diff --git a/booleans-targeted.conf b/booleans-targeted.conf index f2994aa..a701da9 100644 --- a/booleans-targeted.conf +++ b/booleans-targeted.conf @@ -1,14 +1,14 @@ # Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack. # -allow_execmem = true +allow_execmem = false # Allow making a modified private filemapping executable (text relocation). # -allow_execmod = true +allow_execmod = false # Allow making the stack executable via mprotect.Also requires allow_execmem. # -allow_execstack = true +allow_execstack = false # Allow ftpd to read cifs directories. # @@ -66,10 +66,6 @@ fcron_crond = false # ftp_home_dir = false -# Allow ftpd to run directly without inetd -# -ftpd_is_daemon = true - # # allow httpd to connect to mysql/posgresql httpd_can_network_connect_db = false @@ -130,10 +126,6 @@ pppd_can_insmod = false # read_default_t = true -# Allow ssh to run from inetd instead of as a daemon. -# -run_ssh_inetd = false - # Allow samba to export user home directories. # samba_enable_home_dirs = false @@ -142,10 +134,6 @@ samba_enable_home_dirs = false # squid_connect_any = false -# Configure stunnel to be a standalone daemon orinetd service. -# -stunnel_is_daemon = false - # Support NFS home directories # use_nfs_home_dirs = true @@ -158,18 +146,10 @@ use_samba_home_dirs = false # user_ping = true -# Allow gpg executable stack -# -allow_gpg_execstack = false - # allow host key based authentication # allow_ssh_keysign = false -# Allow users to connect to mysql -# -allow_user_mysql_connect = false - # Allow pppd to be run for a regular user # pppd_for_user = false @@ -190,18 +170,10 @@ user_direct_mouse = false # user_dmesg = false -# Allow users to control network interfaces(also needs USERCTL=true) -# -user_net_control = false - # Allow user to r/w files on filesystemsthat do not have extended attributes (FAT, CDROM, FLOPPY) # user_rw_noexattrfile = false -# Allow users to rw usb devices -# -user_rw_usb = false - # Allow users to run TCP servers (bind to ports and accept connection fromthe same domain and outside users) disabling this forces FTP passive modeand may change other protocols. # user_tcp_server = false @@ -226,14 +198,6 @@ allow_polyinstantiation = false # allow_daemons_dump_core = true -# Allow mount command to mounton any directory -# -allow_mounton_anydir = true - -# Allow unlabeled packets to flow -# -allow_unlabeled_packets = true - # Allow samba to act as the domain controller # samba_domain_controller = false @@ -273,4 +237,8 @@ allow_nsplugin_execmem=true # Allow unconfined domain to transition to confined domain # -allow_unconfined_nsplugin_transition=false +allow_unconfined_nsplugin_transition=true + +# Allow unconfined domains mmap low kernel memory +# +allow_unconfined_mmap_low = false diff --git a/policy-20071130.patch b/policy-20071130.patch index 47d05fd..d2e9e4b 100644 --- a/policy-20071130.patch +++ b/policy-20071130.patch @@ -1,6 +1,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Changelog serefpolicy-3.3.1/Changelog --- nsaserefpolicy/Changelog 2008-02-19 17:24:26.000000000 -0500 -+++ serefpolicy-3.3.1/Changelog 2008-04-21 11:02:47.835809000 -0400 ++++ serefpolicy-3.3.1/Changelog 2008-04-21 11:02:47.000000000 -0400 @@ -1,6 +1,3 @@ -- Pam and samba updates from Stefan Schulze Frielinghaus. -- Backup update on Debian from Vaclav Ovsik. @@ -10,7 +10,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Changelog serefpolicy-3.3.1/ - Labeled networking peer object class updates. diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.3.1/Makefile --- nsaserefpolicy/Makefile 2008-02-06 10:33:22.000000000 -0500 -+++ serefpolicy-3.3.1/Makefile 2008-04-21 11:02:47.842805000 -0400 ++++ serefpolicy-3.3.1/Makefile 2008-04-21 11:02:47.000000000 -0400 @@ -235,7 +235,7 @@ appdir := $(contextpath) user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts) @@ -66,7 +66,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.3.1/M $(verbose) $(INSTALL) -m 644 $< $@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.3.1/Rules.modular --- nsaserefpolicy/Rules.modular 2007-12-19 05:32:18.000000000 -0500 -+++ serefpolicy-3.3.1/Rules.modular 2008-04-21 11:02:47.848797000 -0400 ++++ serefpolicy-3.3.1/Rules.modular 2008-04-21 11:02:47.000000000 -0400 @@ -73,8 +73,8 @@ $(tmpdir)/%.mod: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf %.te @echo "Compliling $(NAME) $(@F) module" @@ -98,7 +98,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3. $(tmpdir)/all_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf $(base_te_files) $(tmpdir)/rolemap.conf diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.monolithic serefpolicy-3.3.1/Rules.monolithic --- nsaserefpolicy/Rules.monolithic 2007-11-20 06:55:20.000000000 -0500 -+++ serefpolicy-3.3.1/Rules.monolithic 2008-04-21 11:02:47.854791000 -0400 ++++ serefpolicy-3.3.1/Rules.monolithic 2008-04-21 11:02:47.000000000 -0400 @@ -96,7 +96,7 @@ # # Load the binary policy @@ -110,13 +110,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.monolithic serefpolicy @touch $(tmpdir)/load diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/failsafe_context serefpolicy-3.3.1/config/appconfig-mcs/failsafe_context --- nsaserefpolicy/config/appconfig-mcs/failsafe_context 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.3.1/config/appconfig-mcs/failsafe_context 2008-04-21 11:02:47.859787000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-mcs/failsafe_context 2008-04-21 11:02:47.000000000 -0400 @@ -1 +1 @@ -sysadm_r:sysadm_t:s0 +system_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/guest_u_default_contexts serefpolicy-3.3.1/config/appconfig-mcs/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/config/appconfig-mcs/guest_u_default_contexts 2008-04-21 11:02:47.871774000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-mcs/guest_u_default_contexts 2008-04-21 11:02:47.000000000 -0400 @@ -0,0 +1,4 @@ +system_r:local_login_t:s0 guest_r:guest_t:s0 +system_r:remote_login_t:s0 guest_r:guest_t:s0 @@ -124,7 +124,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/guest_u +system_r:crond_t:s0 guest_r:guest_crond_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_default_contexts serefpolicy-3.3.1/config/appconfig-mcs/root_default_contexts --- nsaserefpolicy/config/appconfig-mcs/root_default_contexts 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.3.1/config/appconfig-mcs/root_default_contexts 2008-04-21 11:02:47.876769000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-mcs/root_default_contexts 2008-04-21 11:02:47.000000000 -0400 @@ -1,11 +1,7 @@ system_r:crond_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0 system_r:local_login_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 @@ -140,7 +140,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_de +system_r:sshd_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/seusers serefpolicy-3.3.1/config/appconfig-mcs/seusers --- nsaserefpolicy/config/appconfig-mcs/seusers 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.3.1/config/appconfig-mcs/seusers 2008-04-21 11:02:47.881764000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-mcs/seusers 2008-04-21 11:02:47.000000000 -0400 @@ -1,3 +1,3 @@ system_u:system_u:s0-mcs_systemhigh root:root:s0-mcs_systemhigh @@ -148,7 +148,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/seusers +__default__:unconfined_u:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/unconfined_u_default_contexts serefpolicy-3.3.1/config/appconfig-mcs/unconfined_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/unconfined_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/config/appconfig-mcs/unconfined_u_default_contexts 2008-04-21 11:02:47.886759000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-mcs/unconfined_u_default_contexts 2008-04-21 11:02:47.000000000 -0400 @@ -0,0 +1,9 @@ +system_r:crond_t:s0 unconfined_r:unconfined_t:s0 +system_r:initrc_t:s0 unconfined_r:unconfined_t:s0 @@ -161,13 +161,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/unconfi +system_r:xdm_t:s0 unconfined_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/userhelper_context serefpolicy-3.3.1/config/appconfig-mcs/userhelper_context --- nsaserefpolicy/config/appconfig-mcs/userhelper_context 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.3.1/config/appconfig-mcs/userhelper_context 2008-04-21 11:02:47.890755000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-mcs/userhelper_context 2008-04-21 11:02:47.000000000 -0400 @@ -1 +1 @@ -system_u:sysadm_r:sysadm_t:s0 +system_u:system_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/x_contexts serefpolicy-3.3.1/config/appconfig-mcs/x_contexts --- nsaserefpolicy/config/appconfig-mcs/x_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/config/appconfig-mcs/x_contexts 2008-04-21 11:02:47.895752000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-mcs/x_contexts 2008-04-21 11:02:47.000000000 -0400 @@ -0,0 +1,188 @@ +# +# Config file for XSELinux extension @@ -359,7 +359,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/x_conte +event * system_u:object_r:default_xevent_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts serefpolicy-3.3.1/config/appconfig-mcs/xguest_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/config/appconfig-mcs/xguest_u_default_contexts 2008-04-21 11:02:47.899746000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-mcs/xguest_u_default_contexts 2008-04-21 11:02:47.000000000 -0400 @@ -0,0 +1,5 @@ +system_r:local_login_t xguest_r:xguest_t:s0 +system_r:remote_login_t xguest_r:xguest_t:s0 @@ -368,7 +368,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_ +system_r:xdm_t xguest_r:xguest_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/guest_u_default_contexts serefpolicy-3.3.1/config/appconfig-mls/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-mls/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/config/appconfig-mls/guest_u_default_contexts 2008-04-21 11:02:47.903742000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-mls/guest_u_default_contexts 2008-04-21 11:02:47.000000000 -0400 @@ -0,0 +1,4 @@ +system_r:local_login_t:s0 guest_r:guest_t:s0 +system_r:remote_login_t:s0 guest_r:guest_t:s0 @@ -376,7 +376,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/guest_u +system_r:crond_t:s0 guest_r:guest_crond_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/x_contexts serefpolicy-3.3.1/config/appconfig-mls/x_contexts --- nsaserefpolicy/config/appconfig-mls/x_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/config/appconfig-mls/x_contexts 2008-04-21 11:02:47.908737000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-mls/x_contexts 2008-04-21 11:02:47.000000000 -0400 @@ -0,0 +1,188 @@ +# +# Config file for XSELinux extension @@ -568,7 +568,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/x_conte +event * system_u:object_r:default_xevent_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/guest_u_default_contexts serefpolicy-3.3.1/config/appconfig-standard/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-standard/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/config/appconfig-standard/guest_u_default_contexts 2008-04-21 11:02:47.912733000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-standard/guest_u_default_contexts 2008-04-21 11:02:47.000000000 -0400 @@ -0,0 +1,4 @@ +system_r:local_login_t guest_r:guest_t +system_r:remote_login_t guest_r:guest_t @@ -576,7 +576,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/gu +system_r:crond_t guest_r:guest_crond_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/root_default_contexts serefpolicy-3.3.1/config/appconfig-standard/root_default_contexts --- nsaserefpolicy/config/appconfig-standard/root_default_contexts 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.3.1/config/appconfig-standard/root_default_contexts 2008-04-21 11:02:47.916729000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-standard/root_default_contexts 2008-04-21 11:02:47.000000000 -0400 @@ -1,11 +1,7 @@ system_r:crond_t unconfined_r:unconfined_t sysadm_r:sysadm_crond_t staff_r:staff_crond_t user_r:user_crond_t system_r:local_login_t unconfined_r:unconfined_t sysadm_r:sysadm_t staff_r:staff_t user_r:user_t @@ -592,7 +592,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/ro +system_r:sshd_t unconfined_r:unconfined_t sysadm_r:sysadm_t staff_r:staff_t user_r:user_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/x_contexts serefpolicy-3.3.1/config/appconfig-standard/x_contexts --- nsaserefpolicy/config/appconfig-standard/x_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/config/appconfig-standard/x_contexts 2008-04-21 11:02:47.922723000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-standard/x_contexts 2008-04-21 11:02:47.000000000 -0400 @@ -0,0 +1,188 @@ +# +# Config file for XSELinux extension @@ -784,16 +784,30 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/x_ +event * system_u:object_r:default_xevent_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/xguest_u_default_contexts serefpolicy-3.3.1/config/appconfig-standard/xguest_u_default_contexts --- nsaserefpolicy/config/appconfig-standard/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/config/appconfig-standard/xguest_u_default_contexts 2008-04-21 11:02:47.926719000 -0400 ++++ serefpolicy-3.3.1/config/appconfig-standard/xguest_u_default_contexts 2008-04-21 11:02:47.000000000 -0400 @@ -0,0 +1,5 @@ +system_r:local_login_t xguest_r:xguest_t +system_r:remote_login_t xguest_r:xguest_t +system_r:sshd_t xguest_r:xguest_t +system_r:crond_t xguest_r:xguest_crond_t +system_r:xdm_t xguest_r:xguest_t +diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.3.1/man/man8/ftpd_selinux.8 +--- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-10-12 08:56:10.000000000 -0400 ++++ serefpolicy-3.3.1/man/man8/ftpd_selinux.8 2008-04-28 08:39:05.840182000 -0400 +@@ -35,10 +35,6 @@ + directorories, you need to set the ftp_home_dir boolean. + .TP + setsebool -P ftp_home_dir 1 +-.TP +-ftpd can run either as a standalone daemon or as part of the xinetd domain. If you want to run ftpd as a daemon you must set the ftpd_is_daemon boolean. +-.TP +-setsebool -P ftpd_is_daemon 1 + .br + service vsftpd restart + .TP diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/httpd_selinux.8 serefpolicy-3.3.1/man/man8/httpd_selinux.8 --- nsaserefpolicy/man/man8/httpd_selinux.8 2008-02-18 14:30:19.000000000 -0500 -+++ serefpolicy-3.3.1/man/man8/httpd_selinux.8 2008-04-21 11:02:47.931714000 -0400 ++++ serefpolicy-3.3.1/man/man8/httpd_selinux.8 2008-04-21 11:02:47.000000000 -0400 @@ -22,23 +22,19 @@ .EX httpd_sys_content_t @@ -825,7 +839,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/httpd_selinux.8 ser .EE diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.3.1/policy/flask/access_vectors --- nsaserefpolicy/policy/flask/access_vectors 2008-02-15 09:52:54.000000000 -0500 -+++ serefpolicy-3.3.1/policy/flask/access_vectors 2008-04-21 11:02:47.937708000 -0400 ++++ serefpolicy-3.3.1/policy/flask/access_vectors 2008-04-21 11:02:47.000000000 -0400 @@ -407,141 +407,159 @@ # # SE-X Windows stuff @@ -1060,7 +1074,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/security_classes serefpolicy-3.3.1/policy/flask/security_classes --- nsaserefpolicy/policy/flask/security_classes 2008-02-15 09:52:54.000000000 -0500 -+++ serefpolicy-3.3.1/policy/flask/security_classes 2008-04-21 11:02:47.942703000 -0400 ++++ serefpolicy-3.3.1/policy/flask/security_classes 2008-04-21 11:02:47.000000000 -0400 @@ -50,21 +50,19 @@ # passwd/chfn/chsh class passwd # userspace @@ -1108,7 +1122,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/security_classe # FLASK diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.3.1/policy/global_tunables --- nsaserefpolicy/policy/global_tunables 2007-12-12 11:35:28.000000000 -0500 -+++ serefpolicy-3.3.1/policy/global_tunables 2008-04-21 11:02:47.947700000 -0400 ++++ serefpolicy-3.3.1/policy/global_tunables 2008-04-21 11:02:47.000000000 -0400 @@ -34,7 +34,7 @@ ## @@ -1149,7 +1163,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.3.1/policy/mls --- nsaserefpolicy/policy/mls 2008-02-01 09:12:53.000000000 -0500 -+++ serefpolicy-3.3.1/policy/mls 2008-04-21 11:02:47.954692000 -0400 ++++ serefpolicy-3.3.1/policy/mls 2008-04-21 11:02:47.000000000 -0400 @@ -371,78 +371,53 @@ @@ -1431,28 +1445,30 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.3.1 # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.3.1/policy/modules/admin/anaconda.te --- nsaserefpolicy/policy/modules/admin/anaconda.te 2007-01-02 12:57:51.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/anaconda.te 2008-04-21 11:02:47.961686000 -0400 -@@ -31,16 +31,13 @@ ++++ serefpolicy-3.3.1/policy/modules/admin/anaconda.te 2008-04-25 15:25:33.000000000 -0400 +@@ -31,15 +31,14 @@ modutils_domtrans_insmod(anaconda_t) seutil_domtrans_semanage(anaconda_t) +- +-unconfined_domain(anaconda_t) +- +-userdom_generic_user_home_dir_filetrans_generic_user_home_content(anaconda_t,{ dir file lnk_file fifo_file sock_file }) +seutil_domtrans_setsebool(anaconda_t) - unconfined_domain(anaconda_t) - - userdom_generic_user_home_dir_filetrans_generic_user_home_content(anaconda_t,{ dir file lnk_file fifo_file sock_file }) - optional_policy(` - dmesg_domtrans(anaconda_t) --') -- --optional_policy(` - kudzu_domtrans(anaconda_t) ++ unconfined_domain(anaconda_t) ') ++userdom_generic_user_home_dir_filetrans_generic_user_home_content(anaconda_t,{ dir file lnk_file fifo_file sock_file }) ++ + optional_policy(` + kudzu_domtrans(anaconda_t) + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-3.3.1/policy/modules/admin/bootloader.te --- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-12-19 05:32:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/bootloader.te 2008-04-21 11:02:47.966681000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/bootloader.te 2008-04-21 11:02:47.000000000 -0400 @@ -215,3 +215,7 @@ userdom_dontaudit_search_staff_home_dirs(bootloader_t) userdom_dontaudit_search_sysadm_home_dirs(bootloader_t) @@ -1463,7 +1479,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.3.1/policy/modules/admin/consoletype.te --- nsaserefpolicy/policy/modules/admin/consoletype.te 2008-02-18 14:30:19.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/consoletype.te 2008-04-21 11:02:47.971677000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/consoletype.te 2008-04-21 11:02:47.000000000 -0400 @@ -8,9 +8,11 @@ type consoletype_t; @@ -1489,7 +1505,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console init_use_fds(consoletype_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstboot.if serefpolicy-3.3.1/policy/modules/admin/firstboot.if --- nsaserefpolicy/policy/modules/admin/firstboot.if 2007-04-10 12:52:58.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/admin/firstboot.if 2008-04-21 11:02:47.977671000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/firstboot.if 2008-04-21 11:02:47.000000000 -0400 @@ -141,4 +141,6 @@ ') @@ -1499,8 +1515,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstbo ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstboot.te serefpolicy-3.3.1/policy/modules/admin/firstboot.te --- nsaserefpolicy/policy/modules/admin/firstboot.te 2007-12-19 05:32:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/firstboot.te 2008-04-21 11:02:47.984660000 -0400 -@@ -120,6 +120,10 @@ ++++ serefpolicy-3.3.1/policy/modules/admin/firstboot.te 2008-04-25 16:46:46.000000000 -0400 +@@ -35,9 +35,6 @@ + + allow firstboot_t firstboot_etc_t:file { getattr read }; + +-# The big hammer +-unconfined_domain(firstboot_t) +- + kernel_read_system_state(firstboot_t) + kernel_read_kernel_sysctls(firstboot_t) + +@@ -110,6 +107,8 @@ + + optional_policy(` + unconfined_domtrans(firstboot_t) ++ # The big hammer ++ unconfined_domain(firstboot_t) + ') + + optional_policy(` +@@ -120,6 +119,10 @@ usermanage_domtrans_admin_passwd(firstboot_t) ') @@ -1511,7 +1546,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstbo ifdef(`TODO',` allow firstboot_t proc_t:file write; -@@ -132,7 +136,4 @@ +@@ -132,7 +135,4 @@ domain_auto_trans(firstboot_t, userhelper_exec_t, sysadm_userhelper_t) ') @@ -1521,7 +1556,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstbo ') dnl end TODO diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.fc serefpolicy-3.3.1/policy/modules/admin/kismet.fc --- nsaserefpolicy/policy/modules/admin/kismet.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/kismet.fc 2008-04-21 11:02:47.990656000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/kismet.fc 2008-04-21 11:02:47.000000000 -0400 @@ -0,0 +1,5 @@ + +/usr/bin/kismet -- gen_context(system_u:object_r:kismet_exec_t,s0) @@ -1530,7 +1565,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. +/var/log/kismet(/.*)? gen_context(system_u:object_r:kismet_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.if serefpolicy-3.3.1/policy/modules/admin/kismet.if --- nsaserefpolicy/policy/modules/admin/kismet.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/kismet.if 2008-04-21 11:02:47.995652000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/kismet.if 2008-04-21 11:02:47.000000000 -0400 @@ -0,0 +1,275 @@ + +## policy for kismet @@ -1809,7 +1844,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.te serefpolicy-3.3.1/policy/modules/admin/kismet.te --- nsaserefpolicy/policy/modules/admin/kismet.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/kismet.te 2008-04-21 11:02:47.999648000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/kismet.te 2008-04-21 11:02:47.000000000 -0400 @@ -0,0 +1,55 @@ + +policy_module(kismet,1.0.0) @@ -1868,7 +1903,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.3.1/policy/modules/admin/kudzu.te --- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-12-19 05:32:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/kudzu.te 2008-04-21 11:02:48.004640000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/kudzu.te 2008-04-21 11:02:48.000000000 -0400 @@ -21,8 +21,8 @@ # Local policy # @@ -1929,7 +1964,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.3.1/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2008-02-19 17:24:26.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/logrotate.te 2008-04-21 11:02:48.010635000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/logrotate.te 2008-04-21 11:02:48.000000000 -0400 @@ -96,9 +96,11 @@ files_read_etc_files(logrotate_t) files_read_etc_runtime_files(logrotate_t) @@ -1944,7 +1979,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota init_domtrans_script(logrotate_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.3.1/policy/modules/admin/logwatch.te --- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-12-19 05:32:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/logwatch.te 2008-04-21 11:02:48.015633000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/logwatch.te 2008-04-21 11:02:48.000000000 -0400 @@ -59,10 +59,9 @@ files_read_usr_files(logwatch_t) files_search_spool(logwatch_t) @@ -1976,7 +2011,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te serefpolicy-3.3.1/policy/modules/admin/mrtg.te --- nsaserefpolicy/policy/modules/admin/mrtg.te 2007-12-19 05:32:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/mrtg.te 2008-04-21 11:02:48.022622000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/mrtg.te 2008-04-21 11:02:48.000000000 -0400 @@ -78,6 +78,7 @@ dev_read_urand(mrtg_t) @@ -1987,7 +2022,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te files_search_var(mrtg_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.3.1/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2007-12-19 05:32:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/netutils.te 2008-04-21 11:02:48.028618000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/netutils.te 2008-04-21 11:02:48.000000000 -0400 @@ -50,6 +50,7 @@ files_tmp_filetrans(netutils_t, netutils_tmp_t, { file dir }) @@ -2111,7 +2146,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.3.1/policy/modules/admin/prelink.te --- nsaserefpolicy/policy/modules/admin/prelink.te 2007-12-19 05:32:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/prelink.te 2008-04-21 11:02:48.040608000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/prelink.te 2008-04-21 11:02:48.000000000 -0400 @@ -26,7 +26,7 @@ # Local policy # @@ -2171,7 +2206,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.3.1/policy/modules/admin/rpm.fc --- nsaserefpolicy/policy/modules/admin/rpm.fc 2006-11-16 17:15:26.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/rpm.fc 2008-04-21 11:02:48.046602000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/rpm.fc 2008-04-21 11:02:48.000000000 -0400 @@ -11,7 +11,8 @@ /usr/sbin/system-install-packages -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -2202,7 +2237,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc ifdef(`distro_suse', ` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.3.1/policy/modules/admin/rpm.if --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/admin/rpm.if 2008-04-21 11:02:48.052595000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/rpm.if 2008-04-21 11:02:48.000000000 -0400 @@ -152,6 +152,24 @@ ######################################## @@ -2492,7 +2527,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.3.1/policy/modules/admin/rpm.te --- nsaserefpolicy/policy/modules/admin/rpm.te 2007-12-19 05:32:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/rpm.te 2008-04-21 11:02:48.058589000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/rpm.te 2008-04-21 11:02:48.000000000 -0400 @@ -31,6 +31,9 @@ files_type(rpm_var_lib_t) typealias rpm_var_lib_t alias var_lib_rpm_t; @@ -2579,7 +2614,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.3.1/policy/modules/admin/su.if --- nsaserefpolicy/policy/modules/admin/su.if 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/admin/su.if 2008-04-21 11:02:48.064582000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/su.if 2008-04-21 11:02:48.000000000 -0400 @@ -41,15 +41,13 @@ allow $2 $1_su_t:process signal; @@ -2709,7 +2744,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s ####################################### diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.3.1/policy/modules/admin/sudo.if --- nsaserefpolicy/policy/modules/admin/sudo.if 2007-12-04 11:02:51.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/sudo.if 2008-04-21 11:02:48.070575000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/sudo.if 2008-04-21 11:02:48.000000000 -0400 @@ -55,7 +55,7 @@ # @@ -2812,7 +2847,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.3.1/policy/modules/admin/tmpreaper.te --- nsaserefpolicy/policy/modules/admin/tmpreaper.te 2007-10-02 09:54:52.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/admin/tmpreaper.te 2008-04-21 11:02:48.075572000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/tmpreaper.te 2008-04-21 11:02:48.000000000 -0400 @@ -26,8 +26,10 @@ files_read_etc_files(tmpreaper_t) files_read_var_lib_files(tmpreaper_t) @@ -2849,7 +2884,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreap + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.3.1/policy/modules/admin/usermanage.te --- nsaserefpolicy/policy/modules/admin/usermanage.te 2008-02-19 17:24:26.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/usermanage.te 2008-04-21 11:02:48.082563000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/usermanage.te 2008-04-21 11:02:48.000000000 -0400 @@ -97,6 +97,7 @@ # allow checking if a shell is executable @@ -2913,11 +2948,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.3.1/policy/modules/admin/vbetool.te --- nsaserefpolicy/policy/modules/admin/vbetool.te 2007-12-19 05:32:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/vbetool.te 2008-04-21 11:02:48.089558000 -0400 -@@ -23,6 +23,8 @@ ++++ serefpolicy-3.3.1/policy/modules/admin/vbetool.te 2008-04-25 14:02:32.000000000 -0400 +@@ -23,6 +23,9 @@ dev_rwx_zero(vbetool_t) dev_read_sysfs(vbetool_t) ++domain_mmap_low_type(vbetool_t) +domain_mmap_low(vbetool_t) + term_use_unallocated_ttys(vbetool_t) @@ -2925,7 +2961,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool libs_use_ld_so(vbetool_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.3.1/policy/modules/admin/vpn.te --- nsaserefpolicy/policy/modules/admin/vpn.te 2008-02-18 14:30:19.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/admin/vpn.te 2008-04-21 11:02:48.094554000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/vpn.te 2008-04-21 11:02:48.000000000 -0400 @@ -24,7 +24,8 @@ allow vpnc_t self:capability { dac_override net_admin ipc_lock net_raw }; @@ -2938,7 +2974,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te allow vpnc_t self:rawip_socket create_socket_perms; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ethereal.fc serefpolicy-3.3.1/policy/modules/apps/ethereal.fc --- nsaserefpolicy/policy/modules/apps/ethereal.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/ethereal.fc 2008-04-21 11:02:48.100547000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/ethereal.fc 2008-04-21 11:02:48.000000000 -0400 @@ -1,4 +1,4 @@ -HOME_DIR/\.ethereal(/.*)? gen_context(system_u:object_r:ROLE_ethereal_home_t,s0) +HOME_DIR/\.ethereal(/.*)? gen_context(system_u:object_r:user_ethereal_home_t,s0) @@ -2947,7 +2983,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ethereal /usr/sbin/tethereal.* -- gen_context(system_u:object_r:tethereal_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ethereal.if serefpolicy-3.3.1/policy/modules/apps/ethereal.if --- nsaserefpolicy/policy/modules/apps/ethereal.if 2007-07-23 10:20:12.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/ethereal.if 2008-04-21 11:02:48.106540000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/ethereal.if 2008-04-21 11:02:48.000000000 -0400 @@ -35,6 +35,7 @@ template(`ethereal_per_role_template',` @@ -3005,7 +3041,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ethereal ####################################### diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ethereal.te serefpolicy-3.3.1/policy/modules/apps/ethereal.te --- nsaserefpolicy/policy/modules/apps/ethereal.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/ethereal.te 2008-04-21 11:02:48.111536000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/ethereal.te 2008-04-21 11:02:48.000000000 -0400 @@ -16,6 +16,13 @@ type tethereal_tmp_t; files_tmp_file(tethereal_tmp_t) @@ -3022,7 +3058,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ethereal # Tethereal policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/evolution.fc serefpolicy-3.3.1/policy/modules/apps/evolution.fc --- nsaserefpolicy/policy/modules/apps/evolution.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/evolution.fc 2008-04-21 11:02:48.116531000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/evolution.fc 2008-04-21 11:02:48.000000000 -0400 @@ -2,13 +2,13 @@ # HOME_DIR/ # @@ -3042,7 +3078,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/evolutio # /usr diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/evolution.if serefpolicy-3.3.1/policy/modules/apps/evolution.if --- nsaserefpolicy/policy/modules/apps/evolution.if 2007-10-29 07:52:48.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/evolution.if 2008-04-21 11:02:48.124522000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/evolution.if 2008-04-21 11:02:48.000000000 -0400 @@ -247,7 +247,7 @@ mta_read_config($1_evolution_t) @@ -3081,7 +3117,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/evolutio nscd_socket_use($1_evolution_webcal_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.if serefpolicy-3.3.1/policy/modules/apps/games.if --- nsaserefpolicy/policy/modules/apps/games.if 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/games.if 2008-04-21 11:02:48.130515000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/games.if 2008-04-21 11:02:48.000000000 -0400 @@ -146,7 +146,7 @@ ') @@ -3093,7 +3129,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.if ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gift.fc serefpolicy-3.3.1/policy/modules/apps/gift.fc --- nsaserefpolicy/policy/modules/apps/gift.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/gift.fc 2008-04-21 11:02:48.135512000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/gift.fc 2008-04-21 11:02:48.000000000 -0400 @@ -1,4 +1,4 @@ -HOME_DIR/\.giFT(/.*)? gen_context(system_u:object_r:ROLE_gift_home_t,s0) +HOME_DIR/\.giFT(/.*)? gen_context(system_u:object_r:user_gift_home_t,s0) @@ -3102,7 +3138,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gift.fc /usr/(local/)?bin/giftd -- gen_context(system_u:object_r:giftd_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gift.if serefpolicy-3.3.1/policy/modules/apps/gift.if --- nsaserefpolicy/policy/modules/apps/gift.if 2007-07-23 10:20:12.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/gift.if 2008-04-21 11:02:48.141504000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/gift.if 2008-04-21 11:02:48.000000000 -0400 @@ -43,9 +43,9 @@ application_domain($1_gift_t,gift_exec_t) role $3 types $1_gift_t; @@ -3176,7 +3212,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gift.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gift.te serefpolicy-3.3.1/policy/modules/apps/gift.te --- nsaserefpolicy/policy/modules/apps/gift.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/gift.te 2008-04-21 11:02:48.146499000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/gift.te 2008-04-21 11:02:48.000000000 -0400 @@ -11,3 +11,7 @@ type giftd_exec_t; @@ -3187,7 +3223,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gift.te + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.3.1/policy/modules/apps/gnome.fc --- nsaserefpolicy/policy/modules/apps/gnome.