diff --git a/policy-F13.patch b/policy-F13.patch index 8d12bed..00b15aa 100644 --- a/policy-F13.patch +++ b/policy-F13.patch @@ -50,7 +50,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.7.8/policy/modules/admin/alsa.te --- nsaserefpolicy/policy/modules/admin/alsa.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/admin/alsa.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/admin/alsa.te 2010-02-08 12:28:40.000000000 -0500 @@ -51,6 +51,8 @@ files_read_etc_files(alsa_t) files_read_usr_files(alsa_t) @@ -223,7 +223,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.7.8/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/admin/logrotate.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/admin/logrotate.te 2010-02-04 13:12:24.000000000 -0500 @@ -32,7 +32,7 @@ # Change ownership on log files. allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner sys_resource sys_nice }; @@ -280,7 +280,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota consoletype_exec(logrotate_t) ') -@@ -157,6 +173,10 @@ +@@ -157,11 +173,15 @@ ') optional_policy(` @@ -291,13 +291,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota hostname_exec(logrotate_t) ') -@@ -183,6 +203,10 @@ + optional_policy(` +- samba_exec_log(logrotate_t) ++ icecast_signal(logrotate_t) + ') + + optional_policy(` +@@ -183,6 +203,15 @@ ') optional_policy(` + psad_domtrans(logrotate_t) +') + ++ ++optional_policy(` ++ samba_exec_log(logrotate_t) ++') ++ +optional_policy(` slrnpull_manage_spool(logrotate_t) ') @@ -358,8 +369,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mcelog. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mcelog.te serefpolicy-3.7.8/policy/modules/admin/mcelog.te --- nsaserefpolicy/policy/modules/admin/mcelog.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/admin/mcelog.te 2010-02-03 08:26:09.000000000 -0500 -@@ -0,0 +1,31 @@ ++++ serefpolicy-3.7.8/policy/modules/admin/mcelog.te 2010-02-08 12:28:54.000000000 -0500 +@@ -0,0 +1,32 @@ + +policy_module(mcelog,1.0.0) + @@ -380,6 +391,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mcelog. +# mcelog local policy +# + ++allow mcelog_t self:capability sys_admin; + +kernel_read_system_state(mcelog_t) + @@ -621,7 +633,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.7.8/policy/modules/admin/readahead.te --- nsaserefpolicy/policy/modules/admin/readahead.te 2009-11-17 10:54:26.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/admin/readahead.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/admin/readahead.te 2010-02-08 15:48:06.000000000 -0500 @@ -52,6 +52,7 @@ files_list_non_security(readahead_t) @@ -630,6 +642,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe files_create_boot_flag(readahead_t) files_getattr_all_pipes(readahead_t) files_dontaudit_getattr_all_sockets(readahead_t) +@@ -61,6 +62,8 @@ + fs_search_auto_mountpoints(readahead_t) + fs_getattr_all_pipes(readahead_t) + fs_getattr_all_files(readahead_t) ++fs_read_cgroup_files(readahead_t) ++fs_read_tmpfs_files(readahead_t) + fs_read_tmpfs_symlinks(readahead_t) + fs_list_inotifyfs(readahead_t) + fs_dontaudit_search_ramfs(readahead_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.7.8/policy/modules/admin/rpm.fc --- nsaserefpolicy/policy/modules/admin/rpm.fc 2009-07-14 14:19:57.000000000 -0400 +++ serefpolicy-3.7.8/policy/modules/admin/rpm.fc 2010-02-02 10:31:03.000000000 -0500 @@ -1667,7 +1688,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.7.8/policy/modules/admin/usermanage.te --- nsaserefpolicy/policy/modules/admin/usermanage.te 2009-11-17 10:54:26.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/admin/usermanage.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/admin/usermanage.te 2010-02-05 09:55:40.000000000 -0500 @@ -82,6 +82,7 @@ selinux_compute_relabel_context(chfn_t) selinux_compute_user_contexts(chfn_t) @@ -1709,6 +1730,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman seutil_read_config(groupadd_t) +@@ -256,7 +256,7 @@ + # Passwd local policy + # + +-allow passwd_t self:capability { chown dac_override fsetid setuid setgid sys_resource }; ++allow passwd_t self:capability { chown dac_override fsetid setuid setgid sys_nice sys_resource }; + allow passwd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; + allow passwd_t self:process { setrlimit setfscreate }; + allow passwd_t self:fd use; @@ -292,6 +292,7 @@ selinux_compute_relabel_context(passwd_t) selinux_compute_user_contexts(passwd_t) @@ -1854,6 +1884,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te optional_policy(` dbus_system_bus_client(vpnc_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cdrecord.te serefpolicy-3.7.8/policy/modules/apps/cdrecord.te +--- nsaserefpolicy/policy/modules/apps/cdrecord.te 2009-11-17 10:54:26.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/apps/cdrecord.te 2010-02-08 11:46:07.000000000 -0500 +@@ -32,6 +32,8 @@ + allow cdrecord_t self:unix_dgram_socket create_socket_perms; + allow cdrecord_t self:unix_stream_socket create_stream_socket_perms; + ++corecmd_exec_bin(cdrecord_t) ++ + # allow searching for cdrom-drive + dev_list_all_dev_nodes(cdrecord_t) + dev_read_sysfs(cdrecord_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.fc serefpolicy-3.7.8/policy/modules/apps/chrome.fc --- nsaserefpolicy/policy/modules/apps/chrome.fc 1969-12-31 19:00:00.000000000 -0500 +++ serefpolicy-3.7.8/policy/modules/apps/chrome.fc 2010-02-02 10:31:03.000000000 -0500 @@ -2807,8 +2849,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc s /usr/bin/gpg-agent -- gen_context(system_u:object_r:gpg_agent_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.7.8/policy/modules/apps/gpg.te --- nsaserefpolicy/policy/modules/apps/gpg.te 2009-12-04 09:43:33.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/apps/gpg.te 2010-02-02 10:31:03.000000000 -0500 -@@ -130,10 +130,10 @@ ++++ serefpolicy-3.7.8/policy/modules/apps/gpg.te 2010-02-05 10:53:43.000000000 -0500 +@@ -20,6 +20,7 @@ + typealias gpg_t alias { auditadm_gpg_t secadm_gpg_t }; + application_domain(gpg_t, gpg_exec_t) + ubac_constrained(gpg_t) ++role system_r types gpg_t; + + type gpg_agent_t; + type gpg_agent_exec_t; +@@ -45,6 +46,7 @@ + typealias gpg_helper_t alias { auditadm_gpg_helper_t secadm_gpg_helper_t }; + application_domain(gpg_helper_t, gpg_helper_exec_t) + ubac_constrained(gpg_helper_t) ++role system_r types gpg_helper_t; + + type gpg_pinentry_t; + type pinentry_exec_t; +@@ -59,7 +61,7 @@ + # + + allow gpg_t self:capability { ipc_lock setuid }; +-# setrlimit is for ulimit -c 0 ++#at setrlimit is for ulimit -c 0 + allow gpg_t self:process { signal setrlimit getcap setcap setpgid }; + + allow gpg_t self:fifo_file rw_fifo_file_perms; +@@ -130,10 +132,10 @@ xserver_rw_xdm_pipes(gpg_t) ') @@ -3073,8 +3140,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.te serefpolicy-3.7.8/policy/modules/apps/kdumpgui.te --- nsaserefpolicy/policy/modules/apps/kdumpgui.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/apps/kdumpgui.te 2010-02-02 10:31:03.000000000 -0500 -@@ -0,0 +1,64 @@ ++++ serefpolicy-3.7.8/policy/modules/apps/kdumpgui.te 2010-02-05 14:36:52.000000000 -0500 +@@ -0,0 +1,68 @@ +policy_module(kdumpgui,1.0.0) + +######################################## @@ -3137,6 +3204,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui +') + +optional_policy(` ++ gnome_dontaudit_search_config(kdumpgui_t) ++') ++ ++optional_policy(` + policykit_dbus_chat(kdumpgui_t) +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/livecd.fc serefpolicy-3.7.8/policy/modules/apps/livecd.fc @@ -4861,8 +4932,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.te serefpolicy-3.7.8/policy/modules/apps/sambagui.te --- nsaserefpolicy/policy/modules/apps/sambagui.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/apps/sambagui.te 2010-02-02 10:31:03.000000000 -0500 -@@ -0,0 +1,61 @@ ++++ serefpolicy-3.7.8/policy/modules/apps/sambagui.te 2010-02-08 15:32:04.000000000 -0500 +@@ -0,0 +1,66 @@ +policy_module(sambagui,1.0.0) + +######################################## @@ -4917,11 +4988,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui + +userdom_dontaudit_search_admin_dir(sambagui_t) + ++ +optional_policy(` + consoletype_exec(sambagui_t) +') + +optional_policy(` ++ gnome_dontaudit_search_config(sambagui_t) ++') ++ ++optional_policy(` + policykit_dbus_chat(sambagui_t) +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.fc serefpolicy-3.7.8/policy/modules/apps/sandbox.fc @@ -4931,7 +5007,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox. +# No types are sandbox_exec_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.if serefpolicy-3.7.8/policy/modules/apps/sandbox.if --- nsaserefpolicy/policy/modules/apps/sandbox.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/apps/sandbox.if 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/apps/sandbox.if 2010-02-05 16:08:07.000000000 -0500 @@ -0,0 +1,225 @@ + +## policy for sandbox @@ -4964,7 +5040,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox. + dontaudit $1 sandbox_domain:process { noatsecure siginh rlimitinh }; + role $2 types sandbox_domain; + allow sandbox_domain $1:process sigchld; -+ allow sandbox_domain $1:fifo_file rw_fifo_file_perms; ++ allow sandbox_domain $1:fifo_file rw_inherited_fifo_file_perms; + + allow $1 sandbox_x_domain:process { signal_perms transition }; + dontaudit $1 sandbox_x_domain:process { noatsecure siginh rlimitinh }; @@ -4972,7 +5048,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox. + role $2 types sandbox_x_domain; + role $2 types sandbox_xserver_t; + allow $1 sandbox_xserver_t:process signal_perms; -+ dontaudit sandbox_xserver_t $1:fifo_file rw_fifo_file_perms; ++ dontaudit sandbox_xserver_t $1:fifo_file rw_inherited_fifo_file_perms; + dontaudit sandbox_xserver_t $1:tcp_socket rw_socket_perms; + dontaudit sandbox_xserver_t $1:udp_socket rw_socket_perms; + allow sandbox_xserver_t $1:unix_stream_socket { read write }; @@ -5980,7 +6056,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.7.8/policy/modules/kernel/corecommands.fc --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2009-11-25 11:47:19.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/kernel/corecommands.fc 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/kernel/corecommands.fc 2010-02-08 15:10:24.000000000 -0500 @@ -44,15 +44,17 @@ /etc/apcupsd/offbattery -- gen_context(system_u:object_r:bin_t,s0) /etc/apcupsd/onbattery -- gen_context(system_u:object_r:bin_t,s0) @@ -6021,15 +6097,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco # # /usr # -@@ -234,6 +240,7 @@ +@@ -214,6 +220,7 @@ + /usr/share/apr-0/build/libtool -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/debconf/.+ -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/cluster/.*\.sh gen_context(system_u:object_r:bin_t,s0) ++/usr/share/cluster/ocf-shellfuncs -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/gnucash/finance-quote-check -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/gnucash/finance-quote-helper -- gen_context(system_u:object_r:bin_t,s0) +@@ -228,12 +235,15 @@ + /usr/share/sectool/.*\.py -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/selinux/devel/policygentool -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/smolt/client(/.*)? gen_context(system_u:object_r:bin_t,s0) ++/usr/share/shorewall/compiler\.pl -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/shorewall/configpath -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/shorewall-perl(/.*)? gen_context(system_u:object_r:bin_t,s0) + /usr/share/shorewall-shell(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall-lite(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall6-lite(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/turboprint/lib(/.