++
++policy_module(exim, 1.0.0)
+
+########################################
+#
@@ -6149,14 +6052,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim
+
+type exim_t;
+type exim_exec_t;
-+domain_type(exim_t)
-+init_daemon_domain(exim_t, exim_exec_t)
++mta_mailserver(exim_t, exim_exec_t)
++mta_mailserver_user_agent(exim_t)
++mta_mailclient(exim_exec_t)
+
+type exim_script_exec_t;
+init_script_type(exim_script_exec_t)
+
-+type exim_tmp_t;
-+files_tmp_file(exim_tmp_t)
++type exim_spool_t;
++files_type(exim_spool_t)
+
+type exim_var_run_t;
+files_pid_file(exim_var_run_t)
@@ -6164,78 +6068,151 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim
+type exim_log_t;
+logging_log_file(exim_log_t)
+
-+type exim_spool_t;
-+files_type(exim_spool_t)
++########################################
++#
++# exim booleans
++#
++
++##
++##
++## Allow exim to connect to databases (postgres, mysql)
++##
++##
++gen_tunable(exim_can_connect_db, false)
++
++##
++##
++## Allow exim to read files in users homedirectories
++##
++##
++gen_tunable(exim_read_user_files, false)
++
++##
++##
++## Allow exim to manage files in users homedirectories
++##
++##
++gen_tunable(exim_manage_user_files, false)
+
+########################################
+#
+# exim local policy
+#
+
-+allow exim_t self:capability { dac_override dac_read_search setuid setgid };
-+
-+## internal communication is often done using fifo and unix sockets.
++allow exim_t self:capability { sys_resource dac_override dac_read_search setuid setgid fowner chown };
++allow exim_t self:process { setrlimit setpgid };
+allow exim_t self:fifo_file rw_file_perms;
++allow exim_t self:tcp_socket create_stream_socket_perms;
++allow exim_t self:udp_socket create_socket_perms;
+allow exim_t self:unix_stream_socket create_stream_socket_perms;
+
-+allow exim_t exim_tmp_t:file manage_file_perms;
-+allow exim_t exim_tmp_t:dir create_dir_perms;
-+files_tmp_filetrans(exim_t,exim_tmp_t, { file dir })
++corenet_all_recvfrom_unlabeled(exim_t)
++corenet_all_recvfrom_netlabel(exim_t)
++corenet_udp_sendrecv_all_if(exim_t)
++corenet_udp_sendrecv_all_nodes(exim_t)
++corenet_tcp_sendrecv_all_if(exim_t)
++corenet_tcp_sendrecv_all_nodes(exim_t)
++corenet_tcp_bind_all_nodes(exim_t)
++corenet_tcp_bind_amavisd_send_port(exim_t)
++corenet_tcp_bind_smtp_port(exim_t)
++corenet_tcp_connect_smtp_port(exim_t)
++corenet_tcp_sendrecv_smtp_port(exim_t)
++corenet_sendrecv_smtp_server_packets(exim_t)
++corenet_sendrecv_all_client_packets(exim_t)
+
-+allow exim_t exim_var_run_t:file manage_file_perms;
-+allow exim_t exim_var_run_t:dir manage_dir_perms;
-+files_pid_filetrans(exim_t,exim_var_run_t, { file dir })
++# make identd connections
++corenet_tcp_connect_auth_port(exim_t)
++corenet_tcp_sendrecv_auth_port(exim_t)
+
-+allow exim_t exim_log_t:file manage_file_perms;
-+allow exim_t exim_log_t:dir { rw_dir_perms setattr };
-+logging_log_filetrans(exim_t,exim_log_t,{ file dir })
++# connect to spamassassin
++corenet_tcp_connect_spamd_port(exim_t)
++corenet_tcp_sendrecv_spamd_port(exim_t)
+
-+allow exim_t exim_spool_t:dir manage_dir_perms;
-+allow exim_t exim_spool_t:file manage_file_perms;
-+allow exim_t exim_spool_t:sock_file create_file_perms;
-+files_spool_filetrans(exim_t,exim_spool_t, { file dir sock_file })
++libs_use_ld_so(exim_t)
++libs_read_lib_files(exim_t)
++libs_exec_lib_files(exim_t)
++libs_use_shared_libs(exim_t)
++libs_legacy_use_shared_libs(exim_t)
