diff --git a/modules-mls.conf b/modules-mls.conf index 6caaf61..178ae40 100644 --- a/modules-mls.conf +++ b/modules-mls.conf @@ -754,6 +754,14 @@ radvd = base # apm = base +# Layer: system +# Module: application +# Required in base +# +# Defines attributs and interfaces for all user applications +# +application = base + # Layer: services # Module: tcpd # diff --git a/modules-strict.conf b/modules-strict.conf index ece907d..071f6fb 100644 --- a/modules-strict.conf +++ b/modules-strict.conf @@ -1242,6 +1242,15 @@ radvd = module # apm = module + +# Layer: system +# Module: application +# Required in base +# +# Defines attributs and interfaces for all user applications +# +application = base + # Layer: services # Module: tcpd # diff --git a/modules-targeted.conf b/modules-targeted.conf index 801df84..ad634d3 100644 --- a/modules-targeted.conf +++ b/modules-targeted.conf @@ -32,6 +32,13 @@ alsa = base # ada = base +# Layer: modules +# Module: awstats +# +# awstats executable +# +awstats = module + # Layer: admin # Module: amanda # diff --git a/policy-20071023.patch b/policy-20071023.patch index db76962..3cac7b8 100644 --- a/policy-20071023.patch +++ b/policy-20071023.patch @@ -1,18 +1,6 @@ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/Changelog serefpolicy-3.1.0/Changelog ---- nsaserefpolicy/Changelog 2007-10-24 15:00:24.000000000 -0400 -+++ serefpolicy-3.1.0/Changelog 2007-10-24 15:06:50.000000000 -0400 -@@ -8,8 +8,6 @@ - strict policy if the unconfined module is not present. If it is, it will - behave like the targeted policy. Added an unconfined role to have a mix - of confined and unconfined users. --- Added modules: -- exim (Dan Walsh) - - * Fri Sep 28 2007 Chris PeBenito - 20070928 - - Add support for setting the unknown permissions handling. diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_contexts serefpolicy-3.1.0/config/appconfig-mcs/default_contexts --- nsaserefpolicy/config/appconfig-mcs/default_contexts 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/config/appconfig-mcs/default_contexts 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/config/appconfig-mcs/default_contexts 2007-11-06 09:28:35.000000000 -0500 @@ -1,15 +1,9 @@ -system_r:crond_t:s0 user_r:user_crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 unconfined_r:unconfined_crond_t:s0 -system_r:local_login_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0 @@ -40,7 +28,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default +system_r:xdm_t:s0 system_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_type serefpolicy-3.1.0/config/appconfig-mcs/default_type --- nsaserefpolicy/config/appconfig-mcs/default_type 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/config/appconfig-mcs/default_type 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/config/appconfig-mcs/default_type 2007-11-06 09:28:35.000000000 -0500 @@ -1,4 +1,4 @@ +system_r:unconfined_t sysadm_r:sysadm_t @@ -49,13 +37,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default user_r:user_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/failsafe_context serefpolicy-3.1.0/config/appconfig-mcs/failsafe_context --- nsaserefpolicy/config/appconfig-mcs/failsafe_context 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/config/appconfig-mcs/failsafe_context 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/config/appconfig-mcs/failsafe_context 2007-11-06 09:28:35.000000000 -0500 @@ -1 +1 @@ -sysadm_r:sysadm_t:s0 +system_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/guest_u_default_contexts serefpolicy-3.1.0/config/appconfig-mcs/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/config/appconfig-mcs/guest_u_default_contexts 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/config/appconfig-mcs/guest_u_default_contexts 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,4 @@ +system_r:local_login_t:s0 guest_r:guest_t:s0 +system_r:remote_login_t:s0 guest_r:guest_t:s0 @@ -63,7 +51,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/guest_u +system_r:crond_t:s0 guest_r:guest_crond_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_default_contexts serefpolicy-3.1.0/config/appconfig-mcs/root_default_contexts --- nsaserefpolicy/config/appconfig-mcs/root_default_contexts 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/config/appconfig-mcs/root_default_contexts 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/config/appconfig-mcs/root_default_contexts 2007-11-06 09:28:35.000000000 -0500 @@ -1,11 +1,10 @@ -system_r:crond_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0 -system_r:local_login_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 @@ -85,35 +73,45 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_de + diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/seusers serefpolicy-3.1.0/config/appconfig-mcs/seusers --- nsaserefpolicy/config/appconfig-mcs/seusers 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/config/appconfig-mcs/seusers 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/config/appconfig-mcs/seusers 2007-11-06 09:28:35.000000000 -0500 @@ -1,3 +1,2 @@ -system_u:system_u:s0-mcs_systemhigh root:root:s0-mcs_systemhigh -__default__:user_u:s0 +__default__:system_u:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts serefpolicy-3.1.0/config/appconfig-mcs/staff_u_default_contexts ---- nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/config/appconfig-mcs/staff_u_default_contexts 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,9 @@ -+system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 -+system_r:remote_login_t:s0 staff_r:staff_t:s0 -+system_r:sshd_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +--- nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts 2007-11-05 10:28:59.000000000 -0500 ++++ serefpolicy-3.1.0/config/appconfig-mcs/staff_u_default_contexts 2007-11-06 09:28:35.000000000 -0500 +@@ -1,10 +1,9 @@ + system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 + system_r:remote_login_t:s0 staff_r:staff_t:s0 + system_r:sshd_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +-system_r:crond_t:s0 staff_r:staff_crond_t:s0 +system_r:crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 mailman_r:user_crond_t:s0 -+system_r:xdm_t:s0 staff_r:staff_t:s0 -+staff_r:staff_su_t:s0 staff_r:staff_t:s0 -+staff_r:staff_sudo_t:s0 staff_r:staff_t:s0 -+sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 -+sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 + system_r:xdm_t:s0 staff_r:staff_t:s0 + staff_r:staff_su_t:s0 staff_r:staff_t:s0 + staff_r:staff_sudo_t:s0 staff_r:staff_t:s0 + sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 + sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 +- diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/userhelper_context serefpolicy-3.1.0/config/appconfig-mcs/userhelper_context --- nsaserefpolicy/config/appconfig-mcs/userhelper_context 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/config/appconfig-mcs/userhelper_context 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/config/appconfig-mcs/userhelper_context 2007-11-06 09:28:35.000000000 -0500 @@ -1 +1 @@ -system_u:sysadm_r:sysadm_t:s0 +system_u:system_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts serefpolicy-3.1.0/config/appconfig-mcs/user_u_default_contexts ---- nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/config/appconfig-mcs/user_u_default_contexts 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,7 @@ +--- nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts 2007-11-05 10:28:59.000000000 -0500 ++++ serefpolicy-3.1.0/config/appconfig-mcs/user_u_default_contexts 2007-11-06 09:28:35.000000000 -0500 +@@ -1,8 +1,7 @@ +-system_r:local_login_t:s0 user_r:user_t:s0 +-system_r:remote_login_t:s0 user_r:user_t:s0 +-system_r:sshd_t:s0 user_r:user_t:s0 +-system_r:crond_t:s0 user_r:user_crond_t:s0 +-system_r:xdm_t:s0 user_r:user_t:s0 +-user_r:user_su_t:s0 user_r:user_t:s0 +-user_r:user_sudo_t:s0 user_r:user_t:s0 +- +system_r:local_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +system_r:remote_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +system_r:sshd_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 @@ -123,7 +121,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/user_u_ +user_r:user_sudo_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts serefpolicy-3.1.0/config/appconfig-mcs/xguest_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/config/appconfig-mcs/xguest_u_default_contexts 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/config/appconfig-mcs/xguest_u_default_contexts 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,5 @@ +system_r:local_login_t xguest_r:xguest_t:s0 +system_r:remote_login_t xguest_r:xguest_t:s0 @@ -132,7 +130,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_ +system_r:xdm_t xguest_r:xguest_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default_contexts serefpolicy-3.1.0/config/appconfig-mls/default_contexts --- nsaserefpolicy/config/appconfig-mls/default_contexts 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/config/appconfig-mls/default_contexts 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/config/appconfig-mls/default_contexts 2007-11-06 09:28:35.000000000 -0500 @@ -1,15 +1,12 @@ -system_r:crond_t:s0 user_r:user_crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 unconfined_r:unconfined_crond_t:s0 -system_r:local_login_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0 @@ -162,7 +160,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default +user_r:user_sudo_t:s0 sysadm_r:sysadm_t:s0 user_r:user_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/guest_u_default_contexts serefpolicy-3.1.0/config/appconfig-mls/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-mls/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/config/appconfig-mls/guest_u_default_contexts 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/config/appconfig-mls/guest_u_default_contexts 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,4 @@ +system_r:local_login_t:s0 guest_r:guest_t:s0 +system_r:remote_login_t:s0 guest_r:guest_t:s0 @@ -170,7 +168,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/guest_u +system_r:crond_t:s0 guest_r:guest_crond_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/root_default_contexts serefpolicy-3.1.0/config/appconfig-mls/root_default_contexts --- nsaserefpolicy/config/appconfig-mls/root_default_contexts 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/config/appconfig-mls/root_default_contexts 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/config/appconfig-mls/root_default_contexts 2007-11-06 09:28:35.000000000 -0500 @@ -1,11 +1,9 @@ -system_r:crond_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0 -system_r:local_login_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 @@ -190,41 +188,50 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/root_de -#system_r:sshd_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +#system_r:sshd_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/staff_u_default_contexts serefpolicy-3.1.0/config/appconfig-mls/staff_u_default_contexts ---- nsaserefpolicy/config/appconfig-mls/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/config/appconfig-mls/staff_u_default_contexts 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,9 @@ -+system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 -+system_r:remote_login_t:s0 staff_r:staff_t:s0 -+system_r:sshd_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +--- nsaserefpolicy/config/appconfig-mls/staff_u_default_contexts 2007-11-05 10:28:58.000000000 -0500 ++++ serefpolicy-3.1.0/config/appconfig-mls/staff_u_default_contexts 2007-11-06 09:28:35.000000000 -0500 +@@ -1,10 +1,9 @@ + system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 + system_r:remote_login_t:s0 staff_r:staff_t:s0 + system_r:sshd_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +-system_r:crond_t:s0 staff_r:staff_crond_t:s0 +system_r:crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 mailman_r:user_crond_t:s0 -+system_r:xdm_t:s0 staff_r:staff_t:s0 -+staff_r:staff_su_t:s0 staff_r:staff_t:s0 -+staff_r:staff_sudo_t:s0 staff_r:staff_t:s0 -+sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 -+sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 + system_r:xdm_t:s0 staff_r:staff_t:s0 + staff_r:staff_su_t:s0 staff_r:staff_t:s0 + staff_r:staff_sudo_t:s0 staff_r:staff_t:s0 + sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 + sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 +- diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/user_u_default_contexts serefpolicy-3.1.0/config/appconfig-mls/user_u_default_contexts ---- nsaserefpolicy/config/appconfig-mls/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/config/appconfig-mls/user_u_default_contexts 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,7 @@ -+system_r:local_login_t:s0 user_r:user_t:s0 -+system_r:remote_login_t:s0 user_r:user_t:s0 -+system_r:sshd_t:s0 user_r:user_t:s0 -+system_r:crond_t:s0 user_r:user_crond_t:s0 -+system_r:xdm_t:s0 user_r:user_t:s0 -+user_r:user_su_t:s0 user_r:user_t:s0 -+user_r:user_sudo_t:s0 user_r:user_t:s0 +--- nsaserefpolicy/config/appconfig-mls/user_u_default_contexts 2007-11-05 10:28:58.000000000 -0500 ++++ serefpolicy-3.1.0/config/appconfig-mls/user_u_default_contexts 2007-11-06 09:28:35.000000000 -0500 +@@ -5,4 +5,3 @@ + system_r:xdm_t:s0 user_r:user_t:s0 + user_r:user_su_t:s0 user_r:user_t:s0 + user_r:user_sudo_t:s0 user_r:user_t:s0 +- diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/guest_u_default_contexts serefpolicy-3.1.0/config/appconfig-standard/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-standard/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/config/appconfig-standard/guest_u_default_contexts 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/config/appconfig-standard/guest_u_default_contexts 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,4 @@ +system_r:local_login_t guest_r:guest_t +system_r:remote_login_t guest_r:guest_t +system_r:sshd_t guest_r:guest_t +system_r:crond_t guest_r:guest_crond_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/staff_u_default_contexts serefpolicy-3.1.0/config/appconfig-standard/staff_u_default_contexts ---- nsaserefpolicy/config/appconfig-standard/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/config/appconfig-standard/staff_u_default_contexts 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,9 @@ +--- nsaserefpolicy/config/appconfig-standard/staff_u_default_contexts 2007-11-05 10:28:59.000000000 -0500 ++++ serefpolicy-3.1.0/config/appconfig-standard/staff_u_default_contexts 2007-11-06 09:28:35.000000000 -0500 +@@ -1,10 +1,9 @@ +-system_r:local_login_t staff_r:staff_t sysadm_r:sysadm_t +-system_r:remote_login_t staff_r:staff_t +-system_r:sshd_t staff_r:staff_t sysadm_r:sysadm_t +-system_r:crond_t staff_r:staff_crond_t +-system_r:xdm_t staff_r:staff_t +-staff_r:staff_su_t staff_r:staff_t +-staff_r:staff_sudo_t staff_r:staff_t +-sysadm_r:sysadm_su_t sysadm_r:sysadm_t +-sysadm_r:sysadm_sudo_t sysadm_r:sysadm_t +- +system_r:local_login_t staff_r:staff_t sysadm_r:sysadm_t +system_r:remote_login_t staff_r:staff_t +system_r:sshd_t staff_r:staff_t sysadm_r:sysadm_t @@ -235,9 +242,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/st +sysadm_r:sysadm_su_t sysadm_r:sysadm_t +sysadm_r:sysadm_sudo_t sysadm_r:sysadm_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/user_u_default_contexts serefpolicy-3.1.0/config/appconfig-standard/user_u_default_contexts ---- nsaserefpolicy/config/appconfig-standard/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/config/appconfig-standard/user_u_default_contexts 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,7 @@ +--- nsaserefpolicy/config/appconfig-standard/user_u_default_contexts 2007-11-05 10:28:59.000000000 -0500 ++++ serefpolicy-3.1.0/config/appconfig-standard/user_u_default_contexts 2007-11-06 09:28:35.000000000 -0500 +@@ -1,8 +1,7 @@ +-system_r:local_login_t user_r:user_t +-system_r:remote_login_t user_r:user_t +-system_r:sshd_t user_r:user_t +-system_r:crond_t user_r:user_crond_t +-system_r:xdm_t user_r:user_t +-user_r:user_su_t user_r:user_t +-user_r:user_sudo_t user_r:user_t +- +system_r:local_login_t system_r:unconfined_t user_r:user_t +system_r:remote_login_t system_r:unconfined_t user_r:user_t +system_r:sshd_t system_r:unconfined_t user_r:user_t @@ -247,465 +262,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/us +user_r:user_sudo_t system_r:unconfined_t user_r:user_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/xguest_u_default_contexts serefpolicy-3.1.0/config/appconfig-standard/xguest_u_default_contexts --- nsaserefpolicy/config/appconfig-standard/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/config/appconfig-standard/xguest_u_default_contexts 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/config/appconfig-standard/xguest_u_default_contexts 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,5 @@ +system_r:local_login_t xguest_r:xguest_t +system_r:remote_login_t xguest_r:xguest_t +system_r:sshd_t xguest_r:xguest_t +system_r:crond_t xguest_r:xguest_crond_t +system_r:xdm_t xguest_r:xguest_t -diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/ftpd_selinux.8 serefpolicy-3.1.0/man/ru/man8/ftpd_selinux.8 ---- nsaserefpolicy/man/ru/man8/ftpd_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/man/ru/man8/ftpd_selinux.8 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,57 @@ -+.TH "ftpd_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "ftpd Selinux Policy documentation" -+.SH "НАЗВАНИЕ" -+ftpd_selinux \- Политика Security Enhanced Linux для демона ftp -+.SH "ОПИСАНИЕ" -+ -+Security-Enhanced Linux обеспечивает защиту сервера ftpd при помощи гибко настраиваемого мандатного контроля доступа. -+.SH КОНТЕКСТ ФАЙЛОВ -+SELinux требует наличия у файлов расширенных атрибутов, определяющих тип файла. -+Политика управляет видом доступа демона к этим файлам. Если вы хотите организовать анонимный -+доступ к файлам, вы должны присвоить этим файлам и директориям контекст public_content_t. -+Таким образом, если вы создаете специальную директорию /var/ftp, то вам необходимо установить контекст для этой директории при помощи утилиты chcon. -+.TP -+chcon -R -t public_content_t /var/ftp -+.TP -+Если вы хотите задать директорию, в которую вы собираетесь загружать файлы, то вы должны -+установить контекст ftpd_anon_rw_t. Таким образом, если вы создаете специальную директорию /var/ftp/incoming, то вам необходимо установить контекст для этой директории при помощи утилиты chcon. -+.TP -+chcon -t public_content_rw_t /var/ftp/incoming -+.TP -+Вы также должны включить переключатель allow_ftpd_anon_write. -+.TP -+setsebool -P allow_ftpd_anon_write=1 -+.TP -+Если вы хотите сделать эти изменения постоянными, иными словами, чтобы данный контекст сохранялся -+при обновлении контекстов, вы должны добавить записи в файл file_contexts.local. -+.TP -+/etc/selinux/POLICYTYPE/contexts/files/file_contexts.local -+.br -+/var/ftp(/.*)? system_u:object_r:public_content_t -+/var/ftp/incoming(/.*)? system_u:object_r:public_content_rw_t -+ -+.SH ПЕРЕКЛЮЧАТЕЛИ (BOOLEANS) -+Политика SELinux для демона ftp настроена исходя из принципа наименьших привелегий. Таким -+образом, по умолчанию политика SELinux не позволяет пользователям заходить на сервер и -+читать содержимое их домашних директорий. -+.br -+Если вы настраиваете данную машину как ftpd-сервер и хотите, чтобы пользователи могли получать -+доступ к своим домашним директориям, то вам необходимо установить переключатель ftp_home_dir. -+.TP -+setsebool -P ftp_home_dir 1 -+.TP -+ftpd может функционировать как самостоятельный демон, а также как часть домена xinetd. Если вы -+хотите, чтобы ftpd работал как демон, вы должны установить переключатель ftpd_is_daemon. -+.TP -+setsebool -P ftpd_is_daemon 1 -+.br -+service vsftpd restart -+.TP -+Для управления настройками SELinux существует графическая утилита system-config-selinux. -+.SH АВТОРЫ -+Эту страницу руководства написал Dan Walsh . -+Перевод руководства - Андрей Маркелов , 2007г. -+ -+.SH "СМОТРИ ТАКЖЕ" -+selinux(8), ftpd(8), chcon(1), setsebool(8) -+ -+ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/httpd_selinux.8 serefpolicy-3.1.0/man/ru/man8/httpd_selinux.8 ---- nsaserefpolicy/man/ru/man8/httpd_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/man/ru/man8/httpd_selinux.8 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,137 @@ -+.TH "httpd_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "httpd Selinux Policy documentation" -+.de EX -+.nf -+.ft CW -+.. -+.de EE -+.ft R -+.fi -+.. -+.SH "НАЗВАНИЕ" -+httpd_selinux \- Политика Security Enhanced Linux для демона httpd -+.SH "ОПИСАНИЕ" -+ -+Security-Enhanced Linux обеспечивает защиту сервера httpd при помощи гибко настраиваемого мандатного контроля доступа. -+.SH КОНТЕКСТ ФАЙЛОВ -+SELinux требует наличия у файлов расширенных атрибутов, определяющих тип файла. -+Политика управляет видом доступа демона к этим файлам. -+Политика SELinux для демона httpd позволяет пользователям настроить web-службы максимально безопасным методом с высокой степенью гибкости. -+.PP -+Для httpd определены следующие контексты файлов: -+.EX -+httpd_sys_content_t -+.EE -+- Установите контекст httpd_sys_content_t для содержимого, которое должно быть доступно для всех скриптов httpd и для самого демона. -+.EX -+httpd_sys_script_exec_t -+.EE -+- Установите контекст httpd_sys_script_exec_t для cgi-скриптов, чтобы разрешить им доступ ко всем sys-типам. -+.EX -+httpd_sys_script_ro_t -+.EE -+- Установите на файлы контекст httpd_sys_script_ro_t если вы хотите, чтобы скрипты httpd_sys_script_exec_t могли читать данные, и при этом нужно запретить доступ другим не-sys скриптам. -+.EX -+httpd_sys_script_rw_t -+.EE -+- Установите на файлы контекст httpd_sys_script_rw_t если вы хотите, чтобы скрипты httpd_sys_script_exec_t могли читать и писать данные, и при этом нужно запретить доступ другим не-sys скриптам. -+.EX -+httpd_sys_script_ra_t -+.EE -+- Установите на файлы контекст httpd_sys_script_ra_t если вы хотите, чтобы скрипты httpd_sys_script_exec_t могли читать и добавлять данные, и при этом нужно запретить доступ другим не-sys скриптам. -+.EX -+httpd_unconfined_script_exec_t -+.EE -+- Установите на cgi-скрипты контекст httpd_unconfined_script_exec_t если вы хотите разрешить -+им исполняться без какой-либо защиты SELinux. Такой способ должен использоваться только для -+скриптов с очень комплексными требованиями, и только в случае, если все остальные варианты настройки не дали результата. Лучше использовать скрипты с контекстом httpd_unconfined_script_exec_t, чем выключать защиту SELinux для httpd. -+ -+.SH ЗАМЕЧАНИЕ -+Вместе с некоторыми политиками, вы можете определить дополнительные контексты файлов, основанные -+на ролях, таких как user или staff. Может быть определен контекст httpd_user_script_exec_t, который будет иметь доступ только к "пользовательским" контекстам. -+ -+.SH СОВМЕСТНОЕ ВЛАДЕНИЕ ФАЙЛАМИ -+Если вы хотите организовать между несколькими доменами (Apache, FTP, rsync, Samba) совместный -+доступ к файлам, то вы можете установить контекст файлов в public_content_t и public_content_rw_t. -+Данный контекст позволяет любому из выше перечисленных демонов читать содержимое. -+Если вы хотите, чтобы конкретный домен имел право записи в домен public_content_rw_t, вы должны -+установить соответствующий переключатель allow_ДОМЕН_anon_write. Таким образом, для httpd вы должны выполнить команду: -+ -+.EX -+setsebool -P allow_httpd_anon_write=1 -+.EE -+ -+или -+ -+.EX -+setsebool -P allow_httpd_sys_script_anon_write=1 -+.EE -+ -+.SH ПЕРЕКЛЮЧАТЕЛИ (BOOLEANS) -+Политика SELinux настроена исходя из принципа наименьших привилегий. Таким образом, -+по умолчанию SELinux препятствует работе некоторых http-скриптов. Политика httpd весьма -+гибка, и существующие переключатели управляют политикой, позволяя httpd выполняться -+с наименее возможными правами доступа. -+.PP -+Если вы хотите, чтобы httpd мог исполнять cgi-скрипты, установите переключатель httpd_enable_cgi -+.EX -+setsebool -P httpd_enable_cgi 1 -+.EE -+ -+.PP -+По умолчанию демону httpd не разрешен доступ в домашние дерикториии пользователей. Если вы хотите разрешить доступ, вам необходимо установить переключатель httpd_enable_homedirs и изменить контекст -+тех файлов в домашних директориях пользователей, к которым должен быть разрешен доступ. -+ -+.EX -+setsebool -P httpd_enable_homedirs 1 -+chcon -R -t httpd_sys_content_t ~user/public_html -+.EE -+ -+.PP -+По умолчанию демон httpd не имеет доступ к управляющему терминалу. В большинстве случаев такое -+поведение является предпочтительным. Это связанно с тем, что злоумышленник может попытаться -+использовать доступ к терминалу для получения привилегий. Однако, в некоторых ситуациях демон -+httpd должен выводить запрос пароля для открытия файла сертификата и в таких случаях нужен доступ -+к терминалу. Для того, чтобы разрешить доступ к терминалу, установите переключатель httpd_tty_comm. -+.EX -+setsebool -P httpd_tty_comm 1 -+.EE -+ -+.PP -+httpd может быть настроен так, чтобы не разграничивать тип доступа к файлу на основании контекста. -+Иными словами, ко всем файлам, имеющим контекст httpd разрешен доступ на чтение/запись/исполнение. -+Установка этого переключателя в false, позволяет настроить политику безопасности таким образом, -+что одина служба httpd не конфликтует с другой. -+.EX -+setsebool -P httpd_unified 0 -+.EE -+ -+.PP -+Имеется возможность настроить httpd таким образом, чтобы отключить встроенную поддержку -+скриптов (PHP). PHP и другие загружаемые модули работают в том же контексте, что и httpd. -+Таким образом, если используются только внешние cgi-скрипты, некоторые из правил политики -+разрешают httpd больший доступ к системе, чем необходимо. -+ -+.EX -+setsebool -P httpd_builtin_scripting 0 -+.EE -+ -+.PP -+По умолчанию httpd-скриптам запрещено устанавливать внешние сетевые подключения. -+Это не позволит хакеру, взломавшему ваш httpd-сервер, атаковать другие машины. -+Если вашим скриптам необходимо иметь возможность подключения, установите переключатель -+httpd_can_network_connect -+ -+.EX -+setsebool -P httpd_can_network_connect 1 -+.EE -+ -+.PP -+Для управления настройками SELinux существует графическая утилита system-config-selinux. -+.SH АВТОРЫ -+Эту страницу руководства написал Dan Walsh . -+Перевод руководства - Андрей Маркелов , 2007г. -+ -+.SH "СМОТРИ ТАКЖЕ" -+selinux(8), httpd(8), chcon(1), setsebool(8) -+ -+ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/kerberos_selinux.8 serefpolicy-3.1.0/man/ru/man8/kerberos_selinux.8 ---- nsaserefpolicy/man/ru/man8/kerberos_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/man/ru/man8/kerberos_selinux.8 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,30 @@ -+.TH "kerberos_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "kerberos Selinux Policy documentation" -+.de EX -+.nf -+.ft CW -+.. -+.de EE -+.ft R -+.fi -+.. -+.SH "НАЗВАНИЕ" -+kerberos_selinux \- Политика Security Enhanced Linux для Kerberos. -+.SH "ОПИСАНИЕ" -+ -+Security-Enhanced Linux защищает систему при помощи гибко настраиваемого мандатного контроля доступа. По умолчанию Kerberos запрещен, поскольку требуется функционирование демонов, -+которым предоставляется слишком обширный доступ к сети и некоторым чувствительным в плане безопасности файлам. -+ -+.SH ПЕРЕКЛЮЧАТЕЛИ (BOOLEANS) -+.PP -+Для того, чтобы система могла корректно работать в окружении Kerberos, вы должны установить переключатель allow_kerberos. -+.EX -+setsebool -P allow_kerberos 1 -+.EE -+.PP -+Для управления настройками SELinux существует графическая утилита system-config-selinux. -+.SH АВТОРЫ -+Эту страницу руководства написал Dan Walsh . -+Перевод руководства - Андрей Маркелов , 2007г. -+ -+.SH "СМОТРИ ТАКЖЕ" -+selinux(8), kerberos(1), chcon(1), setsebool(8) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/named_selinux.8 serefpolicy-3.1.0/man/ru/man8/named_selinux.8 ---- nsaserefpolicy/man/ru/man8/named_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/man/ru/man8/named_selinux.8 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,31 @@ -+.TH "named_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "named Selinux Policy documentation" -+.de EX -+.nf -+.ft CW -+.. -+.de EE -+.ft R -+.fi -+.. -+.SH "НАЗВАНИЕ" -+named_selinux \- Политика Security Enhanced Linux для демона Internet Name server (named) -+.SH "ОПИСАНИЕ" -+ -+Security-Enhanced Linux обеспечивает защиту сервера named при помощи гибко настраиваемого мандатного контроля доступа. -+.SH ПЕРЕКЛЮЧАТЕЛИ (BOOLEANS) -+Политика SELinux настраивается исходя из принципа наименьших привилегий. Таким образом, -+по умолчанию политика SELinux не позволяет демону named осуществлять изменения файлов мастер-зоны. -+Если вам необходимо, чтобы named мог обновлять файлы мастер-зоны, вы должны установить переключатель named_write_master_zones boolean. -+.EX -+setsebool -P named_write_master_zones 1 -+.EE -+.PP -+Для управления настройками SELinux существует графическая утилита system-config-selinux. -+.SH АВТОРЫ -+Эту страницу руководства написал Dan Walsh . -+Перевод руководства - Андрей Маркелов , 2007г. -+ -+.SH "СМОТРИ ТАКЖЕ" -+selinux(8), named(8), chcon(1), setsebool(8) -+ -+ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/nfs_selinux.8 serefpolicy-3.1.0/man/ru/man8/nfs_selinux.8 ---- nsaserefpolicy/man/ru/man8/nfs_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/man/ru/man8/nfs_selinux.8 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,33 @@ -+.TH "nfs_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "nfs Selinux Policy documentation" -+.SH "НАЗВАНИЕ" -+nfs_selinux \- Политика Security Enhanced Linux для NFS -+.SH "ОПИСАНИЕ" -+ -+Security-Enhanced Linux защищает сервер nfs при помощи гибко настраиваемого мандатного контроля доступа. -+.SH ПЕРЕКЛЮЧАТЕЛИ (BOOLEANS) -+Политика SELinux настраивается исходя из принципа наименьших привилегий. Таким образом, -+по умолчанию политика SELinux не позволяет предоставлять доступ к файлам по nfs. Если вы хотите -+разрешить доступ только на чтение к файлам этой машины по nfs, вы должны установить переключатель -+nfs_export_all_ro. -+ -+.TP -+setsebool -P nfs_export_all_ro 1 -+.TP -+Если вы хотите разрешить доступ на чтение/запись, вы должны установить переключатель nfs_export_all_rw. -+.TP -+setsebool -P nfs_export_all_rw 1 -+ -+.TP -+Если вы хотите использовать удаленный NFS сервер для хранения домашних директорий этой машины, -+то вы должны установить переключатель use_nfs_home_dir boolean. -+.TP -+setsebool -P use_nfs_home_dirs 1 -+.TP -+Для управления настройками SELinux существует графическая утилита -+system-config-selinux. -+.SH АВТОРЫ -+Эту страницу руководства написал Dan Walsh . -+Перевод руководства - Андрей Маркелов , 2007г. -+ -+.SH "СМОТРИ ТАКЖЕ" -+selinux(8), chcon(1), setsebool(8) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/rsync_selinux.8 serefpolicy-3.1.0/man/ru/man8/rsync_selinux.8 ---- nsaserefpolicy/man/ru/man8/rsync_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/man/ru/man8/rsync_selinux.8 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,50 @@ -+.TH "rsync_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "rsync Selinux Policy documentation" -+.de EX -+.nf -+.ft CW -+.. -+.de EE -+.ft R -+.fi -+.. -+.SH "НАЗВАНИЕ" -+rsync_selinux \- Политика Security Enhanced Linux для демона rsync -+.SH "ОПИСАНИЕ" -+ -+Security-Enhanced Linux обеспечивает защиту сервера rsync при помощи гибко настраиваемого мандатного контроля доступа. -+.SH КОНТЕКСТ ФАЙЛОВ -+SELinux требует наличия у файлов расширенных атрибутов, определяющих тип файла. -+Политика управляет видом доступа демона к этим файлам. Если вы хотите предоставить доступ к файлам -+при помощи демона rsync, вы должны присвоить этим файлам и директориям контекст -+public_content_t. Таким образом, если вы создаете специальную директорию /var/rsync, то вам -+необходимо установить контекст для этой директории при помощи утилиты chcon. -+.TP -+chcon -t public_content_t /var/rsync -+.TP -+Если вы хотите сделать эти изменения постоянными, иными словами, чтобы данный контекст сохранялся -+при обновлении контекстов, вы должны добавить записи в файл file_contexts.local. -+.EX -+/etc/selinux/POLICYTYPE/contexts/files/file_contexts.local -+/var/rsync(/.*)? system_u:object_r:public_content_t -+.EE -+ -+.SH СОВМЕСТНОЕ ВЛАДЕНИЕ ФАЙЛАМИ -+Если вы хотите организовать между несколькими доменами (Apache, FTP, rsync, Samba) совместный -+доступ к файлам, то вы можете установить контекст файлов в public_content_t и public_content_rw_t. -+Данный контекст позволяет любому из выше перечисленных демонов читать содержимое. -+Если вы хотите, чтобы конкретный домен имел право записи в домен public_content_rw_t, вы должны -+установить соответствующий переключатель allow_ДОМЕН_anon_write. Таким образом, для rsync вы должны выполнить команду: -+ -+.EX -+setsebool -P allow_rsync_anon_write=1 -+.EE -+ -+.SH ПЕРЕКЛЮЧАТЕЛИ (BOOLEANS) -+.TP -+Для управления настройками SELinux существует графическая утилита system-config-selinux. -+.SH АВТОРЫ -+Эту страницу руководства написал Dan Walsh . -+Перевод руководства - Андрей Маркелов , 2007г. -+ -+.SH "СМОТРИ ТАКЖЕ" -+selinux(8), rsync(1), chcon(1), setsebool(8) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/samba_selinux.8 serefpolicy-3.1.0/man/ru/man8/samba_selinux.8 ---- nsaserefpolicy/man/ru/man8/samba_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/man/ru/man8/samba_selinux.8 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,60 @@ -+.TH "samba_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "Samba Selinux Policy documentation" -+.SH "НАЗВАНИЕ" -+samba_selinux \- Политика Security Enhanced Linux для Samba -+.SH "ОПИСАНИЕ" -+ -+Security-Enhanced Linux обеспечивает защиту сервера Samba при помощи гибко настраиваемого мандатного контроля доступа. -+.SH КОНТЕКСТ ФАЙЛОВ -+SELinux требует наличия у файлов расширенных атрибутов, определяющих тип файла. -+Политика управляет видом доступа демона к этим файлам. -+Если вы хотите предоставить доступ к файлам вовне домашних директорий, этим файлам необходимо -+присвоить контекст samba_share_t. -+Таким образом, если вы создаете специальную директорию /var/eng, то вам необходимо -+установить контекст для этой директории при помощи утилиты chcon. -+.TP -+chcon -t samba_share_t /var/eng -+.TP -+ -+Если вы хотите сделать эти изменения постоянными, иными словами, чтобы данный контекст сохранялся -+при обновлении контекстов, вы должны добавить записи в файл file_contexts.local. -+.TP -+/etc/selinux/POLICYTYPE/contexts/files/file_contexts.local -+.br -+/var/eng(/.*)? system_u:object_r:samba_share_t -+ -+.SH СОВМЕСТНОЕ ВЛАДЕНИЕ ФАЙЛАМИ -+Если вы хотите организовать между несколькими доменами (Apache, FTP, rsync, Samba) совместный -+доступ к файлам, то вы можете установить контекст файлов в public_content_t и public_content_rw_t. -+Данный контекст позволяет любому из выше перечисленных демонов читать содержимое. -+Если вы хотите, чтобы конкретный домен имел право записи в домен public_content_rw_t, вы должны -+установить соответствующий переключатель allow_ДОМЕН_anon_write. Таким образом, для samba вы должны выполнить команду: -+ -+setsebool -P allow_smbd_anon_write=1 -+ -+.SH ПЕРЕКЛЮЧАТЕЛИ (BOOLEANS) -+.br -+Политика SELinux настраивается исходя из принципа наименьших привилегий. -+Таким образом, по умолчанию политика SELinux не позволяет предоставлять удаленный доступ -+к домашним директориям и не позволяет использовать удаленный сервер Samba для хранения -+домашних директорий. -+.TP -+Если вы настроили эту машину как сервер Samba и желаете предоставить доступ к домашним -+директориям, вы должны установить переключатель samba_enable_home_dirs. -+.br -+ -+setsebool -P samba_enable_home_dirs 1 -+.TP -+Если вы хотите для хранения домашних директорий пользователей этой машины использовать удаленный -+сервер Samba, вы должны установить переключатель use_samba_home_dirs. -+.br -+ -+setsebool -P use_samba_home_dirs 1 -+.TP -+Для управления настройками SELinux существует графическая утилита system-config-selinux. -+ -+.SH АВТОРЫ -+Эту страницу руководства написал Dan Walsh . -+Перевод руководства - Андрей Маркелов , 2007г. -+ -+.SH "СМОТРИ ТАКЖЕ" -+selinux(8), samba(7), chcon(1), setsebool(8) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/ypbind_selinux.8 serefpolicy-3.1.0/man/ru/man8/ypbind_selinux.8 ---- nsaserefpolicy/man/ru/man8/ypbind_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/man/ru/man8/ypbind_selinux.8 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,19 @@ -+.TH "ypbind_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "ypbind Selinux Policy documentation" -+.SH "НАЗВАНИЕ" -+ypbind_selinux \- Политика Security Enhanced Linux для NIS. -+.SH "ОПИСАНИЕ" -+ -+Security-Enhanced Linux защищает систему при помощи гибко настраиваемого мандатного контроля доступа. По умолчанию работа NIS запрещена. Это является следствием того, что демоны NIS требуют слишком обширного доступа к сети. -+.SH ПЕРЕКЛЮЧАТЕЛИ (BOOLEANS) -+.TP -+Для того, чтобы система могла работать в окружении NIS, вы должны установить переключатель allow_ypbind. -+.TP -+setsebool -P allow_ypbind 1 -+.TP -+Для управления настройками SELinux существует графическая утилита system-config-selinux. -+.SH АВТОРЫ -+Эту страницу руководства написал Dan Walsh . -+Перевод руководства - Андрей Маркелов , 2007г. -+ -+.SH "СМОТРИ ТАКЖЕ" -+selinux(8), ypbind(8), chcon(1), setsebool(8) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.1.0/policy/flask/access_vectors --- nsaserefpolicy/policy/flask/access_vectors 2007-08-11 06:22:29.000000000 -0400 -+++ serefpolicy-3.1.0/policy/flask/access_vectors 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/flask/access_vectors 2007-11-06 09:28:35.000000000 -0500 @@ -639,6 +639,8 @@ send recv @@ -717,28 +283,75 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors class key diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.1.0/policy/global_tunables --- nsaserefpolicy/policy/global_tunables 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/policy/global_tunables 2007-10-24 15:06:50.000000000 -0400 -@@ -132,3 +132,12 @@ ++++ serefpolicy-3.1.0/policy/global_tunables 2007-11-06 09:28:35.000000000 -0500 +@@ -6,38 +6,35 @@ + + ## + ##

