diff --git a/refpolicy/policy/modules/admin/netutils.te b/refpolicy/policy/modules/admin/netutils.te
index b6ce0ea..50e55de 100644
--- a/refpolicy/policy/modules/admin/netutils.te
+++ b/refpolicy/policy/modules/admin/netutils.te
@@ -147,10 +147,8 @@ optional_policy(`pcmcia.te',`
pcmcia_use_cardmgr_fd(ping_t)
')
-optional_policy(`sysnetwork.te',`
- optional_policy(`hotplug.te',`
- hotplug_use_fd(ping_t)
- ')
+optional_policy(`hotplug.te',`
+ hotplug_use_fd(ping_t)
')
ifdef(`TODO',`
diff --git a/refpolicy/policy/modules/kernel/kernel.if b/refpolicy/policy/modules/kernel/kernel.if
index 39193e7..06b32a1 100644
--- a/refpolicy/policy/modules/kernel/kernel.if
+++ b/refpolicy/policy/modules/kernel/kernel.if
@@ -1396,7 +1396,7 @@ interface(`kernel_relabel_unlabeled',`
#
interface(`kernel_unconfined',`
gen_require(`
- type kernel_t, unlabeled_t;
+ type kernel_t, unlabeled_t, sysctl_t;
attribute proc_type, sysctl_type;
attribute kern_unconfined;
attribute can_load_kernmodule, can_receive_kernel_messages;
diff --git a/refpolicy/policy/modules/kernel/storage.if b/refpolicy/policy/modules/kernel/storage.if
index 63a82db..5062aac 100644
--- a/refpolicy/policy/modules/kernel/storage.if
+++ b/refpolicy/policy/modules/kernel/storage.if
@@ -76,25 +76,6 @@ interface(`storage_dontaudit_setattr_fixed_disk',`
########################################
##
-## Do not audit attempts made by the caller to read
-## fixed disk device nodes.
-##
-##
-## The type of the process to not audit.
-##
-#
-interface(`storage_dontaudit_read_fixed_disk',`
- gen_require(`
- type removable_device_t;
- class blk_file { getattr ioctl read };
-
- ')
-
- dontaudit $1 fixed_disk_device_t:blk_file { getattr ioctl read };
-')
-
-########################################
-##
## Allow the caller to directly read from a fixed disk.
## This is extremly dangerous as it can bypass the
## SELinux protections for filesystem objects, and
@@ -118,6 +99,24 @@ interface(`storage_raw_read_fixed_disk',`
########################################
##
+## Do not audit attempts made by the caller to read
+## fixed disk device nodes.
+##
+##
+## The type of the process to not audit.
+##
+#
+interface(`storage_dontaudit_read_fixed_disk',`
+ gen_require(`
+ type fixed_disk_device_t;
+
+ ')
+
+ dontaudit $1 fixed_disk_device_t:blk_file { getattr ioctl read };
+')
+
+########################################
+##
## Allow the caller to directly write to a fixed disk.
## This is extremly dangerous as it can bypass the
## SELinux protections for filesystem objects, and
diff --git a/refpolicy/policy/modules/services/cron.te b/refpolicy/policy/modules/services/cron.te
index 214eb03..dc4f7ba 100644
--- a/refpolicy/policy/modules/services/cron.te
+++ b/refpolicy/policy/modules/services/cron.te
@@ -1,6 +1,10 @@
policy_module(cron, 1.0)
+gen_require(`
+ class passwd rootok;
+')
+
########################################
#
# Declarations
diff --git a/refpolicy/policy/modules/services/nscd.if b/refpolicy/policy/modules/services/nscd.if
index 26740c9..aa0b51d 100644
--- a/refpolicy/policy/modules/services/nscd.if
+++ b/refpolicy/policy/modules/services/nscd.if
@@ -34,6 +34,7 @@ interface(`nscd_domtrans',`
interface(`nscd_use_socket',`
gen_require(`
type nscd_t, nscd_var_run_t;
+ class nscd { getpwd getgrp gethost shmempwd shmemgrp shmemhost };
')
allow $1 self:unix_stream_socket create_socket_perms;
@@ -61,6 +62,7 @@ interface(`nscd_use_socket',`
interface(`nscd_use_shared_mem',`
gen_require(`
type nscd_t, nscd_var_run_t;
+ class nscd { getpwd getgrp gethost shmempwd shmemgrp shmemhost };
')
allow $1 nscd_var_run_t:dir r_dir_perms;
diff --git a/refpolicy/policy/modules/services/postgresql.te b/refpolicy/policy/modules/services/postgresql.te
index 40823d6..66a5b7c 100644
--- a/refpolicy/policy/modules/services/postgresql.te
+++ b/refpolicy/policy/modules/services/postgresql.te
@@ -175,10 +175,6 @@ optional_policy(`nis.te',`
nis_use_ypbind(postgresql_t)
')
-optional_policy(`rhgb.te',`
- rhgb_domain(postgresql_t)
-')
-
optional_policy(`selinuxutil.te',`
seutil_sigchld_newrole(postgresql_t)
')
@@ -188,6 +184,9 @@ optional_policy(`udev.te', `
')
ifdef(`TODO',`
+optional_policy(`rhgb.te',`
+ rhgb_domain(postgresql_t)
+')
ifdef(`targeted_policy', `', `