++
++# PID files
++manage_files_pattern(exim_t, exim_var_run_t, exim_var_run_t)
++files_pid_filetrans(exim_t, exim_var_run_t, file)
+
+auth_use_nsswitch(exim_t)
+
-+can_exec(exim_t,exim_exec_t)
++# Exim uses BerkeleyDB, which checks /var/tmp but doesn't actually use it
++files_dontaudit_getattr_tmp_dirs(exim_t)
++files_search_usr(exim_t)
++files_search_var(exim_t)
++files_read_etc_files(exim_t)
++
++kernel_read_kernel_sysctls(exim_t)
++kernel_dontaudit_read_system_state(exim_t)
++
++miscfiles_read_localization(exim_t)
++miscfiles_read_certs(exim_t)
++
++mta_read_aliases(exim_t)
++mta_read_config(exim_t)
++mta_rw_spool(exim_t)
++mta_mailserver_delivery(exim_t)
+
+# Init script handling
+domain_use_interactive_fds(exim_t)
+
-+files_read_etc_files(exim_t)
++can_exec(exim_t,exim_exec_t)
+
-+sysnet_dns_name_resolve(exim_t)
-+corenet_all_recvfrom_unlabeled(exim_t)
++exim_create_spool(exim_t)
++exim_manage_spool(exim_t)
++allow exim_t exim_spool_t:sock_file create_file_perms;
++files_spool_filetrans(exim_t,exim_spool_t, { file dir sock_file })
+
-+allow exim_t self:tcp_socket create_stream_socket_perms;
-+corenet_tcp_sendrecv_all_if(exim_t)
-+corenet_tcp_sendrecv_all_nodes(exim_t)
-+corenet_tcp_sendrecv_all_ports(exim_t)
-+corenet_tcp_bind_all_nodes(exim_t)
-+corenet_tcp_bind_smtp_port(exim_t)
-+corenet_tcp_bind_amavisd_send_port(exim_t)
-+corenet_tcp_connect_auth_port(exim_t)
-+corenet_tcp_connect_inetd_child_port(exim_t)
++## logging
++logging_send_syslog_msg(exim_t)
++exim_manage_logs(exim_t)
++logging_log_filetrans(exim_t, exim_log_t, { file dir })
+
+corecmd_search_bin(exim_t)
+
-+libs_use_ld_so(exim_t)
-+libs_use_shared_libs(exim_t)
-+logging_send_syslog_msg(exim_t)
++# TLS sessions need entropy
++dev_read_urand(exim_t)
++dev_read_rand(exim_t)
+
-+miscfiles_read_localization(exim_t)
++tunable_policy(`exim_can_connect_db',`
++ corenet_tcp_connect_mysqld_port(exim_t)
++ corenet_sendrecv_mysqld_client_packets(exim_t)
++ corenet_tcp_connect_postgresql_port(exim_t)
++ corenet_sendrecv_postgresql_client_packets(exim_t)
++')
+
-+kernel_read_kernel_sysctls(exim_t)
++optional_policy(`
++ tunable_policy(`exim_can_connect_db',`
++ mysql_stream_connect(exim_t)
++ ')
++')
+
-+mta_mailclient(exim_exec_t)
-+mta_read_aliases(exim_t)
-+mta_rw_spool(exim_t)
++optional_policy(`
++ tunable_policy(`exim_can_connect_db',`
++ postgresql_stream_connect(exim_t)
++ ')
++')
++
++optional_policy(`
++ mailman_read_data_files(exim_t)
++ mailman_domtrans(exim_t)
++')
++
++optional_policy(`
++ procmail_domtrans(exim_t)
++')
+
-+userdom_dontaudit_search_sysadm_home_dirs(exim_t)
-+userdom_dontaudit_search_generic_user_home_dirs(exim_t)
++optional_policy(`
++ sasl_connect(exim_t)
++')
+
-+bool exim_read_user_files false;
-+bool exim_manage_user_files false;
++optional_policy(`
++ cyrus_stream_connect(exim_t)
++')
+
+if (exim_read_user_files) {
+ userdom_read_unpriv_users_home_content_files(exim_t)
@@ -6248,6 +6225,45 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim
+ userdom_write_unpriv_users_tmp_files(exim_t)
+}
+
++## receipt & validation
++
++optional_policy(`
++ clamav_domtrans_clamscan(exim_t)
++ clamav_stream_connect(exim_t)
++')
++
++optional_policy(`
++ spamassassin_exec(exim_t)
++ spamassassin_exec_client(exim_t)
++')
++
++# courier authdaemon; authdaemon doesn't have a type for its UNIX domain
++# socket, nor a public interface for it yet.