+-## Allow making the heap executable. ++## Allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla + ##

+ ## + gen_tunable(allow_execheap,false) + + ## + ##

+-## Allow making anonymous memory executable, e.g. +-## for runtime-code generation or executable stack. ++## Allow unconfined executables to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla") + ##

+ ## + gen_tunable(allow_execmem,false) + + ## + ##

+-## Allow making a modified private file +-## mapping executable (text relocation). ++## Allow all unconfined executables to use libraries requiring text relocation that are not labeled textrel_shlib_t") + ##

+ ## + gen_tunable(allow_execmod,false) + + ## + ##

+-## Allow making the stack executable via mprotect. +-## Also requires allow_execmem. ++## Allow unconfined executables to make their stack executable. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla") + ##

+ ## + gen_tunable(allow_execstack,false) + + ## + ##

+-## Enable polyinstantiated directory support. ++## Allow login programs to use polyinstantiated directories. + ##

+ ## + gen_tunable(allow_polyinstantiation,false) +@@ -132,3 +129,12 @@ ##

## gen_tunable(write_untrusted_content,false) + +## +##

-+## Allow users to connect to console (s390) ++## Allow direct login to the console device. Required for System 390 +##

+## +gen_tunable(allow_console_login,false) + + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.1.0/policy/modules/admin/alsa.fc ---- nsaserefpolicy/policy/modules/admin/alsa.fc 2006-11-16 17:15:26.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/admin/alsa.fc 2007-10-24 15:06:50.000000000 -0400 -@@ -1,4 +1,11 @@ +--- nsaserefpolicy/policy/modules/admin/alsa.fc 2007-10-29 18:02:32.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/alsa.fc 2007-11-06 09:28:35.000000000 -0500 +@@ -1,8 +1,11 @@ +/etc/alsa/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0) /etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0) -+/etc/asound(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0) + /etc/asound(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0) +-/etc/asound\.state gen_context(system_u:object_r:alsa_etc_rw_t,s0) +- +-/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0) +/etc/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0) /usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0) @@ -748,7 +361,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc +/bin/alsaunmute -- gen_context(system_u:object_r:alsa_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.if serefpolicy-3.1.0/policy/modules/admin/alsa.if --- nsaserefpolicy/policy/modules/admin/alsa.if 2007-01-02 12:57:51.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/admin/alsa.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/alsa.if 2007-11-06 09:28:35.000000000 -0500 @@ -74,3 +74,39 @@ read_files_pattern($1,alsa_etc_rw_t,alsa_etc_rw_t) read_lnk_files_pattern($1,alsa_etc_rw_t,alsa_etc_rw_t) @@ -790,9 +403,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.if + read_files_pattern($1,alsa_var_lib_t,alsa_var_lib_t) +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.1.0/policy/modules/admin/alsa.te ---- nsaserefpolicy/policy/modules/admin/alsa.te 2007-10-02 09:54:52.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/alsa.te 2007-10-24 15:06:50.000000000 -0400 -@@ -8,31 +8,47 @@ +--- nsaserefpolicy/policy/modules/admin/alsa.te 2007-10-29 18:02:32.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/alsa.te 2007-11-06 09:28:35.000000000 -0500 +@@ -8,12 +8,15 @@ type alsa_t; type alsa_exec_t; @@ -809,59 +422,36 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te ######################################## # # Local policy - # - --allow alsa_t self:capability { setgid setuid ipc_owner }; -+allow alsa_t self:capability { dac_read_search dac_override setgid setuid ipc_owner }; - dontaudit alsa_t self:capability sys_admin; - allow alsa_t self:sem create_sem_perms; - allow alsa_t self:shm create_shm_perms; - allow alsa_t self:unix_stream_socket create_stream_socket_perms; - allow alsa_t self:unix_dgram_socket create_socket_perms; - -+dev_read_sound(alsa_t) -+dev_write_sound(alsa_t) -+ -+files_etc_filetrans(alsa_t, alsa_etc_rw_t, file) - manage_files_pattern(alsa_t,alsa_etc_rw_t,alsa_etc_rw_t) +@@ -30,11 +33,18 @@ manage_lnk_files_pattern(alsa_t,alsa_etc_rw_t,alsa_etc_rw_t) + files_etc_filetrans(alsa_t, alsa_etc_rw_t, file) +files_search_var_lib(alsa_t) +manage_dirs_pattern(alsa_t,alsa_var_lib_t,alsa_var_lib_t) +manage_files_pattern(alsa_t,alsa_var_lib_t,alsa_var_lib_t) + + kernel_read_system_state(alsa_t) + + dev_read_sound(alsa_t) + dev_write_sound(alsa_t) + +corecmd_exec_bin(alsa_t) +can_exec(alsa_t, alsa_exec_t) + -+files_search_home(alsa_t) + files_search_home(alsa_t) files_read_etc_files(alsa_t) --term_use_generic_ptys(alsa_t) --term_dontaudit_use_unallocated_ttys(alsa_t) -+init_dontaudit_use_fds(alsa_t) -+ -+kernel_read_system_state(alsa_t) - - libs_use_ld_so(alsa_t) - libs_use_shared_libs(alsa_t) -@@ -43,7 +59,14 @@ - +@@ -48,6 +58,7 @@ userdom_manage_unpriv_user_semaphores(alsa_t) userdom_manage_unpriv_user_shared_mem(alsa_t) -+userdom_search_generic_user_home_dirs(alsa_t) + userdom_search_generic_user_home_dirs(alsa_t) +userdom_dontaudit_search_sysadm_home_dirs(alsa_t) optional_policy(` nscd_socket_use(alsa_t) - ') -+ -+optional_policy(` -+ hal_use_fds(alsa_t) -+ hal_write_log(alsa_t) -+') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.1.0/policy/modules/admin/anaconda.te --- nsaserefpolicy/policy/modules/admin/anaconda.te 2007-01-02 12:57:51.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/admin/anaconda.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/anaconda.te 2007-11-06 09:28:35.000000000 -0500 @@ -31,16 +31,13 @@ modutils_domtrans_insmod(anaconda_t) @@ -882,7 +472,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anacond diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/brctl.if serefpolicy-3.1.0/policy/modules/admin/brctl.if --- nsaserefpolicy/policy/modules/admin/brctl.if 2007-09-05 15:24:45.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/brctl.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/brctl.if 2007-11-06 09:28:35.000000000 -0500 @@ -17,3 +17,21 @@ domtrans_pattern($1,brctl_exec_t,brctl_t) @@ -907,7 +497,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/brctl.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.1.0/policy/modules/admin/consoletype.te --- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/consoletype.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/consoletype.te 2007-11-06 09:28:35.000000000 -0500 @@ -8,9 +8,11 @@ type consoletype_t; @@ -923,7 +513,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console role system_r types consoletype_t; ######################################## -@@ -48,7 +50,7 @@ +@@ -43,12 +45,12 @@ + mls_file_write_all_levels(consoletype_t) + + term_use_console(consoletype_t) +-term_use_unallocated_ttys(consoletype_t) ++term_use_all_terms(consoletype_t) + init_use_fds(consoletype_t) init_use_script_ptys(consoletype_t) init_use_script_fds(consoletype_t) @@ -954,7 +550,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstboot.te serefpolicy-3.1.0/policy/modules/admin/firstboot.te --- nsaserefpolicy/policy/modules/admin/firstboot.te 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/firstboot.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/firstboot.te 2007-11-06 09:28:35.000000000 -0500 @@ -120,6 +120,10 @@ usermanage_domtrans_admin_passwd(firstboot_t) ') @@ -976,7 +572,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstbo ') dnl end TODO diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.fc serefpolicy-3.1.0/policy/modules/admin/kismet.fc --- nsaserefpolicy/policy/modules/admin/kismet.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/admin/kismet.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/kismet.fc 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,5 @@ + +/usr/bin/kismet -- gen_context(system_u:object_r:kismet_exec_t,s0) @@ -985,8 +581,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. +/var/log/kismet(/.*)? gen_context(system_u:object_r:kismet_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.if serefpolicy-3.1.0/policy/modules/admin/kismet.if --- nsaserefpolicy/policy/modules/admin/kismet.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/admin/kismet.if 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,274 @@ ++++ serefpolicy-3.1.0/policy/modules/admin/kismet.if 2007-11-06 09:28:35.000000000 -0500 +@@ -0,0 +1,275 @@ + +## policy for kismet + @@ -1026,7 +622,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. + ') + + files_search_pids($1) -+ allow $1 kismet_var_run_t:file r_file_perms; ++ allow $1 kismet_var_run_t:file read_file_perms; +') + +######################################## @@ -1084,7 +680,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. + type kismet_var_lib_t; + ') + -+ allow $1 kismet_var_lib_t:file r_file_perms; ++ allow $1 kismet_var_lib_t:file read_file_perms; + allow $1 kismet_var_lib_t:dir list_dir_perms; + files_search_var_lib($1) +') @@ -1186,6 +782,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. + type kismet_log_t; + ') + ++ logging_search_logs($1) + manage_dirs_pattern($1,kismet_log_t,kismet_log_t) + manage_files_pattern($1,kismet_log_t,kismet_log_t) + manage_lnk_files_pattern($1,kismet_log_t,kismet_log_t) @@ -1263,7 +860,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.te serefpolicy-3.1.0/policy/modules/admin/kismet.te --- nsaserefpolicy/policy/modules/admin/kismet.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/admin/kismet.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/kismet.te 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,58 @@ +policy_module(kismet,1.0.0) + @@ -1325,7 +922,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.1.0/policy/modules/admin/kudzu.te --- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/kudzu.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/kudzu.te 2007-11-06 09:28:35.000000000 -0500 @@ -21,8 +21,8 @@ # Local policy # @@ -1396,7 +993,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.1.0/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/logrotate.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/logrotate.te 2007-11-06 09:28:35.000000000 -0500 @@ -96,6 +96,7 @@ files_read_etc_files(logrotate_t) files_read_etc_runtime_files(logrotate_t) @@ -1407,7 +1004,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota files_manage_generic_spool_dirs(logrotate_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.1.0/policy/modules/admin/logwatch.te --- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-10-23 07:37:52.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/logwatch.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/logwatch.te 2007-11-06 09:28:35.000000000 -0500 @@ -132,4 +132,5 @@ optional_policy(` @@ -1416,7 +1013,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.1.0/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/netutils.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/netutils.te 2007-11-06 09:28:35.000000000 -0500 @@ -94,6 +94,18 @@ ') @@ -1436,7 +1033,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil xen_append_log(netutils_t) ') -@@ -113,6 +125,7 @@ +@@ -107,12 +119,14 @@ + allow ping_t self:tcp_socket create_socket_perms; + allow ping_t self:rawip_socket { create ioctl read write bind getopt setopt }; + allow ping_t self:packet_socket { create ioctl read write bind getopt setopt }; ++allow ping_t self:netlink_route_socket create_netlink_socket_perms; + + corenet_all_recvfrom_unlabeled(ping_t) + corenet_all_recvfrom_netlabel(ping_t) corenet_tcp_sendrecv_all_if(ping_t) corenet_raw_sendrecv_all_if(ping_t) corenet_raw_sendrecv_all_nodes(ping_t) @@ -1446,7 +1050,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.1.0/policy/modules/admin/prelink.te --- nsaserefpolicy/policy/modules/admin/prelink.te 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/prelink.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/prelink.te 2007-11-06 09:28:35.000000000 -0500 @@ -26,7 +26,7 @@ # Local policy # @@ -1498,7 +1102,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.1.0/policy/modules/admin/rpm.fc --- nsaserefpolicy/policy/modules/admin/rpm.fc 2006-11-16 17:15:26.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/admin/rpm.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/rpm.fc 2007-11-06 09:28:35.000000000 -0500 @@ -21,6 +21,9 @@ /usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -1511,7 +1115,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.1.0/policy/modules/admin/rpm.if --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/rpm.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/rpm.if 2007-11-06 09:28:35.000000000 -0500 @@ -152,6 +152,24 @@ ######################################## @@ -1707,7 +1311,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.1.0/policy/modules/admin/rpm.te --- nsaserefpolicy/policy/modules/admin/rpm.te 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/rpm.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/rpm.te 2007-11-06 09:28:35.000000000 -0500 @@ -139,6 +139,7 @@ auth_relabel_all_files_except_shadow(rpm_t) auth_manage_all_files_except_shadow(rpm_t) @@ -1768,7 +1372,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.1.0/policy/modules/admin/sudo.if --- nsaserefpolicy/policy/modules/admin/sudo.if 2007-07-23 10:20:14.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/sudo.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/sudo.if 2007-11-06 09:28:35.000000000 -0500 @@ -55,7 +55,7 @@ # @@ -1786,7 +1390,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if allow $1_sudo_t self:netlink_route_socket r_netlink_socket_perms; # Enter this derived domain from the user domain -@@ -76,6 +75,7 @@ +@@ -76,20 +75,21 @@ # By default, revert to the calling domain when a shell is executed. corecmd_shell_domtrans($1_sudo_t,$2) @@ -1794,7 +1398,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if allow $2 $1_sudo_t:fd use; allow $2 $1_sudo_t:fifo_file rw_file_perms; allow $2 $1_sudo_t:process sigchld; -@@ -89,9 +89,11 @@ + + kernel_read_kernel_sysctls($1_sudo_t) + kernel_read_system_state($1_sudo_t) +- kernel_search_key($1_sudo_t) + + dev_read_urand($1_sudo_t) + fs_search_auto_mountpoints($1_sudo_t) fs_getattr_xattr_fs($1_sudo_t) @@ -1803,15 +1413,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if + auth_run_upd_passwd($1_sudo_t, $3, { $1_tty_device_t $1_devpts_t }) # sudo stores a token in the pam_pid directory auth_manage_pam_pid($1_sudo_t) -+ auth_search_key($1_sudo_t) - corecmd_read_bin_symlinks($1_sudo_t) - corecmd_getattr_all_executables($1_sudo_t) -@@ -106,18 +108,21 @@ +@@ -106,18 +106,23 @@ files_getattr_usr_files($1_sudo_t) # for some PAM modules and for cwd files_dontaudit_search_home($1_sudo_t) + files_list_tmp($1_sudo_t) ++ ++ auth_use_nsswitch($1_sudo_t) init_rw_utmp($1_sudo_t) @@ -1829,20 +1438,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if userdom_manage_user_tmp_files($1,$1_sudo_t) userdom_manage_user_tmp_symlinks($1,$1_sudo_t) userdom_use_user_terminals($1,$1_sudo_t) -@@ -126,6 +131,10 @@ +@@ -125,21 +130,4 @@ + # for some PAM modules and for cwd userdom_dontaudit_search_all_users_home_content($1_sudo_t) - optional_policy(` -+ locallogin_search_keys($1_sudo_t) -+ ') -+ -+ optional_policy(` - nis_use_ypbind($1_sudo_t) - ') - +- optional_policy(` +- nis_use_ypbind($1_sudo_t) +- ') +- +- optional_policy(` +- nscd_socket_use($1_sudo_t) +- ') +- +- ifdef(`TODO',` +- # for when the network connection is killed +- dontaudit unpriv_userdomain $1_sudo_t:process signal; +- +- ifdef(`mta.te', ` +- domain_auto_trans($1_sudo_t, sendmail_exec_t, $1_mail_t) +- ') +- +- ') dnl end TODO + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.1.0/policy/modules/admin/su.if --- nsaserefpolicy/policy/modules/admin/su.if 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/su.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/su.if 2007-11-06 09:28:35.000000000 -0500 @@ -41,12 +41,11 @@ allow $2 $1_su_t:process signal; @@ -1899,7 +1519,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s kernel_read_system_state($1_su_t) kernel_read_kernel_sysctls($1_su_t) -@@ -203,15 +203,18 @@ +@@ -203,15 +203,16 @@ # needed for pam_rootok selinux_compute_access_vector($1_su_t) @@ -1909,8 +1529,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s auth_dontaudit_read_shadow($1_su_t) auth_use_nsswitch($1_su_t) - auth_rw_faillog($1_su_t) -+ auth_keyring_domain($1_su_t) -+ auth_search_key($1_su_t) - corecmd_search_bin($1_su_t) + corecmd_exec_bin($1_su_t) @@ -1921,7 +1539,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s files_read_etc_files($1_su_t) files_read_etc_runtime_files($1_su_t) files_search_var_lib($1_su_t) -@@ -226,6 +229,7 @@ +@@ -226,6 +227,7 @@ libs_use_ld_so($1_su_t) libs_use_shared_libs($1_su_t) @@ -1929,7 +1547,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s logging_send_syslog_msg($1_su_t) miscfiles_read_localization($1_su_t) -@@ -295,6 +299,8 @@ +@@ -295,6 +297,8 @@ xserver_domtrans_user_xauth($1, $1_su_t) ') @@ -1940,8 +1558,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.1.0/policy/modules/admin/tmpreaper.te --- nsaserefpolicy/policy/modules/admin/tmpreaper.te 2007-10-02 09:54:52.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/tmpreaper.te 2007-10-24 15:06:50.000000000 -0400 -@@ -43,5 +43,10 @@ ++++ serefpolicy-3.1.0/policy/modules/admin/tmpreaper.te 2007-11-06 09:28:35.000000000 -0500 +@@ -28,6 +28,7 @@ + files_purge_tmp(tmpreaper_t) + # why does it need setattr? + files_setattr_all_tmp_dirs(tmpreaper_t) ++files_dontaudit_getattr_lost_found_dirs(tmpreaper_t) + + mls_file_read_all_levels(tmpreaper_t) + mls_file_write_all_levels(tmpreaper_t) +@@ -43,5 +44,10 @@ cron_system_entry(tmpreaper_t,tmpreaper_exec_t) optional_policy(` @@ -1954,7 +1580,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreap + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.1.0/policy/modules/admin/usermanage.te --- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-10-23 07:37:52.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/usermanage.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/usermanage.te 2007-11-06 09:28:35.000000000 -0500 @@ -92,6 +92,7 @@ dev_read_urand(chfn_t) @@ -1990,7 +1616,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.1.0/policy/modules/admin/vbetool.te --- nsaserefpolicy/policy/modules/admin/vbetool.te 2007-10-02 09:54:52.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/vbetool.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/vbetool.te 2007-11-06 09:28:35.000000000 -0500 @@ -33,4 +33,5 @@ optional_policy(` hal_rw_pid_files(vbetool_t) @@ -1999,7 +1625,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.fc serefpolicy-3.1.0/policy/modules/admin/vpn.fc --- nsaserefpolicy/policy/modules/admin/vpn.fc 2006-11-16 17:15:26.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/admin/vpn.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/vpn.fc 2007-11-06 09:28:35.000000000 -0500 @@ -7,3 +7,5 @@ # sbin # @@ -2008,7 +1634,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.fc +/var/run/vpnc(/.*)? gen_context(system_u:object_r:vpnc_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.if serefpolicy-3.1.0/policy/modules/admin/vpn.if --- nsaserefpolicy/policy/modules/admin/vpn.if 2007-01-02 12:57:51.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/admin/vpn.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/vpn.if 2007-11-06 09:28:35.000000000 -0500 @@ -67,3 +67,25 @@ allow $1 vpnc_t:process signal; @@ -2036,8 +1662,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.if +') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.1.0/policy/modules/admin/vpn.te ---- nsaserefpolicy/policy/modules/admin/vpn.te 2007-10-02 09:54:52.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/admin/vpn.te 2007-10-24 15:06:50.000000000 -0400 +--- nsaserefpolicy/policy/modules/admin/vpn.te 2007-10-29 07:52:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/admin/vpn.te 2007-11-06 09:28:35.000000000 -0500 @@ -22,7 +22,7 @@ # Local policy # @@ -2075,9 +1701,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te sysnet_etc_filetrans_config(vpnc_t) sysnet_manage_config(vpnc_t) +@@ -105,7 +107,6 @@ + + optional_policy(` + dbus_system_bus_client_template(vpnc,vpnc_t) +- + optional_policy(` + networkmanager_dbus_chat(vpnc_t) + ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ethereal.if serefpolicy-3.1.0/policy/modules/apps/ethereal.if +--- nsaserefpolicy/policy/modules/apps/ethereal.if 2007-07-23 10:20:12.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/ethereal.if 2007-11-07 12:12:58.000000000 -0500 +@@ -163,17 +163,6 @@ + xserver_create_xdm_tmp_sockets($1_ethereal_t) + ') + +- ifdef(`TODO',` +- # Why does it write this? +- optional_policy(` +- dontaudit sysadm_ethereal_t snmpd_var_lib_t:file write; +- ') +- #TODO +- gnome_application($1_ethereal, $1) +- gnome_file_dialog($1_ethereal, $1) +- # FIXME: policy is incomplete +- ') +- + ') + + ####################################### diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.1.0/policy/modules/apps/gnome.fc --- nsaserefpolicy/policy/modules/apps/gnome.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/apps/gnome.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/gnome.fc 2007-11-06 09:28:35.000000000 -0500 @@ -1,8 +1,7 @@ +HOME_DIR/.gnome2(/.*)? gen_context(system_u:object_r:ROLE_gnome_home_t,s0) HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:ROLE_gnome_home_t,s0) @@ -2090,7 +1745,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc /usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.1.0/policy/modules/apps/gnome.if --- nsaserefpolicy/policy/modules/apps/gnome.if 2007-07-23 10:20:12.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/apps/gnome.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/gnome.if 2007-11-06 11:44:25.000000000 -0500 @@ -33,6 +33,51 @@ ## # @@ -2163,7 +1818,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if ps_process_pattern($2,$1_gconfd_t) dev_read_urand($1_gconfd_t) -@@ -100,9 +139,18 @@ +@@ -100,7 +139,12 @@ gnome_stream_connect_gconf_template($1,$2) optional_policy(` @@ -2175,14 +1830,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if + nscd_socket_use($1_gconfd_t) ') -+# optional_policy(` -+# ssh_dontaudit_use_user_ssh_agent_fds($1,$1_gconfd_t) -+# ') -+ optional_policy(` - xserver_use_xdm_fds($1_gconfd_t) - xserver_rw_xdm_pipes($1_gconfd_t) -@@ -135,13 +183,32 @@ +@@ -135,13 +179,32 @@ allow $2 $1_gconfd_t:unix_stream_socket connectto; ') @@ -2216,7 +1865,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if ##

##

## This is a templated interface, and should only -@@ -170,6 +237,30 @@ +@@ -170,6 +233,30 @@ ######################################## ##

@@ -2247,7 +1896,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if ## manage gnome homedir content (.config) ## ## -@@ -189,6 +280,26 @@ +@@ -189,6 +276,26 @@ type $1_gnome_home_t; ') @@ -2278,7 +1927,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.1.0/policy/modules/apps/gnome.te --- nsaserefpolicy/policy/modules/apps/gnome.te 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/apps/gnome.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/gnome.te 2007-11-06 09:28:35.000000000 -0500 @@ -8,8 +8,5 @@ attribute gnomedomain; @@ -2290,7 +1939,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te application_executable_file(gconfd_exec_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.1.0/policy/modules/apps/java.fc --- nsaserefpolicy/policy/modules/apps/java.fc 2007-03-01 10:01:48.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/apps/java.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/java.fc 2007-11-06 09:28:35.000000000 -0500 @@ -11,6 +11,7 @@ # /usr/(.*/)?bin/java.* -- gen_context(system_u:object_r:java_exec_t,s0) @@ -2313,7 +1962,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc +/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.1.0/policy/modules/apps/java.if --- nsaserefpolicy/policy/modules/apps/java.if 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/apps/java.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/java.if 2007-11-06 09:28:35.000000000 -0500 @@ -32,7 +32,7 @@ ## ## @@ -2465,8 +2114,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.1.0/policy/modules/apps/java.te --- nsaserefpolicy/policy/modules/apps/java.te 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/apps/java.te 2007-10-24 15:06:50.000000000 -0400 -@@ -23,11 +23,23 @@ ++++ serefpolicy-3.1.0/policy/modules/apps/java.te 2007-11-06 09:28:35.000000000 -0500 +@@ -6,13 +6,6 @@ + # Declarations + # + +-## +-##