*)? -- gen_context(system_u:object_r:bin_t,s0) +/usr/share/vhostmd/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0) ++/usr/share/e16/misc(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/X11R6/lib(64)?/X11/xkb/xkbcomp -- gen_context(system_u:object_r:bin_t,s0) -@@ -323,3 +330,21 @@ +@@ -323,3 +333,21 @@ ifdef(`distro_suse',` /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) ') @@ -6098,7 +6190,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.if.in serefpolicy-3.7.8/policy/modules/kernel/corenetwork.if.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.if.in 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/kernel/corenetwork.if.in 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/kernel/corenetwork.if.in 2010-02-03 16:54:15.000000000 -0500 @@ -1705,6 +1705,24 @@ ######################################## @@ -6280,7 +6372,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene #network_node(multicast, s0 - mls_systemhigh, ff00::, ff00::) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.7.8/policy/modules/kernel/devices.fc --- nsaserefpolicy/policy/modules/kernel/devices.fc 2009-11-20 10:51:41.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/kernel/devices.fc 2010-02-03 11:34:06.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/kernel/devices.fc 2010-02-04 13:46:48.000000000 -0500 @@ -16,13 +16,16 @@ /dev/audio.* -c gen_context(system_u:object_r:sound_device_t,s0) /dev/autofs.* -c gen_context(system_u:object_r:autofs_device_t,s0) @@ -6298,7 +6390,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device /dev/event.* -c gen_context(system_u:object_r:event_device_t,s0) /dev/evtchn -c gen_context(system_u:object_r:xen_device_t,s0) /dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0) -@@ -80,6 +83,7 @@ +@@ -61,6 +64,7 @@ + /dev/mice -c gen_context(system_u:object_r:mouse_device_t,s0) + /dev/microcode -c gen_context(system_u:object_r:cpu_device_t,s0) + /dev/midi.* -c gen_context(system_u:object_r:sound_device_t,s0) ++/dev/misc/dlm.* -c gen_context(system_u:object_r:dlm_control_device_t,s0) + /dev/mixer.* -c gen_context(system_u:object_r:sound_device_t,s0) + /dev/mmetfgrab -c gen_context(system_u:object_r:scanner_device_t,s0) + /dev/modem -c gen_context(system_u:object_r:modem_device_t,s0) +@@ -80,6 +84,7 @@ /dev/pcfclock.* -c gen_context(system_u:object_r:clock_device_t,s0) /dev/pmu -c gen_context(system_u:object_r:power_device_t,s0) /dev/port -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) @@ -6306,7 +6406,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device /dev/(misc/)?psaux -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/rmidi.* -c gen_context(system_u:object_r:sound_device_t,s0) /dev/radeon -c gen_context(system_u:object_r:dri_device_t,s0) -@@ -101,6 +105,7 @@ +@@ -101,6 +106,7 @@ /dev/urandom -c gen_context(system_u:object_r:urandom_device_t,s0) /dev/ub[a-c] -c gen_context(system_u:object_r:usb_device_t,s0) /dev/usb.+ -c gen_context(system_u:object_r:usb_device_t,s0) @@ -6314,7 +6414,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device /dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0) ifdef(`distro_suse', ` /dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0) -@@ -142,6 +147,7 @@ +@@ -142,6 +148,7 @@ /dev/input/mice -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/input/js.* -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/input/uinput -c gen_context(system_u:object_r:event_device_t,s0) @@ -6322,7 +6422,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device /dev/mapper/control -c gen_context(system_u:object_r:lvm_control_t,s0) -@@ -159,6 +165,8 @@ +@@ -159,6 +166,8 @@ /dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0) /dev/usb/scanner.* -c gen_context(system_u:object_r:scanner_device_t,s0) @@ -6333,7 +6433,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.7.8/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2009-12-18 11:38:25.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/kernel/devices.if 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/kernel/devices.if 2010-02-08 12:14:39.000000000 -0500 @@ -801,6 +801,24 @@ ######################################## @@ -6384,7 +6484,75 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device ## Create all block device files. ## ## -@@ -1999,6 +2035,24 @@ +@@ -1380,6 +1416,42 @@ + rw_chr_files_pattern($1, device_t, crypt_device_t) + ') + ++####################################### ++## ++## Set the attributes of the dlm control devices. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_setattr_dlm_control',` ++ gen_require(` ++ type device_t, kvm_device_t; ++ ') ++ ++ setattr_chr_files_pattern($1, device_t, dlm_control_device_t) ++') ++ ++####################################### ++## ++## Read and write the the dlm control device ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_rw_dlm_control',` ++ gen_require(` ++ type device_t, dlm_control_device_t; ++ ') ++ ++ rw_chr_files_pattern($1, device_t, dlm_control_device_t) ++') ++ + ######################################## + ## + ## getattr the dri devices. +@@ -1710,6 +1782,24 @@ + + ######################################## + ## ++## Write to the kernel messages device ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_write_kmsg',` ++ gen_require(` ++ type device_t, kmsg_device_t; ++ ') ++ ++ write_chr_files_pattern($1, device_t, kmsg_device_t) ++') ++ ++######################################## ++## + ## Get the attributes of the ksm devices. + ## + ## +@@ -1999,6 +2089,24 @@ ######################################## ## @@ -6409,7 +6577,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device ## Read raw memory devices (e.g. /dev/mem). ## ## -@@ -3515,6 +3569,24 @@ +@@ -2450,6 +2558,24 @@ + + ######################################## + ## ++## Dontaudit write the memory type range registers (MTRR). ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_dontaudit_write_mtrr',` ++ gen_require(` ++ type mtrr_device_t; ++ ') ++ ++ dontaudit $1 mtrr_device_t:chr_file write; ++') ++ ++######################################## ++## + ## Get the attributes of the network control device + ## + ## +@@ -3515,6 +3641,24 @@ ######################################## ## @@ -6434,7 +6627,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device ## Mount a usbfs filesystem. ## ## -@@ -3703,6 +3775,24 @@ +@@ -3703,6 +3847,24 @@ getattr_chr_files_pattern($1, device_t, v4l_device_t) ') @@ -6461,8 +6654,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device ## Do not audit attempts to get the attributes diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.7.8/policy/modules/kernel/devices.te --- nsaserefpolicy/policy/modules/kernel/devices.te 2009-12-18 11:38:25.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/kernel/devices.te 2010-02-02 10:31:03.000000000 -0500 -@@ -232,6 +232,18 @@ ++++ serefpolicy-3.7.8/policy/modules/kernel/devices.te 2010-02-04 13:46:48.000000000 -0500 +@@ -59,6 +59,12 @@ + type crypt_device_t; + dev_node(crypt_device_t) + ++# ++# dlm_misc_device_t is the type of /dev/misc/dlm.* ++# ++type dlm_control_device_t; ++dev_node(dlm_control_device_t) ++ + type dri_device_t; + dev_node(dri_device_t) + +@@ -232,6 +238,18 @@ type usb_device_t; dev_node(usb_device_t) @@ -7617,7 +7823,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.7.8/policy/modules/kernel/filesystem.if --- nsaserefpolicy/policy/modules/kernel/filesystem.if 2009-11-25 11:47:19.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/kernel/filesystem.if 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/kernel/filesystem.if 2010-02-08 15:48:31.000000000 -0500 @@ -906,7 +906,7 @@ type cifs_t; ') @@ -7688,7 +7894,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ######################################### ## ## Read named sockets on a NFS filesystem. -@@ -3684,6 +3722,24 @@ +@@ -3458,6 +3496,24 @@ + + ######################################## + ## ++## Read generic tmpfs files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`fs_read_tmpfs_files',` ++ gen_require(` ++ type tmpfs_t; ++ ') ++ ++ read_files_pattern($1, tmpfs_t, tmpfs_t) ++') ++ ++######################################## ++## + ## Read and write generic tmpfs files. + ## + ## +@@ -3684,6 +3740,24 @@ ######################################## ## @@ -7713,7 +7944,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ## Mount a XENFS filesystem. ## ## -@@ -4181,3 +4237,194 @@ +@@ -4181,3 +4255,214 @@ relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs) relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs) ') @@ -7777,6 +8008,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy + +######################################## +## ++## Read files on cgroup ++## file systems. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`fs_read_cgroup_files',` ++ gen_require(` ++ type cgroup_t; ++ ++ ') ++ ++ read_files_pattern($1, cgroup_t, cgroup_t) ++') ++ ++######################################## ++## +## Read and write files on cgroup +## file systems. +## @@ -11083,7 +11334,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav sysnet_use_ldap(amavis_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.7.8/policy/modules/services/apache.fc --- nsaserefpolicy/policy/modules/services/apache.fc 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/services/apache.fc 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/apache.fc 2010-02-04 13:36:26.000000000 -0500 @@ -2,12 +2,19 @@ /etc/apache(2)?(/.*)? gen_context(system_u:object_r:httpd_config_t,s0) @@ -11123,12 +11374,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac /usr/sbin/rotatelogs -- gen_context(system_u:object_r:httpd_rotatelogs_exec_t,s0) /usr/sbin/suexec -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0) -@@ -32,14 +45,28 @@ +@@ -32,14 +45,29 @@ /usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0) ') +/usr/share/drupal(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /usr/share/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) ++/usr/share/icecast(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) +/usr/share/ntop/html(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) +/usr/share/mythweb(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) +/usr/share/mythweb/mythweb\.pl gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) @@ -11152,7 +11404,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac /var/cache/php-eaccelerator(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0) /var/cache/php-mmcache(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0) /var/cache/rt3(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0) -@@ -47,16 +74,21 @@ +@@ -47,16 +75,21 @@ /var/lib/cacti/rra(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /var/lib/dav(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) @@ -11174,7 +11426,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ifdef(`distro_debian', ` /var/log/horde2(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) ') -@@ -64,11 +96,34 @@ +@@ -64,11 +97,34 @@ /var/run/apache.* gen_context(system_u:object_r:httpd_var_run_t,s0) /var/run/gcache_port -s gen_context(system_u:object_r:httpd_var_run_t,s0) /var/run/httpd.* gen_context(system_u:object_r:httpd_var_run_t,s0) @@ -11943,7 +12195,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.7.8/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/services/apache.te 2010-02-03 13:33:57.