++ifdef(`TODO', `
++optional_policy(`
++ gen_require(`
++ type courier_var_run_t;
++ ')
++ files_search_pids(exim_t)
++ stream_connect_pattern(exim_t, courier_var_run_t, courier_var_run_t)
++')
++')
++
++# Debian uses a template based config generator which generates config
++# files under /var
++ifdef(`distro_debian',`
++ type exim_lib_t;
++ files_config_file(exim_lib_t)
++ exim_read_lib(exim_t)
++
++ type exim_lib_update_t;
++ type exim_lib_update_exec_t;
++ init_domain(exim_lib_update_t, exim_lib_update_exec_t)
++ domain_entry_file(exim_lib_update_t, exim_lib_update_exec_t)
++ mta_read_lib(exim_lib_update_t)
++ exim_manage_var_lib(exim_lib_update_t)
++')
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.if serefpolicy-3.0.8/policy/modules/services/ftp.if
--- nsaserefpolicy/policy/modules/services/ftp.if 2007-05-29 14:10:57.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/services/ftp.if 2007-09-24 15:42:55.000000000 -0400
@@ -6272,7 +6288,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
########################################
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.8/policy/modules/services/ftp.te
--- nsaserefpolicy/policy/modules/services/ftp.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/ftp.te 2007-09-24 15:47:19.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/ftp.te 2007-09-27 15:13:40.000000000 -0400
@@ -88,6 +88,7 @@
allow ftpd_t self:unix_stream_socket create_stream_socket_perms;
allow ftpd_t self:tcp_socket create_stream_socket_perms;
@@ -6281,7 +6297,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
allow ftpd_t ftpd_etc_t:file read_file_perms;
-@@ -157,6 +158,7 @@
+@@ -122,6 +123,7 @@
+
+ kernel_read_kernel_sysctls(ftpd_t)
+ kernel_read_system_state(ftpd_t)
++kernel_search_network_state(ftpd_t)
+
+ dev_read_sysfs(ftpd_t)
+ dev_read_urand(ftpd_t)
+@@ -157,6 +159,7 @@
auth_use_nsswitch(ftpd_t)
auth_domtrans_chk_passwd(ftpd_t)
@@ -6289,7 +6313,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
# Append to /var/log/wtmp.
auth_append_login_records(ftpd_t)
#kerberized ftp requires the following
-@@ -168,7 +170,9 @@
+@@ -168,7 +171,9 @@
libs_use_ld_so(ftpd_t)
libs_use_shared_libs(ftpd_t)
@@ -6299,7 +6323,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
miscfiles_read_localization(ftpd_t)
miscfiles_read_public_files(ftpd_t)
-@@ -217,6 +221,11 @@
+@@ -217,6 +222,11 @@
userdom_manage_all_users_home_content_dirs(ftpd_t)
userdom_manage_all_users_home_content_files(ftpd_t)
userdom_manage_all_users_home_content_symlinks(ftpd_t)
@@ -6311,7 +6335,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
')
tunable_policy(`ftp_home_dir && use_nfs_home_dirs',`
-@@ -252,7 +261,10 @@
+@@ -252,7 +262,10 @@
')
optional_policy(`
@@ -6922,7 +6946,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq
+/etc/rc\.d/init\.d/mysqld -- gen_context(system_u:object_r:mysqld_script_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.if serefpolicy-3.0.8/policy/modules/services/mysql.if
--- nsaserefpolicy/policy/modules/services/mysql.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/mysql.if 2007-09-17 16:20:18.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/mysql.if 2007-09-28 14:29:45.000000000 -0400
@@ -157,3 +157,79 @@
logging_search_logs($1)
allow $1 mysqld_log_t:file { write append setattr ioctl };
@@ -6979,29 +7003,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq
+ type mysqld_script_exec_t;
+ ')
+
-+ allow $1 mysqld_t:process { ptrace signal_perms getattr };
++ allow $2 mysqld_t:process { ptrace signal_perms getattr };
+ read_files_pattern($1, mysqld_t, mysqld_t)
+
-+ # Allow $1 to restart the apache service
-+ mysql_script_domtrans($1)
-+ domain_system_change_exemption($1)
++ # Allow $2 to restart the apache service
++ mysql_script_domtrans($2)
++ domain_system_change_exemption($2)
+ role_transition $2 mysqld_script_exec_t system_r;
-+ allow $2 system_r;
++ allow $3 system_r;
+
-+ manage_dirs_pattern($1,mysqld_var_run_t,mysqld_var_run_t)
-+ manage_files_pattern($1,mysqld_var_run_t,mysqld_var_run_t)
++ manage_dirs_pattern($2,mysqld_var_run_t,mysqld_var_run_t)
++ manage_files_pattern($2,mysqld_var_run_t,mysqld_var_run_t)
+
-+ manage_dirs_pattern($1,mysqld_db_t,mysqld_db_t)
-+ manage_files_pattern($1,mysqld_db_t,mysqld_db_t)
++ manage_dirs_pattern($2,mysqld_db_t,mysqld_db_t)
++ manage_files_pattern($2,mysqld_db_t,mysqld_db_t)
+
-+ manage_dirs_pattern($1,mysqld_etc_t,mysqld_etc_t)
-+ manage_files_pattern($1,mysqld_etc_t,mysqld_etc_t)
++ manage_dirs_pattern($2,mysqld_etc_t,mysqld_etc_t)
++ manage_files_pattern($2,mysqld_etc_t,mysqld_etc_t)
+
-+ manage_dirs_pattern($1,mysqld_log_t,mysqld_log_t)
-+ manage_files_pattern($1,mysqld_log_t,mysqld_log_t)
++ manage_dirs_pattern($2,mysqld_log_t,mysqld_log_t)
++ manage_files_pattern($2,mysqld_log_t,mysqld_log_t)
+
-+ manage_dirs_pattern($1,mysqld_tmp_t,mysqld_tmp_t)
-+ manage_files_pattern($1,mysqld_tmp_t,mysqld_tmp_t)
++ manage_dirs_pattern($2,mysqld_tmp_t,mysqld_tmp_t)
++ manage_files_pattern($2,mysqld_tmp_t,mysqld_tmp_t)
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.0.8/policy/modules/services/mysql.te
--- nsaserefpolicy/policy/modules/services/mysql.te 2007-07-25 10:37:42.000000000 -0400
@@ -7995,7 +8019,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+/etc/rc\.d/init\.d/postgresql -- gen_context(system_u:object_r:postgresql_script_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.0.8/policy/modules/services/postgresql.if
--- nsaserefpolicy/policy/modules/services/postgresql.if 2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/postgresql.if 2007-09-17 16:20:18.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/postgresql.if 2007-09-28 14:30:18.000000000 -0400
@@ -113,3 +113,77 @@
# Some versions of postgresql put the sock file in /tmp
allow $1 postgresql_tmp_t:sock_file write;
@@ -8050,29 +8074,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
+ type postgresql_log_t;
+ ')
+
-+ allow $1 postgresql_t:process { ptrace signal_perms getattr };
-+ read_files_pattern($1, postgresql_t, postgresql_t)
++ allow $2 postgresql_t:process { ptrace signal_perms getattr };
++ read_files_pattern($2, postgresql_t, postgresql_t)
+
-+ # Allow $1 to restart the apache service
-+ postgresql_script_domtrans($1)
-+ domain_system_change_exemption($1)
++ # Allow $2 to restart the apache service
++ postgresql_script_domtrans($2)
++ domain_system_change_exemption($2)
+ role_transition $2 postgresql_script_exec_t system_r;
-+ allow $2 system_r;
++ allow $3 system_r;
+
-+ manage_dirs_pattern($1,postgresql_var_run_t,postgresql_var_run_t)
-+ manage_files_pattern($1,postgresql_var_run_t,postgresql_var_run_t)
++ manage_dirs_pattern($2,postgresql_var_run_t,postgresql_var_run_t)