+-## Allow java executable stack +-##

+-## +-gen_tunable(allow_java_execstack,false) +- + type java_t; + type java_exec_t; + init_system_domain(java_t,java_exec_t) +@@ -23,11 +16,23 @@ # # execheap is needed for itanium/BEA jrocket @@ -2495,7 +2158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.1.0/policy/modules/apps/mono.if --- nsaserefpolicy/policy/modules/apps/mono.if 2007-01-02 12:57:22.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/apps/mono.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/mono.if 2007-11-06 09:28:35.000000000 -0500 @@ -18,3 +18,105 @@ corecmd_search_bin($1) domtrans_pattern($1, mono_exec_t, mono_t) @@ -2604,7 +2267,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.1.0/policy/modules/apps/mono.te --- nsaserefpolicy/policy/modules/apps/mono.te 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/apps/mono.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/mono.te 2007-11-06 09:28:35.000000000 -0500 @@ -15,7 +15,7 @@ # Local policy # @@ -2623,8 +2286,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te + xserver_xdm_rw_shm(mono_t) +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.1.0/policy/modules/apps/mozilla.if ---- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/apps/mozilla.if 2007-10-24 15:06:50.000000000 -0400 +--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-29 07:52:48.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/mozilla.if 2007-11-06 09:28:35.000000000 -0500 @@ -36,6 +36,8 @@ gen_require(` type mozilla_conf_t, mozilla_exec_t; @@ -2728,7 +2391,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. term_dontaudit_getattr_pty_dirs($1_mozilla_t) libs_use_ld_so($1_mozilla_t) -@@ -184,16 +227,14 @@ +@@ -184,12 +227,9 @@ sysnet_dns_name_resolve($1_mozilla_t) sysnet_read_config($1_mozilla_t) @@ -2744,12 +2407,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t) xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t) - xserver_dontaudit_getattr_xdm_tmp_sockets($1_mozilla_t) -+ xserver_xdm_sigchld($1_mozilla_t) - - tunable_policy(`allow_execmem',` - allow $1_mozilla_t self:process { execmem execstack }; -@@ -211,131 +252,8 @@ +@@ -211,131 +251,8 @@ fs_manage_cifs_symlinks($1_mozilla_t) ') @@ -2883,7 +2541,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') optional_policy(` -@@ -350,21 +268,28 @@ +@@ -350,19 +267,25 @@ optional_policy(` cups_read_rw_config($1_mozilla_t) cups_dbus_chat($1_mozilla_t) @@ -2892,19 +2550,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. optional_policy(` dbus_system_bus_client_template($1_mozilla,$1_mozilla_t) - dbus_send_system_bus($1_mozilla_t) - dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t) -- dbus_send_user_bus($1,$1_mozilla_t) -+# dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t) -+# dbus_send_user_bus($1,$1_mozilla_t) -+ ') -+ -+ optional_policy(` -+ gnome_exec_gconf($1_mozilla_t) -+ gnome_manage_user_gnome_config($1,$1_mozilla_t) ') optional_policy(` ++ gnome_exec_gconf($1_mozilla_t) ++ gnome_manage_user_gnome_config($1,$1_mozilla_t) ++ ') ++ ++ optional_policy(` + gnome_domtrans_user_gconf($1,$1_mozilla_t) gnome_stream_connect_gconf_template($1,$1_mozilla_t) ') @@ -2915,7 +2569,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') optional_policy(` -@@ -384,25 +309,6 @@ +@@ -382,25 +305,6 @@ thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t) ') @@ -2941,7 +2595,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') ######################################## -@@ -575,3 +481,27 @@ +@@ -573,3 +477,27 @@ allow $2 $1_mozilla_t:tcp_socket rw_socket_perms; ') @@ -2971,7 +2625,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.1.0/policy/modules/apps/mozilla.te --- nsaserefpolicy/policy/modules/apps/mozilla.te 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/apps/mozilla.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/mozilla.te 2007-11-06 09:28:35.000000000 -0500 @@ -6,13 +6,6 @@ # Declarations # @@ -2988,7 +2642,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.1.0/policy/modules/apps/userhelper.if --- nsaserefpolicy/policy/modules/apps/userhelper.if 2007-07-23 10:20:12.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/apps/userhelper.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/userhelper.if 2007-11-06 09:28:35.000000000 -0500 @@ -130,6 +130,7 @@ term_use_all_user_ptys($1_userhelper_t) @@ -2999,7 +2653,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp auth_search_pam_console_data($1_userhelper_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.1.0/policy/modules/apps/vmware.fc --- nsaserefpolicy/policy/modules/apps/vmware.fc 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/apps/vmware.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/vmware.fc 2007-11-06 09:28:35.000000000 -0500 @@ -21,19 +21,25 @@ /usr/bin/vmware-nmbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) /usr/bin/vmware-ping -- gen_context(system_u:object_r:vmware_host_exec_t,s0) @@ -3033,7 +2687,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.f +/var/log/vmware.* -- gen_context(system_u:object_r:vmware_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.if serefpolicy-3.1.0/policy/modules/apps/vmware.if --- nsaserefpolicy/policy/modules/apps/vmware.if 2007-02-19 11:32:52.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/apps/vmware.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/vmware.if 2007-11-06 09:28:35.000000000 -0500 @@ -202,3 +202,22 @@ allow $1 vmware_sys_conf_t:file append; @@ -3059,7 +2713,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.1.0/policy/modules/apps/vmware.te --- nsaserefpolicy/policy/modules/apps/vmware.te 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/apps/vmware.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/vmware.te 2007-11-06 09:28:35.000000000 -0500 @@ -22,6 +22,9 @@ type vmware_var_run_t; files_pid_file(vmware_var_run_t) @@ -3091,7 +2745,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.t kernel_read_proc_symlinks(vmware_host_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.1.0/policy/modules/apps/wine.if --- nsaserefpolicy/policy/modules/apps/wine.if 2007-09-12 10:34:17.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/apps/wine.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/wine.if 2007-11-06 09:28:35.000000000 -0500 @@ -49,3 +49,53 @@ role $2 types wine_t; allow wine_t $3:chr_file rw_term_perms; @@ -3148,7 +2802,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.1.0/policy/modules/apps/wine.te --- nsaserefpolicy/policy/modules/apps/wine.te 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/apps/wine.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/apps/wine.te 2007-11-06 09:28:35.000000000 -0500 @@ -9,6 +9,7 @@ type wine_t; type wine_exec_t; @@ -3174,36 +2828,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te + xserver_xdm_rw_shm(wine_t) ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.1.0/policy/modules/kernel/corecommands.fc ---- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-10-12 08:56:01.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/corecommands.fc 2007-10-24 15:06:50.000000000 -0400 -@@ -36,6 +36,11 @@ - /etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0) - /etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0) - -+/etc/cron.daily/.* -- gen_context(system_u:object_r:bin_t,s0) -+/etc/cron.hourly/.* -- gen_context(system_u:object_r:bin_t,s0) -+/etc/cron.weekly/.* -- gen_context(system_u:object_r:bin_t,s0) -+/etc/cron.monthly/.* -- gen_context(system_u:object_r:bin_t,s0) -+ - /etc/hotplug/.*agent -- gen_context(system_u:object_r:bin_t,s0) - /etc/hotplug/.*rc -- gen_context(system_u:object_r:bin_t,s0) - /etc/hotplug/hotplug\.functions -- gen_context(system_u:object_r:bin_t,s0) -@@ -164,6 +169,7 @@ - - /usr/local/lib(64)?/ipsec/.* -- gen_context(system_u:object_r:bin_t,s0) - /usr/local/Brother/lpd(/.*)? gen_context(system_u:object_r:bin_t,s0) -+/usr/local/Brother/Printer/[^/]*/cupswrapper(/.*)? gen_context(system_u:object_r:bin_t,s0) - - /usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0) - -@@ -259,3 +265,18 @@ +--- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-10-29 18:02:31.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/kernel/corecommands.fc 2007-11-06 09:28:35.000000000 -0500 +@@ -269,3 +269,15 @@ ifdef(`distro_suse',` /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) ') + -+/etc/gdm/XKeepsCrashing[^/]* -- gen_context(system_u:object_r:bin_t,s0) -+/etc/gdm/[^/]+ -d gen_context(system_u:object_r:bin_t,s0) -+/etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0) +/lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:bin_t,s0) +/lib64/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:bin_t,s0) + @@ -3215,185 +2846,89 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco +/etc/apcupsd/mastertimeout -- gen_context(system_u:object_r:bin_t,s0) +/etc/apcupsd/offbattery -- gen_context(system_u:object_r:bin_t,s0) +/etc/apcupsd/onbattery -- gen_context(system_u:object_r:bin_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.if.in serefpolicy-3.1.0/policy/modules/kernel/corenetwork.if.in ---- nsaserefpolicy/policy/modules/kernel/corenetwork.if.in 2007-07-10 12:21:05.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/corenetwork.if.in 2007-10-24 15:06:50.000000000 -0400 -@@ -903,9 +903,11 @@ - interface(`corenet_udp_bind_generic_port',` - gen_require(` - type port_t; -+ attribute port_type; - ') - - allow $1 port_t:udp_socket name_bind; -+ dontaudit $1 { port_type -port_t }:udp_socket name_bind; - ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.1.0/policy/modules/kernel/corenetwork.te.in +--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-10-29 18:02:31.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/kernel/corenetwork.te.in 2007-11-07 08:31:44.000000000 -0500 +@@ -132,6 +132,7 @@ + network_port(openvpn, tcp,1194,s0, udp,1194,s0) + network_port(pegasus_http, tcp,5988,s0) + network_port(pegasus_https, tcp,5989,s0) ++network_port(pgpkeyserver, udp, 11371,s0, tcp,11371,s0) + network_port(pop, tcp,106,s0, tcp,109,s0, tcp,110,s0, tcp,143,s0, tcp,220,s0, tcp,993,s0, tcp,995,s0, tcp,1109,s0) + network_port(portmap, udp,111,s0, tcp,111,s0) + network_port(postgresql, tcp,5432,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.1.0/policy/modules/kernel/devices.fc +--- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-10-29 18:02:31.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/kernel/devices.fc 2007-11-06 09:28:35.000000000 -0500 +@@ -20,6 +20,7 @@ + /dev/evtchn -c gen_context(system_u:object_r:xen_device_t,s0) + /dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0) + /dev/full -c gen_context(system_u:object_r:null_device_t,s0) ++/dev/[0-9].* -c gen_context(system_u:object_r:usb_device_t,s0) + /dev/fw.* -c gen_context(system_u:object_r:usb_device_t,s0) + /dev/hiddev.* -c gen_context(system_u:object_r:usb_device_t,s0) + /dev/hpet -c gen_context(system_u:object_r:clock_device_t,s0) +@@ -30,6 +31,7 @@ + /dev/js.* -c gen_context(system_u:object_r:mouse_device_t,s0) + /dev/kmem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) + /dev/kmsg -c gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh) ++/dev/kvm -c gen_context(system_u:object_r:kvm_device_t,s0) + /dev/logibm -c gen_context(system_u:object_r:mouse_device_t,s0) + /dev/lp.* -c gen_context(system_u:object_r:printer_device_t,s0) + /dev/mcelog -c gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.1.0/policy/modules/kernel/devices.if +--- nsaserefpolicy/policy/modules/kernel/devices.if 2007-10-29 18:02:31.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/kernel/devices.if 2007-11-06 09:28:35.000000000 -0500 +@@ -65,7 +65,7 @@ - ######################################## -@@ -1449,6 +1451,43 @@ + relabelfrom_dirs_pattern($1,device_t,device_node) + relabelfrom_files_pattern($1,device_t,device_node) +- relabelfrom_lnk_files_pattern($1,device_t,device_node) ++ relabelfrom_lnk_files_pattern($1,device_t,{ device_t device_node }) + relabelfrom_fifo_files_pattern($1,device_t,device_node) + relabelfrom_sock_files_pattern($1,device_t,device_node) + relabel_blk_files_pattern($1,device_t,{ device_t device_node }) +@@ -2787,6 +2787,78 @@ ######################################## ## -+## Connect TCP sockets to rpc ports. ++## Get the attributes of the kvm devices. +## +## +## -+## The type of the process performing this action. ++## Domain allowed access. +## +## +# -+interface(`corenet_tcp_connect_all_rpc_ports',` ++interface(`dev_getattr_kvm_dev',` + gen_require(` -+ attribute rpc_port_type; ++ type device_t, kvm_device_t; + ') + -+ allow $1 rpc_port_type:tcp_socket name_connect; ++ getattr_chr_files_pattern($1,device_t,kvm_device_t) +') + +######################################## +## -+## Do not audit attempts to connect TCP sockets -+## all rpc ports. ++## Set the attributes of the kvm devices. +## +## +## -+## Domain to not audit. ++## Domain allowed access. +## +## +# -+interface(`corenet_dontaudit_tcp_connect_all_rpc_ports',` ++interface(`dev_setattr_kvm_dev',` + gen_require(` -+ attribute rpc_port_type; ++ type device_t, kvm_device_t; + ') + -+ dontaudit $1 rpc_port_type:tcp_socket name_connect; ++ setattr_chr_files_pattern($1,device_t,kvm_device_t) +') + +######################################## +## - ## Read and write the TUN/TAP virtual network device. - ## - ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.1.0/policy/modules/kernel/corenetwork.te.in ---- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-10-12 08:56:01.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/corenetwork.te.in 2007-10-24 15:06:50.000000000 -0400 -@@ -55,6 +55,11 @@ - type reserved_port_t, port_type, reserved_port_type; - - # -+# hi_reserved_port_t is the type of INET port numbers between 600-1023. -+# -+type hi_reserved_port_t, port_type, reserved_port_type, rpc_port_type; -+ -+# - # server_packet_t is the default type of IPv4 and IPv6 server packets. - # - type server_packet_t, packet_type, server_packet_type; -@@ -67,7 +72,6 @@ - network_port(amanda, udp,10080,s0, tcp,10080,s0, udp,10081,s0, tcp,10081,s0, tcp,10082,s0, tcp,10083,s0) - network_port(amavisd_recv, tcp,10024,s0) - network_port(amavisd_send, tcp,10025,s0) --network_port(aol, tcp,5190,s0, udp,5190,s0) - network_port(apcupsd, tcp,3551,s0, udp,3551,s0) - network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0, udp,5060,s0) - network_port(auth, tcp,113,s0) -@@ -94,10 +98,11 @@ - network_port(http_cache, tcp,3128,s0, udp,3130,s0, tcp,8080,s0, tcp,8118,s0) # 8118 is for privoxy - network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0, tcp,8009,s0, tcp,8443,s0) #8443 is mod_nss default port - network_port(howl, tcp,5335,s0, udp,5353,s0) --network_port(hplip, tcp,1782,s0, tcp,2207,s0, tcp,2208,s0, tcp,50000,s0, tcp,50002,s0, tcp,8292,s0, tcp,9100,s0, tcp,9101,s0, tcp,9102,s0, tcp,9220,s0, tcp,9221,s0, tcp,9222,s0, tcp,9280,s0, tcp,9281,s0, tcp,9282,s0, tcp,9290,s0, tcp,9291,s0, tcp,9292,s0) -+network_port(hplip, tcp,1782,s0, tcp,2207,s0, tcp,2208,s0, tcp, 8290,s0, tcp,50000,s0, tcp,50002,s0, tcp,8292,s0, tcp,9100,s0, tcp,9101,s0, tcp,9102,s0, tcp,9220,s0, tcp,9221,s0, tcp,9222,s0, tcp,9280,s0, tcp,9281,s0, tcp,9282,s0, tcp,9290,s0, tcp,9291,s0, tcp,9292,s0) - network_port(i18n_input, tcp,9010,s0) -+network_port(ipsecnat, tcp,4500,s0, udp,4500,s0) - network_port(imaze, tcp,5323,s0, udp,5323,s0) --network_port(inetd_child, tcp,7,s0, udp,7,s0, tcp,9,s0, udp,9,s0, tcp,13,s0, udp,13,s0, tcp,19,s0, udp,19,s0, tcp,37,s0, udp,37,s0, tcp,512,s0, tcp,543,s0, tcp,544,s0, tcp,891,s0, udp,891,s0, tcp,892,s0, udp,892,s0, tcp,2105,s0, tcp,5666,s0) -+network_port(inetd_child, tcp,1,s0, udp,1,s0, tcp,7,s0, udp,7,s0, tcp,9,s0, udp,9,s0, tcp,13,s0, udp,13,s0, tcp,19,s0, udp,19,s0, tcp,37,s0, udp,37,s0, tcp,512,s0, tcp,543,s0, tcp,544,s0, tcp,891,s0, udp,891,s0, tcp,892,s0, udp,892,s0, tcp,2105,s0, tcp,5666,s0) - network_port(innd, tcp,119,s0) - network_port(ipp, tcp,631,s0, udp,631,s0) - network_port(ircd, tcp,6667,s0) -@@ -109,14 +114,13 @@ - network_port(kerberos_master, tcp,4444,s0, udp,4444,s0) - network_port(kerberos, tcp,88,s0, udp,88,s0, tcp,750,s0, udp,750,s0) - network_port(ktalkd, udp,517,s0, udp,518,s0) --network_port(ldap, tcp,389,s0, udp,389,s0, tcp,636,s0, udp,636,s0) -+network_port(ldap, tcp,3268,s0, tcp,389,s0, udp,389,s0, tcp,636,s0, udp,636,s0) - type lrrd_port_t, port_type; dnl network_port(lrrd_port_t) # no defined portcon - network_port(lmtp, tcp,24,s0, udp,24,s0) - network_port(mail, tcp,2000,s0) --network_port(mmcc, tcp,5050,s0, udp,5050,s0) --network_port(msnp, tcp,1863,s0, udp,1863,s0) - network_port(monopd, tcp,1234,s0) --network_port(mysqld, tcp,3306,s0) -+network_port(mysqld, tcp,3306,s0, tcp,1186,s0) -+portcon tcp 63132-63163 gen_context(system_u:object_r:mysqld_port_t, s0) - network_port(nessus, tcp,1241,s0) - network_port(netsupport, tcp,5405,s0, udp,5405,s0) - network_port(nmbd, udp,137,s0, udp,138,s0) -@@ -149,7 +153,7 @@ - network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0) - network_port(spamd, tcp,783,s0) - network_port(ssh, tcp,22,s0) --network_port(soundd, tcp,8000,s0, tcp,9433,s0) -+network_port(soundd, tcp,8000,s0, tcp,9433,s0, tcp, 16001, s0) - type socks_port_t, port_type; dnl network_port(socks) # no defined portcon - type stunnel_port_t, port_type; dnl network_port(stunnel) # no defined portcon in current strict - network_port(squid, udp,3401,s0, tcp,3401,s0, udp,4827,s0, tcp,4827,s0) # snmp and htcp -@@ -163,14 +167,19 @@ - type utcpserver_port_t, port_type; dnl network_port(utcpserver) # no defined portcon - network_port(uucpd, tcp,540,s0) - network_port(vnc, tcp,5900,s0) -+network_port(wccp, udp,2048,s0) -+network_port(xdmcp, udp,177,s0, tcp,177,s0) - network_port(xen, tcp,8002,s0) - network_port(xfs, tcp,7100,s0) --network_port(xserver, tcp, 6000, s0, tcp,6001,s0, tcp,6002,s0, tcp,6003,s0, tcp,6004,s0, tcp,6005,s0, tcp,6006,s0, tcp,6007,s0, tcp,6008,s0, tcp,6009,s0, tcp,6010,s0, tcp,6011,s0, tcp,6012,s0, tcp,6013,s0, tcp,6014,s0, tcp,6015,s0, tcp,6016,s0, tcp,6017,s0, tcp,6018,s0, tcp,6019,s0) -+network_port(xserver, tcp, 6000, s0, tcp,6001,s0, tcp,6002,s0, tcp,6003,s0, tcp,6004,s0, tcp,6005,s0, tcp,6006,s0, tcp,6007,s0, tcp,6008,s0, tcp,6009,s0, tcp,6010,s0, tcp,6011,s0, tcp,6012,s0, tcp,6013,s0, tcp,6014,s0, tcp,6015,s0, tcp,6016,s0, tcp,6017,s0, tcp,6018,s0, tcp,6019,s0, tcp,6020,s0) - network_port(zebra, tcp,2600,s0, tcp,2601,s0, tcp,2602,s0, tcp,2603,s0, tcp,2604,s0, tcp,2606,s0, udp,2600,s0, udp,2601,s0, udp,2602,s0, udp,2603,s0, udp,2604,s0, udp,2606,s0) - network_port(zope, tcp,8021,s0) - - # Defaults for reserved ports. Earlier portcon entries take precedence; - # these entries just cover any remaining reserved ports not otherwise declared. -+ -+portcon tcp 600-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0) -+portcon udp 600-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0) - portcon tcp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0) - portcon udp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0) - -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.1.0/policy/modules/kernel/devices.fc ---- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-09-05 15:24:43.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/devices.fc 2007-10-24 15:06:50.000000000 -0400 -@@ -20,6 +20,7 @@ - /dev/evtchn -c gen_context(system_u:object_r:xen_device_t,s0) - /dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0) - /dev/full -c gen_context(system_u:object_r:null_device_t,s0) -+/dev/[0-9].* -c gen_context(system_u:object_r:usb_device_t,s0) - /dev/fw.* -c gen_context(system_u:object_r:usb_device_t,s0) - /dev/hiddev.* -c gen_context(system_u:object_r:usb_device_t,s0) - /dev/hpet -c gen_context(system_u:object_r:clock_device_t,s0) -@@ -98,6 +99,7 @@ - /dev/input/event.* -c gen_context(system_u:object_r:event_device_t,s0) - /dev/input/mice -c gen_context(system_u:object_r:mouse_device_t,s0) - /dev/input/js.* -c gen_context(system_u:object_r:mouse_device_t,s0) -+/dev/input/uinput -c gen_context(system_u:object_r:event_device_t,s0) - - /dev/mapper/control -c gen_context(system_u:object_r:lvm_control_t,s0) - -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.1.0/policy/modules/kernel/devices.if ---- nsaserefpolicy/policy/modules/kernel/devices.if 2007-10-12 08:56:01.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/devices.if 2007-10-24 15:06:50.000000000 -0400 -@@ -161,6 +161,7 @@ - type device_t; - ') - -+ allow $1 device_t:dir { ra_dir_perms create }; - create_dirs_pattern($1,device_t,device_t) - ') - -@@ -1305,6 +1306,44 @@ - - ######################################## - ## -+## Get the attributes of the event devices. ++## Read the kvm devices. +## +## +## @@ -3401,530 +2936,150 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device +## +## +# -+interface(`dev_getattr_event_dev',` ++interface(`dev_read_kvm',` + gen_require(` -+ type device_t, event_device_t; ++ type device_t, kvm_device_t; + ') + -+ allow $1 device_t:dir list_dir_perms; -+ allow $1 event_device_t:chr_file getattr; ++ read_chr_files_pattern($1,device_t,kvm_device_t) +') + +######################################## +## -+## Set the attributes of the event devices. ++## Read and write to kvm devices. +## +## +## -+## Domain allowed access. ++## Domain allowed access. +## +## +# -+interface(`dev_setattr_event_dev',` ++interface(`dev_rw_kvm',` + gen_require(` -+ type device_t, event_device_t; ++ type device_t, kvm_device_t; + ') + -+ allow $1 device_t:dir list_dir_perms; -+ allow $1 event_device_t:chr_file setattr; ++ rw_chr_files_pattern($1,device_t,kvm_device_t) +') + +######################################## +## - ## Read input event devices (/dev/input). + ## Mount a usbfs filesystem. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.1.0/policy/modules/kernel/domain.if ---- nsaserefpolicy/policy/modules/kernel/domain.if 2007-10-12 08:56:01.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/domain.if 2007-10-24 15:06:50.000000000 -0400 -@@ -45,6 +45,11 @@ - # start with basic domain - domain_base_type($1) +@@ -3322,3 +3394,4 @@ -+ optional_policy(` -+ unconfined_use_fds($1) -+ unconfined_sigchld($1) -+ ') + typeattribute $1 devices_unconfined_type; + ') + - # send init a sigchld and signull - optional_policy(` - init_sigchld($1) -@@ -59,6 +64,7 @@ - ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.1.0/policy/modules/kernel/devices.te +--- nsaserefpolicy/policy/modules/kernel/devices.te 2007-10-29 18:02:31.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/kernel/devices.te 2007-11-06 09:28:35.000000000 -0500 +@@ -72,6 +72,13 @@ + dev_node(kmsg_device_t) - optional_policy(` -+ selinux_dontaudit_getattr_fs($1) - selinux_dontaudit_read_fs($1) - ') - -@@ -1270,3 +1276,21 @@ - - typeattribute $1 mmap_low_domain_type; - ') + # ++# kvm_device_t is the type of ++# /dev/kvm ++# ++type kvm_device_t; ++dev_node(kvm_device_t) + -+######################################## -+## -+## Allow specified type to associate ipsec packets from any domain -+## -+## -+## -+## Type of subject to be allowed this. -+## -+## +# -+interface(`domain_ipsec_labels',` -+ gen_require(` -+ attribute domain; -+ ') -+ -+ allow $1 domain:association { sendto recvfrom }; -+') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.1.0/policy/modules/kernel/domain.te ---- nsaserefpolicy/policy/modules/kernel/domain.te 2007-10-12 08:56:01.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/domain.te 2007-10-25 10:13:20.000000000 -0400 -@@ -6,6 +6,22 @@ - # Declarations + # Type for /dev/mapper/control # + type lvm_control_t; +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.1.0/policy/modules/kernel/domain.if +--- nsaserefpolicy/policy/modules/kernel/domain.if 2007-10-29 18:02:31.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/kernel/domain.if 2007-11-06 10:15:09.000000000 -0500 +@@ -57,13 +57,6 @@ + init_signull($1) + ') -+ifdef(`enable_mls',` -+## -+##

-+## Allow all domains to use netlabel labeled packets -+##

-+## -+gen_tunable(allow_netlabel,true) -+') -+ -+## -+##

-+## Allow unlabeled packets to work on system -+##

-+## -+gen_tunable(allow_unlabeled_packets,true) -+ - # Mark process types as domains - attribute domain; - -@@ -80,6 +96,9 @@ - allow domain self:lnk_file { read_lnk_file_perms lock ioctl }; - allow domain self:file rw_file_perms; - kernel_read_proc_symlinks(domain) -+# Every domain gets the key ring, so we should default to no one allowed to look at it -+kernel_dontaudit_search_key(domain) -+kernel_dontaudit_link_key(domain) - - # create child processes in the domain - allow domain self:process { fork sigchld }; -@@ -134,3 +153,22 @@ +- # these seem questionable: +- +- optional_policy(` +- rpm_use_fds($1) +- rpm_read_pipes($1) +- ') +- + optional_policy(` + selinux_dontaudit_getattr_fs($1) + selinux_dontaudit_read_fs($1) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.1.0/policy/modules/kernel/domain.te +--- nsaserefpolicy/policy/modules/kernel/domain.te 2007-10-29 18:02:31.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/kernel/domain.te 2007-11-06 10:15:22.000000000 -0500 +@@ -145,3 +145,9 @@ # act on all domains keys allow unconfined_domain_type domain:key *; + -+# xdm passes an open file descriptor to xsession-errors.log which is then audited by all confined domains. ++# Allow all domains to use fds past to them ++allow domain domain:fd use; +optional_policy(` -+ xserver_dontaudit_use_xdm_fds(domain) -+ xserver_dontaudit_rw_xdm_pipes(domain) -+') -+ -+tunable_policy(`allow_unlabeled_packets',` -+ kernel_sendrecv_unlabeled_association(domain) -+ corenet_sendrecv_unlabeled_packets(domain) -+') -+ -+ifdef(`enable_mls',` -+ tunable_policy(`allow_netlabel',` -+ kernel_raw_recvfrom_unlabeled(domain) -+ kernel_tcp_recvfrom_unlabeled(domain) -+ kernel_udp_recvfrom_unlabeled(domain) -+ ') ++ rpm_dontaudit_rw_pipes(domain) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.1.0/policy/modules/kernel/files.fc ---- nsaserefpolicy/policy/modules/kernel/files.fc 2007-10-12 08:56:01.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/files.fc 2007-10-24 15:06:50.000000000 -0400 -@@ -209,7 +209,8 @@ - /usr/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh) - /usr/lost\+found/.* <> - --/usr/share(/.*)?/lib(64)?(/.*)? gen_context(system_u:object_r:usr_t,s0) -+#/usr/share(/.*)?/lib(64)?(/.*)? gen_context(system_u:object_r:usr_t,s0) -+/usr/share/doc(/.*)?/README.* gen_context(system_u:object_r:usr_t,s0) - - /usr/src(/.*)? gen_context(system_u:object_r:src_t,s0) - /usr/src/kernels/.+/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.1.0/policy/modules/kernel/files.if ---- nsaserefpolicy/policy/modules/kernel/files.if 2007-10-12 08:56:01.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/files.if 2007-10-24 15:06:50.000000000 -0400 -@@ -343,8 +343,7 @@ - - ######################################## - ## --## Mount a filesystem on all non-security --## directories and files. -+## Mount a filesystem on all non-security directories. - ## - ## - ## -@@ -352,12 +351,29 @@ - ## - ## - # --interface(`files_mounton_non_security',` -+interface(`files_mounton_non_security_dir',` - gen_require(` - attribute file_type, security_file_type; - ') +--- nsaserefpolicy/policy/modules/kernel/files.if 2007-10-29 18:02:31.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/kernel/files.if 2007-11-06 09:28:35.000000000 -0500 +@@ -4756,3 +4756,54 @@ - allow $1 { file_type -security_file_type }:dir mounton; -+') + allow $1 { file_type -security_file_type }:dir manage_dir_perms; + ') + +######################################## +## -+## Mount a filesystem on all non-security and files. ++## Create a core files in / +## ++## ++##

++## Create a core file in /, ++##

++## +## +## +## Domain allowed access. +## +## ++## +# -+interface(`files_mounton_non_security_files',` ++interface(`files_dump_core',` + gen_require(` -+ attribute file_type, security_file_type; ++ type root_t; + ') + - allow $1 { file_type -security_file_type }:file mounton; - ') - -@@ -376,7 +392,7 @@ - attribute file_type, security_file_type; - ') - -- allow $1 { file_type -security_file_type }:dir write; -+ allow $1 { file_type -security_file_type }:dir rw_dir_perms; - ') - - ######################################## -@@ -885,6 +901,8 @@ - attribute file_type; - ') - -+ # Have to be able to read badly labeled files like file_context and ld.so.cache -+ files_read_all_files($1) - allow $1 { file_type $2 }:dir list_dir_perms; - relabel_dirs_pattern($1,{ file_type $2 },{ file_type $2 }) - relabel_files_pattern($1,{ file_type $2 },{ file_type $2 }) -@@ -1106,6 +1124,24 @@ - - ######################################## - ## -+## search all mount points. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`files_search_all_mountpoints',` -+ gen_require(` -+ attribute mountpoint; -+ ') -+ -+ allow $1 mountpoint:dir search_dir_perms; -+') -+ -+######################################## -+## - ## List the contents of the root directory. - ## - ## -@@ -1192,6 +1228,25 @@ - - ######################################## - ## -+## Do not audit attempts to write -+## files in the root directory. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`files_dontaudit_write_root_dir',` -+ gen_require(` -+ type root_t; -+ ') -+ -+ dontaudit $1 root_t:dir write; ++ allow $1 root_t:dir rw_dir_perms; ++ allow $1 root_t:file { create getattr write }; +') + +######################################## +## - ## Do not audit attempts to read or write - ## character device nodes in the root directory. - ## -@@ -2023,6 +2078,31 @@ - - ######################################## - ## -+## Create a default directory in / ++## Create a default directory in / +## +## -+##

-+## Create a default_t direcrory in / -+##

++##

++## Create a default_t direcrory in / ++##

+## +## -+## -+## Domain allowed access. -+## ++## ++## Domain allowed access. ++## +## +## +# +interface(`files_create_default_dir',` -+ gen_require(` -+ type root_t, default_t; -+ ') -+ -+ allow $1 default_t:dir create; -+ filetrans_pattern($1,root_t,default_t,dir) -+') -+ -+######################################## -+## - ## Read files in /etc that are dynamically - ## created on boot, such as mtab. - ## -@@ -3107,6 +3187,24 @@ - - ######################################## - ## -+## Manage temporary directories in /tmp. -+## -+## -+## -+## The type of the process performing this action. -+## -+## -+# -+interface(`files_manage_generic_tmp_dirs',` -+ gen_require(` -+ type tmp_t; -+ ') ++ gen_require(` ++ type root_t, default_t; ++ ') + -+ manage_dirs_pattern($1,tmp_t,tmp_t) ++ allow $1 default_t:dir create; ++ filetrans_pattern($1,root_t,default_t,dir) +') + -+######################################## -+## - ## Manage temporary files and directories in /tmp. - ## - ## -@@ -3198,6 +3296,44 @@ - - ######################################## - ## -+## Allow attempts to get the attributes -+## of all tmp files. -+## -+## -+## -+## Domain not to audit. -+## -+## -+# -+interface(`files_getattr_all_tmp_files',` -+ gen_require(` -+ attribute tmpfile; -+ ') -+ -+ allow $1 tmpfile:file getattr; -+') -+ -+######################################## -+## -+## Do not audit attempts to get the attributes -+## of all tmp sock_file. -+## -+## -+## -+## Domain not to audit. -+## -+## -+# -+interface(`files_dontaudit_getattr_all_tmp_sockets',` -+ gen_require(` -+ attribute tmpfile; -+ ') -+ -+ dontaudit $1 tmpfile:sock_file getattr; -+') -+ -+######################################## -+## - ## Read all tmp files. - ## - ## -@@ -3323,6 +3459,42 @@ - - ######################################## - ## -+## dontaudit Add and remove entries from /usr directories. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`files_dontaudit_rw_usr_dirs',` -+ gen_require(` -+ type usr_t; -+ ') -+ -+ dontaudit $1 usr_t:dir rw_dir_perms; -+') -+ -+######################################## -+## -+## Create, read, write, and delete files in the /usr directory. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`files_manage_usr_files',` -+ gen_require(` -+ type usr_t; -+ ') -+ -+ manage_files_pattern($1, usr_t, usr_t) -+') -+ -+######################################## -+## - ## Get the attributes of files in /usr. - ## - ## -@@ -3381,7 +3553,7 @@ - - ######################################## - ## --## Create, read, write, and delete files in the /usr directory. -+## Relabel a file to the type used in /usr. - ## - ## - ## -@@ -3389,17 +3561,17 @@ - ## - ## - # --interface(`files_manage_usr_files',` -+interface(`files_relabelto_usr_files',` - gen_require(` - type usr_t; - ') - -- manage_files_pattern($1, usr_t, usr_t) -+ relabelto_files_pattern($1,usr_t,usr_t) - ') - - ######################################## - ## --## Relabel a file to the type used in /usr. -+## Relabel a file from the type used in /usr. - ## - ## - ## -@@ -3407,12 +3579,12 @@ - ## - ## - # --interface(`files_relabelto_usr_files',` -+interface(`files_relabelfrom_usr_files',` - gen_require(` - type usr_t; - ') - -- relabelto_files_pattern($1,usr_t,usr_t) -+ relabelfrom_files_pattern($1,usr_t,usr_t) - ') - - ######################################## -@@ -3556,7 +3728,7 @@ - type boot_t, system_map_t; - ') - -- allow $1 boot_t:dir { list_dir_perms add_entry_dir_perms }; -+ allow $1 boot_t:dir ra_dir_perms; - allow $1 system_map_t:file { rw_file_perms create }; - ') - -@@ -4043,7 +4215,7 @@ - type var_t, var_lock_t; - ') - -- rw_dirs_pattern($1,var_t,var_lock_t) -+ rw_files_pattern($1,var_t,var_lock_t) - ') - - ######################################## -@@ -4560,6 +4732,8 @@ - # Need to give access to /selinux/member - selinux_compute_member($1) - -+ files_search_home($1) -+ - # Need sys_admin capability for mounting - allow $1 self:capability { chown fsetid sys_admin }; - -@@ -4582,6 +4756,11 @@ - # Default type for mountpoints - allow $1 poly_t:dir { create mounton }; - fs_unmount_xattr_fs($1) -+ corecmd_exec_bin($1) -+ seutil_domtrans_setfiles($1) -+ fs_mount_tmpfs($1) -+ fs_unmount_tmpfs($1) -+ - ') - - ######################################## -@@ -4619,3 +4798,28 @@ - - allow $1 { file_type -security_file_type }:dir manage_dir_perms; - ') -+ -+######################################## -+## -+## Create a core files in / -+## -+## -+##

-+## Create a core file in /, -+##

-+## -+## -+## -+## Domain allowed access. -+## -+## -+## -+# -+interface(`files_dump_core',` -+ gen_require(` -+ type root_t; -+ ') -+ -+ allow $1 root_t:dir rw_dir_perms; -+ allow $1 root_t:file { create getattr write }; -+') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.1.0/policy/modules/kernel/files.te ---- nsaserefpolicy/policy/modules/kernel/files.te 2007-10-12 08:56:01.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/files.te 2007-10-24 15:06:50.000000000 -0400 +--- nsaserefpolicy/policy/modules/kernel/files.te 2007-10-29 18:02:31.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/kernel/files.te 2007-11-06 09:28:35.000000000 -0500 @@ -55,6 +55,9 @@ # compatibility aliases for removed types: typealias etc_t alias automount_etc_t; @@ -3935,148 +3090,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # # etc_runtime_t is the type of various -@@ -188,6 +191,7 @@ - fs_associate(file_type) - fs_associate_noxattr(file_type) - fs_associate_tmpfs(file_type) -+fs_associate_ramfs(file_type) - - ######################################## - # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.1.0/policy/modules/kernel/filesystem.te ---- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-10-24 15:00:24.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/filesystem.te 2007-10-25 19:49:07.000000000 -0400 -@@ -21,6 +21,7 @@ - - # Use xattrs for the following filesystem types. - # Requires that a security xattr handler exist for the filesystem. -+fs_use_xattr ecryptfs gen_context(system_u:object_r:fs_t,s0); - fs_use_xattr encfs gen_context(system_u:object_r:fs_t,s0); - fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0); - fs_use_xattr ext3 gen_context(system_u:object_r:fs_t,s0); -@@ -28,6 +29,7 @@ - fs_use_xattr gfs2 gen_context(system_u:object_r:fs_t,s0); - fs_use_xattr jffs2 gen_context(system_u:object_r:fs_t,s0); - fs_use_xattr jfs gen_context(system_u:object_r:fs_t,s0); -+fs_use_xattr lustre gen_context(system_u:object_r:fs_t,s0); - fs_use_xattr xfs gen_context(system_u:object_r:fs_t,s0); - - # Use the allocating task SID to label inodes in the following filesystem -@@ -110,6 +112,7 @@ - - type ramfs_t; - fs_type(ramfs_t) -+files_mountpoint(ramfs_t) - genfscon ramfs / gen_context(system_u:object_r:ramfs_t,s0) - - type romfs_t; -@@ -127,6 +130,11 @@ - genfscon spufs / gen_context(system_u:object_r:spufs_t,s0) - files_mountpoint(spufs_t) - -+type squash_t; -+fs_type(squash_t) -+genfscon squash / gen_context(system_u:object_r:squash_t,s0) -+files_mountpoint(squash_t) -+ - type vxfs_t; - fs_noxattr_type(vxfs_t) - files_mountpoint(vxfs_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.1.0/policy/modules/kernel/kernel.if ---- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-08-20 18:23:04.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/kernel.if 2007-10-25 10:22:34.000000000 -0400 -@@ -352,6 +352,24 @@ - - ######################################## - ## -+## dontaudit search the kernel key ring. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`kernel_dontaudit_search_key',` -+ gen_require(` -+ type kernel_t; -+ ') -+ -+ dontaudit $1 kernel_t:key search; -+') -+ -+######################################## -+## - ## Allow link to the kernel key ring. - ## - ## -@@ -370,6 +388,24 @@ - - ######################################## - ## -+## dontaudit link to the kernel key ring. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`kernel_dontaudit_link_key',` -+ gen_require(` -+ type kernel_t; -+ ') -+ -+ dontaudit $1 kernel_t:key link; -+') -+ -+######################################## -+## - ## Allows caller to read the ring buffer. - ## - ## -@@ -1867,6 +1903,27 @@ - - ######################################## - ## -+## Read the process state (/proc/pid) of all unlabeled_t. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`kernel_read_unlabeled_state',` -+ gen_require(` -+ type unlabeled_t; -+ ') -+ -+ allow $1 unlabeled_t:dir list_dir_perms; -+ read_files_pattern($1,unlabeled_t,unlabeled_t) -+ read_lnk_files_pattern($1,unlabeled_t,unlabeled_t) -+') -+ -+ -+######################################## -+## - ## Do not audit attempts to list unlabeled directories. - ## - ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.1.0/policy/modules/kernel/kernel.te ---- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-10-12 08:56:01.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/kernel.te 2007-10-24 15:06:50.000000000 -0400 -@@ -279,6 +279,7 @@ - - optional_policy(` - logging_send_syslog_msg(kernel_t) -+ logging_unconfined(kernel_t) - ') - - optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.1.0/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-06-21 09:32:03.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/selinux.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/kernel/selinux.if 2007-11-06 09:28:35.000000000 -0500 @@ -138,6 +138,7 @@ type security_t; ') @@ -4169,7 +3185,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.te serefpolicy-3.1.0/policy/modules/kernel/selinux.te --- nsaserefpolicy/policy/modules/kernel/selinux.te 2007-07-10 12:21:05.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/selinux.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/kernel/selinux.te 2007-11-06 09:28:35.000000000 -0500 @@ -10,6 +10,7 @@ attribute can_setenforce; attribute can_setsecparam; @@ -4190,132 +3206,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu neverallow ~{ selinux_unconfined_type can_load_policy } security_t:security load_policy; neverallow ~{ selinux_unconfined_type can_setenforce } security_t:security setenforce; neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.1.0/policy/modules/kernel/storage.fc ---- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-08-11 06:22:32.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/storage.fc 2007-10-24 15:06:50.000000000 -0400 -@@ -39,6 +39,7 @@ - ') - /dev/s(cd|r)[^/]* -b gen_context(system_u:object_r:removable_device_t,s0) - /dev/sbpcd.* -b gen_context(system_u:object_r:removable_device_t,s0) -+/dev/bsg/.+ -c gen_context(system_u:object_r:scsi_generic_device_t,s0) - /dev/sg[0-9]+ -c gen_context(system_u:object_r:scsi_generic_device_t,s0) - /dev/sjcd -b gen_context(system_u:object_r:removable_device_t,s0) - /dev/sonycd -b gen_context(system_u:object_r:removable_device_t,s0) -@@ -52,7 +53,7 @@ - - /dev/cciss/[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) - --/dev/fuse -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) -+/dev/fuse -c gen_context(system_u:object_r:fuse_device_t,mls_systemhigh) - /dev/floppy/[^/]* -b gen_context(system_u:object_r:removable_device_t,s0) - - /dev/i2o/hd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.1.0/policy/modules/kernel/storage.if ---- nsaserefpolicy/policy/modules/kernel/storage.if 2007-08-11 06:22:32.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/storage.if 2007-10-24 15:06:50.000000000 -0400 -@@ -673,3 +673,61 @@ - - typeattribute $1 storage_unconfined_type; - ') -+ -+######################################## -+## -+## Allow the caller to get the attributes -+## of device nodes of fuse devices. -+## -+## -+## -+## The type of the process performing this action. -+## -+## -+# -+interface(`storage_getattr_fuse_dev',` -+ gen_require(` -+ type fuse_device_t; -+ ') -+ -+ dev_list_all_dev_nodes($1) -+ allow $1 fuse_device_t:chr_file getattr; -+') -+ -+######################################## -+## -+## read or write fuse device interfaces. -+## -+## -+## -+## Domain to not audit. -+## -+## -+# -+interface(`storage_rw_fuse',` -+ gen_require(` -+ type fuse_device_t; -+ ') -+ -+ allow $1 fuse_device_t:chr_file rw_file_perms; -+') -+ -+######################################## -+## -+## Do not audit attempts to read or write -+## fuse device interfaces. -+## -+## -+## -+## Domain to not audit. -+## -+## -+# -+interface(`storage_dontaudit_rw_fuse',` -+ gen_require(` -+ type fuse_device_t; -+ ') -+ -+ dontaudit $1 fuse_device_t:chr_file rw_file_perms; -+') -+ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.te serefpolicy-3.1.0/policy/modules/kernel/storage.te ---- nsaserefpolicy/policy/modules/kernel/storage.te 2007-10-02 09:54:49.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/storage.te 2007-10-24 15:06:50.000000000 -0400 -@@ -23,6 +23,12 @@ - neverallow ~{ fixed_disk_raw_write storage_unconfined_type } fixed_disk_device_t:{ chr_file blk_file } { append write }; - - # -+# fuse_device_t is the type of /dev/fuse -+# -+type fuse_device_t; -+dev_node(fuse_device_t) -+ -+# - # scsi_generic_device_t is the type of /dev/sg* - # it gives access to ALL SCSI devices (both fixed and removable) - # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.1.0/policy/modules/kernel/terminal.fc ---- nsaserefpolicy/policy/modules/kernel/terminal.fc 2007-01-02 12:57:13.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/kernel/terminal.fc 2007-10-24 15:06:50.000000000 -0400 -@@ -8,6 +8,7 @@ - /dev/dcbri[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0) - /dev/hvc.* -c gen_context(system_u:object_r:tty_device_t,s0) - /dev/hvsi.* -c gen_context(system_u:object_r:tty_device_t,s0) -+/dev/i2c[^/]* -c gen_context(system_u:object_r:tty_device_t,s0) - /dev/ircomm[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0) - /dev/ip2[^/]* -c gen_context(system_u:object_r:tty_device_t,s0) - /dev/isdn.* -c gen_context(system_u:object_r:tty_device_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.1.0/policy/modules/kernel/terminal.te ---- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-10-12 08:56:01.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/kernel/terminal.te 2007-10-24 15:06:50.000000000 -0400 -@@ -28,6 +28,7 @@ - type devpts_t; - files_mountpoint(devpts_t) - fs_associate_tmpfs(devpts_t) -+files_associate_tmp(devpts_t) - fs_type(devpts_t) - fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0); - diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.1.0/policy/modules/services/amavis.te --- nsaserefpolicy/policy/modules/services/amavis.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/amavis.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/amavis.te 2007-11-06 09:28:35.000000000 -0500 @@ -65,6 +65,7 @@ # Spool Files manage_dirs_pattern(amavis_t,amavis_spool_t,amavis_spool_t) @@ -4334,7 +3227,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav dev_read_rand(amavis_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.1.0/policy/modules/services/apache.fc --- nsaserefpolicy/policy/modules/services/apache.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/apache.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/apache.fc 2007-11-06 09:28:35.000000000 -0500 @@ -16,7 +16,6 @@ /usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0) @@ -4362,7 +3255,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +/etc/rc\.d/init\.d/httpd -- gen_context(system_u:object_r:httpd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.1.0/policy/modules/services/apache.if --- nsaserefpolicy/policy/modules/services/apache.if 2007-10-23 17:17:42.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/apache.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/apache.if 2007-11-07 12:47:31.000000000 -0500 @@ -18,10 +18,6 @@ attribute httpd_script_exec_type; type httpd_t, httpd_suexec_t, httpd_log_t; @@ -4451,7 +3344,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac optional_policy(` tunable_policy(`httpd_enable_cgi && allow_ypbind',` nis_use_ypbind_uncond(httpd_$1_script_t) -@@ -761,6 +710,7 @@ +@@ -352,12 +301,11 @@ + # + template(`apache_read_user_scripts',` + gen_require(` +- type httpd_$1_script_exec_t; ++ attribute httpd_user_script_exec_type; + ') +- +- allow $2 httpd_$1_script_exec_t:dir list_dir_perms; +- read_files_pattern($2,httpd_$1_script_exec_t,httpd_$1_script_exec_t) +- read_lnk_files_pattern($2,httpd_$1_script_exec_t,httpd_$1_script_exec_t) ++ allow $2 httpd_user_script_exec_type:dir list_dir_perms; ++ read_files_pattern($2,httpd_user_script_exec_type,httpd_user_script_exec_type) ++ read_lnk_files_pattern($2,httpd_user_script_exec_type,httpd_user_script_exec_type) + ') + + ######################################## +@@ -378,12 +326,12 @@ + # + template(`apache_read_user_content',` + gen_require(` +- type httpd_$1_content_t; ++ attribute httpd_user_content_type; + ') + +- allow $2 httpd_$1_content_t:dir list_dir_perms; +- read_files_pattern($2,httpd_$1_content_t,httpd_$1_content_t) +- read_lnk_files_pattern($2,httpd_$1_content_t,httpd_$1_content_t) ++ allow $2 httpd_user_content_type:dir list_dir_perms; ++ read_files_pattern($2,httpd_user_content_type,httpd_user_content_type) ++ read_lnk_files_pattern($2,httpd_user_content_type,httpd_user_content_type) + ') + + ######################################## +@@ -761,6 +709,7 @@ ') allow $1 httpd_modules_t:dir list_dir_perms; @@ -4459,7 +3386,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -845,6 +795,10 @@ +@@ -845,6 +794,10 @@ type httpd_sys_script_t; ') @@ -4470,7 +3397,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_cgi && httpd_unified',` domtrans_pattern($1, httpdcontent, httpd_sys_script_t) ') -@@ -932,7 +886,7 @@ +@@ -932,7 +885,7 @@ type httpd_squirrelmail_t; ') @@ -4479,7 +3406,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -1088,3 +1042,144 @@ +@@ -1088,3 +1041,138 @@ allow httpd_t $1:process signal; ') @@ -4565,69 +3492,63 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +interface(`apache_admin',` + + gen_require(` -+ type httpd_t; -+ type httpd_bool_t; -+ type httpd_script_exec_t; -+ type httpd_config_t; -+ type httpd_log_t; -+ type httpd_modules_t; -+ type httpd_lock_t; ++ type httpd_t, httpd_script_exec_t, httpd_config_t; ++ type httpd_log_t, httpd_modules_t, httpd_lock_t; + type httpd_var_run_t; + attribute httpdcontent; + attribute httpd_script_exec_type; ++ type httpd_bool_t; + ') + -+ allow $2 httpd_t:process { getattr ptrace signal_perms }; ++ allow $1 httpd_t:process { getattr ptrace signal_perms }; + -+ # Allow $2 to restart the apache service -+ apache_script_domtrans($2) -+ domain_system_change_exemption($2) -+ role_transition $3 httpd_script_exec_t system_r; -+ allow $3 system_r; ++ # Allow $1 to restart the apache service ++ apache_script_domtrans($1) ++ domain_system_change_exemption($1) ++ role_transition $2 httpd_script_exec_t system_r; ++ allow $2 system_r; + -+ apache_manage_all_content($2) ++ apache_manage_all_content($1) + -+ files_search_etc($2) -+ manage_dirs_pattern($2,httpd_config_t,httpd_config_t) -+ manage_files_pattern($2,httpd_config_t,httpd_config_t) -+ read_lnk_files_pattern($2,httpd_config_t,httpd_config_t) ++ files_search_etc($1) ++ manage_dirs_pattern($1,httpd_config_t,httpd_config_t) ++ manage_files_pattern($1,httpd_config_t,httpd_config_t) ++ read_lnk_files_pattern($1,httpd_config_t,httpd_config_t) + -+ logging_search_logs($2) -+ manage_dirs_pattern($2,httpd_log_t,httpd_log_t) -+ manage_files_pattern($2,httpd_log_t,httpd_log_t) -+ read_lnk_files_pattern($2,httpd_log_t,httpd_log_t) ++ logging_search_logs($1) ++ manage_dirs_pattern($1,httpd_log_t,httpd_log_t) ++ manage_files_pattern($1,httpd_log_t,httpd_log_t) ++ read_lnk_files_pattern($1,httpd_log_t,httpd_log_t) + -+ manage_dirs_pattern($2,httpd_modules_t,httpd_modules_t) -+ manage_files_pattern($2,httpd_modules_t,httpd_modules_t) -+ manage_lnk_files_pattern($2,httpd_modules_t,httpd_modules_t) ++ manage_dirs_pattern($1,httpd_modules_t,httpd_modules_t) ++ manage_files_pattern($1,httpd_modules_t,httpd_modules_t) ++ manage_lnk_files_pattern($1,httpd_modules_t,httpd_modules_t) + -+ allow $2 httpd_lock_t:file manage_file_perms; -+ files_lock_filetrans($2, httpd_lock_t, file) ++ allow $1 httpd_lock_t:file manage_file_perms; ++ files_lock_filetrans($1, httpd_lock_t, file) + -+ manage_files_pattern($2,httpd_var_run_t,httpd_var_run_t) -+ files_pid_filetrans($2,httpd_var_run_t, file) ++ manage_files_pattern($1,httpd_var_run_t,httpd_var_run_t) ++ files_pid_filetrans($1,httpd_var_run_t, file) + -+ kernel_search_proc($2) -+ allow $2 httpd_t:dir list_dir_perms; -+ read_files_pattern($2,httpd_t,httpd_t) -+ read_lnk_files_pattern($2,httpd_t,httpd_t) ++ kernel_search_proc($1) ++ allow $1 httpd_t:dir list_dir_perms; ++ read_files_pattern($1,httpd_t,httpd_t) ++ read_lnk_files_pattern($1,httpd_t,httpd_t) + -+ allow $2 { httpd_script_exec_type httpdcontent}:dir { relabelto relabelfrom }; -+ allow $2 { httpd_script_exec_type httpdcontent}:file { relabelto relabelfrom }; ++ allow $1 { httpd_script_exec_type httpdcontent}:dir { relabelto relabelfrom }; ++ allow $1 { httpd_script_exec_type httpdcontent}:file { relabelto relabelfrom }; + -+ seutil_domtrans_setfiles($2) ++ seutil_domtrans_setfiles($1) + -+ seutil_setsebool_per_role_template($1, $2, $3) -+ allow $1_setsebool_t httpd_bool_t:dir list_dir_perms; -+ allow $1_setsebool_t httpd_bool_t:file rw_file_perms; ++# apache_set_booleans($1, $2, $3, httpd_bool_t ) ++# seutil_setsebool_per_role_template($1, httpd, $3) ++# allow httpd_setsebool_t httpd_bool_t:dir list_dir_perms; ++# allow httpd_setsebool_t httpd_bool_t:file rw_file_perms; +') -+ -+ -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.1.0/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2007-10-23 07:37:52.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/apache.te 2007-10-24 15:06:50.000000000 -0400 -@@ -20,6 +20,8 @@ ++++ serefpolicy-3.1.0/policy/modules/services/apache.te 2007-11-06 09:28:35.000000000 -0500 +@@ -20,16 +20,25 @@ # Declarations # @@ -4636,11 +3557,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ## ##