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/gnome.fc 2008-04-21 11:02:48.151494000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/gnome.fc 2008-04-21 11:02:48.000000000 -0400 @@ -1,8 +1,7 @@ -HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:ROLE_gnome_home_t,s0) -HOME_DIR/\.gconf(d)?(/.*)? gen_context(system_u:object_r:ROLE_gconf_home_t,s0) @@ -3203,7 +3239,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc /usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.3.1/policy/modules/apps/gnome.if --- nsaserefpolicy/policy/modules/apps/gnome.if 2007-07-23 10:20:12.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/gnome.if 2008-04-21 11:02:48.157488000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/gnome.if 2008-04-21 11:02:48.000000000 -0400 @@ -33,9 +33,60 @@ ## # @@ -3436,7 +3472,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.3.1/policy/modules/apps/gnome.te --- nsaserefpolicy/policy/modules/apps/gnome.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/gnome.te 2008-04-21 11:02:48.162483000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/gnome.te 2008-04-21 11:02:48.000000000 -0400 @@ -8,8 +8,19 @@ attribute gnomedomain; @@ -3462,7 +3498,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te +typealias user_gconf_tmp_t alias unconfined_gconf_tmp_t; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-3.3.1/policy/modules/apps/gpg.fc --- nsaserefpolicy/policy/modules/apps/gpg.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/gpg.fc 2008-04-21 11:02:48.167478000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/gpg.fc 2008-04-21 11:02:48.000000000 -0400 @@ -1,9 +1,9 @@ -HOME_DIR/\.gnupg(/.+)? gen_context(system_u:object_r:ROLE_gpg_secret_t,s0) +HOME_DIR/\.gnupg(/.+)? gen_context(system_u:object_r:user_gpg_secret_t,s0) @@ -3479,7 +3515,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc s +/usr/lib(64)?/gnupg/gpgkeys.* -- gen_context(system_u:object_r:gpg_helper_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if serefpolicy-3.3.1/policy/modules/apps/gpg.if --- nsaserefpolicy/policy/modules/apps/gpg.if 2007-07-23 10:20:12.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/gpg.if 2008-04-21 11:02:48.173471000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/gpg.if 2008-04-21 11:02:48.000000000 -0400 @@ -38,6 +38,10 @@ gen_require(` type gpg_exec_t, gpg_helper_exec_t; @@ -3805,7 +3841,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if s ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.3.1/policy/modules/apps/gpg.te --- nsaserefpolicy/policy/modules/apps/gpg.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/gpg.te 2008-04-21 13:02:48.601482000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/gpg.te 2008-04-21 13:02:48.000000000 -0400 @@ -7,15 +7,241 @@ # @@ -4054,7 +4090,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.fc serefpolicy-3.3.1/policy/modules/apps/irc.fc --- nsaserefpolicy/policy/modules/apps/irc.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/irc.fc 2008-04-21 11:02:48.184461000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/irc.fc 2008-04-21 11:02:48.000000000 -0400 @@ -1,7 +1,7 @@ # # /home @@ -4066,7 +4102,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.fc s # /usr diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.if serefpolicy-3.3.1/policy/modules/apps/irc.if --- nsaserefpolicy/policy/modules/apps/irc.if 2007-07-23 10:20:12.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/irc.if 2008-04-21 11:02:48.190454000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/irc.if 2008-04-21 11:02:48.000000000 -0400 @@ -35,6 +35,7 @@ template(`irc_per_role_template',` gen_require(` @@ -4123,7 +4159,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.if s domtrans_pattern($2,irc_exec_t,$1_irc_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.te serefpolicy-3.3.1/policy/modules/apps/irc.te --- nsaserefpolicy/policy/modules/apps/irc.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/irc.te 2008-04-21 11:02:48.200453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/irc.te 2008-04-21 11:02:48.000000000 -0400 @@ -8,3 +8,10 @@ type irc_exec_t; @@ -4137,7 +4173,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/irc.te s + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.3.1/policy/modules/apps/java.fc --- nsaserefpolicy/policy/modules/apps/java.fc 2007-03-01 10:01:48.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/java.fc 2008-04-21 11:02:48.205453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/java.fc 2008-04-21 11:02:48.000000000 -0400 @@ -3,14 +3,15 @@ # /opt/(.*/)?bin/java[^/]* -- gen_context(system_u:object_r:java_exec_t,s0) @@ -4171,7 +4207,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc +/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.3.1/policy/modules/apps/java.if --- nsaserefpolicy/policy/modules/apps/java.if 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/java.if 2008-04-21 11:02:48.211453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/java.if 2008-04-21 11:02:48.000000000 -0400 @@ -32,7 +32,7 @@ ## ## @@ -4422,7 +4458,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.3.1/policy/modules/apps/java.te --- nsaserefpolicy/policy/modules/apps/java.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/java.te 2008-04-21 11:02:48.216453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/java.te 2008-04-21 11:02:48.000000000 -0400 @@ -6,16 +6,10 @@ # Declarations # @@ -4475,7 +4511,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.3.1/policy/modules/apps/loadkeys.te --- nsaserefpolicy/policy/modules/apps/loadkeys.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/loadkeys.te 2008-04-21 11:02:48.221453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/loadkeys.te 2008-04-21 11:02:48.000000000 -0400 @@ -44,3 +44,7 @@ optional_policy(` nscd_dontaudit_search_pid(loadkeys_t) @@ -4486,7 +4522,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys +userdom_dontaudit_list_sysadm_home_dirs(loadkeys_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.3.1/policy/modules/apps/mono.if --- nsaserefpolicy/policy/modules/apps/mono.if 2007-01-02 12:57:22.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/mono.if 2008-04-21 11:02:48.226453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/mono.if 2008-04-21 11:02:48.000000000 -0400 @@ -18,3 +18,101 @@ corecmd_search_bin($1) domtrans_pattern($1, mono_exec_t, mono_t) @@ -4591,7 +4627,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.3.1/policy/modules/apps/mono.te --- nsaserefpolicy/policy/modules/apps/mono.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/mono.te 2008-04-21 11:02:48.231453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/mono.te 2008-04-21 11:02:48.000000000 -0400 @@ -15,7 +15,7 @@ # Local policy # @@ -4611,7 +4647,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.fc serefpolicy-3.3.1/policy/modules/apps/mozilla.fc --- nsaserefpolicy/policy/modules/apps/mozilla.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/mozilla.fc 2008-04-21 11:02:48.236453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/mozilla.fc 2008-04-21 11:02:48.000000000 -0400 @@ -1,8 +1,8 @@ -HOME_DIR/\.galeon(/.*)? gen_context(system_u:object_r:ROLE_mozilla_home_t,s0) -HOME_DIR/\.java(/.*)? gen_context(system_u:object_r:ROLE_mozilla_home_t,s0) @@ -4642,7 +4678,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. +/usr/lib64/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.3.1/policy/modules/apps/mozilla.if --- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-29 07:52:48.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/mozilla.if 2008-04-21 11:02:48.242453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/mozilla.if 2008-04-21 11:02:48.000000000 -0400 @@ -35,7 +35,10 @@ template(`mozilla_per_role_template',` gen_require(` @@ -5122,7 +5158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.3.1/policy/modules/apps/mozilla.te --- nsaserefpolicy/policy/modules/apps/mozilla.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/mozilla.te 2008-04-21 11:02:48.248453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/mozilla.te 2008-04-21 11:02:48.000000000 -0400 @@ -6,15 +6,15 @@ # Declarations # @@ -5148,7 +5184,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. +files_tmp_file(user_mozilla_tmp_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.fc serefpolicy-3.3.1/policy/modules/apps/mplayer.fc --- nsaserefpolicy/policy/modules/apps/mplayer.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/mplayer.fc 2008-04-21 11:02:48.253453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/mplayer.fc 2008-04-21 11:02:48.000000000 -0400 @@ -10,4 +10,4 @@ /usr/bin/mencoder -- gen_context(system_u:object_r:mencoder_exec_t,s0) /usr/bin/xine -- gen_context(system_u:object_r:mplayer_exec_t,s0) @@ -5157,7 +5193,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer. +HOME_DIR/\.mplayer(/.*)? gen_context(system_u:object_r:user_mplayer_home_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.if serefpolicy-3.3.1/policy/modules/apps/mplayer.if --- nsaserefpolicy/policy/modules/apps/mplayer.if 2007-07-23 10:20:12.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/mplayer.if 2008-04-21 12:53:27.780512000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/mplayer.if 2008-04-21 12:53:27.000000000 -0400 @@ -35,6 +35,7 @@ template(`mplayer_per_role_template',` gen_require(` @@ -5293,7 +5329,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer. ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer.te serefpolicy-3.3.1/policy/modules/apps/mplayer.te --- nsaserefpolicy/policy/modules/apps/mplayer.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/mplayer.te 2008-04-21 11:02:48.265453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/mplayer.te 2008-04-21 11:02:48.000000000 -0400 @@ -22,3 +22,7 @@ type mplayer_exec_t; corecmd_executable_file(mplayer_exec_t) @@ -5304,7 +5340,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mplayer. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.fc serefpolicy-3.3.1/policy/modules/apps/nsplugin.fc --- nsaserefpolicy/policy/modules/apps/nsplugin.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/nsplugin.fc 2008-04-21 11:02:48.270453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/nsplugin.fc 2008-04-21 11:02:48.000000000 -0400 @@ -0,0 +1,9 @@ + +/usr/lib(64)?/nspluginwrapper/npviewer.bin -- gen_context(system_u:object_r:nsplugin_exec_t,s0) @@ -5317,7 +5353,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin +HOME_DIR/\.local.* gen_context(system_u:object_r:user_nsplugin_home_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.if serefpolicy-3.3.1/policy/modules/apps/nsplugin.if --- nsaserefpolicy/policy/modules/apps/nsplugin.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/nsplugin.if 2008-04-21 11:02:48.275453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/nsplugin.if 2008-04-21 11:02:48.000000000 -0400 @@ -0,0 +1,353 @@ + +## policy for nsplugin @@ -5674,7 +5710,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.3.1/policy/modules/apps/nsplugin.te --- nsaserefpolicy/policy/modules/apps/nsplugin.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/nsplugin.te 2008-04-21 11:02:48.280453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/nsplugin.te 2008-04-21 11:02:48.000000000 -0400 @@ -0,0 +1,198 @@ + +policy_module(nsplugin,1.0.0) @@ -5876,14 +5912,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.fc serefpolicy-3.3.1/policy/modules/apps/openoffice.fc --- nsaserefpolicy/policy/modules/apps/openoffice.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/openoffice.fc 2008-04-21 11:02:48.284453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/openoffice.fc 2008-04-21 11:02:48.000000000 -0400 @@ -0,0 +1,3 @@ +/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0) +/usr/lib64/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.if serefpolicy-3.3.1/policy/modules/apps/openoffice.if --- nsaserefpolicy/policy/modules/apps/openoffice.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/openoffice.if 2008-04-21 11:02:48.289453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/openoffice.if 2008-04-21 11:02:48.000000000 -0400 @@ -0,0 +1,212 @@ +## Openoffice + @@ -6099,7 +6135,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffi +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.te serefpolicy-3.3.1/policy/modules/apps/openoffice.te --- nsaserefpolicy/policy/modules/apps/openoffice.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/openoffice.te 2008-04-21 11:02:48.293453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/openoffice.te 2008-04-21 11:02:48.000000000 -0400 @@ -0,0 +1,14 @@ + +policy_module(openoffice,1.0.0) @@ -6117,7 +6153,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffi + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/screen.fc serefpolicy-3.3.1/policy/modules/apps/screen.fc --- nsaserefpolicy/policy/modules/apps/screen.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/screen.fc 2008-04-21 11:02:48.297455000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/screen.fc 2008-04-21 11:02:48.000000000 -0400 @@ -1,7 +1,7 @@ # # /home @@ -6129,7 +6165,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/screen.f # /usr diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/screen.if serefpolicy-3.3.1/policy/modules/apps/screen.if --- nsaserefpolicy/policy/modules/apps/screen.if 2007-07-23 10:20:12.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/screen.if 2008-04-21 11:02:48.303453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/screen.if 2008-04-21 11:02:48.000000000 -0400 @@ -35,6 +35,7 @@ template(`screen_per_role_template',` gen_require(` @@ -6184,7 +6220,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/screen.i kernel_read_kernel_sysctls($1_screen_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/screen.te serefpolicy-3.3.1/policy/modules/apps/screen.te --- nsaserefpolicy/policy/modules/apps/screen.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/screen.te 2008-04-21 11:02:48.315453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/screen.te 2008-04-21 11:02:48.000000000 -0400 @@ -11,3 +11,7 @@ type screen_exec_t; @@ -6195,7 +6231,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/screen.t + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.3.1/policy/modules/apps/slocate.te --- nsaserefpolicy/policy/modules/apps/slocate.te 2007-10-02 09:54:50.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/slocate.te 2008-04-21 11:02:48.320453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/slocate.te 2008-04-21 11:02:48.000000000 -0400 @@ -39,6 +39,7 @@ files_list_all(locate_t) @@ -6206,7 +6242,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate. files_read_etc_files(locate_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/thunderbird.fc serefpolicy-3.3.1/policy/modules/apps/thunderbird.fc --- nsaserefpolicy/policy/modules/apps/thunderbird.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/thunderbird.fc 2008-04-21 11:02:48.325453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/thunderbird.fc 2008-04-21 11:02:48.000000000 -0400 @@ -3,4 +3,4 @@ # /usr/bin/thunderbird.* -- gen_context(system_u:object_r:thunderbird_exec_t,s0) @@ -6215,7 +6251,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/thunderb +HOME_DIR/\.thunderbird(/.*)? gen_context(system_u:object_r:user_thunderbird_home_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/thunderbird.if serefpolicy-3.3.1/policy/modules/apps/thunderbird.if --- nsaserefpolicy/policy/modules/apps/thunderbird.if 2007-12-06 13:12:03.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/thunderbird.if 2008-04-21 11:02:48.331453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/thunderbird.if 2008-04-21 11:02:48.000000000 -0400 @@ -43,9 +43,9 @@ application_domain($1_thunderbird_t,thunderbird_exec_t) role $3 types $1_thunderbird_t; @@ -6274,7 +6310,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/thunderb diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/thunderbird.te serefpolicy-3.3.1/policy/modules/apps/thunderbird.te --- nsaserefpolicy/policy/modules/apps/thunderbird.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/thunderbird.te 2008-04-21 11:02:48.337453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/thunderbird.te 2008-04-21 11:02:48.000000000 -0400 @@ -8,3 +8,7 @@ type thunderbird_exec_t; @@ -6285,7 +6321,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/thunderb + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/tvtime.if serefpolicy-3.3.1/policy/modules/apps/tvtime.if --- nsaserefpolicy/policy/modules/apps/tvtime.if 2007-07-23 10:20:12.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/tvtime.if 2008-04-21 11:02:48.343452000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/tvtime.if 2008-04-21 11:02:48.000000000 -0400 @@ -35,6 +35,7 @@ template(`tvtime_per_role_template',` gen_require(` @@ -6363,7 +6399,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/tvtime.i ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/tvtime.te serefpolicy-3.3.1/policy/modules/apps/tvtime.te --- nsaserefpolicy/policy/modules/apps/tvtime.te 2007-10-02 09:54:50.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/tvtime.te 2008-04-21 11:02:48.347456000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/tvtime.te 2008-04-21 11:02:48.000000000 -0400 @@ -11,3 +11,9 @@ type tvtime_dir_t; @@ -6376,7 +6412,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/tvtime.t +files_tmp_file(user_tvtime_tmp_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.fc serefpolicy-3.3.1/policy/modules/apps/uml.fc --- nsaserefpolicy/policy/modules/apps/uml.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/uml.fc 2008-04-21 11:02:48.352451000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/uml.fc 2008-04-21 11:02:48.000000000 -0400 @@ -1,7 +1,7 @@ # # HOME_DIR/ @@ -6388,7 +6424,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.fc s # /usr diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.3.1/policy/modules/apps/userhelper.if --- nsaserefpolicy/policy/modules/apps/userhelper.if 2007-07-23 10:20:12.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/userhelper.if 2008-04-21 11:02:48.358445000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/userhelper.if 2008-04-21 11:02:48.000000000 -0400 @@ -181,24 +181,6 @@ nscd_socket_use($1_userhelper_t) ') @@ -6455,7 +6491,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp allow $2 $1_userhelper_t:process sigchld; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.3.1/policy/modules/apps/vmware.fc --- nsaserefpolicy/policy/modules/apps/vmware.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/vmware.fc 2008-04-21 11:02:48.364438000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/vmware.fc 2008-04-21 11:02:48.000000000 -0400 @@ -1,9 +1,9 @@ # # HOME_DIR/ @@ -6506,7 +6542,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.f +/usr/lib/vmware-tools/sbin64/vmware.* -- gen_context(system_u:object_r:vmware_host_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.if serefpolicy-3.3.1/policy/modules/apps/vmware.if --- nsaserefpolicy/policy/modules/apps/vmware.if 2007-02-19 11:32:52.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/vmware.if 2008-04-21 11:02:48.370433000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/vmware.if 2008-04-21 11:02:48.000000000 -0400 @@ -164,7 +164,7 @@ sysnet_dns_name_resolve($1_vmware_t) sysnet_read_config($1_vmware_t) @@ -6541,7 +6577,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.3.1/policy/modules/apps/vmware.te --- nsaserefpolicy/policy/modules/apps/vmware.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/vmware.te 2008-04-21 11:02:48.375428000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/vmware.te 2008-04-21 11:02:48.000000000 -0400 @@ -22,17 +22,21 @@ type vmware_var_run_t; files_pid_file(vmware_var_run_t) @@ -6609,7 +6645,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.t + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.3.1/policy/modules/apps/wine.if --- nsaserefpolicy/policy/modules/apps/wine.if 2007-09-12 10:34:17.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/apps/wine.if 2008-04-21 11:02:48.404399000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/wine.if 2008-04-21 11:02:48.000000000 -0400 @@ -49,3 +49,53 @@ role $2 types wine_t; allow wine_t $3:chr_file rw_term_perms; @@ -6666,7 +6702,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.3.1/policy/modules/apps/wine.te --- nsaserefpolicy/policy/modules/apps/wine.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/wine.te 2008-04-21 11:02:48.426377000 -0400 ++++ serefpolicy-3.3.1/policy/modules/apps/wine.te 2008-04-25 14:01:56.000000000 -0400 @@ -9,6 +9,7 @@ type wine_t; type wine_exec_t; @@ -6675,10 +6711,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te ######################################## # -@@ -17,10 +18,16 @@ +@@ -17,10 +18,17 @@ optional_policy(` allow wine_t self:process { execstack execmem execheap }; ++ domain_mmap_low_type(wine_t) + domain_mmap_low(wine_t) unconfined_domain_noaudit(wine_t) files_execmod_all_files(wine_t) @@ -6697,7 +6734,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.3.1/policy/modules/kernel/corecommands.fc --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-12-12 11:35:27.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/corecommands.fc 2008-04-21 12:04:14.237837000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/corecommands.fc 2008-04-21 12:04:14.000000000 -0400 @@ -7,11 +7,11 @@ /bin/d?ash -- gen_context(system_u:object_r:shell_exec_t,s0) /bin/bash -- gen_context(system_u:object_r:shell_exec_t,s0) @@ -6808,7 +6845,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-3.3.1/policy/modules/kernel/corecommands.if --- nsaserefpolicy/policy/modules/kernel/corecommands.if 2007-11-14 08:17:58.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/corecommands.if 2008-04-21 11:02:48.440364000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/corecommands.if 2008-04-21 11:02:48.000000000 -0400 @@ -875,6 +875,7 @@ read_lnk_files_pattern($1,bin_t,bin_t) @@ -6819,7 +6856,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.if.in serefpolicy-3.3.1/policy/modules/kernel/corenetwork.if.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.if.in 2008-02-01 09:12:53.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/corenetwork.if.in 2008-04-21 11:02:48.452351000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/corenetwork.if.in 2008-04-21 11:02:48.000000000 -0400 @@ -1441,10 +1441,11 @@ # interface(`corenet_tcp_bind_all_unreserved_ports',` @@ -6849,7 +6886,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.3.1/policy/modules/kernel/corenetwork.te.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2008-02-01 09:12:53.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/corenetwork.te.in 2008-04-22 15:54:10.151463000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/corenetwork.te.in 2008-04-22 15:54:10.000000000 -0400 @@ -75,6 +75,7 @@ network_port(aol, udp,5190,s0, tcp,5190,s0, udp,5191,s0, tcp,5191,s0, udp,5192,s0, tcp,5192,s0, udp,5193,s0, tcp,5193,s0) network_port(apcupsd, tcp,3551,s0, udp,3551,s0) @@ -6934,7 +6971,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene network_port(xen, tcp,8002,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.3.1/policy/modules/kernel/devices.fc --- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-12-12 11:35:27.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/devices.fc 2008-04-21 11:02:48.464339000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/devices.fc 2008-04-21 11:02:48.000000000 -0400 @@ -1,7 +1,7 @@ /dev -d gen_context(system_u:object_r:device_t,s0) @@ -7060,7 +7097,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.3.1/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2007-10-29 18:02:31.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/kernel/devices.if 2008-04-21 11:02:48.478327000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/devices.if 2008-04-21 11:02:48.000000000 -0400 @@ -65,7 +65,7 @@ relabelfrom_dirs_pattern($1,device_t,device_node) @@ -7388,7 +7425,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.3.1/policy/modules/kernel/devices.te --- nsaserefpolicy/policy/modules/kernel/devices.te 2007-12-19 05:32:07.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/devices.te 2008-04-21 11:02:48.485318000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/devices.te 2008-04-21 11:02:48.000000000 -0400 @@ -32,6 +32,12 @@ type apm_bios_t; dev_node(apm_bios_t) @@ -7441,9 +7478,50 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device # Type for /dev/mapper/control # type lvm_control_t; +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.3.1/policy/modules/kernel/domain.if +--- nsaserefpolicy/policy/modules/kernel/domain.if 2007-11-29 13:29:34.000000000 -0500 ++++ serefpolicy-3.3.1/policy/modules/kernel/domain.if 2008-04-28 09:14:07.261479000 -0400 +@@ -1242,18 +1242,34 @@ + ## + ## + # +-interface(`domain_mmap_low',` ++interface(`domain_mmap_low_type',` + gen_require(` + attribute mmap_low_domain_type; + ') + +- allow $1 self:memprotect mmap_zero; +- + typeattribute $1 mmap_low_domain_type; + ') + + ######################################## + ## ++## Ability to mmap a low area of the address space, ++## as configured by /proc/sys/kernel/mmap_min_addr. ++## Preventing such mappings helps protect against ++## exploiting null deref bugs in the kernel. ++## ++## ++## ++## Domain allowed to mmap low memory. ++## ++## ++# ++interface(`domain_mmap_low',` ++ ++ allow $1 self:memprotect mmap_zero; ++') ++ ++######################################## ++## + ## Allow specified type to receive labeled + ## networking packets from all domains, over + ## all protocols (TCP, UDP, etc) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.3.1/policy/modules/kernel/domain.te --- nsaserefpolicy/policy/modules/kernel/domain.te 2007-12-19 05:32:07.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/domain.te 2008-04-21 11:02:48.491312000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/domain.te 2008-04-21 11:02:48.000000000 -0400 @@ -5,6 +5,13 @@ # # Declarations @@ -7509,7 +7587,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain +dontaudit can_change_object_identity can_change_object_identity:key link; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.3.1/policy/modules/kernel/files.fc --- nsaserefpolicy/policy/modules/kernel/files.fc 2007-10-29 18:02:31.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/kernel/files.fc 2008-04-21 11:02:48.497306000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/files.fc 2008-04-21 11:02:48.000000000 -0400 @@ -32,6 +32,7 @@ /boot/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh) /boot/lost\+found/.* <> @@ -7520,7 +7598,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # /emul diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.3.1/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2007-10-29 18:02:31.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/kernel/files.if 2008-04-23 10:14:31.898476000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/files.if 2008-04-23 10:14:31.000000000 -0400 @@ -110,6 +110,11 @@ ## # @@ -7807,7 +7885,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.3.1/policy/modules/kernel/files.te --- nsaserefpolicy/policy/modules/kernel/files.te 2008-02-18 14:30:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/files.te 2008-04-23 15:35:25.733975000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/files.te 2008-04-23 15:35:25.000000000 -0400 @@ -50,11 +50,15 @@ # # etc_t is the type of the system etc directories. @@ -7839,7 +7917,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.3.1/policy/modules/kernel/filesystem.if --- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-10-24 15:00:24.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/kernel/filesystem.if 2008-04-22 14:44:30.292823000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/filesystem.if 2008-04-28 17:00:20.022613000 -0400 @@ -310,6 +310,25 @@ ######################################## @@ -8222,7 +8300,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.3.1/policy/modules/kernel/filesystem.te --- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-12-19 05:32:07.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/filesystem.te 2008-04-21 11:02:48.541262000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/filesystem.te 2008-04-21 11:02:48.000000000 -0400 @@ -25,6 +25,8 @@ fs_use_xattr encfs gen_context(system_u:object_r:fs_t,s0); fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0); @@ -8264,7 +8342,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.3.1/policy/modules/kernel/kernel.if --- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-10-29 18:02:31.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/kernel/kernel.if 2008-04-21 11:02:48.553250000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/kernel.if 2008-04-21 11:02:48.000000000 -0400 @@ -851,9 +851,8 @@ type proc_t, proc_afs_t; ') @@ -8294,7 +8372,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.3.1/policy/modules/kernel/kernel.te --- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-12-19 05:32:07.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/kernel.te 2008-04-21 11:02:48.559245000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/kernel.te 2008-04-21 11:02:48.000000000 -0400 @@ -231,6 +231,8 @@ # Mount root file system. Used when loading a policy # from initrd, then mounting the root filesystem @@ -8337,7 +8415,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-3.3.1/policy/modules/kernel/mls.if --- nsaserefpolicy/policy/modules/kernel/mls.if 2008-02-01 09:12:53.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/mls.if 2008-04-21 11:02:48.566237000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/mls.if 2008-04-21 11:02:48.000000000 -0400 @@ -612,6 +612,26 @@ ######################################## ## @@ -8394,7 +8472,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.3.1/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-11-16 13:45:14.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/selinux.if 2008-04-21 11:02:48.572231000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/selinux.if 2008-04-21 11:02:48.000000000 -0400 @@ -164,6 +164,7 @@ type security_t; ') @@ -8515,7 +8593,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.te serefpolicy-3.3.1/policy/modules/kernel/selinux.te --- nsaserefpolicy/policy/modules/kernel/selinux.te 2007-12-19 05:32:07.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/selinux.te 2008-04-21 11:02:48.577226000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/selinux.te 2008-04-21 11:02:48.000000000 -0400 @@ -10,6 +10,7 @@ attribute can_setenforce; attribute can_setsecparam; @@ -8538,7 +8616,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.3.1/policy/modules/kernel/storage.fc --- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-10-29 18:02:31.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/kernel/storage.fc 2008-04-21 11:02:48.583220000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/storage.fc 2008-04-28 15:02:52.901366000 -0400 @@ -13,6 +13,7 @@ /dev/cm20.* -b gen_context(system_u:object_r:removable_device_t,s0) /dev/dasd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) @@ -8547,9 +8625,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag /dev/fd[^/]+ -b gen_context(system_u:object_r:removable_device_t,s0) /dev/flash[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/gscd -b gen_context(system_u:object_r:removable_device_t,s0) +@@ -48,6 +49,7 @@ + /dev/tw[a-z][^/]+ -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) + /dev/ub[a-z][^/]+ -b gen_context(system_u:object_r:removable_device_t,mls_systemhigh) + /dev/ubd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) ++/dev/vd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) + /dev/xvd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) + + /dev/ataraid/.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.3.1/policy/modules/kernel/storage.if --- nsaserefpolicy/policy/modules/kernel/storage.if 2008-02-26 08:17:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/kernel/storage.if 2008-04-21 11:59:53.395967000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/storage.if 2008-04-28 16:19:58.789387000 -0400 @@ -81,6 +81,26 @@ ######################################## @@ -8579,7 +8665,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag ## SELinux protections for filesystem objects, and diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.3.1/policy/modules/kernel/terminal.if --- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-09-12 10:34:17.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/kernel/terminal.if 2008-04-21 11:02:48.597206000 -0400 ++++ serefpolicy-3.3.1/policy/modules/kernel/terminal.if 2008-04-28 15:49:59.242976000 -0400 @@ -525,11 +525,13 @@ interface(`term_use_generic_ptys',` gen_require(` @@ -8608,7 +8694,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.if serefpolicy-3.3.1/policy/modules/services/aide.if --- nsaserefpolicy/policy/modules/services/aide.if 2008-02-18 14:30:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/aide.if 2008-04-21 11:02:48.603200000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/aide.if 2008-04-21 11:02:48.000000000 -0400 @@ -79,10 +79,12 @@ allow $1 aide_t:process { ptrace signal_perms }; @@ -8626,7 +8712,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.fc serefpolicy-3.3.1/policy/modules/services/amavis.fc --- nsaserefpolicy/policy/modules/services/amavis.