 +534,14 @@ corenet_udp_sendrecv_all_ports(xdm_t) corenet_tcp_bind_generic_node(xdm_t) corenet_udp_bind_generic_node(xdm_t) @@ -24165,7 +24049,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser dev_read_rand(xdm_t) dev_read_sysfs(xdm_t) dev_getattr_framebuffer_dev(xdm_t) -@@ -405,6 +549,7 @@ +@@ -402,6 +549,7 @@ dev_getattr_mouse_dev(xdm_t) dev_setattr_mouse_dev(xdm_t) dev_rw_apm_bios(xdm_t) @@ -24173,7 +24057,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser dev_setattr_apm_bios_dev(xdm_t) dev_rw_dri(xdm_t) dev_rw_agp(xdm_t) -@@ -413,18 +558,22 @@ +@@ -410,18 +558,22 @@ dev_getattr_misc_dev(xdm_t) dev_setattr_misc_dev(xdm_t) dev_dontaudit_rw_misc(xdm_t) @@ -24199,7 +24083,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser files_read_etc_files(xdm_t) files_read_var_files(xdm_t) -@@ -435,9 +584,17 @@ +@@ -432,9 +584,17 @@ files_read_usr_files(xdm_t) # Poweroff wants to create the /poweroff file when run from xdm files_create_boot_flag(xdm_t) @@ -24217,7 +24101,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t) -@@ -446,14 +603,19 @@ +@@ -443,14 +603,19 @@ storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t) @@ -24237,7 +24121,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser auth_rw_faillog(xdm_t) auth_write_login_records(xdm_t) -@@ -464,10 +626,12 @@ +@@ -461,10 +626,12 @@ logging_read_generic_logs(xdm_t) @@ -24252,7 +24136,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_create_all_users_keys(xdm_t) -@@ -476,6 +640,11 @@ +@@ -473,6 +640,11 @@ # Search /proc for any user domain processes. userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) @@ -24264,7 +24148,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser xserver_rw_session(xdm_t, xdm_tmpfs_t) xserver_unconfined(xdm_t) -@@ -507,11 +676,17 @@ +@@ -504,11 +676,17 @@ ') optional_policy(` @@ -24282,7 +24166,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') optional_policy(` -@@ -519,12 +694,50 @@ +@@ -516,12 +694,51 @@ ') optional_policy(` @@ -24324,6 +24208,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') optional_policy(` ++ gnome_manage_config(xdm_t) + gnome_manage_gconf_home_files(xdm_t) + gnome_read_config(xdm_t) + gnome_read_gconf_config(xdm_t) @@ -24333,7 +24218,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser hostname_exec(xdm_t) ') -@@ -542,20 +755,59 @@ +@@ -539,20 +756,63 @@ ') optional_policy(` @@ -24379,6 +24264,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') optional_policy(` ++ ssh_signull(xdm_t) ++') ++ ++optional_policy(` + shutdown_domtrans(xdm_t) +') + @@ -24395,7 +24284,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ifndef(`distro_redhat',` allow xdm_t self:process { execheap execmem }; -@@ -564,7 +816,6 @@ +@@ -561,7 +821,6 @@ ifdef(`distro_rhel4',` allow xdm_t self:process { execheap execmem }; ') @@ -24403,7 +24292,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser optional_policy(` userhelper_dontaudit_search_config(xdm_t) -@@ -575,6 +826,10 @@ +@@ -572,6 +831,10 @@ ') optional_policy(` @@ -24414,7 +24303,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser xfs_stream_connect(xdm_t) ') -@@ -599,10 +854,9 @@ +@@ -596,10 +859,9 @@ # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack @@ -24426,7 +24315,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser allow xserver_t self:fd use; allow xserver_t self:fifo_file rw_fifo_file_perms; allow xserver_t self:sock_file read_sock_file_perms; -@@ -614,6 +868,18 @@ +@@ -611,6 +873,18 @@ allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:udp_socket create_socket_perms; @@ -24445,7 +24334,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) -@@ -633,12 +899,19 @@ +@@ -630,12 +904,19 @@ manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) files_search_var_lib(xserver_t) @@ -24467,7 +24356,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser kernel_read_system_state(xserver_t) kernel_read_device_sysctls(xserver_t) -@@ -672,7 +945,6 @@ +@@ -669,7 +950,6 @@ dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) @@ -24475,7 +24364,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser dev_create_generic_dirs(xserver_t) dev_setattr_generic_dirs(xserver_t) # raw memory access is needed if not using the frame buffer -@@ -682,9 +954,12 @@ +@@ -679,9 +959,12 @@ dev_rw_xserver_misc(xserver_t) # read events - the synaptics touchpad driver reads raw events dev_rw_input_dev(xserver_t) @@ -24489,7 +24378,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser files_read_etc_files(xserver_t) files_read_etc_runtime_files(xserver_t) -@@ -699,8 +974,13 @@ +@@ -696,8 +979,13 @@ fs_search_nfs(xserver_t) fs_search_auto_mountpoints(xserver_t) fs_search_ramfs(xserver_t) @@ -24503,7 +24392,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser selinux_validate_context(xserver_t) selinux_compute_access_vector(xserver_t) -@@ -722,11 +1002,14 @@ +@@ -719,11 +1007,14 @@ miscfiles_read_localization(xserver_t) miscfiles_read_fonts(xserver_t) @@ -24518,7 +24407,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser userdom_search_user_home_dirs(xserver_t) userdom_use_user_ttys(xserver_t) -@@ -778,12 +1061,28 @@ +@@ -775,12 +1066,28 @@ ') optional_policy(` @@ -24548,7 +24437,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser unconfined_domtrans(xserver_t) ') -@@ -807,10 +1106,10 @@ +@@ -804,10 +1111,10 @@ # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open # handle of a file inside the dir!!! @@ -24561,22 +24450,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # Label pid and temporary files with derived types. manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) -@@ -831,9 +1130,14 @@ +@@ -828,6 +1135,13 @@ # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_user_home_content_files(xserver_t) +userdom_read_all_users_state(xserver_t) - - xserver_use_user_fonts(xserver_t) - ++ ++xserver_use_user_fonts(xserver_t) ++ +optional_policy(` + userhelper_search_config(xserver_t) +') -+ + tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(xserver_t) - fs_manage_nfs_files(xserver_t) -@@ -848,11 +1152,14 @@ +@@ -843,11 +1157,14 @@ optional_policy(` dbus_system_bus_client(xserver_t) @@ -24593,7 +24481,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') optional_policy(` -@@ -998,3 +1305,33 @@ +@@ -993,3 +1310,33 @@ allow xserver_unconfined_type xextension_type:x_extension *; allow xserver_unconfined_type { x_domain xserver_t }:x_resource *; allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *; @@ -24627,24 +24515,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser +tunable_policy(`use_samba_home_dirs',` + fs_append_cifs_files(xdmhomewriter) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zabbix.te serefpolicy-3.8.6/policy/modules/services/zabbix.te ---- nsaserefpolicy/policy/modules/services/zabbix.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/services/zabbix.te 2010-07-12 09:05:35.000000000 -0400 -@@ -12,11 +12,9 @@ - type zabbix_initrc_exec_t; - init_script_file(zabbix_initrc_exec_t) - --# log files - type zabbix_log_t; - logging_log_file(zabbix_log_t) - --# pid files - type zabbix_var_run_t; - files_pid_file(zabbix_var_run_t) - -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.fc serefpolicy-3.8.6/policy/modules/services/zarafa.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.fc serefpolicy-3.8.7/policy/modules/services/zarafa.fc --- nsaserefpolicy/policy/modules/services/zarafa.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/zarafa.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/zarafa.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,27 @@ + +/etc/zarafa(/.*)? gen_context(system_u:object_r:zarafa_etc_t,s0) @@ -24673,9 +24546,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zara +/var/run/zarafa-spooler\.pid -- gen_context(system_u:object_r:zarafa_spooler_var_run_t,s0) +/var/run/zarafa-ical\.pid -- gen_context(system_u:object_r:zarafa_ical_var_run_t,s0) +/var/run/zarafa-monitor\.pid -- gen_context(system_u:object_r:zarafa_monitor_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.if serefpolicy-3.8.6/policy/modules/services/zarafa.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.if serefpolicy-3.8.7/policy/modules/services/zarafa.if --- nsaserefpolicy/policy/modules/services/zarafa.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/zarafa.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/zarafa.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,105 @@ + +## policy for zarafa services @@ -24782,9 +24655,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zara + + stream_connect_pattern($1, zarafa_server_t, zarafa_server_var_run_t, zarafa_server_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.te serefpolicy-3.8.6/policy/modules/services/zarafa.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.te serefpolicy-3.8.7/policy/modules/services/zarafa.te --- nsaserefpolicy/policy/modules/services/zarafa.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/services/zarafa.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/services/zarafa.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,133 @@ +policy_module(zarafa, 1.0.0) + @@ -24919,9 +24792,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zara +optional_policy(` + apache_content_template(zarafa) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.8.6/policy/modules/system/application.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.8.7/policy/modules/system/application.te --- nsaserefpolicy/policy/modules/system/application.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/application.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/application.te 2010-07-14 14:08:02.000000000 -0400 @@ -6,6 +6,22 @@ # Executables to be run by user attribute application_exec_type; @@ -24945,9 +24818,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic optional_policy(` ssh_sigchld(application_domain_type) ssh_rw_stream_sockets(application_domain_type) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.8.6/policy/modules/system/authlogin.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.8.7/policy/modules/system/authlogin.fc --- nsaserefpolicy/policy/modules/system/authlogin.fc 2010-03-18 10:35:11.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/authlogin.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/authlogin.fc 2010-07-14 14:08:02.000000000 -0400 @@ -10,6 +10,7 @@ /sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0) /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0) @@ -24956,9 +24829,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo /sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0) /sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0) ifdef(`distro_suse', ` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.8.6/policy/modules/system/authlogin.