++ manage_files_pattern($2,postgresql_var_run_t,postgresql_var_run_t)
+
-+ manage_dirs_pattern($1,postgresql_db_t,postgresql_db_t)
-+ manage_files_pattern($1,postgresql_db_t,postgresql_db_t)
++ manage_dirs_pattern($2,postgresql_db_t,postgresql_db_t)
++ manage_files_pattern($2,postgresql_db_t,postgresql_db_t)
+
-+ manage_dirs_pattern($1,postgresql_etc_t,postgresql_etc_t)
-+ manage_files_pattern($1,postgresql_etc_t,postgresql_etc_t)
++ manage_dirs_pattern($2,postgresql_etc_t,postgresql_etc_t)
++ manage_files_pattern($2,postgresql_etc_t,postgresql_etc_t)
+
-+ manage_dirs_pattern($1,postgresql_log_t,postgresql_log_t)
-+ manage_files_pattern($1,postgresql_log_t,postgresql_log_t)
++ manage_dirs_pattern($2,postgresql_log_t,postgresql_log_t)
++ manage_files_pattern($2,postgresql_log_t,postgresql_log_t)
+
-+ manage_dirs_pattern($1,postgresql_tmp_t,postgresql_tmp_t)
-+ manage_files_pattern($1,postgresql_tmp_t,postgresql_tmp_t)
++ manage_dirs_pattern($2,postgresql_tmp_t,postgresql_tmp_t)
++ manage_files_pattern($2,postgresql_tmp_t,postgresql_tmp_t)
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.0.8/policy/modules/services/postgresql.te
--- nsaserefpolicy/policy/modules/services/postgresql.te 2007-07-25 10:37:42.000000000 -0400
@@ -9347,7 +9371,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.8/policy/modules/services/setroubleshoot.te
--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-09-12 10:34:50.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/setroubleshoot.te 2007-09-26 11:12:03.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/setroubleshoot.te 2007-09-26 17:41:34.000000000 -0400
@@ -67,6 +67,7 @@
corenet_sendrecv_smtp_client_packets(setroubleshootd_t)
@@ -10562,7 +10586,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.8/policy/modules/system/authlogin.if
--- nsaserefpolicy/policy/modules/system/authlogin.if 2007-08-22 07:14:13.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2007-09-25 10:59:20.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2007-09-27 15:46:41.000000000 -0400
@@ -26,7 +26,8 @@
type $1_chkpwd_t, can_read_shadow_passwords;
application_domain($1_chkpwd_t,chkpwd_exec_t)
@@ -10594,7 +10618,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
domain_type($1)
domain_subj_id_change_exemption($1)
-@@ -176,11 +178,28 @@
+@@ -176,11 +178,32 @@
domain_obj_id_change_exemption($1)
role system_r types $1;
@@ -10616,6 +10640,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
# for SSP/ProPolice
dev_read_urand($1)
++ # for fingerprint readers
++ dev_rw_input_dev($1)
++ dev_rw_generic_usb_dev($1)
++
files_read_etc_files($1)
+ fs_list_auto_mountpoints($1)
@@ -10623,7 +10651,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
selinux_get_fs_mount($1)
selinux_validate_context($1)
selinux_compute_access_vector($1)
-@@ -196,22 +215,33 @@
+@@ -196,22 +219,33 @@
mls_fd_share_all_levels($1)
auth_domtrans_chk_passwd($1)
@@ -10658,7 +10686,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
')
')
-@@ -309,9 +339,6 @@
+@@ -309,9 +343,6 @@
type system_chkpwd_t, chkpwd_exec_t, shadow_t;
')
@@ -10668,7 +10696,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
corecmd_search_bin($1)
domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t)
-@@ -329,6 +356,8 @@
+@@ -329,6 +360,8 @@
optional_policy(`
kerberos_use($1)
@@ -10677,7 +10705,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
')