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/amavis.fc 2008-04-21 11:02:48.608195000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/amavis.fc 2008-04-21 11:02:48.000000000 -0400 @@ -14,3 +14,5 @@ /var/run/amavis(d)?(/.*)? gen_context(system_u:object_r:amavis_var_run_t,s0) /var/spool/amavisd(/.*)? gen_context(system_u:object_r:amavis_spool_t,s0) @@ -8635,7 +8721,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav +/etc/rc.d/init.d/amavis -- gen_context(system_u:object_r:amavis_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.if serefpolicy-3.3.1/policy/modules/services/amavis.if --- nsaserefpolicy/policy/modules/services/amavis.if 2008-02-18 14:30:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/amavis.if 2008-04-21 11:02:48.614189000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/amavis.if 2008-04-21 11:02:48.000000000 -0400 @@ -189,6 +189,25 @@ ######################################## @@ -8709,7 +8795,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.3.1/policy/modules/services/amavis.te --- nsaserefpolicy/policy/modules/services/amavis.te 2008-02-18 14:30:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/amavis.te 2008-04-23 15:44:23.414526000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/amavis.te 2008-04-23 15:44:23.000000000 -0400 @@ -13,7 +13,7 @@ # configuration files @@ -8731,7 +8817,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav # amavis local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.3.1/policy/modules/services/apache.fc --- nsaserefpolicy/policy/modules/services/apache.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/apache.fc 2008-04-21 11:02:48.626177000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/apache.fc 2008-04-21 11:02:48.000000000 -0400 @@ -1,4 +1,4 @@ -HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_ROLE_content_t,s0) +HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0) @@ -8794,7 +8880,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +/etc/rc\.d/init\.d/httpd -- gen_context(system_u:object_r:httpd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.3.1/policy/modules/services/apache.if --- nsaserefpolicy/policy/modules/services/apache.if 2007-10-23 17:17:42.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/apache.if 2008-04-21 11:02:48.635168000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/apache.if 2008-04-21 11:02:48.000000000 -0400 @@ -13,21 +13,16 @@ # template(`apache_content_template',` @@ -9383,7 +9469,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.3.1/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/apache.te 2008-04-21 14:57:09.863361000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/apache.te 2008-04-21 14:57:09.000000000 -0400 @@ -20,6 +20,8 @@ # Declarations # @@ -9937,7 +10023,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-3.3.1/policy/modules/services/apcupsd.fc --- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/apcupsd.fc 2008-04-21 11:02:48.649154000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/apcupsd.fc 2008-04-21 11:02:48.000000000 -0400 @@ -13,3 +13,5 @@ /var/www/apcupsd/upsfstats\.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) /var/www/apcupsd/upsimage\.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) @@ -9946,7 +10032,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +/etc/rc.d/init.d/apcupsd -- gen_context(system_u:object_r:apcupsd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.3.1/policy/modules/services/apcupsd.if --- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-09-12 10:34:18.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/apcupsd.if 2008-04-21 11:02:48.655147000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/apcupsd.if 2008-04-21 11:02:48.000000000 -0400 @@ -90,10 +90,102 @@ ## ## @@ -10053,7 +10139,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.3.1/policy/modules/services/apcupsd.te --- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/apcupsd.te 2008-04-21 11:02:48.660143000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/apcupsd.te 2008-04-21 11:02:48.000000000 -0400 @@ -22,6 +22,9 @@ type apcupsd_var_run_t; files_pid_file(apcupsd_var_run_t) @@ -10078,7 +10164,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apm.te serefpolicy-3.3.1/policy/modules/services/apm.te --- nsaserefpolicy/policy/modules/services/apm.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/apm.te 2008-04-21 11:02:48.667136000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/apm.te 2008-04-21 11:02:48.000000000 -0400 @@ -190,6 +190,10 @@ dbus_stub(apmd_t) @@ -10092,7 +10178,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apm. ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.fc serefpolicy-3.3.1/policy/modules/services/arpwatch.fc --- nsaserefpolicy/policy/modules/services/arpwatch.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/arpwatch.fc 2008-04-21 11:02:48.672131000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/arpwatch.fc 2008-04-21 11:02:48.000000000 -0400 @@ -9,3 +9,5 @@ # /var/arpwatch(/.*)? gen_context(system_u:object_r:arpwatch_data_t,s0) @@ -10101,7 +10187,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpw +/etc/rc.d/init.d/arpwatch -- gen_context(system_u:object_r:arpwatch_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.if serefpolicy-3.3.1/policy/modules/services/arpwatch.if --- nsaserefpolicy/policy/modules/services/arpwatch.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/arpwatch.if 2008-04-21 11:02:48.677126000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/arpwatch.if 2008-04-21 11:02:48.000000000 -0400 @@ -90,3 +90,73 @@ dontaudit $1 arpwatch_t:packet_socket { read write }; @@ -10178,7 +10264,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpw + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.te serefpolicy-3.3.1/policy/modules/services/arpwatch.te --- nsaserefpolicy/policy/modules/services/arpwatch.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/arpwatch.te 2008-04-21 11:02:48.683120000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/arpwatch.te 2008-04-21 11:02:48.000000000 -0400 @@ -19,6 +19,9 @@ type arpwatch_var_run_t; files_pid_file(arpwatch_var_run_t) @@ -10191,7 +10277,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpw # Local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.fc serefpolicy-3.3.1/policy/modules/services/asterisk.fc --- nsaserefpolicy/policy/modules/services/asterisk.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/asterisk.fc 2008-04-21 11:02:48.688115000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/asterisk.fc 2008-04-21 11:02:48.000000000 -0400 @@ -6,3 +6,4 @@ /var/log/asterisk(/.*)? gen_context(system_u:object_r:asterisk_log_t,s0) /var/run/asterisk(/.*)? gen_context(system_u:object_r:asterisk_var_run_t,s0) @@ -10199,7 +10285,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aste +/etc/rc.d/init.d/asterisk -- gen_context(system_u:object_r:asterisk_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.if serefpolicy-3.3.1/policy/modules/services/asterisk.if --- nsaserefpolicy/policy/modules/services/asterisk.if 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/asterisk.if 2008-04-21 11:02:48.693110000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/asterisk.if 2008-04-21 11:02:48.000000000 -0400 @@ -1 +1,83 @@ ## Asterisk IP telephony server + @@ -10286,7 +10372,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aste + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.te serefpolicy-3.3.1/policy/modules/services/asterisk.te --- nsaserefpolicy/policy/modules/services/asterisk.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/asterisk.te 2008-04-21 11:02:48.699104000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/asterisk.te 2008-04-21 11:02:48.000000000 -0400 @@ -31,6 +31,9 @@ type asterisk_var_run_t; files_pid_file(asterisk_var_run_t) @@ -10299,7 +10385,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aste # Local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.fc serefpolicy-3.3.1/policy/modules/services/automount.fc --- nsaserefpolicy/policy/modules/services/automount.fc 2007-02-19 11:32:53.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/automount.fc 2008-04-21 11:02:48.704099000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/automount.fc 2008-04-21 11:02:48.000000000 -0400 @@ -12,4 +12,7 @@ # /var # @@ -10311,7 +10397,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.if serefpolicy-3.3.1/policy/modules/services/automount.if --- nsaserefpolicy/policy/modules/services/automount.if 2007-03-26 10:39:04.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/automount.if 2008-04-21 11:02:48.710092000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/automount.if 2008-04-21 11:02:48.000000000 -0400 @@ -74,3 +74,109 @@ dontaudit $1 automount_tmp_t:dir getattr; @@ -10424,7 +10510,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.3.1/policy/modules/services/automount.te --- nsaserefpolicy/policy/modules/services/automount.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/automount.te 2008-04-21 11:02:48.716087000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/automount.te 2008-04-21 11:02:48.000000000 -0400 @@ -20,6 +20,9 @@ files_tmp_file(automount_tmp_t) files_mountpoint(automount_tmp_t) @@ -10511,7 +10597,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.fc serefpolicy-3.3.1/policy/modules/services/avahi.fc --- nsaserefpolicy/policy/modules/services/avahi.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/avahi.fc 2008-04-21 11:02:48.721082000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/avahi.fc 2008-04-21 11:02:48.000000000 -0400 @@ -3,3 +3,7 @@ /usr/sbin/avahi-dnsconfd -- gen_context(system_u:object_r:avahi_exec_t,s0) @@ -10522,7 +10608,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.if serefpolicy-3.3.1/policy/modules/services/avahi.if --- nsaserefpolicy/policy/modules/services/avahi.if 2007-05-02 15:04:46.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/avahi.if 2008-04-21 11:02:48.726077000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/avahi.if 2008-04-21 11:02:48.000000000 -0400 @@ -57,3 +57,64 @@ dontaudit $1 avahi_var_run_t:dir search_dir_perms; @@ -10590,7 +10676,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.3.1/policy/modules/services/avahi.te --- nsaserefpolicy/policy/modules/services/avahi.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/avahi.te 2008-04-21 11:02:48.731072000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/avahi.te 2008-04-21 11:02:48.000000000 -0400 @@ -13,6 +13,9 @@ type avahi_var_run_t; files_pid_file(avahi_var_run_t) @@ -10620,7 +10706,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.3.1/policy/modules/services/bind.fc --- nsaserefpolicy/policy/modules/services/bind.fc 2007-10-15 16:11:05.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/bind.fc 2008-04-21 11:02:48.736067000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/bind.fc 2008-04-21 11:02:48.000000000 -0400 @@ -49,3 +49,5 @@ /var/named/chroot/var/log/named.* -- gen_context(system_u:object_r:named_log_t,s0) /var/named/dynamic(/.*)? gen_context(system_u:object_r:named_cache_t,s0) @@ -10629,7 +10715,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind +/etc/rc.d/init.d/named -- gen_context(system_u:object_r:named_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.if serefpolicy-3.3.1/policy/modules/services/bind.if --- nsaserefpolicy/policy/modules/services/bind.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/bind.if 2008-04-21 11:02:48.743060000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/bind.if 2008-04-21 11:02:48.000000000 -0400 @@ -254,3 +254,94 @@ interface(`bind_udp_chat_named',` refpolicywarn(`$0($*) has been deprecated.') @@ -10727,7 +10813,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.3.1/policy/modules/services/bind.te --- nsaserefpolicy/policy/modules/services/bind.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/bind.te 2008-04-21 11:02:48.749054000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/bind.te 2008-04-21 11:02:48.000000000 -0400 @@ -53,6 +53,9 @@ init_system_domain(ndc_t,ndc_exec_t) role system_r types ndc_t; @@ -10757,7 +10843,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind domain_use_interactive_fds(ndc_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.fc serefpolicy-3.3.1/policy/modules/services/bitlbee.fc --- nsaserefpolicy/policy/modules/services/bitlbee.fc 2007-09-17 15:56:47.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/bitlbee.fc 2008-04-21 11:02:48.754049000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/bitlbee.fc 2008-04-21 11:02:48.000000000 -0400 @@ -1,3 +1,6 @@ /usr/sbin/bitlbee -- gen_context(system_u:object_r:bitlbee_exec_t,s0) /etc/bitlbee(/.*)? gen_context(system_u:object_r:bitlbee_conf_t,s0) @@ -10767,7 +10853,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitl +/etc/rc.d/init.d/bitlbee -- gen_context(system_u:object_r:bitlbee_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.if serefpolicy-3.3.1/policy/modules/services/bitlbee.if --- nsaserefpolicy/policy/modules/services/bitlbee.if 2007-09-17 15:56:47.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/bitlbee.if 2008-04-21 11:02:48.759048000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/bitlbee.if 2008-04-21 11:02:48.000000000 -0400 @@ -20,3 +20,70 @@ allow $1 bitlbee_conf_t:file { read getattr }; ') @@ -10841,7 +10927,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitl + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.te serefpolicy-3.3.1/policy/modules/services/bitlbee.te --- nsaserefpolicy/policy/modules/services/bitlbee.te 2007-09-17 15:56:47.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/bitlbee.te 2008-04-21 11:02:48.765038000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/bitlbee.te 2008-04-21 11:02:48.000000000 -0400 @@ -17,6 +17,12 @@ type bitlbee_var_t; files_type(bitlbee_var_t) @@ -10895,7 +10981,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitl optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.fc serefpolicy-3.3.1/policy/modules/services/bluetooth.fc --- nsaserefpolicy/policy/modules/services/bluetooth.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/bluetooth.fc 2008-04-21 11:02:48.770034000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/bluetooth.fc 2008-04-21 11:02:48.000000000 -0400 @@ -22,3 +22,8 @@ # /var/lib/bluetooth(/.*)? gen_context(system_u:object_r:bluetooth_var_lib_t,s0) @@ -10907,7 +10993,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue +/etc/rc.d/init.d/pand -- gen_context(system_u:object_r:bluetooth_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.if serefpolicy-3.3.1/policy/modules/services/bluetooth.if --- nsaserefpolicy/policy/modules/services/bluetooth.if 2007-10-29 07:52:49.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/bluetooth.if 2008-04-21 11:02:48.776027000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/bluetooth.if 2008-04-21 11:02:48.000000000 -0400 @@ -35,7 +35,7 @@ template(`bluetooth_per_role_template',` gen_require(` @@ -11017,7 +11103,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.3.1/policy/modules/services/bluetooth.te --- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/bluetooth.te 2008-04-21 11:02:48.782021000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/bluetooth.te 2008-04-21 11:02:48.000000000 -0400 @@ -32,19 +32,22 @@ type bluetooth_var_run_t; files_pid_file(bluetooth_var_run_t) @@ -11086,7 +11172,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/canna.fc serefpolicy-3.3.1/policy/modules/services/canna.fc --- nsaserefpolicy/policy/modules/services/canna.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/canna.fc 2008-04-21 11:02:48.787016000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/canna.fc 2008-04-21 11:02:48.000000000 -0400 @@ -20,3 +20,5 @@ /var/run/\.iroha_unix -d gen_context(system_u:object_r:canna_var_run_t,s0) /var/run/\.iroha_unix/.* -s gen_context(system_u:object_r:canna_var_run_t,s0) @@ -11095,7 +11181,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cann +/etc/rc.d/init.d/canna -- gen_context(system_u:object_r:canna_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/canna.if serefpolicy-3.3.1/policy/modules/services/canna.if --- nsaserefpolicy/policy/modules/services/canna.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/canna.if 2008-04-21 11:02:48.792011000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/canna.if 2008-04-21 11:02:48.000000000 -0400 @@ -18,3 +18,74 @@ files_search_pids($1) stream_connect_pattern($1,canna_var_run_t,canna_var_run_t,canna_t) @@ -11173,7 +11259,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cann + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/canna.te serefpolicy-3.3.1/policy/modules/services/canna.te --- nsaserefpolicy/policy/modules/services/canna.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/canna.te 2008-04-21 11:02:48.806996000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/canna.te 2008-04-21 11:02:48.000000000 -0400 @@ -19,6 +19,9 @@ type canna_var_run_t; files_pid_file(canna_var_run_t) @@ -11186,7 +11272,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cann # Local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.fc serefpolicy-3.3.1/policy/modules/services/clamav.fc --- nsaserefpolicy/policy/modules/services/clamav.fc 2007-09-05 15:24:44.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/clamav.fc 2008-04-21 11:02:48.812990000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/clamav.fc 2008-04-21 11:02:48.000000000 -0400 @@ -5,16 +5,20 @@ /usr/bin/freshclam -- gen_context(system_u:object_r:freshclam_exec_t,s0) @@ -11212,7 +11298,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam +/etc/rc.d/init.d/clamd-wrapper -- gen_context(system_u:object_r:clamd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.if serefpolicy-3.3.1/policy/modules/services/clamav.if --- nsaserefpolicy/policy/modules/services/clamav.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/clamav.if 2008-04-21 11:02:48.818984000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/clamav.if 2008-04-21 11:02:48.000000000 -0400 @@ -38,6 +38,27 @@ ######################################## @@ -11360,7 +11446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.3.1/policy/modules/services/clamav.te --- nsaserefpolicy/policy/modules/services/clamav.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/clamav.te 2008-04-23 15:44:28.165531000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/clamav.te 2008-04-23 15:44:28.000000000 -0400 @@ -13,7 +13,7 @@ # configuration files @@ -11421,7 +11507,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.fc serefpolicy-3.3.1/policy/modules/services/consolekit.fc --- nsaserefpolicy/policy/modules/services/consolekit.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/consolekit.fc 2008-04-21 11:02:48.829973000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/consolekit.fc 2008-04-21 11:02:48.000000000 -0400 @@ -1,3 +1,6 @@ /usr/sbin/console-kit-daemon -- gen_context(system_u:object_r:consolekit_exec_t,s0) @@ -11431,7 +11517,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons +/var/log/ConsoleKit(/.*)? gen_context(system_u:object_r:consolekit_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.if serefpolicy-3.3.1/policy/modules/services/consolekit.if --- nsaserefpolicy/policy/modules/services/consolekit.if 2007-03-20 09:23:13.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/consolekit.if 2008-04-21 11:02:48.852950000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/consolekit.if 2008-04-21 11:02:48.000000000 -0400 @@ -38,3 +38,24 @@ allow $1 consolekit_t:dbus send_msg; allow consolekit_t $1:dbus send_msg; @@ -11459,7 +11545,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.3.1/policy/modules/services/consolekit.te --- nsaserefpolicy/policy/modules/services/consolekit.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/consolekit.te 2008-04-21 11:02:48.857945000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/consolekit.te 2008-04-21 11:02:48.000000000 -0400 @@ -13,6 +13,9 @@ type consolekit_var_run_t; files_pid_file(consolekit_var_run_t) @@ -11577,7 +11663,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.3.1/policy/modules/services/courier.te --- nsaserefpolicy/policy/modules/services/courier.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/courier.te 2008-04-23 15:44:33.699904000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/courier.te 2008-04-23 15:44:33.000000000 -0400 @@ -9,7 +9,7 @@ courier_domain_template(authdaemon) @@ -11589,7 +11675,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cour diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.3.1/policy/modules/services/cron.fc --- nsaserefpolicy/policy/modules/services/cron.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/cron.fc 2008-04-21 11:02:48.885917000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cron.fc 2008-04-21 11:02:48.000000000 -0400 @@ -17,6 +17,8 @@ /var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0) /var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) @@ -11606,7 +11692,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron +/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.3.1/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/cron.if 2008-04-24 15:33:13.461240000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cron.if 2008-04-24 15:33:13.000000000 -0400 @@ -35,38 +35,23 @@ # template(`cron_per_role_template',` @@ -11933,7 +12019,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.3.1/policy/modules/services/cron.te --- nsaserefpolicy/policy/modules/services/cron.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/cron.te 2008-04-21 11:02:48.898906000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cron.te 2008-04-21 11:02:48.000000000 -0400 @@ -12,14 +12,6 @@ ## @@ -12201,7 +12287,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron -') dnl end TODO diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.3.1/policy/modules/services/cups.fc --- nsaserefpolicy/policy/modules/services/cups.fc 2007-11-16 15:30:49.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/cups.fc 2008-04-21 11:02:48.904897000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cups.fc 2008-04-21 11:02:48.000000000 -0400 @@ -8,24 +8,28 @@ /etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -12260,7 +12346,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups +/usr/lib/cups/backend/cups-pdf -- gen_context(system_u:object_r:cups_pdf_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.if serefpolicy-3.3.1/policy/modules/services/cups.if --- nsaserefpolicy/policy/modules/services/cups.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/cups.if 2008-04-21 11:02:48.910892000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cups.if 2008-04-21 11:02:48.000000000 -0400 @@ -20,6 +20,30 @@ ######################################## @@ -12420,7 +12506,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.3.1/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/cups.te 2008-04-21 11:02:48.917885000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cups.te 2008-04-28 15:33:05.015286000 -0400 @@ -43,14 +43,13 @@ type cupsd_var_run_t; @@ -12723,7 +12809,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups optional_policy(` seutil_sigchld_newrole(hplip_t) -@@ -645,3 +691,39 @@ +@@ -645,3 +691,43 @@ optional_policy(` udev_read_db(ptal_t) ') @@ -12763,9 +12849,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups +lpd_manage_spool(cups_pdf_t) + +manage_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t) ++miscfiles_read_fonts(cups_pdf_t) ++ ++userdom_dontaudit_read_sysadm_home_content_files(cups_pdf_t) ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.if serefpolicy-3.3.1/policy/modules/services/cvs.if --- nsaserefpolicy/policy/modules/services/cvs.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/cvs.if 2008-04-21 11:02:48.922880000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cvs.if 2008-04-21 11:02:48.000000000 -0400 @@ -36,3 +36,72 @@ can_exec($1,cvs_exec_t) @@ -12841,7 +12931,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.3.1/policy/modules/services/cvs.te --- nsaserefpolicy/policy/modules/services/cvs.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/cvs.te 2008-04-21 11:02:48.927875000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cvs.te 2008-04-21 11:02:48.000000000 -0400 @@ -28,6 +28,9 @@ type cvs_var_run_t; files_pid_file(cvs_var_run_t) @@ -12883,13 +12973,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs. -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyphesis.fc serefpolicy-3.3.1/policy/modules/services/cyphesis.fc --- nsaserefpolicy/policy/modules/services/cyphesis.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/cyphesis.fc 2008-04-21 11:02:48.932870000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cyphesis.fc 2008-04-21 11:02:48.000000000 -0400 @@ -0,0 +1,2 @@ + +/usr/bin/cyphesis -- gen_context(system_u:object_r:cyphesis_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyphesis.if serefpolicy-3.3.1/policy/modules/services/cyphesis.if --- nsaserefpolicy/policy/modules/services/cyphesis.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/cyphesis.if 2008-04-21 11:02:48.936866000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cyphesis.if 2008-04-21 11:02:48.000000000 -0400 @@ -0,0 +1,19 @@ +## policy for cyphesis + @@ -12912,7 +13002,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyph +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyphesis.te serefpolicy-3.3.1/policy/modules/services/cyphesis.te --- nsaserefpolicy/policy/modules/services/cyphesis.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/cyphesis.te 2008-04-21 11:02:48.940862000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cyphesis.te 2008-04-21 11:02:48.000000000 -0400 @@ -0,0 +1,92 @@ +policy_module(cyphesis,1.0.0) + @@ -13008,7 +13098,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyph + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.fc serefpolicy-3.3.1/policy/modules/services/cyrus.fc --- nsaserefpolicy/policy/modules/services/cyrus.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/cyrus.fc 2008-04-21 11:02:48.944858000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cyrus.fc 2008-04-21 11:02:48.000000000 -0400 @@ -2,3 +2,5 @@ /usr/lib(64)?/cyrus-imapd/cyrus-master -- gen_context(system_u:object_r:cyrus_exec_t,s0) @@ -13017,7 +13107,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru +/etc/rc.d/init.d/cyrus -- gen_context(system_u:object_r:cyrus_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.if serefpolicy-3.3.1/policy/modules/services/cyrus.if --- nsaserefpolicy/policy/modules/services/cyrus.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/cyrus.if 2008-04-21 11:02:48.949853000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cyrus.if 2008-04-21 11:02:48.000000000 -0400 @@ -39,3 +39,74 @@ files_search_var_lib($1) stream_connect_pattern($1,cyrus_var_lib_t,cyrus_var_lib_t,cyrus_t) @@ -13095,7 +13185,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-3.3.1/policy/modules/services/cyrus.te --- nsaserefpolicy/policy/modules/services/cyrus.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/cyrus.te 2008-04-21 11:02:48.954847000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cyrus.te 2008-04-21 11:02:48.000000000 -0400 @@ -19,6 +19,9 @@ type cyrus_var_run_t; files_pid_file(cyrus_var_run_t) @@ -13108,7 +13198,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru # Local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.3.1/policy/modules/services/dbus.fc --- nsaserefpolicy/policy/modules/services/dbus.fc 2007-09-12 10:34:18.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/dbus.fc 2008-04-21 11:02:48.967835000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dbus.fc 2008-04-21 11:02:48.000000000 -0400 @@ -4,6 +4,9 @@ /usr/bin/dbus-daemon(-1)? -- gen_context(system_u:object_r:system_dbusd_exec_t,s0) /bin/dbus-daemon -- gen_context(system_u:object_r:system_dbusd_exec_t,s0) @@ -13121,7 +13211,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus /var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.3.1/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dbus.if 2008-04-21 12:08:05.940792000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dbus.if 2008-04-21 12:08:05.000000000 -0400 @@ -53,6 +53,7 @@ gen_require(` type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t; @@ -13388,7 +13478,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.3.1/policy/modules/services/dbus.te --- nsaserefpolicy/policy/modules/services/dbus.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dbus.te 2008-04-23 15:44:38.592767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dbus.te 2008-04-28 17:24:06.516754000 -0400 @@ -9,9 +9,10 @@ # # Delcarations @@ -13431,7 +13521,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus allow system_dbusd_t self:capability { dac_override setgid setpcap setuid }; dontaudit system_dbusd_t self:capability sys_tty_config; -allow system_dbusd_t self:process { getattr signal_perms setcap }; -+allow system_dbusd_t self:process { getattr signal_perms getcap setcap }; ++allow system_dbusd_t self:process { getattr signal_perms setpgid getcap setcap }; allow system_dbusd_t self:fifo_file { read write }; allow system_dbusd_t self:dbus { send_msg acquire_svc }; allow system_dbusd_t self:unix_stream_socket { connectto create_stream_socket_perms connectto }; @@ -13470,10 +13560,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus libs_use_ld_so(system_dbusd_t) libs_use_shared_libs(system_dbusd_t) -@@ -121,9 +139,32 @@ +@@ -121,9 +139,36 @@ ') optional_policy(` ++ networkmanager_init_script_domtrans_spec(system_dbusd_t) ++') ++ ++optional_policy(` + polkit_domtrans_auth(system_dbusd_t) + polkit_search_lib(system_dbusd_t) +') @@ -13505,7 +13599,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.if serefpolicy-3.3.1/policy/modules/services/dcc.if --- nsaserefpolicy/policy/modules/services/dcc.if 2007-03-26 10:39:05.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/dcc.if 2008-04-21 11:02:48.984819000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dcc.if 2008-04-21 11:02:48.000000000 -0400 @@ -72,6 +72,24 @@ ######################################## @@ -13533,7 +13627,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.te serefpolicy-3.3.1/policy/modules/services/dcc.te --- nsaserefpolicy/policy/modules/services/dcc.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dcc.te 2008-04-21 11:02:48.991811000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dcc.te 2008-04-21 11:02:48.000000000 -0400 @@ -105,6 +105,8 @@ files_read_etc_files(cdcc_t) files_read_etc_runtime_files(cdcc_t) @@ -13695,7 +13789,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ddclient.fc serefpolicy-3.3.1/policy/modules/services/ddclient.fc --- nsaserefpolicy/policy/modules/services/ddclient.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ddclient.fc 2008-04-21 11:02:48.996806000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ddclient.fc 2008-04-21 11:02:48.000000000 -0400 @@ -9,3 +9,5 @@ /var/log/ddtcd\.log.* -- gen_context(system_u:object_r:ddclient_log_t,s0) /var/run/ddclient\.pid -- gen_context(system_u:object_r:ddclient_var_run_t,s0) @@ -13704,7 +13798,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ddcl + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ddclient.if serefpolicy-3.3.1/policy/modules/services/ddclient.if --- nsaserefpolicy/policy/modules/services/ddclient.if 2007-03-26 10:39:04.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/ddclient.if 2008-04-21 11:02:49.001803000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ddclient.if 2008-04-21 11:02:49.000000000 -0400 @@ -18,3 +18,81 @@ corecmd_search_bin($1) domtrans_pattern($1, ddclient_exec_t, ddclient_t) @@ -13789,7 +13883,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ddcl +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ddclient.te serefpolicy-3.3.1/policy/modules/services/ddclient.te --- nsaserefpolicy/policy/modules/services/ddclient.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ddclient.te 2008-04-23 15:44:44.645621000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ddclient.te 2008-04-23 15:44:44.000000000 -0400 @@ -11,7 +11,7 @@ init_daemon_domain(ddclient_t,ddclient_exec_t) @@ -13811,7 +13905,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ddcl # Declarations diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.fc serefpolicy-3.3.1/policy/modules/services/dhcp.fc --- nsaserefpolicy/policy/modules/services/dhcp.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dhcp.fc 2008-04-21 11:02:49.011791000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dhcp.fc 2008-04-21 11:02:49.000000000 -0400 @@ -5,3 +5,6 @@ /var/lib/dhcp(3)?/dhcpd\.leases.* -- gen_context(system_u:object_r:dhcpd_state_t,s0) @@ -13821,7 +13915,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.if serefpolicy-3.3.1/policy/modules/services/dhcp.if --- nsaserefpolicy/policy/modules/services/dhcp.if 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dhcp.if 2008-04-21 11:02:49.016786000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dhcp.if 2008-04-21 11:02:49.000000000 -0400 @@ -19,3 +19,71 @@ sysnet_search_dhcp_state($1) allow $1 dhcpd_state_t:file setattr; @@ -13896,7 +13990,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.3.1/policy/modules/services/dhcp.te --- nsaserefpolicy/policy/modules/services/dhcp.