## Allow Apache to modify public files -@@ -30,6 +32,13 @@ +-## used for public file transfer services. ++## used for public file transfer services. Directories/Files must be labeled public_content_rw_t. + ##

+ ## + gen_tunable(allow_httpd_anon_write,false) ## ##

-+## Allow Apache to communicate with avahi via dbus ++## Allow Apache to communicate with avahi service via dbus +##

+## +gen_tunable(allow_httpd_dbus_avahi,false) @@ -4684,7 +3609,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + +## +##

-+## Allow apache scripts to write to public content ++## Allow apache scripts to write to public content. Directories/Files must be labeled public_content_rw_t. +##

+## +gen_tunable(allow_httpd_sys_script_anon_write,false) @@ -4776,17 +3701,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_can_network_connect_db',` # allow httpd to connect to mysql/posgresql corenet_tcp_connect_postgresql_port(httpd_t) -@@ -389,6 +442,17 @@ +@@ -389,6 +442,10 @@ corenet_sendrecv_http_cache_client_packets(httpd_t) ') -+tunable_policy(`httpd_enable_cgi',` -+ domtrans_pattern(httpd_t, httpd_unconfined_script_exec_t, httpd_unconfined_script_t) -+ -+ allow httpd_t httpd_unconfined_script_t:process { signal sigkill sigstop }; -+ allow httpd_t httpd_unconfined_script_exec_t:dir list_dir_perms; -+') -+ +tunable_policy(`allow_httpd_sys_script_anon_write',` + miscfiles_manage_public_files(httpd_sys_script_t) +') @@ -4794,7 +3712,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',` domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t) -@@ -406,11 +470,21 @@ +@@ -406,11 +463,21 @@ fs_read_nfs_symlinks(httpd_t) ') @@ -4816,7 +3734,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_ssi_exec',` corecmd_shell_domtrans(httpd_t,httpd_sys_script_t) allow httpd_sys_script_t httpd_t:fd use; -@@ -432,6 +506,12 @@ +@@ -432,6 +499,12 @@ ') optional_policy(` @@ -4829,12 +3747,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac calamaris_read_www_files(httpd_t) ') -@@ -444,8 +524,15 @@ +@@ -444,8 +517,14 @@ ') optional_policy(` + dbus_system_bus_client_template(httpd,httpd_t) -+ dbus_send_system_bus(httpd_t) + tunable_policy(`allow_httpd_dbus_avahi',` + avahi_dbus_chat(httpd_t) + ') @@ -4846,7 +3763,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') optional_policy(` -@@ -459,11 +546,11 @@ +@@ -459,11 +538,11 @@ optional_policy(` mysql_stream_connect(httpd_t) mysql_rw_db_sockets(httpd_t) @@ -4859,7 +3776,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') optional_policy(` -@@ -483,6 +570,7 @@ +@@ -483,6 +562,7 @@ ') optional_policy(` @@ -4867,7 +3784,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac snmp_dontaudit_read_snmp_var_lib_files(httpd_t) snmp_dontaudit_write_snmp_var_lib_files(httpd_t) ') -@@ -518,6 +606,13 @@ +@@ -518,6 +598,13 @@ userdom_use_sysadm_terms(httpd_helper_t) ') @@ -4881,7 +3798,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ######################################## # # Apache PHP script local policy -@@ -555,6 +650,7 @@ +@@ -555,6 +642,7 @@ optional_policy(` mysql_stream_connect(httpd_php_t) @@ -4889,7 +3806,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') optional_policy(` -@@ -569,7 +665,6 @@ +@@ -569,7 +657,6 @@ allow httpd_suexec_t self:capability { setuid setgid }; allow httpd_suexec_t self:process signal_perms; allow httpd_suexec_t self:unix_stream_socket create_stream_socket_perms; @@ -4897,7 +3814,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac domtrans_pattern(httpd_t, httpd_suexec_exec_t, httpd_suexec_t) -@@ -583,6 +678,10 @@ +@@ -583,6 +670,10 @@ manage_files_pattern(httpd_suexec_t,httpd_suexec_tmp_t,httpd_suexec_tmp_t) files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir }) @@ -4908,19 +3825,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac kernel_read_kernel_sysctls(httpd_suexec_t) kernel_list_proc(httpd_suexec_t) kernel_read_proc_symlinks(httpd_suexec_t) -@@ -622,8 +721,10 @@ +@@ -622,8 +713,6 @@ corenet_udp_sendrecv_all_ports(httpd_suexec_t) corenet_tcp_connect_all_ports(httpd_suexec_t) corenet_sendrecv_all_client_packets(httpd_suexec_t) -+') - +- - sysnet_read_config(httpd_suexec_t) -+tunable_policy(`httpd_enable_cgi',` -+ domtrans_pattern(httpd_suexec_t, httpd_unconfined_script_exec_t, httpd_unconfined_script_t) ') tunable_policy(`httpd_enable_cgi && httpd_unified',` -@@ -636,6 +737,12 @@ +@@ -636,6 +725,12 @@ fs_exec_nfs_files(httpd_suexec_t) ') @@ -4933,7 +3847,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_suexec_t) fs_read_cifs_symlinks(httpd_suexec_t) -@@ -653,18 +760,6 @@ +@@ -653,18 +748,6 @@ dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write }; ') @@ -4952,7 +3866,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ######################################## # # Apache system script local policy -@@ -674,7 +769,8 @@ +@@ -674,7 +757,8 @@ dontaudit httpd_sys_script_t httpd_config_t:dir search; @@ -4962,7 +3876,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms; read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t) -@@ -688,15 +784,62 @@ +@@ -688,15 +772,62 @@ # Should we add a boolean? apache_domtrans_rotatelogs(httpd_sys_script_t) @@ -5026,7 +3940,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_sys_script_t) fs_read_cifs_symlinks(httpd_sys_script_t) -@@ -709,6 +852,7 @@ +@@ -709,6 +840,7 @@ optional_policy(` mysql_stream_connect(httpd_sys_script_t) mysql_rw_db_sockets(httpd_sys_script_t) @@ -5034,7 +3948,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -730,3 +874,20 @@ +@@ -730,3 +862,20 @@ logging_search_logs(httpd_rotatelogs_t) miscfiles_read_localization(httpd_rotatelogs_t) @@ -5057,7 +3971,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.1.0/policy/modules/services/apcupsd.if --- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-09-12 10:34:18.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/apcupsd.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/apcupsd.if 2007-11-06 09:28:35.000000000 -0500 @@ -90,10 +90,29 @@ ## ## @@ -5091,7 +4005,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.1.0/policy/modules/services/apcupsd.te --- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/apcupsd.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/apcupsd.te 2007-11-06 09:28:35.000000000 -0500 @@ -86,6 +86,11 @@ miscfiles_read_localization(apcupsd_t) @@ -5106,7 +4020,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.te serefpolicy-3.1.0/policy/modules/services/asterisk.te --- nsaserefpolicy/policy/modules/services/asterisk.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/asterisk.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/asterisk.te 2007-11-06 09:28:35.000000000 -0500 @@ -98,6 +98,7 @@ # for VOIP voice channels. corenet_tcp_bind_generic_port(asterisk_t) @@ -5117,7 +4031,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aste dev_read_sysfs(asterisk_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.if serefpolicy-3.1.0/policy/modules/services/automount.if --- nsaserefpolicy/policy/modules/services/automount.if 2007-03-26 10:39:04.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/automount.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/automount.if 2007-11-06 09:28:35.000000000 -0500 @@ -74,3 +74,21 @@ dontaudit $1 automount_tmp_t:dir getattr; @@ -5142,7 +4056,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.1.0/policy/modules/services/automount.te --- nsaserefpolicy/policy/modules/services/automount.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/automount.te 2007-10-26 09:15:09.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/automount.te 2007-11-06 09:28:35.000000000 -0500 @@ -52,7 +52,8 @@ files_root_filetrans(automount_t,automount_tmp_t,dir) @@ -5183,23 +4097,60 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.1.0/policy/modules/services/avahi.te ---- nsaserefpolicy/policy/modules/services/avahi.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/avahi.te 2007-10-24 15:06:50.000000000 -0400 -@@ -85,6 +85,7 @@ +--- nsaserefpolicy/policy/modules/services/avahi.te 2007-10-29 07:52:49.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/avahi.te 2007-11-06 15:54:43.000000000 -0500 +@@ -83,8 +83,8 @@ + optional_policy(` + dbus_system_bus_client_template(avahi,avahi_t) dbus_connect_system_bus(avahi_t) - dbus_send_system_bus(avahi_t) +- init_dbus_chat_script(avahi_t) + dbus_system_domain(avahi_t,avahi_exec_t) ') optional_policy(` +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.1.0/policy/modules/services/bind.te +--- nsaserefpolicy/policy/modules/services/bind.te 2007-10-29 07:52:49.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/bind.te 2007-11-06 09:28:35.000000000 -0500 +@@ -156,6 +156,12 @@ + ') + + optional_policy(` ++ gen_require(` ++ class dbus send_msg; ++ ') ++ ++ allow named_t self:dbus send_msg; ++ + init_dbus_chat_script(named_t) + + sysnet_dbus_chat_dhcpc(named_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.fc serefpolicy-3.1.0/policy/modules/services/bluetooth.fc +--- nsaserefpolicy/policy/modules/services/bluetooth.fc 2006-11-16 17:15:20.000000000 -0500 ++++ serefpolicy-3.1.0/policy/modules/services/bluetooth.fc 2007-11-06 09:28:35.000000000 -0500 +@@ -22,3 +22,4 @@ + # + /var/lib/bluetooth(/.*)? gen_context(system_u:object_r:bluetooth_var_lib_t,s0) + /var/run/sdp -s gen_context(system_u:object_r:bluetooth_var_run_t,s0) ++/var/run/bluetoothd_address gen_context(system_u:object_r:bluetooth_var_run_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.if serefpolicy-3.1.0/policy/modules/services/bluetooth.if +--- nsaserefpolicy/policy/modules/services/bluetooth.if 2007-10-29 07:52:49.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/bluetooth.if 2007-11-06 09:28:35.000000000 -0500 +@@ -97,7 +97,6 @@ + + optional_policy(` + bluetooth_dbus_chat($1_bluetooth_t) +- + dbus_system_bus_client_template($1_bluetooth, $1_bluetooth_t) + dbus_connect_system_bus($1_bluetooth_t) + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.1.0/policy/modules/services/bluetooth.te ---- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/bluetooth.te 2007-10-24 15:06:50.000000000 -0400 -@@ -128,6 +128,8 @@ +--- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-10-29 07:52:49.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/bluetooth.te 2007-11-06 09:28:35.000000000 -0500 +@@ -127,6 +127,8 @@ + optional_policy(` dbus_system_bus_client_template(bluetooth,bluetooth_t) dbus_connect_system_bus(bluetooth_t) - dbus_send_system_bus(bluetooth_t) + allow bluetooth_t self:dbus send_msg; + dbus_system_domain(bluetooth_t,bluetooth_exec_t) ') @@ -5207,7 +4158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.1.0/policy/modules/services/clamav.te --- nsaserefpolicy/policy/modules/services/clamav.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/clamav.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/clamav.te 2007-11-06 09:28:35.000000000 -0500 @@ -87,6 +87,7 @@ kernel_dontaudit_list_proc(clamd_t) kernel_read_sysctl(clamd_t) @@ -5221,7 +4172,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam ') +optional_policy(` -+ exim_read_spool(clamd_t) ++ exim_read_spool_files(clamd_t) +') + ######################################## @@ -5237,7 +4188,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.if serefpolicy-3.1.0/policy/modules/services/consolekit.if --- nsaserefpolicy/policy/modules/services/consolekit.if 2007-03-20 09:23:13.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/consolekit.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/consolekit.if 2007-11-06 09:28:35.000000000 -0500 @@ -38,3 +38,24 @@ allow $1 consolekit_t:dbus send_msg; allow consolekit_t $1:dbus send_msg; @@ -5264,8 +4215,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons + dontaudit consolekit_t $1:dbus send_msg; +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.1.0/policy/modules/services/consolekit.te ---- nsaserefpolicy/policy/modules/services/consolekit.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/consolekit.te 2007-10-24 15:06:50.000000000 -0400 +--- nsaserefpolicy/policy/modules/services/consolekit.te 2007-10-29 07:52:49.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/consolekit.te 2007-11-06 09:28:35.000000000 -0500 @@ -10,7 +10,6 @@ type consolekit_exec_t; init_daemon_domain(consolekit_t, consolekit_exec_t) @@ -5307,8 +4258,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons + optional_policy(` dbus_system_bus_client_template(consolekit, consolekit_t) - dbus_send_system_bus(consolekit_t) -@@ -68,3 +76,8 @@ + dbus_connect_system_bus(consolekit_t) +@@ -67,3 +75,8 @@ xserver_read_all_users_xauth(consolekit_t) xserver_stream_connect_xdm_xserver(consolekit_t) ') @@ -5319,7 +4270,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.1.0/policy/modules/services/courier.te --- nsaserefpolicy/policy/modules/services/courier.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/courier.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/courier.te 2007-11-06 09:28:35.000000000 -0500 @@ -58,6 +58,7 @@ files_getattr_tmp_dirs(courier_authdaemon_t) @@ -5330,7 +4281,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cour diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cpucontrol.te serefpolicy-3.1.0/policy/modules/services/cpucontrol.te --- nsaserefpolicy/policy/modules/services/cpucontrol.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/cpucontrol.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/cpucontrol.te 2007-11-06 09:28:35.000000000 -0500 @@ -63,6 +63,10 @@ ') @@ -5344,7 +4295,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cpuc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.1.0/policy/modules/services/cron.fc --- nsaserefpolicy/policy/modules/services/cron.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/cron.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/cron.fc 2007-11-06 09:28:35.000000000 -0500 @@ -17,6 +17,8 @@ /var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0) /var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) @@ -5361,7 +4312,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron +/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.1.0/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/cron.if 2007-10-26 09:03:28.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/cron.if 2007-11-06 09:28:35.000000000 -0500 @@ -35,6 +35,7 @@ # template(`cron_per_role_template',` @@ -5388,7 +4339,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # The entrypoint interface is not used as this is not # a regular entrypoint. Since crontab files are -@@ -138,51 +137,32 @@ +@@ -119,6 +118,8 @@ + # for nscd: + files_dontaudit_search_pids($1_crond_t) + ++ auth_use_nsswitch($1_crond_t) ++ + libs_use_ld_so($1_crond_t) + libs_use_shared_libs($1_crond_t) + libs_exec_lib_files($1_crond_t) +@@ -138,52 +139,25 @@ userdom_manage_user_tmp_symlinks($1,$1_crond_t) userdom_manage_user_tmp_pipes($1,$1_crond_t) userdom_manage_user_tmp_sockets($1,$1_crond_t) @@ -5421,17 +4381,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron - ') - optional_policy(` - nis_use_ypbind($1_crond_t) +- nis_use_ypbind($1_crond_t) ++ mta_send_mail($1_crond_t) ') - ifdef(`TODO',` - optional_policy(` +- optional_policy(` - create_dir_file($1_crond_t, httpd_$1_content_t) -+ mta_send_mail($1_crond_t) - ') +- ') - allow $1_crond_t tmp_t:dir rw_dir_perms; - type_transition $1_crond_t $1_tmp_t:{ file lnk_file sock_file fifo_file } $1_tmp_t; - +- - ifdef(`mta.te', ` - domain_auto_trans($1_crond_t, sendmail_exec_t, $1_mail_t) - allow $1_crond_t sendmail_exec_t:lnk_file read_lnk_file_perms; @@ -5439,14 +4399,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron - # $1_mail_t should only be reading from the cron fifo not needing to write - dontaudit $1_mail_t crond_t:fifo_file write; - allow mta_user_agent $1_crond_t:fd use; -+ optional_policy(` -+ nscd_socket_use($1_crond_t) - ') +- ') - ') dnl endif TODO - +- ############################## # -@@ -192,9 +172,13 @@ + # $1_crontab_t local policy +@@ -192,9 +166,13 @@ # dac_override is to create the file in the directory under /tmp allow $1_crontab_t self:capability { fowner setuid setgid chown dac_override }; allow $1_crontab_t self:process signal_perms; @@ -5456,11 +4415,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron domtrans_pattern($2, crontab_exec_t, $1_crontab_t) + allow $2 $1_crontab_t:fd use; + -+ auth_domtrans_upd_passwd_chk($1_crontab_t) ++ auth_domtrans_chk_passwd($1_crontab_t) # crontab shows up in user ps ps_process_pattern($2,$1_crontab_t) -@@ -205,9 +189,6 @@ +@@ -205,9 +183,6 @@ # Allow crond to read those crontabs in cron spool. allow crond_t $1_cron_spool_t:file manage_file_perms; @@ -5470,7 +4429,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # create files in /var/spool/cron manage_files_pattern($1_crontab_t,cron_spool_t,$1_cron_spool_t) filetrans_pattern($1_crontab_t,cron_spool_t,$1_cron_spool_t,file) -@@ -236,6 +217,7 @@ +@@ -236,6 +211,7 @@ libs_use_shared_libs($1_crontab_t) logging_send_syslog_msg($1_crontab_t) @@ -5478,7 +4437,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron miscfiles_read_localization($1_crontab_t) -@@ -243,10 +225,12 @@ +@@ -243,10 +219,12 @@ userdom_manage_user_tmp_dirs($1,$1_crontab_t) userdom_manage_user_tmp_files($1,$1_crontab_t) @@ -5491,7 +4450,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron tunable_policy(`fcron_crond',` # fcron wants an instant update of a crontab change for the administrator -@@ -438,6 +422,25 @@ +@@ -438,6 +416,25 @@ ######################################## ## @@ -5519,7 +4478,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.1.0/policy/modules/services/cron.te --- nsaserefpolicy/policy/modules/services/cron.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/cron.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/cron.te 2007-11-06 09:28:35.000000000 -0500 @@ -50,6 +50,7 @@ type crond_tmp_t; @@ -5575,16 +4534,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron dev_read_sysfs(crond_t) selinux_get_fs_mount(crond_t) -@@ -127,6 +136,8 @@ +@@ -127,6 +136,7 @@ # need auth_chkpwd to check for locked accounts. auth_domtrans_chk_passwd(crond_t) +auth_domtrans_upd_passwd_chk(crond_t) -+auth_search_key(crond_t) corecmd_exec_shell(crond_t) corecmd_list_bin(crond_t) -@@ -146,7 +157,9 @@ +@@ -146,7 +156,9 @@ libs_use_ld_so(crond_t) libs_use_shared_libs(crond_t) @@ -5594,7 +4552,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron seutil_read_config(crond_t) seutil_read_default_contexts(crond_t) -@@ -160,6 +173,16 @@ +@@ -160,6 +172,16 @@ mta_send_mail(crond_t) @@ -5611,7 +4569,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ifdef(`distro_debian',` optional_policy(` # Debian logcheck has the home dir set to its cache -@@ -180,29 +203,34 @@ +@@ -180,29 +202,34 @@ locallogin_link_keys(crond_t) ') @@ -5654,7 +4612,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') optional_policy(` -@@ -270,9 +298,16 @@ +@@ -270,9 +297,16 @@ filetrans_pattern(system_crond_t,crond_tmp_t,system_crond_tmp_t,{ file lnk_file }) files_tmp_filetrans(system_crond_t,system_crond_tmp_t,file) @@ -5672,7 +4630,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron kernel_read_kernel_sysctls(system_crond_t) kernel_read_system_state(system_crond_t) -@@ -326,7 +361,7 @@ +@@ -326,7 +360,7 @@ init_read_utmp(system_crond_t) init_dontaudit_rw_utmp(system_crond_t) # prelink tells init to restart it self, we either need to allow or dontaudit @@ -5681,7 +4639,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron libs_use_ld_so(system_crond_t) libs_use_shared_libs(system_crond_t) -@@ -334,6 +369,7 @@ +@@ -334,6 +368,7 @@ libs_exec_ld_so(system_crond_t) logging_read_generic_logs(system_crond_t) @@ -5689,7 +4647,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron logging_send_syslog_msg(system_crond_t) miscfiles_read_localization(system_crond_t) -@@ -384,6 +420,14 @@ +@@ -384,6 +419,14 @@ ') optional_policy(` @@ -5704,7 +4662,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron mrtg_append_create_logs(system_crond_t) ') -@@ -424,8 +468,7 @@ +@@ -424,8 +467,7 @@ ') optional_policy(` @@ -5714,7 +4672,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') optional_policy(` -@@ -433,9 +476,13 @@ +@@ -433,9 +475,13 @@ ') optional_policy(` @@ -5731,7 +4689,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ifdef(`TODO',` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.1.0/policy/modules/services/cups.fc --- nsaserefpolicy/policy/modules/services/cups.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/cups.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/cups.fc 2007-11-06 09:28:35.000000000 -0500 @@ -8,17 +8,14 @@ /etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -5779,9 +4737,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups -/var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) +/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.1.0/policy/modules/services/cups.te ---- nsaserefpolicy/policy/modules/services/cups.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/cups.te 2007-10-25 10:21:03.000000000 -0400 -@@ -48,9 +48,8 @@ +--- nsaserefpolicy/policy/modules/services/cups.te 2007-10-29 07:52:49.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/cups.te 2007-11-06 09:28:35.000000000 -0500 +@@ -48,9 +48,7 @@ type hplip_t; type hplip_exec_t; init_daemon_domain(hplip_t,hplip_exec_t) @@ -5789,11 +4747,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups -type hplip_etc_t; -files_config_file(hplip_etc_t) +domtrans_pattern(cupsd_t,hplip_exec_t, hplip_t) -+domtrans_pattern(cupsd_config_t,hplip_exec_t, hplip_t) type hplip_var_run_t; files_pid_file(hplip_var_run_t) -@@ -81,12 +80,11 @@ +@@ -81,12 +79,11 @@ # /usr/lib/cups/backend/serial needs sys_admin(?!) allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config }; dontaudit cupsd_t self:capability { sys_tty_config net_admin }; @@ -5807,7 +4764,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups allow cupsd_t self:tcp_socket create_stream_socket_perms; allow cupsd_t self:udp_socket create_socket_perms; allow cupsd_t self:appletalk_socket create_socket_perms; -@@ -105,7 +103,7 @@ +@@ -105,7 +102,7 @@ # allow cups to execute its backend scripts can_exec(cupsd_t, cupsd_exec_t) @@ -5816,7 +4773,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups allow cupsd_t cupsd_exec_t:lnk_file read; manage_files_pattern(cupsd_t,cupsd_log_t,cupsd_log_t) -@@ -122,13 +120,13 @@ +@@ -122,13 +119,13 @@ manage_sock_files_pattern(cupsd_t,cupsd_var_run_t,cupsd_var_run_t) files_pid_filetrans(cupsd_t,cupsd_var_run_t,file) @@ -5832,7 +4789,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups kernel_read_system_state(cupsd_t) kernel_read_network_state(cupsd_t) kernel_read_all_sysctls(cupsd_t) -@@ -150,21 +148,26 @@ +@@ -150,21 +147,26 @@ corenet_tcp_bind_reserved_port(cupsd_t) corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t) corenet_tcp_connect_all_ports(cupsd_t) @@ -5860,15 +4817,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups mls_file_downgrade(cupsd_t) mls_file_write_all_levels(cupsd_t) mls_file_read_all_levels(cupsd_t) -@@ -174,6 +177,7 @@ - term_search_ptys(cupsd_t) - - auth_domtrans_chk_passwd(cupsd_t) -+auth_domtrans_upd_passwd_chk(cupsd_t) - auth_dontaudit_read_pam_pid(cupsd_t) - - # Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp -@@ -187,7 +191,7 @@ +@@ -187,7 +189,7 @@ # read python modules files_read_usr_files(cupsd_t) # for /var/lib/defoma @@ -5877,7 +4826,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups files_list_world_readable(cupsd_t) files_read_world_readable_files(cupsd_t) files_read_world_readable_symlinks(cupsd_t) -@@ -196,12 +200,9 @@ +@@ -196,12 +198,9 @@ files_read_var_symlinks(cupsd_t) # for /etc/printcap files_dontaudit_write_etc_files(cupsd_t) @@ -5891,7 +4840,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups init_exec_script_files(cupsd_t) -@@ -221,17 +222,37 @@ +@@ -221,17 +220,37 @@ sysnet_read_config(cupsd_t) @@ -5929,7 +4878,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups apm_domtrans_client(cupsd_t) ') -@@ -263,16 +284,16 @@ +@@ -262,16 +281,16 @@ ') optional_policy(` @@ -5950,7 +4899,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups seutil_sigchld_newrole(cupsd_t) ') -@@ -331,6 +352,7 @@ +@@ -291,7 +310,9 @@ + allow cupsd_config_t self:unix_stream_socket create_socket_perms; + allow cupsd_config_t self:unix_dgram_socket create_socket_perms; + allow cupsd_config_t self:tcp_socket create_stream_socket_perms; +-allow cupsd_config_t self:netlink_route_socket r_netlink_socket_perms; ++ ++allow cupsd_config_t hplip_exec_t:file read_file_perms; ++domtrans_pattern(cupsd_config_t,hplip_exec_t, hplip_t) + + allow cupsd_config_t cupsd_t:process signal; + ps_process_pattern(cupsd_config_t,cupsd_t) +@@ -330,6 +351,7 @@ dev_read_sysfs(cupsd_config_t) dev_read_urand(cupsd_config_t) dev_read_rand(cupsd_config_t) @@ -5958,7 +4918,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups fs_getattr_all_fs(cupsd_config_t) fs_search_auto_mountpoints(cupsd_config_t) -@@ -377,6 +399,14 @@ +@@ -354,6 +376,8 @@ + + logging_send_syslog_msg(cupsd_config_t) + ++auth_use_nsswitch(cupsd_config_t) ++ + miscfiles_read_localization(cupsd_config_t) + + seutil_dontaudit_search_config(cupsd_config_t) +@@ -376,6 +400,14 @@ ') optional_policy(` @@ -5973,7 +4942,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups cron_system_entry(cupsd_config_t, cupsd_config_exec_t) ') -@@ -393,6 +423,7 @@ +@@ -391,6 +423,7 @@ optional_policy(` hal_domtrans(cupsd_config_t) hal_read_tmp_files(cupsd_config_t) @@ -5981,7 +4950,54 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups ') optional_policy(` -@@ -525,11 +556,9 @@ +@@ -402,14 +435,6 @@ + ') + + optional_policy(` +- nis_use_ypbind(cupsd_config_t) +-') +- +-optional_policy(` +- nscd_socket_use(cupsd_config_t) +-') +- +-optional_policy(` + rpm_read_db(cupsd_config_t) + ') + +@@ -430,7 +455,6 @@ + allow cupsd_lpd_t self:fifo_file rw_fifo_file_perms; + allow cupsd_lpd_t self:tcp_socket connected_stream_socket_perms; + allow cupsd_lpd_t self:udp_socket create_socket_perms; +-allow cupsd_lpd_t self:netlink_route_socket r_netlink_socket_perms; + + # for identd + # cjp: this should probably only be inetd_child rules? +@@ -480,6 +504,8 @@ + + files_read_etc_files(cupsd_lpd_t) + ++auth_use_nsswitch(cupsd_lpd_t) ++ + libs_use_ld_so(cupsd_lpd_t) + libs_use_shared_libs(cupsd_lpd_t) + +@@ -495,14 +521,6 @@ + inetd_service_domain(cupsd_lpd_t,cupsd_lpd_exec_t) + ') + +-optional_policy(` +- nis_use_ypbind(cupsd_lpd_t) +-') +- +-optional_policy(` +- nscd_socket_use(cupsd_lpd_t) +-') +- + ######################################## + # + # HPLIP local policy +@@ -523,11 +541,9 @@ allow hplip_t cupsd_etc_t:dir search; cups_stream_connect(hplip_t) @@ -5996,7 +5012,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t) files_pid_filetrans(hplip_t,hplip_var_run_t,file) -@@ -560,7 +589,9 @@ +@@ -558,7 +574,9 @@ dev_read_urand(hplip_t) dev_read_rand(hplip_t) dev_rw_generic_usb_dev(hplip_t) @@ -6007,7 +5023,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups fs_getattr_all_fs(hplip_t) fs_search_auto_mountpoints(hplip_t) -@@ -587,8 +618,6 @@ +@@ -585,8 +603,6 @@ userdom_dontaudit_search_sysadm_home_dirs(hplip_t) userdom_dontaudit_search_all_users_home_content(hplip_t) @@ -6016,7 +5032,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups optional_policy(` seutil_sigchld_newrole(hplip_t) ') -@@ -668,3 +697,15 @@ +@@ -666,3 +682,15 @@ optional_policy(` udev_read_db(ptal_t) ') @@ -6034,7 +5050,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.1.0/policy/modules/services/cvs.te --- nsaserefpolicy/policy/modules/services/cvs.te 2007-07-10 13:21:26.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/cvs.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/cvs.te 2007-11-06 09:28:35.000000000 -0500 @@ -16,6 +16,7 @@ type cvs_t; type cvs_exec_t; @@ -6060,8 +5076,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs. miscfiles_read_localization(cvs_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.1.0/policy/modules/services/dbus.if ---- nsaserefpolicy/policy/modules/services/dbus.if 2007-10-23 07:37:52.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/dbus.if 2007-10-24 15:06:50.000000000 -0400 +--- nsaserefpolicy/policy/modules/services/dbus.if 2007-10-29 07:52:49.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/dbus.if 2007-11-06 09:28:35.000000000 -0500 @@ -91,7 +91,7 @@ # SE-DBus specific permissions allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg; @@ -6071,14 +5087,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms; read_files_pattern($1_dbusd_t,dbusd_etc_t,dbusd_etc_t) -@@ -104,7 +104,6 @@ +@@ -104,8 +104,7 @@ domtrans_pattern($2, system_dbusd_exec_t, $1_dbusd_t) allow $2 $1_dbusd_t:process { sigkill signal }; - # cjp: this seems very broken - corecmd_bin_domtrans($1_dbusd_t, $2) +- corecmd_bin_domtrans($1_dbusd_t, $2) ++ corecmd_bin_domtrans($1_dbusd_t, $1_t) allow $1_dbusd_t $2:process sigkill; allow $2 $1_dbusd_t:fd use; + allow $2 $1_dbusd_t:fifo_file rw_fifo_file_perms; @@ -148,6 +147,7 @@ selinux_compute_user_contexts($1_dbusd_t) @@ -6096,7 +5114,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus userdom_read_user_home_content_files($1, $1_dbusd_t) ifdef(`hide_broken_symptoms', ` -@@ -293,6 +291,32 @@ +@@ -295,6 +293,32 @@ allow $2 $1_dbusd_t:dbus send_msg; ') @@ -6129,33 +5147,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ######################################## ## ## Read dbus configuration. -@@ -369,3 +393,55 @@ +@@ -371,3 +395,35 @@ allow $1 system_dbusd_t:dbus *; ') + +######################################## +## -+## dontaudit attempts to use system_dbus_t selinux_socket -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dbus_dontaudit_rw_system_selinux_socket',` -+ gen_require(` -+ type system_dbusd_t; -+ ') -+ -+ dontaudit $1 system_dbusd_t:netlink_selinux_socket { read write }; -+') -+ -+ -+ -+######################################## -+## +## Create a domain for processes +## which can be started by the system dbus +## @@ -6186,9 +5184,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus +') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.1.0/policy/modules/services/dbus.te ---- nsaserefpolicy/policy/modules/services/dbus.te 2007-10-23 07:37:52.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/dbus.te 2007-10-24 15:06:50.000000000 -0400 -@@ -121,9 +121,18 @@ +--- nsaserefpolicy/policy/modules/services/dbus.te 2007-10-29 07:52:49.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/dbus.te 2007-11-06 09:28:35.000000000 -0500 +@@ -121,6 +121,10 @@ ') optional_policy(` @@ -6199,17 +5197,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus sysnet_domtrans_dhcpc(system_dbusd_t) ') - optional_policy(` - udev_read_db(system_dbusd_t) - ') -+ -+optional_policy(` -+ unconfined_use_terminals(system_dbusd_t) -+') -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.1.0/policy/modules/services/dnsmasq.te --- nsaserefpolicy/policy/modules/services/dnsmasq.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/dnsmasq.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/dnsmasq.te 2007-11-06 09:28:35.000000000 -0500 @@ -94,3 +94,7 @@ optional_policy(` udev_read_db(dnsmasq_t) @@ -6220,8 +5210,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsm +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.1.0/policy/modules/services/dovecot.fc --- nsaserefpolicy/policy/modules/services/dovecot.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/dovecot.fc 2007-10-24 15:06:50.000000000 -0400 -@@ -17,16 +17,19 @@ ++++ serefpolicy-3.1.0/policy/modules/services/dovecot.fc 2007-11-06 10:59:40.000000000 -0500 +@@ -17,19 +17,24 @@ ifdef(`distro_debian', ` /usr/lib/dovecot/dovecot-auth -- gen_context(system_u:object_r:dovecot_auth_exec_t,s0) @@ -6241,9 +5231,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove /var/lib/dovecot(/.*)? gen_context(system_u:object_r:dovecot_var_lib_t,s0) ++/var/log/dovecot\.log.* gen_context(system_u:object_r:dovecot_var_log_t,s0) ++ + /var/spool/dovecot(/.*)? gen_context(system_u:object_r:dovecot_spool_t,s0) + + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.1.0/policy/modules/services/dovecot.if --- nsaserefpolicy/policy/modules/services/dovecot.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/dovecot.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/dovecot.if 2007-11-06 09:28:35.000000000 -0500 @@ -18,3 +18,43 @@ manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t) manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t) @@ -6290,7 +5285,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.1.0/policy/modules/services/dovecot.te --- nsaserefpolicy/policy/modules/services/dovecot.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/dovecot.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/dovecot.te 2007-11-06 11:00:19.000000000 -0500 @@ -15,6 +15,12 @@ domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t) role system_r types dovecot_auth_t; @@ -6304,7 +5299,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove type dovecot_cert_t; files_type(dovecot_cert_t) -@@ -46,8 +52,6 @@ +@@ -31,6 +37,9 @@ + type dovecot_var_lib_t; + files_type(dovecot_var_lib_t) + ++type dovecot_var_log_t; ++logging_log_file(dovecot_var_log_t) ++ + type dovecot_var_run_t; + files_pid_file(dovecot_var_run_t) + +@@ -46,8 +55,6 @@ allow dovecot_t self:tcp_socket create_stream_socket_perms; allow dovecot_t self:unix_dgram_socket create_socket_perms; allow dovecot_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -6313,7 +5318,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove domtrans_pattern(dovecot_t, dovecot_auth_exec_t, dovecot_auth_t) allow dovecot_t dovecot_cert_t:dir list_dir_perms; -@@ -67,6 +71,8 @@ +@@ -67,6 +74,8 @@ manage_sock_files_pattern(dovecot_t,dovecot_var_run_t,dovecot_var_run_t) files_pid_filetrans(dovecot_t,dovecot_var_run_t,file) @@ -6322,7 +5327,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove kernel_read_kernel_sysctls(dovecot_t) kernel_read_system_state(dovecot_t) -@@ -99,7 +105,7 @@ +@@ -99,7 +108,7 @@ files_dontaudit_list_default(dovecot_t) # Dovecot now has quota support and it uses getmntent() to find the mountpoints. files_read_etc_runtime_files(dovecot_t) @@ -6331,7 +5336,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove init_getattr_utmp(dovecot_t) -@@ -111,9 +117,6 @@ +@@ -111,9 +120,6 @@ miscfiles_read_certs(dovecot_t) miscfiles_read_localization(dovecot_t) @@ -6341,7 +5346,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove userdom_dontaudit_use_unpriv_user_fds(dovecot_t) userdom_dontaudit_search_sysadm_home_dirs(dovecot_t) userdom_priveleged_home_dir_manager(dovecot_t) -@@ -125,10 +128,6 @@ +@@ -125,10 +131,6 @@ ') optional_policy(` @@ -6352,7 +5357,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove seutil_sigchld_newrole(dovecot_t) ') -@@ -145,33 +144,40 @@ +@@ -145,33 +147,44 @@ # dovecot auth local policy # @@ -6368,6 +5373,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove allow dovecot_auth_t dovecot_passwd_t:file { getattr read }; ++# log files ++manage_files_pattern(dovecot_t, dovecot_var_log_t, dovecot_var_log_t) ++logging_log_filetrans(dovecot_t, dovecot_var_log_t, file) ++ # Allow dovecot to create and read SSL parameters file manage_files_pattern(dovecot_t,dovecot_var_lib_t,dovecot_var_lib_t) files_search_var_lib(dovecot_t) @@ -6395,7 +5404,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove files_read_usr_symlinks(dovecot_auth_t) files_search_tmp(dovecot_auth_t) files_read_var_lib_files(dovecot_t) -@@ -185,12 +191,50 @@ +@@ -185,12 +198,50 @@ seutil_dontaudit_search_config(dovecot_auth_t) @@ -6413,12 +5422,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + +optional_policy(` + nis_authenticate(dovecot_auth_t) -+') + ') + +optional_policy(` + postfix_create_pivate_sockets(dovecot_auth_t) + postfix_search_spool(dovecot_auth_t) - ') ++') + +# for gssapi (kerberos) +userdom_list_unpriv_users_tmp(dovecot_auth_t) @@ -6451,7 +5460,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.fc serefpolicy-3.1.0/policy/modules/services/exim.fc --- nsaserefpolicy/policy/modules/services/exim.fc 2007-10-24 15:00:24.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/exim.fc 2007-10-24 15:28:23.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/exim.fc 2007-11-06 09:28:35.000000000 -0500 @@ -1,3 +1,4 @@ + /usr/sbin/exim -- gen_context(system_u:object_r:exim_exec_t,s0) @@ -6459,7 +5468,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim /var/run/exim.pid -- gen_context(system_u:object_r:exim_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.1.0/policy/modules/services/exim.te --- nsaserefpolicy/policy/modules/services/exim.te 2007-10-24 15:17:31.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/exim.te 2007-10-26 09:02:45.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/exim.te 2007-11-06 09:28:35.000000000 -0500 @@ -21,9 +21,20 @@ ## gen_tunable(exim_manage_user_files,false) @@ -6638,7 +5647,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetchmail.te serefpolicy-3.1.0/policy/modules/services/fetchmail.te --- nsaserefpolicy/policy/modules/services/fetchmail.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/fetchmail.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/fetchmail.te 2007-11-06 09:28:35.000000000 -0500 @@ -86,6 +86,10 @@ userdom_dontaudit_search_sysadm_home_dirs(fetchmail_t) @@ -6652,7 +5661,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.if serefpolicy-3.1.0/policy/modules/services/ftp.if --- nsaserefpolicy/policy/modules/services/ftp.if 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/ftp.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/ftp.if 2007-11-06 09:28:35.000000000 -0500 @@ -28,11 +28,13 @@ type ftpd_t; ') @@ -6674,7 +5683,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.1.0/policy/modules/services/ftp.te --- nsaserefpolicy/policy/modules/services/ftp.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/ftp.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/ftp.te 2007-11-06 09:28:35.000000000 -0500 +@@ -9,7 +9,7 @@ + ## + ##