optional_policy(`
-@@ -347,6 +376,37 @@
+@@ -347,6 +380,37 @@
########################################
##
@@ -10715,7 +10743,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
## Get the attributes of the shadow passwords file.
##
##
-@@ -695,6 +755,24 @@
+@@ -695,6 +759,24 @@
########################################
##
@@ -10740,7 +10768,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
## Execute pam programs in the PAM domain.
##
##
-@@ -1318,14 +1396,9 @@
+@@ -1318,14 +1400,9 @@
##
#
interface(`auth_use_nsswitch',`
@@ -10755,7 +10783,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
files_list_var_lib($1)
miscfiles_read_certs($1)
-@@ -1347,6 +1420,8 @@
+@@ -1347,6 +1424,8 @@
optional_policy(`
samba_stream_connect_winbind($1)
@@ -10764,7 +10792,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
')
')
-@@ -1381,3 +1456,163 @@
+@@ -1381,3 +1460,163 @@
typeattribute $1 can_write_shadow_passwords;
typeattribute $1 can_relabelto_shadow_passwords;
')
@@ -11628,7 +11656,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.8/policy/modules/system/ipsec.te
--- nsaserefpolicy/policy/modules/system/ipsec.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/ipsec.te 2007-09-24 10:16:55.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/ipsec.te 2007-09-27 11:30:18.000000000 -0400
@@ -56,7 +56,6 @@
allow ipsec_t self:capability { net_admin dac_override dac_read_search };
dontaudit ipsec_t self:capability sys_tty_config;
@@ -11676,7 +11704,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
# manage pid file
manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t)
-@@ -299,6 +294,8 @@
+@@ -299,11 +294,15 @@
allow racoon_t ipsec_spd_t:association setcontext;
@@ -11685,6 +11713,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
kernel_read_network_state(racoon_t)
corenet_all_recvfrom_unlabeled(racoon_t)
+ corenet_tcp_bind_all_nodes(racoon_t)
+ corenet_udp_bind_isakmp_port(racoon_t)
++corenet_udp_bind_all_nodes(racoon_t)
++corenet_udp_sendrecv_all_if(racoon_t)
+
+ dev_read_urand(racoon_t)
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.8/policy/modules/system/iptables.te
--- nsaserefpolicy/policy/modules/system/iptables.te 2007-09-12 10:34:51.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/iptables.te 2007-09-17 16:20:18.000000000 -0400
@@ -11924,7 +11959,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+/etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_script_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.8/policy/modules/system/logging.if
--- nsaserefpolicy/policy/modules/system/logging.if 2007-09-12 10:34:51.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/logging.if 2007-09-20 15:21:10.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/logging.if 2007-09-28 14:33:08.000000000 -0400
@@ -33,8 +33,27 @@
##
#
@@ -12018,16 +12053,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
## Create an object in the log directory, with a private
## type using a type transition.
##
-@@ -470,7 +546,7 @@
+@@ -465,12 +541,11 @@
+ interface(`logging_read_all_logs',`
+ gen_require(`
+ attribute logfile;
+- type var_log_t;
+ ')
files_search_var($1)
- allow $1 var_log_t:dir list_dir_perms;
+- allow $1 var_log_t:dir list_dir_perms;
- read_files_pattern($1,var_log_t,logfile)
++ allow $1 logfile:dir list_dir_perms;
+ read_files_pattern($1,logfile, logfile)
')
########################################
-@@ -514,6 +590,8 @@
+@@ -514,6 +589,8 @@
files_search_var($1)
manage_files_pattern($1,logfile,logfile)
read_lnk_files_pattern($1,logfile,logfile)
@@ -12036,7 +12077,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
')
########################################
-@@ -597,3 +675,258 @@
+@@ -597,3 +674,258 @@
files_search_var($1)
manage_files_pattern($1,var_log_t,var_log_t)
')
@@ -12197,7 +12238,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+##
+##
+#
-+template(`logging_audit_admin',`
++interface(`logging_audit_admin',`
+
+ gen_require(`
+ type auditd_t;
@@ -12249,7 +12290,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+##
+##
+#
-+template(`logging_syslog_admin',`
++interface(`logging_syslog_admin',`
+
+ gen_require(`
+ type syslogd_t;
@@ -12297,7 +12338,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.8/policy/modules/system/logging.te
--- nsaserefpolicy/policy/modules/system/logging.te 2007-09-12 10:34:51.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/logging.te 2007-09-17 16:20:18.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/logging.te 2007-09-27 11:25:28.000000000 -0400
@@ -7,6 +7,10 @@
#
@@ -12377,7 +12418,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
#
-allow auditd_t self:capability { audit_write audit_control fsetid sys_nice sys_resource };
-+allow auditd_t self:capability { fsetid sys_nice sys_resource };
++allow auditd_t self:capability { chown fsetid sys_nice sys_resource };
dontaudit auditd_t self:capability sys_tty_config;
allow auditd_t self:process { signal_perms setpgid setsched };
allow auditd_t self:file { getattr read write };
@@ -12452,7 +12493,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc
/etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.8/policy/modules/system/lvm.te
--- nsaserefpolicy/policy/modules/system/lvm.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/lvm.te 2007-09-24 15:55:39.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/lvm.te 2007-10-01 10:41:59.000000000 -0400
@@ -44,9 +44,9 @@
# Cluster LVM daemon local policy
#
@@ -12543,7 +12584,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
dontaudit lvm_t self:capability sys_tty_config;
allow lvm_t self:process { sigchld sigkill sigstop signull signal };