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dhcp.te 2008-04-21 11:02:49.021781000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dhcp.te 2008-04-21 11:02:49.000000000 -0400 @@ -19,18 +19,20 @@ type dhcpd_var_run_t; files_pid_file(dhcpd_var_run_t) @@ -13962,7 +14056,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dictd.fc serefpolicy-3.3.1/policy/modules/services/dictd.fc --- nsaserefpolicy/policy/modules/services/dictd.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dictd.fc 2008-04-21 11:02:49.027775000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dictd.fc 2008-04-21 11:02:49.000000000 -0400 @@ -4,3 +4,6 @@ /usr/sbin/dictd -- gen_context(system_u:object_r:dictd_exec_t,s0) @@ -13972,7 +14066,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dict +/etc/rc.d/init.d/dictd -- gen_context(system_u:object_r:dictd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dictd.if serefpolicy-3.3.1/policy/modules/services/dictd.if --- nsaserefpolicy/policy/modules/services/dictd.if 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dictd.if 2008-04-21 11:02:49.032770000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dictd.if 2008-04-21 11:02:49.000000000 -0400 @@ -14,3 +14,73 @@ interface(`dictd_tcp_connect',` refpolicywarn(`$0($*) has been deprecated.') @@ -14049,7 +14143,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dict + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dictd.te serefpolicy-3.3.1/policy/modules/services/dictd.te --- nsaserefpolicy/policy/modules/services/dictd.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dictd.te 2008-04-21 11:02:49.037765000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dictd.te 2008-04-21 11:02:49.000000000 -0400 @@ -16,6 +16,12 @@ type dictd_var_lib_t alias var_lib_dictd_t; files_type(dictd_var_lib_t) @@ -14075,7 +14169,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dict diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.fc serefpolicy-3.3.1/policy/modules/services/dnsmasq.fc --- nsaserefpolicy/policy/modules/services/dnsmasq.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dnsmasq.fc 2008-04-21 11:02:49.042760000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dnsmasq.fc 2008-04-21 11:02:49.000000000 -0400 @@ -1,4 +1,7 @@ /usr/sbin/dnsmasq -- gen_context(system_u:object_r:dnsmasq_exec_t,s0) @@ -14086,7 +14180,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsm +/etc/rc.d/init.d/dnsmasq -- gen_context(system_u:object_r:dnsmasq_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.if serefpolicy-3.3.1/policy/modules/services/dnsmasq.if --- nsaserefpolicy/policy/modules/services/dnsmasq.if 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dnsmasq.if 2008-04-21 11:02:49.047755000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dnsmasq.if 2008-04-21 11:02:49.000000000 -0400 @@ -1 +1,125 @@ ## dnsmasq DNS forwarder and DHCP server + @@ -14215,7 +14309,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsm +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.3.1/policy/modules/services/dnsmasq.te --- nsaserefpolicy/policy/modules/services/dnsmasq.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dnsmasq.te 2008-04-21 11:02:49.052750000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dnsmasq.te 2008-04-21 11:02:49.000000000 -0400 @@ -16,6 +16,9 @@ type dnsmasq_var_run_t; files_pid_file(dnsmasq_var_run_t) @@ -14254,7 +14348,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsm +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.3.1/policy/modules/services/dovecot.fc --- nsaserefpolicy/policy/modules/services/dovecot.fc 2008-02-26 08:17:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dovecot.fc 2008-04-21 11:02:49.057745000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dovecot.fc 2008-04-21 11:02:49.000000000 -0400 @@ -17,23 +17,24 @@ ifdef(`distro_debian', ` @@ -14287,7 +14381,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove +/etc/rc.d/init.d/dovecot -- gen_context(system_u:object_r:dovecot_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.3.1/policy/modules/services/dovecot.if --- nsaserefpolicy/policy/modules/services/dovecot.if 2008-02-26 08:17:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dovecot.if 2008-04-21 11:02:49.062740000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dovecot.if 2008-04-21 11:02:49.000000000 -0400 @@ -21,7 +21,46 @@ ######################################## @@ -14428,7 +14522,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.3.1/policy/modules/services/dovecot.te --- nsaserefpolicy/policy/modules/services/dovecot.te 2008-02-26 08:17:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/dovecot.te 2008-04-21 11:02:49.069733000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/dovecot.te 2008-04-21 11:02:49.000000000 -0400 @@ -15,6 +15,12 @@ domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t) role system_r types dovecot_auth_t; @@ -14577,7 +14671,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.if serefpolicy-3.3.1/policy/modules/services/exim.if --- nsaserefpolicy/policy/modules/services/exim.if 2007-10-24 15:00:24.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/exim.if 2008-04-21 11:02:49.074728000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/exim.if 2008-04-21 11:02:49.000000000 -0400 @@ -97,6 +97,26 @@ ######################################## @@ -14607,7 +14701,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.3.1/policy/modules/services/exim.te --- nsaserefpolicy/policy/modules/services/exim.te 2007-10-24 15:17:31.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/exim.te 2008-04-21 11:02:49.081721000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/exim.te 2008-04-21 11:02:49.000000000 -0400 @@ -21,9 +21,20 @@ ## gen_tunable(exim_manage_user_files,false) @@ -14786,7 +14880,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.fc serefpolicy-3.3.1/policy/modules/services/fail2ban.fc --- nsaserefpolicy/policy/modules/services/fail2ban.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/fail2ban.fc 2008-04-21 11:02:49.086716000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/fail2ban.fc 2008-04-21 11:02:49.000000000 -0400 @@ -1,3 +1,7 @@ /usr/bin/fail2ban -- gen_context(system_u:object_r:fail2ban_exec_t,s0) +/usr/bin/fail2ban-server -- gen_context(system_u:object_r:fail2ban_exec_t,s0) @@ -14797,7 +14891,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.if serefpolicy-3.3.1/policy/modules/services/fail2ban.if --- nsaserefpolicy/policy/modules/services/fail2ban.if 2007-03-22 14:30:09.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/fail2ban.if 2008-04-21 11:02:49.091711000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/fail2ban.if 2008-04-21 11:02:49.000000000 -0400 @@ -78,3 +78,68 @@ files_search_pids($1) allow $1 fail2ban_var_run_t:file read_file_perms; @@ -14869,7 +14963,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.te serefpolicy-3.3.1/policy/modules/services/fail2ban.te --- nsaserefpolicy/policy/modules/services/fail2ban.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/fail2ban.te 2008-04-21 15:47:26.864308000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/fail2ban.te 2008-04-21 15:47:26.000000000 -0400 @@ -18,6 +18,9 @@ type fail2ban_var_run_t; files_pid_file(fail2ban_var_run_t) @@ -14942,7 +15036,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetchmail.fc serefpolicy-3.3.1/policy/modules/services/fetchmail.fc --- nsaserefpolicy/policy/modules/services/fetchmail.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/fetchmail.fc 2008-04-21 11:02:49.102700000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/fetchmail.fc 2008-04-21 11:02:49.000000000 -0400 @@ -17,3 +17,4 @@ /var/run/fetchmail/.* -- gen_context(system_u:object_r:fetchmail_var_run_t,s0) @@ -14950,7 +15044,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetc + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetchmail.if serefpolicy-3.3.1/policy/modules/services/fetchmail.if --- nsaserefpolicy/policy/modules/services/fetchmail.if 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/fetchmail.if 2008-04-21 11:02:49.107695000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/fetchmail.if 2008-04-21 11:02:49.000000000 -0400 @@ -1 +1,44 @@ ## Remote-mail retrieval and forwarding utility + @@ -14998,7 +15092,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetc +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetchmail.te serefpolicy-3.3.1/policy/modules/services/fetchmail.te --- nsaserefpolicy/policy/modules/services/fetchmail.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/fetchmail.te 2008-04-23 10:05:38.630717000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/fetchmail.te 2008-04-23 10:05:38.000000000 -0400 @@ -14,7 +14,7 @@ files_pid_file(fetchmail_var_run_t) @@ -15021,7 +15115,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.fc serefpolicy-3.3.1/policy/modules/services/ftp.fc --- nsaserefpolicy/policy/modules/services/ftp.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ftp.fc 2008-04-21 11:02:49.117685000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ftp.fc 2008-04-21 11:02:49.000000000 -0400 @@ -27,3 +27,6 @@ /var/log/vsftpd.* -- gen_context(system_u:object_r:xferlog_t,s0) /var/log/xferlog.* -- gen_context(system_u:object_r:xferlog_t,s0) @@ -15031,7 +15125,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. +/etc/rc.d/init.d/proftpd -- gen_context(system_u:object_r:ftp_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.if serefpolicy-3.3.1/policy/modules/services/ftp.if --- nsaserefpolicy/policy/modules/services/ftp.if 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/ftp.if 2008-04-21 11:02:49.123679000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ftp.if 2008-04-21 11:02:49.000000000 -0400 @@ -28,11 +28,13 @@ type ftpd_t; ') @@ -15150,7 +15244,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.3.1/policy/modules/services/ftp.te --- nsaserefpolicy/policy/modules/services/ftp.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ftp.te 2008-04-21 11:02:49.129673000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ftp.te 2008-04-21 11:02:49.000000000 -0400 @@ -75,6 +75,9 @@ type xferlog_t; logging_log_file(xferlog_t) @@ -15216,13 +15310,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.fc serefpolicy-3.3.1/policy/modules/services/gamin.fc --- nsaserefpolicy/policy/modules/services/gamin.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/gamin.fc 2008-04-21 11:02:49.145657000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/gamin.fc 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,2 @@ + +/usr/libexec/gam_server -- gen_context(system_u:object_r:gamin_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.if serefpolicy-3.3.1/policy/modules/services/gamin.if --- nsaserefpolicy/policy/modules/services/gamin.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/gamin.if 2008-04-21 11:02:49.149653000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/gamin.if 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,39 @@ + +## policy for gamin @@ -15265,7 +15359,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gami +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.te serefpolicy-3.3.1/policy/modules/services/gamin.te --- nsaserefpolicy/policy/modules/services/gamin.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/gamin.te 2008-04-21 11:02:49.153649000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/gamin.te 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,40 @@ +policy_module(gamin,1.0.0) + @@ -15309,14 +15403,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gami + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.fc serefpolicy-3.3.1/policy/modules/services/gnomeclock.fc --- nsaserefpolicy/policy/modules/services/gnomeclock.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/gnomeclock.fc 2008-04-21 11:02:49.157645000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/gnomeclock.fc 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,3 @@ + +/usr/libexec/gnome-clock-applet-mechanism -- gen_context(system_u:object_r:gnomeclock_exec_t,s0) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.if serefpolicy-3.3.1/policy/modules/services/gnomeclock.if --- nsaserefpolicy/policy/modules/services/gnomeclock.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/gnomeclock.if 2008-04-21 11:02:49.161641000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/gnomeclock.if 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,75 @@ + +## policy for gnomeclock @@ -15395,8 +15489,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnom +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.te serefpolicy-3.3.1/policy/modules/services/gnomeclock.te --- nsaserefpolicy/policy/modules/services/gnomeclock.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/gnomeclock.te 2008-04-21 11:02:49.165637000 -0400 -@@ -0,0 +1,53 @@ ++++ serefpolicy-3.3.1/policy/modules/services/gnomeclock.te 2008-04-28 10:32:02.385047000 -0400 +@@ -0,0 +1,55 @@ +policy_module(gnomeclock,1.0.0) +######################################## +# @@ -15412,7 +15506,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnom +# gnomeclock local policy +# +allow gnomeclock_t self:capability { sys_nice sys_time sys_ptrace }; -+allow gnomeclock_t self:process getsched; ++allow gnomeclock_t self:process { getattr getsched }; + +# internal communication is often done using fifo and unix sockets. +allow gnomeclock_t self:fifo_file rw_file_perms; @@ -15420,6 +15514,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnom + +corecmd_exec_bin(gnomeclock_t) + ++userdom_ptrace_all_users(gnomeclock_t) ++ +files_read_etc_files(gnomeclock_t) +files_read_usr_files(gnomeclock_t) + @@ -15452,7 +15548,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnom + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.3.1/policy/modules/services/hal.fc --- nsaserefpolicy/policy/modules/services/hal.fc 2007-11-14 08:17:58.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/hal.fc 2008-04-21 11:02:49.169633000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/hal.fc 2008-04-21 11:02:49.000000000 -0400 @@ -8,6 +8,7 @@ /usr/libexec/hal-hotplug-map -- gen_context(system_u:object_r:hald_exec_t,s0) /usr/libexec/hal-system-sonypic -- gen_context(system_u:object_r:hald_sonypic_exec_t,s0) @@ -15479,7 +15575,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.3.1/policy/modules/services/hal.if --- nsaserefpolicy/policy/modules/services/hal.if 2007-09-05 15:24:44.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/hal.if 2008-04-21 11:02:49.175627000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/hal.if 2008-04-21 11:02:49.000000000 -0400 @@ -302,3 +302,42 @@ files_search_pids($1) allow $1 hald_var_run_t:file rw_file_perms; @@ -15525,7 +15621,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.3.1/policy/modules/services/hal.te --- nsaserefpolicy/policy/modules/services/hal.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/hal.te 2008-04-21 11:02:49.181621000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/hal.te 2008-04-21 11:02:49.000000000 -0400 @@ -49,6 +49,9 @@ type hald_var_lib_t; files_type(hald_var_lib_t) @@ -15684,7 +15780,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. +cron_read_system_job_lib_files(hald_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.if serefpolicy-3.3.1/policy/modules/services/inetd.if --- nsaserefpolicy/policy/modules/services/inetd.if 2007-03-26 10:39:04.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/inetd.if 2008-04-21 11:02:49.187614000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/inetd.if 2008-04-21 11:02:49.000000000 -0400 @@ -115,6 +115,10 @@ allow $1 inetd_t:tcp_socket rw_stream_socket_perms; @@ -15698,7 +15794,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.3.1/policy/modules/services/inetd.te --- nsaserefpolicy/policy/modules/services/inetd.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/inetd.te 2008-04-21 11:02:49.193610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/inetd.te 2008-04-21 11:02:49.000000000 -0400 @@ -30,6 +30,10 @@ type inetd_child_var_run_t; files_pid_file(inetd_child_var_run_t) @@ -15754,7 +15850,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inn.fc serefpolicy-3.3.1/policy/modules/services/inn.fc --- nsaserefpolicy/policy/modules/services/inn.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/inn.fc 2008-04-21 11:02:49.199609000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/inn.fc 2008-04-21 11:02:49.000000000 -0400 @@ -64,3 +64,5 @@ /var/run/news(/.*)? gen_context(system_u:object_r:innd_var_run_t,s0) @@ -15763,7 +15859,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inn. +/etc/rc.d/init.d/innd -- gen_context(system_u:object_r:innd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inn.if serefpolicy-3.3.1/policy/modules/services/inn.if --- nsaserefpolicy/policy/modules/services/inn.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/inn.if 2008-04-21 11:02:49.205610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/inn.if 2008-04-21 11:02:49.000000000 -0400 @@ -54,8 +54,7 @@ ') @@ -15857,7 +15953,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inn. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inn.te serefpolicy-3.3.1/policy/modules/services/inn.te --- nsaserefpolicy/policy/modules/services/inn.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/inn.te 2008-04-21 11:02:49.210610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/inn.te 2008-04-21 11:02:49.000000000 -0400 @@ -22,7 +22,10 @@ files_pid_file(innd_var_run_t) @@ -15872,7 +15968,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inn. # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/jabber.fc serefpolicy-3.3.1/policy/modules/services/jabber.fc --- nsaserefpolicy/policy/modules/services/jabber.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/jabber.fc 2008-04-21 11:02:49.216610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/jabber.fc 2008-04-21 11:02:49.000000000 -0400 @@ -2,3 +2,4 @@ /var/lib/jabber(/.*)? gen_context(system_u:object_r:jabberd_var_lib_t,s0) @@ -15880,7 +15976,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/jabb +/etc/rc.d/init.d/jabber -- gen_context(system_u:object_r:jabber_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/jabber.if serefpolicy-3.3.1/policy/modules/services/jabber.if --- nsaserefpolicy/policy/modules/services/jabber.if 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/jabber.if 2008-04-21 11:02:49.221610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/jabber.if 2008-04-21 11:02:49.000000000 -0400 @@ -13,3 +13,73 @@ interface(`jabber_tcp_connect',` refpolicywarn(`$0($*) has been deprecated.') @@ -15957,7 +16053,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/jabb + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/jabber.te serefpolicy-3.3.1/policy/modules/services/jabber.te --- nsaserefpolicy/policy/modules/services/jabber.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/jabber.te 2008-04-21 11:02:49.226610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/jabber.te 2008-04-21 11:02:49.000000000 -0400 @@ -19,6 +19,9 @@ type jabberd_var_run_t; files_pid_file(jabberd_var_run_t) @@ -15970,7 +16066,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/jabb # Local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.fc serefpolicy-3.3.1/policy/modules/services/kerberos.fc --- nsaserefpolicy/policy/modules/services/kerberos.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/kerberos.fc 2008-04-21 11:02:49.231610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/kerberos.fc 2008-04-21 11:02:49.000000000 -0400 @@ -16,3 +16,9 @@ /var/log/krb5kdc\.log gen_context(system_u:object_r:krb5kdc_log_t,s0) @@ -15983,7 +16079,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb +/etc/rc.d/init.d/krb5kdc -- gen_context(system_u:object_r:kerberos_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-3.3.1/policy/modules/services/kerberos.if --- nsaserefpolicy/policy/modules/services/kerberos.if 2007-07-16 14:09:46.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/kerberos.if 2008-04-21 11:02:49.237610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/kerberos.if 2008-04-21 11:02:49.000000000 -0400 @@ -43,7 +43,14 @@ dontaudit $1 krb5kdc_conf_t:dir list_dir_perms; dontaudit $1 krb5kdc_conf_t:file rw_file_perms; @@ -16173,7 +16269,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.3.1/policy/modules/services/kerberos.te --- nsaserefpolicy/policy/modules/services/kerberos.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/kerberos.te 2008-04-21 11:02:49.243610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/kerberos.te 2008-04-21 11:02:49.000000000 -0400 @@ -54,6 +54,12 @@ type krb5kdc_var_run_t; files_pid_file(krb5kdc_var_run_t) @@ -16273,7 +16369,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.fc serefpolicy-3.3.1/policy/modules/services/kerneloops.fc --- nsaserefpolicy/policy/modules/services/kerneloops.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/kerneloops.fc 2008-04-21 11:02:49.248610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/kerneloops.fc 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,4 @@ + +/usr/sbin/kerneloops -- gen_context(system_u:object_r:kerneloops_exec_t,s0) @@ -16281,7 +16377,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kern +/etc/rc.d/init.d/kerneloops -- gen_context(system_u:object_r:kerneloops_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.if serefpolicy-3.3.1/policy/modules/services/kerneloops.if --- nsaserefpolicy/policy/modules/services/kerneloops.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/kerneloops.if 2008-04-21 11:02:49.252610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/kerneloops.if 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,125 @@ + +## policy for kerneloops @@ -16410,7 +16506,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kern +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.te serefpolicy-3.3.1/policy/modules/services/kerneloops.te --- nsaserefpolicy/policy/modules/services/kerneloops.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/kerneloops.te 2008-04-21 11:02:49.256611000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/kerneloops.te 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,57 @@ +policy_module(kerneloops,1.0.0) + @@ -16471,7 +16567,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kern + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.fc serefpolicy-3.3.1/policy/modules/services/ldap.fc --- nsaserefpolicy/policy/modules/services/ldap.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ldap.fc 2008-04-21 11:02:49.260611000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ldap.fc 2008-04-21 11:02:49.000000000 -0400 @@ -14,3 +14,5 @@ /var/run/openldap(/.*)? gen_context(system_u:object_r:slapd_var_run_t,s0) /var/run/slapd\.args -- gen_context(system_u:object_r:slapd_var_run_t,s0) @@ -16480,7 +16576,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap +/etc/rc.d/init.d/ldap -- gen_context(system_u:object_r:ldap_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.if serefpolicy-3.3.1/policy/modules/services/ldap.if --- nsaserefpolicy/policy/modules/services/ldap.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ldap.if 2008-04-21 11:02:49.265612000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ldap.if 2008-04-21 11:02:49.000000000 -0400 @@ -73,3 +73,80 @@ allow $1 slapd_var_run_t:sock_file write; allow $1 slapd_t:unix_stream_socket connectto; @@ -16564,7 +16660,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.te serefpolicy-3.3.1/policy/modules/services/ldap.te --- nsaserefpolicy/policy/modules/services/ldap.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ldap.te 2008-04-21 11:02:49.271609000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ldap.te 2008-04-21 11:02:49.000000000 -0400 @@ -31,6 +31,9 @@ type slapd_var_run_t; files_pid_file(slapd_var_run_t) @@ -16577,7 +16673,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap # Local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.fc serefpolicy-3.3.1/policy/modules/services/lpd.fc --- nsaserefpolicy/policy/modules/services/lpd.fc 2007-11-16 13:45:14.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/lpd.fc 2008-04-21 11:02:49.276612000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/lpd.fc 2008-04-21 11:02:49.000000000 -0400 @@ -22,11 +22,15 @@ /usr/sbin/lpinfo -- gen_context(system_u:object_r:lpr_exec_t,s0) /usr/sbin/lpmove -- gen_context(system_u:object_r:lpr_exec_t,s0) @@ -16596,7 +16692,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.3.1/policy/modules/services/lpd.if --- nsaserefpolicy/policy/modules/services/lpd.if 2007-11-16 13:45:14.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/lpd.if 2008-04-21 11:02:49.282612000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/lpd.if 2008-04-21 11:02:49.000000000 -0400 @@ -336,10 +336,8 @@ ') @@ -16611,7 +16707,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd. ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.fc serefpolicy-3.3.1/policy/modules/services/mailman.fc --- nsaserefpolicy/policy/modules/services/mailman.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/mailman.fc 2008-04-21 11:02:49.288612000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/mailman.fc 2008-04-21 11:02:49.000000000 -0400 @@ -31,3 +31,4 @@ /var/lock/mailman(/.*)? gen_context(system_u:object_r:mailman_lock_t,s0) /var/spool/mailman(/.*)? gen_context(system_u:object_r:mailman_data_t,s0) @@ -16619,7 +16715,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail +/usr/lib/mailman/mail/mailman -- gen_context(system_u:object_r:mailman_mail_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-3.3.1/policy/modules/services/mailman.if --- nsaserefpolicy/policy/modules/services/mailman.if 2007-12-04 11:02:50.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/mailman.if 2008-04-21 11:02:49.294611000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/mailman.if 2008-04-21 11:02:49.000000000 -0400 @@ -211,6 +211,7 @@ type mailman_data_t; ') @@ -16656,7 +16752,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.3.1/policy/modules/services/mailman.te --- nsaserefpolicy/policy/modules/services/mailman.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/mailman.te 2008-04-21 11:02:49.299610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/mailman.te 2008-04-21 11:02:49.000000000 -0400 @@ -53,10 +53,9 @@ apache_use_fds(mailman_cgi_t) apache_dontaudit_append_log(mailman_cgi_t) @@ -16688,13 +16784,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.3.1/policy/modules/services/mailscanner.fc --- nsaserefpolicy/policy/modules/services/mailscanner.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/mailscanner.fc 2008-04-21 11:02:49.305610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/mailscanner.fc 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,2 @@ +/var/spool/MailScanner(/.*)? gen_context(system_u:object_r:mailscanner_spool_t,s0) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.3.1/policy/modules/services/mailscanner.if --- nsaserefpolicy/policy/modules/services/mailscanner.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/mailscanner.if 2008-04-21 11:02:49.309610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/mailscanner.if 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,59 @@ +## Anti-Virus and Anti-Spam Filter + @@ -16757,7 +16853,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.3.1/policy/modules/services/mailscanner.te --- nsaserefpolicy/policy/modules/services/mailscanner.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/mailscanner.te 2008-04-21 11:02:49.313610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/mailscanner.te 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,5 @@ + +policy_module(mailscanner,1.0.0) @@ -16766,7 +16862,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail +files_type(mailscanner_spool_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.3.1/policy/modules/services/mta.fc --- nsaserefpolicy/policy/modules/services/mta.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/mta.fc 2008-04-21 11:02:49.317610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/mta.fc 2008-04-21 11:02:49.000000000 -0400 @@ -11,6 +11,7 @@ /usr/lib(64)?/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) @@ -16777,7 +16873,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.3.1/policy/modules/services/mta.if --- nsaserefpolicy/policy/modules/services/mta.if 2007-12-06 13:12:03.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/mta.if 2008-04-21 11:02:49.324610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/mta.if 2008-04-21 11:02:49.000000000 -0400 @@ -133,6 +133,12 @@ sendmail_create_log($1_mail_t) ') @@ -16949,7 +17045,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.3.1/policy/modules/services/mta.te --- nsaserefpolicy/policy/modules/services/mta.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/mta.te 2008-04-21 11:02:49.330610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/mta.te 2008-04-21 11:02:49.000000000 -0400 @@ -6,6 +6,8 @@ # Declarations # @@ -17087,7 +17183,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.fc serefpolicy-3.3.1/policy/modules/services/munin.fc --- nsaserefpolicy/policy/modules/services/munin.fc 2007-04-30 10:41:38.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/munin.fc 2008-04-21 11:02:49.335610000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/munin.fc 2008-04-21 11:02:49.000000000 -0400 @@ -6,6 +6,9 @@ /usr/share/munin/plugins/.* -- gen_context(system_u:object_r:munin_exec_t,s0) @@ -17102,7 +17198,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni +/etc/rc.d/init.d/munin-node -- gen_context(system_u:object_r:munin_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.if serefpolicy-3.3.1/policy/modules/services/munin.if --- nsaserefpolicy/policy/modules/services/munin.if 2007-11-15 13:40:14.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/munin.if 2008-04-21 11:02:49.340612000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/munin.if 2008-04-21 11:02:49.000000000 -0400 @@ -80,3 +80,85 @@ dontaudit $1 munin_var_lib_t:dir search_dir_perms; @@ -17191,7 +17287,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.te serefpolicy-3.3.1/policy/modules/services/munin.te --- nsaserefpolicy/policy/modules/services/munin.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/munin.te 2008-04-21 11:02:49.347609000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/munin.te 2008-04-21 11:02:49.000000000 -0400 @@ -25,26 +25,33 @@ type munin_var_run_t alias lrrd_var_run_t; files_pid_file(munin_var_run_t) @@ -17316,7 +17412,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni +manage_files_pattern(munin_t, httpd_munin_content_t, httpd_munin_content_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.fc serefpolicy-3.3.1/policy/modules/services/mysql.fc --- nsaserefpolicy/policy/modules/services/mysql.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/mysql.fc 2008-04-21 11:02:49.355606000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/mysql.fc 2008-04-21 11:02:49.000000000 -0400 @@ -22,3 +22,5 @@ /var/log/mysql.* -- gen_context(system_u:object_r:mysqld_log_t,s0) @@ -17325,8 +17421,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq +/etc/rc\.d/init\.d/mysqld -- gen_context(system_u:object_r:mysqld_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.if serefpolicy-3.3.1/policy/modules/services/mysql.if --- nsaserefpolicy/policy/modules/services/mysql.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/mysql.if 2008-04-21 14:56:36.040978000 -0400 -@@ -157,3 +157,74 @@ ++++ serefpolicy-3.3.1/policy/modules/services/mysql.if 2008-04-28 14:00:53.714473000 -0400 +@@ -32,9 +32,11 @@ + interface(`mysql_stream_connect',` + gen_require(` + type mysqld_t, mysqld_var_run_t; ++ type mysqld_db_t; + ') + + stream_connect_pattern($1,mysqld_var_run_t,mysqld_var_run_t,mysqld_t) ++ stream_connect_pattern($1, mysqld_db_t, mysqld_var_run_t, mysqld_t) + ') + + ######################################## +@@ -157,3 +159,74 @@ logging_search_logs($1) allow $1 mysqld_log_t:file { write append setattr ioctl }; ') @@ -17403,7 +17511,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.3.1/policy/modules/services/mysql.te --- nsaserefpolicy/policy/modules/services/mysql.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/mysql.te 2008-04-21 11:02:49.407555000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/mysql.te 2008-04-21 11:02:49.000000000 -0400 @@ -25,6 +25,9 @@ type mysqld_tmp_t; files_tmp_file(mysqld_tmp_t) @@ -17434,7 +17542,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.3.1/policy/modules/services/nagios.fc --- nsaserefpolicy/policy/modules/services/nagios.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/nagios.fc 2008-04-21 11:02:49.413549000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/nagios.fc 2008-04-21 11:02:49.000000000 -0400 @@ -4,13 +4,19 @@ /usr/bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0) /usr/bin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0) @@ -17460,7 +17568,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.3.1/policy/modules/services/nagios.if --- nsaserefpolicy/policy/modules/services/nagios.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/nagios.if 2008-04-21 11:02:49.418544000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/nagios.if 2008-04-21 11:02:49.000000000 -0400 @@ -44,7 +44,7 @@ ######################################## @@ -17572,7 +17680,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.3.1/policy/modules/services/nagios.te --- nsaserefpolicy/policy/modules/services/nagios.