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.8.7/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2010-03-18 10:35:11.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/authlogin.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/authlogin.if 2010-07-14 14:08:02.000000000 -0400 @@ -91,9 +91,12 @@ interface(`auth_login_pgm_domain',` gen_require(` @@ -25080,9 +24953,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.8.6/policy/modules/system/authlogin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.8.7/policy/modules/system/authlogin.te --- nsaserefpolicy/policy/modules/system/authlogin.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/authlogin.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/authlogin.te 2010-07-14 14:08:02.000000000 -0400 @@ -8,6 +8,7 @@ attribute can_read_shadow_passwords; attribute can_write_shadow_passwords; @@ -25103,9 +24976,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + userdom_relabelto_user_home_dirs(polydomain) + userdom_relabelto_user_home_files(polydomain) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/daemontools.if serefpolicy-3.8.6/policy/modules/system/daemontools.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/daemontools.if serefpolicy-3.8.7/policy/modules/system/daemontools.if --- nsaserefpolicy/policy/modules/system/daemontools.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/daemontools.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/daemontools.if 2010-07-14 14:08:02.000000000 -0400 @@ -71,6 +71,32 @@ domtrans_pattern($1, svc_start_exec_t, svc_start_t) ') @@ -25186,9 +25059,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/daemon + + allow $1 svc_run_t:process sigchld; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/daemontools.te serefpolicy-3.8.6/policy/modules/system/daemontools.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/daemontools.te serefpolicy-3.8.7/policy/modules/system/daemontools.te --- nsaserefpolicy/policy/modules/system/daemontools.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/daemontools.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/daemontools.te 2010-07-14 14:08:02.000000000 -0400 @@ -38,7 +38,10 @@ # multilog creates /service/*/log/status manage_files_pattern(svc_multilog_t, svc_svc_t, svc_svc_t) @@ -25261,9 +25134,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/daemon + daemontools_domtrans_run(svc_start_t) daemontools_manage_svc(svc_start_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.8.6/policy/modules/system/fstools.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.8.7/policy/modules/system/fstools.fc --- nsaserefpolicy/policy/modules/system/fstools.fc 2010-03-09 15:39:06.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/fstools.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/fstools.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,4 +1,3 @@ -/sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0) @@ -25277,9 +25150,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.8.6/policy/modules/system/fstools.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.8.7/policy/modules/system/fstools.te --- nsaserefpolicy/policy/modules/system/fstools.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/fstools.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/fstools.te 2010-07-14 14:08:02.000000000 -0400 @@ -117,6 +117,8 @@ fs_search_tmpfs(fsadm_t) fs_getattr_tmpfs_dirs(fsadm_t) @@ -25313,9 +25186,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool nis_use_ypbind(fsadm_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.8.6/policy/modules/system/getty.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.8.7/policy/modules/system/getty.te --- nsaserefpolicy/policy/modules/system/getty.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/getty.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/getty.te 2010-07-14 14:08:02.000000000 -0400 @@ -83,7 +83,7 @@ term_setattr_all_ttys(getty_t) term_setattr_unallocated_ttys(getty_t) @@ -25325,9 +25198,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty. auth_rw_login_records(getty_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.8.6/policy/modules/system/hostname.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.8.7/policy/modules/system/hostname.te --- nsaserefpolicy/policy/modules/system/hostname.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/hostname.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/hostname.te 2010-07-14 14:08:02.000000000 -0400 @@ -26,15 +26,18 @@ dev_read_sysfs(hostname_t) @@ -25358,9 +25231,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna xen_append_log(hostname_t) xen_dontaudit_use_fds(hostname_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplug.te serefpolicy-3.8.6/policy/modules/system/hotplug.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplug.te serefpolicy-3.8.7/policy/modules/system/hotplug.te --- nsaserefpolicy/policy/modules/system/hotplug.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/hotplug.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/hotplug.te 2010-07-14 14:08:02.000000000 -0400 @@ -23,7 +23,7 @@ # @@ -25378,10 +25251,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplu kernel_read_kernel_sysctls(hotplug_t) kernel_read_net_sysctls(hotplug_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.fc serefpolicy-3.8.6/policy/modules/system/init.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.fc serefpolicy-3.8.7/policy/modules/system/init.fc --- nsaserefpolicy/policy/modules/system/init.fc 2010-03-18 10:35:11.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/init.fc 2010-07-12 09:05:35.000000000 -0400 -@@ -44,6 +44,9 @@ ++++ serefpolicy-3.8.7/policy/modules/system/init.fc 2010-07-15 08:43:58.000000000 -0400 +@@ -24,6 +24,11 @@ + # + # /sbin + # ++/bin/systemd -- gen_context(system_u:object_r:init_exec_t,s0) ++ ++# ++# /sbin ++# + /sbin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0) + + ifdef(`distro_gentoo', ` +@@ -44,6 +49,9 @@ /usr/sbin/apachectl -- gen_context(system_u:object_r:initrc_exec_t,s0) /usr/sbin/open_init_pty -- gen_context(system_u:object_r:initrc_exec_t,s0) @@ -25391,9 +25276,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.f # # /var -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.8.6/policy/modules/system/init.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.8.7/policy/modules/system/init.if --- nsaserefpolicy/policy/modules/system/init.if 2010-03-18 10:35:11.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/init.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/init.if 2010-07-14 14:08:02.000000000 -0400 @@ -193,8 +193,10 @@ gen_require(` attribute direct_run_init, direct_init, direct_init_entry; @@ -25655,9 +25540,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i + init_dontaudit_use_script_fds($1) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.8.6/policy/modules/system/init.te ---- nsaserefpolicy/policy/modules/system/init.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/init.te 2010-07-12 11:30:18.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.8.7/policy/modules/system/init.te +--- nsaserefpolicy/policy/modules/system/init.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/init.te 2010-07-14 16:30:09.000000000 -0400 @@ -16,6 +16,27 @@ ## gen_tunable(init_upstart, false) @@ -25731,7 +25616,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t # For /var/run/shutdown.pid. allow init_t init_var_run_t:file manage_file_perms; -@@ -120,6 +145,7 @@ +@@ -120,12 +145,14 @@ corecmd_exec_bin(init_t) dev_read_sysfs(init_t) @@ -25739,7 +25624,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t domain_getpgid_all_domains(init_t) domain_kill_all_domains(init_t) -@@ -168,6 +194,8 @@ + domain_signal_all_domains(init_t) + domain_signull_all_domains(init_t) + domain_sigstop_all_domains(init_t) ++domain_sigstop_all_domains(init_t) + domain_sigchld_all_domains(init_t) + + files_read_etc_files(init_t) +@@ -167,6 +194,8 @@ miscfiles_read_localization(init_t) @@ -25748,7 +25640,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ifdef(`distro_gentoo',` allow init_t self:process { getcap setcap }; ') -@@ -191,10 +219,23 @@ +@@ -190,10 +219,23 @@ ') optional_policy(` @@ -25772,7 +25664,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t nscd_socket_use(init_t) ') -@@ -212,7 +253,7 @@ +@@ -211,7 +253,7 @@ # allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; @@ -25781,7 +25673,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t dontaudit initrc_t self:capability sys_module; # sysctl is triggering this allow initrc_t self:passwd rootok; allow initrc_t self:key manage_key_perms; -@@ -241,6 +282,7 @@ +@@ -240,6 +282,7 @@ allow initrc_t initrc_var_run_t:file manage_file_perms; files_pid_filetrans(initrc_t, initrc_var_run_t, file) @@ -25789,7 +25681,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t can_exec(initrc_t, initrc_tmp_t) manage_files_pattern(initrc_t, initrc_tmp_t, initrc_tmp_t) -@@ -258,11 +300,22 @@ +@@ -257,11 +300,22 @@ kernel_clear_ring_buffer(initrc_t) kernel_get_sysvipc_info(initrc_t) kernel_read_all_sysctls(initrc_t) @@ -25812,17 +25704,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t corecmd_exec_all_executables(initrc_t) -@@ -298,8 +351,7 @@ +@@ -297,11 +351,13 @@ dev_delete_generic_symlinks(initrc_t) dev_getattr_all_blk_files(initrc_t) dev_getattr_all_chr_files(initrc_t) -- --corecmd_exec_all_executables(initrc_t) +dev_rw_xserver_misc(initrc_t) domain_kill_all_domains(initrc_t) domain_signal_all_domains(initrc_t) -@@ -324,8 +376,10 @@ + domain_signull_all_domains(initrc_t) + domain_sigstop_all_domains(initrc_t) ++domain_sigstop_all_domains(initrc_t) + domain_sigchld_all_domains(initrc_t) + domain_read_all_domains_state(initrc_t) + domain_getattr_all_domains(initrc_t) +@@ -320,8 +376,10 @@ files_getattr_all_pipes(initrc_t) files_getattr_all_sockets(initrc_t) files_purge_tmp(initrc_t) @@ -25834,7 +25730,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t files_delete_all_pids(initrc_t) files_delete_all_pid_dirs(initrc_t) files_read_etc_files(initrc_t) -@@ -341,6 +395,8 @@ +@@ -337,6 +395,8 @@ files_mounton_isid_type_dirs(initrc_t) files_list_default(initrc_t) files_mounton_default(initrc_t) @@ -25843,7 +25739,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t fs_delete_cgroup_dirs(initrc_t) fs_list_cgroup_dirs(initrc_t) -@@ -354,6 +410,8 @@ +@@ -350,6 +410,8 @@ fs_unmount_all_fs(initrc_t) fs_remount_all_fs(initrc_t) fs_getattr_all_fs(initrc_t) @@ -25852,7 +25748,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t # initrc_t needs to do a pidof which requires ptrace mcs_ptrace_all(initrc_t) -@@ -366,6 +424,7 @@ +@@ -362,6 +424,7 @@ mls_process_write_down(initrc_t) mls_rangetrans_source(initrc_t) mls_fd_share_all_levels(initrc_t) @@ -25860,7 +25756,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t selinux_get_enforce_mode(initrc_t) -@@ -397,13 +456,14 @@ +@@ -393,13 +456,14 @@ miscfiles_read_localization(initrc_t) # slapd needs to read cert files from its initscript @@ -25876,7 +25772,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t userdom_read_user_home_content_files(initrc_t) # Allow access to the sysadm TTYs. Note that this will give access to the # TTYs to any process in the initrc_t domain. Therefore, daemons and such -@@ -476,7 +536,7 @@ +@@ -472,7 +536,7 @@ # Red Hat systems seem to have a stray # fd open from the initrd @@ -25885,7 +25781,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t files_dontaudit_read_root_files(initrc_t) # These seem to be from the initrd -@@ -522,6 +582,19 @@ +@@ -518,6 +582,19 @@ optional_policy(` bind_manage_config_dirs(initrc_t) bind_write_config(initrc_t) @@ -25905,7 +25801,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -529,10 +602,16 @@ +@@ -525,10 +602,17 @@ rpc_write_exports(initrc_t) rpc_manage_nfs_state_data(initrc_t) ') @@ -25919,10 +25815,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t + sysnet_manage_dhcpc_state(initrc_t) + sysnet_relabelfrom_dhcpc_state(initrc_t) + sysnet_relabelfrom_net_conf(initrc_t) ++ sysnet_relabelto_net_conf(initrc_t) ') optional_policy(` -@@ -547,6 +626,35 @@ +@@ -543,6 +627,35 @@ ') ') @@ -25958,7 +25855,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t optional_policy(` amavis_search_lib(initrc_t) amavis_setattr_pid_files(initrc_t) -@@ -559,6 +667,8 @@ +@@ -555,6 +668,8 @@ optional_policy(` apache_read_config(initrc_t) apache_list_modules(initrc_t) @@ -25967,7 +25864,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -587,6 +697,11 @@ +@@ -583,6 +698,11 @@ ') optional_policy(` @@ -25979,7 +25876,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t dev_getattr_printer_dev(initrc_t) cups_read_log(initrc_t) -@@ -603,6 +718,7 @@ +@@ -599,6 +719,7 @@ dbus_connect_system_bus(initrc_t) dbus_system_bus_client(initrc_t) dbus_read_config(initrc_t) @@ -25987,7 +25884,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t optional_policy(` consolekit_dbus_chat(initrc_t) -@@ -704,7 +820,12 @@ +@@ -700,7 +821,12 @@ ') optional_policy(` @@ -26000,7 +25897,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t mta_dontaudit_read_spool_symlinks(initrc_t) ') -@@ -727,6 +848,10 @@ +@@ -723,6 +849,10 @@ ') optional_policy(` @@ -26011,7 +25908,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t postgresql_manage_db(initrc_t) postgresql_read_config(initrc_t) ') -@@ -769,8 +894,6 @@ +@@ -765,8 +895,6 @@ # bash tries ioctl for some reason files_dontaudit_ioctl_all_pids(initrc_t) @@ -26020,7 +25917,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -783,10 +906,12 @@ +@@ -779,10 +907,12 @@ squid_manage_logs(initrc_t) ') @@ -26033,7 +25930,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t optional_policy(` ssh_dontaudit_read_server_keys(initrc_t) -@@ -808,11 +933,19 @@ +@@ -804,11 +934,19 @@ ') optional_policy(` @@ -26054,7 +25951,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ifdef(`distro_redhat',` # system-config-services causes avc messages that should be dontaudited -@@ -822,6 +955,25 @@ +@@ -818,6 +956,25 @@ optional_policy(` mono_domtrans(initrc_t) ') @@ -26080,7 +25977,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -847,3 +999,35 @@ +@@ -843,3 +1000,35 @@ optional_policy(` zebra_read_config(initrc_t) ') @@ -26116,9 +26013,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t +ifdef(`init_systemd', ` + allow daemon init_t:socket_class_set { getopt read getattr ioctl setopt write }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.fc serefpolicy-3.8.6/policy/modules/system/ipsec.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.fc serefpolicy-3.8.7/policy/modules/system/ipsec.fc --- nsaserefpolicy/policy/modules/system/ipsec.fc 2010-03-18 06:48:09.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/ipsec.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/ipsec.fc 2010-07-14 14:08:02.000000000 -0400 @@ -25,6 +25,7 @@ /usr/libexec/ipsec/klipsdebug -- gen_context(system_u:object_r:ipsec_exec_t,s0) /usr/libexec/ipsec/pluto -- gen_context(system_u:object_r:ipsec_exec_t,s0) @@ -26127,9 +26024,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. /usr/local/lib(64)?/ipsec/eroute -- gen_context(system_u:object_r:ipsec_exec_t,s0) /usr/local/lib(64)?/ipsec/klipsdebug -- gen_context(system_u:object_r:ipsec_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.8.6/policy/modules/system/ipsec.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.8.7/policy/modules/system/ipsec.if --- nsaserefpolicy/policy/modules/system/ipsec.if 2010-03-18 06:48:09.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/ipsec.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/ipsec.if 2010-07-14 14:08:02.000000000 -0400 @@ -20,6 +20,24 @@ ######################################## @@ -26217,9 +26114,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. + allow $1 ipsec_mgmt_t:process sigkill; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.8.6/policy/modules/system/ipsec.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.8.7/policy/modules/system/ipsec.te --- nsaserefpolicy/policy/modules/system/ipsec.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/ipsec.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/ipsec.te 2010-07-14 14:08:02.000000000 -0400 @@ -72,7 +72,7 @@ # @@ -26353,9 +26250,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. userdom_use_user_terminals(setkey_t) +userdom_read_user_tmp_files(setkey_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.fc serefpolicy-3.8.6/policy/modules/system/iptables.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.fc serefpolicy-3.8.7/policy/modules/system/iptables.fc --- nsaserefpolicy/policy/modules/system/iptables.fc 2010-02-12 16:41:05.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/iptables.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/iptables.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,12 +1,19 @@ /etc/rc\.d/init\.d/ip6?tables -- gen_context(system_u:object_r:iptables_initrc_exec_t,s0) -/etc/sysconfig/ip6?tables.* -- gen_context(system_u:object_r:iptables_conf_t,s0) @@ -26378,9 +26275,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl /usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/iptables -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/iptables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.if serefpolicy-3.8.6/policy/modules/system/iptables.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.if serefpolicy-3.8.7/policy/modules/system/iptables.if --- nsaserefpolicy/policy/modules/system/iptables.if 2009-12-04 09:43:33.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/iptables.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/iptables.if 2010-07-14 14:08:02.000000000 -0400 @@ -17,6 +17,10 @@ corecmd_search_bin($1) @@ -26392,9 +26289,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.8.6/policy/modules/system/iptables.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.8.7/policy/modules/system/iptables.te --- nsaserefpolicy/policy/modules/system/iptables.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/iptables.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/iptables.te 2010-07-14 14:08:02.000000000 -0400 @@ -13,9 +13,6 @@ type iptables_initrc_exec_t; init_script_file(iptables_initrc_exec_t) @@ -26479,9 +26376,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.if serefpolicy-3.8.6/policy/modules/system/iscsi.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.if serefpolicy-3.8.7/policy/modules/system/iscsi.if --- nsaserefpolicy/policy/modules/system/iscsi.if 2009-11-25 11:47:19.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/iscsi.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/iscsi.if 2010-07-14 14:08:02.000000000 -0400 @@ -56,3 +56,21 @@ allow $1 iscsi_var_lib_t:dir list_dir_perms; files_search_var_lib($1) @@ -26504,9 +26401,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi. + + allow $1 iscsid_t:sem create_sem_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.8.6/policy/modules/system/iscsi.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.8.7/policy/modules/system/iscsi.te --- nsaserefpolicy/policy/modules/system/iscsi.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/iscsi.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/iscsi.te 2010-07-14 14:08:02.000000000 -0400 @@ -76,6 +76,8 @@ dev_rw_sysfs(iscsid_t) @@ -26516,9 +26413,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi. domain_use_interactive_fds(iscsid_t) domain_dontaudit_read_all_domains_state(iscsid_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.8.6/policy/modules/system/libraries.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.8.7/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2010-03-23 11:19:40.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/libraries.fc 2010-07-12 16:29:02.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/libraries.fc 2010-07-14 14:08:02.000000000 -0400 @@ -131,13 +131,13 @@ /usr/lib/vlc/codec/libdmo_plugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/vlc/codec/librealaudio_plugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -26727,9 +26624,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar +/opt/lgtonmc/bin/.*\.so(\.[0-9])? -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/opt/google/picasa/.*\.dll -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/opt/google/picasa/.*\.yti -- gen_context(system_u:object_r:textrel_shlib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.8.6/policy/modules/system/libraries.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.8.7/policy/modules/system/libraries.te --- nsaserefpolicy/policy/modules/system/libraries.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/libraries.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/libraries.te 2010-07-14 14:08:02.000000000 -0400 @@ -61,7 +61,7 @@ manage_files_pattern(ldconfig_t, ldconfig_cache_t, ldconfig_cache_t) @@ -26766,9 +26663,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar ifdef(`hide_broken_symptoms',` ifdef(`distro_gentoo',` # leaked fds from portage -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.8.6/policy/modules/system/locallogin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.fc serefpolicy-3.8.7/policy/modules/system/locallogin.fc +--- nsaserefpolicy/policy/modules/system/locallogin.fc 2009-07-14 14:19:57.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/locallogin.fc 2010-07-14 14:08:02.000000000 -0400 +@@ -1,2 +1,3 @@ + + /sbin/sulogin -- gen_context(system_u:object_r:sulogin_exec_t,s0) ++/sbin/sushell -- gen_context(system_u:object_r:sulogin_exec_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.8.7/policy/modules/system/locallogin.te --- nsaserefpolicy/policy/modules/system/locallogin.