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/apache.te 2010-02-05 12:03:18.000000000 -0500 @@ -19,6 +19,8 @@ # Declarations # @@ -13195,6 +13447,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind domain_system_change_exemption($1) role_transition $2 named_initrc_exec_t system_r; allow $2 system_r; +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.7.8/policy/modules/services/bind.te +--- nsaserefpolicy/policy/modules/services/bind.te 2009-08-14 16:14:31.000000000 -0400 ++++ serefpolicy-3.7.8/policy/modules/services/bind.te 2010-02-08 15:31:29.000000000 -0500 +@@ -142,11 +142,11 @@ + + logging_send_syslog_msg(named_t) + ++init_read_script_tmp_files(named_t) ++ + miscfiles_read_localization(named_t) + miscfiles_read_certs(named_t) + +-sysnet_read_config(named_t) +- + userdom_dontaudit_use_unpriv_user_fds(named_t) + userdom_dontaudit_search_user_home_dirs(named_t) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.7.8/policy/modules/services/bluetooth.te --- nsaserefpolicy/policy/modules/services/bluetooth.te 2010-01-07 14:53:53.000000000 -0500 +++ serefpolicy-3.7.8/policy/modules/services/bluetooth.te 2010-02-02 10:31:03.000000000 -0500 @@ -14773,8 +15042,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/coro + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/corosync.te serefpolicy-3.7.8/policy/modules/services/corosync.te --- nsaserefpolicy/policy/modules/services/corosync.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/services/corosync.te 2010-02-02 10:31:03.000000000 -0500 -@@ -0,0 +1,108 @@ ++++ serefpolicy-3.7.8/policy/modules/services/corosync.te 2010-02-04 13:46:48.000000000 -0500 +@@ -0,0 +1,110 @@ + +policy_module(corosync,1.0.0) + @@ -14850,6 +15119,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/coro + +kernel_read_system_state(corosync_t) + ++domain_read_all_domains_state(corosync_t) ++ +corenet_udp_bind_netsupport_port(corosync_t) + +corecmd_exec_bin(corosync_t) @@ -14905,7 +15176,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron +/var/log/mcelog.* -- gen_context(system_u:object_r:cron_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.7.8/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2009-09-16 09:09:20.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/services/cron.if 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/cron.if 2010-02-05 11:29:08.000000000 -0500 @@ -12,6 +12,10 @@ ## # @@ -14978,7 +15249,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') - allow $1 crond_t:fifo_file { getattr read write }; -+ allow $1 crond_t:fifo_file rw_fifo_file_perms; ++ allow $1 crond_t:fifo_file rw_inherited_fifo_file_perms; + ') + + ######################################## +@@ -554,7 +550,7 @@ + type system_cronjob_t; + ') + +- allow $1 system_cronjob_t:fifo_file rw_fifo_file_perms; ++ allow $1 system_cronjob_t:fifo_file rw_inherited_fifo_file_perms; ') ######################################## @@ -15641,7 +15921,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru snmp_stream_connect(cyrus_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.7.8/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2009-07-28 13:28:33.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/services/dbus.if 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/dbus.if 2010-02-08 12:17:04.000000000 -0500 @@ -42,8 +42,10 @@ gen_require(` class dbus { send_msg acquire_svc }; @@ -16018,12 +16298,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/deny +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.fc serefpolicy-3.7.8/policy/modules/services/devicekit.fc --- nsaserefpolicy/policy/modules/services/devicekit.fc 2009-07-29 15:15:33.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/services/devicekit.fc 2010-02-02 10:31:03.000000000 -0500 -@@ -1,8 +1,11 @@ ++++ serefpolicy-3.7.8/policy/modules/services/devicekit.fc 2010-02-05 07:38:20.000000000 -0500 +@@ -1,8 +1,12 @@ /usr/libexec/devkit-daemon -- gen_context(system_u:object_r:devicekit_exec_t,s0) /usr/libexec/devkit-disks-daemon -- gen_context(system_u:object_r:devicekit_disk_exec_t,s0) /usr/libexec/devkit-power-daemon -- gen_context(system_u:object_r:devicekit_power_exec_t,s0) +/usr/libexec/udisks-daemon -- gen_context(system_u:object_r:devicekit_disk_exec_t,s0) ++/usr/libexec/upowerd -- gen_context(system_u:object_r:devicekit_power_exec_t,s0) /var/lib/DeviceKit-.* gen_context(system_u:object_r:devicekit_var_lib_t,s0) +/var/lib/udisks(/.*)? gen_context(system_u:object_r:devicekit_var_lib_t,s0) @@ -16423,7 +16704,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove /var/spool/dovecot(/.*)? gen_context(system_u:object_r:dovecot_spool_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.7.8/policy/modules/services/dovecot.te --- nsaserefpolicy/policy/modules/services/dovecot.te 2010-01-07 14:53:53.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/services/dovecot.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/dovecot.te 2010-02-08 15:51:15.000000000 -0500 @@ -73,14 +73,21 @@ can_exec(dovecot_t, dovecot_exec_t) @@ -16447,7 +16728,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove manage_sock_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t) files_pid_filetrans(dovecot_t, dovecot_var_run_t, file) -@@ -103,6 +110,7 @@ +@@ -93,6 +100,7 @@ + corenet_tcp_sendrecv_generic_node(dovecot_t) + corenet_tcp_sendrecv_all_ports(dovecot_t) + corenet_tcp_bind_generic_node(dovecot_t) ++corenet_tcp_bind_mail_port(dovecot_t) + corenet_tcp_bind_pop_port(dovecot_t) + corenet_tcp_connect_all_ports(dovecot_t) + corenet_tcp_connect_postgresql_port(dovecot_t) +@@ -103,6 +111,7 @@ dev_read_urand(dovecot_t) fs_getattr_all_fs(dovecot_t) @@ -16455,7 +16744,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove fs_search_auto_mountpoints(dovecot_t) fs_list_inotifyfs(dovecot_t) -@@ -142,6 +150,10 @@ +@@ -142,6 +151,10 @@ ') optional_policy(` @@ -16466,7 +16755,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove seutil_sigchld_newrole(dovecot_t) ') -@@ -172,11 +184,6 @@ +@@ -172,11 +185,6 @@ manage_files_pattern(dovecot_auth_t, dovecot_auth_tmp_t, dovecot_auth_tmp_t) files_tmp_filetrans(dovecot_auth_t, dovecot_auth_tmp_t, { file dir }) @@ -16478,7 +16767,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove allow dovecot_auth_t dovecot_var_run_t:dir list_dir_perms; manage_sock_files_pattern(dovecot_auth_t, dovecot_var_run_t, dovecot_var_run_t) dovecot_stream_connect_auth(dovecot_auth_t) -@@ -197,8 +204,9 @@ +@@ -197,8 +205,9 @@ files_search_pids(dovecot_auth_t) files_read_usr_files(dovecot_auth_t) files_read_usr_symlinks(dovecot_auth_t) @@ -16489,7 +16778,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove init_rw_utmp(dovecot_auth_t) -@@ -225,6 +233,7 @@ +@@ -225,6 +234,7 @@ ') optional_policy(` @@ -16497,7 +16786,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove postfix_search_spool(dovecot_auth_t) ') -@@ -234,6 +243,8 @@ +@@ -234,6 +244,8 @@ # allow dovecot_deliver_t self:unix_dgram_socket create_socket_perms; @@ -16506,7 +16795,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove allow dovecot_deliver_t dovecot_etc_t:file read_file_perms; allow dovecot_deliver_t dovecot_var_run_t:dir list_dir_perms; -@@ -263,11 +274,19 @@ +@@ -263,11 +275,19 @@ userdom_user_home_dir_filetrans_user_home_content(dovecot_deliver_t, { dir file lnk_file fifo_file sock_file }) tunable_policy(`use_nfs_home_dirs',` @@ -17495,7 +17784,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/git.te serefpolicy-3.7.8/policy/modules/services/git.te --- nsaserefpolicy/policy/modules/services/git.te 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/services/git.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/git.te 2010-02-08 15:36:58.000000000 -0500 @@ -1,9 +1,182 @@ -policy_module(git, 1.0) @@ -17912,6 +18201,283 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/howl kernel_list_proc(howl_t) kernel_read_proc_symlinks(howl_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/icecast.fc serefpolicy-3.7.8/policy/modules/services/icecast.fc +--- nsaserefpolicy/policy/modules/services/icecast.fc 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/icecast.fc 2010-02-04 13:36:50.000000000 -0500 +@@ -0,0 +1,7 @@ ++/etc/rc\.d/init\.d/icecast -- gen_context(system_u:object_r:icecast_initrc_exec_t,s0) ++ ++/usr/bin/icecast -- gen_context(system_u:object_r:icecast_exec_t,s0) ++ ++/var/log/icecast(/.*)? gen_context(system_u:object_r:icecast_log_t,s0) ++ ++/var/run/icecast(/.*)? gen_context(system_u:object_r:icecast_var_run_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/icecast.if serefpolicy-3.7.8/policy/modules/services/icecast.if +--- nsaserefpolicy/policy/modules/services/icecast.if 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/icecast.if 2010-02-04 13:14:02.000000000 -0500 +@@ -0,0 +1,199 @@ ++ ++## ShoutCast compatible streaming media server ++ ++######################################## ++## ++## Execute a domain transition to run icecast. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`icecast_domtrans',` ++ gen_require(` ++ type icecast_t, icecast_exec_t; ++ ') ++ ++ domtrans_pattern($1, icecast_exec_t, icecast_t) ++') ++ ++ ++######################################## ++## ++## Execute icecast server in the icecast domain. ++## ++## ++## ++## The type of the process performing this action. ++## ++## ++# ++interface(`icecast_initrc_domtrans',` ++ gen_require(` ++ type icecast_initrc_exec_t; ++ ') ++ ++ init_labeled_script_domtrans($1, icecast_initrc_exec_t) ++') ++ ++######################################## ++## ++## Read icecast PID files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`icecast_read_pid_files',` ++ gen_require(` ++ type icecast_var_run_t; ++ ') ++ ++ files_search_pids($1) ++ allow $1 icecast_var_run_t:file read_file_perms; ++') ++ ++######################################## ++## ++## Manage icecast var_run files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`icecast_manage_var_run',` ++ gen_require(` ++ type icecast_var_run_t; ++ ') ++ ++ manage_dirs_pattern($1, icecast_var_run_t, icecast_var_run_t) ++ manage_files_pattern($1, icecast_var_run_t, icecast_var_run_t) ++ manage_lnk_files_pattern($1, icecast_var_run_t, icecast_var_run_t) ++') ++ ++ ++######################################## ++## ++## Allow the specified domain to read icecast's log files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++# ++interface(`icecast_read_log',` ++ gen_require(` ++ type icecast_log_t; ++ ') ++ ++ logging_search_logs($1) ++ read_files_pattern($1, icecast_log_t, icecast_log_t) ++') ++ ++######################################## ++## ++## Allow the specified domain to append ++## icecast log files. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`icecast_append_log',` ++ gen_require(` ++ type var_log_t, icecast_log_t; ++ ') ++ ++ logging_search_logs($1) ++ append_files_pattern($1, icecast_log_t, icecast_log_t) ++') ++ ++######################################## ++## ++## Allow domain to manage icecast log files ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`icecast_manage_log',` ++ gen_require(` ++ type icecast_log_t; ++ ') ++ ++ manage_dirs_pattern($1, icecast_log_t, icecast_log_t) ++ manage_files_pattern($1, icecast_log_t, icecast_log_t) ++ manage_lnk_files_pattern($1, icecast_log_t, icecast_log_t) ++') ++ ++######################################## ++## ++## Allow domain signal icecast ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`icecast_signal',` ++ gen_require(` ++ type icecast_t; ++ ') ++ ++ allow $1 icecast_t:process signal; ++') ++ ++######################################## ++## ++## All of the rules required to administrate ++## an icecast environment ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++## ++## Role allowed access. ++## ++## ++## ++# ++interface(`icecast_admin',` ++ gen_require(` ++ type icecast_t; ++ ') ++ ++ allow $1 icecast_t:process { ptrace signal_perms getattr }; ++ read_files_pattern($1, icecast_t, icecast_t) ++ ++ ++ gen_require(` ++ type icecast_initrc_exec_t; ++ ') ++ ++ # Allow icecast_t to restart the apache service ++ icecast_initrc_domtrans($1) ++ domain_system_change_exemption($1) ++ role_transition $2 icecast_initrc_exec_t system_r; ++ allow $2 system_r; ++ ++ icecast_manage_var_run($1) ++ ++ icecast_manage_log($1) ++ ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/icecast.te serefpolicy-3.7.8/policy/modules/services/icecast.te +--- nsaserefpolicy/policy/modules/services/icecast.te 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/icecast.te 2010-02-04 13:11:42.000000000 -0500 +@@ -0,0 +1,59 @@ ++policy_module(icecast,1.0.0) ++ ++######################################## ++# ++# Declarations ++# ++ ++type icecast_t; ++type icecast_exec_t; ++init_daemon_domain(icecast_t, icecast_exec_t) ++ ++permissive icecast_t; ++ ++type icecast_initrc_exec_t; ++init_script_file(icecast_initrc_exec_t) ++ ++type icecast_var_run_t; ++files_pid_file(icecast_var_run_t) ++ ++type icecast_log_t; ++logging_log_file(icecast_log_t) ++ ++######################################## ++# ++# icecast local policy ++# ++ ++allow icecast_t self:capability { dac_override setgid setuid sys_nice }; ++allow icecast_t self:process { getsched fork setsched signal }; ++ ++# Init script handling ++domain_use_interactive_fds(icecast_t) ++ ++# internal communication is often done using fifo and unix sockets. ++allow icecast_t self:fifo_file rw_fifo_file_perms; ++allow icecast_t self:unix_stream_socket create_stream_socket_perms; ++allow icecast_t self:tcp_socket create_stream_socket_perms; ++ ++corenet_tcp_bind_soundd_port(icecast_t) ++ ++files_read_etc_files(icecast_t) ++ ++miscfiles_read_localization(icecast_t) ++ ++manage_dirs_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t) ++manage_files_pattern(icecast_t, icecast_var_run_t, icecast_var_run_t) ++files_pid_filetrans(icecast_t, icecast_var_run_t, { file dir }) ++ ++manage_dirs_pattern(icecast_t, icecast_log_t, icecast_log_t) ++manage_files_pattern(icecast_t, icecast_log_t, icecast_log_t) ++logging_log_filetrans(icecast_t, icecast_log_t, { file dir } ) ++ ++auth_use_nsswitch(icecast_t) ++ ++sysnet_dns_name_resolve(icecast_t) ++ ++optional_policy(` ++ rtkit_daemon_system_domain(icecast_t) ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-3.7.8/policy/modules/services/kerberos.if --- nsaserefpolicy/policy/modules/services/kerberos.if 2009-07-23 14:11:04.000000000 -0400 +++ serefpolicy-3.7.8/policy/modules/services/kerberos.if 2010-02-02 10:31:03.000000000 -0500 @@ -18347,7 +18913,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.7.8/policy/modules/services/mta.if --- nsaserefpolicy/policy/modules/services/mta.if 2010-01-07 14:53:53.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/services/mta.if 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/mta.if 2010-02-08 13:36:02.000000000 -0500 @@ -335,6 +335,7 @@ # apache should set close-on-exec apache_dontaudit_rw_stream_sockets($1) @@ -18401,6 +18967,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. read_lnk_files_pattern($1, mail_spool_t, mail_spool_t) ') +@@ -765,6 +786,25 @@ + + ####################################### + ## ++## List the mail queue. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`mta_list_queue',` ++ gen_require(` ++ type mqueue_spool_t; ++ ') ++ ++ allow $1 mqueue_spool_t:dir list_dir_perms; ++ files_search_spool($1) ++') ++ ++####################################### ++## + ## Read the mail queue. + ## + ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.7.8/policy/modules/services/mta.te --- nsaserefpolicy/policy/modules/services/mta.te 2010-01-07 14:53:53.000000000 -0500 +++ serefpolicy-3.7.8/policy/modules/services/mta.te 2010-02-02 10:31:03.000000000 -0500 @@ -18488,7 +19080,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.te serefpolicy-3.7.8/policy/modules/services/munin.te --- nsaserefpolicy/policy/modules/services/munin.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/services/munin.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/munin.te 2010-02-08 13:34:54.000000000 -0500 @@ -33,7 +33,7 @@ # Local policy # @@ -18508,7 +19100,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni # Allow access to the munin databases manage_dirs_pattern(munin_t, munin_var_lib_t, munin_var_lib_t) -@@ -147,6 +148,7 @@ +@@ -133,6 +134,7 @@ + optional_policy(` + mta_read_config(munin_t) + mta_send_mail(munin_t) ++ mta_list_queue(munin_t) + mta_read_queue(munin_t) + ') + +@@ -147,6 +149,7 @@ optional_policy(` postfix_list_spool(munin_t) @@ -18565,7 +19165,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq ## Send a generic signal to MySQL. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.7.8/policy/modules/services/mysql.te --- nsaserefpolicy/policy/modules/services/mysql.te 2009-12-18 11:38:25.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/services/mysql.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/mysql.te 2010-02-05 10:58:38.000000000 -0500 @@ -1,6 +1,13 @@ policy_module(mysql, 1.11.1) @@ -18580,6 +19180,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq ######################################## # # Declarations +@@ -37,7 +44,7 @@ + # Local policy + # + +-allow mysqld_t self:capability { dac_override setgid setuid sys_resource net_bind_service }; ++allow mysqld_t self:capability { dac_override ipc_lock setgid setuid sys_resource net_bind_service }; + dontaudit mysqld_t self:capability sys_tty_config; + allow mysqld_t self:process { setsched getsched setrlimit signal_perms rlimitinh }; + allow mysqld_t self:fifo_file rw_fifo_file_perms; @@ -109,6 +116,11 @@ # for /root/.my.cnf - should not be needed: userdom_read_user_home_content_files(mysqld_t) @@ -18724,7 +19333,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi +/usr/lib(64)?/nagios/plugins/check_by_ssh -- gen_context(system_u:object_r:nagios_unconfined_plugin_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.7.8/policy/modules/services/nagios.if --- nsaserefpolicy/policy/modules/services/nagios.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/services/nagios.if 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/nagios.if 2010-02-08 14:30:28.000000000 -0500 @@ -64,7 +64,7 @@ ######################################## @@ -18757,7 +19366,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi ## ## ## -@@ -92,10 +91,119 @@ +@@ -92,10 +91,121 @@ ## ## # @@ -18823,6 +19432,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi + # needed by command.cfg + domtrans_pattern(nagios_t, nagios_$1_plugin_exec_t, nagios_$1_plugin_t) + ++ allow nagios_t nagios_$1_plugin_t:process signal_perms; ++ + # cjp: leaked file descriptor + dontaudit nagios_$1_plugin_t nrpe_t:tcp_socket { read write }; + @@ -20910,8 +21521,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plym +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouth.te serefpolicy-3.7.8/policy/modules/services/plymouth.te --- nsaserefpolicy/policy/modules/services/plymouth.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/services/plymouth.te 2010-02-03 15:28:58.000000000 -0500 -@@ -0,0 +1,102 @@ ++++ serefpolicy-3.7.8/policy/modules/services/plymouth.te 2010-02-08 14:38:49.000000000 -0500 +@@ -0,0 +1,104 @@ +policy_module(plymouthd, 1.0.0) + +######################################## @@ -21000,6 +21611,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plym + +miscfiles_read_localization(plymouth_t) + ++sysnet_read_config(plymouth_t) ++ +term_use_ptmx(plymouth_t) + +plymouth_stream_connect(plymouth_t) @@ -22437,6 +23050,44 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo userdom_dontaudit_search_user_home_dirs(pyzor_t) optional_policy(` +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radvd.te serefpolicy-3.7.8/policy/modules/services/radvd.te +--- nsaserefpolicy/policy/modules/services/radvd.te 2009-12-18 11:38:25.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/radvd.te 2010-02-08 16:21:33.000000000 -0500 +@@ -22,9 +22,9 @@ + # + # Local policy + # +-allow radvd_t self:capability { setgid setuid net_raw net_admin }; ++allow radvd_t self:capability { kill setgid setuid net_raw net_admin }; + dontaudit radvd_t self:capability sys_tty_config; +-allow radvd_t self:process signal_perms; ++allow radvd_t self:process { fork signal_perms }; + allow radvd_t self:unix_dgram_socket create_socket_perms; + allow radvd_t self:unix_stream_socket create_socket_perms; + allow radvd_t self:rawip_socket create_socket_perms; +@@ -64,20 +64,16 @@ + files_read_etc_files(radvd_t) + files_list_usr(radvd_t) + ++auth_use_nsswitch(radvd_t) ++ + logging_send_syslog_msg(radvd_t) + + miscfiles_read_localization(radvd_t) + +-sysnet_read_config(radvd_t) +- + userdom_dontaudit_use_unpriv_user_fds(radvd_t) + userdom_dontaudit_search_user_home_dirs(radvd_t) + + optional_policy(` +- nis_use_ypbind(radvd_t) +-') +- +-optional_policy(` + seutil_sigchld_newrole(radvd_t) + ') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.fc serefpolicy-3.7.8/policy/modules/services/razor.fc --- nsaserefpolicy/policy/modules/services/razor.fc 2009-07-14 14:19:57.000000000 -0400 +++ serefpolicy-3.7.8/policy/modules/services/razor.fc 2010-02-02 10:31:03.000000000 -0500 @@ -22649,8 +23300,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgma + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.te serefpolicy-3.7.8/policy/modules/services/rgmanager.te --- nsaserefpolicy/policy/modules/services/rgmanager.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/services/rgmanager.te 2010-02-02 10:31:03.000000000 -0500 -@@ -0,0 +1,186 @@ ++++ serefpolicy-3.7.8/policy/modules/services/rgmanager.te 2010-02-04 15:10:37.000000000 -0500 +@@ -0,0 +1,204 @@ + +policy_module(rgmanager,1.0.0) + @@ -22675,6 +23326,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgma +type rgmanager_tmp_t; +files_tmp_file(rgmanager_tmp_t) + ++type rgmanager_tmpfs_t; ++files_tmpfs_file(rgmanager_tmpfs_t) ++ +# log files +type rgmanager_var_log_t; +logging_log_file(rgmanager_var_log_t) @@ -22703,6 +23357,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgma +manage_files_pattern(rgmanager_t, rgmanager_tmp_t, rgmanager_tmp_t) +files_tmp_filetrans(rgmanager_t, rgmanager_tmp_t, { file dir }) + ++manage_dirs_pattern(rgmanager_t, rgmanager_tmpfs_t, rgmanager_tmpfs_t) ++manage_files_pattern(rgmanager_t, rgmanager_tmpfs_t, rgmanager_tmpfs_t) ++fs_tmpfs_filetrans(rgmanager_t, rgmanager_tmpfs_t,{ dir file }) ++ +# log files +manage_files_pattern(rgmanager_t, rgmanager_var_log_t,rgmanager_var_log_t) +logging_log_filetrans(rgmanager_t,rgmanager_var_log_t,{ file }) @@ -22712,9 +23370,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgma +manage_sock_files_pattern(rgmanager_t, rgmanager_var_run_t, rgmanager_var_run_t) +files_pid_filetrans(rgmanager_t,rgmanager_var_run_t, { file sock_file }) + -+aisexec_stream_connect(rgmanager_t) -+groupd_stream_connect(rgmanager_t) -+ +corecmd_exec_bin(rgmanager_t) +corecmd_exec_sbin(rgmanager_t) +corecmd_exec_shell(rgmanager_t) @@ -22726,7 +23381,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgma +fs_getattr_xattr_fs(rgmanager_t) + +# need to write to /dev/misc/dlm-control -+dev_manage_generic_chr_files(rgmanager_t) ++dev_rw_dlm_control(rgmanager_t) ++dev_setattr_dlm_control(rgmanager_t) +dev_search_sysfs(rgmanager_t) + +domain_read_all_domains_state(rgmanager_t) @@ -22762,16 +23418,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgma + +# rgmanager can run resource scripts + ++ ++optional_policy(` ++ aisexec_stream_connect(rgmanager_t) ++') ++ +optional_policy(` + apache_domtrans(rgmanager_t) + apache_signal(rgmanager_t) +') + +optional_policy(` ++ corosync_stream_connect(rgmanager_t) ++') ++ ++optional_policy(` + fstools_domtrans(rgmanager_t) +') + +optional_policy(` ++ groupd_stream_connect(rgmanager_t) ++') ++ ++optional_policy(` + hostname_exec(rgmanager_t) +') + @@ -22839,25 +23508,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgma + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs.fc serefpolicy-3.7.8/policy/modules/services/rhcs.fc --- nsaserefpolicy/policy/modules/services/rhcs.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/services/rhcs.fc 2010-02-02 10:31:03.000000000 -0500 -@@ -0,0 +1,24 @@ -+/dev/misc/dlm.