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/nagios.te 2008-04-21 11:02:49.425535000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/nagios.te 2008-04-21 11:02:49.000000000 -0400 @@ -8,11 +8,7 @@ type nagios_t; @@ -17678,7 +17786,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.3.1/policy/modules/services/networkmanager.fc --- nsaserefpolicy/policy/modules/services/networkmanager.fc 2007-09-12 10:34:18.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/networkmanager.fc 2008-04-21 11:02:49.430532000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/networkmanager.fc 2008-04-28 17:01:05.578193000 -0400 @@ -1,7 +1,11 @@ /usr/s?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) /usr/s?bin/wpa_supplicant -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) @@ -17693,8 +17801,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw +/etc/NetworkManager/dispatcher.d(/.*) gen_context(system_u:object_r:NetworkManager_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.3.1/policy/modules/services/networkmanager.if --- nsaserefpolicy/policy/modules/services/networkmanager.if 2007-06-12 10:15:45.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/networkmanager.if 2008-04-21 11:02:49.435527000 -0400 -@@ -97,3 +97,21 @@ ++++ serefpolicy-3.3.1/policy/modules/services/networkmanager.if 2008-04-28 17:23:33.835317000 -0400 +@@ -97,3 +97,40 @@ allow $1 NetworkManager_t:dbus send_msg; allow NetworkManager_t $1:dbus send_msg; ') @@ -17716,9 +17824,28 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw + + allow $1 NetworkManager_t:process signal; +') ++ ++######################################## ++## ++## Execute NetworkManager scripts with an automatic domain transition to initrc. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`networkmanager_init_script_domtrans_spec',` ++ gen_require(` ++ type NetworkManager_script_exec_t; ++ ') ++ ++ init_script_domtrans_spec($1, NetworkManager_script_exec_t) ++') ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.3.1/policy/modules/services/networkmanager.te --- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/networkmanager.te 2008-04-21 11:02:49.441519000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/networkmanager.te 2008-04-28 17:20:44.106667000 -0400 @@ -13,6 +13,13 @@ type NetworkManager_var_run_t; files_pid_file(NetworkManager_var_run_t) @@ -17728,7 +17855,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw + +type NetworkManager_script_exec_t; +init_script_type(NetworkManager_script_exec_t) -+init_script_domtrans_spec(NetworkManager_t,httpd_script_exec_t) ++init_script_domtrans_spec(NetworkManager_t, NetworkManager_script_exec_t) + ######################################## # @@ -17842,7 +17969,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.3.1/policy/modules/services/nis.fc --- nsaserefpolicy/policy/modules/services/nis.fc 2007-02-19 11:32:53.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/nis.fc 2008-04-21 11:02:49.446515000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/nis.fc 2008-04-21 11:02:49.000000000 -0400 @@ -4,9 +4,14 @@ /sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0) @@ -17860,7 +17987,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. +/etc/rc.d/init.d/ypxfrd -- gen_context(system_u:object_r:nis_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.3.1/policy/modules/services/nis.if --- nsaserefpolicy/policy/modules/services/nis.if 2007-07-16 14:09:46.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/nis.if 2008-04-21 11:02:49.452509000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/nis.if 2008-04-21 11:02:49.000000000 -0400 @@ -49,8 +49,8 @@ corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) @@ -17994,7 +18121,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.3.1/policy/modules/services/nis.te --- nsaserefpolicy/policy/modules/services/nis.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/nis.te 2008-04-21 11:02:49.458504000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/nis.te 2008-04-21 11:02:49.000000000 -0400 @@ -44,6 +44,9 @@ type ypxfr_exec_t; init_daemon_domain(ypxfr_t,ypxfr_exec_t) @@ -18062,7 +18189,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_tcp_connect_all_ports(ypxfr_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.fc serefpolicy-3.3.1/policy/modules/services/nscd.fc --- nsaserefpolicy/policy/modules/services/nscd.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/nscd.fc 2008-04-21 11:02:49.462502000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/nscd.fc 2008-04-21 11:02:49.000000000 -0400 @@ -9,3 +9,5 @@ /var/run/\.nscd_socket -s gen_context(system_u:object_r:nscd_var_run_t,s0) @@ -18071,7 +18198,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd +/etc/rc\.d/init\.d/nscd -- gen_context(system_u:object_r:nscd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.3.1/policy/modules/services/nscd.if --- nsaserefpolicy/policy/modules/services/nscd.if 2007-03-26 10:39:04.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/nscd.if 2008-04-21 11:02:49.468492000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/nscd.if 2008-04-21 11:02:49.000000000 -0400 @@ -70,15 +70,14 @@ interface(`nscd_socket_use',` gen_require(` @@ -18161,7 +18288,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.3.1/policy/modules/services/nscd.te --- nsaserefpolicy/policy/modules/services/nscd.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/nscd.te 2008-04-21 11:02:49.473487000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/nscd.te 2008-04-21 11:02:49.000000000 -0400 @@ -23,19 +23,22 @@ type nscd_log_t; logging_log_file(nscd_log_t) @@ -18228,7 +18355,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.3.1/policy/modules/services/ntp.fc --- nsaserefpolicy/policy/modules/services/ntp.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ntp.fc 2008-04-21 11:02:49.479481000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ntp.fc 2008-04-21 11:02:49.000000000 -0400 @@ -17,3 +17,8 @@ /var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0) @@ -18240,7 +18367,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. +/etc/rc\.d/init\.d/ntpd -- gen_context(system_u:object_r:ntpd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.if serefpolicy-3.3.1/policy/modules/services/ntp.if --- nsaserefpolicy/policy/modules/services/ntp.if 2007-03-26 10:39:05.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/ntp.if 2008-04-21 11:02:49.484476000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ntp.if 2008-04-21 11:02:49.000000000 -0400 @@ -53,3 +53,76 @@ corecmd_search_bin($1) domtrans_pattern($1,ntpdate_exec_t,ntpd_t) @@ -18320,7 +18447,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.3.1/policy/modules/services/ntp.te --- nsaserefpolicy/policy/modules/services/ntp.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ntp.te 2008-04-21 11:02:49.489471000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ntp.te 2008-04-21 11:02:49.000000000 -0400 @@ -25,6 +25,12 @@ type ntpdate_exec_t; init_system_domain(ntpd_t,ntpdate_exec_t) @@ -18387,7 +18514,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.fc serefpolicy-3.3.1/policy/modules/services/nx.fc --- nsaserefpolicy/policy/modules/services/nx.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/nx.fc 2008-04-21 11:02:49.495466000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/nx.fc 2008-04-21 11:02:49.000000000 -0400 @@ -1,3 +1,5 @@ + +/usr/libexec/nx/nxserver -- gen_context(system_u:object_r:nx_server_exec_t,s0) @@ -18396,7 +18523,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.f /opt/NX/home/nx/\.ssh(/.*)? gen_context(system_u:object_r:nx_server_home_ssh_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oav.te serefpolicy-3.3.1/policy/modules/services/oav.te --- nsaserefpolicy/policy/modules/services/oav.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/oav.te 2008-04-23 10:05:51.242047000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/oav.te 2008-04-23 10:05:51.000000000 -0400 @@ -12,7 +12,7 @@ # cjp: may be collapsable to etc_t @@ -18417,7 +18544,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oav. logging_log_file(scannerdaemon_log_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.fc serefpolicy-3.3.1/policy/modules/services/oddjob.fc --- nsaserefpolicy/policy/modules/services/oddjob.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/oddjob.fc 2008-04-21 11:02:49.500460000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/oddjob.fc 2008-04-21 11:02:49.000000000 -0400 @@ -1,4 +1,4 @@ -/usr/lib/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0) +/usr/lib(64)?/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0) @@ -18426,7 +18553,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.if serefpolicy-3.3.1/policy/modules/services/oddjob.if --- nsaserefpolicy/policy/modules/services/oddjob.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/oddjob.if 2008-04-21 11:02:49.504456000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/oddjob.if 2008-04-21 11:02:49.000000000 -0400 @@ -44,6 +44,7 @@ ') @@ -18437,7 +18564,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-3.3.1/policy/modules/services/oddjob.te --- nsaserefpolicy/policy/modules/services/oddjob.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/oddjob.te 2008-04-21 11:02:49.509451000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/oddjob.te 2008-04-21 11:02:49.000000000 -0400 @@ -10,14 +10,20 @@ type oddjob_exec_t; domain_type(oddjob_t) @@ -18505,7 +18632,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj userdom_generic_user_home_dir_filetrans_generic_user_home_content(oddjob_mkhomedir_t,notdevfile_class_set) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openca.te serefpolicy-3.3.1/policy/modules/services/openca.te --- nsaserefpolicy/policy/modules/services/openca.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/openca.te 2008-04-23 10:06:13.680203000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/openca.te 2008-04-23 10:06:13.000000000 -0400 @@ -18,7 +18,7 @@ # /etc/openca standard files @@ -18517,7 +18644,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open type openca_etc_in_t; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-3.3.1/policy/modules/services/openct.te --- nsaserefpolicy/policy/modules/services/openct.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/openct.te 2008-04-21 11:02:49.515445000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/openct.te 2008-04-21 11:02:49.000000000 -0400 @@ -22,6 +22,7 @@ allow openct_t self:process signal_perms; @@ -18528,7 +18655,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open kernel_read_kernel_sysctls(openct_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.fc serefpolicy-3.3.1/policy/modules/services/openvpn.fc --- nsaserefpolicy/policy/modules/services/openvpn.fc 2007-06-11 16:05:22.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/openvpn.fc 2008-04-21 11:02:49.527433000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/openvpn.fc 2008-04-21 11:02:49.000000000 -0400 @@ -11,5 +11,7 @@ # # /var @@ -18540,7 +18667,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open +/etc/rc.d/init.d/openvpn -- gen_context(system_u:object_r:openvpn_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-3.3.1/policy/modules/services/openvpn.if --- nsaserefpolicy/policy/modules/services/openvpn.if 2007-09-12 10:34:18.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/openvpn.if 2008-04-21 11:02:49.532428000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/openvpn.if 2008-04-21 11:02:49.000000000 -0400 @@ -90,3 +90,74 @@ read_files_pattern($1,openvpn_etc_t,openvpn_etc_t) read_lnk_files_pattern($1,openvpn_etc_t,openvpn_etc_t) @@ -18618,7 +18745,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.3.1/policy/modules/services/openvpn.te --- nsaserefpolicy/policy/modules/services/openvpn.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/openvpn.te 2008-04-23 10:08:10.784604000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/openvpn.te 2008-04-23 10:08:10.000000000 -0400 @@ -8,7 +8,7 @@ ## @@ -18685,7 +18812,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-3.3.1/policy/modules/services/pcscd.te --- nsaserefpolicy/policy/modules/services/pcscd.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/pcscd.te 2008-04-21 11:02:49.544416000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/pcscd.te 2008-04-21 11:02:49.000000000 -0400 @@ -45,6 +45,7 @@ files_read_etc_files(pcscd_t) files_read_etc_runtime_files(pcscd_t) @@ -18696,7 +18823,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcsc libs_use_ld_so(pcscd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.3.1/policy/modules/services/pegasus.te --- nsaserefpolicy/policy/modules/services/pegasus.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/pegasus.te 2008-04-21 11:02:49.550409000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/pegasus.te 2008-04-21 11:02:49.000000000 -0400 @@ -42,6 +42,7 @@ allow pegasus_t pegasus_conf_t:file { read_file_perms link unlink }; allow pegasus_t pegasus_conf_t:lnk_file read_lnk_file_perms; @@ -18745,11 +18872,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.fc serefpolicy-3.3.1/policy/modules/services/polkit.fc --- nsaserefpolicy/policy/modules/services/polkit.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/polkit.fc 2008-04-21 11:02:49.555405000 -0400 -@@ -0,0 +1,8 @@ ++++ serefpolicy-3.3.1/policy/modules/services/polkit.fc 2008-04-28 15:14:56.271771000 -0400 +@@ -0,0 +1,9 @@ + +/usr/libexec/polkit-read-auth-helper -- gen_context(system_u:object_r:polkit_auth_exec_t,s0) +/usr/libexec/polkit-grant-helper.* -- gen_context(system_u:object_r:polkit_grant_exec_t,s0) ++/usr/libexec/polkit-resolve-exe-helper.* -- gen_context(system_u:object_r:polkit_resolve_exec_t,s0) +/usr/libexec/polkitd -- gen_context(system_u:object_r:polkit_exec_t,s0) + +/var/lib/PolicyKit(/.*)? gen_context(system_u:object_r:polkit_var_lib_t,s0) @@ -18757,8 +18885,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk +/var/lib/PolicyKit-public(/.*)? gen_context(system_u:object_r:polkit_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.if serefpolicy-3.3.1/policy/modules/services/polkit.if --- nsaserefpolicy/policy/modules/services/polkit.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/polkit.if 2008-04-21 11:02:49.560399000 -0400 -@@ -0,0 +1,189 @@ ++++ serefpolicy-3.3.1/policy/modules/services/polkit.if 2008-04-28 15:56:30.712486000 -0400 +@@ -0,0 +1,208 @@ + +## policy for polkit_auth + @@ -18843,6 +18971,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk + +######################################## +## ++## Execute a domain transition to run polkit_resolve. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`polkit_domtrans_resolve',` ++ gen_require(` ++ type polkit_resolve_t; ++ type polkit_resolve_exec_t; ++ ') ++ ++ domtrans_pattern($1,polkit_resolve_exec_t,polkit_resolve_t) ++') ++ ++######################################## ++## +## Execute a policy_grant in the policy_grant domain, and +## allow the specified role the policy_grant domain, +## and use the caller's terminal. @@ -18950,8 +19097,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.te serefpolicy-3.3.1/policy/modules/services/polkit.te --- nsaserefpolicy/policy/modules/services/polkit.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/polkit.te 2008-04-21 11:02:49.565394000 -0400 -@@ -0,0 +1,157 @@ ++++ serefpolicy-3.3.1/policy/modules/services/polkit.te 2008-04-28 16:10:18.292199000 -0400 +@@ -0,0 +1,190 @@ +policy_module(polkit_auth,1.0.0) + +######################################## @@ -18967,6 +19114,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk +type polkit_grant_exec_t; +init_system_domain(polkit_grant_t, polkit_grant_exec_t) + ++type polkit_resolve_t; ++type polkit_resolve_exec_t; ++init_system_domain(polkit_resolve_t, polkit_resolve_exec_t) ++ +type polkit_auth_t; +type polkit_auth_exec_t; +init_daemon_domain(polkit_auth_t, polkit_auth_exec_t) @@ -18989,7 +19140,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk +allow polkit_t self:unix_stream_socket create_stream_socket_perms; + +can_exec(polkit_t, polkit_exec_t) -+corecmd_search_bin(polkit_t) ++corecmd_exec_bin(polkit_t) + +domain_use_interactive_fds(polkit_t) + @@ -19024,7 +19175,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk +# polkit_auth local policy +# + -+allow polkit_auth_t self:process getattr; ++allow polkit_auth_t self:capability setgid; ++allow polkit_auth_t self:process { getattr }; + +allow polkit_auth_t self:unix_dgram_socket create_socket_perms; +allow polkit_auth_t self:fifo_file rw_file_perms; @@ -19099,6 +19251,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk +polkit_domtrans_auth(polkit_grant_t) + +manage_files_pattern(polkit_grant_t, polkit_var_lib_t, polkit_var_lib_t) ++userdom_read_all_users_state(polkit_grant_t) + +optional_policy(` + dbus_system_bus_client_template(polkit_grant, polkit_grant_t) @@ -19109,9 +19262,36 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk + type system_crond_var_lib_t; +') +manage_files_pattern(polkit_grant_t, system_crond_var_lib_t, system_crond_var_lib_t) ++ ++######################################## ++# ++# polkit_resolve local policy ++# ++ ++allow polkit_resolve_t self:capability setuid; ++allow polkit_resolve_t self:process getattr; ++ ++allow polkit_resolve_t self:unix_dgram_socket create_socket_perms; ++allow polkit_resolve_t self:fifo_file rw_file_perms; ++allow polkit_resolve_t self:unix_stream_socket create_stream_socket_perms; ++ ++can_exec(polkit_resolve_t, polkit_resolve_exec_t) ++corecmd_search_bin(polkit_resolve_t) ++ ++files_read_etc_files(polkit_resolve_t) ++files_read_usr_files(polkit_resolve_t) ++ ++auth_use_nsswitch(polkit_resolve_t) ++ ++libs_use_ld_so(polkit_resolve_t) ++libs_use_shared_libs(polkit_resolve_t) ++ ++miscfiles_read_localization(polkit_resolve_t) ++ ++logging_send_syslog_msg(polkit_resolve_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.3.1/policy/modules/services/portslave.te --- nsaserefpolicy/policy/modules/services/portslave.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/portslave.te 2008-04-23 10:08:09.033037000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/portslave.te 2008-04-23 10:08:09.000000000 -0400 @@ -12,7 +12,7 @@ init_daemon_domain(portslave_t,portslave_exec_t) @@ -19123,7 +19303,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port files_lock_file(portslave_lock_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.3.1/policy/modules/services/postfix.fc --- nsaserefpolicy/policy/modules/services/postfix.fc 2007-09-12 10:34:18.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/postfix.fc 2008-04-21 11:02:49.570389000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/postfix.fc 2008-04-21 11:02:49.000000000 -0400 @@ -29,12 +29,10 @@ /usr/lib/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0) /usr/lib/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0) @@ -19139,7 +19319,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post /usr/sbin/postkick -- gen_context(system_u:object_r:postfix_master_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.3.1/policy/modules/services/postfix.if --- nsaserefpolicy/policy/modules/services/postfix.if 2007-12-04 11:02:50.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/postfix.if 2008-04-21 11:02:49.576384000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/postfix.if 2008-04-21 11:02:49.000000000 -0400 @@ -206,9 +206,8 @@ type postfix_etc_t; ') @@ -19216,7 +19396,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.3.1/policy/modules/services/postfix.te --- nsaserefpolicy/policy/modules/services/postfix.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/postfix.te 2008-04-23 15:05:37.257075000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/postfix.te 2008-04-23 15:05:37.000000000 -0400 @@ -6,6 +6,14 @@ # Declarations # @@ -19408,7 +19588,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post corecmd_exec_bin(postfix_virtual_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfixpolicyd.fc serefpolicy-3.3.1/policy/modules/services/postfixpolicyd.fc --- nsaserefpolicy/policy/modules/services/postfixpolicyd.fc 2007-11-08 09:29:27.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/postfixpolicyd.fc 2008-04-21 11:02:49.588372000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/postfixpolicyd.fc 2008-04-21 11:02:49.000000000 -0400 @@ -3,3 +3,5 @@ /usr/sbin/policyd -- gen_context(system_u:object_r:postfix_policyd_exec_t, s0) @@ -19417,7 +19597,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +/etc/rc.d/init.d/postfixpolicyd -- gen_context(system_u:object_r:postfixpolicyd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfixpolicyd.if serefpolicy-3.3.1/policy/modules/services/postfixpolicyd.if --- nsaserefpolicy/policy/modules/services/postfixpolicyd.if 2007-11-08 09:29:27.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/postfixpolicyd.if 2008-04-21 11:02:49.593367000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/postfixpolicyd.if 2008-04-21 11:02:49.000000000 -0400 @@ -1 +1,68 @@ ## Postfix policy server + @@ -19489,7 +19669,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfixpolicyd.te serefpolicy-3.3.1/policy/modules/services/postfixpolicyd.te --- nsaserefpolicy/policy/modules/services/postfixpolicyd.te 2007-11-08 09:29:27.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/postfixpolicyd.te 2008-04-21 11:02:49.598362000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/postfixpolicyd.te 2008-04-21 11:02:49.000000000 -0400 @@ -16,6 +16,9 @@ type postfix_policyd_var_run_t; files_pid_file(postfix_policyd_var_run_t) @@ -19502,7 +19682,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post # Local Policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.fc serefpolicy-3.3.1/policy/modules/services/postgresql.fc --- nsaserefpolicy/policy/modules/services/postgresql.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/postgresql.fc 2008-04-21 11:02:49.603357000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/postgresql.fc 2008-04-21 11:02:49.000000000 -0400 @@ -31,6 +31,7 @@ /var/lib/pgsql/pgstartup\.log gen_context(system_u:object_r:postgresql_log_t,s0) @@ -19519,7 +19699,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +/etc/rc\.d/init\.d/postgresql -- gen_context(system_u:object_r:postgresql_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.3.1/policy/modules/services/postgresql.if --- nsaserefpolicy/policy/modules/services/postgresql.if 2007-11-29 13:29:35.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/postgresql.if 2008-04-21 11:02:49.609351000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/postgresql.if 2008-04-21 11:02:49.000000000 -0400 @@ -120,3 +120,72 @@ # Some versions of postgresql put the sock file in /tmp allow $1 postgresql_tmp_t:sock_file write; @@ -19595,7 +19775,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.3.1/policy/modules/services/postgresql.te --- nsaserefpolicy/policy/modules/services/postgresql.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/postgresql.te 2008-04-21 11:02:49.613347000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/postgresql.te 2008-04-21 11:02:49.000000000 -0400 @@ -27,6 +27,9 @@ type postgresql_var_run_t; files_pid_file(postgresql_var_run_t) @@ -19616,7 +19796,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgrey.fc serefpolicy-3.3.1/policy/modules/services/postgrey.fc --- nsaserefpolicy/policy/modules/services/postgrey.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/postgrey.fc 2008-04-21 11:02:49.618342000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/postgrey.fc 2008-04-21 11:02:49.000000000 -0400 @@ -7,3 +7,7 @@ /var/run/postgrey(/.*)? gen_context(system_u:object_r:postgrey_var_run_t,s0) @@ -19627,7 +19807,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +/var/spool/postfix/postgrey(/.*)? gen_context(system_u:object_r:postgrey_spool_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgrey.if serefpolicy-3.3.1/policy/modules/services/postgrey.if --- nsaserefpolicy/policy/modules/services/postgrey.if 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/postgrey.if 2008-04-21 11:02:49.623343000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/postgrey.if 2008-04-21 11:02:49.000000000 -0400 @@ -12,10 +12,82 @@ # interface(`postgrey_stream_connect',` @@ -19714,7 +19894,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgrey.te serefpolicy-3.3.1/policy/modules/services/postgrey.te --- nsaserefpolicy/policy/modules/services/postgrey.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/postgrey.te 2008-04-21 11:02:49.629331000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/postgrey.te 2008-04-21 11:02:49.000000000 -0400 @@ -13,26 +13,38 @@ type postgrey_etc_t; files_config_file(postgrey_etc_t) @@ -19769,7 +19949,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.fc serefpolicy-3.3.1/policy/modules/services/ppp.fc --- nsaserefpolicy/policy/modules/services/ppp.fc 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ppp.fc 2008-04-21 11:02:49.646314000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ppp.fc 2008-04-21 11:02:49.000000000 -0400 @@ -33,3 +33,5 @@ /var/log/ppp-connect-errors.* -- gen_context(system_u:object_r:pppd_log_t,s0) @@ -19778,7 +19958,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. +/etc/rc.d/init.d/ppp -- gen_context(system_u:object_r:pppd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.if serefpolicy-3.3.1/policy/modules/services/ppp.if --- nsaserefpolicy/policy/modules/services/ppp.if 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ppp.if 2008-04-21 11:02:49.652308000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ppp.if 2008-04-21 11:02:49.000000000 -0400 @@ -297,38 +297,42 @@ type pppd_t, pppd_tmp_t, pppd_log_t, pppd_lock_t; type pppd_etc_t, pppd_script_t, pppd_secret_t; @@ -19838,7 +20018,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.3.1/policy/modules/services/ppp.te --- nsaserefpolicy/policy/modules/services/ppp.te 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ppp.te 2008-04-21 11:02:49.658303000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ppp.te 2008-04-21 11:02:49.000000000 -0400 @@ -196,6 +196,12 @@ optional_policy(` @@ -19881,7 +20061,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.fc serefpolicy-3.3.1/policy/modules/services/prelude.fc --- nsaserefpolicy/policy/modules/services/prelude.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/prelude.fc 2008-04-21 11:02:49.663297000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/prelude.fc 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,13 @@ + +/sbin/audisp-prelude -- gen_context(system_u:object_r:audisp_prelude_exec_t,s0) @@ -19898,7 +20078,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel +/usr/share/prewikka/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_prewikka_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.if serefpolicy-3.3.1/policy/modules/services/prelude.if --- nsaserefpolicy/policy/modules/services/prelude.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/prelude.if 2008-04-21 11:02:49.667293000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/prelude.if 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,128 @@ + +## policy for prelude @@ -20030,7 +20210,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.3.1/policy/modules/services/prelude.te --- nsaserefpolicy/policy/modules/services/prelude.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/prelude.te 2008-04-21 11:02:49.673286000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/prelude.te 2008-04-21 11:02:49.000000000 -0400 @@ -0,0 +1,160 @@ +policy_module(prelude,1.0.0) + @@ -20194,7 +20374,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/privoxy.fc serefpolicy-3.3.1/policy/modules/services/privoxy.fc --- nsaserefpolicy/policy/modules/services/privoxy.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/privoxy.fc 2008-04-21 11:02:49.677283000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/privoxy.fc 2008-04-21 11:02:49.000000000 -0400 @@ -1,6 +1,10 @@ /etc/privoxy/user\.action -- gen_context(system_u:object_r:privoxy_etc_rw_t,s0) @@ -20208,7 +20388,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/priv + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/privoxy.if serefpolicy-3.3.1/policy/modules/services/privoxy.if --- nsaserefpolicy/policy/modules/services/privoxy.if 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/privoxy.if 2008-04-21 11:02:49.682278000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/privoxy.if 2008-04-21 11:02:49.000000000 -0400 @@ -2,6 +2,25 @@ ######################################## @@ -20267,7 +20447,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/priv + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/privoxy.te serefpolicy-3.3.1/policy/modules/services/privoxy.te --- nsaserefpolicy/policy/modules/services/privoxy.te 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/privoxy.te 2008-04-21 11:02:49.688272000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/privoxy.te 2008-04-21 11:02:49.000000000 -0400 @@ -19,6 +19,9 @@ type privoxy_var_run_t; files_pid_file(privoxy_var_run_t) @@ -20288,7 +20468,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/priv corenet_sendrecv_http_cache_server_packets(privoxy_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.fc serefpolicy-3.3.1/policy/modules/services/procmail.fc --- nsaserefpolicy/policy/modules/services/procmail.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/procmail.fc 2008-04-21 11:02:49.693267000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/procmail.fc 2008-04-21 11:02:49.000000000 -0400 @@ -1,2 +1,5 @@ /usr/bin/procmail -- gen_context(system_u:object_r:procmail_exec_t,s0) @@ -20297,7 +20477,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc +/var/log/procmail(/.*)? gen_context(system_u:object_r:procmail_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.if serefpolicy-3.3.1/policy/modules/services/procmail.if --- nsaserefpolicy/policy/modules/services/procmail.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/procmail.if 2008-04-21 11:02:49.698262000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/procmail.if 2008-04-21 11:02:49.000000000 -0400 @@ -39,3 +39,41 @@ corecmd_search_bin($1) can_exec($1,procmail_exec_t) @@ -20342,7 +20522,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.3.1/policy/modules/services/procmail.te --- nsaserefpolicy/policy/modules/services/procmail.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/procmail.te 2008-04-21 11:02:49.704255000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/procmail.te 2008-04-21 11:02:49.000000000 -0400 @@ -14,6 +14,10 @@ type procmail_tmp_t; files_tmp_file(procmail_tmp_t) @@ -20417,13 +20597,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/publicfile.if serefpolicy-3.3.1/policy/modules/services/publicfile.if --- nsaserefpolicy/policy/modules/services/publicfile.if 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/publicfile.if 2008-04-21 11:02:49.709251000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/publicfile.if 2008-04-21 11:02:49.000000000 -0400 @@ -1 +1,2 @@ ## publicfile supplies files to the public through HTTP and FTP + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.fc serefpolicy-3.3.1/policy/modules/services/pyzor.fc --- nsaserefpolicy/policy/modules/services/pyzor.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/pyzor.fc 2008-04-21 11:02:49.714246000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/pyzor.fc 2008-04-21 11:02:49.000000000 -0400 @@ -1,9 +1,11 @@ /etc/pyzor(/.*)? gen_context(system_u:object_r:pyzor_etc_t, s0) @@ -20439,7 +20619,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo +/etc/rc.d/init.d/pyzord -- gen_context(system_u:object_r:pyzord_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.3.1/policy/modules/services/pyzor.if --- nsaserefpolicy/policy/modules/services/pyzor.if 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/pyzor.if 2008-04-21 11:02:49.720239000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/pyzor.if 2008-04-21 11:02:49.000000000 -0400 @@ -25,16 +25,18 @@ # template(`pyzor_per_role_template',` @@ -20547,7 +20727,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.3.1/policy/modules/services/pyzor.te --- nsaserefpolicy/policy/modules/services/pyzor.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/pyzor.te 2008-04-23 10:08:05.686909000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/pyzor.te 2008-04-23 10:08:05.000000000 -0400 @@ -17,7 +17,7 @@ init_daemon_domain(pyzord_t,pyzord_exec_t) @@ -20595,7 +20775,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qmail.if serefpolicy-3.3.1/policy/modules/services/qmail.if --- nsaserefpolicy/policy/modules/services/qmail.if 2007-03-26 10:39:05.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/qmail.if 2008-04-21 11:02:49.732227000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/qmail.if 2008-04-21 11:02:49.000000000 -0400 @@ -197,3 +197,4 @@ domtrans_pattern(qmail_smtpd_t, $2, $1) @@ -20603,7 +20783,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qmai + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qmail.te serefpolicy-3.3.1/policy/modules/services/qmail.te --- nsaserefpolicy/policy/modules/services/qmail.te 2007-10-02 09:54:52.