# LVM will complain a lot if it cannot set its priority.
-@@ -208,7 +218,6 @@
+@@ -160,6 +170,7 @@
+ allow lvm_t self:unix_dgram_socket create_socket_perms;
+ allow lvm_t self:netlink_kobject_uevent_socket create_socket_perms;
+
++allow lvm_t self:unix_stream_socket { connectto create_stream_socket_perms };
+ allow lvm_t clvmd_t:unix_stream_socket connectto;
+
+ manage_dirs_pattern(lvm_t,lvm_tmp_t,lvm_tmp_t)
+@@ -208,7 +219,6 @@
selinux_compute_user_contexts(lvm_t)
dev_create_generic_chr_files(lvm_t)
@@ -12551,7 +12600,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
dev_read_rand(lvm_t)
dev_read_urand(lvm_t)
dev_rw_lvm_control(lvm_t)
-@@ -228,6 +237,8 @@
+@@ -228,6 +238,8 @@
dev_dontaudit_getattr_generic_blk_files(lvm_t)
dev_dontaudit_getattr_generic_pipes(lvm_t)
dev_create_generic_dirs(lvm_t)
@@ -12560,7 +12609,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
fs_getattr_xattr_fs(lvm_t)
fs_search_auto_mountpoints(lvm_t)
-@@ -246,6 +257,7 @@
+@@ -246,6 +258,7 @@
storage_dev_filetrans_fixed_disk(lvm_t)
# Access raw devices and old /dev/lvm (c 109,0). Is this needed?
storage_manage_fixed_disk(lvm_t)
@@ -12568,7 +12617,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
term_getattr_all_user_ttys(lvm_t)
term_list_ptys(lvm_t)
-@@ -254,6 +266,7 @@
+@@ -254,6 +267,7 @@
domain_use_interactive_fds(lvm_t)
@@ -12576,7 +12625,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
files_read_etc_files(lvm_t)
files_read_etc_runtime_files(lvm_t)
# for when /usr is not mounted:
-@@ -275,6 +288,8 @@
+@@ -275,6 +289,8 @@
seutil_search_default_contexts(lvm_t)
seutil_sigchld_newrole(lvm_t)
@@ -12585,7 +12634,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
ifdef(`distro_redhat',`
# this is from the initrd:
files_rw_isid_type_dirs(lvm_t)
-@@ -293,5 +308,14 @@
+@@ -293,5 +309,14 @@
')
optional_policy(`
@@ -12600,6 +12649,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te
+ xen_append_log(lvm_t)
+ xen_dontaudit_rw_unix_stream_sockets(lvm_t)
+')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.0.8/policy/modules/system/miscfiles.if
+--- nsaserefpolicy/policy/modules/system/miscfiles.if 2007-05-29 14:10:58.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/miscfiles.if 2007-09-27 15:33:47.000000000 -0400
+@@ -253,6 +253,8 @@
+ files_search_usr($1)
+
+ allow $1 man_t:dir setattr;
++ # 309351
++ allow $1 man_t:dir list_dir_perms;
+ delete_dirs_pattern($1,man_t,man_t)
+ delete_files_pattern($1,man_t,man_t)
+ delete_lnk_files_pattern($1,man_t,man_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.8/policy/modules/system/modutils.te
--- nsaserefpolicy/policy/modules/system/modutils.te 2007-08-22 07:14:12.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/modutils.te 2007-09-17 16:20:18.000000000 -0400
@@ -13465,7 +13526,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.8/policy/modules/system/sysnetwork.te
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.te 2007-09-17 16:20:18.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.te 2007-09-28 09:01:32.000000000 -0400
@@ -45,7 +45,7 @@
dontaudit dhcpc_t self:capability sys_tty_config;
# for access("/etc/bashrc", X_OK) on Red Hat
@@ -13494,7 +13555,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
optional_policy(`
networkmanager_dbus_chat(dhcpc_t)