bool allow_user_postgresql_connect false;
diff --git a/refpolicy/policy/modules/services/samba.te b/refpolicy/policy/modules/services/samba.te
index b73bd1d..7aabe1c 100644
--- a/refpolicy/policy/modules/services/samba.te
+++ b/refpolicy/policy/modules/services/samba.te
@@ -16,8 +16,8 @@ files_pid_file(nmbd_var_run_t)
type samba_etc_t; #, usercanread;
files_type(samba_etc_t)
-type samba_log_t, logfile;
-files_type(samba_log_t)
+type samba_log_t;
+logging_log_file(samba_log_t)
type samba_net_t;
domain_type(samba_net_t)
diff --git a/refpolicy/policy/modules/services/ssh.if b/refpolicy/policy/modules/services/ssh.if
index ca7b37e..d7287e8 100644
--- a/refpolicy/policy/modules/services/ssh.if
+++ b/refpolicy/policy/modules/services/ssh.if
@@ -480,22 +480,24 @@ template(`ssh_server_template', `
fs_read_cifs_files($1_t)
')
- optional_policy(`inetd.te',`
- tunable_policy(`run_ssh_inetd',`
- allow $1_t self:process signal;
- files_list_pids($1_t)
- ',`
- corenet_tcp_bind_ssh_port($1_t)
- init_use_fd($1_t)
- init_use_script_pty($1_t)
- ')
- ',`
+ # cjp: commenting out until typeattribute works in conditional
+ # and require block in optional else is resolved
+ #optional_policy(`inetd.te',`
+ # tunable_policy(`run_ssh_inetd',`
+ # allow $1_t self:process signal;
+ # files_list_pids($1_t)
+ # ',`
+ # corenet_tcp_bind_ssh_port($1_t)
+ # init_use_fd($1_t)
+ # init_use_script_pty($1_t)
+ # ')
+ #',`
# These rules should match the else block
# of the run_ssh_inetd tunable directly above
corenet_tcp_bind_ssh_port($1_t)
init_use_fd($1_t)
init_use_script_pty($1_t)
- ')
+ #')
optional_policy(`kerberos.te',`
kerberos_use($1_t)
diff --git a/refpolicy/policy/modules/system/init.if b/refpolicy/policy/modules/system/init.if
index f4d943d..f1f0d9f 100644
--- a/refpolicy/policy/modules/system/init.if
+++ b/refpolicy/policy/modules/system/init.if
@@ -592,11 +592,10 @@ interface(`init_dontaudit_use_script_pty',`
#
interface(`init_rw_script_tmp_files',`
gen_require(`
- type initrc_var_run_t;
- class file rw_file_perms;
+ type initrc_tmp_t;
')
- # FIXME: read tmp_t dir
+ files_search_tmp($1)
allow $1 initrc_tmp_t:file rw_file_perms;
')
diff --git a/refpolicy/policy/modules/system/sysnetwork.te b/refpolicy/policy/modules/system/sysnetwork.te
index 9ea6f3f..4790442 100644
--- a/refpolicy/policy/modules/system/sysnetwork.te
+++ b/refpolicy/policy/modules/system/sysnetwork.te
@@ -140,7 +140,7 @@ miscfiles_read_localization(dhcpc_t)
modutils_domtrans_insmod(dhcpc_t)
-userdom_dontaudit_search_staff_home_dir(sysadm_t)
+userdom_dontaudit_search_staff_home_dir(dhcpc_t)
ifdef(`distro_redhat', `
files_exec_etc_files(dhcpc_t)
diff --git a/refpolicy/policy/support/loadable_module.spt b/refpolicy/policy/support/loadable_module.spt
index 244acc0..d5e6194 100644
--- a/refpolicy/policy/support/loadable_module.spt
+++ b/refpolicy/policy/support/loadable_module.spt
@@ -106,31 +106,31 @@ define(`dflt_or_overr',`ifdef(`$1',$1,$2)')
##############################
#
+# Extract booleans out of an expression.
+# This needs to be reworked so expressions
+# with parentheses can work.
+
+define(`delcare_required_symbols',`
+ifelse(regexp($1, `\w'), -1, `', `dnl
+bool regexp($1, `\(\w+\)', `\1');
+delcare_required_symbols(regexp($1, `\w+\(.*\)', `\1'))dnl
+') dnl
+')
+
+##############################
+#
# Tunable declaration
#
define(`gen_tunable',`
- ifdef(`in_gen_require_block',`
- ifdef(`self_contained_policy',`
- bool $1;
- ',`
- # loadable module tunable
- # require will go here
- # instead of bool when
- # loadable modules support
- # tunables
- bool $1;
- ')
+ ifdef(`self_contained_policy',`
+ bool $1 dflt_or_overr(`$1'_conf,$2);
',`
- ifdef(`self_contained_policy',`
- bool $1 dflt_or_overr(`$1'_conf,$2);
- ',`
- # loadable module tunable
- # declaration will go here
- # instead of bool when
- # loadable modules support
- # tunables
- bool $1 dflt_or_overr(`$1'_conf,$2);
- ')
+ # loadable module tunable
+ # declaration will go here
+ # instead of bool when
+ # loadable modules support
+ # tunables
+ bool $1 dflt_or_overr(`$1'_conf,$2);
')
')
@@ -150,6 +150,10 @@ define(`tunable_policy',`
# will go here instead of a
# conditional when loadable
# modules support tunables
+ gen_require(`
+ delcare_required_symbols(`$1')
+ ')
+
if (`$1') {
$2
} else {