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/qmail.te 2008-04-23 10:08:04.028252000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/qmail.te 2008-04-23 10:08:04.000000000 -0400 @@ -14,7 +14,7 @@ qmail_child_domain_template(qmail_clean, qmail_start_t) @@ -20661,7 +20841,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qmai ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.fc serefpolicy-3.3.1/policy/modules/services/radius.fc --- nsaserefpolicy/policy/modules/services/radius.fc 2007-11-16 13:45:14.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/radius.fc 2008-04-21 15:05:20.403645000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/radius.fc 2008-04-21 15:05:20.000000000 -0400 @@ -20,3 +20,5 @@ /var/run/radiusd(/.*)? gen_context(system_u:object_r:radiusd_var_run_t,s0) @@ -20670,7 +20850,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi +/etc/rc.d/init.d/radiusd -- gen_context(system_u:object_r:radius_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.if serefpolicy-3.3.1/policy/modules/services/radius.if --- nsaserefpolicy/policy/modules/services/radius.if 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/radius.if 2008-04-21 11:02:49.748212000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/radius.if 2008-04-21 11:02:49.000000000 -0400 @@ -16,6 +16,25 @@ ######################################## @@ -20736,7 +20916,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.3.1/policy/modules/services/radius.te --- nsaserefpolicy/policy/modules/services/radius.te 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/radius.te 2008-04-21 15:05:12.544320000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/radius.te 2008-04-21 15:05:12.000000000 -0400 @@ -25,6 +25,9 @@ type radiusd_var_run_t; files_pid_file(radiusd_var_run_t) @@ -20804,7 +20984,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radvd.fc serefpolicy-3.3.1/policy/modules/services/radvd.fc --- nsaserefpolicy/policy/modules/services/radvd.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/radvd.fc 2008-04-21 11:02:49.759201000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/radvd.fc 2008-04-21 11:02:49.000000000 -0400 @@ -5,3 +5,4 @@ /var/run/radvd\.pid -- gen_context(system_u:object_r:radvd_var_run_t,s0) @@ -20812,7 +20992,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radv +/etc/rc.d/init.d/radvd -- gen_context(system_u:object_r:radvd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radvd.if serefpolicy-3.3.1/policy/modules/services/radvd.if --- nsaserefpolicy/policy/modules/services/radvd.if 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/radvd.if 2008-04-21 11:02:49.764196000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/radvd.if 2008-04-21 11:02:49.000000000 -0400 @@ -2,6 +2,25 @@ ######################################## @@ -20868,7 +21048,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radv ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radvd.te serefpolicy-3.3.1/policy/modules/services/radvd.te --- nsaserefpolicy/policy/modules/services/radvd.te 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/radvd.te 2008-04-21 11:02:49.769191000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/radvd.te 2008-04-21 11:02:49.000000000 -0400 @@ -15,6 +15,9 @@ type radvd_etc_t; files_config_file(radvd_etc_t) @@ -20889,7 +21069,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radv diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.fc serefpolicy-3.3.1/policy/modules/services/razor.fc --- nsaserefpolicy/policy/modules/services/razor.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/razor.fc 2008-04-21 11:02:49.774186000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/razor.fc 2008-04-21 11:02:49.000000000 -0400 @@ -1,4 +1,4 @@ -HOME_DIR/\.razor(/.*)? gen_context(system_u:object_r:ROLE_razor_home_t,s0) +HOME_DIR/\.razor(/.*)? gen_context(system_u:object_r:user_razor_home_t,s0) @@ -20898,7 +21078,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razo diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.if serefpolicy-3.3.1/policy/modules/services/razor.if --- nsaserefpolicy/policy/modules/services/razor.if 2007-07-16 14:09:46.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/razor.if 2008-04-21 11:02:49.780180000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/razor.if 2008-04-21 11:02:49.000000000 -0400 @@ -137,6 +137,7 @@ template(`razor_per_role_template',` gen_require(` @@ -20969,7 +21149,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razo + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.te serefpolicy-3.3.1/policy/modules/services/razor.te --- nsaserefpolicy/policy/modules/services/razor.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/razor.te 2008-04-21 11:02:49.785175000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/razor.te 2008-04-21 11:02:49.000000000 -0400 @@ -23,6 +23,12 @@ razor_common_domain_template(razor) @@ -20985,7 +21165,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razo # Local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rdisc.if serefpolicy-3.3.1/policy/modules/services/rdisc.if --- nsaserefpolicy/policy/modules/services/rdisc.if 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/rdisc.if 2008-04-21 11:02:49.790170000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rdisc.if 2008-04-21 11:02:49.000000000 -0400 @@ -1 +1,20 @@ ## Network router discovery daemon + @@ -21009,7 +21189,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rdis +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remotelogin.if serefpolicy-3.3.1/policy/modules/services/remotelogin.if --- nsaserefpolicy/policy/modules/services/remotelogin.if 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/remotelogin.if 2008-04-21 11:02:49.813146000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/remotelogin.if 2008-04-21 11:02:49.000000000 -0400 @@ -35,3 +35,4 @@ allow $1 remote_login_t:process signal; @@ -21017,7 +21197,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remo + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remotelogin.te serefpolicy-3.3.1/policy/modules/services/remotelogin.te --- nsaserefpolicy/policy/modules/services/remotelogin.te 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/remotelogin.te 2008-04-21 11:02:49.840119000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/remotelogin.te 2008-04-21 11:02:49.000000000 -0400 @@ -85,6 +85,7 @@ miscfiles_read_localization(remote_login_t) @@ -21028,7 +21208,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remo # Only permit unprivileged user domains to be entered via rlogin, diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.3.1/policy/modules/services/rhgb.te --- nsaserefpolicy/policy/modules/services/rhgb.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/rhgb.te 2008-04-21 11:02:49.845117000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rhgb.te 2008-04-21 11:02:49.000000000 -0400 @@ -92,6 +92,7 @@ term_getattr_pty_fs(rhgb_t) @@ -21047,7 +21227,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb consoletype_exec(rhgb_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.if serefpolicy-3.3.1/policy/modules/services/ricci.if --- nsaserefpolicy/policy/modules/services/ricci.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ricci.if 2008-04-21 11:02:49.850111000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ricci.if 2008-04-21 11:02:49.000000000 -0400 @@ -165,3 +165,4 @@ domtrans_pattern($1,ricci_modstorage_exec_t,ricci_modstorage_t) @@ -21055,7 +21235,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.3.1/policy/modules/services/rlogin.te --- nsaserefpolicy/policy/modules/services/rlogin.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/rlogin.te 2008-04-21 11:02:49.855106000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rlogin.te 2008-04-21 11:02:49.000000000 -0400 @@ -36,6 +36,8 @@ allow rlogind_t rlogind_devpts_t:chr_file { rw_chr_file_perms setattr }; term_create_pty(rlogind_t,rlogind_devpts_t) @@ -21095,7 +21275,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/roundup.fc serefpolicy-3.3.1/policy/modules/services/roundup.fc --- nsaserefpolicy/policy/modules/services/roundup.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/roundup.fc 2008-04-21 11:02:49.860101000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/roundup.fc 2008-04-21 11:02:49.000000000 -0400 @@ -7,3 +7,5 @@ # /var # @@ -21104,7 +21284,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/roun +/etc/rc.d/init.d/roundup -- gen_context(system_u:object_r:roundup_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/roundup.if serefpolicy-3.3.1/policy/modules/services/roundup.if --- nsaserefpolicy/policy/modules/services/roundup.if 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/roundup.if 2008-04-21 11:02:49.865095000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/roundup.if 2008-04-21 11:02:49.000000000 -0400 @@ -1 +1,68 @@ ## Roundup Issue Tracking System policy + @@ -21176,7 +21356,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/roun + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/roundup.te serefpolicy-3.3.1/policy/modules/services/roundup.te --- nsaserefpolicy/policy/modules/services/roundup.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/roundup.te 2008-04-21 11:02:49.870090000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/roundup.te 2008-04-21 11:02:49.000000000 -0400 @@ -16,6 +16,9 @@ type roundup_var_lib_t; files_type(roundup_var_lib_t) @@ -21189,7 +21369,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/roun # Local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.3.1/policy/modules/services/rpc.if --- nsaserefpolicy/policy/modules/services/rpc.if 2007-12-04 11:02:50.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/rpc.if 2008-04-21 11:02:49.875087000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rpc.if 2008-04-21 11:02:49.000000000 -0400 @@ -88,8 +88,11 @@ # bind to arbitary unused ports corenet_tcp_bind_generic_port($1_t) @@ -21230,7 +21410,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.3.1/policy/modules/services/rpc.te --- nsaserefpolicy/policy/modules/services/rpc.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/rpc.te 2008-04-23 10:03:48.199613000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rpc.te 2008-04-28 16:23:06.250792000 -0400 @@ -23,7 +23,7 @@ gen_tunable(allow_nfsd_anon_write,false) @@ -21292,7 +21472,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. corenet_tcp_bind_all_rpc_ports(nfsd_t) corenet_udp_bind_all_rpc_ports(nfsd_t) -@@ -124,6 +142,7 @@ +@@ -102,6 +120,7 @@ + fs_mount_nfsd_fs(nfsd_t) + fs_search_nfsd_fs(nfsd_t) + fs_getattr_all_fs(nfsd_t) ++fs_getattr_all_dirs(nfsd_t) + fs_rw_nfsd_fs(nfsd_t) + + term_use_controlling_term(nfsd_t) +@@ -124,6 +143,7 @@ tunable_policy(`nfs_export_all_rw',` fs_read_noxattr_fs_files(nfsd_t) auth_manage_all_files_except_shadow(nfsd_t) @@ -21300,7 +21488,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. ') tunable_policy(`nfs_export_all_ro',` -@@ -144,6 +163,7 @@ +@@ -144,6 +164,7 @@ manage_files_pattern(gssd_t,gssd_tmp_t,gssd_tmp_t) files_tmp_filetrans(gssd_t, gssd_tmp_t, { file dir }) @@ -21308,7 +21496,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. kernel_read_network_state(gssd_t) kernel_read_network_state_symlinks(gssd_t) kernel_search_network_sysctl(gssd_t) -@@ -157,8 +177,14 @@ +@@ -157,8 +178,14 @@ files_list_tmp(gssd_t) files_read_usr_symlinks(gssd_t) @@ -21325,7 +21513,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. userdom_read_unpriv_users_tmp_files(gssd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.fc serefpolicy-3.3.1/policy/modules/services/rpcbind.fc --- nsaserefpolicy/policy/modules/services/rpcbind.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/rpcbind.fc 2008-04-21 11:02:49.886076000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rpcbind.fc 2008-04-21 11:02:49.000000000 -0400 @@ -5,3 +5,5 @@ /var/run/rpc.statd\.pid -- gen_context(system_u:object_r:rpcbind_var_run_t,s0) /var/run/rpcbind\.lock -- gen_context(system_u:object_r:rpcbind_var_run_t,s0) @@ -21334,7 +21522,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb +/etc/rc.d/init.d/rpcbind -- gen_context(system_u:object_r:rpcbind_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-3.3.1/policy/modules/services/rpcbind.if --- nsaserefpolicy/policy/modules/services/rpcbind.if 2007-07-16 14:09:46.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/rpcbind.if 2008-04-21 11:02:49.891070000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rpcbind.if 2008-04-21 11:02:49.000000000 -0400 @@ -95,3 +95,70 @@ manage_files_pattern($1,rpcbind_var_lib_t,rpcbind_var_lib_t) files_search_var_lib($1) @@ -21408,7 +21596,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.3.1/policy/modules/services/rpcbind.te --- nsaserefpolicy/policy/modules/services/rpcbind.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/rpcbind.te 2008-04-21 11:02:49.897064000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rpcbind.te 2008-04-21 11:02:49.000000000 -0400 @@ -16,16 +16,21 @@ type rpcbind_var_lib_t; files_type(rpcbind_var_lib_t) @@ -21442,7 +21630,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb corenet_all_recvfrom_unlabeled(rpcbind_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.3.1/policy/modules/services/rshd.te --- nsaserefpolicy/policy/modules/services/rshd.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/rshd.te 2008-04-21 11:02:49.902059000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rshd.te 2008-04-21 11:02:49.000000000 -0400 @@ -16,7 +16,7 @@ # # Local policy @@ -21505,7 +21693,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.fc serefpolicy-3.3.1/policy/modules/services/rsync.fc --- nsaserefpolicy/policy/modules/services/rsync.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/rsync.fc 2008-04-21 11:02:49.906055000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rsync.fc 2008-04-21 11:02:49.000000000 -0400 @@ -1,2 +1,4 @@ /usr/bin/rsync -- gen_context(system_u:object_r:rsync_exec_t,s0) @@ -21513,7 +21701,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn +/var/log/rsync.log -- gen_context(system_u:object_r:rsync_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.if serefpolicy-3.3.1/policy/modules/services/rsync.if --- nsaserefpolicy/policy/modules/services/rsync.if 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/rsync.if 2008-04-21 11:02:49.910050000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rsync.if 2008-04-21 11:02:49.000000000 -0400 @@ -103,3 +103,5 @@ can_exec($1,rsync_exec_t) @@ -21522,7 +21710,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.3.1/policy/modules/services/rsync.te --- nsaserefpolicy/policy/modules/services/rsync.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/rsync.te 2008-04-21 11:02:49.915045000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rsync.te 2008-04-21 11:02:49.000000000 -0400 @@ -31,6 +31,9 @@ type rsync_data_t; files_type(rsync_data_t) @@ -21570,7 +21758,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-3.3.1/policy/modules/services/rwho.fc --- nsaserefpolicy/policy/modules/services/rwho.fc 2007-09-12 10:34:18.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/rwho.fc 2008-04-21 11:02:49.921039000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rwho.fc 2008-04-21 11:02:49.000000000 -0400 @@ -3,3 +3,5 @@ /var/spool/rwho(/.*)? gen_context(system_u:object_r:rwho_spool_t,s0) @@ -21579,7 +21767,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho +/etc/rc.d/init.d/rwhod -- gen_context(system_u:object_r:rwho_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-3.3.1/policy/modules/services/rwho.if --- nsaserefpolicy/policy/modules/services/rwho.if 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/rwho.if 2008-04-21 11:02:49.926034000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rwho.if 2008-04-21 11:02:49.000000000 -0400 @@ -118,6 +118,25 @@ ######################################## @@ -21632,7 +21820,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-3.3.1/policy/modules/services/rwho.te --- nsaserefpolicy/policy/modules/services/rwho.te 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/rwho.te 2008-04-21 11:02:49.932028000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/rwho.te 2008-04-21 11:02:49.000000000 -0400 @@ -16,6 +16,9 @@ type rwho_spool_t; files_type(rwho_spool_t) @@ -21645,7 +21833,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho # rwho local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.3.1/policy/modules/services/samba.fc --- nsaserefpolicy/policy/modules/services/samba.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/samba.fc 2008-04-21 11:02:49.937023000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/samba.fc 2008-04-21 11:02:49.000000000 -0400 @@ -15,6 +15,7 @@ /usr/bin/ntlm_auth -- gen_context(system_u:object_r:winbind_helper_exec_t,s0) /usr/bin/smbmount -- gen_context(system_u:object_r:smbmount_exec_t,s0) @@ -21673,7 +21861,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +/etc/rc.d/init.d/smb -- gen_context(system_u:object_r:samba_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.3.1/policy/modules/services/samba.if --- nsaserefpolicy/policy/modules/services/samba.if 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/samba.if 2008-04-21 13:17:56.885515000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/samba.if 2008-04-21 13:17:56.000000000 -0400 @@ -33,8 +33,8 @@ ') @@ -22042,7 +22230,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.3.1/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2008-02-19 17:24:26.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/samba.te 2008-04-23 10:02:23.430077000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/samba.te 2008-04-23 10:02:23.000000000 -0400 @@ -59,6 +59,13 @@ ## gen_tunable(samba_share_nfs,false) @@ -22374,7 +22562,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.fc serefpolicy-3.3.1/policy/modules/services/sasl.fc --- nsaserefpolicy/policy/modules/services/sasl.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/sasl.fc 2008-04-21 11:02:49.958003000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/sasl.fc 2008-04-21 11:02:49.000000000 -0400 @@ -8,3 +8,5 @@ # /var # @@ -22383,7 +22571,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl +/etc/rc.d/init.d/sasl -- gen_context(system_u:object_r:sasl_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.if serefpolicy-3.3.1/policy/modules/services/sasl.if --- nsaserefpolicy/policy/modules/services/sasl.if 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/sasl.if 2008-04-21 11:02:49.962997000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/sasl.if 2008-04-21 11:02:49.000000000 -0400 @@ -21,6 +21,25 @@ ######################################## @@ -22440,7 +22628,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.3.1/policy/modules/services/sasl.te --- nsaserefpolicy/policy/modules/services/sasl.te 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/sasl.te 2008-04-21 11:02:49.967992000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/sasl.te 2008-04-21 11:02:49.000000000 -0400 @@ -23,6 +23,9 @@ type saslauthd_var_run_t; files_pid_file(saslauthd_var_run_t) @@ -22464,7 +22652,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.3.1/policy/modules/services/sendmail.if --- nsaserefpolicy/policy/modules/services/sendmail.if 2007-08-27 13:57:20.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/sendmail.if 2008-04-21 11:02:49.974985000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/sendmail.if 2008-04-21 11:02:49.000000000 -0400 @@ -149,3 +149,85 @@ logging_log_filetrans($1,sendmail_log_t,file) @@ -22553,7 +22741,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.3.1/policy/modules/services/sendmail.te --- nsaserefpolicy/policy/modules/services/sendmail.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/sendmail.te 2008-04-21 11:02:49.980979000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/sendmail.te 2008-04-21 11:02:49.000000000 -0400 @@ -20,13 +20,17 @@ mta_mailserver_delivery(sendmail_t) mta_mailserver_sender(sendmail_t) @@ -22702,7 +22890,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send -') dnl end TODO diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.fc serefpolicy-3.3.1/policy/modules/services/setroubleshoot.fc --- nsaserefpolicy/policy/modules/services/setroubleshoot.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/setroubleshoot.fc 2008-04-21 11:02:49.985974000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/setroubleshoot.fc 2008-04-21 11:02:49.000000000 -0400 @@ -5,3 +5,5 @@ /var/log/setroubleshoot(/.*)? gen_context(system_u:object_r:setroubleshoot_var_log_t,s0) @@ -22711,7 +22899,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr +/etc/rc.d/init.d/setroubleshoot -- gen_context(system_u:object_r:setroubleshoot_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.3.1/policy/modules/services/setroubleshoot.if --- nsaserefpolicy/policy/modules/services/setroubleshoot.if 2007-09-04 15:22:23.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/setroubleshoot.if 2008-04-21 11:02:49.990969000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/setroubleshoot.if 2008-04-21 11:02:49.000000000 -0400 @@ -16,14 +16,13 @@ ') @@ -22811,7 +22999,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.3.1/policy/modules/services/setroubleshoot.te --- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/setroubleshoot.te 2008-04-21 11:02:49.997962000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/setroubleshoot.te 2008-04-28 15:21:41.039805000 -0400 @@ -22,13 +22,16 @@ type setroubleshoot_var_run_t; files_pid_file(setroubleshoot_var_run_t) @@ -22866,7 +23054,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr selinux_get_enforce_mode(setroubleshootd_t) selinux_validate_context(setroubleshootd_t) -@@ -97,19 +109,20 @@ +@@ -97,19 +109,21 @@ locallogin_dontaudit_use_fds(setroubleshootd_t) @@ -22882,6 +23070,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr +seutil_read_bin_policy(setroubleshootd_t) userdom_dontaudit_read_sysadm_home_content_files(setroubleshootd_t) ++userdom_dontaudit_read_unpriv_users_home_content_files(setroubleshootd_t) optional_policy(` dbus_system_bus_client_template(setroubleshootd, setroubleshootd_t) @@ -22892,7 +23081,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.fc serefpolicy-3.3.1/policy/modules/services/smartmon.fc --- nsaserefpolicy/policy/modules/services/smartmon.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/smartmon.fc 2008-04-21 11:02:50.002957000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/smartmon.fc 2008-04-21 11:02:50.000000000 -0400 @@ -8,3 +8,4 @@ # /var/run/smartd\.pid -- gen_context(system_u:object_r:fsdaemon_var_run_t,s0) @@ -22900,7 +23089,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar +/etc/rc.d/init.d/smartd -- gen_context(system_u:object_r:smartmon_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.if serefpolicy-3.3.1/policy/modules/services/smartmon.if --- nsaserefpolicy/policy/modules/services/smartmon.if 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/smartmon.if 2008-04-21 11:02:50.007957000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/smartmon.if 2008-04-21 11:02:50.000000000 -0400 @@ -20,6 +20,25 @@ ######################################## @@ -22953,7 +23142,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.3.1/policy/modules/services/smartmon.te --- nsaserefpolicy/policy/modules/services/smartmon.te 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/smartmon.te 2008-04-21 11:02:50.022937000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/smartmon.te 2008-04-21 11:02:50.000000000 -0400 @@ -16,6 +16,9 @@ type fsdaemon_tmp_t; files_tmp_file(fsdaemon_tmp_t) @@ -22974,7 +23163,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar storage_raw_write_fixed_disk(fsdaemon_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.3.1/policy/modules/services/snmp.fc --- nsaserefpolicy/policy/modules/services/snmp.fc 2007-06-19 16:23:06.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/snmp.fc 2008-04-21 11:02:50.028931000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/snmp.fc 2008-04-21 11:02:50.000000000 -0400 @@ -17,3 +17,6 @@ /var/run/snmpd -d gen_context(system_u:object_r:snmpd_var_run_t,s0) @@ -22984,7 +23173,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp +/etc/rc.d/init.d/snmptrapd -- gen_context(system_u:object_r:snmp_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.if serefpolicy-3.3.1/policy/modules/services/snmp.if --- nsaserefpolicy/policy/modules/services/snmp.if 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/snmp.if 2008-04-21 11:02:50.033926000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/snmp.if 2008-04-21 11:02:50.000000000 -0400 @@ -87,6 +87,25 @@ ######################################## @@ -23041,7 +23230,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.3.1/policy/modules/services/snmp.te --- nsaserefpolicy/policy/modules/services/snmp.te 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/snmp.te 2008-04-21 11:02:50.040918000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/snmp.te 2008-04-21 11:02:50.000000000 -0400 @@ -18,12 +18,16 @@ type snmpd_var_lib_t; files_type(snmpd_var_lib_t) @@ -23079,7 +23268,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp fs_getattr_all_fs(snmpd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snort.te serefpolicy-3.3.1/policy/modules/services/snort.te --- nsaserefpolicy/policy/modules/services/snort.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/snort.te 2008-04-23 10:08:01.979984000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/snort.te 2008-04-23 10:08:01.000000000 -0400 @@ -11,7 +11,7 @@ init_daemon_domain(snort_t,snort_exec_t) @@ -23091,7 +23280,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snor logging_log_file(snort_log_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.fc serefpolicy-3.3.1/policy/modules/services/soundserver.fc --- nsaserefpolicy/policy/modules/services/soundserver.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/soundserver.fc 2008-04-21 11:02:50.045914000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/soundserver.fc 2008-04-21 11:02:50.000000000 -0400 @@ -1,10 +1,12 @@ -/etc/nas(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) -/etc/yiff(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) @@ -23110,7 +23299,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun +/etc/rc.d/init.d/nasd -- gen_context(system_u:object_r:soundd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.if serefpolicy-3.3.1/policy/modules/services/soundserver.if --- nsaserefpolicy/policy/modules/services/soundserver.if 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/soundserver.if 2008-04-21 11:02:50.050909000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/soundserver.if 2008-04-21 11:02:50.000000000 -0400 @@ -13,3 +13,74 @@ interface(`soundserver_tcp_connect',` refpolicywarn(`$0($*) has been deprecated.') @@ -23188,7 +23377,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.te serefpolicy-3.3.1/policy/modules/services/soundserver.te --- nsaserefpolicy/policy/modules/services/soundserver.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/soundserver.te 2008-04-23 10:07:55.149707000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/soundserver.te 2008-04-23 10:07:55.000000000 -0400 @@ -10,9 +10,6 @@ type soundd_exec_t; init_daemon_domain(soundd_t,soundd_exec_t) @@ -23259,7 +23448,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.3.1/policy/modules/services/spamassassin.fc --- nsaserefpolicy/policy/modules/services/spamassassin.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/spamassassin.fc 2008-04-21 11:02:50.061898000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/spamassassin.fc 2008-04-21 11:02:50.000000000 -0400 @@ -1,4 +1,4 @@ -HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:ROLE_spamassassin_home_t,s0) +HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:user_spamassassin_home_t,s0) @@ -23286,7 +23475,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam +/etc/rc.d/init.d/spamd -- gen_context(system_u:object_r:spamd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.3.1/policy/modules/services/spamassassin.if --- nsaserefpolicy/policy/modules/services/spamassassin.if 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/spamassassin.if 2008-04-21 11:02:50.067892000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/spamassassin.if 2008-04-21 11:02:50.000000000 -0400 @@ -34,10 +34,11 @@ # cjp: when tunables are available, spamc stuff should be # toggled on activation of spamc, and similarly for spamd. @@ -23854,7 +24043,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.3.1/policy/modules/services/spamassassin.te --- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/spamassassin.te 2008-04-21 11:02:50.073886000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/spamassassin.te 2008-04-21 11:02:50.000000000 -0400 @@ -21,8 +21,9 @@ gen_tunable(spamd_enable_home_dirs,true) @@ -24191,7 +24380,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.3.1/policy/modules/services/squid.fc --- nsaserefpolicy/policy/modules/services/squid.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/squid.fc 2008-04-21 11:02:50.079880000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/squid.fc 2008-04-21 11:02:50.000000000 -0400 @@ -12,3 +12,8 @@ /var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0) @@ -24203,7 +24392,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-3.3.1/policy/modules/services/squid.if --- nsaserefpolicy/policy/modules/services/squid.if 2007-05-07 10:32:44.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/squid.if 2008-04-21 11:02:50.085873000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/squid.if 2008-04-21 11:02:50.000000000 -0400 @@ -131,3 +131,95 @@ interface(`squid_use',` refpolicywarn(`$0($*) has been deprecated.') @@ -24302,7 +24491,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.3.1/policy/modules/services/squid.te --- nsaserefpolicy/policy/modules/services/squid.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/squid.te 2008-04-21 11:02:50.091868000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/squid.te 2008-04-21 11:02:50.000000000 -0400 @@ -31,12 +31,15 @@ type squid_var_run_t; files_pid_file(squid_var_run_t) @@ -24385,7 +24574,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.fc serefpolicy-3.3.1/policy/modules/services/ssh.fc --- nsaserefpolicy/policy/modules/services/ssh.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/ssh.fc 2008-04-21 11:02:50.096863000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ssh.fc 2008-04-21 11:02:50.000000000 -0400 @@ -1,4 +1,4 @@ -HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ROLE_home_ssh_t,s0) +HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:user_ssh_home_t,s0) @@ -24394,7 +24583,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. /etc/ssh/ssh_host_key -- gen_context(system_u:object_r:sshd_key_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.3.1/policy/modules/services/ssh.if --- nsaserefpolicy/policy/modules/services/ssh.if 2008-02-06 10:33:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ssh.if 2008-04-21 11:02:50.103856000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ssh.if 2008-04-21 11:02:50.000000000 -0400 @@ -36,6 +36,7 @@ gen_require(` attribute ssh_server; @@ -24565,7 +24754,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.3.1/policy/modules/services/ssh.te --- nsaserefpolicy/policy/modules/services/ssh.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/ssh.te 2008-04-21 11:02:50.109850000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/ssh.te 2008-04-21 11:02:50.000000000 -0400 @@ -24,7 +24,7 @@ # Type for the ssh-agent executable. @@ -24627,7 +24816,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stunnel.if serefpolicy-3.3.1/policy/modules/services/stunnel.if --- nsaserefpolicy/policy/modules/services/stunnel.if 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/stunnel.if 2008-04-21 11:02:50.114845000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/stunnel.if 2008-04-21 11:02:50.000000000 -0400 @@ -1 +1,25 @@ ## SSL Tunneling Proxy + @@ -24656,7 +24845,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stun +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stunnel.te serefpolicy-3.3.1/policy/modules/services/stunnel.te --- nsaserefpolicy/policy/modules/services/stunnel.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/stunnel.te 2008-04-23 10:06:53.948261000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/stunnel.te 2008-04-23 10:06:53.000000000 -0400 @@ -20,7 +20,7 @@ ') @@ -24668,7 +24857,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stun files_tmp_file(stunnel_tmp_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/telnet.te serefpolicy-3.3.1/policy/modules/services/telnet.te --- nsaserefpolicy/policy/modules/services/telnet.