* -- gen_context(system_u:object_r:dlm_control_dev_t,s0) -+ -+/sbin/dlm_controld -- gen_context(system_u:object_r:dlm_controld_exec_t,s0) ++++ serefpolicy-3.7.8/policy/modules/services/rhcs.fc 2010-02-04 13:49:09.000000000 -0500 +@@ -0,0 +1,22 @@ ++/usr/sbin/dlm_controld -- gen_context(system_u:object_r:dlm_controld_exec_t,s0) +/var/log/cluster/dlm_controld\.log.* -- gen_context(system_u:object_r:dlm_controld_var_log_t,s0) +/var/run/dlm_controld\.pid -- gen_context(system_u:object_r:dlm_controld_var_run_t,s0) + -+/sbin/fenced -- gen_context(system_u:object_r:fenced_exec_t,s0) ++/usr/sbin/fenced -- gen_context(system_u:object_r:fenced_exec_t,s0) +/usr/sbin/fence_node -- gen_context(system_u:object_r:fenced_exec_t,s0) +/var/log/cluster/fenced\.log.* -- gen_context(system_u:object_r:fenced_var_log_t,s0) +/var/run/fenced\.pid -- gen_context(system_u:object_r:fenced_var_run_t,s0) +/var/run/cluster/fenced_override -- gen_context(system_u:object_r:fenced_var_run_t,s0) + -+/sbin/gfs_controld -- gen_context(system_u:object_r:gfs_controld_exec_t,s0) ++/usr/sbin/gfs_controld -- gen_context(system_u:object_r:gfs_controld_exec_t,s0) +/var/log/cluster/gfs_controld\.log.* -- gen_context(system_u:object_r:gfs_controld_var_log_t,s0) +/var/run/gfs_controld\.pid -- gen_context(system_u:object_r:gfs_controld_var_run_t,s0) + -+/sbin/groupd -- gen_context(system_u:object_r:groupd_exec_t,s0) ++/usr/sbin/groupd -- gen_context(system_u:object_r:groupd_exec_t,s0) +/var/run/groupd\.pid -- gen_context(system_u:object_r:groupd_var_run_t,s0) + +/usr/sbin/qdiskd -- gen_context(system_u:object_r:qdiskd_exec_t,s0) @@ -23238,8 +23905,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs.te serefpolicy-3.7.8/policy/modules/services/rhcs.te --- nsaserefpolicy/policy/modules/services/rhcs.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/services/rhcs.te 2010-02-02 10:31:26.000000000 -0500 -@@ -0,0 +1,422 @@ ++++ serefpolicy-3.7.8/policy/modules/services/rhcs.te 2010-02-04 15:17:12.000000000 -0500 +@@ -0,0 +1,419 @@ + +policy_module(rhcs,1.0.0) + @@ -23270,9 +23937,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs +type dlm_controld_tmpfs_t; +files_tmpfs_file(dlm_controld_tmpfs_t) + -+type dlm_control_dev_t; -+dev_node(dlm_control_dev_t) -+ +type fenced_t; +type fenced_exec_t; +init_daemon_domain(fenced_t, fenced_exec_t) @@ -23352,12 +24016,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs + +allow dlm_controld_t self:sem create_sem_perms; +allow dlm_controld_t self:fifo_file rw_fifo_file_perms; -+allow dlm_controld_t self:unix_stream_socket { create_stream_socket_perms }; -+allow dlm_controld_t self:unix_dgram_socket { create_socket_perms }; ++allow dlm_controld_t self:unix_stream_socket create_stream_socket_perms; ++allow dlm_controld_t self:unix_dgram_socket create_socket_perms; +allow dlm_controld_t self:netlink_kobject_uevent_socket create_socket_perms; + -+allow dlm_controld_t dlm_control_dev_t:chr_file rw_chr_file_perms; -+ +manage_dirs_pattern(dlm_controld_t, dlm_controld_tmpfs_t, dlm_controld_tmpfs_t) +manage_files_pattern(dlm_controld_t, dlm_controld_tmpfs_t, dlm_controld_tmpfs_t) +fs_tmpfs_filetrans(dlm_controld_t, dlm_controld_tmpfs_t,{ dir file }) @@ -23374,10 +24036,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs +stream_connect_pattern(dlm_controld_t, fenced_var_run_t, fenced_var_run_t, fenced_t) +aisexec_stream_connect(dlm_controld_t) +ccs_stream_connect(dlm_controld_t) ++corosync_stream_connect(dlm_controld_t) +groupd_stream_connect(dlm_controld_t) + +kernel_read_system_state(dlm_controld_t) + ++dev_rw_dlm_control(dlm_controld_t) +dev_rw_sysfs(dlm_controld_t) + +fs_manage_configfs_files(dlm_controld_t) @@ -23514,8 +24178,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhcs + +storage_getattr_removable_dev(gfs_controld_t) + -+dev_manage_generic_chr_files(gfs_controld_t) -+#dev_read_sysfs(gfs_controld_t) ++dev_rw_dlm_control(gfs_controld_t) ++dev_setattr_dlm_control(gfs_controld_t) +dev_rw_sysfs(gfs_controld_t) + +init_rw_script_tmp_files(gfs_controld_t) @@ -24089,7 +24753,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn auth_can_read_shadow_passwords(rsync_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rtkit.if serefpolicy-3.7.8/policy/modules/services/rtkit.if --- nsaserefpolicy/policy/modules/services/rtkit.if 2009-09-16 09:09:20.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/services/rtkit.if 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/rtkit.if 2010-02-04 08:57:20.000000000 -0500 @@ -38,3 +38,23 @@ allow $1 rtkit_daemon_t:dbus send_msg; allow rtkit_daemon_t $1:dbus send_msg; @@ -24367,7 +25031,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.7.8/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/services/samba.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/samba.te 2010-02-08 16:25:02.000000000 -0500 @@ -66,6 +66,13 @@ ## gen_tunable(samba_share_nfs, false) @@ -24387,7 +25051,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb auth_use_nsswitch(samba_net_t) -auth_read_cache(samba_net_t) -+auth_rw_cache(samba_net_t) ++auth_manage_cache(samba_net_t) logging_send_syslog_msg(samba_net_t) @@ -24410,7 +25074,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_getattr_core_if(smbd_t) kernel_getattr_message_if(smbd_t) kernel_read_network_state(smbd_t) -@@ -325,6 +336,8 @@ +@@ -316,6 +327,7 @@ + auth_use_nsswitch(smbd_t) + auth_domtrans_chk_passwd(smbd_t) + auth_domtrans_upd_passwd(smbd_t) ++auth_manage_cache(smbd_t) + + domain_use_interactive_fds(smbd_t) + domain_dontaudit_list_all_domains_state(smbd_t) +@@ -325,6 +337,8 @@ files_read_etc_runtime_files(smbd_t) files_read_usr_files(smbd_t) files_search_spool(smbd_t) @@ -24419,7 +25091,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb # Allow samba to list mnt_t for potential mounted dirs files_list_mnt(smbd_t) -@@ -337,10 +350,13 @@ +@@ -337,10 +351,13 @@ miscfiles_read_public_files(smbd_t) userdom_use_unpriv_users_fds(smbd_t) @@ -24434,7 +25106,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ifdef(`hide_broken_symptoms', ` files_dontaudit_getattr_default_dirs(smbd_t) files_dontaudit_getattr_boot_dirs(smbd_t) -@@ -352,19 +368,19 @@ +@@ -352,19 +369,19 @@ ') tunable_policy(`samba_domain_controller',` @@ -24460,7 +25132,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') # Support Samba sharing of NFS mount points -@@ -376,6 +392,15 @@ +@@ -376,6 +393,15 @@ fs_manage_nfs_named_sockets(smbd_t) ') @@ -24476,7 +25148,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb optional_policy(` cups_read_rw_config(smbd_t) cups_stream_connect(smbd_t) -@@ -391,6 +416,11 @@ +@@ -391,6 +417,11 @@ ') optional_policy(` @@ -24488,7 +25160,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb rpc_search_nfs_state_data(smbd_t) ') -@@ -405,13 +435,15 @@ +@@ -405,13 +436,15 @@ tunable_policy(`samba_create_home_dirs',` allow smbd_t self:capability chown; userdom_create_user_home_dirs(smbd_t) @@ -24505,7 +25177,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb auth_read_all_files_except_shadow(nmbd_t) ') -@@ -420,8 +452,8 @@ +@@ -420,8 +453,8 @@ auth_manage_all_files_except_shadow(smbd_t) fs_read_noxattr_fs_files(nmbd_t) auth_manage_all_files_except_shadow(nmbd_t) @@ -24515,7 +25187,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ######################################## # -@@ -525,6 +557,7 @@ +@@ -525,6 +558,7 @@ allow smbcontrol_t winbind_t:process { signal signull }; @@ -24523,7 +25195,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb samba_read_config(smbcontrol_t) samba_rw_var_files(smbcontrol_t) samba_search_var(smbcontrol_t) -@@ -536,6 +569,8 @@ +@@ -536,6 +570,8 @@ miscfiles_read_localization(smbcontrol_t) @@ -24532,7 +25204,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ######################################## # # smbmount Local policy -@@ -618,7 +653,7 @@ +@@ -618,7 +654,7 @@ # SWAT Local policy # @@ -24541,7 +25213,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow swat_t self:process { setrlimit signal_perms }; allow swat_t self:fifo_file rw_fifo_file_perms; allow swat_t self:netlink_tcpdiag_socket r_netlink_socket_perms; -@@ -626,23 +661,23 @@ +@@ -626,23 +662,23 @@ allow swat_t self:udp_socket create_socket_perms; allow swat_t self:unix_stream_socket connectto; @@ -24574,7 +25246,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow swat_t smbd_exec_t:file mmap_file_perms ; allow swat_t smbd_t:process signull; -@@ -657,7 +692,7 @@ +@@ -657,7 +693,7 @@ files_pid_filetrans(swat_t, swat_var_run_t, file) allow swat_t winbind_exec_t:file mmap_file_perms; @@ -24583,7 +25255,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow swat_t winbind_var_run_t:dir { write add_name remove_name }; allow swat_t winbind_var_run_t:sock_file { create unlink }; -@@ -700,6 +735,8 @@ +@@ -700,6 +736,8 @@ miscfiles_read_localization(swat_t) @@ -24592,7 +25264,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb optional_policy(` cups_read_rw_config(swat_t) cups_stream_connect(swat_t) -@@ -713,12 +750,23 @@ +@@ -713,12 +751,23 @@ kerberos_use(swat_t) ') @@ -24617,7 +25289,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb dontaudit winbind_t self:capability sys_tty_config; allow winbind_t self:process { signal_perms getsched setsched }; allow winbind_t self:fifo_file rw_fifo_file_perms; -@@ -866,6 +914,18 @@ +@@ -779,6 +828,8 @@ + corenet_tcp_bind_generic_node(winbind_t) + corenet_udp_bind_generic_node(winbind_t) + corenet_tcp_connect_smbd_port(winbind_t) ++corenet_tcp_connect_smbd_port(winbind_t) ++corenet_tcp_connect_all_unreserved_ports(winbind_t) + + dev_read_sysfs(winbind_t) + dev_read_urand(winbind_t) +@@ -788,7 +839,7 @@ + + auth_domtrans_chk_passwd(winbind_t) + auth_use_nsswitch(winbind_t) +-auth_rw_cache(winbind_t) ++auth_manage_cache(winbind_t) + + domain_use_interactive_fds(winbind_t) + +@@ -866,6 +917,18 @@ # optional_policy(` @@ -24636,7 +25326,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb type samba_unconfined_script_t; type samba_unconfined_script_exec_t; domain_type(samba_unconfined_script_t) -@@ -876,9 +936,12 @@ +@@ -876,9 +939,12 @@ allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms; allow smbd_t samba_unconfined_script_exec_t:file ioctl; @@ -24973,7 +25663,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.7.8/policy/modules/services/setroubleshoot.te --- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/services/setroubleshoot.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/setroubleshoot.te 2010-02-05 14:36:34.000000000 -0500 @@ -22,13 +22,19 @@ type setroubleshoot_var_run_t; files_pid_file(setroubleshoot_var_run_t) @@ -25035,7 +25725,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr selinux_get_enforce_mode(setroubleshootd_t) selinux_validate_context(setroubleshootd_t) -@@ -94,23 +113,75 @@ +@@ -94,23 +113,79 @@ locallogin_dontaudit_use_fds(setroubleshootd_t) @@ -25105,6 +25795,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr +userdom_signull_unpriv_users(setroubleshoot_fixit_t) + +optional_policy(` ++ gnome_dontaudit_search_config(setroubleshoot_fixit_t) ++') ++ ++optional_policy(` + rpm_signull(setroubleshoot_fixit_t) + rpm_read_db(setroubleshoot_fixit_t) + rpm_dontaudit_manage_db(setroubleshoot_fixit_t) @@ -25157,7 +25851,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp allow snmpd_t self:fifo_file rw_fifo_file_perms; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snort.te serefpolicy-3.7.8/policy/modules/services/snort.te --- nsaserefpolicy/policy/modules/services/snort.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/services/snort.