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/locallogin.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/locallogin.te 2010-07-14 14:08:02.000000000 -0400 @@ -32,9 +32,8 @@ # Local login local policy # @@ -26870,9 +26774,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall -optional_policy(` - nscd_socket_use(sulogin_t) -') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.8.6/policy/modules/system/logging.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.8.7/policy/modules/system/logging.fc --- nsaserefpolicy/policy/modules/system/logging.fc 2010-03-18 06:48:09.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/logging.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/logging.fc 2010-07-14 14:08:02.000000000 -0400 @@ -17,6 +17,10 @@ /sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) /sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0) @@ -26911,9 +26815,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin /var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) + +/var/webmin(/.*)? gen_context(system_u:object_r:var_log_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.8.6/policy/modules/system/logging.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.8.7/policy/modules/system/logging.if --- nsaserefpolicy/policy/modules/system/logging.if 2010-03-18 06:48:09.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/logging.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/logging.if 2010-07-14 14:08:02.000000000 -0400 @@ -545,6 +545,25 @@ ######################################## @@ -26985,9 +26889,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin init_labeled_script_domtrans($1, syslogd_initrc_exec_t) domain_system_change_exemption($1) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.8.6/policy/modules/system/logging.te ---- nsaserefpolicy/policy/modules/system/logging.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/logging.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.8.7/policy/modules/system/logging.te +--- nsaserefpolicy/policy/modules/system/logging.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/logging.te 2010-07-14 14:08:02.000000000 -0400 @@ -60,6 +60,7 @@ type syslogd_t; type syslogd_exec_t; @@ -27058,20 +26962,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin sysnet_dns_name_resolve(audisp_remote_t) ######################################## -@@ -372,8 +394,10 @@ +@@ -372,6 +394,11 @@ manage_files_pattern(syslogd_t, syslogd_var_lib_t, syslogd_var_lib_t) files_search_var_lib(syslogd_t) --allow syslogd_t syslogd_var_run_t:file manage_file_perms; --files_pid_filetrans(syslogd_t, syslogd_var_run_t, file) +manage_dirs_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t) +manage_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t) +manage_sock_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t) +files_pid_filetrans(syslogd_t, syslogd_var_run_t, { dir file }) - ++ # manage pid file manage_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t) -@@ -415,6 +439,7 @@ + files_pid_filetrans(syslogd_t, syslogd_var_run_t, file) +@@ -412,6 +439,7 @@ dev_filetrans(syslogd_t, devlog_t, sock_file) dev_read_sysfs(syslogd_t) @@ -27079,7 +26982,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin domain_use_interactive_fds(syslogd_t) -@@ -491,6 +516,10 @@ +@@ -488,6 +516,10 @@ ') optional_policy(` @@ -27090,9 +26993,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin udev_read_db(syslogd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.8.6/policy/modules/system/lvm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.8.7/policy/modules/system/lvm.fc --- nsaserefpolicy/policy/modules/system/lvm.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/lvm.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/lvm.fc 2010-07-14 14:08:02.000000000 -0400 @@ -28,10 +28,12 @@ # /lib/lvm-10/.* -- gen_context(system_u:object_r:lvm_exec_t,s0) @@ -27106,9 +27009,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc /sbin/cryptsetup -- gen_context(system_u:object_r:lvm_exec_t,s0) /sbin/dmraid -- gen_context(system_u:object_r:lvm_exec_t,s0) /sbin/dmsetup -- gen_context(system_u:object_r:lvm_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.8.6/policy/modules/system/lvm.te ---- nsaserefpolicy/policy/modules/system/lvm.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/lvm.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.8.7/policy/modules/system/lvm.te +--- nsaserefpolicy/policy/modules/system/lvm.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/lvm.te 2010-07-14 14:08:02.000000000 -0400 @@ -141,6 +141,11 @@ ') @@ -27129,7 +27032,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te allow lvm_t self:file rw_file_perms; allow lvm_t self:fifo_file manage_fifo_file_perms; allow lvm_t self:unix_dgram_socket create_socket_perms; -@@ -217,6 +223,7 @@ +@@ -211,11 +217,13 @@ + files_search_mnt(lvm_t) + + kernel_read_system_state(lvm_t) ++kernel_read_kernel_sysctls(lvm_t) + # Read system variables in /proc/sys + kernel_read_kernel_sysctls(lvm_t) # it has no reason to need this kernel_dontaudit_getattr_core_if(lvm_t) kernel_use_fds(lvm_t) @@ -27137,7 +27046,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te kernel_search_debugfs(lvm_t) corecmd_exec_bin(lvm_t) -@@ -243,6 +250,7 @@ +@@ -242,6 +250,7 @@ dev_dontaudit_getattr_generic_blk_files(lvm_t) dev_dontaudit_getattr_generic_pipes(lvm_t) dev_create_generic_dirs(lvm_t) @@ -27145,7 +27054,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te domain_use_interactive_fds(lvm_t) domain_read_all_domains_state(lvm_t) -@@ -252,8 +260,9 @@ +@@ -251,8 +260,9 @@ files_read_etc_runtime_files(lvm_t) # for when /usr is not mounted: files_dontaudit_search_isid_type_dirs(lvm_t) @@ -27156,7 +27065,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te fs_search_auto_mountpoints(lvm_t) fs_list_tmpfs(lvm_t) fs_read_tmpfs_symlinks(lvm_t) -@@ -263,6 +272,7 @@ +@@ -262,6 +272,7 @@ mls_file_read_all_levels(lvm_t) mls_file_write_to_clearance(lvm_t) @@ -27164,7 +27073,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te selinux_get_fs_mount(lvm_t) selinux_validate_context(lvm_t) -@@ -310,6 +320,11 @@ +@@ -309,6 +320,11 @@ ') optional_policy(` @@ -27176,7 +27085,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te bootloader_rw_tmp_files(lvm_t) ') -@@ -330,6 +345,10 @@ +@@ -329,6 +345,10 @@ ') optional_policy(` @@ -27187,9 +27096,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te modutils_domtrans_insmod(lvm_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.8.6/policy/modules/system/miscfiles.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.8.7/policy/modules/system/miscfiles.fc --- nsaserefpolicy/policy/modules/system/miscfiles.fc 2010-03-09 15:39:06.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/miscfiles.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/miscfiles.fc 2010-07-14 14:08:02.000000000 -0400 @@ -75,13 +75,11 @@ /var/cache/fonts(/.*)? gen_context(system_u:object_r:tetex_data_t,s0) /var/cache/man(/.*)? gen_context(system_u:object_r:man_t,s0) @@ -27206,9 +27115,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi ifdef(`distro_debian',` /var/lib/msttcorefonts(/.*)? gen_context(system_u:object_r:fonts_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.8.6/policy/modules/system/miscfiles.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.8.7/policy/modules/system/miscfiles.if --- nsaserefpolicy/policy/modules/system/miscfiles.if 2010-03-09 15:39:06.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/miscfiles.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/miscfiles.if 2010-07-14 14:08:02.000000000 -0400 @@ -305,9 +305,6 @@ allow $1 locale_t:dir list_dir_perms; read_files_pattern($1, locale_t, locale_t) @@ -27219,9 +27128,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.if serefpolicy-3.8.6/policy/modules/system/modutils.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.if serefpolicy-3.8.7/policy/modules/system/modutils.if --- nsaserefpolicy/policy/modules/system/modutils.if 2009-12-04 09:43:33.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/modutils.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/modutils.if 2010-07-14 14:08:02.000000000 -0400 @@ -39,6 +39,26 @@ ######################################## @@ -27249,9 +27158,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti ## Read the configuration options used when ## loading modules. ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.8.6/policy/modules/system/modutils.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.8.7/policy/modules/system/modutils.te --- nsaserefpolicy/policy/modules/system/modutils.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/modutils.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/modutils.te 2010-07-14 16:35:18.000000000 -0400 @@ -18,6 +18,7 @@ type insmod_exec_t; application_domain(insmod_t, insmod_exec_t) @@ -27333,9 +27242,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti userdom_dontaudit_search_user_home_dirs(insmod_t) if( ! secure_mode_insmod ) { -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.8.6/policy/modules/system/mount.fc +@@ -235,6 +243,10 @@ + ') + + optional_policy(` ++ virt_dontaudit_write_pipes(insmod_t) ++') ++ ++optional_policy(` + # cjp: why is this needed: + dev_rw_xserver_misc(insmod_t) + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.8.7/policy/modules/system/mount.fc --- nsaserefpolicy/policy/modules/system/mount.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/mount.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/mount.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,4 +1,10 @@ /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) @@ -27348,9 +27268,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. -/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) +/var/cache/davfs2(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0) +/var/run/davfs2(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-3.8.6/policy/modules/system/mount.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-3.8.7/policy/modules/system/mount.if --- nsaserefpolicy/policy/modules/system/mount.if 2009-07-29 15:15:33.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/mount.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/mount.if 2010-07-14 14:08:02.000000000 -0400 @@ -16,6 +16,14 @@ ') @@ -27548,9 +27468,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + mount_domtrans_showmount($1) + role $2 types showmount_t; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.8.6/policy/modules/system/mount.