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/telnet.te 2008-04-21 11:02:50.119840000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/telnet.te 2008-04-21 11:02:50.000000000 -0400 @@ -37,6 +37,8 @@ allow telnetd_t telnetd_devpts_t:chr_file { rw_chr_file_perms setattr }; term_create_pty(telnetd_t,telnetd_devpts_t) @@ -24719,7 +24908,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/teln + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.fc serefpolicy-3.3.1/policy/modules/services/tftp.fc --- nsaserefpolicy/policy/modules/services/tftp.fc 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/tftp.fc 2008-04-21 11:02:50.124835000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/tftp.fc 2008-04-21 11:02:50.000000000 -0400 @@ -4,5 +4,5 @@ /tftpboot -d gen_context(system_u:object_r:tftpdir_t,s0) @@ -24729,7 +24918,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.if serefpolicy-3.3.1/policy/modules/services/tftp.if --- nsaserefpolicy/policy/modules/services/tftp.if 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/tftp.if 2008-04-21 11:02:50.129830000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/tftp.if 2008-04-21 11:02:50.000000000 -0400 @@ -31,10 +31,10 @@ allow $1 tftp_t:process { ptrace signal_perms getattr }; ps_process_pattern($1, tftp_t) @@ -24746,7 +24935,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-3.3.1/policy/modules/services/tftp.te --- nsaserefpolicy/policy/modules/services/tftp.te 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/tftp.te 2008-04-21 11:02:50.142817000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/tftp.te 2008-04-21 11:02:50.000000000 -0400 @@ -37,7 +37,6 @@ allow tftpd_t self:udp_socket create_socket_perms; allow tftpd_t self:unix_dgram_socket create_socket_perms; @@ -24791,13 +24980,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/timidity.if serefpolicy-3.3.1/policy/modules/services/timidity.if --- nsaserefpolicy/policy/modules/services/timidity.if 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/timidity.if 2008-04-21 11:02:50.148811000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/timidity.if 2008-04-21 11:02:50.000000000 -0400 @@ -1 +1,2 @@ ## MIDI to WAV converter and player configured as a service + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor.fc serefpolicy-3.3.1/policy/modules/services/tor.fc --- nsaserefpolicy/policy/modules/services/tor.fc 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/tor.fc 2008-04-21 11:02:50.153806000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/tor.fc 2008-04-21 11:02:50.000000000 -0400 @@ -1,8 +1,10 @@ /etc/tor(/.*)? gen_context(system_u:object_r:tor_etc_t,s0) @@ -24812,7 +25001,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor. +/etc/rc.d/init.d/tor -- gen_context(system_u:object_r:tor_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor.if serefpolicy-3.3.1/policy/modules/services/tor.if --- nsaserefpolicy/policy/modules/services/tor.if 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/tor.if 2008-04-21 11:02:50.158801000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/tor.if 2008-04-21 11:02:50.000000000 -0400 @@ -20,6 +20,25 @@ ######################################## @@ -24873,8 +25062,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor. ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor.te serefpolicy-3.3.1/policy/modules/services/tor.te --- nsaserefpolicy/policy/modules/services/tor.te 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/tor.te 2008-04-21 11:02:50.163796000 -0400 -@@ -26,6 +26,9 @@ ++++ serefpolicy-3.3.1/policy/modules/services/tor.te 2008-04-25 15:19:54.000000000 -0400 +@@ -26,11 +26,15 @@ type tor_var_run_t; files_pid_file(tor_var_run_t) @@ -24884,9 +25073,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor. ######################################## # # tor local policy + # + ++allow tor_t self:capability { setgid setuid }; + allow tor_t self:fifo_file { read write }; + allow tor_t self:unix_stream_socket create_stream_socket_perms; + allow tor_t self:netlink_route_socket r_netlink_socket_perms; +@@ -86,13 +90,13 @@ + files_read_etc_files(tor_t) + files_read_etc_runtime_files(tor_t) + ++auth_use_nsswitch(tor_t) ++ + libs_use_ld_so(tor_t) + libs_use_shared_libs(tor_t) + + miscfiles_read_localization(tor_t) + +-sysnet_dns_name_resolve(tor_t) +- + optional_policy(` + seutil_sigchld_newrole(tor_t) + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp.if serefpolicy-3.3.1/policy/modules/services/uucp.if --- nsaserefpolicy/policy/modules/services/uucp.if 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/uucp.if 2008-04-21 11:02:50.168791000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/uucp.if 2008-04-21 11:02:50.000000000 -0400 @@ -94,18 +94,18 @@ ps_process_pattern($1, uucp_t) @@ -24914,13 +25125,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.3.1/policy/modules/services/w3c.fc --- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/w3c.fc 2008-04-21 11:02:50.173786000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/w3c.fc 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1,2 @@ +/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0) +/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.3.1/policy/modules/services/w3c.if --- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/w3c.if 2008-04-21 11:02:50.177782000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/w3c.if 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1,20 @@ +## W3C + @@ -24944,7 +25155,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.3.1/policy/modules/services/w3c.te --- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/w3c.te 2008-04-21 11:02:50.181778000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/w3c.te 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1,14 @@ +policy_module(w3c,1.2.1) + @@ -24962,19 +25173,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c. +miscfiles_read_certs(httpd_w3c_validator_script_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/watchdog.if serefpolicy-3.3.1/policy/modules/services/watchdog.if --- nsaserefpolicy/policy/modules/services/watchdog.if 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/watchdog.if 2008-04-21 11:02:50.185774000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/watchdog.if 2008-04-21 11:02:50.000000000 -0400 @@ -1 +1,2 @@ ## Software watchdog + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xprint.if serefpolicy-3.3.1/policy/modules/services/xprint.if --- nsaserefpolicy/policy/modules/services/xprint.if 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/xprint.if 2008-04-21 11:02:50.190769000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/xprint.if 2008-04-21 11:02:50.000000000 -0400 @@ -1 +1,2 @@ ## X print server + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.3.1/policy/modules/services/xserver.fc --- nsaserefpolicy/policy/modules/services/xserver.fc 2007-10-15 16:11:05.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/xserver.fc 2008-04-21 11:02:50.196767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/xserver.fc 2008-04-21 11:02:50.000000000 -0400 @@ -1,13 +1,13 @@ # # HOME_DIR @@ -25044,7 +25255,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser /var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.3.1/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2007-12-04 11:02:50.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/xserver.if 2008-04-21 11:02:50.208767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/xserver.if 2008-04-25 13:53:23.000000000 -0400 @@ -12,9 +12,15 @@ ## ## @@ -25103,7 +25314,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser kernel_read_system_state($1_xserver_t) kernel_read_device_sysctls($1_xserver_t) kernel_read_modprobe_sysctls($1_xserver_t) -@@ -115,18 +129,23 @@ +@@ -115,18 +129,24 @@ dev_rw_agp($1_xserver_t) dev_rw_framebuffer($1_xserver_t) dev_manage_dri_dev($1_xserver_t) @@ -25123,13 +25334,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser + dev_rw_generic_usb_dev($1_xserver_t) + dev_rw_generic_usb_pipes($1_xserver_t) ++ domain_mmap_low_type($1_xserver_t) domain_mmap_low($1_xserver_t) + domain_read_all_domains_state($1_xserver_t) + domain_dontaudit_ptrace_all_domains($1_xserver_t) files_read_etc_files($1_xserver_t) files_read_etc_runtime_files($1_xserver_t) -@@ -140,26 +159,37 @@ +@@ -140,26 +160,37 @@ fs_getattr_xattr_fs($1_xserver_t) fs_search_nfs($1_xserver_t) fs_search_auto_mountpoints($1_xserver_t) @@ -25169,7 +25381,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ifndef(`distro_redhat',` allow $1_xserver_t self:process { execmem execheap execstack }; -@@ -169,6 +199,46 @@ +@@ -169,6 +200,46 @@ allow $1_xserver_t self:process { execmem execheap execstack }; ') @@ -25216,7 +25428,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser optional_policy(` apm_stream_connect($1_xserver_t) ') -@@ -223,8 +293,10 @@ +@@ -223,8 +294,10 @@ template(`xserver_per_role_template',` gen_require(` @@ -25229,7 +25441,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ############################## -@@ -232,189 +304,119 @@ +@@ -232,189 +305,119 @@ # Declarations # @@ -25483,7 +25695,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ####################################### -@@ -521,19 +523,18 @@ +@@ -521,19 +524,18 @@ ## # template(`xserver_user_client_template',` @@ -25511,7 +25723,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # for when /tmp/.X11-unix is created by the system allow $2 xdm_t:fd use; -@@ -542,26 +543,535 @@ +@@ -542,26 +544,535 @@ allow $2 xdm_tmp_t:sock_file { read write }; dontaudit $2 xdm_t:tcp_socket { read write }; @@ -26053,7 +26265,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ######################################## -@@ -593,26 +1103,44 @@ +@@ -593,26 +1104,44 @@ # template(`xserver_use_user_fonts',` gen_require(` @@ -26105,7 +26317,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ## Transition to a user Xauthority domain. ## ## -@@ -638,10 +1166,77 @@ +@@ -638,10 +1167,77 @@ # template(`xserver_domtrans_user_xauth',` gen_require(` @@ -26185,7 +26397,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ######################################## -@@ -671,10 +1266,10 @@ +@@ -671,10 +1267,10 @@ # template(`xserver_user_home_dir_filetrans_user_xauth',` gen_require(` @@ -26198,7 +26410,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ######################################## -@@ -760,7 +1355,7 @@ +@@ -760,7 +1356,7 @@ type xconsole_device_t; ') @@ -26207,7 +26419,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ######################################## -@@ -860,6 +1455,25 @@ +@@ -860,6 +1456,25 @@ ######################################## ## @@ -26233,7 +26445,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ## Read xdm-writable configuration files. ## ## -@@ -914,6 +1528,7 @@ +@@ -914,6 +1529,7 @@ files_search_tmp($1) allow $1 xdm_tmp_t:dir list_dir_perms; create_sock_files_pattern($1,xdm_tmp_t,xdm_tmp_t) @@ -26241,7 +26453,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ######################################## -@@ -932,7 +1547,7 @@ +@@ -932,7 +1548,7 @@ ') files_search_pids($1) @@ -26250,7 +26462,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ######################################## -@@ -955,6 +1570,24 @@ +@@ -955,6 +1571,24 @@ ######################################## ## @@ -26275,7 +26487,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ## Execute the X server in the XDM X server domain. ## ## -@@ -965,15 +1598,47 @@ +@@ -965,15 +1599,47 @@ # interface(`xserver_domtrans_xdm_xserver',` gen_require(` @@ -26324,7 +26536,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ## Make an X session script an entrypoint for the specified domain. ## ## -@@ -1123,7 +1788,7 @@ +@@ -1123,7 +1789,7 @@ type xdm_xserver_tmp_t; ') @@ -26333,7 +26545,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ######################################## -@@ -1312,3 +1977,83 @@ +@@ -1312,3 +1978,83 @@ files_search_tmp($1) stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t) ') @@ -26419,7 +26631,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.3.1/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/xserver.te 2008-04-23 10:06:49.639936000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/xserver.te 2008-04-23 10:06:49.000000000 -0400 @@ -8,6 +8,14 @@ ## @@ -27068,7 +27280,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zabbix.fc serefpolicy-3.3.1/policy/modules/services/zabbix.fc --- nsaserefpolicy/policy/modules/services/zabbix.fc 2007-04-11 15:52:54.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/zabbix.fc 2008-04-21 11:02:50.221767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/zabbix.fc 2008-04-21 11:02:50.000000000 -0400 @@ -1,5 +1,8 @@ + /usr/bin/zabbix_server -- gen_context(system_u:object_r:zabbix_exec_t,s0) @@ -27080,7 +27292,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zabb +/etc/rc.d/init.d/zabbix -- gen_context(system_u:object_r:zabbix_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zabbix.if serefpolicy-3.3.1/policy/modules/services/zabbix.if --- nsaserefpolicy/policy/modules/services/zabbix.if 2008-02-06 10:33:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/zabbix.if 2008-04-21 11:02:50.226767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/zabbix.if 2008-04-21 11:02:50.000000000 -0400 @@ -79,6 +79,25 @@ ######################################## @@ -27139,7 +27351,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zabb + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zabbix.te serefpolicy-3.3.1/policy/modules/services/zabbix.te --- nsaserefpolicy/policy/modules/services/zabbix.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/zabbix.te 2008-04-21 11:02:50.261767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/zabbix.te 2008-04-21 11:02:50.000000000 -0400 @@ -18,6 +18,9 @@ type zabbix_var_run_t; files_pid_file(zabbix_var_run_t) @@ -27152,7 +27364,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zabb # zabbix local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zebra.fc serefpolicy-3.3.1/policy/modules/services/zebra.fc --- nsaserefpolicy/policy/modules/services/zebra.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/zebra.fc 2008-04-21 11:02:50.275767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/zebra.fc 2008-04-21 11:02:50.000000000 -0400 @@ -14,3 +14,10 @@ /var/run/\.zebra -s gen_context(system_u:object_r:zebra_var_run_t,s0) /var/run/\.zserv -s gen_context(system_u:object_r:zebra_var_run_t,s0) @@ -27166,7 +27378,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zebr +/etc/rc.d/init.d/zebra -- gen_context(system_u:object_r:zebra_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zebra.if serefpolicy-3.3.1/policy/modules/services/zebra.if --- nsaserefpolicy/policy/modules/services/zebra.if 2008-02-06 10:33:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/zebra.if 2008-04-21 11:02:50.280767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/zebra.if 2008-04-21 11:02:50.000000000 -0400 @@ -18,12 +18,32 @@ files_search_etc($1) @@ -27243,7 +27455,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zebr ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zebra.te serefpolicy-3.3.1/policy/modules/services/zebra.te --- nsaserefpolicy/policy/modules/services/zebra.te 2008-02-06 10:33:21.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/zebra.te 2008-04-21 11:02:50.286766000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/zebra.te 2008-04-21 11:02:50.000000000 -0400 @@ -30,6 +30,9 @@ type zebra_var_run_t; files_pid_file(zebra_var_run_t) @@ -27265,7 +27477,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zebr allow zebra_t self:unix_stream_socket { connectto create_stream_socket_perms }; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.3.1/policy/modules/system/authlogin.fc --- nsaserefpolicy/policy/modules/system/authlogin.fc 2008-02-19 17:24:26.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/authlogin.fc 2008-04-21 12:03:55.507562000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/authlogin.fc 2008-04-21 12:03:55.000000000 -0400 @@ -7,12 +7,10 @@ /etc/passwd\.lock -- gen_context(system_u:object_r:shadow_t,s0) /etc/shadow.* -- gen_context(system_u:object_r:shadow_t,s0) @@ -27294,7 +27506,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.3.1/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2008-02-01 09:12:53.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/authlogin.if 2008-04-21 11:02:50.300767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/authlogin.if 2008-04-28 09:15:47.070186000 -0400 @@ -99,7 +99,7 @@ template(`authlogin_per_role_template',` @@ -27312,7 +27524,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') domain_type($1) -@@ -177,12 +178,27 @@ +@@ -177,12 +178,28 @@ domain_obj_id_change_exemption($1) role system_r types $1; @@ -27325,6 +27537,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + allow $1 self:process setkeycreate; + allow $1 self:key manage_key_perms; + userdom_manage_all_users_keys($1) ++ init_script_search_keyring($1) + files_list_var_lib($1) manage_files_pattern($1, var_auth_t, var_auth_t) @@ -27340,7 +27553,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo # for SSP/ProPolice dev_read_urand($1) # for fingerprint readers -@@ -226,8 +242,38 @@ +@@ -226,8 +243,38 @@ seutil_read_config($1) seutil_read_default_contexts($1) @@ -27379,7 +27592,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') ') -@@ -342,6 +388,8 @@ +@@ -342,6 +389,8 @@ optional_policy(` kerberos_use($1) @@ -27388,7 +27601,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') optional_policy(` -@@ -356,6 +404,28 @@ +@@ -356,6 +405,28 @@ optional_policy(` samba_stream_connect_winbind($1) ') @@ -27417,7 +27630,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') ######################################## -@@ -369,12 +439,12 @@ +@@ -369,12 +440,12 @@ ## ## ## @@ -27432,7 +27645,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ## ## # -@@ -386,6 +456,7 @@ +@@ -386,6 +457,7 @@ auth_domtrans_chk_passwd($1) role $2 types system_chkpwd_t; allow system_chkpwd_t $3:chr_file rw_file_perms; @@ -27440,7 +27653,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') ######################################## -@@ -1457,6 +1528,7 @@ +@@ -1457,6 +1529,7 @@ optional_policy(` samba_stream_connect_winbind($1) samba_read_var_files($1) @@ -27448,7 +27661,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') ') -@@ -1491,3 +1563,59 @@ +@@ -1491,3 +1564,59 @@ typeattribute $1 can_write_shadow_passwords; typeattribute $1 can_relabelto_shadow_passwords; ') @@ -27510,7 +27723,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.3.1/policy/modules/system/authlogin.te --- nsaserefpolicy/policy/modules/system/authlogin.te 2008-02-19 17:24:26.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/authlogin.te 2008-04-21 11:02:50.306767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/authlogin.te 2008-04-21 11:02:50.000000000 -0400 @@ -59,6 +59,9 @@ type utempter_exec_t; application_domain(utempter_t,utempter_exec_t) @@ -27592,7 +27805,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.3.1/policy/modules/system/fstools.fc --- nsaserefpolicy/policy/modules/system/fstools.fc 2007-09-26 12:15:01.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/system/fstools.fc 2008-04-21 11:02:50.311767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/fstools.fc 2008-04-21 11:02:50.000000000 -0400 @@ -1,4 +1,3 @@ -/sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0) @@ -27608,7 +27821,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.3.1/policy/modules/system/fstools.if --- nsaserefpolicy/policy/modules/system/fstools.if 2008-02-18 14:30:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/fstools.if 2008-04-21 11:02:50.316767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/fstools.if 2008-04-21 11:02:50.000000000 -0400 @@ -81,10 +81,10 @@ # interface(`fstools_read_pipes',` @@ -27624,7 +27837,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.3.1/policy/modules/system/fstools.te --- nsaserefpolicy/policy/modules/system/fstools.te 2008-02-18 14:30:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/fstools.te 2008-04-21 11:02:50.323767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/fstools.te 2008-04-21 11:02:50.000000000 -0400 @@ -97,6 +97,10 @@ fs_getattr_tmpfs_dirs(fsadm_t) fs_read_tmpfs_symlinks(fsadm_t) @@ -27648,7 +27861,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.3.1/policy/modules/system/getty.te --- nsaserefpolicy/policy/modules/system/getty.te 2008-02-18 14:30:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/getty.te 2008-04-21 11:02:50.329766000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/getty.te 2008-04-21 11:02:50.000000000 -0400 @@ -9,6 +9,7 @@ type getty_t; type getty_exec_t; @@ -27659,7 +27872,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty. type getty_etc_t; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.3.1/policy/modules/system/hostname.te --- nsaserefpolicy/policy/modules/system/hostname.te 2008-02-18 14:30:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/hostname.te 2008-04-21 11:02:50.334767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/hostname.te 2008-04-21 11:02:50.000000000 -0400 @@ -8,7 +8,9 @@ type hostname_t; @@ -27673,7 +27886,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplug.te serefpolicy-3.3.1/policy/modules/system/hotplug.te --- nsaserefpolicy/policy/modules/system/hotplug.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/hotplug.te 2008-04-21 11:02:50.340767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/hotplug.te 2008-04-21 11:02:50.000000000 -0400 @@ -179,6 +179,7 @@ sysnet_read_dhcpc_pid(hotplug_t) sysnet_rw_dhcp_config(hotplug_t) @@ -27684,7 +27897,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplu optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.fc serefpolicy-3.3.1/policy/modules/system/init.fc --- nsaserefpolicy/policy/modules/system/init.fc 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/system/init.fc 2008-04-21 11:02:50.345767000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/init.fc 2008-04-21 11:02:50.000000000 -0400 @@ -4,8 +4,7 @@ /etc/init\.d/.* -- gen_context(system_u:object_r:initrc_exec_t,s0) @@ -27702,7 +27915,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.f - diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.3.1/policy/modules/system/init.if --- nsaserefpolicy/policy/modules/system/init.if 2007-10-29 18:02:31.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/system/init.if 2008-04-21 11:02:50.353764000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/init.if 2008-04-28 09:15:35.654776000 -0400 @@ -211,6 +211,13 @@ kernel_dontaudit_use_fds($1) ') @@ -27769,7 +27982,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ') -@@ -567,19 +576,66 @@ +@@ -567,23 +576,70 @@ # interface(`init_domtrans_script',` gen_require(` @@ -27817,11 +28030,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ifdef(`enable_mls',` - range_transition $1 initrc_exec_t:process s0 - mls_systemhigh; + range_transition $1 $2:process s0 - mls_systemhigh; -+ ') -+') -+ -+######################################## -+## + ') + ') + + ######################################## + ## +## Execute a file in a bin directory +## in the initrc_t domain +## @@ -27834,12 +28047,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i +interface(`init_bin_domtrans_spec',` + gen_require(` + type initrc_t; - ') ++ ') + + corecmd_bin_domtrans($1, initrc_t) - ') - - ######################################## ++') ++ ++######################################## ++## + ## Execute a init script in a specified domain. + ## + ## @@ -609,11 +665,11 @@ # cjp: added for gentoo integrated run_init interface(`init_script_file_domtrans',` @@ -27939,7 +28156,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -1273,3 +1349,114 @@ +@@ -1273,3 +1349,131 @@ files_search_pids($1) allow $1 initrc_var_run_t:file manage_file_perms; ') @@ -28053,10 +28270,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i + allow init_t $1:unix_dgram_socket sendto; +') + ++######################################## ++## ++## Search for initrc_t kernel keyrings ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`init_script_search_keyring',` ++ gen_require(` ++ type initrc_t; ++ ') ++ ++ allow $1 initrc_t:key search; ++') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.3.1/policy/modules/system/init.te --- nsaserefpolicy/policy/modules/system/init.te 2008-02-26 08:17:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/init.te 2008-04-21 11:02:50.360757000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/init.te 2008-04-21 11:02:50.000000000 -0400 @@ -10,6 +10,20 @@ # Declarations # @@ -28348,7 +28582,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.3.1/policy/modules/system/iptables.te --- nsaserefpolicy/policy/modules/system/iptables.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/iptables.te 2008-04-21 11:02:50.365752000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/iptables.te 2008-04-21 11:02:50.000000000 -0400 @@ -48,6 +48,7 @@ fs_getattr_xattr_fs(iptables_t) @@ -28359,7 +28593,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.3.1/policy/modules/system/iscsi.te --- nsaserefpolicy/policy/modules/system/iscsi.te 2008-02-18 14:30:18.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/iscsi.te 2008-04-21 11:02:50.370747000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/iscsi.te 2008-04-28 10:29:25.956857000 -0400 @@ -29,7 +29,7 @@ # @@ -28379,7 +28613,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.3.1/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2007-12-12 11:35:28.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/libraries.fc 2008-04-21 11:02:50.389728000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/libraries.fc 2008-04-21 11:02:50.000000000 -0400 @@ -69,8 +69,10 @@ ifdef(`distro_gentoo',` # despite the extensions, they are actually libs @@ -28454,7 +28688,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar +/usr/lib/oracle/.*/lib/libnnz10\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.3.1/policy/modules/system/libraries.te --- nsaserefpolicy/policy/modules/system/libraries.te 2008-02-06 10:33:22.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/libraries.te 2008-04-21 11:02:50.394723000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/libraries.te 2008-04-21 11:02:50.000000000 -0400 @@ -23,6 +23,9 @@ init_system_domain(ldconfig_t,ldconfig_exec_t) role system_r types ldconfig_t; @@ -28523,7 +28757,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.3.1/policy/modules/system/locallogin.te --- nsaserefpolicy/policy/modules/system/locallogin.te 2008-02-06 10:33:22.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/locallogin.te 2008-04-21 11:02:50.401716000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/locallogin.te 2008-04-21 11:02:50.000000000 -0400 @@ -131,6 +131,7 @@ miscfiles_read_localization(local_login_t) @@ -28574,7 +28808,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.3.1/policy/modules/system/logging.fc --- nsaserefpolicy/policy/modules/system/logging.fc 2008-02-26 08:17:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/logging.fc 2008-04-21 11:02:50.407709000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/logging.fc 2008-04-21 11:02:50.000000000 -0400 @@ -4,6 +4,8 @@ /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh) @@ -28604,7 +28838,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin +/var/cfengine/outputs(/.*)? gen_context(system_u:object_r:var_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.3.1/policy/modules/system/logging.if --- nsaserefpolicy/policy/modules/system/logging.if 2007-12-12 11:35:28.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/logging.if 2008-04-21 11:02:50.414703000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/logging.if 2008-04-21 11:02:50.000000000 -0400 @@ -213,12 +213,7 @@ ## # @@ -28831,7 +29065,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.3.1/policy/modules/system/logging.te --- nsaserefpolicy/policy/modules/system/logging.te 2008-02-26 08:17:43.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/logging.te 2008-04-21 11:02:50.421696000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/logging.te 2008-04-21 11:02:50.000000000 -0400 @@ -61,10 +61,29 @@ logging_log_file(var_log_t) files_mountpoint(var_log_t) @@ -29054,7 +29288,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.3.1/policy/modules/system/lvm.fc --- nsaserefpolicy/policy/modules/system/lvm.fc 2007-12-12 11:35:28.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/lvm.fc 2008-04-21 11:02:50.426691000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/lvm.fc 2008-04-21 11:02:50.000000000 -0400 @@ -55,6 +55,7 @@ /sbin/lvs -- gen_context(system_u:object_r:lvm_exec_t,s0) /sbin/lvscan -- gen_context(system_u:object_r:lvm_exec_t,s0) @@ -29070,7 +29304,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc +/var/run/dmevent.* gen_context(system_u:object_r:lvm_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.3.1/policy/modules/system/lvm.te --- nsaserefpolicy/policy/modules/system/lvm.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/lvm.te 2008-04-23 10:09:00.750545000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/lvm.te 2008-04-23 10:09:00.000000000 -0400 @@ -22,7 +22,7 @@ role system_r types lvm_t; @@ -29249,7 +29483,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.3.1/policy/modules/system/miscfiles.fc --- nsaserefpolicy/policy/modules/system/miscfiles.fc 2007-08-22 17:33:53.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/system/miscfiles.fc 2008-04-21 11:02:50.437680000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/miscfiles.fc 2008-04-21 11:02:50.000000000 -0400 @@ -11,6 +11,7 @@ /etc/avahi/etc/localtime -- gen_context(system_u:object_r:locale_t,s0) /etc/localtime -- gen_context(system_u:object_r:locale_t,s0) @@ -29265,7 +29499,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi +HOME_DIR/\.fontconfig(/.*)? gen_context(system_u:object_r:user_fonts_home_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.3.1/policy/modules/system/miscfiles.if --- nsaserefpolicy/policy/modules/system/miscfiles.if 2007-11-16 13:45:14.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/miscfiles.if 2008-04-21 16:33:42.509785000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/miscfiles.if 2008-04-21 16:33:42.000000000 -0400 @@ -489,3 +489,65 @@ manage_lnk_files_pattern($1,locale_t,locale_t) ') @@ -29334,7 +29568,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.te serefpolicy-3.3.1/policy/modules/system/miscfiles.te --- nsaserefpolicy/policy/modules/system/miscfiles.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/miscfiles.te 2008-04-21 11:02:50.449668000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/miscfiles.te 2008-04-21 11:02:50.000000000 -0400 @@ -20,6 +20,14 @@ files_type(fonts_t) @@ -29352,7 +29586,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi type hwdata_t; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.if serefpolicy-3.3.1/policy/modules/system/modutils.if --- nsaserefpolicy/policy/modules/system/modutils.if 2007-03-26 10:39:07.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/system/modutils.if 2008-04-21 11:02:50.455662000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/modutils.if 2008-04-21 11:02:50.000000000 -0400 @@ -66,6 +66,25 @@ ######################################## @@ -29381,7 +29615,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.3.1/policy/modules/system/modutils.te --- nsaserefpolicy/policy/modules/system/modutils.te 2008-02-06 10:33:22.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/modutils.te 2008-04-21 11:02:50.461656000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/modutils.te 2008-04-21 11:02:50.000000000 -0400 @@ -22,6 +22,8 @@ type insmod_exec_t; application_domain(insmod_t,insmod_exec_t) @@ -29524,7 +29758,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti ################################# diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.3.1/policy/modules/system/mount.fc --- nsaserefpolicy/policy/modules/system/mount.fc 2006-11-16 17:15:24.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/mount.fc 2008-04-21 11:02:50.466651000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/mount.fc 2008-04-21 11:02:50.000000000 -0400 @@ -1,4 +1,6 @@ /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) @@ -29536,7 +29770,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. +/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-3.3.1/policy/modules/system/mount.if --- nsaserefpolicy/policy/modules/system/mount.if 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/system/mount.if 2008-04-21 11:02:50.472644000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/mount.if 2008-04-21 11:02:50.000000000 -0400 @@ -48,7 +48,9 @@ mount_domtrans($1) @@ -29550,7 +29784,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. samba_run_smbmount($1, $2, $3) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.3.1/policy/modules/system/mount.te --- nsaserefpolicy/policy/modules/system/mount.te 2008-02-06 10:33:22.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/mount.te 2008-04-22 14:45:02.004951000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/mount.te 2008-04-22 14:45:02.000000000 -0400 @@ -18,17 +18,18 @@ init_system_domain(mount_t,mount_exec_t) role system_r types mount_t; @@ -29698,14 +29932,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/qemu.fc serefpolicy-3.3.1/policy/modules/system/qemu.fc --- nsaserefpolicy/policy/modules/system/qemu.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/qemu.fc 2008-04-21 11:02:50.484633000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/qemu.fc 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1,3 @@ + +/usr/bin/qemu -- gen_context(system_u:object_r:qemu_exec_t,s0) +/usr/bin/qemu-kvm -- gen_context(system_u:object_r:qemu_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/qemu.if serefpolicy-3.3.1/policy/modules/system/qemu.if --- nsaserefpolicy/policy/modules/system/qemu.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/qemu.if 2008-04-21 11:02:50.489628000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/qemu.if 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1,303 @@ + +## policy for qemu @@ -30012,8 +30246,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/qemu.i + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/qemu.te serefpolicy-3.3.1/policy/modules/system/qemu.te --- nsaserefpolicy/policy/modules/system/qemu.