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/snort.te 2010-02-04 08:19:39.000000000 -0500 @@ -37,6 +37,7 @@ allow snort_t self:tcp_socket create_stream_socket_perms; allow snort_t self:udp_socket create_socket_perms; @@ -25182,11 +25876,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snor corenet_all_recvfrom_unlabeled(snort_t) corenet_all_recvfrom_netlabel(snort_t) -@@ -76,6 +78,7 @@ +@@ -76,6 +78,8 @@ dev_read_sysfs(snort_t) dev_read_rand(snort_t) dev_read_urand(snort_t) +dev_read_usbmon_dev(snort_t) ++dev_rw_generic_usb_dev(snort_t) domain_use_interactive_fds(snort_t) @@ -25353,7 +26048,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.7.8/policy/modules/services/spamassassin.te --- nsaserefpolicy/policy/modules/services/spamassassin.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/services/spamassassin.te 2010-02-03 08:51:00.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/spamassassin.te 2010-02-08 15:11:48.000000000 -0500 @@ -20,6 +20,35 @@ ## gen_tunable(spamd_enable_home_dirs, true) @@ -25611,9 +26306,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam fs_manage_cifs_files(spamd_t) ') -@@ -402,23 +499,16 @@ +@@ -401,24 +498,18 @@ + ') optional_policy(` ++ dcc_domtrans_cdcc(spamd_t) dcc_domtrans_client(spamd_t) + dcc_signal_client(spamd_t) dcc_stream_connect_dccifd(spamd_t) @@ -25636,7 +26333,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam postfix_read_config(spamd_t) ') -@@ -433,6 +523,10 @@ +@@ -433,6 +524,10 @@ optional_policy(` razor_domtrans(spamd_t) @@ -25647,7 +26344,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam ') optional_policy(` -@@ -445,5 +539,9 @@ +@@ -445,5 +540,9 @@ ') optional_policy(` @@ -25996,7 +26693,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd /var/run/sssd.pid -- gen_context(system_u:object_r:sssd_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.if serefpolicy-3.7.8/policy/modules/services/sssd.if --- nsaserefpolicy/policy/modules/services/sssd.if 2010-01-07 14:53:53.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/services/sssd.if 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/sssd.if 2010-02-08 12:03:33.000000000 -0500 @@ -38,6 +38,25 @@ ######################################## @@ -28099,7 +28796,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.7.8/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2009-12-04 09:43:33.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/services/xserver.te 2010-02-02 16:08:33.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/services/xserver.te 2010-02-08 14:29:02.000000000 -0500 @@ -36,6 +36,13 @@ ## @@ -28262,11 +28959,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files(iceauth_t) -@@ -250,30 +274,52 @@ +@@ -250,30 +274,53 @@ fs_manage_cifs_files(iceauth_t) ') +ifdef(`hide_broken_symptoms', ` ++ dev_dontaudit_read_urand(iceauth_t) + dev_dontaudit_rw_dri(iceauth_t) + dev_dontaudit_rw_generic_dev_nodes(iceauth_t) + fs_list_inotifyfs(iceauth_t) @@ -28319,7 +29017,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser fs_search_auto_mountpoints(xauth_t) # cjp: why? -@@ -283,17 +329,35 @@ +@@ -283,17 +330,35 @@ userdom_use_user_terminals(xauth_t) userdom_read_user_tmp_files(xauth_t) @@ -28355,7 +29053,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser optional_policy(` ssh_sigchld(xauth_t) ssh_read_pipes(xauth_t) -@@ -305,20 +369,31 @@ +@@ -305,20 +370,31 @@ # XDM Local policy # @@ -28390,7 +29088,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # Allow gdm to run gdm-binary can_exec(xdm_t, xdm_exec_t) -@@ -334,22 +409,40 @@ +@@ -334,22 +410,40 @@ manage_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t) manage_sock_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t) files_tmp_filetrans(xdm_t, xdm_tmp_t, { file dir sock_file }) @@ -28434,7 +29132,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser allow xdm_t xserver_t:process signal; allow xdm_t xserver_t:unix_stream_socket connectto; -@@ -363,6 +456,7 @@ +@@ -363,6 +457,7 @@ allow xdm_t xserver_t:process { noatsecure siginh rlimitinh signal sigkill }; allow xdm_t xserver_t:shm rw_shm_perms; @@ -28442,7 +29140,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # connect to xdm xserver over stream socket stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) -@@ -371,10 +465,14 @@ +@@ -371,10 +466,14 @@ delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) @@ -28458,7 +29156,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser kernel_read_system_state(xdm_t) kernel_read_kernel_sysctls(xdm_t) -@@ -394,11 +492,13 @@ +@@ -394,11 +493,13 @@ corenet_udp_sendrecv_all_ports(xdm_t) corenet_tcp_bind_generic_node(xdm_t) corenet_udp_bind_generic_node(xdm_t) @@ -28472,7 +29170,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser dev_read_rand(xdm_t) dev_read_sysfs(xdm_t) dev_getattr_framebuffer_dev(xdm_t) -@@ -406,6 +506,7 @@ +@@ -406,6 +507,7 @@ dev_getattr_mouse_dev(xdm_t) dev_setattr_mouse_dev(xdm_t) dev_rw_apm_bios(xdm_t) @@ -28480,7 +29178,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser dev_setattr_apm_bios_dev(xdm_t) dev_rw_dri(xdm_t) dev_rw_agp(xdm_t) -@@ -414,18 +515,21 @@ +@@ -414,18 +516,21 @@ dev_getattr_misc_dev(xdm_t) dev_setattr_misc_dev(xdm_t) dev_dontaudit_rw_misc(xdm_t) @@ -28505,7 +29203,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser files_read_etc_files(xdm_t) files_read_var_files(xdm_t) -@@ -436,9 +540,15 @@ +@@ -436,9 +541,15 @@ files_read_usr_files(xdm_t) # Poweroff wants to create the /poweroff file when run from xdm files_create_boot_flag(xdm_t) @@ -28521,7 +29219,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t) -@@ -447,6 +557,7 @@ +@@ -447,6 +558,7 @@ storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t) @@ -28529,7 +29227,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser term_setattr_console(xdm_t) term_use_unallocated_ttys(xdm_t) -@@ -455,6 +566,7 @@ +@@ -455,6 +567,7 @@ auth_domtrans_pam_console(xdm_t) auth_manage_pam_pid(xdm_t) auth_manage_pam_console_data(xdm_t) @@ -28537,7 +29235,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser auth_rw_faillog(xdm_t) auth_write_login_records(xdm_t) -@@ -465,10 +577,12 @@ +@@ -465,10 +578,12 @@ logging_read_generic_logs(xdm_t) @@ -28552,7 +29250,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_create_all_users_keys(xdm_t) -@@ -477,6 +591,11 @@ +@@ -477,6 +592,11 @@ # Search /proc for any user domain processes. userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) @@ -28564,7 +29262,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser xserver_rw_session(xdm_t, xdm_tmpfs_t) xserver_unconfined(xdm_t) -@@ -509,10 +628,12 @@ +@@ -509,10 +629,12 @@ optional_policy(` alsa_domtrans(xdm_t) @@ -28577,7 +29275,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') optional_policy(` -@@ -520,12 +641,49 @@ +@@ -520,12 +642,49 @@ ') optional_policy(` @@ -28627,7 +29325,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser hostname_exec(xdm_t) ') -@@ -543,9 +701,43 @@ +@@ -543,9 +702,43 @@ ') optional_policy(` @@ -28671,7 +29369,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser optional_policy(` seutil_sigchld_newrole(xdm_t) ') -@@ -555,8 +747,9 @@ +@@ -555,8 +748,9 @@ ') optional_policy(` @@ -28683,7 +29381,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ifndef(`distro_redhat',` allow xdm_t self:process { execheap execmem }; -@@ -565,7 +758,6 @@ +@@ -565,7 +759,6 @@ ifdef(`distro_rhel4',` allow xdm_t self:process { execheap execmem }; ') @@ -28691,7 +29389,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser optional_policy(` userhelper_dontaudit_search_config(xdm_t) -@@ -576,6 +768,10 @@ +@@ -576,6 +769,10 @@ ') optional_policy(` @@ -28702,7 +29400,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser xfs_stream_connect(xdm_t) ') -@@ -600,10 +796,9 @@ +@@ -600,10 +797,9 @@ # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack @@ -28714,7 +29412,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser allow xserver_t self:fd use; allow xserver_t self:fifo_file rw_fifo_file_perms; allow xserver_t self:sock_file read_sock_file_perms; -@@ -615,6 +810,18 @@ +@@ -615,6 +811,18 @@ allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:udp_socket create_socket_perms; @@ -28733,7 +29431,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) -@@ -634,12 +841,19 @@ +@@ -634,12 +842,19 @@ manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) files_search_var_lib(xserver_t) @@ -28755,7 +29453,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser kernel_read_system_state(xserver_t) kernel_read_device_sysctls(xserver_t) -@@ -673,7 +887,6 @@ +@@ -673,7 +888,6 @@ dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) @@ -28763,7 +29461,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser dev_create_generic_dirs(xserver_t) dev_setattr_generic_dirs(xserver_t) # raw memory access is needed if not using the frame buffer -@@ -683,9 +896,12 @@ +@@ -683,9 +897,12 @@ dev_rw_xserver_misc(xserver_t) # read events - the synaptics touchpad driver reads raw events dev_rw_input_dev(xserver_t) @@ -28777,7 +29475,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser files_read_etc_files(xserver_t) files_read_etc_runtime_files(xserver_t) -@@ -700,8 +916,12 @@ +@@ -700,8 +917,12 @@ fs_search_nfs(xserver_t) fs_search_auto_mountpoints(xserver_t) fs_search_ramfs(xserver_t) @@ -28790,7 +29488,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser selinux_validate_context(xserver_t) selinux_compute_access_vector(xserver_t) -@@ -723,6 +943,7 @@ +@@ -723,6 +944,7 @@ miscfiles_read_localization(xserver_t) miscfiles_read_fonts(xserver_t) @@ -28798,7 +29496,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser modutils_domtrans_insmod(xserver_t) -@@ -779,12 +1000,20 @@ +@@ -779,12 +1001,20 @@ ') optional_policy(` @@ -28820,7 +29518,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser unconfined_domtrans(xserver_t) ') -@@ -811,7 +1040,7 @@ +@@ -811,7 +1041,7 @@ allow xserver_t xdm_var_lib_t:file { getattr read }; dontaudit xserver_t xdm_var_lib_t:dir search; @@ -28829,7 +29527,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # Label pid and temporary files with derived types. manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) -@@ -832,9 +1061,14 @@ +@@ -832,9 +1062,14 @@ # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_user_home_content_files(xserver_t) @@ -28844,7 +29542,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(xserver_t) fs_manage_nfs_files(xserver_t) -@@ -849,11 +1083,14 @@ +@@ -849,11 +1084,14 @@ optional_policy(` dbus_system_bus_client(xserver_t) @@ -28861,7 +29559,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') optional_policy(` -@@ -1000,17 +1237,32 @@ +@@ -1000,17 +1238,32 @@ allow xserver_unconfined_type { x_domain xserver_t }:x_resource *; allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *; @@ -28938,15 +29636,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zebr ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.7.8/policy/modules/system/application.te --- nsaserefpolicy/policy/modules/system/application.te 2009-11-25 11:47:19.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/system/application.te 2010-02-03 09:21:48.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/system/application.te 2010-02-05 11:23:03.000000000 -0500 @@ -7,6 +7,17 @@ # Executables to be run by user attribute application_exec_type; +userdom_inherit_append_user_home_content_files(application_domain_type) +userdom_inherit_append_admin_home_files(application_domain_type) -+userdom_write_user_tmp_files(application_domain_type) -+logging_rw_all_logs(application_domain_type) ++userdom_inherit_append_user_tmp_files(application_domain_type) ++logging_inherit_append_all_logs(application_domain_type) + +files_dontaudit_search_all_dirs(application_domain_type) + @@ -29460,7 +30158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.f # /var diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.7.8/policy/modules/system/init.if --- nsaserefpolicy/policy/modules/system/init.if 2009-11-12 12:51:51.