+ ## Allow ftp servers to modify public files +-## used for public file transfer services. ++## used for public file transfer services. Directories must be labeled public_content_rw_t + ##

+ ## + gen_tunable(allow_ftpd_anon_write,false) @@ -88,6 +88,7 @@ allow ftpd_t self:unix_stream_socket create_stream_socket_perms; allow ftpd_t self:tcp_socket create_stream_socket_perms; @@ -6746,7 +5764,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.1.0/policy/modules/services/hal.fc --- nsaserefpolicy/policy/modules/services/hal.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/hal.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/hal.fc 2007-11-06 09:28:35.000000000 -0500 @@ -8,14 +8,18 @@ /usr/libexec/hal-hotplug-map -- gen_context(system_u:object_r:hald_exec_t,s0) /usr/libexec/hal-system-sonypic -- gen_context(system_u:object_r:hald_sonypic_exec_t,s0) @@ -6765,10 +5783,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. +/var/run/pm(/.*)? gen_context(system_u:object_r:hald_var_run_t,s0) /var/run/haldaemon\.pid -- gen_context(system_u:object_r:hald_var_run_t,s0) - /var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0) +-/var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0) ++/var/run/vbe.* -- gen_context(system_u:object_r:hald_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.1.0/policy/modules/services/hal.te ---- nsaserefpolicy/policy/modules/services/hal.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/hal.te 2007-10-24 15:06:50.000000000 -0400 +--- nsaserefpolicy/policy/modules/services/hal.te 2007-10-29 07:52:49.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/hal.te 2007-11-06 09:28:35.000000000 -0500 @@ -49,6 +49,9 @@ type hald_var_lib_t; files_type(hald_var_lib_t) @@ -6805,7 +5824,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. storage_raw_read_removable_device(hald_t) storage_raw_write_removable_device(hald_t) storage_raw_read_fixed_disk(hald_t) -@@ -293,6 +299,7 @@ +@@ -230,6 +236,7 @@ + optional_policy(` + dbus_system_bus_client_template(hald,hald_t) + dbus_connect_system_bus(hald_t) ++ allow hald_t self:dbus send_msg; + + init_dbus_chat_script(hald_t) + +@@ -291,6 +298,7 @@ # allow hald_acl_t self:capability { dac_override fowner }; @@ -6813,7 +5840,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. allow hald_acl_t self:fifo_file read_fifo_file_perms; domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t) -@@ -340,10 +347,14 @@ +@@ -338,10 +346,14 @@ manage_files_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t) files_search_var_lib(hald_mac_t) @@ -6830,17 +5857,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.1.0/policy/modules/services/inetd.te --- nsaserefpolicy/policy/modules/services/inetd.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/inetd.te 2007-10-24 15:06:50.000000000 -0400 -@@ -53,6 +53,8 @@ - allow inetd_t inetd_var_run_t:file manage_file_perms; - files_pid_filetrans(inetd_t,inetd_var_run_t,file) - -+auth_search_key(inetd_t) -+ - kernel_read_kernel_sysctls(inetd_t) - kernel_list_proc(inetd_t) - kernel_read_proc_symlinks(inetd_t) -@@ -84,6 +86,7 @@ ++++ serefpolicy-3.1.0/policy/modules/services/inetd.te 2007-11-07 10:34:39.000000000 -0500 +@@ -84,6 +84,7 @@ corenet_udp_bind_ftp_port(inetd_t) corenet_tcp_bind_inetd_child_port(inetd_t) corenet_udp_bind_inetd_child_port(inetd_t) @@ -6848,7 +5866,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet corenet_udp_bind_ktalkd_port(inetd_t) corenet_tcp_bind_printer_port(inetd_t) corenet_udp_bind_rlogind_port(inetd_t) -@@ -137,6 +140,7 @@ +@@ -137,6 +138,7 @@ miscfiles_read_localization(inetd_t) # xinetd needs MLS override privileges to work @@ -6856,7 +5874,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet mls_fd_share_all_levels(inetd_t) mls_socket_read_to_clearance(inetd_t) mls_socket_write_to_clearance(inetd_t) -@@ -180,6 +184,9 @@ +@@ -164,6 +166,7 @@ + ') + + optional_policy(` ++ unconfined_domain(inetd_t) + unconfined_domtrans(inetd_t) + ') + +@@ -180,6 +183,9 @@ # for identd allow inetd_child_t self:netlink_tcpdiag_socket r_netlink_socket_perms; allow inetd_child_t self:capability { setuid setgid }; @@ -6866,7 +5892,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet files_search_home(inetd_child_t) manage_dirs_pattern(inetd_child_t,inetd_child_tmp_t,inetd_child_tmp_t) -@@ -226,3 +233,7 @@ +@@ -226,3 +232,7 @@ optional_policy(` unconfined_domain(inetd_child_t) ') @@ -6876,7 +5902,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.fc serefpolicy-3.1.0/policy/modules/services/kerberos.fc --- nsaserefpolicy/policy/modules/services/kerberos.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/kerberos.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/kerberos.fc 2007-11-06 09:28:35.000000000 -0500 @@ -16,3 +16,4 @@ /var/log/krb5kdc\.log gen_context(system_u:object_r:krb5kdc_log_t,s0) @@ -6884,7 +5910,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb +/var/tmp/host_0 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-3.1.0/policy/modules/services/kerberos.if --- nsaserefpolicy/policy/modules/services/kerberos.if 2007-07-16 14:09:46.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/kerberos.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/kerberos.if 2007-11-07 11:41:20.000000000 -0500 @@ -42,6 +42,10 @@ dontaudit $1 krb5_conf_t:file write; dontaudit $1 krb5kdc_conf_t:dir list_dir_perms; @@ -6896,7 +5922,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb tunable_policy(`allow_kerberos',` allow $1 self:tcp_socket create_socket_perms; -@@ -172,3 +176,51 @@ +@@ -61,9 +65,6 @@ + corenet_tcp_connect_ocsp_port($1) + corenet_sendrecv_kerberos_client_packets($1) + corenet_sendrecv_ocsp_client_packets($1) +- +- sysnet_read_config($1) +- sysnet_dns_name_resolve($1) + ') + + optional_policy(` +@@ -172,3 +173,51 @@ allow $1 krb5kdc_conf_t:file read_file_perms; ') @@ -6950,7 +5986,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.1.0/policy/modules/services/kerberos.te --- nsaserefpolicy/policy/modules/services/kerberos.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/kerberos.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/kerberos.te 2007-11-06 09:28:35.000000000 -0500 +@@ -8,7 +8,7 @@ + + ## + ##

+-## Allow system to run with kerberos ++## Allow confined applications to run with kerberos + ##

+ ## + gen_tunable(allow_kerberos,false) @@ -54,6 +54,9 @@ type krb5kdc_var_run_t; files_pid_file(krb5kdc_var_run_t) @@ -7031,7 +6076,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.fc serefpolicy-3.1.0/policy/modules/services/lpd.fc --- nsaserefpolicy/policy/modules/services/lpd.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/lpd.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/lpd.fc 2007-11-06 09:28:35.000000000 -0500 @@ -29,3 +29,4 @@ # /var/spool/lpd(/.*)? gen_context(system_u:object_r:print_spool_t,s0) @@ -7039,7 +6084,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd. +/var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.1.0/policy/modules/services/lpd.if --- nsaserefpolicy/policy/modules/services/lpd.if 2007-09-12 10:34:18.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/lpd.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/lpd.if 2007-11-06 09:28:35.000000000 -0500 @@ -303,6 +303,25 @@ ######################################## @@ -7068,7 +6113,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.1.0/policy/modules/services/mailman.te --- nsaserefpolicy/policy/modules/services/mailman.te 2007-07-10 13:21:26.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/mailman.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/mailman.te 2007-11-06 09:28:35.000000000 -0500 @@ -55,6 +55,8 @@ apache_use_fds(mailman_cgi_t) apache_dontaudit_append_log(mailman_cgi_t) @@ -7101,13 +6146,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.1.0/policy/modules/services/mailscanner.fc --- nsaserefpolicy/policy/modules/services/mailscanner.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/mailscanner.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/mailscanner.fc 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,2 @@ +/var/spool/MailScanner(/.*)? gen_context(system_u:object_r:mailscanner_spool_t,s0) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.1.0/policy/modules/services/mailscanner.if --- nsaserefpolicy/policy/modules/services/mailscanner.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/mailscanner.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/mailscanner.if 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,59 @@ +## Anti-Virus and Anti-Spam Filter + @@ -7170,7 +6215,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.1.0/policy/modules/services/mailscanner.te --- nsaserefpolicy/policy/modules/services/mailscanner.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/mailscanner.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/mailscanner.te 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,5 @@ + +policy_module(mailscanner,1.0.0) @@ -7179,20 +6224,48 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail +files_type(mailscanner_spool_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.1.0/policy/modules/services/mta.if --- nsaserefpolicy/policy/modules/services/mta.if 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/mta.if 2007-10-24 15:06:50.000000000 -0400 -@@ -142,6 +142,11 @@ ++++ serefpolicy-3.1.0/policy/modules/services/mta.if 2007-11-06 10:42:12.000000000 -0500 +@@ -87,6 +87,8 @@ + # It wants to check for nscd + files_dontaudit_search_pids($1_mail_t) + ++ auth_use_nsswitch($1_mail_t) ++ + libs_use_ld_so($1_mail_t) + libs_use_shared_libs($1_mail_t) + +@@ -94,17 +96,6 @@ + + miscfiles_read_localization($1_mail_t) + +- sysnet_read_config($1_mail_t) +- sysnet_dns_name_resolve($1_mail_t) +- +- optional_policy(` +- nis_use_ypbind($1_mail_t) +- ') +- +- optional_policy(` +- nscd_socket_use($1_mail_t) +- ') +- + optional_policy(` + postfix_domtrans_user_mail_handler($1_mail_t) + ') +@@ -142,6 +133,12 @@ sendmail_create_log($1_mail_t) ') + optional_policy(` -+ exim_read_logs($1_mail_t) -+ exim_manage_spool($1_mail_t) ++ exim_read_log($1_mail_t) ++ exim_append_log($1_mail_t) ++ exim_manage_spool_files($1_mail_t) + ') + ') ####################################### -@@ -226,6 +231,15 @@ +@@ -226,6 +223,15 @@ tunable_policy(`use_samba_home_dirs',` fs_manage_cifs_files($1_mail_t) fs_manage_cifs_symlinks($1_mail_t) @@ -7208,7 +6281,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. ') optional_policy(` -@@ -314,6 +328,24 @@ +@@ -314,6 +320,42 @@ ######################################## ## @@ -7230,10 +6303,28 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. + +######################################## +## ++## Make the specified type readable for a system_mail_t ++## ++## ++## ++## Type to be used as a mail client. ++## ++## ++# ++interface(`mta_mailcontent',` ++ gen_require(` ++ attribute mailcontent_type; ++ ') ++ ++ typeattribute $1 mailcontent_type; ++') ++ ++######################################## ++## ## Modified mailserver interface for ## sendmail daemon use. ## -@@ -392,6 +424,7 @@ +@@ -392,6 +434,7 @@ allow $1 mail_spool_t:dir list_dir_perms; create_files_pattern($1,mail_spool_t,mail_spool_t) read_files_pattern($1,mail_spool_t,mail_spool_t) @@ -7241,7 +6332,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. create_lnk_files_pattern($1,mail_spool_t,mail_spool_t) read_lnk_files_pattern($1,mail_spool_t,mail_spool_t) -@@ -447,20 +480,18 @@ +@@ -447,20 +490,18 @@ interface(`mta_send_mail',` gen_require(` attribute mta_user_agent; @@ -7268,7 +6359,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. ') ######################################## -@@ -595,6 +626,25 @@ +@@ -595,6 +636,25 @@ files_search_etc($1) allow $1 etc_aliases_t:file { rw_file_perms setattr }; ') @@ -7296,16 +6387,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.1.0/policy/modules/services/mta.te --- nsaserefpolicy/policy/modules/services/mta.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/mta.te 2007-10-26 09:08:35.000000000 -0400 -@@ -6,6 +6,7 @@ ++++ serefpolicy-3.1.0/policy/modules/services/mta.te 2007-11-06 09:28:35.000000000 -0500 +@@ -6,6 +6,8 @@ # Declarations # ++attribute mailcontent_type; +attribute mailclient_exec_type; attribute mta_user_agent; attribute mailserver_delivery; attribute mailserver_domain; -@@ -27,6 +28,7 @@ +@@ -27,6 +29,7 @@ type sendmail_exec_t; application_executable_file(sendmail_exec_t) @@ -7313,7 +6405,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. mta_base_mail_template(system) role system_r types system_mail_t; -@@ -44,23 +46,33 @@ +@@ -40,27 +43,38 @@ + allow system_mail_t self:capability { dac_override }; + + read_files_pattern(system_mail_t,etc_mail_t,etc_mail_t) ++read_files_pattern(system_mail_t,mailcontent_type,mailcontent_type) + kernel_read_system_state(system_mail_t) kernel_read_network_state(system_mail_t) @@ -7347,7 +6444,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. ') optional_policy(` -@@ -73,6 +85,7 @@ +@@ -73,6 +87,7 @@ optional_policy(` cron_read_system_job_tmp_files(system_mail_t) @@ -7355,11 +6452,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. cron_dontaudit_write_pipes(system_mail_t) ') -@@ -81,6 +94,10 @@ +@@ -81,6 +96,10 @@ ') optional_policy(` -+ exim_append_log(system_mail_t) ++ exim_domtrans(system_mail_t) +') + +optional_policy(` @@ -7368,7 +6465,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.if serefpolicy-3.1.0/policy/modules/services/munin.if --- nsaserefpolicy/policy/modules/services/munin.if 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/munin.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/munin.if 2007-11-06 09:28:35.000000000 -0500 @@ -61,3 +61,21 @@ allow $1 munin_var_lib_t:dir search_dir_perms; files_search_var_lib($1) @@ -7393,7 +6490,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.fc serefpolicy-3.1.0/policy/modules/services/mysql.fc --- nsaserefpolicy/policy/modules/services/mysql.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/mysql.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/mysql.fc 2007-11-06 09:28:35.000000000 -0500 @@ -22,3 +22,5 @@ /var/log/mysql.* -- gen_context(system_u:object_r:mysqld_log_t,s0) @@ -7402,7 +6499,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq +/etc/rc\.d/init\.d/mysqld -- gen_context(system_u:object_r:mysqld_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.if serefpolicy-3.1.0/policy/modules/services/mysql.if --- nsaserefpolicy/policy/modules/services/mysql.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/mysql.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/mysql.if 2007-11-06 09:28:35.000000000 -0500 @@ -157,3 +157,79 @@ logging_search_logs($1) allow $1 mysqld_log_t:file { write append setattr ioctl }; @@ -7485,7 +6582,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.1.0/policy/modules/services/mysql.te --- nsaserefpolicy/policy/modules/services/mysql.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/mysql.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/mysql.te 2007-11-06 09:28:35.000000000 -0500 @@ -25,6 +25,9 @@ type mysqld_tmp_t; files_tmp_file(mysqld_tmp_t) @@ -7498,7 +6595,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq # Local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.1.0/policy/modules/services/nagios.fc --- nsaserefpolicy/policy/modules/services/nagios.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/nagios.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/nagios.fc 2007-11-06 09:28:35.000000000 -0500 @@ -4,13 +4,15 @@ /usr/bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0) /usr/bin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0) @@ -7520,7 +6617,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi +/usr/lib(64)?/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.1.0/policy/modules/services/nagios.if --- nsaserefpolicy/policy/modules/services/nagios.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/nagios.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/nagios.if 2007-11-06 09:28:35.000000000 -0500 @@ -44,25 +44,6 @@ ######################################## @@ -7549,7 +6646,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.1.0/policy/modules/services/nagios.te --- nsaserefpolicy/policy/modules/services/nagios.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/nagios.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/nagios.te 2007-11-06 09:28:35.000000000 -0500 @@ -8,11 +8,7 @@ type nagios_t; @@ -7661,15 +6758,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.1.0/policy/modules/services/networkmanager.fc --- nsaserefpolicy/policy/modules/services/networkmanager.fc 2007-09-12 10:34:18.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/networkmanager.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/networkmanager.fc 2007-11-06 09:28:35.000000000 -0500 @@ -5,3 +5,4 @@ /var/run/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/wpa_supplicant-global -s gen_context(system_u:object_r:NetworkManager_var_run_t,s0) +/var/log/wpa_supplicant\.log -- gen_context(system_u:object_r:NetworkManager_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.1.0/policy/modules/services/networkmanager.te ---- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/networkmanager.te 2007-10-24 15:39:06.000000000 -0400 +--- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-10-29 07:52:49.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/networkmanager.te 2007-11-06 09:28:35.000000000 -0500 @@ -13,6 +13,9 @@ type NetworkManager_var_run_t; files_pid_file(NetworkManager_var_run_t) @@ -7685,7 +6782,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw # networkmanager will ptrace itself if gdb is installed # and it receives a unexpected signal (rh bug #204161) -allow NetworkManager_t self:capability { kill setgid setuid sys_nice dac_override net_admin net_raw net_bind_service ipc_lock }; -+allow NetworkManager_t self:capability { chown kill setgid setuid sys_nice dac_override net_admin net_raw net_bind_service ipc_lock }; ++allow NetworkManager_t self:capability { chown kill setgid setuid sys_nice dac_override net_admin net_raw ipc_lock }; dontaudit NetworkManager_t self:capability { sys_tty_config sys_ptrace }; allow NetworkManager_t self:process { ptrace setcap setpgid getsched signal_perms }; allow NetworkManager_t self:fifo_file rw_fifo_file_perms; @@ -7699,25 +6796,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw kernel_read_system_state(NetworkManager_t) kernel_read_network_state(NetworkManager_t) kernel_read_kernel_sysctls(NetworkManager_t) -@@ -129,15 +135,13 @@ +@@ -129,8 +135,11 @@ ') optional_policy(` -- gen_require(` -- class dbus send_msg; -- ') -- - allow NetworkManager_t self:dbus send_msg; - ++ allow NetworkManager_t self:dbus send_msg; ++ dbus_system_bus_client_template(NetworkManager,NetworkManager_t) dbus_connect_system_bus(NetworkManager_t) - dbus_send_system_bus(NetworkManager_t) -+ dbus_dontaudit_rw_system_selinux_socket(NetworkManager_t) + dbus_system_domain(NetworkManager_t,NetworkManager_exec_t) ') optional_policy(` -@@ -151,6 +155,8 @@ +@@ -144,6 +153,8 @@ optional_policy(` nscd_socket_use(NetworkManager_t) nscd_signal(NetworkManager_t) @@ -7726,7 +6817,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw ') optional_policy(` -@@ -162,6 +168,7 @@ +@@ -155,6 +166,7 @@ ppp_domtrans(NetworkManager_t) ppp_read_pid_files(NetworkManager_t) ppp_signal(NetworkManager_t) @@ -7734,7 +6825,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw ') optional_policy(` -@@ -173,8 +180,10 @@ +@@ -166,8 +178,10 @@ ') optional_policy(` @@ -7747,7 +6838,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.1.0/policy/modules/services/nis.fc --- nsaserefpolicy/policy/modules/services/nis.fc 2007-02-19 11:32:53.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/nis.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/nis.fc 2007-11-06 09:28:35.000000000 -0500 @@ -4,6 +4,7 @@ /sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0) @@ -7758,7 +6849,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. /usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.1.0/policy/modules/services/nis.if --- nsaserefpolicy/policy/modules/services/nis.if 2007-07-16 14:09:46.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/nis.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/nis.if 2007-11-06 09:28:35.000000000 -0500 @@ -49,8 +49,8 @@ corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) @@ -7770,7 +6861,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_dontaudit_tcp_bind_all_ports($1) corenet_dontaudit_udp_bind_all_ports($1) corenet_tcp_connect_portmap_port($1) -@@ -87,6 +87,27 @@ +@@ -87,6 +87,25 @@ ######################################## ## @@ -7786,8 +6877,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. +interface(`nis_authenticate',` + tunable_policy(`allow_ypbind',` + nis_use_ypbind_uncond($1) -+ # Needs to bind to a port < 1024 -+ allow $1 self:capability net_bind_service; + corenet_tcp_bind_all_rpc_ports($1) + corenet_udp_bind_all_rpc_ports($1) + ') @@ -7800,8 +6889,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.1.0/policy/modules/services/nis.te --- nsaserefpolicy/policy/modules/services/nis.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/nis.te 2007-10-24 15:06:50.000000000 -0400 -@@ -113,6 +113,18 @@ ++++ serefpolicy-3.1.0/policy/modules/services/nis.te 2007-11-06 09:28:35.000000000 -0500 +@@ -113,6 +113,17 @@ userdom_dontaudit_use_unpriv_user_fds(ypbind_t) userdom_dontaudit_search_sysadm_home_dirs(ypbind_t) @@ -7809,7 +6898,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. +optional_policy(` + dbus_system_bus_client_template(ypbind,ypbind_t) + dbus_connect_system_bus(ypbind_t) -+ dbus_send_system_bus(ypbind_t) + init_dbus_chat_script(ypbind_t) + + optional_policy(` @@ -7820,7 +6908,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. optional_policy(` seutil_sigchld_newrole(ypbind_t) ') -@@ -126,6 +138,7 @@ +@@ -126,6 +137,7 @@ # yppasswdd local policy # @@ -7828,7 +6916,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. dontaudit yppasswdd_t self:capability sys_tty_config; allow yppasswdd_t self:fifo_file rw_fifo_file_perms; allow yppasswdd_t self:process { setfscreate signal_perms }; -@@ -156,8 +169,8 @@ +@@ -156,8 +168,8 @@ corenet_udp_sendrecv_all_ports(yppasswdd_t) corenet_tcp_bind_all_nodes(yppasswdd_t) corenet_udp_bind_all_nodes(yppasswdd_t) @@ -7839,7 +6927,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_dontaudit_tcp_bind_all_reserved_ports(yppasswdd_t) corenet_dontaudit_udp_bind_all_reserved_ports(yppasswdd_t) corenet_sendrecv_generic_server_packets(yppasswdd_t) -@@ -247,6 +260,8 @@ +@@ -247,6 +259,8 @@ corenet_udp_bind_all_nodes(ypserv_t) corenet_tcp_bind_reserved_port(ypserv_t) corenet_udp_bind_reserved_port(ypserv_t) @@ -7848,7 +6936,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_dontaudit_tcp_bind_all_reserved_ports(ypserv_t) corenet_dontaudit_udp_bind_all_reserved_ports(ypserv_t) corenet_sendrecv_generic_server_packets(ypserv_t) -@@ -315,6 +330,8 @@ +@@ -315,6 +329,8 @@ corenet_udp_bind_all_nodes(ypxfr_t) corenet_tcp_bind_reserved_port(ypxfr_t) corenet_udp_bind_reserved_port(ypxfr_t) @@ -7859,7 +6947,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_tcp_connect_all_ports(ypxfr_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.fc serefpolicy-3.1.0/policy/modules/services/nscd.fc --- nsaserefpolicy/policy/modules/services/nscd.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/nscd.fc 2007-10-24 15:39:38.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/nscd.fc 2007-11-06 09:28:35.000000000 -0500 @@ -9,3 +9,5 @@ /var/run/\.nscd_socket -s gen_context(system_u:object_r:nscd_var_run_t,s0) @@ -7868,7 +6956,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd +/etc/rc\.d/init\.d/nscd -- gen_context(system_u:object_r:httpd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.1.0/policy/modules/services/nscd.if --- nsaserefpolicy/policy/modules/services/nscd.if 2007-03-26 10:39:04.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/nscd.if 2007-10-24 15:39:27.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/nscd.if 2007-11-06 09:28:35.000000000 -0500 @@ -204,3 +204,22 @@ role $2 types nscd_t; dontaudit nscd_t $3:chr_file rw_term_perms; @@ -7894,7 +6982,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.1.0/policy/modules/services/nscd.te --- nsaserefpolicy/policy/modules/services/nscd.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/nscd.te 2007-10-24 15:39:54.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/nscd.te 2007-11-06 09:28:35.000000000 -0500 @@ -23,19 +23,22 @@ type nscd_log_t; logging_log_file(nscd_log_t) @@ -7962,7 +7050,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.1.0/policy/modules/services/ntp.fc --- nsaserefpolicy/policy/modules/services/ntp.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/ntp.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/ntp.fc 2007-11-06 09:28:35.000000000 -0500 @@ -17,3 +17,8 @@ /var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0) @@ -7974,7 +7062,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. +/etc/rc\.d/init\.d/ntpd -- gen_context(system_u:object_r:ntpd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.if serefpolicy-3.1.0/policy/modules/services/ntp.if --- nsaserefpolicy/policy/modules/services/ntp.if 2007-03-26 10:39:05.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/ntp.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/ntp.if 2007-11-06 09:28:35.000000000 -0500 @@ -53,3 +53,22 @@ corecmd_search_bin($1) domtrans_pattern($1,ntpdate_exec_t,ntpd_t) @@ -8000,7 +7088,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.1.0/policy/modules/services/ntp.te --- nsaserefpolicy/policy/modules/services/ntp.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/ntp.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/ntp.te 2007-11-06 09:28:35.000000000 -0500 @@ -25,6 +25,12 @@ type ntpdate_exec_t; init_system_domain(ntpd_t,ntpdate_exec_t) @@ -8062,13 +7150,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.1.0/policy/modules/services/openvpn.te ---- nsaserefpolicy/policy/modules/services/openvpn.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/openvpn.te 2007-10-24 15:06:50.000000000 -0400 -@@ -108,6 +108,14 @@ - dbus_system_bus_client_template(openvpn,openvpn_t) - dbus_connect_system_bus(openvpn_t) - dbus_send_system_bus(openvpn_t) -- +--- nsaserefpolicy/policy/modules/services/openvpn.te 2007-10-29 07:52:49.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/openvpn.te 2007-11-06 09:28:35.000000000 -0500 +@@ -110,3 +110,12 @@ + networkmanager_dbus_chat(openvpn_t) ') + @@ -8080,15 +7165,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open + unconfined_use_terminals(openvpn_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.1.0/policy/modules/services/pegasus.if ---- nsaserefpolicy/policy/modules/services/pegasus.if 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/pegasus.if 2007-10-24 15:06:50.000000000 -0400 -@@ -1 +1,2 @@ - ## The Open Group Pegasus CIM/WBEM Server. -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.1.0/policy/modules/services/pegasus.te --- nsaserefpolicy/policy/modules/services/pegasus.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/pegasus.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/pegasus.te 2007-11-06 09:28:35.000000000 -0500 @@ -42,6 +42,7 @@ allow pegasus_t pegasus_conf_t:file { read_file_perms link unlink }; allow pegasus_t pegasus_conf_t:lnk_file read_lnk_file_perms; @@ -8138,7 +7217,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portmap.te serefpolicy-3.1.0/policy/modules/services/portmap.te --- nsaserefpolicy/policy/modules/services/portmap.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/portmap.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/portmap.te 2007-11-06 09:28:35.000000000 -0500 @@ -63,6 +63,7 @@ # portmap binds to arbitary ports corenet_tcp_bind_generic_port(portmap_t) @@ -8149,7 +7228,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port corenet_dontaudit_tcp_bind_all_reserved_ports(portmap_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.1.0/policy/modules/services/portslave.te --- nsaserefpolicy/policy/modules/services/portslave.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/portslave.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/portslave.te 2007-11-06 09:28:35.000000000 -0500 @@ -85,6 +85,7 @@ auth_rw_login_records(portslave_t) @@ -8160,7 +7239,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.1.0/policy/modules/services/postfix.fc --- nsaserefpolicy/policy/modules/services/postfix.fc 2007-09-12 10:34:18.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/postfix.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/postfix.fc 2007-11-06 09:28:35.000000000 -0500 @@ -29,12 +29,10 @@ /usr/lib/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0) /usr/lib/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0) @@ -8176,7 +7255,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post /usr/sbin/postkick -- gen_context(system_u:object_r:postfix_master_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.1.0/policy/modules/services/postfix.if --- nsaserefpolicy/policy/modules/services/postfix.if 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/postfix.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/postfix.if 2007-11-06 09:28:35.000000000 -0500 @@ -58,6 +58,8 @@ allow postfix_$1_t postfix_var_run_t:file manage_file_perms; files_pid_filetrans(postfix_$1_t,postfix_var_run_t,file) @@ -8198,7 +7277,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.1.0/policy/modules/services/postfix.te --- nsaserefpolicy/policy/modules/services/postfix.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/postfix.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/postfix.te 2007-11-06 09:28:35.000000000 -0500 @@ -6,6 +6,14 @@ # Declarations # @@ -8233,15 +7312,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post allow postfix_master_t postfix_etc_t:file rw_file_perms; -@@ -164,22 +177,18 @@ - - files_read_usr_files(postfix_master_t) - --term_dontaudit_search_ptys(postfix_master_t) -- - miscfiles_read_man_pages(postfix_master_t) - - seutil_sigchld_newrole(postfix_master_t) +@@ -172,15 +185,11 @@ # postfix does a "find" on startup for some reason - keep it quiet seutil_dontaudit_search_config(postfix_master_t) @@ -8250,15 +7321,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post mta_rw_aliases(postfix_master_t) mta_read_sendmail_bin(postfix_master_t) +mta_getattr_spool(postfix_master_t) -+ -+term_dontaudit_search_ptys(postfix_master_t) --optional_policy(` + optional_policy(` - auth_use_nsswitch(postfix_master_t) -') - optional_policy(` +-optional_policy(` cyrus_stream_connect(postfix_master_t) ') + @@ -278,6 +287,8 @@ files_read_etc_files(postfix_local_t) @@ -8347,7 +7417,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post # Postfix virtual local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.fc serefpolicy-3.1.0/policy/modules/services/postgresql.fc --- nsaserefpolicy/policy/modules/services/postgresql.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/postgresql.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/postgresql.fc 2007-11-06 09:28:35.000000000 -0500 @@ -38,3 +38,5 @@ ') @@ -8356,7 +7426,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +/etc/rc\.d/init\.d/postgresql -- gen_context(system_u:object_r:postgresql_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.1.0/policy/modules/services/postgresql.if --- nsaserefpolicy/policy/modules/services/postgresql.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/postgresql.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/postgresql.if 2007-11-06 09:28:35.000000000 -0500 @@ -113,3 +113,77 @@ # Some versions of postgresql put the sock file in /tmp allow $1 postgresql_tmp_t:sock_file write; @@ -8437,7 +7507,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.1.0/policy/modules/services/postgresql.te --- nsaserefpolicy/policy/modules/services/postgresql.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/postgresql.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/postgresql.te 2007-11-06 09:28:35.000000000 -0500 @@ -27,6 +27,9 @@ type postgresql_var_run_t; files_pid_file(postgresql_var_run_t) @@ -8450,7 +7520,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post # postgresql Local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.fc serefpolicy-3.1.0/policy/modules/services/ppp.fc --- nsaserefpolicy/policy/modules/services/ppp.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/ppp.fc 2007-10-26 08:54:35.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/ppp.fc 2007-11-06 09:28:35.000000000 -0500 @@ -25,7 +25,7 @@ # # /var @@ -8462,7 +7532,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. # Fix pptp sockets diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.if serefpolicy-3.1.0/policy/modules/services/ppp.if --- nsaserefpolicy/policy/modules/services/ppp.if 2007-03-26 10:39:04.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/ppp.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/ppp.if 2007-11-06 09:28:35.000000000 -0500 @@ -159,6 +159,25 @@ ######################################## @@ -8489,9 +7559,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. ## Read PPP-writable configuration files. ## ## +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.1.0/policy/modules/services/ppp.te +--- nsaserefpolicy/policy/modules/services/ppp.te 2007-10-12 08:56:07.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/ppp.te 2007-11-06 09:28:35.000000000 -0500 +@@ -194,6 +194,8 @@ + + optional_policy(` + mta_send_mail(pppd_t) ++ mta_mailcontent(pppd_etc_t) ++ mta_mailcontent(pppd_etc_rw_t) + ') + + optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.1.0/policy/modules/services/procmail.te --- nsaserefpolicy/policy/modules/services/procmail.te 2007-10-02 09:54:52.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/procmail.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/procmail.te 2007-11-06 09:28:35.000000000 -0500 @@ -52,6 +52,7 @@ fs_getattr_xattr_fs(procmail_t) @@ -8532,7 +7614,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.1.0/policy/modules/services/pyzor.if --- nsaserefpolicy/policy/modules/services/pyzor.if 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/pyzor.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/pyzor.if 2007-11-06 09:28:35.000000000 -0500 @@ -25,16 +25,16 @@ # template(`pyzor_per_role_template',` @@ -8558,7 +7640,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.fc serefpolicy-3.1.0/policy/modules/services/radius.fc --- nsaserefpolicy/policy/modules/services/radius.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/radius.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/radius.fc 2007-11-06 09:28:35.000000000 -0500 @@ -18,3 +18,4 @@ /var/run/radiusd(/.*)? gen_context(system_u:object_r:radiusd_var_run_t,s0) @@ -8566,7 +7648,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi +/var/lib/radiousd(/.*)? gen_context(system_u:object_r:radiusd_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.1.0/policy/modules/services/radius.te --- nsaserefpolicy/policy/modules/services/radius.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/radius.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/radius.te 2007-11-06 09:28:35.000000000 -0500 @@ -19,6 +19,9 @@ type radiusd_log_t; logging_log_file(radiusd_log_t) @@ -8604,7 +7686,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi corecmd_exec_shell(radiusd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remotelogin.if serefpolicy-3.1.0/policy/modules/services/remotelogin.if --- nsaserefpolicy/policy/modules/services/remotelogin.if 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/remotelogin.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/remotelogin.if 2007-11-06 09:28:35.000000000 -0500 @@ -18,3 +18,20 @@ auth_domtrans_login_program($1,remote_login_t) ') @@ -8628,7 +7710,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remo +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remotelogin.te serefpolicy-3.1.0/policy/modules/services/remotelogin.te --- nsaserefpolicy/policy/modules/services/remotelogin.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/remotelogin.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/remotelogin.te 2007-11-06 09:28:35.000000000 -0500 @@ -85,6 +85,7 @@ miscfiles_read_localization(remote_login_t) @@ -8639,7 +7721,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remo # Only permit unprivileged user domains to be entered via rlogin, diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.1.0/policy/modules/services/rhgb.te --- nsaserefpolicy/policy/modules/services/rhgb.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/rhgb.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/rhgb.te 2007-11-06 09:28:35.000000000 -0500 @@ -59,6 +59,7 @@ corenet_sendrecv_all_client_packets(rhgb_t) @@ -8652,7 +7734,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb files_search_tmp(rhgb_t) files_read_usr_files(rhgb_t) files_mounton_mnt(rhgb_t) -+files_dontaudit_write_root_dir(rhgb_t) ++files_dontaudit_rw_root_dir(rhgb_t) files_dontaudit_read_default_files(rhgb_t) files_dontaudit_search_pids(rhgb_t) # for nscd @@ -8673,8 +7755,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb optional_policy(` consoletype_exec(rhgb_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.1.0/policy/modules/services/ricci.te ---- nsaserefpolicy/policy/modules/services/ricci.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/ricci.te 2007-10-24 15:06:50.000000000 -0400 +--- nsaserefpolicy/policy/modules/services/ricci.te 2007-10-29 07:52:49.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/ricci.te 2007-11-06 09:28:35.000000000 -0500 @@ -138,6 +138,7 @@ files_create_boot_flag(ricci_t) @@ -8723,8 +7805,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.1.0/policy/modules/services/rlogin.te --- nsaserefpolicy/policy/modules/services/rlogin.te 2007-10-02 09:54:52.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/rlogin.te 2007-10-24 15:06:50.000000000 -0400 -@@ -36,15 +36,17 @@ ++++ serefpolicy-3.1.0/policy/modules/services/rlogin.te 2007-11-06 09:28:35.000000000 -0500 +@@ -36,6 +36,8 @@ allow rlogind_t rlogind_devpts_t:chr_file { rw_chr_file_perms setattr }; term_create_pty(rlogind_t,rlogind_devpts_t) @@ -8733,32 +7815,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog # for /usr/lib/telnetlogin can_exec(rlogind_t, rlogind_exec_t) --manage_dirs_pattern(rlogind_t, rlogind_tmp_t, rlogind_tmp_t) --manage_files_pattern(rlogind_t, rlogind_tmp_t, rlogind_tmp_t) -+manage_dirs_pattern(rlogind_t,rlogind_tmp_t,rlogind_tmp_t) -+manage_files_pattern(rlogind_t,rlogind_tmp_t,rlogind_tmp_t) - files_tmp_filetrans(rlogind_t, rlogind_tmp_t, { file dir }) - --manage_files_pattern(rlogind_t, rlogind_var_run_t, rlogind_var_run_t) --files_pid_filetrans(rlogind_t, rlogind_var_run_t, file) -+manage_files_pattern(rlogind_t,rlogind_var_run_t,rlogind_var_run_t) -+files_pid_filetrans(rlogind_t,rlogind_var_run_t,file) - - kernel_read_kernel_sysctls(rlogind_t) - kernel_read_system_state(rlogind_t) -@@ -64,9 +66,10 @@ - fs_getattr_xattr_fs(rlogind_t) +@@ -65,6 +67,7 @@ fs_search_auto_mountpoints(rlogind_t) -+auth_use_nsswitch(rlogind_t) auth_domtrans_chk_passwd(rlogind_t) +auth_domtrans_upd_passwd(rlogind_t) auth_rw_login_records(rlogind_t) --auth_use_nsswitch(rlogind_t) + auth_use_nsswitch(rlogind_t) - files_read_etc_files(rlogind_t) - files_read_etc_runtime_files(rlogind_t) -@@ -82,25 +85,17 @@ +@@ -82,25 +85,21 @@ miscfiles_read_localization(rlogind_t) @@ -8777,20 +7842,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog optional_policy(` + kerberos_use(rlogind_t) kerberos_read_keytab(rlogind_t) --') -- --optional_policy(` -- tcpd_wrapped_domain(rlogind_t, rlogind_exec_t) --') ++ kerberos_manage_host_rcache(rlogind_t) + ') + + optional_policy(` + tcpd_wrapped_domain(rlogind_t, rlogind_exec_t) + ') - -ifdef(`TODO',` -# Allow krb5 rlogind to use fork and open /dev/tty for use -allow rlogind_t userpty_type:chr_file setattr; -+ kerberos_manage_host_rcache(rlogind_t) - ') +-') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.1.0/policy/modules/services/rpcbind.te --- nsaserefpolicy/policy/modules/services/rpcbind.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/rpcbind.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/rpcbind.te 2007-11-06 09:28:35.000000000 -0500 @@ -21,11 +21,13 @@ # rpcbind local policy # @@ -8808,7 +7873,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.1.0/policy/modules/services/rpc.if --- nsaserefpolicy/policy/modules/services/rpc.if 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/rpc.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/rpc.if 2007-11-06 09:28:35.000000000 -0500 @@ -89,8 +89,11 @@ # bind to arbitary unused ports corenet_tcp_bind_generic_port($1_t) @@ -8849,7 +7914,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.1.0/policy/modules/services/rpc.te --- nsaserefpolicy/policy/modules/services/rpc.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/rpc.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/rpc.te 2007-11-06 09:28:35.000000000 -0500 +@@ -8,7 +8,7 @@ + + ## + ##