')
-@@ -203,9 +208,7 @@
+@@ -177,6 +182,7 @@
+ ')
+ ')
+
++
+ # for the dhcp client to run ping to check IP addresses
+ optional_policy(`
+ netutils_domtrans_ping(dhcpc_t)
+@@ -203,9 +209,7 @@
')
optional_policy(`
@@ -13505,7 +13574,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
')
optional_policy(`
-@@ -216,6 +219,7 @@
+@@ -216,6 +220,7 @@
optional_policy(`
seutil_sigchld_newrole(dhcpc_t)
seutil_dontaudit_search_config(dhcpc_t)
@@ -13513,7 +13582,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
')
optional_policy(`
-@@ -254,6 +258,7 @@
+@@ -254,6 +259,7 @@
allow ifconfig_t self:sem create_sem_perms;
allow ifconfig_t self:msgq create_msgq_perms;
allow ifconfig_t self:msg { send receive };
@@ -13521,7 +13590,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
# Create UDP sockets, necessary when called from dhcpc
allow ifconfig_t self:udp_socket create_socket_perms;
-@@ -280,6 +285,8 @@
+@@ -280,6 +286,8 @@
fs_getattr_xattr_fs(ifconfig_t)
fs_search_auto_mountpoints(ifconfig_t)
@@ -13530,6 +13599,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
term_dontaudit_use_all_user_ttys(ifconfig_t)
term_dontaudit_use_all_user_ptys(ifconfig_t)
+@@ -332,3 +340,7 @@
+ xen_append_log(ifconfig_t)
+ xen_dontaudit_rw_unix_stream_sockets(ifconfig_t)
+ ')
++
++optional_policy(`
++ unconfined_dontaudit_rw_pipes(ifconfig_t)
++')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.8/policy/modules/system/udev.te
--- nsaserefpolicy/policy/modules/system/udev.te 2007-09-12 10:34:51.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/udev.te 2007-09-25 15:03:25.000000000 -0400
@@ -13556,7 +13633,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
+/usr/bin/sbcl -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.8/policy/modules/system/unconfined.if
--- nsaserefpolicy/policy/modules/system/unconfined.if 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/unconfined.if 2007-09-24 15:31:00.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/unconfined.if 2007-09-28 09:00:54.000000000 -0400
@@ -12,14 +12,13 @@
#
interface(`unconfined_domain_noaudit',`
diff --git a/selinux-policy.spec b/selinux-policy.spec
index d9380c9..e13a886 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.0.8
-Release: 14%{?dist}
+Release: 15%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -298,13 +298,13 @@ fi
exit 0
-%triggerpostun targeted -- selinux-policy-targeted < 3.0.4-1
+%triggerpostun targeted -- selinux-policy-targeted < 3.0.8-14-1
setsebool -P use_nfs_home_dirs=1
-restorecon -R /root /etc/selinux/targeted 2> /dev/null
semanage login -m -s "system_u" __default__ 2> /dev/null
semanage user -a -P unconfined -R "unconfined_r system_r" unconfined_u 2> /dev/null
-semanage user -a -P guest -R guest_r guest_u 2> /dev/null
+semanage user -a -P guest -R guest_r guest_u 2> /dev/null
semanage user -a -P xguest -R xguest_r xguest_u 2> /dev/null
+restorecon -R /root /etc/selinux/targeted 2> /dev/null
exit 0
%files targeted
@@ -365,6 +365,11 @@ exit 0
%endif
%changelog
+* Thu Sep 24 2007 Dan Walsh 3.0.8-15
+- Allow tmpreadper to read man_t
+- Allow racoon to bind to all nodes
+- Fixes for finger print reader
+
* Tue Sep 24 2007 Dan Walsh 3.0.8-14
- Allow xdm to talk to input device (fingerprint reader)
- Allow octave to run as java