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/system/init.if 2010-02-03 15:45:27.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/system/init.if 2010-02-04 09:02:56.000000000 -0500 @@ -162,8 +162,10 @@ gen_require(` attribute direct_run_init, direct_init, direct_init_entry; @@ -29472,12 +30170,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') typeattribute $1 daemon; -@@ -174,6 +176,12 @@ +@@ -174,6 +176,13 @@ role system_r types $1; domtrans_pattern(initrc_t,$2,$1) + allow initrc_t $1:process siginh; + allow $1 initrc_transition_domain:fifo_file rw_inherited_fifo_file_perms; ++ allow $1 initrc_transition_domain:fd use; + + # Handle upstart direct transition to a executable + domtrans_pattern(init_t,$2,$1) @@ -29485,7 +30184,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i # daemons started from init will # inherit fds from init for the console -@@ -265,6 +273,7 @@ +@@ -265,6 +274,7 @@ gen_require(` type initrc_t; role system_r; @@ -29493,16 +30192,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') application_domain($1,$2) -@@ -272,6 +281,8 @@ +@@ -272,6 +282,9 @@ role system_r types $1; domtrans_pattern(initrc_t,$2,$1) + allow initrc_t $1:process siginh; + allow $1 initrc_transition_domain:fifo_file rw_inherited_fifo_file_perms; ++ allow $1 initrc_transition_domain:fd use; ifdef(`hide_broken_symptoms',` # RHEL4 systems seem to have a stray -@@ -280,6 +291,36 @@ +@@ -280,6 +293,36 @@ kernel_dontaudit_use_fds($1) ') ') @@ -29539,7 +30239,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -546,7 +587,8 @@ +@@ -546,7 +589,8 @@ # upstart uses a datagram socket instead of initctl pipe allow $1 self:unix_dgram_socket create_socket_perms; @@ -29549,7 +30249,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ') -@@ -619,18 +661,19 @@ +@@ -619,18 +663,19 @@ # interface(`init_spec_domtrans_script',` gen_require(` @@ -29573,7 +30273,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ') -@@ -646,23 +689,43 @@ +@@ -646,23 +691,43 @@ # interface(`init_domtrans_script',` gen_require(` @@ -29621,7 +30321,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ## Execute a init script in a specified domain. ## ## -@@ -714,8 +777,10 @@ +@@ -714,8 +779,10 @@ interface(`init_labeled_script_domtrans',` gen_require(` type initrc_t; @@ -29632,7 +30332,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i domtrans_pattern($1, $2, initrc_t) files_search_etc($1) ') -@@ -923,6 +988,24 @@ +@@ -923,6 +990,24 @@ allow $1 init_script_file_type:file read_file_perms; ') @@ -29657,7 +30357,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ######################################## ## ## Execute all init scripts in the caller domain. -@@ -1142,7 +1225,7 @@ +@@ -1142,7 +1227,7 @@ type initrc_t; ') @@ -29666,7 +30366,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -1310,6 +1393,25 @@ +@@ -1310,6 +1395,25 @@ ######################################## ## @@ -29692,7 +30392,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ## Create files in a init script ## temporary data directory. ## -@@ -1540,3 +1642,76 @@ +@@ -1540,3 +1644,76 @@ ') corenet_udp_recvfrom_labeled($1, daemon) ') @@ -29771,7 +30471,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.7.8/policy/modules/system/init.te --- nsaserefpolicy/policy/modules/system/init.te 2009-11-12 12:51:51.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/system/init.te 2010-02-03 15:43:32.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/system/init.te 2010-02-08 12:54:27.000000000 -0500 @@ -17,6 +17,20 @@ ## gen_tunable(init_upstart, false) @@ -29801,6 +30501,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t # Mark process types as daemons attribute daemon; +@@ -33,7 +48,7 @@ + # + # init_t is the domain of the init process. + # +-type init_t; ++type init_t, initrc_transition_domain; + type init_exec_t; + domain_type(init_t) + domain_entry_file(init_t, init_exec_t) @@ -64,6 +79,7 @@ # of the below init_upstart tunable # but this has a typeattribute in it @@ -29818,17 +30527,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t # is ~sys_module really needed? observed: # sys_boot # sys_tty_config -@@ -101,7 +117,8 @@ +@@ -101,7 +117,9 @@ # Re-exec itself can_exec(init_t, init_exec_t) -allow init_t initrc_t:unix_stream_socket connectto; +allow init_t initrc_t:unix_stream_socket { connectto rw_stream_socket_perms }; +allow initrc_t init_t:unix_stream_socket { connectto rw_stream_socket_perms }; ++allow initrc_t init_t:fifo_file rw_fifo_file_perms; # For /var/run/shutdown.pid. allow init_t init_var_run_t:file manage_file_perms; -@@ -140,6 +157,7 @@ +@@ -140,6 +158,7 @@ files_dontaudit_rw_root_files(init_t) files_dontaudit_rw_root_chr_files(init_t) @@ -29836,7 +30546,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t # cjp: this may be related to /dev/log fs_write_ramfs_sockets(init_t) -@@ -167,6 +185,8 @@ +@@ -167,11 +186,14 @@ miscfiles_read_localization(init_t) @@ -29845,7 +30555,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ifdef(`distro_gentoo',` allow init_t self:process { getcap setcap }; ') -@@ -189,6 +209,22 @@ + + ifdef(`distro_redhat',` ++ fs_read_tmpfs_symlinks(init_t) + fs_rw_tmpfs_chr_files(init_t) + fs_tmpfs_filetrans(init_t, initctl_t, fifo_file) + ') +@@ -189,10 +211,31 @@ ') optional_policy(` @@ -29853,6 +30569,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t +') + +optional_policy(` ++ dbus_connect_system_bus(init_t) + dbus_system_bus_client(init_t) +') + @@ -29868,7 +30585,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t nscd_socket_use(init_t) ') -@@ -202,9 +238,10 @@ + optional_policy(` ++ sssd_stream_connect(init_t) ++') ++ ++optional_policy(` + unconfined_domain(init_t) + ') + +@@ -202,9 +245,10 @@ # allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; @@ -29880,7 +30605,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t # Allow IPC with self allow initrc_t self:unix_dgram_socket create_socket_perms; -@@ -217,7 +254,8 @@ +@@ -217,7 +261,8 @@ term_create_pty(initrc_t, initrc_devpts_t) # Going to single user mode @@ -29890,7 +30615,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t can_exec(initrc_t, init_script_file_type) -@@ -230,10 +268,16 @@ +@@ -230,10 +275,16 @@ allow initrc_t initrc_var_run_t:file manage_file_perms; files_pid_filetrans(initrc_t, initrc_var_run_t, file) @@ -29909,7 +30634,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t files_tmp_filetrans(initrc_t, initrc_tmp_t, { file dir }) init_write_initctl(initrc_t) -@@ -246,13 +290,19 @@ +@@ -246,13 +297,19 @@ kernel_clear_ring_buffer(initrc_t) kernel_get_sysvipc_info(initrc_t) kernel_read_all_sysctls(initrc_t) @@ -29931,7 +30656,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t corenet_all_recvfrom_unlabeled(initrc_t) corenet_all_recvfrom_netlabel(initrc_t) -@@ -272,16 +322,66 @@ +@@ -267,21 +324,72 @@ + + dev_read_rand(initrc_t) + dev_read_urand(initrc_t) ++dev_write_kmsg(initrc_t) + dev_write_rand(initrc_t) + dev_write_urand(initrc_t) dev_rw_sysfs(initrc_t) dev_list_usbfs(initrc_t) dev_read_framebuffer(initrc_t) @@ -29999,7 +30730,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t domain_kill_all_domains(initrc_t) domain_signal_all_domains(initrc_t) -@@ -291,7 +391,7 @@ +@@ -291,7 +399,7 @@ domain_sigchld_all_domains(initrc_t) domain_read_all_domains_state(initrc_t) domain_getattr_all_domains(initrc_t) @@ -30008,7 +30739,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t domain_getsession_all_domains(initrc_t) domain_use_interactive_fds(initrc_t) # for lsof which is used by alsa shutdown: -@@ -306,14 +406,15 @@ +@@ -306,14 +414,15 @@ files_getattr_all_pipes(initrc_t) files_getattr_all_sockets(initrc_t) files_purge_tmp(initrc_t) @@ -30026,7 +30757,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t files_exec_etc_files(initrc_t) files_read_usr_files(initrc_t) files_manage_urandom_seed(initrc_t) -@@ -324,48 +425,16 @@ +@@ -324,48 +433,16 @@ files_mounton_isid_type_dirs(initrc_t) files_list_default(initrc_t) files_mounton_default(initrc_t) @@ -30079,7 +30810,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t logging_send_syslog_msg(initrc_t) logging_manage_generic_logs(initrc_t) logging_read_all_logs(initrc_t) -@@ -374,19 +443,22 @@ +@@ -374,19 +451,22 @@ miscfiles_read_localization(initrc_t) # slapd needs to read cert files from its initscript @@ -30103,7 +30834,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ifdef(`distro_debian',` dev_setattr_generic_dirs(initrc_t) -@@ -422,16 +494,12 @@ +@@ -422,16 +502,12 @@ # init scripts touch this clock_dontaudit_write_adjtime(initrc_t) @@ -30121,7 +30852,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t optional_policy(` arpwatch_manage_data_files(initrc_t) -@@ -450,11 +518,9 @@ +@@ -450,11 +526,9 @@ # Red Hat systems seem to have a stray # fd open from the initrd @@ -30134,7 +30865,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t # These seem to be from the initrd # during device initialization: dev_create_generic_dirs(initrc_t) -@@ -464,6 +530,7 @@ +@@ -464,6 +538,7 @@ storage_raw_read_fixed_disk(initrc_t) storage_raw_write_fixed_disk(initrc_t) @@ -30142,7 +30873,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t files_create_boot_flag(initrc_t) files_rw_boot_symlinks(initrc_t) # wants to read /.fonts directory -@@ -492,15 +559,26 @@ +@@ -472,6 +547,7 @@ + # Needs to cp localtime to /var dirs + files_write_var_dirs(initrc_t) + ++ fs_read_tmpfs_symlinks(initrc_t) + fs_rw_tmpfs_chr_files(initrc_t) + + storage_manage_fixed_disk(initrc_t) +@@ -492,15 +568,26 @@ optional_policy(` bind_manage_config_dirs(initrc_t) bind_write_config(initrc_t) @@ -30169,7 +30908,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -515,6 +593,33 @@ +@@ -515,6 +602,33 @@ ') ') @@ -30203,7 +30942,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t optional_policy(` amavis_search_lib(initrc_t) amavis_setattr_pid_files(initrc_t) -@@ -567,10 +672,19 @@ +@@ -567,10 +681,19 @@ dbus_connect_system_bus(initrc_t) dbus_system_bus_client(initrc_t) dbus_read_config(initrc_t) @@ -30223,7 +30962,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -590,6 +704,10 @@ +@@ -590,6 +713,10 @@ ') optional_policy(` @@ -30234,7 +30973,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t dev_read_usbfs(initrc_t) # init scripts run /etc/hotplug/usb.rc -@@ -646,20 +764,20 @@ +@@ -646,20 +773,20 @@ ') optional_policy(` @@ -30261,7 +31000,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t optional_policy(` ifdef(`distro_redhat',` -@@ -668,6 +786,7 @@ +@@ -668,6 +795,7 @@ mysql_stream_connect(initrc_t) mysql_write_log(initrc_t) @@ -30269,7 +31008,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -700,7 +819,6 @@ +@@ -700,7 +828,6 @@ ') optional_policy(` @@ -30277,7 +31016,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t fs_write_ramfs_sockets(initrc_t) fs_search_ramfs(initrc_t) -@@ -722,8 +840,6 @@ +@@ -722,8 +849,6 @@ # bash tries ioctl for some reason files_dontaudit_ioctl_all_pids(initrc_t) @@ -30286,7 +31025,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -736,13 +852,16 @@ +@@ -736,13 +861,16 @@ squid_manage_logs(initrc_t) ') @@ -30303,7 +31042,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -751,6 +870,7 @@ +@@ -751,6 +879,7 @@ optional_policy(` udev_rw_db(initrc_t) @@ -30311,7 +31050,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -758,7 +878,17 @@ +@@ -758,7 +887,17 @@ ') optional_policy(` @@ -30329,7 +31068,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ifdef(`distro_redhat',` # system-config-services causes avc messages that should be dontaudited -@@ -768,6 +898,21 @@ +@@ -768,6 +907,25 @@ optional_policy(` mono_domtrans(initrc_t) ') @@ -30344,6 +31083,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t + ') + init_system_domain(unconfined_execmem_t, execmem_exec_t) + ') ++ ++ optional_policy(` ++ rtkit_daemon_system_domain(initrc_t) ++ ') +') + +optional_policy(` @@ -30351,7 +31094,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -793,3 +938,31 @@ +@@ -793,3 +951,31 @@ optional_policy(` zebra_read_config(initrc_t) ') @@ -30664,9 +31407,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl +/etc/sysctl\.conf.