+-## Allow gssd to read temp directory. ++## Allow gssd to read temp directory. For access to kerberos tgt. + ##

+ ## + gen_tunable(allow_gssd_read_tmp,true) +@@ -16,7 +16,7 @@ + ## + ##

+ ## Allow nfs servers to modify public files +-## used for public file transfer services. ++## used for public file transfer services. Files/Directories must be labeled public_content_rw_t + ##

+ ## + gen_tunable(allow_nfsd_anon_write,false) @@ -59,10 +59,14 @@ manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t) files_pid_filetrans(rpcd_t,rpcd_var_run_t,file) @@ -8926,8 +8009,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. userdom_read_unpriv_users_tmp_files(gssd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.1.0/policy/modules/services/rshd.te --- nsaserefpolicy/policy/modules/services/rshd.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/rshd.te 2007-10-24 15:06:50.000000000 -0400 -@@ -16,10 +16,11 @@ ++++ serefpolicy-3.1.0/policy/modules/services/rshd.te 2007-11-06 09:28:35.000000000 -0500 +@@ -16,7 +16,7 @@ # # Local policy # @@ -8936,11 +8019,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd allow rshd_t self:process { signal_perms fork setsched setpgid setexec }; allow rshd_t self:fifo_file rw_fifo_file_perms; allow rshd_t self:tcp_socket create_stream_socket_perms; -+allow rshd_t self:key {search write link}; - - kernel_read_kernel_sysctls(rshd_t) - -@@ -33,6 +34,9 @@ +@@ -33,6 +33,9 @@ corenet_udp_sendrecv_all_ports(rshd_t) corenet_tcp_bind_all_nodes(rshd_t) corenet_tcp_bind_rsh_port(rshd_t) @@ -8950,13 +8029,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd corenet_sendrecv_rsh_server_packets(rshd_t) dev_read_urand(rshd_t) -@@ -44,26 +48,29 @@ +@@ -44,26 +47,28 @@ selinux_compute_relabel_context(rshd_t) selinux_compute_user_contexts(rshd_t) -auth_domtrans_chk_passwd(rshd_t) +auth_login_pgm_domain(rshd_t) -+auth_search_key(rshd_t) +auth_write_login_records(rshd_t) corecmd_read_bin_symlinks(rshd_t) @@ -8984,7 +8062,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd userdom_search_all_users_home_content(rshd_t) tunable_policy(`use_nfs_home_dirs',` -@@ -78,10 +85,8 @@ +@@ -78,10 +83,8 @@ optional_policy(` kerberos_use(rshd_t) @@ -8997,7 +8075,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd ') optional_policy(` -@@ -90,4 +95,5 @@ +@@ -90,4 +93,5 @@ optional_policy(` unconfined_shell_domtrans(rshd_t) @@ -9005,8 +8083,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.1.0/policy/modules/services/rsync.te --- nsaserefpolicy/policy/modules/services/rsync.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/rsync.te 2007-10-24 15:06:50.000000000 -0400 -@@ -8,6 +8,13 @@ ++++ serefpolicy-3.1.0/policy/modules/services/rsync.te 2007-11-06 09:28:35.000000000 -0500 +@@ -8,8 +8,15 @@ ## ##

@@ -9018,8 +8096,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn +## +##

## Allow rsync to modify public files - ## used for public file transfer services. +-## used for public file transfer services. ++## used for public file transfer services. Files/Directories must be labeled public_content_rw_t. ##

+ ## + gen_tunable(allow_rsync_anon_write,false) @@ -58,6 +65,8 @@ manage_files_pattern(rsync_t,rsync_var_run_t,rsync_var_run_t) files_pid_filetrans(rsync_t,rsync_var_run_t,file) @@ -9055,7 +8136,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.1.0/policy/modules/services/samba.fc --- nsaserefpolicy/policy/modules/services/samba.fc 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/samba.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/samba.fc 2007-11-06 09:28:35.000000000 -0500 @@ -15,6 +15,7 @@ /usr/bin/ntlm_auth -- gen_context(system_u:object_r:winbind_helper_exec_t,s0) /usr/bin/smbmount -- gen_context(system_u:object_r:smbmount_exec_t,s0) @@ -9075,7 +8156,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb /var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.1.0/policy/modules/services/samba.if --- nsaserefpolicy/policy/modules/services/samba.if 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/samba.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/samba.if 2007-11-06 09:28:35.000000000 -0500 @@ -331,6 +331,25 @@ ######################################## @@ -9215,7 +8296,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.1.0/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/samba.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/samba.te 2007-11-06 09:28:35.000000000 -0500 +@@ -9,7 +9,7 @@ + ## + ##

+ ## Allow samba to modify public files +-## used for public file transfer services. ++## used for public file transfer services. Files/Directories must be labeled public_content_rw_t. + ##

+ ## + gen_tunable(allow_smbd_anon_write,false) @@ -137,6 +137,11 @@ type winbind_var_run_t; files_pid_file(winbind_var_run_t) @@ -9421,7 +8511,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb -allow swat_t self:capability { setuid setgid }; -allow swat_t self:process signal_perms; -+allow swat_t self:capability { setuid setgid sys_resource net_bind_service }; ++allow swat_t self:capability { setuid setgid sys_resource }; +allow swat_t self:process { setrlimit signal_perms }; allow swat_t self:fifo_file rw_file_perms; allow swat_t self:netlink_tcpdiag_socket r_netlink_socket_perms; @@ -9620,7 +8710,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +allow smbcontrol_t nmbd_var_run_t:file { read lock }; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.1.0/policy/modules/services/sasl.te --- nsaserefpolicy/policy/modules/services/sasl.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/sasl.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/sasl.te 2007-11-06 09:28:35.000000000 -0500 @@ -64,6 +64,7 @@ selinux_compute_access_vector(saslauthd_t) @@ -9631,7 +8721,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl domain_use_interactive_fds(saslauthd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.1.0/policy/modules/services/sendmail.if --- nsaserefpolicy/policy/modules/services/sendmail.if 2007-08-27 13:57:20.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/sendmail.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/sendmail.if 2007-11-06 09:28:35.000000000 -0500 @@ -149,3 +149,85 @@ logging_log_filetrans($1,sendmail_log_t,file) @@ -9720,7 +8810,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.1.0/policy/modules/services/sendmail.te --- nsaserefpolicy/policy/modules/services/sendmail.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/sendmail.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/sendmail.te 2007-11-06 09:28:35.000000000 -0500 @@ -20,19 +20,22 @@ mta_mailserver_delivery(sendmail_t) mta_mailserver_sender(sendmail_t) @@ -9819,11 +8909,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send +') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.1.0/policy/modules/services/setroubleshoot.te ---- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/setroubleshoot.te 2007-10-24 15:06:50.000000000 -0400 -@@ -111,6 +111,7 @@ +--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-10-29 07:52:49.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/setroubleshoot.te 2007-11-06 09:28:35.000000000 -0500 +@@ -110,6 +110,7 @@ + optional_policy(` dbus_system_bus_client_template(setroubleshootd, setroubleshootd_t) - dbus_send_system_bus(setroubleshootd_t) dbus_connect_system_bus(setroubleshootd_t) + dbus_system_domain(setroubleshootd_t,setroubleshootd_exec_t) ') @@ -9831,7 +8921,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.1.0/policy/modules/services/snmp.te --- nsaserefpolicy/policy/modules/services/snmp.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/snmp.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/snmp.te 2007-11-06 09:28:35.000000000 -0500 @@ -81,8 +81,7 @@ files_read_usr_files(snmpd_t) files_read_etc_runtime_files(snmpd_t) @@ -9844,7 +8934,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp fs_getattr_all_fs(snmpd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.fc serefpolicy-3.1.0/policy/modules/services/soundserver.fc --- nsaserefpolicy/policy/modules/services/soundserver.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/soundserver.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/soundserver.fc 2007-11-06 09:28:35.000000000 -0500 @@ -1,5 +1,3 @@ -/etc/nas(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) -/etc/yiff(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) @@ -9860,7 +8950,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun /var/state/yiff(/.*)? gen_context(system_u:object_r:soundd_state_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.te serefpolicy-3.1.0/policy/modules/services/soundserver.te --- nsaserefpolicy/policy/modules/services/soundserver.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/soundserver.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/soundserver.te 2007-11-06 09:28:35.000000000 -0500 @@ -10,9 +10,6 @@ type soundd_exec_t; init_daemon_domain(soundd_t,soundd_exec_t) @@ -9871,7 +8961,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun type soundd_state_t; files_type(soundd_state_t) -@@ -28,20 +25,24 @@ +@@ -28,20 +25,21 @@ ######################################## # @@ -9879,16 +8969,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun +# sound server local policy # ++allow soundd_t self:capability dac_override; dontaudit soundd_t self:capability sys_tty_config; allow soundd_t self:process { setpgid signal_perms }; -+ allow soundd_t self:tcp_socket create_stream_socket_perms; allow soundd_t self:udp_socket create_socket_perms; -+ +allow soundd_t self:unix_stream_socket { connectto create_stream_socket_perms }; + -+allow soundd_t self:capability { dac_override }; -+ +fs_getattr_all_fs(soundd_t) + # for yiff @@ -9901,7 +8988,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun manage_files_pattern(soundd_t,soundd_state_t,soundd_state_t) manage_lnk_files_pattern(soundd_t,soundd_state_t,soundd_state_t) -@@ -55,8 +56,10 @@ +@@ -55,8 +53,10 @@ manage_sock_files_pattern(soundd_t,soundd_tmpfs_t,soundd_tmpfs_t) fs_tmpfs_filetrans(soundd_t,soundd_tmpfs_t,{ dir file lnk_file sock_file fifo_file }) @@ -9913,7 +9000,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun kernel_read_kernel_sysctls(soundd_t) kernel_list_proc(soundd_t) -@@ -99,6 +102,10 @@ +@@ -99,6 +99,10 @@ userdom_dontaudit_search_sysadm_home_dirs(soundd_t) optional_policy(` @@ -9924,9 +9011,34 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun seutil_sigchld_newrole(soundd_t) ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.1.0/policy/modules/services/spamassassin.te +--- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-10-12 08:56:07.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/spamassassin.te 2007-11-06 09:28:35.000000000 -0500 +@@ -81,7 +81,7 @@ + + # var/lib files for spamd + allow spamd_t spamd_var_lib_t:dir list_dir_perms; +-read_files_pattern(spamd_t,spamd_var_lib_t,spamd_var_lib_t) ++manage_files_pattern(spamd_t,spamd_var_lib_t,spamd_var_lib_t) + + manage_dirs_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t) + manage_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t) +@@ -150,10 +150,12 @@ + userdom_dontaudit_search_sysadm_home_dirs(spamd_t) + + tunable_policy(`use_nfs_home_dirs',` ++ fs_manage_nfs_dirs(spamd_t) + fs_manage_nfs_files(spamd_t) + ') + + tunable_policy(`use_samba_home_dirs',` ++ fs_manage_cifs_dirs(spamd_t) + fs_manage_cifs_files(spamd_t) + ') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.1.0/policy/modules/services/squid.fc --- nsaserefpolicy/policy/modules/services/squid.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/squid.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/squid.fc 2007-11-06 09:28:35.000000000 -0500 @@ -12,3 +12,5 @@ /var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0) @@ -9935,7 +9047,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-3.1.0/policy/modules/services/squid.if --- nsaserefpolicy/policy/modules/services/squid.if 2007-05-07 10:32:44.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/squid.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/squid.if 2007-11-06 09:28:35.000000000 -0500 @@ -131,3 +131,22 @@ interface(`squid_use',` refpolicywarn(`$0($*) has been deprecated.') @@ -9961,7 +9073,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.1.0/policy/modules/services/squid.te --- nsaserefpolicy/policy/modules/services/squid.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/squid.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/squid.te 2007-11-06 09:28:35.000000000 -0500 @@ -36,7 +36,7 @@ # Local policy # @@ -10047,7 +9159,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.1.0/policy/modules/services/ssh.if --- nsaserefpolicy/policy/modules/services/ssh.if 2007-07-23 10:20:13.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/ssh.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/ssh.if 2007-11-06 09:28:35.000000000 -0500 @@ -202,6 +202,7 @@ # template(`ssh_per_role_template',` @@ -10073,59 +9185,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. tunable_policy(`use_samba_home_dirs',` @@ -520,6 +523,7 @@ - - optional_policy(` - kerberos_use($1_t) -+ kerberos_manage_host_rcache($1_t) - ') - - optional_policy(` -@@ -708,3 +712,42 @@ - - dontaudit $1 sshd_key_t:file { getattr read }; - ') -+ -+######################################## -+## -+## Inherit and use a file descriptor -+## from the ssh-agent. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`ssh_use_user_ssh_agent_fds',` -+ gen_require(` -+ type $1_ssh_agent_t; -+ ') -+ -+ allow $2 $1_ssh_agent_t:fd use; -+') -+ -+######################################## -+## -+## dontaudit use of file descriptor -+## from the ssh-agent. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`ssh_dontaudit_use_user_ssh_agent_fds',` -+ gen_require(` -+ type $1_ssh_agent_t; -+ ') -+ -+ dontaudit $2 $1_ssh_agent_t:fd use; -+') -+ + + optional_policy(` + kerberos_use($1_t) ++ kerberos_manage_host_rcache($1_t) + ') + + optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.1.0/policy/modules/services/ssh.te --- nsaserefpolicy/policy/modules/services/ssh.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/ssh.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/ssh.te 2007-11-06 09:28:35.000000000 -0500 @@ -24,7 +24,7 @@ # Type for the ssh-agent executable. @@ -10135,28 +9204,28 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. # ssh client executable. type ssh_exec_t; -@@ -80,6 +80,8 @@ +@@ -80,6 +80,9 @@ corenet_tcp_bind_xserver_port(sshd_t) corenet_sendrecv_xserver_server_packets(sshd_t) +userdom_read_all_users_home_dirs_symlinks(sshd_t) ++userdom_read_all_users_home_content_files(sshd_t) + tunable_policy(`ssh_sysadm_login',` # Relabel and access ptys created by sshd # ioctl is necessary for logout() processing for utmp entry and for w to -@@ -100,6 +102,11 @@ - userdom_use_unpriv_users_ptys(sshd_t) +@@ -101,6 +104,10 @@ ') -+ -+optional_policy(` + optional_policy(` + xserver_getattr_xauth(sshd_t) +') + - optional_policy(` ++optional_policy(` daemontools_service_domain(sshd_t, sshd_exec_t) ') -@@ -119,8 +126,12 @@ + +@@ -119,7 +126,10 @@ ') optional_policy(` @@ -10166,21 +9235,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. + +optional_policy(` unconfined_shell_domtrans(sshd_t) -+ userdom_read_all_users_home_content_files(sshd_t) ') - ifdef(`TODO',` -@@ -222,6 +233,9 @@ - - logging_send_syslog_msg(ssh_keygen_t) - -+allow ssh_keygen_t proc_t:dir list_dir_perms; -+allow ssh_keygen_t proc_t:lnk_file read; -+ - userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t) - - optional_policy(` -@@ -229,9 +243,15 @@ +@@ -229,6 +239,10 @@ ') optional_policy(` @@ -10191,14 +9248,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. seutil_sigchld_newrole(ssh_keygen_t) ') - optional_policy(` - udev_read_db(ssh_keygen_t) - ') -+ -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/telnet.te serefpolicy-3.1.0/policy/modules/services/telnet.te --- nsaserefpolicy/policy/modules/services/telnet.te 2007-07-16 14:09:46.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/telnet.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/telnet.te 2007-11-06 09:28:35.000000000 -0500 @@ -32,12 +32,13 @@ allow telnetd_t self:udp_socket create_socket_perms; # for identd; cjp: this should probably only be inetd_child rules? @@ -10267,11 +9319,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/teln -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-3.1.0/policy/modules/services/tftp.te --- nsaserefpolicy/policy/modules/services/tftp.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/tftp.te 2007-10-24 15:06:50.000000000 -0400 -@@ -16,6 +16,14 @@ ++++ serefpolicy-3.1.0/policy/modules/services/tftp.te 2007-11-06 09:28:35.000000000 -0500 +@@ -16,6 +16,17 @@ type tftpdir_t; files_type(tftpdir_t) ++type tftpdir_rw_t; ++files_type(tftpdir_rw_t) ++ +## +##

+## Allow tftp to modify public files @@ -10283,7 +9338,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp ######################################## # # Local policy -@@ -33,6 +41,10 @@ +@@ -33,6 +44,10 @@ allow tftpd_t tftpdir_t:file { read getattr }; allow tftpd_t tftpdir_t:lnk_file { getattr read }; @@ -10294,7 +9349,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp manage_files_pattern(tftpd_t,tftpd_var_run_t,tftpd_var_run_t) files_pid_filetrans(tftpd_t,tftpd_var_run_t,file) -@@ -73,6 +85,10 @@ +@@ -73,6 +88,10 @@ miscfiles_read_localization(tftpd_t) miscfiles_read_public_files(tftpd_t) @@ -10305,28 +9360,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp sysnet_read_config(tftpd_t) sysnet_use_ldap(tftpd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucspitcp.te serefpolicy-3.1.0/policy/modules/services/ucspitcp.te ---- nsaserefpolicy/policy/modules/services/ucspitcp.te 2007-07-16 14:09:46.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/ucspitcp.te 2007-10-24 15:06:50.000000000 -0400 -@@ -35,6 +35,7 @@ - corenet_udp_sendrecv_all_ports(rblsmtpd_t) - corenet_tcp_bind_all_nodes(rblsmtpd_t) - corenet_udp_bind_generic_port(rblsmtpd_t) -+corenet_dontaudit_udp_bind_all_ports(rblsmtpd_t) - - files_read_etc_files(rblsmtpd_t) - files_search_var(rblsmtpd_t) -@@ -78,6 +79,7 @@ - corenet_tcp_bind_dns_port(ucspitcp_t) - corenet_udp_bind_dns_port(ucspitcp_t) - corenet_udp_bind_generic_port(ucspitcp_t) -+corenet_dontaudit_udp_bind_all_ports(ucspitcp_t) - - # server packets: - corenet_sendrecv_ftp_server_packets(ucspitcp_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.1.0/policy/modules/services/uwimap.te --- nsaserefpolicy/policy/modules/services/uwimap.te 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/uwimap.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/uwimap.te 2007-11-06 09:28:35.000000000 -0500 @@ -64,6 +64,7 @@ fs_search_auto_mountpoints(imapd_t) @@ -10337,18 +9373,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwim libs_use_shared_libs(imapd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.1.0/policy/modules/services/w3c.fc --- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/w3c.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/w3c.fc 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,2 @@ +/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0) +/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.1.0/policy/modules/services/w3c.if --- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/w3c.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/w3c.if 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1 @@ +##