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.8.7/policy/modules/system/mount.te --- nsaserefpolicy/policy/modules/system/mount.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/mount.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/mount.te 2010-07-14 14:08:02.000000000 -0400 @@ -17,8 +17,15 @@ init_system_domain(mount_t, mount_exec_t) role system_r types mount_t; @@ -27834,9 +27754,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. +sysnet_dns_name_resolve(showmount_t) + +userdom_use_user_terminals(showmount_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.8.6/policy/modules/system/raid.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.8.7/policy/modules/system/raid.te --- nsaserefpolicy/policy/modules/system/raid.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/raid.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/raid.te 2010-07-14 14:08:02.000000000 -0400 @@ -57,6 +57,7 @@ files_read_etc_files(mdadm_t) @@ -27845,9 +27765,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t fs_search_auto_mountpoints(mdadm_t) fs_dontaudit_list_tmpfs(mdadm_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.8.6/policy/modules/system/selinuxutil.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.8.7/policy/modules/system/selinuxutil.fc --- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/selinuxutil.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/selinuxutil.fc 2010-07-14 14:08:02.000000000 -0400 @@ -6,13 +6,13 @@ /etc/selinux(/.*)? gen_context(system_u:object_r:selinux_config_t,s0) /etc/selinux/([^/]*/)?contexts(/.*)? gen_context(system_u:object_r:default_context_t,s0) @@ -27887,9 +27807,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu + +/etc/share/selinux/targeted(/.*)? gen_context(system_u:object_r:semanage_store_t,s0) +/etc/share/selinux/mls(/.*)? gen_context(system_u:object_r:semanage_store_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.8.6/policy/modules/system/selinuxutil.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.8.7/policy/modules/system/selinuxutil.if --- nsaserefpolicy/policy/modules/system/selinuxutil.if 2010-03-03 23:26:37.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/selinuxutil.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/selinuxutil.if 2010-07-14 14:08:02.000000000 -0400 @@ -361,6 +361,27 @@ ######################################## @@ -28266,9 +28186,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu + hotplug_use_fds($1) +') +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.8.6/policy/modules/system/selinuxutil.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.8.7/policy/modules/system/selinuxutil.te --- nsaserefpolicy/policy/modules/system/selinuxutil.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/selinuxutil.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/selinuxutil.te 2010-07-14 14:08:02.000000000 -0400 @@ -22,6 +22,9 @@ type selinux_config_t; files_type(selinux_config_t) @@ -28652,9 +28572,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu - hotplug_use_fds(setfiles_t) + unconfined_domain(setfiles_mac_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/setrans.te serefpolicy-3.8.6/policy/modules/system/setrans.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/setrans.te serefpolicy-3.8.7/policy/modules/system/setrans.te --- nsaserefpolicy/policy/modules/system/setrans.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/setrans.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/setrans.te 2010-07-14 14:08:02.000000000 -0400 @@ -12,6 +12,7 @@ type setrans_t; type setrans_exec_t; @@ -28663,15 +28583,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/setran type setrans_initrc_exec_t; init_script_file(setrans_initrc_exec_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosreport.fc serefpolicy-3.8.6/policy/modules/system/sosreport.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosreport.fc serefpolicy-3.8.7/policy/modules/system/sosreport.fc --- nsaserefpolicy/policy/modules/system/sosreport.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/sosreport.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/sosreport.fc 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,2 @@ + +/usr/sbin/sosreport -- gen_context(system_u:object_r:sosreport_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosreport.if serefpolicy-3.8.6/policy/modules/system/sosreport.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosreport.if serefpolicy-3.8.7/policy/modules/system/sosreport.if --- nsaserefpolicy/policy/modules/system/sosreport.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/sosreport.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/sosreport.if 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,131 @@ + +## policy for sosreport @@ -28804,9 +28724,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosrep + + allow $1 sosreport_tmp_t:file append; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosreport.te serefpolicy-3.8.6/policy/modules/system/sosreport.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosreport.te serefpolicy-3.8.7/policy/modules/system/sosreport.te --- nsaserefpolicy/policy/modules/system/sosreport.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/sosreport.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/sosreport.te 2010-07-14 14:08:02.000000000 -0400 @@ -0,0 +1,154 @@ +policy_module(sosreport,1.0.0) + @@ -28962,18 +28882,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sosrep +optional_policy(` + unconfined_domain(sosreport_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.fc serefpolicy-3.8.6/policy/modules/system/sysnetwork.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.fc serefpolicy-3.8.7/policy/modules/system/sysnetwork.fc --- nsaserefpolicy/policy/modules/system/sysnetwork.fc 2010-03-23 10:55:15.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/sysnetwork.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/sysnetwork.fc 2010-07-14 14:08:02.000000000 -0400 @@ -64,3 +64,5 @@ ifdef(`distro_gentoo',` /var/lib/dhcpc(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0) ') + +/etc/firestarter/firestarter\.sh gen_context(system_u:object_r:dhcpc_helper_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.8.6/policy/modules/system/sysnetwork.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.8.7/policy/modules/system/sysnetwork.if --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2010-03-23 10:55:15.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/sysnetwork.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/sysnetwork.if 2010-07-14 14:08:02.000000000 -0400 @@ -60,25 +60,24 @@ netutils_run(dhcpc_t, $2) netutils_run_ping(dhcpc_t, $2) @@ -29221,9 +29141,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet + + role_transition $1 dhcpc_exec_t system_r; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.8.6/policy/modules/system/sysnetwork.te ---- nsaserefpolicy/policy/modules/system/sysnetwork.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/sysnetwork.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.8.7/policy/modules/system/sysnetwork.te +--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/sysnetwork.te 2010-07-14 14:08:02.000000000 -0400 @@ -19,6 +19,9 @@ init_daemon_domain(dhcpc_t, dhcpc_exec_t) role system_r types dhcpc_t; @@ -29279,12 +29199,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet ') optional_policy(` -@@ -192,6 +205,12 @@ +@@ -192,6 +205,13 @@ ') optional_policy(` + networkmanager_domtrans(dhcpc_t) + networkmanager_read_pid_files(dhcpc_t) ++ networkmanager_read_lib_files(dhcpc_t) +') + +optional_policy(` @@ -29292,7 +29213,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet nis_read_ypbind_pid(dhcpc_t) ') -@@ -213,6 +232,7 @@ +@@ -213,6 +233,7 @@ optional_policy(` seutil_sigchld_newrole(dhcpc_t) seutil_dontaudit_search_config(dhcpc_t) @@ -29300,7 +29221,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet ') optional_policy(` -@@ -276,8 +296,11 @@ +@@ -276,8 +297,11 @@ domain_use_interactive_fds(ifconfig_t) @@ -29312,7 +29233,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet fs_getattr_xattr_fs(ifconfig_t) fs_search_auto_mountpoints(ifconfig_t) -@@ -305,6 +328,8 @@ +@@ -305,6 +329,8 @@ seutil_use_runinit_fds(ifconfig_t) @@ -29321,7 +29242,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet userdom_use_user_terminals(ifconfig_t) userdom_use_all_users_fds(ifconfig_t) -@@ -327,6 +352,8 @@ +@@ -327,6 +353,8 @@ optional_policy(` hal_dontaudit_rw_pipes(ifconfig_t) hal_dontaudit_rw_dgram_sockets(ifconfig_t) @@ -29330,17 +29251,28 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.fc serefpolicy-3.8.6/policy/modules/system/udev.fc +@@ -334,6 +362,10 @@ + ') + + optional_policy(` ++ netutils_domtrans(dhcpc_t) ++') ++ ++optional_policy(` + nis_use_ypbind(ifconfig_t) + ') + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.fc serefpolicy-3.8.7/policy/modules/system/udev.fc --- nsaserefpolicy/policy/modules/system/udev.fc 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/udev.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/udev.fc 2010-07-14 14:08:02.000000000 -0400 @@ -22,3 +22,4 @@ /usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0) /var/run/PackageKit/udev(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0) +/var/run/libgpod(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.8.6/policy/modules/system/udev.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.8.7/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/udev.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/udev.te 2010-07-14 16:42:17.000000000 -0400 @@ -52,6 +52,7 @@ allow udev_t self:unix_stream_socket connectto; allow udev_t self:netlink_kobject_uevent_socket create_socket_perms; @@ -29349,7 +29281,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t allow udev_t udev_exec_t:file write; can_exec(udev_t, udev_exec_t) -@@ -216,6 +217,10 @@ +@@ -116,6 +117,7 @@ + files_dontaudit_search_isid_type_dirs(udev_t) + files_getattr_generic_locks(udev_t) + files_search_mnt(udev_t) ++files_list_tmp(udev_t) + + fs_getattr_all_fs(udev_t) + fs_list_inotifyfs(udev_t) +@@ -216,6 +218,10 @@ ') optional_policy(` @@ -29360,7 +29300,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t consoletype_exec(udev_t) ') -@@ -259,6 +264,10 @@ +@@ -259,6 +265,10 @@ ') optional_policy(` @@ -29371,7 +29311,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t openct_read_pid_files(udev_t) openct_domtrans(udev_t) ') -@@ -273,6 +282,10 @@ +@@ -273,6 +283,10 @@ ') optional_policy(` @@ -29382,9 +29322,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t unconfined_signal(udev_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.8.6/policy/modules/system/unconfined.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.8.7/policy/modules/system/unconfined.fc --- nsaserefpolicy/policy/modules/system/unconfined.fc 2010-02-22 08:30:53.