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/qemu.te 2008-04-21 11:02:50.493624000 -0400 -@@ -0,0 +1,50 @@ ++++ serefpolicy-3.3.1/policy/modules/system/qemu.te 2008-04-28 16:14:23.857051000 -0400 +@@ -0,0 +1,49 @@ +policy_module(qemu,1.0.0) + +## @@ -30060,13 +30294,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/qemu.t +unconfined_domain_noaudit(qemu_unconfined_t) +allow qemu_unconfined_t self:process { execstack execmem }; + -+ +optional_policy(` + xserver_xdm_rw_shm(qemu_unconfined_t) +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.3.1/policy/modules/system/raid.te --- nsaserefpolicy/policy/modules/system/raid.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/raid.te 2008-04-21 11:02:50.497620000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/raid.te 2008-04-21 11:02:50.000000000 -0400 @@ -19,7 +19,7 @@ # Local policy # @@ -30094,7 +30327,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.3.1/policy/modules/system/selinuxutil.fc --- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-18 11:12:44.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/system/selinuxutil.fc 2008-04-21 11:02:50.502615000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/selinuxutil.fc 2008-04-21 11:02:50.000000000 -0400 @@ -38,7 +38,7 @@ /usr/sbin/restorecond -- gen_context(system_u:object_r:restorecond_exec_t,s0) /usr/sbin/run_init -- gen_context(system_u:object_r:run_init_exec_t,s0) @@ -30106,7 +30339,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.3.1/policy/modules/system/selinuxutil.if --- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-11-29 13:29:35.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/selinuxutil.if 2008-04-21 11:02:50.511606000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/selinuxutil.if 2008-04-21 11:02:50.000000000 -0400 @@ -215,8 +215,6 @@ seutil_domtrans_newrole($1) role $2 types newrole_t; @@ -30390,7 +30623,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.3.1/policy/modules/system/selinuxutil.te --- nsaserefpolicy/policy/modules/system/selinuxutil.te 2008-02-06 10:33:22.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/selinuxutil.te 2008-04-21 11:02:50.518599000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/selinuxutil.te 2008-04-28 10:24:53.045591000 -0400 @@ -75,7 +75,6 @@ type restorecond_exec_t; init_daemon_domain(restorecond_t,restorecond_exec_t) @@ -30628,7 +30861,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu fs_search_auto_mountpoints(setfiles_t) fs_relabelfrom_noxattr_fs(setfiles_t) -@@ -617,16 +596,8 @@ +@@ -572,9 +551,7 @@ + selinux_compute_relabel_context(setfiles_t) + selinux_compute_user_contexts(setfiles_t) + +-term_use_all_user_ttys(setfiles_t) +-term_use_all_user_ptys(setfiles_t) +-term_use_unallocated_ttys(setfiles_t) ++term_use_all_terms(setfiles_t) + + # this is to satisfy the assertion: + auth_relabelto_shadow(setfiles_t) +@@ -617,16 +594,8 @@ ') ') @@ -30649,7 +30893,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/setrans.te serefpolicy-3.3.1/policy/modules/system/setrans.te --- nsaserefpolicy/policy/modules/system/setrans.te 2007-10-02 09:54:52.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/system/setrans.te 2008-04-21 11:02:50.523594000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/setrans.te 2008-04-21 11:02:50.000000000 -0400 @@ -28,7 +28,7 @@ # @@ -30669,7 +30913,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/setran diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.3.1/policy/modules/system/sysnetwork.if --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-16 14:09:49.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/system/sysnetwork.if 2008-04-21 11:02:50.529588000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/sysnetwork.if 2008-04-21 11:02:50.000000000 -0400 @@ -145,6 +145,25 @@ ######################################## @@ -30768,7 +31012,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.3.1/policy/modules/system/sysnetwork.te --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2008-02-06 10:33:22.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/sysnetwork.te 2008-04-22 07:16:34.625592000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/sysnetwork.te 2008-04-22 07:16:34.000000000 -0400 @@ -45,7 +45,7 @@ dontaudit dhcpc_t self:capability sys_tty_config; # for access("/etc/bashrc", X_OK) on Red Hat @@ -30919,9 +31163,63 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet kernel_read_xen_state(ifconfig_t) kernel_write_xen_state(ifconfig_t) xen_append_log(ifconfig_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.if serefpolicy-3.3.1/policy/modules/system/udev.if +--- nsaserefpolicy/policy/modules/system/udev.if 2007-01-02 12:57:49.000000000 -0500 ++++ serefpolicy-3.3.1/policy/modules/system/udev.if 2008-04-28 10:54:03.940707000 -0400 +@@ -96,6 +96,24 @@ + + ######################################## + ## ++## dontaudit process read list of devices. ++## ++## ++## ++## The type of the process performing this action. ++## ++## ++# ++interface(`udev_dontaudit_search_db',` ++ gen_require(` ++ type udev_tbl_t; ++ ') ++ ++ dontaudit $1 udev_tbl_t:dir search_dir_perms; ++') ++ ++######################################## ++## + ## Allow process to read list of devices. + ## + ## +@@ -106,11 +124,11 @@ + # + interface(`udev_read_db',` + gen_require(` +- type udev_tdb_t; ++ type udev_tbl_t; + ') + + dev_list_all_dev_nodes($1) +- allow $1 udev_tdb_t:file read_file_perms; ++ read_files_pattern($1, udev_tbl_t, udev_tbl_t) + ') + + ######################################## +@@ -125,9 +143,9 @@ + # + interface(`udev_rw_db',` + gen_require(` +- type udev_tdb_t; ++ type udev_tbl_t; + ') + + dev_list_all_dev_nodes($1) +- allow $1 udev_tdb_t:file rw_file_perms; ++ allow $1 udev_tbl_t:file rw_file_perms; + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.3.1/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/udev.te 2008-04-21 11:02:50.541576000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/udev.te 2008-04-21 11:02:50.000000000 -0400 @@ -83,6 +83,7 @@ kernel_rw_unix_dgram_sockets(udev_t) kernel_dgram_send(udev_t) @@ -30979,7 +31277,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.3.1/policy/modules/system/unconfined.fc --- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-12-12 11:35:28.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/unconfined.fc 2008-04-21 11:02:50.546571000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/unconfined.fc 2008-04-21 11:02:50.000000000 -0400 @@ -2,15 +2,16 @@ # e.g.: # /usr/local/bin/appsrv -- gen_context(system_u:object_r:unconfined_exec_t,s0) @@ -31003,7 +31301,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf +/usr/sbin/sysreport -- gen_context(system_u:object_r:unconfined_notrans_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.3.1/policy/modules/system/unconfined.if --- nsaserefpolicy/policy/modules/system/unconfined.if 2007-11-16 15:30:49.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/unconfined.if 2008-04-21 11:02:50.553564000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/unconfined.if 2008-04-25 13:52:57.000000000 -0400 @@ -12,14 +12,13 @@ # interface(`unconfined_domain_noaudit',` @@ -31038,15 +31336,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf kernel_unconfined($1) corenet_unconfined($1) -@@ -40,6 +40,7 @@ +@@ -40,10 +40,16 @@ domain_unconfined($1) domain_dontaudit_read_all_domains_state($1) domain_dontaudit_ptrace_all_domains($1) -+ domain_mmap_low($1) ++ files_unconfined($1) fs_unconfined($1) selinux_unconfined($1) -@@ -70,6 +71,7 @@ + ++ domain_mmap_low_type($1) ++ tunable_policy(`allow_unconfined_mmap_low',` ++ domain_mmap_low($1) ++ ') ++ + tunable_policy(`allow_execheap',` + # Allow making the stack executable via mprotect. + allow $1 self:process execheap; +@@ -70,6 +76,7 @@ optional_policy(` # Communicate via dbusd. dbus_system_bus_unconfined($1) @@ -31054,7 +31361,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -95,6 +97,10 @@ +@@ -95,6 +102,10 @@ optional_policy(` storage_unconfined($1) ') @@ -31065,7 +31372,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') ######################################## -@@ -372,6 +378,24 @@ +@@ -372,6 +383,24 @@ ######################################## ## @@ -31090,7 +31397,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ## Send generic signals to the unconfined domain. ## ## -@@ -581,7 +605,6 @@ +@@ -581,7 +610,6 @@ interface(`unconfined_dbus_connect',` gen_require(` type unconfined_t; @@ -31098,19 +31405,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') allow $1 unconfined_t:dbus acquire_svc; -@@ -589,49 +612,209 @@ +@@ -589,7 +617,7 @@ ######################################## ## -## Read files in unconfined users home directories. +## Allow ptrace of unconfined domain -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -597,20 +625,53 @@ + ## + ## + # +-interface(`unconfined_read_home_content_files',` +interface(`unconfined_ptrace',` + gen_require(` + type unconfined_t; @@ -31148,34 +31456,47 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf +## +# +interface(`unconfined_execmem_rw_shm',` -+ gen_require(` + gen_require(` +- type unconfined_home_dir_t, unconfined_home_t; + type unconfined_execmem_t; -+ ') -+ + ') + +- files_search_home($1) +- allow $1 { unconfined_home_dir_t unconfined_home_t }:dir list_dir_perms; +- read_files_pattern($1, { unconfined_home_dir_t unconfined_home_t }, unconfined_home_t) +- read_lnk_files_pattern($1, { unconfined_home_dir_t unconfined_home_t }, unconfined_home_t) + allow $1 unconfined_execmem_t:shm rw_shm_perms; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Read unconfined users temporary files. +## Transition to the unconfined_execmem domain. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -618,20 +679,58 @@ + ## + ## + # +-interface(`unconfined_read_tmp_files',` +interface(`unconfined_execmem_domtrans',` + -+ gen_require(` + gen_require(` +- type unconfined_tmp_t; + type unconfined_execmem_t, unconfined_execmem_exec_t; -+ ') -+ + ') + +- files_search_tmp($1) +- allow $1 unconfined_tmp_t:dir list_dir_perms; +- read_files_pattern($1, unconfined_tmp_t, unconfined_tmp_t) +- read_lnk_files_pattern($1, unconfined_tmp_t, unconfined_tmp_t) + domtrans_pattern($1,unconfined_execmem_exec_t,unconfined_execmem_t) -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Write unconfined users temporary files. +## allow attempts to use unconfined ttys and ptys. +## +## @@ -31217,15 +31538,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf +######################################## +## +## Allow apps to set rlimits on userdomain -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -639,10 +738,99 @@ + ## + ## + # +-interface(`unconfined_write_tmp_files',` +interface(`unconfined_set_rlimitnh',` -+ gen_require(` + gen_require(` +- type unconfined_tmp_t; + type unconfined_t; + ') + @@ -31254,83 +31577,67 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf +######################################## +## +## Read/write unconfined tmpfs files. - ## ++## +## +##

+## Read/write unconfined tmpfs files. +##

+## - ## - ## - ## Domain allowed access. - ## - ## - # --interface(`unconfined_read_home_content_files',` ++## ++## ++## Domain allowed access. ++## ++## ++# +interface(`unconfined_rw_tmpfs_files',` - gen_require(` -- type unconfined_home_dir_t, unconfined_home_t; ++ gen_require(` + type unconfined_tmpfs_t; - ') - -- files_search_home($1) -- allow $1 { unconfined_home_dir_t unconfined_home_t }:dir list_dir_perms; -- read_files_pattern($1, { unconfined_home_dir_t unconfined_home_t }, unconfined_home_t) -- read_lnk_files_pattern($1, { unconfined_home_dir_t unconfined_home_t }, unconfined_home_t) ++ ') ++ + fs_search_tmpfs($1) + allow $1 unconfined_tmpfs_t:dir list_dir_perms; + rw_files_pattern($1,unconfined_tmpfs_t,unconfined_tmpfs_t) + read_lnk_files_pattern($1,unconfined_tmpfs_t,unconfined_tmpfs_t) - ') - - ######################################## - ## --## Read unconfined users temporary files. ++') ++ ++######################################## ++## +## Delete unconfined tmpfs files. - ## ++## +## +##

+## Read/write unconfined tmpfs files. +##

+## - ## - ## - ## Domain allowed access. - ## - ## - # --interface(`unconfined_read_tmp_files',` ++## ++## ++## Domain allowed access. ++## ++## ++# +interface(`unconfined_delete_tmpfs_files',` - gen_require(` -- type unconfined_tmp_t; ++ gen_require(` + type unconfined_tmpfs_t; - ') - -- files_search_tmp($1) -- allow $1 unconfined_tmp_t:dir list_dir_perms; -- read_files_pattern($1, unconfined_tmp_t, unconfined_tmp_t) -- read_lnk_files_pattern($1, unconfined_tmp_t, unconfined_tmp_t) ++ ') ++ + fs_search_tmpfs($1) + allow $1 unconfined_tmpfs_t:dir list_dir_perms; + delete_files_pattern($1,unconfined_tmpfs_t,unconfined_tmpfs_t) + read_lnk_files_pattern($1,unconfined_tmpfs_t,unconfined_tmpfs_t) - ') - - ######################################## - ## --## Write unconfined users temporary files. ++') ++ ++######################################## ++## +## Get the process group of unconfined. - ## - ## - ## -@@ -639,10 +822,10 @@ - ## - ## - # --interface(`unconfined_write_tmp_files',` ++## ++## ++## ++## Domain allowed access. ++## ++## ++# +interface(`unconfined_getpgid',` - gen_require(` -- type unconfined_tmp_t; ++ gen_require(` + type unconfined_t; ') @@ -31339,8 +31646,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.3.1/policy/modules/system/unconfined.te --- nsaserefpolicy/policy/modules/system/unconfined.te 2008-02-13 16:26:06.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/unconfined.te 2008-04-24 16:57:46.339086000 -0400 -@@ -6,35 +6,67 @@ ++++ serefpolicy-3.3.1/policy/modules/system/unconfined.te 2008-04-25 14:52:17.000000000 -0400 +@@ -6,35 +6,74 @@ # Declarations # @@ -31353,6 +31660,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + +## +##

++## Allow unconfined domain to map low memory in the kernel ++##

++## ++gen_tunable(allow_unconfined_mmap_low,false) ++ ++## ++##

+## Transition to confined qemu domains from unconfined user +##

+## @@ -31412,7 +31726,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf libs_run_ldconfig(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) -@@ -42,37 +74,44 @@ +@@ -42,37 +81,44 @@ logging_run_auditctl(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) mount_run_unconfined(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) @@ -31467,7 +31781,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -101,12 +140,24 @@ +@@ -101,12 +147,24 @@ ') optional_policy(` @@ -31492,7 +31806,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -118,11 +169,7 @@ +@@ -118,11 +176,7 @@ ') optional_policy(` @@ -31505,7 +31819,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -134,82 +181,97 @@ +@@ -134,82 +188,97 @@ ') optional_policy(` @@ -31628,7 +31942,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') ######################################## -@@ -219,14 +281,35 @@ +@@ -219,14 +288,35 @@ allow unconfined_execmem_t self:process { execstack execmem }; unconfined_domain_noaudit(unconfined_execmem_t) @@ -31671,7 +31985,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf +domain_ptrace_all_domains(unconfined_notrans_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.3.1/policy/modules/system/userdomain.fc --- nsaserefpolicy/policy/modules/system/userdomain.fc 2007-02-19 11:32:53.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/userdomain.fc 2008-04-21 11:02:50.564553000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/userdomain.fc 2008-04-21 11:02:50.000000000 -0400 @@ -1,4 +1,5 @@ -HOME_DIR -d gen_context(system_u:object_r:ROLE_home_dir_t,s0-mls_systemhigh) -HOME_DIR/.+ gen_context(system_u:object_r:ROLE_home_t,s0) @@ -31684,7 +31998,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo +/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.3.1/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2008-02-15 09:52:56.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/userdomain.if 2008-04-24 15:08:40.156331000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/userdomain.if 2008-04-28 15:32:37.832254000 -0400 @@ -29,9 +29,14 @@ ') @@ -34467,7 +34781,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + attribute user_home_type; + ') + -+ allow $1 user_home_type:file write; ++ allow $1 user_home_type:file write_file_perms; +') + +######################################## @@ -34655,7 +34969,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.3.1/policy/modules/system/userdomain.te --- nsaserefpolicy/policy/modules/system/userdomain.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/userdomain.te 2008-04-21 11:02:50.596521000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/userdomain.te 2008-04-21 11:02:50.000000000 -0400 @@ -2,12 +2,7 @@ policy_module(userdomain,2.5.0) @@ -34963,7 +35277,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.fc serefpolicy-3.3.1/policy/modules/system/virt.fc --- nsaserefpolicy/policy/modules/system/virt.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/virt.fc 2008-04-21 11:02:50.601516000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/virt.fc 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1,13 @@ + +/usr/sbin/libvirtd -- gen_context(system_u:object_r:virtd_exec_t,s0) @@ -34980,7 +35294,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.f +/etc/libvirt/.*/.* gen_context(system_u:object_r:virt_etc_rw_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.3.1/policy/modules/system/virt.if --- nsaserefpolicy/policy/modules/system/virt.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/virt.if 2008-04-21 11:02:50.606511000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/virt.if 2008-04-28 16:10:44.344207000 -0400 @@ -0,0 +1,324 @@ + +## policy for virt @@ -35308,8 +35622,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.i + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.3.1/policy/modules/system/virt.te --- nsaserefpolicy/policy/modules/system/virt.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/virt.te 2008-04-23 10:09:03.411358000 -0400 -@@ -0,0 +1,174 @@ ++++ serefpolicy-3.3.1/policy/modules/system/virt.te 2008-04-28 16:24:22.547363000 -0400 +@@ -0,0 +1,197 @@ + +policy_module(virt,1.0.0) + @@ -35364,8 +35678,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.t +# +# virtd local policy +# -+allow virtd_t self:capability { dac_override kill net_admin setgid }; -+allow virtd_t self:process { sigkill signal }; ++allow virtd_t self:capability { dac_override kill net_admin setgid sys_ptrace }; ++allow virtd_t self:process { sigkill signal execmem }; +allow virtd_t self:fifo_file rw_file_perms; +allow virtd_t self:unix_stream_socket create_stream_socket_perms; +allow virtd_t self:tcp_socket create_stream_socket_perms; @@ -35383,6 +35697,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.t +manage_files_pattern(virtd_t, virt_log_t, virt_log_t) +logging_log_filetrans(virtd_t, virt_log_t, { file dir } ) + ++manage_files_pattern(virtd_t, virt_image_t, virt_image_t) ++ +read_files_pattern(virtd_t, virt_etc_t, virt_etc_t) +read_lnk_files_pattern(virtd_t, virt_etc_t, virt_etc_t) + @@ -35425,6 +35741,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.t +files_read_etc_runtime_files(virtd_t) +files_search_all(virtd_t) + ++fs_list_auto_mountpoints(virtd_t) ++ ++storage_raw_write_removable_device(virtd_t) ++storage_raw_read_removable_device(virtd_t) ++ ++term_getattr_pty_fs(virtd_t) ++term_use_ptmx(virtd_t) ++ +libs_use_ld_so(virtd_t) +libs_use_shared_libs(virtd_t) + @@ -35467,6 +35791,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.t + +optional_policy(` + polkit_domtrans_auth(virtd_t) ++ polkit_domtrans_resolve(virtd_t) +') + +optional_policy(` @@ -35484,9 +35809,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.t + xen_stream_connect(virtd_t) + xen_stream_connect_xenstore(virtd_t) +') ++ ++tunable_policy(`virt_use_nfs',` ++ fs_manage_nfs_dirs(virtd_t) ++ fs_manage_nfs_files(virtd_t) ++ fs_read_nfs_symlinks(virtd_t) ++') ++ ++tunable_policy(`virt_use_samba',` ++ fs_manage_nfs_files(virtd_t) ++ fs_manage_cifs_files(virtd_t) ++ fs_read_cifs_symlinks(virtd_t) ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.3.1/policy/modules/system/xen.if --- nsaserefpolicy/policy/modules/system/xen.if 2007-06-21 09:32:04.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/system/xen.if 2008-04-21 11:02:50.616500000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/xen.if 2008-04-21 11:02:50.000000000 -0400 @@ -167,11 +167,14 @@ # interface(`xen_stream_connect',` @@ -35530,7 +35867,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.3.1/policy/modules/system/xen.te --- nsaserefpolicy/policy/modules/system/xen.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/system/xen.te 2008-04-21 11:02:50.622495000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/xen.te 2008-04-21 11:02:50.000000000 -0400 @@ -6,6 +6,13 @@ # Declarations # @@ -35720,17 +36057,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/auditadm.fc serefpolicy-3.3.1/policy/modules/users/auditadm.fc --- nsaserefpolicy/policy/modules/users/auditadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/auditadm.fc 2008-04-21 11:02:50.628489000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/auditadm.fc 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +# No auditadm file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/auditadm.if serefpolicy-3.3.1/policy/modules/users/auditadm.if --- nsaserefpolicy/policy/modules/users/auditadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/auditadm.if 2008-04-21 11:02:50.632485000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/auditadm.if 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +## Policy for auditadm user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/auditadm.te serefpolicy-3.3.1/policy/modules/users/auditadm.te --- nsaserefpolicy/policy/modules/users/auditadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/auditadm.te 2008-04-21 11:02:50.636481000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/auditadm.te 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1,25 @@ +policy_module(auditadm,1.0.1) +gen_require(` @@ -35759,17 +36096,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/auditad +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.3.1/policy/modules/users/guest.fc --- nsaserefpolicy/policy/modules/users/guest.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/guest.fc 2008-04-21 11:02:50.640477000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/guest.fc 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +# No guest file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.3.1/policy/modules/users/guest.if --- nsaserefpolicy/policy/modules/users/guest.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/guest.if 2008-04-21 11:02:50.644475000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/guest.if 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +## Policy for guest user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.3.1/policy/modules/users/guest.te --- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/guest.te 2008-04-21 11:02:50.649467000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/guest.te 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1,21 @@ +policy_module(guest,1.0.1) +userdom_restricted_user_template(guest) @@ -35794,17 +36131,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.t +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.3.1/policy/modules/users/logadm.fc --- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/logadm.fc 2008-04-21 11:02:50.653465000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/logadm.fc 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +# No logadm file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.3.1/policy/modules/users/logadm.if --- nsaserefpolicy/policy/modules/users/logadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/logadm.if 2008-04-21 11:02:50.658459000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/logadm.if 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +## Policy for logadm user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.3.1/policy/modules/users/logadm.te --- nsaserefpolicy/policy/modules/users/logadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/logadm.te 2008-04-21 11:02:50.662457000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/logadm.te 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1,11 @@ +policy_module(logadm,1.0.0) + @@ -35819,22 +36156,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm. +logging_admin(logadm_t, logadm_r, { logadm_devpts_t logadm_tty_device_t }) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.3.1/policy/modules/users/metadata.xml --- nsaserefpolicy/policy/modules/users/metadata.xml 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/metadata.xml 2008-04-21 11:02:50.666453000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/metadata.xml 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +Policy modules for users diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/secadm.fc serefpolicy-3.3.1/policy/modules/users/secadm.fc --- nsaserefpolicy/policy/modules/users/secadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/secadm.fc 2008-04-21 11:02:50.669451000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/secadm.fc 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +# No secadm file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/secadm.if serefpolicy-3.3.1/policy/modules/users/secadm.if --- nsaserefpolicy/policy/modules/users/secadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/secadm.if 2008-04-21 11:02:50.672448000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/secadm.if 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +## Policy for secadm user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/secadm.te serefpolicy-3.3.1/policy/modules/users/secadm.te --- nsaserefpolicy/policy/modules/users/secadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/secadm.te 2008-04-21 11:02:50.676440000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/secadm.te 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1,39 @@ +policy_module(secadm,1.0.1) +gen_require(` @@ -35877,17 +36214,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/secadm. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.fc serefpolicy-3.3.1/policy/modules/users/staff.fc --- nsaserefpolicy/policy/modules/users/staff.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/staff.fc 2008-04-21 11:02:50.690428000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/staff.fc 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +# No staff file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.if serefpolicy-3.3.1/policy/modules/users/staff.if --- nsaserefpolicy/policy/modules/users/staff.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/staff.if 2008-04-21 11:02:50.727392000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/staff.if 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +## Policy for staff user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.te serefpolicy-3.3.1/policy/modules/users/staff.te --- nsaserefpolicy/policy/modules/users/staff.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/staff.te 2008-04-24 15:09:37.398476000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/staff.te 2008-04-24 15:09:37.000000000 -0400 @@ -0,0 +1,23 @@ +policy_module(staff,1.0.1) +userdom_admin_login_user_template(staff) @@ -35914,17 +36251,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.t + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/user.fc serefpolicy-3.3.1/policy/modules/users/user.fc --- nsaserefpolicy/policy/modules/users/user.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/user.fc 2008-04-21 11:02:50.738381000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/user.fc 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +# No user file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/user.if serefpolicy-3.3.1/policy/modules/users/user.if --- nsaserefpolicy/policy/modules/users/user.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/user.if 2008-04-21 11:02:50.741379000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/user.if 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +## Policy for user user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/user.te serefpolicy-3.3.1/policy/modules/users/user.te --- nsaserefpolicy/policy/modules/users/user.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/user.te 2008-04-24 15:09:03.056815000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/user.te 2008-04-24 15:09:03.000000000 -0400 @@ -0,0 +1,18 @@ +policy_module(user,1.0.1) +userdom_unpriv_user_template(user) @@ -35946,17 +36283,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/user.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.3.1/policy/modules/users/webadm.fc --- nsaserefpolicy/policy/modules/users/webadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/webadm.fc 2008-04-21 11:02:50.749370000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/webadm.fc 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +# No webadm file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.3.1/policy/modules/users/webadm.if --- nsaserefpolicy/policy/modules/users/webadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/webadm.if 2008-04-21 11:02:50.752367000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/webadm.if 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +## Policy for webadm user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.3.1/policy/modules/users/webadm.te --- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/webadm.te 2008-04-21 11:02:50.755365000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/webadm.te 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1,41 @@ +policy_module(webadm,1.0.0) + @@ -36001,17 +36338,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm. +userdom_role_change_template(staff, webadm) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.fc serefpolicy-3.3.1/policy/modules/users/xguest.fc --- nsaserefpolicy/policy/modules/users/xguest.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/xguest.fc 2008-04-21 11:02:50.758364000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/xguest.fc 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +# No xguest file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.if serefpolicy-3.3.1/policy/modules/users/xguest.if --- nsaserefpolicy/policy/modules/users/xguest.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/xguest.if 2008-04-21 11:02:50.763355000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/xguest.if 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1 @@ +## Policy for xguest user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.te serefpolicy-3.3.1/policy/modules/users/xguest.te --- nsaserefpolicy/policy/modules/users/xguest.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/users/xguest.te 2008-04-21 11:02:50.768353000 -0400 ++++ serefpolicy-3.3.1/policy/modules/users/xguest.te 2008-04-21 11:02:50.000000000 -0400 @@ -0,0 +1,66 @@ +policy_module(xguest,1.0.1) + @@ -36081,7 +36418,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/file_patterns.spt serefpolicy-3.3.1/policy/support/file_patterns.spt --- nsaserefpolicy/policy/support/file_patterns.spt 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.3.1/policy/support/file_patterns.spt 2008-04-21 11:02:50.774346000 -0400 ++++ serefpolicy-3.3.1/policy/support/file_patterns.spt 2008-04-21 11:02:50.000000000 -0400 @@ -537,3 +537,23 @@ allow $1 $2:dir rw_dir_perms; type_transition $1 $2:$4 $3; @@ -36108,7 +36445,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/file_patterns +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.3.1/policy/support/obj_perm_sets.spt --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2008-02-06 10:33:22.000000000 -0500 -+++ serefpolicy-3.3.1/policy/support/obj_perm_sets.spt 2008-04-21 11:02:50.781336000 -0400 ++++ serefpolicy-3.3.1/policy/support/obj_perm_sets.spt 2008-04-21 11:02:50.000000000 -0400 @@ -315,3 +315,13 @@ # define(`client_stream_socket_perms', `{ create ioctl read getattr write setattr append bind getopt setopt shutdown }') @@ -36125,7 +36462,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets +define(`manage_key_perms', `{ create link read search setattr view write } ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.3.1/policy/users --- nsaserefpolicy/policy/users 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.3.1/policy/users 2008-04-21 11:02:50.786332000 -0400 ++++ serefpolicy-3.3.1/policy/users 2008-04-21 11:02:50.000000000 -0400 @@ -16,7 +16,7 @@ # and a user process should never be assigned the system user # identity. diff --git a/selinux-policy.spec b/selinux-policy.spec index ed2863c..24b7dfe 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -17,7 +17,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.3.1 -Release: 41%{?dist} +Release: 43%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -385,6 +385,14 @@ exit 0 %endif %changelog +* Mon Apr 28 2008 Dan Walsh 3.3.1-43 +- Remove old booleans from targeted-booleans.conf file + +* Fri Apr 25 2008 Dan Walsh 3.3.1-42 +- Add boolean to mmap_zero +- allow tor setgid +- Allow gnomeclock to set clock + * Thu Apr 24 2008 Dan Walsh 3.3.1-41 - Don't run crontab from unconfined_t