W3C diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.1.0/policy/modules/services/w3c.te --- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/services/w3c.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/w3c.te 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,14 @@ +policy_module(w3c,1.2.1) + @@ -10366,7 +9402,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c. +miscfiles_read_certs(httpd_w3c_validator_script_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.1.0/policy/modules/services/xserver.fc --- nsaserefpolicy/policy/modules/services/xserver.fc 2007-10-15 16:11:05.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/xserver.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/xserver.fc 2007-11-06 09:28:35.000000000 -0500 @@ -32,11 +32,6 @@ /etc/X11/wdm/Xstartup.* -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/Xsession[^/]* -- gen_context(system_u:object_r:xsession_exec_t,s0) @@ -10409,23 +9445,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser /var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.1.0/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2007-10-12 08:56:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/xserver.if 2007-10-24 15:06:50.000000000 -0400 -@@ -126,6 +126,8 @@ ++++ serefpolicy-3.1.0/policy/modules/services/xserver.if 2007-11-07 12:15:33.000000000 -0500 +@@ -58,7 +58,6 @@ + allow $1_xserver_t self:msg { send receive }; + allow $1_xserver_t self:unix_dgram_socket { create_socket_perms sendto }; + allow $1_xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; +- allow $1_xserver_t self:netlink_route_socket r_netlink_socket_perms; + allow $1_xserver_t self:tcp_socket create_stream_socket_perms; + allow $1_xserver_t self:udp_socket create_socket_perms; + +@@ -126,6 +125,7 @@ # read events - the synaptics touchpad driver reads raw events dev_rw_input_dev($1_xserver_t) dev_rwx_zero($1_xserver_t) + dev_read_urand($1_xserver_t) -+ domain_mmap_low($1_xserver_t) -@@ -141,10 +143,12 @@ +@@ -141,10 +141,14 @@ fs_getattr_xattr_fs($1_xserver_t) fs_search_nfs($1_xserver_t) fs_search_auto_mountpoints($1_xserver_t) - fs_search_ramfs($1_xserver_t) + fs_manage_ramfs_files($1_xserver_t) + fs_list_inotifyfs($1_xserver_t) ++ ++ auth_use_nsswitch($1_xserver_t) init_getpgid($1_xserver_t) @@ -10433,7 +9478,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser term_setattr_unallocated_ttys($1_xserver_t) term_use_unallocated_ttys($1_xserver_t) -@@ -251,7 +255,7 @@ +@@ -160,8 +164,6 @@ + + seutil_dontaudit_search_config($1_xserver_t) + +- sysnet_read_config($1_xserver_t) +- + ifndef(`distro_redhat',` + allow $1_xserver_t self:process { execmem execheap execstack }; + ') +@@ -179,14 +181,6 @@ + ') + + optional_policy(` +- nis_use_ypbind($1_xserver_t) +- ') +- +- optional_policy(` +- nscd_socket_use($1_xserver_t) +- ') +- +- optional_policy(` + rhgb_getpgid($1_xserver_t) + rhgb_signal($1_xserver_t) + ') +@@ -251,7 +245,7 @@ userdom_user_home_content($1,$1_fonts_cache_t) type $1_fonts_config_t, fonts_config_type; @@ -10442,24 +9511,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser type $1_iceauth_t; domain_type($1_iceauth_t) -@@ -281,12 +285,16 @@ - +@@ -282,11 +276,14 @@ domtrans_pattern($1_xserver_t, xauth_exec_t, $1_xauth_t) -+ read_files_pattern($1_xserver_t, $2, $2) allow $1_xserver_t $1_xauth_home_t:file { getattr read }; + allow xdm_t $1_xauth_home_t:file append_file_perms; domtrans_pattern($2, xserver_exec_t, $1_xserver_t) allow $1_xserver_t $2:process signal; ++ read_files_pattern($1_xserver_t, $2, $2) allow $1_xserver_t $2:shm rw_shm_perms; -+ # Certain X Libraries want to read /proc/self/cmdline when started with startx + allow $1_xserver_t $2:file read_file_perms; manage_dirs_pattern($2,$1_fonts_t,$1_fonts_t) manage_files_pattern($2,$1_fonts_t,$1_fonts_t) -@@ -316,6 +324,7 @@ +@@ -316,6 +313,7 @@ userdom_use_user_ttys($1,$1_xserver_t) userdom_setattr_user_ttys($1,$1_xserver_t) userdom_rw_user_tmpfs_files($1,$1_xserver_t) @@ -10467,7 +9534,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser xserver_use_user_fonts($1,$1_xserver_t) xserver_rw_xdm_tmp_files($1_xauth_t) -@@ -353,12 +362,6 @@ +@@ -353,12 +351,6 @@ # allow ps to show xauth ps_process_pattern($2,$1_xauth_t) @@ -10480,7 +9547,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser domain_use_interactive_fds($1_xauth_t) files_read_etc_files($1_xauth_t) -@@ -387,6 +390,14 @@ +@@ -387,6 +379,14 @@ ') optional_policy(` @@ -10495,11 +9562,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser nis_use_ypbind($1_xauth_t) ') -@@ -537,16 +548,14 @@ +@@ -536,17 +536,15 @@ + template(`xserver_user_client_template',` gen_require(` - type xdm_t, xdm_tmp_t; +- type xdm_t, xdm_tmp_t; - type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t; ++ type xdm_t, xdm_tmp_t, xdm_xserver_t; ') - allow $2 self:shm create_shm_perms; @@ -10517,7 +9586,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # for when /tmp/.X11-unix is created by the system allow $2 xdm_t:fd use; -@@ -555,25 +564,53 @@ +@@ -555,25 +553,53 @@ allow $2 xdm_tmp_t:sock_file { read write }; dontaudit $2 xdm_t:tcp_socket { read write }; @@ -10579,7 +9648,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ') -@@ -626,6 +663,24 @@ +@@ -626,6 +652,24 @@ ######################################## ## @@ -10604,7 +9673,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ## Transition to a user Xauthority domain. ## ## -@@ -659,6 +714,73 @@ +@@ -659,6 +703,73 @@ ######################################## ## @@ -10678,7 +9747,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ## Transition to a user Xauthority domain. ## ## -@@ -927,6 +1049,7 @@ +@@ -927,6 +1038,7 @@ files_search_tmp($1) allow $1 xdm_tmp_t:dir list_dir_perms; create_sock_files_pattern($1,xdm_tmp_t,xdm_tmp_t) @@ -10686,7 +9755,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ######################################## -@@ -987,6 +1110,37 @@ +@@ -987,6 +1099,37 @@ ######################################## ## @@ -10724,7 +9793,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ## Make an X session script an entrypoint for the specified domain. ## ## -@@ -1136,7 +1290,7 @@ +@@ -1136,7 +1279,7 @@ type xdm_xserver_tmp_t; ') @@ -10733,31 +9802,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ######################################## -@@ -1325,3 +1479,63 @@ +@@ -1325,3 +1468,45 @@ files_search_tmp($1) stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t) ') + +######################################## +## -+## Sigchld XDM -+## -+## -+## -+## Domain to not audit -+## -+## -+# -+interface(`xserver_xdm_sigchld',` -+ gen_require(` -+ type xdm_t; -+ ') -+ -+ allow $1 xdm_t:process sigchld; -+') -+ -+######################################## -+## +## Connect to apmd over an unix stream socket. +## +## @@ -10799,7 +9850,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.1.0/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2007-10-15 16:11:05.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/services/xserver.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/services/xserver.te 2007-11-06 09:28:35.000000000 -0500 @@ -16,6 +16,13 @@ ## @@ -10877,11 +9928,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser miscfiles_read_localization(xdm_t) miscfiles_read_fonts(xdm_t) -@@ -268,9 +284,14 @@ - userdom_create_all_users_keys(xdm_t) - # for .dmrc - userdom_read_unpriv_users_home_content_files(xdm_t) -+ +@@ -271,6 +287,10 @@ # Search /proc for any user domain processes. userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) @@ -10892,33 +9939,28 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t) -@@ -306,6 +327,11 @@ +@@ -306,6 +326,10 @@ optional_policy(` consolekit_dbus_chat(xdm_t) + dbus_system_bus_client_template(xdm, xdm_t) -+ dbus_send_system_bus(xdm_t) + optional_policy(` + hal_dbus_chat(xdm_t) + ') ') optional_policy(` -@@ -348,12 +374,8 @@ +@@ -348,8 +372,8 @@ ') optional_policy(` - unconfined_domain(xdm_t) unconfined_domtrans(xdm_t) -- -- ifndef(`distro_redhat',` -- allow xdm_t self:process { execheap execmem }; -- ') + unconfined_signal(xdm_t) - ifdef(`distro_rhel4',` + ifndef(`distro_redhat',` allow xdm_t self:process { execheap execmem }; -@@ -385,7 +407,7 @@ +@@ -385,7 +409,7 @@ allow xdm_xserver_t xdm_var_lib_t:file { getattr read }; dontaudit xdm_xserver_t xdm_var_lib_t:dir search; @@ -10927,7 +9969,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # Label pid and temporary files with derived types. manage_files_pattern(xdm_xserver_t,xdm_tmp_t,xdm_tmp_t) -@@ -425,6 +447,14 @@ +@@ -425,6 +449,14 @@ ') optional_policy(` @@ -10942,7 +9984,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser resmgr_stream_connect(xdm_t) ') -@@ -434,47 +464,26 @@ +@@ -434,47 +466,31 @@ ') optional_policy(` @@ -10990,10 +10032,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser -allow xdm_t polymember:lnk_file { create unlink }; -# xdm needs access for copying .Xauthority into new home -allow xdm_t polymember:file { create getattr write }; ++ +tunable_policy(`allow_xserver_execmem', ` + allow xdm_xserver_t self:process { execheap execmem execstack }; +') + ++ifndef(`distro_redhat',` ++ allow xdm_xserver_t self:process { execheap execmem }; ++') ++ +ifdef(`distro_rhel4',` + allow xdm_xserver_t self:process { execheap execmem }; ') @@ -11007,100 +10054,39 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser -# -allow pam_t xdm_t:fifo_file { getattr ioctl write }; -') dnl end TODO -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.1.0/policy/modules/system/application.if ---- nsaserefpolicy/policy/modules/system/application.if 2007-07-23 10:20:13.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/application.if 2007-10-24 15:06:50.000000000 -0400 -@@ -63,6 +63,26 @@ - - ######################################## - ## -+## Execute all executable files. -+## -+## -+## -+## Domain allowed access. -+## -+## -+## -+# -+interface(`application_exec_all',` -+ # Need this dontaudit or command completion fires hundreds of avcs -+ corecmd_dontaudit_exec_all_executables($1) -+ corecmd_exec_bin($1) -+ corecmd_exec_shell($1) -+ corecmd_exec_chroot($1) -+ application_exec($1) -+') -+ -+######################################## -+## - ## Create a domain which can be started by users - ## - ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.1.0/policy/modules/system/authlogin.fc ---- nsaserefpolicy/policy/modules/system/authlogin.fc 2006-11-16 17:15:24.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/system/authlogin.fc 2007-10-24 15:06:50.000000000 -0400 -@@ -14,6 +14,7 @@ - /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0) - /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) - /sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0) -+/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0) - ifdef(`distro_suse', ` - /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) - ') -@@ -40,3 +41,5 @@ +--- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-10-29 18:02:31.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/authlogin.fc 2007-11-06 09:28:35.000000000 -0500 +@@ -41,3 +41,5 @@ /var/run/console(/.*)? gen_context(system_u:object_r:pam_var_console_t,s0) /var/run/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0) + +/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.1.0/policy/modules/system/authlogin.if ---- nsaserefpolicy/policy/modules/system/authlogin.if 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/authlogin.if 2007-10-24 15:06:50.000000000 -0400 -@@ -26,7 +26,8 @@ - type $1_chkpwd_t, can_read_shadow_passwords; - application_domain($1_chkpwd_t,chkpwd_exec_t) - -- allow $1_chkpwd_t self:capability { audit_control setuid }; -+ allow $1_chkpwd_t self:capability { dac_override setuid }; -+ dontaudit $1_chkpwd_t self:capability sys_tty_config; - allow $1_chkpwd_t self:process getattr; - - files_list_etc($1_chkpwd_t) -@@ -106,9 +107,6 @@ - role $3 types $1_chkpwd_t; - role $3 types system_chkpwd_t; - -- # cjp: is this really needed? -- allow $2 self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; -- - dontaudit $2 shadow_t:file { getattr read }; - - # Transition from the user domain to this domain. -@@ -169,6 +167,10 @@ - ## - # +--- nsaserefpolicy/policy/modules/system/authlogin.if 2007-10-29 18:02:31.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/authlogin.if 2007-11-06 09:28:35.000000000 -0500 +@@ -169,6 +169,7 @@ interface(`auth_login_pgm_domain',` -+ gen_require(` -+ attribute keyring_type; + gen_require(` + type var_auth_t; + type auth_cache_t; -+ ') + ') domain_type($1) - domain_subj_id_change_exemption($1) -@@ -176,11 +178,31 @@ +@@ -177,12 +178,20 @@ domain_obj_id_change_exemption($1) role system_r types $1; -+ # needed for afs - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=253321 -+ kernel_write_proc_files($1) -+ -+ auth_keyring_domain($1) -+ allow $1 keyring_type:key { search link }; -+ -+ files_list_var_lib($1) -+ manage_files_pattern($1, var_auth_t, var_auth_t) ++ allow $1 self:key manage_key_perms; ++ userdom_manage_all_users_keys($1) + + files_list_var_lib($1) + manage_files_pattern($1, var_auth_t, var_auth_t) + + # needed for afs - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=253321 + kernel_rw_afs_state($1) + + manage_dirs_pattern($1, auth_cache_t, auth_cache_t) + manage_files_pattern($1, auth_cache_t, auth_cache_t) + manage_sock_files_pattern($1, auth_cache_t, auth_cache_t) @@ -11108,39 +10094,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + # for SSP/ProPolice dev_read_urand($1) + # for fingerprint readers +@@ -221,11 +230,17 @@ -+ # for fingerprint readers -+ dev_rw_input_dev($1) -+ dev_rw_generic_usb_dev($1) -+ - files_read_etc_files($1) - -+ fs_list_auto_mountpoints($1) -+ - selinux_get_fs_mount($1) - selinux_validate_context($1) - selinux_compute_access_vector($1) -@@ -196,22 +218,40 @@ - mls_fd_share_all_levels($1) - - auth_domtrans_chk_passwd($1) -+ auth_domtrans_upd_passwd($1) - auth_dontaudit_read_shadow($1) - auth_read_login_records($1) - auth_append_login_records($1) - auth_rw_lastlog($1) -- auth_append_faillog($1) -+ auth_rw_faillog($1) - auth_exec_pam($1) -+ auth_use_nsswitch($1) -+ -+ corenet_tcp_bind_all_rpc_ports($1) -+ corenet_udp_bind_all_rpc_ports($1) - - init_rw_utmp($1) - -+ logging_send_audit_msgs($1) + logging_send_audit_msgs($1) logging_send_syslog_msg($1) +-# logging_set_loginuid($1) + logging_set_loginuid($1) seutil_read_config($1) @@ -11148,214 +10107,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + userdom_set_rlimitnh($1) + -+ optional_policy(` -+ nis_authenticate($1) -+ ') -+ -+ optional_policy(` -+ unconfined_set_rlimitnh($1) -+ ') -+ - tunable_policy(`allow_polyinstantiation',` - files_polyinstantiate_all($1) -+ mount_domtrans($1) - ') - ') - -@@ -309,9 +349,6 @@ - type system_chkpwd_t, chkpwd_exec_t, shadow_t; - ') - -- # cjp: is this really needed? -- allow $1 self:capability audit_control; -- - corecmd_search_bin($1) - domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t) - -@@ -329,6 +366,8 @@ - - optional_policy(` - kerberos_use($1) -+ kerberos_read_keytab($1) -+ kerberos_524_connect($1) - ') - - optional_policy(` -@@ -347,6 +386,37 @@ - - ######################################## - ## -+## Execute chkpwd programs in the chkpwd domain. -+## -+## -+## -+## Domain allowed access. -+## -+## -+## -+## -+## The role to allow hte updpwd domain. -+## -+## -+## -+## -+## The type of the terminal allow the updpwd domain to use. -+## -+## -+# -+interface(`auth_run_chk_passwd',` -+ gen_require(` -+ type system_chkpwd_t; -+ ') -+ -+ auth_domtrans_chk_passwd($1) -+ role $2 types system_chkpwd_t; -+ allow system_chkpwd_t $3:chr_file rw_file_perms; -+ -+') -+ -+######################################## -+## - ## Get the attributes of the shadow passwords file. - ## - ## -@@ -695,6 +765,24 @@ - - ######################################## - ## -+## Execute pam programs in the pam domain. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`auth_signal_pam',` -+ gen_require(` -+ type pam_t; -+ ') -+ -+ allow $1 pam_t:process signal; -+') -+ -+######################################## -+## - ## Execute pam programs in the PAM domain. - ## - ## -@@ -1318,16 +1406,14 @@ - ## - # - interface(`auth_use_nsswitch',` -- gen_require(` -- type var_auth_t; -- ') - - allow $1 self:netlink_route_socket r_netlink_socket_perms; - -- allow $1 var_auth_t:dir list_dir_perms; -- allow $1 var_auth_t:file manage_file_perms; - files_list_var_lib($1) - -+ # read /etc/nsswitch.conf -+ files_read_etc_files($1) -+ - miscfiles_read_certs($1) - - sysnet_dns_name_resolve($1) -@@ -1347,6 +1433,8 @@ - - optional_policy(` - samba_stream_connect_winbind($1) -+ samba_read_var_files($1) -+ samba_dontaudit_write_var_files($1) - ') - ') - -@@ -1381,3 +1469,163 @@ - typeattribute $1 can_write_shadow_passwords; - typeattribute $1 can_relabelto_shadow_passwords; - ') -+ -+######################################## -+## -+## read login keyrings. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`auth_read_key',` -+ gen_require(` -+ attribute keyring_type; -+ ') -+ -+ allow $1 keyring_type:key { read search view }; -+') -+ -+######################################## -+## -+## search login keyrings. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`auth_search_key',` -+ gen_require(` -+ attribute keyring_type; -+ ') -+ -+ allow $1 keyring_type:key { search link }; -+') -+ -+ -+ -+######################################## -+## -+## Make the specified domain a keyring domain -+## -+## -+## -+## Domain type used for a login program domain. -+## -+## -+# -+interface(`auth_keyring_domain',` -+ gen_require(` -+ attribute keyring_type; -+ ') -+ -+ typeattribute $1 keyring_type; -+') -+ -+######################################## -+## -+## Execute a domain transition to run unix_update. -+## -+## -+## -+## Domain allowed to transition. -+## -+## -+# -+interface(`auth_domtrans_upd_passwd',` -+ gen_require(` -+ type updpwd_t, updpwd_exec_t; -+ ') -+ -+ domtrans_pattern($1,updpwd_exec_t,updpwd_t) -+ auth_dontaudit_read_shadow($1) -+ -+') ++ optional_policy(` ++ nis_authenticate($1) ++ ') + -+######################################## -+## + tunable_policy(`allow_polyinstantiation',` + files_polyinstantiate_all($1) + ') +@@ -342,6 +357,8 @@ + + optional_policy(` + kerberos_use($1) ++ kerberos_read_keytab($1) ++ kerberos_524_connect($1) + ') + + optional_policy(` +@@ -440,6 +457,59 @@ + + ######################################## + ## +## Execute a domain transition to run unix_update in Read Only Mode. +## +## @@ -11379,36 +10150,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + +######################################## +## -+## Execute updpwd programs in the updpwd domain. -+## -+## -+## -+## Domain allowed access. -+## -+## -+## -+## -+## The role to allow the updpwd domain. -+## -+## -+## -+## -+## The type of the terminal allow the updpwd domain to use. -+## -+## -+# -+interface(`auth_run_upd_passwd',` -+ gen_require(` -+ type updpwd_t; -+ ') -+ -+ auth_domtrans_upd_passwd($1) -+ role $2 types updpwd_t; -+ allow updpwd_t $3:chr_file rw_file_perms; -+') -+ -+######################################## -+## +## Execute updpwd programs in the chkpwd domain. +## +## @@ -11437,24 +10178,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + allow system_chkpwd_t $3:chr_file rw_file_perms; +') + ++######################################## ++## + ## Get the attributes of the shadow passwords file. + ## + ## +@@ -1457,6 +1527,7 @@ + optional_policy(` + samba_stream_connect_winbind($1) + samba_read_var_files($1) ++ samba_dontaudit_write_var_files($1) + ') + ') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.1.0/policy/modules/system/authlogin.te ---- nsaserefpolicy/policy/modules/system/authlogin.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/authlogin.te 2007-10-24 15:06:50.000000000 -0400 -@@ -9,6 +9,13 @@ - attribute can_read_shadow_passwords; - attribute can_write_shadow_passwords; - attribute can_relabelto_shadow_passwords; -+attribute keyring_type; -+ -+type updpwd_t; -+type updpwd_exec_t; -+domain_type(updpwd_t) -+domain_entry_file(updpwd_t,updpwd_exec_t) -+role system_r types updpwd_t; - - type chkpwd_exec_t; - application_executable_file(chkpwd_exec_t) -@@ -53,6 +60,9 @@ +--- nsaserefpolicy/policy/modules/system/authlogin.te 2007-10-29 18:02:31.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/authlogin.te 2007-11-06 09:28:35.000000000 -0500 +@@ -59,6 +59,9 @@ type utempter_exec_t; application_domain(utempter_t,utempter_exec_t) @@ -11464,99 +10204,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo # # var_auth_t is the type of /var/lib/auth, usually # used for auth data in pam_able -@@ -67,6 +77,10 @@ +@@ -73,6 +76,9 @@ authlogin_common_auth_domain_template(system) role system_r types system_chkpwd_t; +# Read only version of updpwd +domain_entry_file(system_chkpwd_t,updpwd_exec_t) + -+ ######################################## # # PAM local policy -@@ -94,10 +108,14 @@ - allow pam_t pam_tmp_t:file manage_file_perms; - files_tmp_filetrans(pam_t, pam_tmp_t, { file dir }) - -+auth_use_nsswitch(pam_t) -+ - kernel_read_system_state(pam_t) - - fs_search_auto_mountpoints(pam_t) - -+miscfiles_read_localization(pam_t) -+ - term_use_all_user_ttys(pam_t) - term_use_all_user_ptys(pam_t) - -@@ -149,6 +167,8 @@ - dev_setattr_apm_bios_dev(pam_console_t) - dev_getattr_dri_dev(pam_console_t) - dev_setattr_dri_dev(pam_console_t) -+dev_getattr_event_dev(pam_console_t) -+dev_setattr_event_dev(pam_console_t) - dev_getattr_framebuffer_dev(pam_console_t) - dev_setattr_framebuffer_dev(pam_console_t) - dev_getattr_generic_usb_dev(pam_console_t) -@@ -159,6 +179,8 @@ - dev_setattr_mouse_dev(pam_console_t) - dev_getattr_power_mgmt_dev(pam_console_t) - dev_setattr_power_mgmt_dev(pam_console_t) -+dev_getattr_printer_dev(pam_console_t) -+dev_setattr_printer_dev(pam_console_t) - dev_getattr_scanner_dev(pam_console_t) - dev_setattr_scanner_dev(pam_console_t) - dev_getattr_sound_dev(pam_console_t) -@@ -200,6 +222,7 @@ - - fs_list_auto_mountpoints(pam_console_t) - fs_list_noxattr_fs(pam_console_t) -+fs_getattr_all_fs(pam_console_t) - - init_use_fds(pam_console_t) - init_use_script_ptys(pam_console_t) -@@ -236,7 +259,7 @@ - - optional_policy(` - xserver_read_xdm_pid(pam_console_t) -- xserver_use_xdm_fds(pam_t) -+ xserver_dontaudit_write_log(pam_console_t) - ') - - ######################################## -@@ -302,3 +325,28 @@ - xserver_use_xdm_fds(utempter_t) - xserver_rw_xdm_pipes(utempter_t) - ') -+ -+######################################## -+# -+# updpwd local policy -+# -+ -+allow updpwd_t self:process setfscreate; -+allow updpwd_t self:fifo_file { read write }; -+allow updpwd_t self:unix_stream_socket create_stream_socket_perms; -+allow updpwd_t self:unix_dgram_socket create_socket_perms; -+ -+files_read_etc_files(updpwd_t) -+libs_use_ld_so(updpwd_t) -+libs_use_shared_libs(updpwd_t) -+miscfiles_read_localization(updpwd_t) -+ -+auth_manage_shadow(updpwd_t) -+auth_use_nsswitch(updpwd_t) -+ -+term_dontaudit_use_console(updpwd_t) -+term_dontaudit_use_console(updpwd_t) -+term_dontaudit_use_unallocated_ttys(updpwd_t) -+files_manage_etc_files(updpwd_t) -+kernel_read_system_state(updpwd_t) -+logging_send_syslog_msg(updpwd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.1.0/policy/modules/system/fstools.fc --- nsaserefpolicy/policy/modules/system/fstools.fc 2007-09-26 12:15:01.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/fstools.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/fstools.fc 2007-11-06 09:28:35.000000000 -0500 @@ -1,4 +1,3 @@ -/sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0) @@ -11572,7 +10232,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.1.0/policy/modules/system/fstools.if --- nsaserefpolicy/policy/modules/system/fstools.if 2007-08-22 17:33:53.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/fstools.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/fstools.if 2007-11-06 09:28:35.000000000 -0500 @@ -142,3 +142,20 @@ allow $1 swapfile_t:file getattr; @@ -11596,7 +10256,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.1.0/policy/modules/system/fstools.te --- nsaserefpolicy/policy/modules/system/fstools.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/fstools.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/fstools.te 2007-11-06 09:28:35.000000000 -0500 @@ -109,8 +109,7 @@ term_use_console(fsadm_t) @@ -11615,14 +10275,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.1.0/policy/modules/system/fusermount.fc --- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/system/fusermount.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/fusermount.fc 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,3 @@ + +/usr/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) +/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.1.0/policy/modules/system/fusermount.if --- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/system/fusermount.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/fusermount.if 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,41 @@ +## policy for fusermount + @@ -11668,7 +10328,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm \ No newline at end of file diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.1.0/policy/modules/system/fusermount.te --- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/system/fusermount.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/fusermount.te 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,45 @@ +policy_module(fusermount,1.0.0) + @@ -11717,7 +10377,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.1.0/policy/modules/system/getty.te --- nsaserefpolicy/policy/modules/system/getty.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/getty.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/getty.te 2007-11-06 09:28:35.000000000 -0500 @@ -33,7 +33,8 @@ # @@ -11730,7 +10390,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty. allow getty_t self:fifo_file rw_fifo_file_perms; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.1.0/policy/modules/system/hostname.te --- nsaserefpolicy/policy/modules/system/hostname.te 2007-01-02 12:57:49.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/system/hostname.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/hostname.te 2007-11-06 09:28:35.000000000 -0500 @@ -8,7 +8,9 @@ type hostname_t; @@ -11756,7 +10416,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplug.te serefpolicy-3.1.0/policy/modules/system/hotplug.te --- nsaserefpolicy/policy/modules/system/hotplug.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/hotplug.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/hotplug.te 2007-11-06 09:28:35.000000000 -0500 @@ -179,6 +179,7 @@ sysnet_read_dhcpc_pid(hotplug_t) sysnet_rw_dhcp_config(hotplug_t) @@ -11766,9 +10426,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplu optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.1.0/policy/modules/system/init.if ---- nsaserefpolicy/policy/modules/system/init.if 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/init.if 2007-10-24 15:06:50.000000000 -0400 -@@ -211,6 +211,21 @@ +--- nsaserefpolicy/policy/modules/system/init.if 2007-10-29 18:02:31.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/init.if 2007-11-07 10:40:22.000000000 -0500 +@@ -211,6 +211,13 @@ kernel_dontaudit_use_fds($1) ') ') @@ -11779,18 +10439,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i + term_dontaudit_use_all_user_ttys($1) + term_dontaudit_use_all_user_ptys($1) + ') -+ -+ optional_policy(` -+ tunable_policy(`allow_daemons_use_tty',` -+ unconfined_use_terminals($1) -+ ', ` -+ unconfined_dontaudit_use_terminals($1) -+ ') -+ ') ') ######################################## -@@ -540,18 +555,19 @@ +@@ -242,11 +249,11 @@ + init_system_domain($1,$2) + + ifdef(`enable_mcs',` +- range_transition initrc_t $2:process $3; ++ range_transition initrc_t $2 $3; + ') + + ifdef(`enable_mls',` +- range_transition initrc_t $2:process $3; ++ range_transition initrc_t $2 $3; + ') + ') + +@@ -540,18 +547,19 @@ # interface(`init_spec_domtrans_script',` gen_require(` @@ -11814,26 +10480,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ') -@@ -567,18 +583,46 @@ +@@ -567,18 +575,46 @@ # interface(`init_domtrans_script',` gen_require(` - type initrc_t, initrc_exec_t; + type initrc_t; + attribute initscript; - ') - - files_list_etc($1) -- domtrans_pattern($1,initrc_exec_t,initrc_t) ++ ') ++ ++ files_list_etc($1) + domtrans_pattern($1,initscript,initrc_t) - - ifdef(`enable_mcs',` -- range_transition $1 initrc_exec_t:process s0; ++ ++ ifdef(`enable_mcs',` + range_transition $1 initscript:process s0; - ') - - ifdef(`enable_mls',` -- range_transition $1 initrc_exec_t:process s0 - mls_systemhigh; ++ ') ++ ++ ifdef(`enable_mls',` + range_transition $1 initscript:process s0 - mls_systemhigh; + ') +') @@ -11851,21 +10514,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i +interface(`init_script_domtrans_spec',` + gen_require(` + type initrc_t; -+ ') -+ -+ files_list_etc($1) + ') + + files_list_etc($1) +- domtrans_pattern($1,initrc_exec_t,initrc_t) + domtrans_pattern($1,$2,initrc_t) -+ -+ ifdef(`enable_mcs',` + + ifdef(`enable_mcs',` +- range_transition $1 initrc_exec_t:process s0; + range_transition $1 $2:process s0; -+ ') -+ -+ ifdef(`enable_mls',` + ') + + ifdef(`enable_mls',` +- range_transition $1 initrc_exec_t:process s0 - mls_systemhigh; + range_transition $1 $2:process s0 - mls_systemhigh; ') ') -@@ -609,11 +653,11 @@ +@@ -609,11 +645,11 @@ # cjp: added for gentoo integrated run_init interface(`init_script_file_domtrans',` gen_require(` @@ -11879,7 +10545,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -684,11 +728,11 @@ +@@ -684,11 +720,11 @@ # interface(`init_getattr_script_files',` gen_require(` @@ -11893,7 +10559,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -703,11 +747,11 @@ +@@ -703,11 +739,11 @@ # interface(`init_exec_script_files',` gen_require(` @@ -11907,7 +10573,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -931,6 +975,7 @@ +@@ -931,6 +967,7 @@ dontaudit $1 initrc_t:unix_stream_socket connectto; ') @@ -11915,7 +10581,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ######################################## ## ## Send messages to init scripts over dbus. -@@ -1030,11 +1075,11 @@ +@@ -1030,11 +1067,11 @@ # interface(`init_read_script_files',` gen_require(` @@ -11929,7 +10595,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -1252,7 +1297,7 @@ +@@ -1252,7 +1289,7 @@ type initrc_var_run_t; ') @@ -11938,7 +10604,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -1273,3 +1318,64 @@ +@@ -1273,3 +1310,64 @@ files_search_pids($1) allow $1 initrc_var_run_t:file manage_file_perms; ') @@ -11959,8 +10625,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i + ') + + allow $1 init_t:dir search_dir_perms; -+ allow $1 init_t:file r_file_perms; -+ allow $1 init_t:lnk_file r_file_perms; ++ allow $1 init_t:file read_file_perms; ++ allow $1 init_t:lnk_file read_file_perms; +') + +######################################## @@ -12004,15 +10670,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i + +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.1.0/policy/modules/system/init.te ---- nsaserefpolicy/policy/modules/system/init.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/init.te 2007-10-24 15:06:50.000000000 -0400 +--- nsaserefpolicy/policy/modules/system/init.te 2007-10-29 07:52:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/init.te 2007-11-06 09:28:35.000000000 -0500 @@ -10,6 +10,20 @@ # Declarations # +## +##

-+## Allow all daemons the ability to use unallocated ttys ++## Allow all daemons the ability to read/write terminals +##

+## +gen_tunable(allow_daemons_use_tty,false) @@ -12054,10 +10720,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t # is ~sys_module really needed? observed: # sys_boot # sys_tty_config -@@ -175,9 +191,13 @@ - unconfined_domain(init_t) +@@ -171,13 +187,13 @@ + nscd_socket_use(init_t) ') +-optional_policy(` +- unconfined_domain(init_t) +-') +- -# Run the shell in the sysadm_t domain for single-user mode. -optional_policy(` +# Run the shell in the unconfined_t or sysadm_t domain for single-user mode. @@ -12070,7 +10740,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') ######################################## -@@ -186,7 +206,7 @@ +@@ -186,7 +202,7 @@ # allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; @@ -12079,7 +10749,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t dontaudit initrc_t self:capability sys_module; # sysctl is triggering this allow initrc_t self:passwd rootok; -@@ -201,10 +221,9 @@ +@@ -201,10 +217,9 @@ allow initrc_t initrc_devpts_t:chr_file rw_term_perms; term_create_pty(initrc_t,initrc_devpts_t) @@ -12092,7 +10762,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t manage_dirs_pattern(initrc_t,initrc_state_t,initrc_state_t) manage_files_pattern(initrc_t,initrc_state_t,initrc_state_t) -@@ -283,7 +302,6 @@ +@@ -283,7 +298,6 @@ mls_process_read_up(initrc_t) mls_process_write_down(initrc_t) mls_rangetrans_source(initrc_t) @@ -12100,7 +10770,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t selinux_get_enforce_mode(initrc_t) -@@ -497,6 +515,47 @@ +@@ -497,6 +511,33 @@ ') optional_policy(` @@ -12126,29 +10796,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t + files_dump_core(daemon) +') + -+tunable_policy(`allow_daemons_use_tty',` -+ term_use_all_user_ttys(daemon) -+ term_use_all_user_ptys(daemon) -+', ` -+ term_dontaudit_use_all_user_ttys(daemon) -+ term_dontaudit_use_all_user_ptys(daemon) -+') -+ +optional_policy(` + unconfined_dontaudit_rw_pipes(daemon) -+ -+ tunable_policy(`allow_daemons_use_tty',` -+ unconfined_use_terminals(daemon) -+ ', ` -+ unconfined_dontaudit_use_terminals(daemon) -+ ') +') + +optional_policy(` amavis_search_lib(initrc_t) amavis_setattr_pid_files(initrc_t) ') -@@ -632,12 +691,6 @@ +@@ -631,12 +672,6 @@ mta_read_config(initrc_t) mta_dontaudit_read_spool_symlinks(initrc_t) ') @@ -12161,7 +10817,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t optional_policy(` ifdef(`distro_redhat',` -@@ -703,6 +756,9 @@ +@@ -702,6 +737,9 @@ # why is this needed: rpm_manage_db(initrc_t) @@ -12171,7 +10827,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -750,6 +806,10 @@ +@@ -749,6 +787,10 @@ ') optional_policy(` @@ -12184,7 +10840,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.1.0/policy/modules/system/ipsec.te --- nsaserefpolicy/policy/modules/system/ipsec.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/ipsec.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/ipsec.te 2007-11-06 09:28:35.000000000 -0500 @@ -55,11 +55,11 @@ allow ipsec_t self:capability { net_admin dac_override dac_read_search }; @@ -12263,19 +10919,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. domain_use_interactive_fds(ipsec_mgmt_t) # denials when ps tries to search /proc. Do not audit these denials. -@@ -278,11 +282,11 @@ - # - - allow racoon_t self:capability { net_admin net_bind_service }; --allow racoon_t self:netlink_route_socket create_netlink_socket_perms; - allow racoon_t self:unix_dgram_socket { connect create ioctl write }; - allow racoon_t self:netlink_selinux_socket { bind create read }; - allow racoon_t self:udp_socket create_socket_perms; - allow racoon_t self:key_socket { create read setopt write }; -+logging_send_audit_msgs(racoon_t) - - # manage pid file - manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t) @@ -299,11 +303,15 @@ allow racoon_t ipsec_spd_t:association setcontext; @@ -12292,51 +10935,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. dev_read_urand(racoon_t) -@@ -321,7 +329,6 @@ - locallogin_use_fds(racoon_t) - - logging_send_syslog_msg(racoon_t) --logging_send_audit_msgs(racoon_t) - - miscfiles_read_localization(racoon_t) - -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.1.0/policy/modules/system/iptables.te ---- nsaserefpolicy/policy/modules/system/iptables.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/iptables.te 2007-10-24 15:06:50.000000000 -0400 -@@ -64,6 +64,7 @@ - init_use_script_ptys(iptables_t) - # to allow rules to be saved on reboot: - init_rw_script_tmp_files(iptables_t) -+init_rw_script_stream_sockets(iptables_t) - - libs_use_ld_so(iptables_t) - libs_use_shared_libs(iptables_t) -@@ -102,6 +103,10 @@ - ') - - optional_policy(` -+ rhgb_dontaudit_use_ptys(iptables_t) -+') -+ -+optional_policy(` - seutil_sigchld_newrole(iptables_t) - ') - -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.1.0/policy/modules/system/iscsi.te ---- nsaserefpolicy/policy/modules/system/iscsi.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/iscsi.te 2007-10-24 15:06:50.000000000 -0400 -@@ -68,6 +68,8 @@ - - files_read_etc_files(iscsid_t) - -+kernel_read_system_state(iscsid_t) -+ - libs_use_ld_so(iscsid_t) - libs_use_shared_libs(iscsid_t) - diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.1.0/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/libraries.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/libraries.fc 2007-11-06 09:28:35.000000000 -0500 @@ -65,11 +65,12 @@ /opt/(.*/)?java/.+\.jar -- gen_context(system_u:object_r:lib_t,s0) /opt/(.*/)?jre.*/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -12361,7 +10962,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar /usr/X11R6/lib/libGL\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/X11R6/lib/libXvMCNVIDIA\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -@@ -216,6 +219,7 @@ +@@ -158,6 +161,7 @@ + # Fedora Core packages: gstreamer-plugins, compat-libstdc++, Glide3, libdv + # HelixPlayer, SDL, xorg-x11, xorg-x11-libs, Hermes, valgrind, openoffice.org-libs, httpd - php + /usr/lib(64)?/gstreamer-.*/[^/]*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) ++HOME_DIR/.*/\.gstreamer-.*/plugins/*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) + + /usr/lib(64)?/libstdc\+\+\.so\.2\.7\.2\.8 -- gen_context(system_u:object_r:textrel_shlib_t,s0) + /usr/lib(64)?/libg\+\+\.so\.2\.7\.2\.8 -- gen_context(system_u:object_r:textrel_shlib_t,s0) +@@ -216,6 +220,7 @@ /usr/lib(64)?/libpostproc\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/libavformat.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/libavcodec.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -12369,7 +10978,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar /usr/lib(64)?/libavutil.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/libxvidcore\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/xine/plugins/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) -@@ -236,7 +240,9 @@ +@@ -236,7 +241,9 @@ /usr/lib(64)?/libdivxdecore\.so\.0 -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/libdivxencore\.so\.0 -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -12380,7 +10989,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar # vmware /usr/lib(64)?/vmware/lib(/.*)?/libgdk-x11-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -@@ -284,3 +290,9 @@ +@@ -284,3 +291,10 @@ /var/spool/postfix/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0) /var/spool/postfix/usr(/.*)? gen_context(system_u:object_r:lib_t,s0) /var/spool/postfix/lib(64)?/ld.*\.so.* -- gen_context(system_u:object_r:ld_so_t,s0) @@ -12390,9 +10999,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar +/var/cache/ldconfig(/.*)? gen_context(system_u:object_r:ldconfig_cache_t,s0) +/usr/lib/libFLAC\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib/maxima/[^/]+/binary-gcl/maxima -- gen_context(system_u:object_r:textrel_shlib_t,s0) ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.1.0/policy/modules/system/libraries.te --- nsaserefpolicy/policy/modules/system/libraries.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/libraries.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/libraries.te 2007-11-06 09:28:35.000000000 -0500 @@ -23,6 +23,9 @@ init_system_domain(ldconfig_t,ldconfig_exec_t) role system_r types ldconfig_t; @@ -12450,8 +11060,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar + unconfined_manage_tmp_files(ldconfig_t) ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.1.0/policy/modules/system/locallogin.te ---- nsaserefpolicy/policy/modules/system/locallogin.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/locallogin.te 2007-10-24 15:06:50.000000000 -0400 +--- nsaserefpolicy/policy/modules/system/locallogin.te 2007-10-29 07:52:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/locallogin.te 2007-11-06 09:28:35.000000000 -0500 @@ -25,7 +25,6 @@ domain_role_change_exemption(sulogin_t) domain_interactive_fd(sulogin_t) @@ -12480,7 +11090,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall userdom_spec_domtrans_all_users(local_login_t) userdom_signal_all_users(local_login_t) userdom_search_all_users_home_content(local_login_t) -@@ -186,7 +191,7 @@ +@@ -185,7 +190,7 @@ ') optional_policy(` @@ -12490,82 +11100,40 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.1.0/policy/modules/system/logging.fc ---- nsaserefpolicy/policy/modules/system/logging.fc 2007-09-12 16:32:51.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/logging.fc 2007-10-24 15:06:50.000000000 -0400 -@@ -1,5 +1,7 @@ - /dev/log -s gen_context(system_u:object_r:devlog_t,s0) - -+/etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) -+/etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) - /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh) - - /sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0) -@@ -33,7 +35,10 @@ +--- nsaserefpolicy/policy/modules/system/logging.fc 2007-11-06 09:18:37.000000000 -0500 ++++ serefpolicy-3.1.0/policy/modules/system/logging.fc 2007-11-06 13:09:04.000000000 -0500 +@@ -29,6 +29,11 @@ + + /var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh) + /var/log/.* gen_context(system_u:object_r:var_log_t,s0) ++/var/log/messages[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) ++/var/log/secure[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) ++/var/log/cron[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) ++/var/log/maillog[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) ++/var/log/spooler[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) + /var/log/audit(/.*)? gen_context(system_u:object_r:auditd_log_t,mls_systemhigh) + /var/log/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_run_t,s0) + +@@ -36,6 +41,8 @@ /var/log/audit\.log -- gen_context(system_u:object_r:auditd_log_t,mls_systemhigh) ') +/var/named/chroot/var/log -d gen_context(system_u:object_r:var_log_t,s0) + /var/run/audit_events -s gen_context(system_u:object_r:auditd_var_run_t,s0) -+/var/run/audispd_events -s gen_context(system_u:object_r:auditd_var_run_t,s0) + /var/run/audispd_events -s gen_context(system_u:object_r:auditd_var_run_t,s0) /var/run/auditd\.pid -- gen_context(system_u:object_r:auditd_var_run_t,s0) - /var/run/auditd_sock -s gen_context(system_u:object_r:auditd_var_run_t,s0) - /var/run/klogd\.pid -- gen_context(system_u:object_r:klogd_var_run_t,s0) -@@ -44,3 +49,8 @@ +@@ -48,3 +55,6 @@ /var/spool/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0) /var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) + -+/var/log/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_run_t,s0) -+ +/etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_script_exec_t,s0) +/etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.1.0/policy/modules/system/logging.if ---- nsaserefpolicy/policy/modules/system/logging.if 2007-09-12 16:32:51.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/logging.if 2007-10-24 15:06:50.000000000 -0400 -@@ -33,8 +33,27 @@ - ## - # - interface(`logging_send_audit_msgs',` -+ gen_require(` -+ attribute can_send_audit_msgs; -+ ') -+ -+ typeattribute $1 can_send_audit_msgs; - allow $1 self:capability audit_write; -- allow $1 self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; -+ allow $1 self:netlink_audit_socket { r_netlink_socket_perms nlmsg_relay }; -+') -+ -+####################################### -+## -+## dontaudit attempts to send audit messages. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`logging_dontaudit_send_audit_msgs',` -+ dontaudit $1 self:netlink_audit_socket { r_netlink_socket_perms nlmsg_relay }; - ') - - ######################################## -@@ -484,11 +503,10 @@ - interface(`logging_read_all_logs',` - gen_require(` - attribute logfile; -- type var_log_t; - ') - - files_search_var($1) -- allow $1 var_log_t:dir list_dir_perms; -+ allow $1 logfile:dir list_dir_perms; - read_files_pattern($1,logfile, logfile) - ') - -@@ -533,6 +551,8 @@ +--- nsaserefpolicy/policy/modules/system/logging.if 2007-11-06 09:51:43.000000000 -0500 ++++ serefpolicy-3.1.0/policy/modules/system/logging.if 2007-11-06 11:50:09.000000000 -0500 +@@ -577,6 +577,8 @@ files_search_var($1) manage_files_pattern($1,logfile,logfile) read_lnk_files_pattern($1,logfile,logfile) @@ -12574,107 +11142,56 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin ') ######################################## -@@ -616,3 +636,259 @@ - files_search_var($1) - manage_files_pattern($1,var_log_t,var_log_t) - ') -+ -+######################################## -+## -+## Set login uid -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`logging_set_loginuid',` -+ gen_require(` -+ attribute can_set_loginuid; -+ attribute can_send_audit_msgs; -+ ') -+ -+ typeattribute $1 can_set_loginuid, can_send_audit_msgs; -+ -+ allow $1 self:capability audit_control; -+ allow $1 self:netlink_audit_socket { r_netlink_socket_perms nlmsg_relay }; -+') -+ -+######################################## -+## -+## Set up audit -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`logging_set_audit',` -+ gen_require(` -+ attribute can_set_audit; -+ attribute can_send_audit_msgs; -+ ') +@@ -686,6 +688,7 @@ + interface(`logging_admin_audit',` + gen_require(` + type auditd_t, auditd_etc_t, auditd_log_t; ++ type auditd_script_exec_t; + type auditd_var_run_t; + ') + +@@ -700,6 +703,15 @@ + + manage_dirs_pattern($1, auditd_var_run_t, auditd_var_run_t) + manage_files_pattern($1, auditd_var_run_t, auditd_var_run_t) + -+ typeattribute $1 can_set_audit, can_send_audit_msgs; -+ allow $1 self:capability { audit_write audit_control }; -+ allow $1 self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; -+') ++ logging_run_auditctl($1, $2, $3) + -+######################################## -+## -+## Set audit control rules -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`logging_set_auditctl',` -+ gen_require(` -+ attribute can_set_auditctl; -+ ') ++ # Allow $1 to restart the audit service ++ logging_audit_script_domtrans($1) ++ domain_system_change_exemption($1) ++ role_transition $2 auditd_script_exec_t system_r; ++ allow $2 system_r; + -+ typeattribute $1 can_set_auditctl; -+ logging_set_audit($1) -+ allow $1 self:netlink_audit_socket nlmsg_readpriv; -+') + ') + + ######################################## +@@ -730,6 +742,7 @@ + type syslogd_tmp_t, syslogd_var_lib_t; + type syslogd_var_run_t, klogd_var_run_t; + type klogd_tmp_t, var_log_t; ++ type syslogd_script_exec_t; + ') + + allow $1 syslogd_t:process { ptrace signal_perms }; +@@ -757,6 +770,13 @@ + manage_files_pattern($1, syslogd_var_run_t, syslogd_var_run_t) + + logging_manage_all_logs($1) + -+######################################## -+## -+## Unconfined access to the loggin module. -+## -+## -+##