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/unconfined.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/unconfined.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,15 +1 @@ # Add programs here which should not be confined by SELinux -# e.g.: @@ -29401,9 +29341,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf -ifdef(`distro_gentoo',` -/usr/lib32/openoffice/program/[^/]+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) -') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.8.6/policy/modules/system/unconfined.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.8.7/policy/modules/system/unconfined.if --- nsaserefpolicy/policy/modules/system/unconfined.if 2010-03-01 15:12:54.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/unconfined.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/unconfined.if 2010-07-14 14:08:02.000000000 -0400 @@ -12,14 +12,13 @@ # interface(`unconfined_domain_noaudit',` @@ -29898,9 +29838,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf - - allow $1 unconfined_t:dbus acquire_svc; -') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.8.6/policy/modules/system/unconfined.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.8.7/policy/modules/system/unconfined.te --- nsaserefpolicy/policy/modules/system/unconfined.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/unconfined.te 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/unconfined.te 2010-07-14 14:08:02.000000000 -0400 @@ -4,227 +4,5 @@ # # Declarations @@ -30130,9 +30070,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf - hal_dbus_chat(unconfined_execmem_t) - ') -') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.8.6/policy/modules/system/userdomain.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.8.7/policy/modules/system/userdomain.fc --- nsaserefpolicy/policy/modules/system/userdomain.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/userdomain.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/userdomain.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,4 +1,14 @@ HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh) +HOME_DIR -l gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh) @@ -30149,9 +30089,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo +HOME_DIR/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0) +HOME_DIR/\.pki(/.*)? gen_context(system_u:object_r:home_cert_t,s0) +HOME_DIR/\.gvfs(/.*)? <> -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.8.6/policy/modules/system/userdomain.if ---- nsaserefpolicy/policy/modules/system/userdomain.if 2010-06-08 10:35:48.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/userdomain.if 2010-07-12 11:40:53.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.8.7/policy/modules/system/userdomain.if +--- nsaserefpolicy/policy/modules/system/userdomain.if 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/userdomain.if 2010-07-14 14:08:02.000000000 -0400 @@ -30,8 +30,9 @@ ') @@ -30318,7 +30258,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ####################################### -@@ -168,27 +200,6 @@ +@@ -149,6 +181,8 @@ + type user_home_t, user_home_dir_t; + ') + ++ role $1 types { user_home_t user_home_dir_t }; ++ + ############################## + # + # Domain access to home dir +@@ -166,27 +200,6 @@ read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t) files_list_home($2) @@ -30346,19 +30295,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ####################################### -@@ -220,9 +231,10 @@ +@@ -218,8 +231,11 @@ interface(`userdom_manage_home_role',` gen_require(` type user_home_t, user_home_dir_t; + attribute user_home_type; ') -- role $1 types { user_home_t user_home_dir_t }; + role $1 types { user_home_type user_home_dir_t }; - ++ ############################## # -@@ -232,17 +244,21 @@ + # Domain access to home dir +@@ -228,17 +244,21 @@ type_member $2 user_home_dir_t:dir user_home_dir_t; # full control of the home directory @@ -30390,7 +30339,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file }) files_list_home($2) -@@ -250,25 +266,23 @@ +@@ -246,25 +266,23 @@ allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms }; tunable_policy(`use_nfs_home_dirs',` @@ -30420,7 +30369,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ') -@@ -303,6 +317,45 @@ +@@ -289,6 +307,8 @@ + type user_tmp_t; + ') + ++ role $1 types user_tmp_t; ++ + files_poly_member_tmp($2, user_tmp_t) + + manage_dirs_pattern($2, user_tmp_t, user_tmp_t) +@@ -297,6 +317,45 @@ manage_sock_files_pattern($2, user_tmp_t, user_tmp_t) manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t) files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file }) @@ -30466,7 +30424,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ####################################### -@@ -322,6 +375,7 @@ +@@ -316,6 +375,7 @@ ') exec_files_pattern($1, user_tmp_t, user_tmp_t) @@ -30474,7 +30432,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo files_search_tmp($1) ') -@@ -368,46 +422,41 @@ +@@ -350,6 +410,8 @@ + type user_tmpfs_t; + ') + ++ role $1 types user_tmpfs_t; ++ + manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t) + manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t) + manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t) +@@ -360,46 +422,41 @@ ####################################### ## @@ -30496,12 +30463,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo - gen_require(` - type $1_t; - ') -+interface(`userdom_basic_networking',` - +- - allow $1_t self:tcp_socket create_stream_socket_perms; - allow $1_t self:udp_socket create_socket_perms; -+ allow $1 self:tcp_socket create_stream_socket_perms; -+ allow $1 self:udp_socket create_socket_perms; ++interface(`userdom_basic_networking',` - corenet_all_recvfrom_unlabeled($1_t) - corenet_all_recvfrom_netlabel($1_t) @@ -30513,7 +30478,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo - corenet_udp_sendrecv_all_ports($1_t) - corenet_tcp_connect_all_ports($1_t) - corenet_sendrecv_all_client_packets($1_t) -- ++ allow $1 self:tcp_socket create_stream_socket_perms; ++ allow $1 self:udp_socket create_socket_perms; + - corenet_all_recvfrom_labeled($1_t, $1_t) + corenet_all_recvfrom_unlabeled($1) + corenet_all_recvfrom_netlabel($1) @@ -30541,7 +30508,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ####################################### -@@ -438,6 +487,7 @@ +@@ -430,6 +487,7 @@ dev_dontaudit_rw_dri($1_t) # GNOME checks for usb and other devices: dev_rw_usbfs($1_t) @@ -30549,7 +30516,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo xserver_user_x_domain_template($1, $1_t, user_tmpfs_t) xserver_xsession_entry_type($1_t) -@@ -498,7 +548,7 @@ +@@ -490,7 +548,7 @@ attribute unpriv_userdomain; ') @@ -30558,7 +30525,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ############################## # -@@ -508,73 +558,78 @@ +@@ -500,73 +558,78 @@ # evolution and gnome-session try to create a netlink socket dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown }; dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write }; @@ -30579,27 +30546,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + kernel_get_sysvipc_info($1_usertype) # Find CDROM devices: - kernel_read_device_sysctls($1_t) -- -- corecmd_exec_bin($1_t) + kernel_read_device_sysctls($1_usertype) + kernel_request_load_module($1_usertype) -- corenet_udp_bind_generic_node($1_t) -- corenet_udp_bind_generic_port($1_t) +- corecmd_exec_bin($1_t) + corenet_udp_bind_generic_node($1_usertype) + corenet_udp_bind_generic_port($1_usertype) -- dev_read_rand($1_t) -- dev_write_sound($1_t) -- dev_read_sound($1_t) -- dev_read_sound_mixer($1_t) -- dev_write_sound_mixer($1_t) +- corenet_udp_bind_generic_node($1_t) +- corenet_udp_bind_generic_port($1_t) + dev_read_rand($1_usertype) + dev_write_sound($1_usertype) + dev_read_sound($1_usertype) + dev_read_sound_mixer($1_usertype) + dev_write_sound_mixer($1_usertype) +- dev_read_rand($1_t) +- dev_write_sound($1_t) +- dev_read_sound($1_t) +- dev_read_sound_mixer($1_t) +- dev_write_sound_mixer($1_t) +- - files_exec_etc_files($1_t) - files_search_locks($1_t) + files_exec_etc_files($1_usertype) @@ -30677,7 +30644,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') tunable_policy(`user_ttyfile_stat',` -@@ -582,65 +637,108 @@ +@@ -574,65 +637,108 @@ ') optional_policy(` @@ -30713,40 +30680,40 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + optional_policy(` + policykit_dbus_chat($1_usertype) + ') -+ -+ optional_policy(` -+ bluetooth_dbus_chat($1_usertype) -+ ') optional_policy(` - bluetooth_dbus_chat($1_t) -+ consolekit_dbus_chat($1_usertype) -+ consolekit_read_log($1_usertype) ++ bluetooth_dbus_chat($1_usertype) ') optional_policy(` - evolution_dbus_chat($1_t) - evolution_alarm_dbus_chat($1_t) -+ devicekit_dbus_chat($1_usertype) -+ devicekit_dbus_chat_power($1_usertype) -+ devicekit_dbus_chat_disk($1_usertype) ++ consolekit_dbus_chat($1_usertype) ++ consolekit_read_log($1_usertype) ') optional_policy(` - cups_dbus_chat_config($1_t) -+ evolution_dbus_chat($1_usertype) -+ evolution_alarm_dbus_chat($1_usertype) ++ devicekit_dbus_chat($1_usertype) ++ devicekit_dbus_chat_power($1_usertype) ++ devicekit_dbus_chat_disk($1_usertype) ') optional_policy(` - hal_dbus_chat($1_t) -+ gnome_dbus_chat_gconfdefault($1_usertype) ++ evolution_dbus_chat($1_usertype) ++ evolution_alarm_dbus_chat($1_usertype) ') optional_policy(` - networkmanager_dbus_chat($1_t) ++ gnome_dbus_chat_gconfdefault($1_usertype) ++ ') ++ ++ optional_policy(` + hal_dbus_chat($1_usertype) - ') ++ ') + + optional_policy(` + modemmanager_dbus_chat($1_usertype) @@ -30759,31 +30726,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + + optional_policy(` + vpn_dbus_chat($1_usertype) -+ ') -+ ') -+ -+ optional_policy(` -+ git_session_role($1_r, $1_usertype) + ') ') optional_policy(` - inetd_use_fds($1_t) - inetd_rw_tcp_sockets($1_t) -+ inetd_use_fds($1_usertype) -+ inetd_rw_tcp_sockets($1_usertype) ++ git_session_role($1_r, $1_usertype) ') optional_policy(` - inn_read_config($1_t) - inn_read_news_lib($1_t) - inn_read_news_spool($1_t) -+ inn_read_config($1_usertype) -+ inn_read_news_lib($1_usertype) -+ inn_read_news_spool($1_usertype) ++ inetd_use_fds($1_usertype) ++ inetd_rw_tcp_sockets($1_usertype) ') optional_policy(` - locate_read_lib_files($1_t) ++ inn_read_config($1_usertype) ++ inn_read_news_lib($1_usertype) ++ inn_read_news_spool($1_usertype) ++ ') ++ ++ optional_policy(` + locate_read_lib_files($1_usertype) ') @@ -30791,20 +30758,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo optional_policy(` - modutils_read_module_config($1_t) + modutils_read_module_config($1_usertype) ++ ') ++ ++ optional_policy(` ++ mta_rw_spool($1_usertype) ++ mta_manage_queue($1_usertype) ') optional_policy(` - mta_rw_spool($1_t) -+ mta_rw_spool($1_usertype) -+ mta_manage_queue($1_usertype) -+ ') -+ -+ optional_policy(` + nsplugin_role($1_r, $1_usertype) ') optional_policy(` -@@ -651,41 +749,50 @@ +@@ -643,41 +749,50 @@ optional_policy(` # to allow monitoring of pcmcia status @@ -30866,7 +30833,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ####################################### -@@ -713,13 +820,26 @@ +@@ -705,13 +820,26 @@ userdom_base_user_template($1) @@ -30875,12 +30842,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + + userdom_manage_tmp_role($1_r, $1_usertype) + userdom_manage_tmpfs_role($1_r, $1_usertype) -+ -+ ifelse(`$1',`unconfined',`',` -+ gen_tunable(allow_$1_exec_content, true) - userdom_manage_tmp_role($1_r, $1_t) - userdom_manage_tmpfs_role($1_r, $1_t) ++ ifelse(`$1',`unconfined',`',` ++ gen_tunable(allow_$1_exec_content, true) ++ + tunable_policy(`allow_$1_exec_content',` + userdom_exec_user_tmp_files($1_usertype) + userdom_exec_user_home_content_files($1_usertype) @@ -30898,7 +30865,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo userdom_change_password_template($1) -@@ -737,72 +857,74 @@ +@@ -729,72 +857,74 @@ allow $1_t self:context contains; @@ -30966,10 +30933,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo - miscfiles_exec_tetex_data($1_t) + miscfiles_read_tetex_data($1_usertype) + miscfiles_exec_tetex_data($1_usertype) ++ ++ seutil_read_config($1_usertype) - seutil_read_config($1_t) -+ seutil_read_config($1_usertype) -+ + optional_policy(` + cups_read_config($1_usertype) + cups_stream_connect($1_usertype) @@ -31008,7 +30975,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ') -@@ -834,12 +956,35 @@ +@@ -826,12 +956,35 @@ typeattribute $1_t unpriv_userdomain; domain_interactive_fd($1_t) @@ -31044,7 +31011,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo loadkeys_run($1_t,$1_r) ') ') -@@ -875,45 +1020,83 @@ +@@ -867,45 +1020,83 @@ # auth_role($1_r, $1_t) @@ -31115,14 +31082,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo - ') + optional_policy(` + openoffice_role_template($1, $1_r, $1_usertype) -+ ') -+ -+ optional_policy(` -+ policykit_role($1_r, $1_usertype) ') optional_policy(` - java_role($1_r, $1_t) ++ policykit_role($1_r, $1_usertype) ++ ') ++ ++ optional_policy(` + pulseaudio_role($1_r, $1_usertype) + ') + @@ -31143,7 +31110,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ') -@@ -948,7 +1131,7 @@ +@@ -940,7 +1131,7 @@ # # Inherit rules for ordinary users. @@ -31152,7 +31119,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo userdom_common_user_template($1) ############################## -@@ -957,54 +1140,77 @@ +@@ -949,54 +1140,77 @@ # # port access is audited even if dac would not have allowed it, so dontaudit it here @@ -31241,26 +31208,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + + optional_policy(` + mount_run_fusermount($1_t, $1_r) -+ ') -+ -+ optional_policy(` -+ wine_role_template($1, $1_r, $1_t) ') - # Run pppd in pppd_t by default for user optional_policy(` - ppp_run_cond($1_t,$1_r) -+ postfix_run_postdrop($1_t, $1_r) ++ wine_role_template($1, $1_r, $1_t) ') -+ # Run pppd in pppd_t by default for user optional_policy(` - setroubleshoot_stream_connect($1_t) ++ postfix_run_postdrop($1_t, $1_r) ++ ') ++ ++ # Run pppd in pppd_t by default for user ++ optional_policy(` + ppp_run_cond($1_t, $1_r) ') ') -@@ -1040,7 +1246,7 @@ +@@ -1032,7 +1246,7 @@ template(`userdom_admin_user_template',` gen_require(` attribute admindomain; @@ -31269,7 +31236,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ############################## -@@ -1075,6 +1281,9 @@ +@@ -1067,6 +1281,9 @@ # Skip authentication when pam_rootok is specified. allow $1_t self:passwd rootok; @@ -31279,7 +31246,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo kernel_read_software_raid_state($1_t) kernel_getattr_core_if($1_t) kernel_getattr_message_if($1_t) -@@ -1089,6 +1298,7 @@ +@@ -1081,6 +1298,7 @@ kernel_sigstop_unlabeled($1_t) kernel_signull_unlabeled($1_t) kernel_sigchld_unlabeled($1_t) @@ -31287,7 +31254,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo corenet_tcp_bind_generic_port($1_t) # allow setting up tunnels -@@ -1120,10 +1330,13 @@ +@@ -1112,10 +1330,13 @@ domain_sigchld_all_domains($1_t) # for lsof domain_getattr_all_sockets($1_t) @@ -31301,7 +31268,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo fs_set_all_quotas($1_t) fs_exec_noxattr($1_t) -@@ -1143,6 +1356,7 @@ +@@ -1135,6 +1356,7 @@ logging_send_syslog_msg($1_t) modutils_domtrans_insmod($1_t) @@ -31309,7 +31276,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo # The following rule is temporary until such time that a complete # policy management infrastructure is in place so that an administrator -@@ -1211,6 +1425,8 @@ +@@ -1203,6 +1425,8 @@ dev_relabel_all_dev_nodes($1) files_create_boot_flag($1) @@ -31318,7 +31285,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo # Necessary for managing /boot/efi fs_manage_dos_files($1) -@@ -1238,6 +1454,7 @@ +@@ -1230,6 +1454,7 @@ seutil_run_checkpolicy($1,$2) seutil_run_loadpolicy($1,$2) seutil_run_semanage($1,$2) @@ -31326,7 +31293,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo seutil_run_setfiles($1, $2) optional_policy(` -@@ -1276,11 +1493,15 @@ +@@ -1268,12 +1493,15 @@ interface(`userdom_user_home_content',` gen_require(` type user_home_t; @@ -31335,6 +31302,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 user_home_t:filesystem associate; files_type($1) +- files_poly_member($1) ubac_constrained($1) + + files_poly_member($1) @@ -31342,7 +31310,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1391,6 +1612,7 @@ +@@ -1384,6 +1612,7 @@ ') allow $1 user_home_dir_t:dir search_dir_perms; @@ -31350,7 +31318,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo files_search_home($1) ') -@@ -1437,6 +1659,14 @@ +@@ -1430,6 +1659,14 @@ allow $1 user_home_dir_t:dir list_dir_perms; files_search_home($1) @@ -31365,7 +31333,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1452,9 +1682,11 @@ +@@ -1445,9 +1682,11 @@ interface(`userdom_dontaudit_list_user_home_dirs',` gen_require(` type user_home_dir_t; @@ -31377,7 +31345,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1511,6 +1743,42 @@ +@@ -1504,6 +1743,42 @@ allow $1 user_home_dir_t:dir relabelto; ') @@ -31420,7 +31388,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ######################################## ## ## Create directories in the home dir root with -@@ -1585,6 +1853,8 @@ +@@ -1578,6 +1853,8 @@ ') dontaudit $1 user_home_t:dir search_dir_perms; @@ -31429,7 +31397,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1599,10 +1869,12 @@ +@@ -1592,10 +1869,12 @@ # interface(`userdom_list_user_home_content',` gen_require(` @@ -31444,68 +31412,87 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1645,6 +1917,25 @@ +@@ -1638,26 +1917,27 @@ ######################################## ## +-## Do not audit attempts to set the +-## attributes of user home files. +## Set the attributes of user home files. -+## -+## -+## -+## Domain allowed access. -+## -+## + ## + ## + ## + ## Domain allowed access. + ## + ## +## -+# + # +-interface(`userdom_dontaudit_setattr_user_home_content_files',` +interface(`userdom_setattr_user_home_content_files',` -+ gen_require(` -+ type user_home_t; -+ ') -+ -+ allow $1 user_home_t:file setattr; -+') -+ -+######################################## -+## - ## Do not audit attempts to set the - ## attributes of user home files. - ## -@@ -1696,13 +1987,14 @@ - type user_home_dir_t, user_home_t; + gen_require(` + type user_home_t; ') -+ list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t }) - read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t) - files_search_home($1) +- dontaudit $1 user_home_t:file setattr_file_perms; ++ allow $1 user_home_t:file setattr; ') ######################################## ## --## Do not audit attempts to read user home files. -+## Do not audit attempts to getattr user home files. +-## Mmap user home files. ++## Do not audit attempts to set the ++## attributes of user home files. ## ## ## -@@ -1710,13 +2002,35 @@ +@@ -1665,13 +1945,31 @@ ## ## # --interface(`userdom_dontaudit_read_user_home_content_files',` -+interface(`userdom_dontaudit_getattr_user_home_content',` +-interface(`userdom_mmap_user_home_content_files',` ++interface(`userdom_dontaudit_setattr_user_home_content_files',` gen_require(` -- type user_home_t; -+ attribute user_home_type; +- type user_home_dir_t, user_home_t; ++ type user_home_t; ') -- dontaudit $1 user_home_t:dir list_dir_perms; -- dontaudit $1 user_home_t:file read_file_perms; -+ dontaudit $1 user_home_type:dir getattr; -+ dontaudit $1 user_home_type:file getattr; +- mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t) +- files_search_home($1) ++ dontaudit $1 user_home_t:file setattr_file_perms; +') + +######################################## +## -+## Do not audit attempts to read user home files. ++## Mmap user home files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`userdom_mmap_user_home_content_files',` ++ gen_require(` ++ type user_home_dir_t, user_home_t; ++ ') ++ ++ mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t) ++ files_search_home($1) + ') + + ######################################## +@@ -1689,12 +1987,32 @@ + type user_home_dir_t, user_home_t; + ') + ++ list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t }) + read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t) + files_search_home($1) + ') + + ######################################## + ## ++## Do not audit attempts to getattr user home files. +## +## +## @@ -31513,12 +31500,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo +## +## +# -+interface(`userdom_dontaudit_read_user_home_content_files',` ++interface(`userdom_dontaudit_getattr_user_home_content',` + gen_require(` + attribute user_home_type; -+ type user_home_dir_t; + ') + ++ dontaudit $1 user_home_type:dir getattr; ++ dontaudit $1 user_home_type:file getattr; ++') ++ ++######################################## ++## + ## Do not audit attempts to read user home files. + ## + ## +@@ -1705,11 +2023,14 @@ + # + interface(`userdom_dontaudit_read_user_home_content_files',` + gen_require(` +- type user_home_t; ++ attribute user_home_type; ++ type user_home_dir_t; + ') + +- dontaudit $1 user_home_t:dir list_dir_perms; +- dontaudit $1 user_home_t:file read_file_perms; + dontaudit $1 user_home_dir_t:dir list_dir_perms; + dontaudit $1 user_home_type:dir list_dir_perms; + dontaudit $1 user_home_type:file read_file_perms; @@ -31526,7 +31532,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1806,8 +2120,7 @@ +@@ -1799,8 +2120,7 @@ type user_home_dir_t, user_home_t; ') @@ -31536,7 +31542,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1823,20 +2136,14 @@ +@@ -1816,20 +2136,14 @@ # interface(`userdom_exec_user_home_content_files',` gen_require(` @@ -31561,7 +31567,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ######################################## ## -@@ -2178,7 +2485,7 @@ +@@ -2171,7 +2485,7 @@ type user_tmp_t; ') @@ -31570,7 +31576,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -2431,13 +2738,14 @@ +@@ -2424,13 +2738,14 @@ ') read_files_pattern($1, user_tmpfs_t, user_tmpfs_t) @@ -31586,7 +31592,34 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ## ## ## -@@ -2791,7 +3099,7 @@ +@@ -2451,26 +2766,6 @@ + + ######################################## + ## +-## Create, read, write, and delete user tmpfs files. +-## +-## +-## +-## Domain allowed access. +-## +-## +-# +-interface(`userdom_manage_user_tmpfs_files',` +- gen_require(` +- type user_tmpfs_t; +- ') +- +- manage_files_pattern($1, user_tmpfs_t, user_tmpfs_t) +- allow $1 user_tmpfs_t:dir list_dir_perms; +- fs_search_tmpfs($1) +-') +- +-######################################## +-## + ## Get the attributes of a user domain tty. + ## + ## +@@ -2804,7 +3099,7 @@ domain_entry_file_spec_domtrans($1, unpriv_userdomain) allow unpriv_userdomain $1:fd use; @@ -31595,7 +31628,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow unpriv_userdomain $1:process sigchld; ') -@@ -2807,11 +3115,13 @@ +@@ -2820,11 +3115,13 @@ # interface(`userdom_search_user_home_content',` gen_require(` @@ -31611,7 +31644,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -2948,7 +3258,45 @@ +@@ -2961,7 +3258,45 @@ type user_tmp_t; ') @@ -31658,7 +31691,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -2985,6 +3333,7 @@ +@@ -2998,6 +3333,7 @@ ') read_files_pattern($1, userdomain, userdomain) @@ -31666,7 +31699,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo kernel_search_proc($1) ') -@@ -3115,3 +3464,779 @@ +@@ -3128,3 +3464,779 @@ allow $1 userdomain:dbus send_msg; ') @@ -32446,9 +32479,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + + dontaudit $1 user_tmp_t:dir search_dir_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.8.6/policy/modules/system/userdomain.te ---- nsaserefpolicy/policy/modules/system/userdomain.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/userdomain.te 2010-07-12 11:38:28.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.8.7/policy/modules/system/userdomain.te +--- nsaserefpolicy/policy/modules/system/userdomain.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/userdomain.te 2010-07-14 14:08:02.000000000 -0400 @@ -43,6 +43,13 @@ ## @@ -32479,7 +32512,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo type user_home_dir_t alias { staff_home_dir_t sysadm_home_dir_t secadm_home_dir_t auditadm_home_dir_t unconfined_home_dir_t }; fs_associate_tmpfs(user_home_dir_t) files_type(user_home_dir_t) -@@ -71,6 +87,7 @@ +@@ -71,18 +87,21 @@ type user_home_t alias { staff_home_t sysadm_home_t secadm_home_t auditadm_home_t unconfined_home_t }; typealias user_home_t alias { staff_untrusted_content_t sysadm_untrusted_content_t secadm_untrusted_content_t auditadm_untrusted_content_t unconfined_untrusted_content_t }; @@ -32487,7 +32520,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo userdom_user_home_content(user_home_t) fs_associate_tmpfs(user_home_t) files_associate_tmp(user_home_t) -@@ -84,7 +101,7 @@ ++files_poly_member(user_home_t) + files_poly_parent(user_home_t) + files_mountpoint(user_home_t) ++ubac_constrained(user_home_t) + + type user_devpts_t alias { staff_devpts_t sysadm_devpts_t secadm_devpts_t auditadm_devpts_t unconfined_devpts_t }; + dev_node(user_devpts_t) files_type(user_devpts_t) ubac_constrained(user_devpts_t) @@ -32496,7 +32535,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo typealias user_tmp_t alias { staff_untrusted_content_tmp_t sysadm_untrusted_content_tmp_t secadm_untrusted_content_tmp_t auditadm_untrusted_content_tmp_t unconfined_untrusted_content_tmp_t }; files_tmp_file(user_tmp_t) userdom_user_home_content(user_tmp_t) -@@ -96,3 +113,24 @@ +@@ -94,3 +113,24 @@ type user_tty_device_t alias { staff_tty_device_t sysadm_tty_device_t secadm_tty_device_t auditadm_tty_device_t unconfined_tty_device_t }; dev_node(user_tty_device_t) ubac_constrained(user_tty_device_t) @@ -32521,9 +32560,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + +# Nautilus causes this avc +dontaudit unpriv_userdomain self:dir setattr; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc serefpolicy-3.8.6/policy/modules/system/xen.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc serefpolicy-3.8.7/policy/modules/system/xen.fc --- nsaserefpolicy/policy/modules/system/xen.fc 2009-11-25 11:47:19.000000000 -0500 -+++ serefpolicy-3.8.6/policy/modules/system/xen.fc 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/xen.fc 2010-07-14 14:08:02.000000000 -0400 @@ -1,7 +1,5 @@ /dev/xen/tapctrl.* -p gen_context(system_u:object_r:xenctl_t,s0) @@ -32532,9 +32571,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc /usr/sbin/evtchnd -- gen_context(system_u:object_r:evtchnd_exec_t,s0) ifdef(`distro_debian',` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.8.6/policy/modules/system/xen.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.8.7/policy/modules/system/xen.if --- nsaserefpolicy/policy/modules/system/xen.if 2010-03-23 10:55:15.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/xen.if 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/xen.if 2010-07-14 14:08:02.000000000 -0400 @@ -87,6 +87,26 @@ ## ## @@ -32573,9 +32612,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if domtrans_pattern($1, xm_exec_t, xm_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.8.6/policy/modules/system/xen.te ---- nsaserefpolicy/policy/modules/system/xen.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.6/policy/modules/system/xen.te 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.8.7/policy/modules/system/xen.te +--- nsaserefpolicy/policy/modules/system/xen.te 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/modules/system/xen.te 2010-07-14 14:08:02.000000000 -0400 @@ -4,6 +4,7 @@ # # Declarations @@ -32612,7 +32651,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te fs_manage_xenfs_files(xenstored_t) storage_raw_read_fixed_disk(xenstored_t) -@@ -366,98 +364,9 @@ +@@ -353,6 +351,7 @@ + storage_raw_read_removable_device(xenstored_t) + + term_use_generic_ptys(xenstored_t) ++term_use_console(xenconsoled_t) + + init_use_fds(xenstored_t) + init_use_script_ptys(xenstored_t) +@@ -365,98 +364,9 @@ ######################################## # @@ -32711,9 +32758,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te #Should have a boolean wrapping these fs_list_auto_mountpoints(xend_t) files_search_mnt(xend_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-3.8.6/policy/support/misc_patterns.spt +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-3.8.7/policy/support/misc_patterns.spt --- nsaserefpolicy/policy/support/misc_patterns.spt 2010-05-25 16:28:22.000000000 -0400 -+++ serefpolicy-3.8.6/policy/support/misc_patterns.spt 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/support/misc_patterns.spt 2010-07-14 14:08:02.000000000 -0400 @@ -15,7 +15,7 @@ domain_transition_pattern($1,$2,$3) @@ -32737,9 +32784,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns ') # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.8.6/policy/support/obj_perm_sets.spt ---- nsaserefpolicy/policy/support/obj_perm_sets.spt 2010-03-04 11:44:07.000000000 -0500 -+++ serefpolicy-3.8.6/policy/support/obj_perm_sets.spt 2010-07-12 09:05:35.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.8.7/policy/support/obj_perm_sets.spt +--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/policy/support/obj_perm_sets.spt 2010-07-14 14:08:02.000000000 -0400 @@ -28,7 +28,7 @@ # # All socket classes. @@ -32849,9 +32896,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets +define(`all_dbus_perms', `{ acquire_svc send_msg } ') +define(`all_passwd_perms', `{ passwd chfn chsh rootok crontab } ') +define(`all_association_perms', `{ sendto recvfrom setcontext polmatch } ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.8.6/policy/users +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.8.7/policy/users --- nsaserefpolicy/policy/users 2009-12-18 11:38:25.000000000 -0500 -+++ serefpolicy-3.8.6/policy/users 2010-07-12 09:05:35.000000000 -0400 ++++ serefpolicy-3.8.7/policy/users 2010-07-14 14:08:02.000000000 -0400 @@ -15,7 +15,7 @@ # and a user process should never be assigned the system user # identity. @@ -32885,3 +32932,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.8 - gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) -') +gen_user(root, user, unconfined_r sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.8.7/support/Makefile.devel +--- nsaserefpolicy/support/Makefile.devel 2010-07-14 11:21:53.000000000 -0400 ++++ serefpolicy-3.8.7/support/Makefile.devel 2010-07-14 14:08:02.000000000 -0400 +@@ -68,8 +68,8 @@ + + # default MLS/MCS sensitivity and category settings. + MLS_SENS ?= 16 +-MLS_CATS ?= 1024 +-MCS_CATS ?= 1024 ++MLS_CATS ?= 256 ++MCS_CATS ?= 256 + + ifeq ($(QUIET),y) + verbose := @ diff --git a/selinux-policy.spec b/selinux-policy.spec index 8e2b7ff..88b63ff 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,8 +19,8 @@ %define CHECKPOLICYVER 2.0.21-1 Summary: SELinux policy configuration Name: selinux-policy -Version: 3.8.6 -Release: 3%{?dist} +Version: 3.8.7 +Release: 1%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -331,7 +331,7 @@ if [ $1 -eq 1 ]; then %loadpolicy targeted $packages restorecon -R /root /var/log /var/run /var/lib 2> /dev/null else - semodule -n -s targeted -r moilscanner -r mailscanner -r gamin -r audio_entropy -r iscsid -r polkit_auth -r polkit -r rtkit_daemon -r ModemManager 2>/dev/null + semodule -n -s targeted -r moilscanner mailscanner gamin audio_entropy iscsid polkit_auth polkit rtkit_daemon ModemManager telepathysofiasip ethereal 2>/dev/null %loadpolicy targeted $packages %relabel targeted fi @@ -450,7 +450,7 @@ SELinux Reference policy mls base module. %saveFileContext mls %post mls -semodule -n -s mls -r mailscanner -r polkit -r ModemManager 2>/dev/null +semodule -n -s mls -r mailscanner polkit ModemManager telepathysofiasip ethereal 2>/dev/null packages=`cat /usr/share/selinux/mls/modules.lst` %loadpolicy mls $packages @@ -469,6 +469,9 @@ exit 0 %endif %changelog +* Mon Jul 14 2010 Dan Walsh 3.8.7-1 +- Update to upstream + * Mon Jul 12 2010 Dan Walsh 3.8.6-3 - Add boolean to turn off port forwarding in sshd. diff --git a/sources b/sources index 3b6d800..92b8b05 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ 4c7d323036f1662a06a7a4f2a7da57a5 config.tgz -5fa7e359d8016e05ebb27e9b4ec74584 serefpolicy-3.8.6.tgz +d50240e814f78bdcb7c4e49829f0b18d serefpolicy-3.8.7.tgz