* -- +gen_context(system_u:object_r:iptables_conf_t,s0) +') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.if serefpolicy-3.7.8/policy/modules/system/iptables.if +--- nsaserefpolicy/policy/modules/system/iptables.if 2009-12-04 09:43:33.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/system/iptables.if 2010-02-08 13:40:44.000000000 -0500 +@@ -49,6 +49,13 @@ + optional_policy(` + modutils_run_insmod(iptables_t, $2) + ') ++ ++ifdef(`hide_broken_symptoms', ` ++ dontaudit iptables_t $2:unix_stream_socket rw_socket_perms; ++ dontaudit iptables_t $2:tcp_socket rw_socket_perms; ++ dontaudit iptables_t $2:udp_socket rw_socket_perms; ++') ++ + ') + + ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.7.8/policy/modules/system/iptables.te --- nsaserefpolicy/policy/modules/system/iptables.te 2009-12-04 09:43:33.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/system/iptables.te 2010-02-03 08:15:29.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/system/iptables.te 2010-02-04 13:52:12.000000000 -0500 @@ -14,9 +14,6 @@ type iptables_initrc_exec_t; init_script_file(iptables_initrc_exec_t) @@ -30692,15 +31452,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl manage_files_pattern(iptables_t, iptables_var_run_t, iptables_var_run_t) files_pid_filetrans(iptables_t, iptables_var_run_t, file) -@@ -53,6 +51,7 @@ +@@ -53,8 +51,12 @@ kernel_use_fds(iptables_t) corenet_relabelto_all_packets(iptables_t) +corenet_dontaudit_rw_tun_tap_dev(iptables_t) dev_read_sysfs(iptables_t) ++ifdef(`hide_broken_symptoms',` ++ dev_dontaudit_write_mtrr(iptables_t) ++') -@@ -63,6 +62,7 @@ + fs_getattr_xattr_fs(iptables_t) + fs_search_auto_mountpoints(iptables_t) +@@ -63,6 +65,7 @@ mls_file_read_all_levels(iptables_t) term_dontaudit_use_console(iptables_t) @@ -30708,7 +31473,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl domain_use_interactive_fds(iptables_t) -@@ -76,6 +76,7 @@ +@@ -76,6 +79,7 @@ # to allow rules to be saved on reboot: init_rw_script_tmp_files(iptables_t) init_rw_script_stream_sockets(iptables_t) @@ -30716,7 +31481,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl logging_send_syslog_msg(iptables_t) -@@ -89,6 +90,7 @@ +@@ -89,6 +93,7 @@ optional_policy(` fail2ban_append_log(iptables_t) @@ -30724,7 +31489,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl ') optional_policy(` -@@ -122,5 +124,10 @@ +@@ -122,5 +127,10 @@ ') optional_policy(` @@ -31401,7 +32166,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin +/var/webmin(/.*)? gen_context(system_u:object_r:var_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.7.8/policy/modules/system/logging.if --- nsaserefpolicy/policy/modules/system/logging.if 2009-08-28 14:58:20.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/system/logging.if 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/system/logging.if 2010-02-05 11:22:48.000000000 -0500 @@ -69,6 +69,20 @@ ######################################## @@ -31423,16 +32188,34 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin ## Set up audit ## ## -@@ -624,7 +638,7 @@ +@@ -624,7 +638,25 @@ ') files_search_var($1) - append_files_pattern($1, var_log_t, logfile) + append_files_pattern($1, logfile, logfile) ++') ++ ++######################################## ++## ++## Append to all log files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`logging_inherit_append_all_logs',` ++ gen_require(` ++ attribute logfile; ++ ') ++ ++ allow $1 logfile:file { getattr append }; ') ######################################## -@@ -707,7 +721,9 @@ +@@ -707,7 +739,9 @@ files_search_var($1) manage_files_pattern($1, logfile, logfile) @@ -31730,7 +32513,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.7.8/policy/modules/system/modutils.te --- nsaserefpolicy/policy/modules/system/modutils.te 2009-12-04 09:43:33.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/system/modutils.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/system/modutils.te 2010-02-08 11:50:22.000000000 -0500 @@ -19,6 +19,7 @@ type insmod_exec_t; application_domain(insmod_t, insmod_exec_t) @@ -31771,7 +32554,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal }; allow insmod_t self:udp_socket create_socket_perms; -@@ -143,6 +147,7 @@ +@@ -126,6 +130,7 @@ + kernel_mount_debugfs(insmod_t) + kernel_mount_kvmfs(insmod_t) + kernel_read_debugfs(insmod_t) ++kernel_request_load_module(insmod_t) + # Rules for /proc/sys/kernel/tainted + kernel_read_kernel_sysctls(insmod_t) + kernel_rw_kernel_sysctl(insmod_t) +@@ -143,6 +148,7 @@ dev_read_sound(insmod_t) dev_write_sound(insmod_t) dev_rw_apm_bios(insmod_t) @@ -31779,7 +32570,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti domain_signal_all_domains(insmod_t) domain_use_interactive_fds(insmod_t) -@@ -160,11 +165,15 @@ +@@ -160,11 +166,15 @@ files_write_kernel_modules(insmod_t) fs_getattr_xattr_fs(insmod_t) @@ -31795,7 +32586,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti logging_send_syslog_msg(insmod_t) logging_search_logs(insmod_t) -@@ -173,10 +182,13 @@ +@@ -173,10 +183,13 @@ seutil_read_file_contexts(insmod_t) @@ -31811,7 +32602,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti if( ! secure_mode_insmod ) { kernel_domtrans_to(insmod_t, insmod_exec_t) } -@@ -230,7 +242,7 @@ +@@ -230,7 +243,7 @@ ') optional_policy(` @@ -31926,7 +32717,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.7.8/policy/modules/system/mount.te --- nsaserefpolicy/policy/modules/system/mount.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/system/mount.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/system/mount.te 2010-02-05 14:44:10.000000000 -0500 @@ -18,8 +18,15 @@ init_system_domain(mount_t, mount_exec_t) role system_r types mount_t; @@ -32129,7 +32920,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. # for kernel package installation optional_policy(` rpm_rw_pipes(mount_t) -@@ -186,6 +259,15 @@ +@@ -186,6 +259,19 @@ optional_policy(` samba_domtrans_smbmount(mount_t) @@ -32137,6 +32928,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. +') + +optional_policy(` ++ ssh_exec(mount_t) ++') ++ ++optional_policy(` + usbmuxd_stream_connect(mount_t) +') + @@ -32145,7 +32940,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ') ######################################## -@@ -195,5 +277,9 @@ +@@ -195,5 +281,9 @@ optional_policy(` files_etc_filetrans_etc_runtime(unconfined_mount_t, file) @@ -33003,7 +33798,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet +/etc/firestarter/firestarter\.sh gen_context(system_u:object_r:dhcpc_helper_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.7.8/policy/modules/system/sysnetwork.if --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/system/sysnetwork.if 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/system/sysnetwork.if 2010-02-08 14:34:28.000000000 -0500 @@ -43,6 +43,36 @@ sysnet_domtrans_dhcpc($1) @@ -33182,7 +33977,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.7.8/policy/modules/system/sysnetwork.te --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/system/sysnetwork.te 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/system/sysnetwork.te 2010-02-08 13:45:54.000000000 -0500 @@ -20,6 +20,9 @@ init_daemon_domain(dhcpc_t, dhcpc_exec_t) role system_r types dhcpc_t; @@ -33419,7 +34214,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.i ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.7.8/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2009-11-25 11:47:19.000000000 -0500 -+++ serefpolicy-3.7.8/policy/modules/system/udev.te 2010-02-03 14:21:06.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/system/udev.te 2010-02-08 11:55:08.000000000 -0500 @@ -50,6 +50,7 @@ allow udev_t self:unix_stream_socket connectto; allow udev_t self:netlink_kobject_uevent_socket create_socket_perms; @@ -33428,7 +34223,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t allow udev_t udev_exec_t:file write; can_exec(udev_t, udev_exec_t) -@@ -210,6 +211,10 @@ +@@ -99,6 +100,7 @@ + # udev_node.c/node_symlink() symlink labels are explicitly + # preserved, instead of short circuiting the relabel + dev_relabel_generic_symlinks(udev_t) ++dev_manage_generic_symlinks(udev_t) + + domain_read_all_domains_state(udev_t) + domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these +@@ -210,6 +212,10 @@ ') optional_policy(` @@ -33439,7 +34242,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t consoletype_exec(udev_t) ') -@@ -236,6 +241,7 @@ +@@ -236,6 +242,7 @@ optional_policy(` hal_dgram_send(udev_t) @@ -33447,7 +34250,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t ') optional_policy(` -@@ -263,7 +269,7 @@ +@@ -263,7 +270,7 @@ ') optional_policy(` @@ -33456,7 +34259,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t ') optional_policy(` -@@ -271,6 +277,14 @@ +@@ -271,6 +278,14 @@ ') optional_policy(` @@ -34248,7 +35051,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo +HOME_DIR/\.gvfs(/.*)? <> diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.7.8/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2009-08-31 13:30:04.000000000 -0400 -+++ serefpolicy-3.7.8/policy/modules/system/userdomain.if 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/modules/system/userdomain.if 2010-02-05 11:22:50.000000000 -0500 @@ -30,8 +30,9 @@ ') @@ -36829,9 +37632,30 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te #Should have a boolean wrapping these fs_list_auto_mountpoints(xend_t) files_search_mnt(xend_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-3.7.8/policy/support/misc_patterns.spt +--- nsaserefpolicy/policy/support/misc_patterns.spt 2009-07-14 14:19:57.000000000 -0400 ++++ serefpolicy-3.7.8/policy/support/misc_patterns.spt 2010-02-05 16:37:16.000000000 -0500 +@@ -15,7 +15,7 @@ + domain_transition_pattern($1,$2,$3) + + allow $3 $1:fd use; +- allow $3 $1:fifo_file rw_fifo_file_perms; ++ allow $3 $1:fifo_file rw_inherited_fifo_file_perms; + allow $3 $1:process sigchld; + ') + +@@ -34,7 +34,7 @@ + domain_auto_transition_pattern($1,$2,$3) + + allow $3 $1:fd use; +- allow $3 $1:fifo_file rw_fifo_file_perms; ++ allow $3 $1:fifo_file rw_inherited_fifo_file_perms; + allow $3 $1:process sigchld; + ') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.7.8/policy/support/obj_perm_sets.spt --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2009-11-25 11:47:19.000000000 -0500 -+++ serefpolicy-3.7.8/policy/support/obj_perm_sets.spt 2010-02-02 10:31:03.000000000 -0500 ++++ serefpolicy-3.7.8/policy/support/obj_perm_sets.spt 2010-02-08 12:51:47.000000000 -0500 @@ -28,7 +28,7 @@ # # All socket classes. @@ -36858,6 +37682,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets define(`create_file_perms',`{ getattr create open }') define(`rename_file_perms',`{ getattr rename }') define(`delete_file_perms',`{ getattr unlink }') +@@ -225,7 +227,7 @@ + define(`create_lnk_file_perms',`{ create getattr }') + define(`rename_lnk_file_perms',`{ getattr rename }') + define(`delete_lnk_file_perms',`{ getattr unlink }') +-define(`manage_lnk_file_perms',`{ create read getattr setattr link unlink rename }') ++define(`manage_lnk_file_perms',`{ create getattr setattr read write append rename link unlink ioctl lock }') + define(`relabelfrom_lnk_file_perms',`{ getattr relabelfrom }') + define(`relabelto_lnk_file_perms',`{ getattr relabelto }') + define(`relabel_lnk_file_perms',`{ getattr relabelfrom relabelto }') @@ -238,7 +240,8 @@ define(`read_fifo_file_perms',`{ getattr open read lock ioctl }') define(`append_fifo_file_perms',`{ getattr open append lock ioctl }')