-+## Unconfined access to the authlogin module. -+##

-+##

-+## Currently, this only allows assertions for -+## the audit susbsystem to be passed. -+## No access is granted yet. -+##

-+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`logging_unconfined',` -+ gen_require(` -+ attribute can_set_audit; -+ attribute can_set_auditctl; -+ attribute can_send_audit_msgs; -+ attribute can_set_loginuid; -+ ') ++ # Allow $1 to restart the syslog service ++ logging_syslog_script_domtrans($1) ++ domain_system_change_exemption($1) ++ role_transition $2 syslogd_script_exec_t system_r; ++ allow $2 system_r; + -+ typeattribute $1 can_set_loginuid; -+ typeattribute $1 can_set_audit; -+ typeattribute $1 can_set_auditctl; -+ typeattribute $1 can_send_audit_msgs; -+') + ') + + ######################################## +@@ -785,3 +805,40 @@ + logging_admin_audit($1, $2, $3) + logging_admin_syslog($1, $2, $3) + ') + +######################################## +## @@ -12712,159 +11229,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin + init_script_domtrans_spec($1,auditd_script_exec_t) +') + -+ -+######################################## -+## -+## All of the rules required to administrate an audit environment -+## -+## -+## -+## Prefix of the domain. Example, user would be -+## the prefix for the uder_t domain. -+## -+## -+## -+## -+## Domain allowed access. -+## -+## -+## -+## -+## The role to be allowed to manage the audit domain. -+## -+## -+## -+# -+interface(`logging_audit_admin',` -+ -+ gen_require(` -+ type auditd_t; -+ type auditd_script_exec_t; -+ type auditd_etc_t; -+ type auditd_log_t; -+ type auditd_var_run_t; -+ ') -+ -+ allow $2 auditd_t:process { ptrace signal_perms getattr }; -+ read_files_pattern($2, auditd_t, auditd_t) -+ -+ # Allow $2 to restart the audit service -+ logging_audit_script_domtrans($2) -+ domain_system_change_exemption($2) -+ role_transition $3 auditd_script_exec_t system_r; -+ allow $3 system_r; -+ -+ manage_dirs_pattern($2,auditd_etc_t,auditd_etc_t) -+ manage_files_pattern($2,auditd_etc_t,auditd_etc_t) -+ -+ manage_dirs_pattern($2,auditd_log_t,auditd_log_t) -+ manage_files_pattern($2,auditd_log_t,auditd_log_t) -+ -+ manage_dirs_pattern($2,auditd_var_run_t,auditd_var_run_t) -+ manage_files_pattern($2,auditd_var_run_t,auditd_var_run_t) -+ logging_run_auditctl($2, $3,{ $1_devpts_t $1_tty_device_t }) -+') -+ -+######################################## -+## -+## All of the rules required to administrate an audit environment -+## -+## -+## -+## Prefix of the domain. Example, user would be -+## the prefix for the uder_t domain. -+## -+## -+## -+## -+## Domain allowed access. -+## -+## -+## -+## -+## The role to be allowed to manage the audit domain. -+## -+## -+## -+# -+interface(`logging_syslog_admin',` -+ -+ gen_require(` -+ type syslogd_t; -+ type klogd_t; -+ type syslogd_script_exec_t; -+ type syslog_conf_t; -+ type syslogd_tmp_t; -+ type syslogd_var_lib_t; -+ type syslogd_var_run_t; -+ type klogd_var_run_t; -+ type klogd_tmp_t; -+ type var_log_t; -+ ') -+ -+ allow $2 syslogd_t:process { ptrace signal_perms getattr }; -+ allow $2 klogd_t:process { ptrace signal_perms getattr }; -+ read_files_pattern($2, syslogd_t, syslogd_t) -+ read_files_pattern($2, klogd_t, klogd_t) -+ -+ # Allow $2 to restart the syslog service -+ logging_syslog_script_domtrans($2) -+ domain_system_change_exemption($2) -+ role_transition $3 syslogd_script_exec_t system_r; -+ allow $3 system_r; -+ -+ manage_dirs_pattern($2, klogd_var_run_t,klogd_var_run_t) -+ manage_files_pattern($2,klogd_var_run_t,klogd_var_run_t) -+ -+ manage_dirs_pattern($2,klogd_tmp_t,klogd_tmp_t) -+ manage_files_pattern($2,klogd_tmp_t,klogd_tmp_t) -+ -+ manage_dirs_pattern($2,syslogd_tmp_t,syslogd_tmp_t) -+ manage_files_pattern($2,syslogd_tmp_t,syslogd_tmp_t) -+ -+ manage_dirs_pattern($2,syslog_conf_t,syslog_conf_t) -+ manage_files_pattern($2,syslog_conf_t,syslog_conf_t) -+ files_etc_filetrans($2,syslog_conf_t,file) -+ -+ manage_dirs_pattern($2,syslogd_var_lib_t,syslogd_var_lib_t) -+ manage_files_pattern($2,syslogd_var_lib_t,syslogd_var_lib_t) -+ -+ manage_dirs_pattern($2,syslogd_var_run_t,syslogd_var_run_t) -+ manage_files_pattern($2,syslogd_var_run_t,syslogd_var_run_t) -+ -+ logging_manage_all_logs($2) -+') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.1.0/policy/modules/system/logging.te ---- nsaserefpolicy/policy/modules/system/logging.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/logging.te 2007-10-24 15:06:50.000000000 -0400 -@@ -7,6 +7,10 @@ - # - - attribute logfile; -+attribute can_set_audit; -+attribute can_set_auditctl; -+attribute can_set_loginuid; -+attribute can_send_audit_msgs; - - type auditctl_t; - type auditctl_exec_t; -@@ -45,9 +49,15 @@ - type syslogd_exec_t; - init_daemon_domain(syslogd_t,syslogd_exec_t) - -+type syslog_conf_t; -+files_type(syslog_conf_t) -+ - type syslogd_tmp_t; - files_tmp_file(syslogd_tmp_t) - -+type syslogd_var_lib_t; -+files_type(syslogd_var_lib_t) -+ - type syslogd_var_run_t; - files_pid_file(syslogd_var_run_t) - -@@ -55,17 +65,28 @@ +--- nsaserefpolicy/policy/modules/system/logging.te 2007-11-06 09:18:37.000000000 -0500 ++++ serefpolicy-3.1.0/policy/modules/system/logging.te 2007-11-06 09:28:35.000000000 -0500 +@@ -61,6 +61,12 @@ logging_log_file(var_log_t) files_mountpoint(var_log_t) @@ -12877,94 +11245,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin ifdef(`enable_mls',` init_ranged_daemon_domain(auditd_t,auditd_exec_t,mls_systemhigh) ') - -+neverallow ~{ can_set_loginuid can_set_audit } self:capability audit_control; -+neverallow ~can_set_audit self:netlink_audit_socket nlmsg_write; -+neverallow ~can_set_auditctl self:netlink_audit_socket nlmsg_readpriv; -+neverallow ~can_send_audit_msgs self:capability audit_write; -+neverallow ~can_send_audit_msgs self:netlink_audit_socket nlmsg_relay; -+ - ######################################## - # - # Auditctl local policy - # - --allow auditctl_t self:capability { fsetid dac_read_search dac_override audit_write audit_control }; --allow auditctl_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay nlmsg_readpriv }; -+allow auditctl_t self:capability { fsetid dac_read_search dac_override }; - - read_files_pattern(auditctl_t,auditd_etc_t,auditd_etc_t) - allow auditctl_t auditd_etc_t:dir list_dir_perms; -@@ -92,6 +113,7 @@ - - locallogin_dontaudit_use_fds(auditctl_t) - -+logging_set_auditctl(auditctl_t) - logging_send_syslog_msg(auditctl_t) - - ######################################## -@@ -99,12 +121,12 @@ - # Auditd local policy - # - --allow auditd_t self:capability { audit_write audit_control fsetid sys_nice sys_resource }; -+allow auditd_t self:capability { chown fsetid sys_nice sys_resource }; - dontaudit auditd_t self:capability sys_tty_config; - allow auditd_t self:process { signal_perms setpgid setsched }; -+allow auditd_t self:file { getattr read write }; - allow auditd_t self:unix_dgram_socket create_socket_perms; --allow auditd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay nlmsg_readpriv }; --allow auditd_t self:fifo_file rw_fifo_file_perms; -+allow auditd_t self:fifo_file rw_file_perms; - - allow auditd_t auditd_etc_t:dir list_dir_perms; - allow auditd_t auditd_etc_t:file read_file_perms; -@@ -141,6 +163,7 @@ - - init_telinit(auditd_t) - -+logging_set_audit(auditd_t) - logging_send_syslog_msg(auditd_t) - - libs_use_ld_so(auditd_t) -@@ -150,6 +173,7 @@ - - mls_file_read_all_levels(auditd_t) - mls_file_write_all_levels(auditd_t) # Need to be able to write to /var/run/ directory -+mls_fd_use_all_levels(auditd_t) - - seutil_dontaudit_read_config(auditd_t) - -@@ -241,12 +265,16 @@ - allow syslogd_t self:udp_socket create_socket_perms; - allow syslogd_t self:tcp_socket create_stream_socket_perms; - -+allow syslogd_t syslog_conf_t:file read_file_perms; -+ - # Create and bind to /dev/log or /var/run/log. - allow syslogd_t devlog_t:sock_file manage_sock_file_perms; - files_pid_filetrans(syslogd_t,devlog_t,sock_file) - - # create/append log files. - manage_files_pattern(syslogd_t,var_log_t,var_log_t) -+allow syslogd_t var_run_t:fifo_file { ioctl read write }; -+# r/w log fifo_files files. - rw_fifo_files_pattern(syslogd_t,var_log_t,var_log_t) - - # Allow access for syslog-ng -@@ -257,6 +285,9 @@ - manage_files_pattern(syslogd_t,syslogd_tmp_t,syslogd_tmp_t) - files_tmp_filetrans(syslogd_t,syslogd_tmp_t,{ dir file }) - -+files_search_var_lib(syslogd_t) -+manage_files_pattern(syslogd_t,syslogd_var_lib_t,syslogd_var_lib_t) -+ - allow syslogd_t syslogd_var_run_t:file manage_file_perms; - files_pid_filetrans(syslogd_t,syslogd_var_run_t,file) - diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.1.0/policy/modules/system/lvm.fc --- nsaserefpolicy/policy/modules/system/lvm.fc 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/lvm.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/lvm.fc 2007-11-06 09:28:35.000000000 -0500 @@ -15,6 +15,7 @@ # /etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0) @@ -12975,7 +11258,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc /etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.1.0/policy/modules/system/lvm.te --- nsaserefpolicy/policy/modules/system/lvm.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/lvm.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/lvm.te 2007-11-06 09:28:35.000000000 -0500 @@ -44,9 +44,9 @@ # Cluster LVM daemon local policy # @@ -13135,7 +11418,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.1.0/policy/modules/system/miscfiles.if --- nsaserefpolicy/policy/modules/system/miscfiles.if 2007-02-19 11:32:53.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/system/miscfiles.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/miscfiles.if 2007-11-06 09:28:35.000000000 -0500 @@ -57,6 +57,26 @@ ## ## @@ -13174,7 +11457,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi delete_lnk_files_pattern($1,man_t,man_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.if serefpolicy-3.1.0/policy/modules/system/modutils.if --- nsaserefpolicy/policy/modules/system/modutils.if 2007-03-26 10:39:07.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/modutils.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/modutils.if 2007-11-06 09:28:35.000000000 -0500 @@ -66,6 +66,25 @@ ######################################## @@ -13203,7 +11486,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.1.0/policy/modules/system/modutils.te --- nsaserefpolicy/policy/modules/system/modutils.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/modutils.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/modutils.te 2007-11-06 09:28:35.000000000 -0500 @@ -42,7 +42,7 @@ # insmod local policy # @@ -13304,7 +11587,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.1.0/policy/modules/system/mount.fc --- nsaserefpolicy/policy/modules/system/mount.fc 2006-11-16 17:15:24.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/system/mount.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/mount.fc 2007-11-06 09:28:35.000000000 -0500 @@ -1,4 +1,2 @@ /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) @@ -13312,22 +11595,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. -/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.1.0/policy/modules/system/mount.te --- nsaserefpolicy/policy/modules/system/mount.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/mount.te 2007-10-24 15:06:50.000000000 -0400 -@@ -8,6 +8,13 @@ ++++ serefpolicy-3.1.0/policy/modules/system/mount.te 2007-11-06 09:28:35.000000000 -0500 +@@ -8,7 +8,7 @@ ## ##

-+## Allow mount to mount any dir -+##

-+## -+gen_tunable(allow_mounton_anydir,true) -+ -+## -+##

- ## Allow mount to mount any file +-## Allow mount to mount any file ++## Allow the mount command to mount any directory or file ##

## -@@ -18,17 +25,18 @@ + gen_tunable(allow_mount_anyfile,false) +@@ -18,17 +18,18 @@ init_system_domain(mount_t,mount_exec_t) role system_r types mount_t; @@ -13349,7 +11627,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ######################################## # -@@ -36,21 +44,22 @@ +@@ -36,21 +37,22 @@ # # setuid/setgid needed to mount cifs @@ -13376,7 +11654,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. dev_getattr_all_blk_files(mount_t) dev_list_all_dev_nodes(mount_t) -@@ -63,6 +72,7 @@ +@@ -63,6 +65,7 @@ storage_raw_write_fixed_disk(mount_t) storage_raw_read_removable_device(mount_t) storage_raw_write_removable_device(mount_t) @@ -13384,7 +11662,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. fs_getattr_xattr_fs(mount_t) fs_getattr_cifs(mount_t) -@@ -101,6 +111,8 @@ +@@ -101,6 +104,8 @@ init_use_fds(mount_t) init_use_script_ptys(mount_t) init_dontaudit_getattr_initctl(mount_t) @@ -13393,24 +11671,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. libs_use_ld_so(mount_t) libs_use_shared_libs(mount_t) -@@ -127,10 +139,15 @@ - ') - ') - -+tunable_policy(`allow_mounton_anydir',` -+ auth_read_all_dirs_except_shadow(mount_t) -+ files_mounton_non_security_dir(mount_t) -+') -+ - tunable_policy(`allow_mount_anyfile',` - auth_read_all_dirs_except_shadow(mount_t) - auth_read_all_files_except_shadow(mount_t) -- files_mounton_non_security(mount_t) -+ files_mounton_non_security_files(mount_t) - ') - - optional_policy(` -@@ -159,13 +176,9 @@ +@@ -159,13 +164,9 @@ fs_search_rpc(mount_t) @@ -13425,7 +11686,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ') optional_policy(` -@@ -189,10 +202,6 @@ +@@ -189,10 +190,6 @@ samba_domtrans_smbmount(mount_t) ') @@ -13436,7 +11697,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ######################################## # # Unconfined mount local policy -@@ -201,4 +210,29 @@ +@@ -201,4 +198,29 @@ optional_policy(` files_etc_filetrans_etc_runtime(unconfined_mount_t,file) unconfined_domain(unconfined_mount_t) @@ -13468,7 +11729,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.1.0/policy/modules/system/raid.te --- nsaserefpolicy/policy/modules/system/raid.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/raid.te 2007-10-25 09:40:53.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/raid.te 2007-11-06 09:28:35.000000000 -0500 @@ -19,7 +19,7 @@ # Local policy # @@ -13488,7 +11749,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t fs_dontaudit_list_tmpfs(mdadm_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.1.0/policy/modules/system/selinuxutil.fc --- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-18 11:12:44.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/selinuxutil.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/selinuxutil.fc 2007-11-06 09:28:35.000000000 -0500 @@ -38,7 +38,7 @@ /usr/sbin/restorecond -- gen_context(system_u:object_r:restorecond_exec_t,s0) /usr/sbin/run_init -- gen_context(system_u:object_r:run_init_exec_t,s0) @@ -13500,16 +11761,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.1.0/policy/modules/system/selinuxutil.if --- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-05-18 11:12:44.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/selinuxutil.if 2007-10-24 15:06:50.000000000 -0400 -@@ -432,6 +432,7 @@ - role $2 types run_init_t; - allow run_init_t $3:chr_file rw_term_perms; - allow $2 system_r; -+ auth_run_upd_passwd_chk($1,$2,$3) - ') - - ######################################## -@@ -585,7 +586,7 @@ ++++ serefpolicy-3.1.0/policy/modules/system/selinuxutil.if 2007-11-07 11:58:01.000000000 -0500 +@@ -585,7 +585,7 @@ type selinux_config_t; ') @@ -13518,7 +11771,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ') ######################################## -@@ -604,7 +605,7 @@ +@@ -604,7 +604,7 @@ type selinux_config_t; ') @@ -13527,7 +11780,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu dontaudit $1 selinux_config_t:file { getattr read }; ') -@@ -669,6 +670,7 @@ +@@ -669,6 +669,7 @@ ') files_search_etc($1) @@ -13535,7 +11788,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu manage_files_pattern($1,selinux_config_t,selinux_config_t) read_lnk_files_pattern($1,selinux_config_t,selinux_config_t) ') -@@ -778,6 +780,28 @@ +@@ -778,6 +779,28 @@ ######################################## ## @@ -13556,7 +11809,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu + files_search_etc($1) + dontaudit $1 { selinux_config_t default_context_t }:dir search_dir_perms; + dontaudit $1 file_context_t:dir search_dir_perms; -+ dontaudit $1 file_context_t:file r_file_perms; ++ dontaudit $1 file_context_t:file read_file_perms; +') + +######################################## @@ -13564,7 +11817,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ## Read and write the file_contexts files. ## ## -@@ -968,6 +992,26 @@ +@@ -968,6 +991,26 @@ ######################################## ## @@ -13591,7 +11844,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ## Execute semanage in the semanage domain, and ## allow the specified role the semanage domain, ## and use the caller's terminal. -@@ -979,7 +1023,7 @@ +@@ -979,7 +1022,7 @@ ## ## ## @@ -13600,7 +11853,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ## ## ## -@@ -1001,6 +1045,39 @@ +@@ -1001,6 +1044,39 @@ ######################################## ## @@ -13640,7 +11893,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ## Full management of the semanage ## module store. ## -@@ -1058,3 +1135,138 @@ +@@ -1058,3 +1134,138 @@ files_search_etc($1) rw_files_pattern($1,selinux_config_t,semanage_trans_lock_t) ') @@ -13781,7 +12034,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.1.0/policy/modules/system/selinuxutil.te --- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/selinuxutil.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/selinuxutil.te 2007-11-06 09:28:35.000000000 -0500 @@ -76,7 +76,6 @@ type restorecond_exec_t; init_daemon_domain(restorecond_t,restorecond_exec_t) @@ -13831,7 +12084,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu read_files_pattern(newrole_t,selinux_config_t,selinux_config_t) read_lnk_files_pattern(newrole_t,selinux_config_t,selinux_config_t) -@@ -252,8 +264,11 @@ +@@ -252,7 +264,9 @@ term_getattr_unallocated_ttys(newrole_t) term_dontaudit_use_unallocated_ttys(newrole_t) @@ -13839,11 +12092,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu auth_domtrans_chk_passwd(newrole_t) +auth_domtrans_upd_passwd_chk(newrole_t) auth_rw_faillog(newrole_t) -+auth_search_key(newrole_t) corecmd_list_bin(newrole_t) - corecmd_read_bin_symlinks(newrole_t) -@@ -273,6 +288,7 @@ +@@ -273,6 +287,7 @@ libs_use_ld_so(newrole_t) libs_use_shared_libs(newrole_t) @@ -13851,7 +12102,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu logging_send_syslog_msg(newrole_t) miscfiles_read_localization(newrole_t) -@@ -294,14 +310,6 @@ +@@ -294,14 +309,6 @@ files_polyinstantiate_all(newrole_t) ') @@ -13866,7 +12117,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ######################################## # # Restorecond local policy -@@ -309,11 +317,12 @@ +@@ -309,11 +316,12 @@ allow restorecond_t self:capability { dac_override dac_read_search fowner }; allow restorecond_t self:fifo_file rw_fifo_file_perms; @@ -13880,7 +12131,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu kernel_use_fds(restorecond_t) kernel_rw_pipes(restorecond_t) kernel_read_system_state(restorecond_t) -@@ -343,15 +352,12 @@ +@@ -343,15 +351,12 @@ miscfiles_read_localization(restorecond_t) @@ -13898,7 +12149,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ################################# # -@@ -361,7 +367,7 @@ +@@ -361,7 +366,7 @@ allow run_init_t self:process setexec; allow run_init_t self:capability setuid; allow run_init_t self:fifo_file rw_file_perms; @@ -13907,7 +12158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # often the administrator runs such programs from a directory that is owned # by a different user or has restrictive SE permissions, do not want to audit -@@ -375,6 +381,7 @@ +@@ -375,6 +380,7 @@ term_dontaudit_list_ptys(run_init_t) auth_domtrans_chk_passwd(run_init_t) @@ -13915,11 +12166,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu auth_dontaudit_read_shadow(run_init_t) corecmd_exec_bin(run_init_t) -@@ -423,77 +430,52 @@ - nscd_socket_use(run_init_t) - ') +@@ -425,75 +431,49 @@ -+ ######################################## # -# semodule local policy @@ -13941,17 +12189,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu - -kernel_read_system_state(semanage_t) -kernel_read_kernel_sysctls(semanage_t) +- +-corecmd_exec_bin(semanage_t) +init_dontaudit_use_fds(setsebool_t) --corecmd_exec_bin(semanage_t) +-dev_read_urand(semanage_t) +# Bug in semanage +seutil_domtrans_setfiles(setsebool_t) +seutil_manage_file_contexts(setsebool_t) +seutil_manage_default_contexts(setsebool_t) +seutil_manage_selinux_config(setsebool_t) --dev_read_urand(semanage_t) -- -domain_use_interactive_fds(semanage_t) - -files_read_etc_files(semanage_t) @@ -14019,7 +12267,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # cjp: need a more general way to handle this: ifdef(`enable_mls',` # read secadm tmp files -@@ -519,7 +501,9 @@ +@@ -519,7 +499,9 @@ allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:dir list_dir_perms; allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:file read_file_perms; @@ -14030,7 +12278,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu kernel_read_system_state(setfiles_t) kernel_relabelfrom_unlabeled_dirs(setfiles_t) -@@ -537,6 +521,7 @@ +@@ -537,6 +519,7 @@ fs_getattr_xattr_fs(setfiles_t) fs_list_all(setfiles_t) @@ -14038,7 +12286,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu fs_search_auto_mountpoints(setfiles_t) fs_relabelfrom_noxattr_fs(setfiles_t) -@@ -590,8 +575,16 @@ +@@ -590,8 +573,16 @@ fs_relabel_tmpfs_chr_file(setfiles_t) ') @@ -14057,7 +12305,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.1.0/policy/modules/system/sysnetwork.if --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-16 14:09:49.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/sysnetwork.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/sysnetwork.if 2007-11-06 15:55:18.000000000 -0500 @@ -145,6 +145,25 @@ ######################################## @@ -14084,7 +12332,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet ## Send and receive messages from ## dhcpc over dbus. ## -@@ -522,6 +541,8 @@ +@@ -493,6 +512,10 @@ + + files_search_etc($1) + allow $1 net_conf_t:file read_file_perms; ++ ++ optional_policy(` ++ avahi_stream_connect($1) ++ ') + ') + + ######################################## +@@ -522,6 +545,8 @@ files_search_etc($1) allow $1 net_conf_t:file read_file_perms; @@ -14093,7 +12352,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet ') ######################################## -@@ -556,3 +577,23 @@ +@@ -556,3 +581,23 @@ files_search_etc($1) allow $1 net_conf_t:file read_file_perms; ') @@ -14118,8 +12377,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet +') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.1.0/policy/modules/system/sysnetwork.te ---- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/sysnetwork.te 2007-10-24 15:06:50.000000000 -0400 +--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-10-29 07:52:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/sysnetwork.te 2007-11-06 09:28:35.000000000 -0500 @@ -45,7 +45,7 @@ dontaudit dhcpc_t self:capability sys_tty_config; # for access("/etc/bashrc", X_OK) on Red Hat @@ -14137,18 +12396,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet userdom_dontaudit_search_staff_home_dirs(dhcpc_t) ifdef(`distro_redhat', ` -@@ -159,6 +160,10 @@ +@@ -147,11 +148,19 @@ + ') + + optional_policy(` ++ gen_require(` ++ class dbus send_msg; ++ ') ++ ++ allow dhcpc_t self:dbus send_msg; ++ + init_dbus_chat_script(dhcpc_t) + + dbus_system_bus_client_template(dhcpc,dhcpc_t) dbus_connect_system_bus(dhcpc_t) - dbus_send_system_bus(dhcpc_t) + dbus_read_config(dhcpc_t) + -+ dbus_dontaudit_rw_system_selinux_socket(dhcpc_t) -+ optional_policy(` networkmanager_dbus_chat(dhcpc_t) ') -@@ -203,9 +208,7 @@ +@@ -180,6 +189,10 @@ + ') + + optional_policy(` ++ networkmanager_domtrans(dhcpc_t) ++') ++ ++optional_policy(` + nis_use_ypbind(dhcpc_t) + nis_signal_ypbind(dhcpc_t) + nis_read_ypbind_pid(dhcpc_t) +@@ -196,9 +209,7 @@ ') optional_policy(` @@ -14159,7 +12438,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet ') optional_policy(` -@@ -216,6 +219,7 @@ +@@ -209,6 +220,7 @@ optional_policy(` seutil_sigchld_newrole(dhcpc_t) seutil_dontaudit_search_config(dhcpc_t) @@ -14167,7 +12446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet ') optional_policy(` -@@ -227,6 +231,10 @@ +@@ -220,6 +232,10 @@ ') optional_policy(` @@ -14178,15 +12457,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet kernel_read_xen_state(dhcpc_t) kernel_write_xen_state(dhcpc_t) xen_append_log(dhcpc_t) -@@ -254,6 +262,7 @@ +@@ -233,7 +249,6 @@ + + allow ifconfig_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack }; + allow ifconfig_t self:capability { net_raw net_admin sys_tty_config }; +-dontaudit ifconfig_t self:capability sys_module; + + allow ifconfig_t self:fd use; + allow ifconfig_t self:fifo_file rw_fifo_file_perms; +@@ -247,6 +262,7 @@ allow ifconfig_t self:sem create_sem_perms; allow ifconfig_t self:msgq create_msgq_perms; allow ifconfig_t self:msg { send receive }; -+allow ifconfig_t net_conf_t:file r_file_perms; ++allow ifconfig_t net_conf_t:file read_file_perms; # Create UDP sockets, necessary when called from dhcpc allow ifconfig_t self:udp_socket create_socket_perms; -@@ -270,6 +279,8 @@ +@@ -263,6 +279,8 @@ kernel_read_network_state(ifconfig_t) kernel_search_network_sysctl(ifconfig_t) kernel_rw_net_sysctls(ifconfig_t) @@ -14195,7 +12482,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet corenet_rw_tun_tap_dev(ifconfig_t) -@@ -280,8 +291,11 @@ +@@ -273,8 +291,11 @@ fs_getattr_xattr_fs(ifconfig_t) fs_search_auto_mountpoints(ifconfig_t) @@ -14207,7 +12494,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet domain_use_interactive_fds(ifconfig_t) -@@ -327,6 +341,14 @@ +@@ -320,6 +341,14 @@ ') optional_policy(` @@ -14224,7 +12511,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet xen_append_log(ifconfig_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.1.0/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/udev.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/udev.te 2007-11-06 09:28:35.000000000 -0500 @@ -132,6 +132,7 @@ init_read_utmp(udev_t) @@ -14233,12 +12520,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t libs_use_ld_so(udev_t) libs_use_shared_libs(udev_t) -@@ -184,6 +185,13 @@ +@@ -184,6 +185,12 @@ ') optional_policy(` + alsa_domtrans(udev_t) -+ alsa_search_lib(udev_t) + alsa_read_lib(udev_t) + alsa_read_rw_config(udev_t) +') @@ -14247,7 +12533,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t brctl_domtrans(udev_t) ') -@@ -220,6 +228,10 @@ +@@ -220,6 +227,10 @@ ') optional_policy(` @@ -14260,7 +12546,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t xen_manage_log(udev_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.1.0/policy/modules/system/unconfined.fc --- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/unconfined.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/unconfined.fc 2007-11-06 09:28:35.000000000 -0500 @@ -10,3 +10,5 @@ /usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) @@ -14269,7 +12555,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf +/usr/bin/sbcl -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.1.0/policy/modules/system/unconfined.if --- nsaserefpolicy/policy/modules/system/unconfined.if 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/unconfined.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/unconfined.if 2007-11-06 09:28:35.000000000 -0500 @@ -12,14 +12,13 @@ # interface(`unconfined_domain_noaudit',` @@ -14304,18 +12590,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf kernel_unconfined($1) corenet_unconfined($1) -@@ -79,6 +79,10 @@ - ') - - optional_policy(` -+ logging_unconfined($1) -+ ') -+ -+ optional_policy(` - nscd_unconfined($1) - ') - -@@ -558,9 +562,9 @@ +@@ -558,9 +558,9 @@ ') files_search_home($1) @@ -14328,7 +12603,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') ######################################## -@@ -601,3 +605,216 @@ +@@ -601,3 +601,179 @@ allow $1 unconfined_tmp_t:file { getattr write append }; ') @@ -14409,24 +12684,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + +######################################## +## -+## Transform specified type into a unconfined_terminal type. -+## -+## -+## -+## Domain to not audit. -+## -+## -+# -+interface(`unconfined_terminal_type',` -+ gen_require(` -+ attribute unconfined_terminal; -+ ') -+ -+ typeattribute $1 unconfined_terminal; -+') -+ -+######################################## -+## +## allow attempts to use unconfined ttys and ptys. +## +## @@ -14526,29 +12783,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + + allow $1 unconfined_t:process getpgid; +') -+ -+######################################## -+## -+## Read and write unconfined named sockets in the tmp directory (/tmp). -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`unconfined_rw_tmp_sockets',` -+ gen_require(` -+ type tmp_t; -+ ') -+ files_search_tmp($1) -+ rw_sock_files_pattern($1,unconfined_tmp_t,unconfined_tmp_t) -+') -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.1.0/policy/modules/system/unconfined.te --- nsaserefpolicy/policy/modules/system/unconfined.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/unconfined.te 2007-10-26 08:47:03.000000000 -0400 -@@ -5,17 +5,23 @@ ++++ serefpolicy-3.1.0/policy/modules/system/unconfined.te 2007-11-06 09:28:35.000000000 -0500 +@@ -5,17 +5,18 @@ # # Declarations # @@ -14562,13 +12800,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf -userdom_manage_home_template(unconfined) -userdom_manage_tmp_template(unconfined) -userdom_manage_tmpfs_template(unconfined) -+attribute unconfined_terminal; -+ +userdom_unpriv_user_template(unconfined) +userdom_xwindows_client_template(unconfined) -+ -+unconfined_terminal_type(unconfined_devpts_t) -+unconfined_terminal_type(unconfined_tty_device_t) type unconfined_exec_t; init_system_domain(unconfined_t, unconfined_exec_t) @@ -14579,7 +12812,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf type unconfined_execmem_t; type unconfined_execmem_exec_t; -@@ -27,14 +33,21 @@ +@@ -27,14 +28,21 @@ # Local policy # @@ -14601,7 +12834,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf libs_run_ldconfig(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) -@@ -42,7 +55,10 @@ +@@ -42,7 +50,10 @@ logging_run_auditctl(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) mount_run_unconfined(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) @@ -14612,7 +12845,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf seutil_run_setfiles(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) seutil_run_semanage(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) -@@ -51,13 +67,12 @@ +@@ -51,13 +62,12 @@ userdom_priveleged_home_dir_manager(unconfined_t) optional_policy(` @@ -14621,21 +12854,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` - apache_run_helper(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) +- apache_run_helper(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) apache_per_role_template(unconfined, unconfined_t, unconfined_r) - # this is disallowed usage: ++ apache_run_helper(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) unconfined_domain(httpd_unconfined_script_t) ') -@@ -73,6 +88,7 @@ +@@ -73,6 +83,8 @@ cron_per_role_template(unconfined, unconfined_t, unconfined_r) # this is disallowed usage: unconfined_domain(unconfined_crond_t) + unconfined_domain(unconfined_crontab_t) ++ role system_r types unconfined_crontab_t; ') optional_policy(` -@@ -107,6 +123,10 @@ +@@ -107,6 +119,10 @@ optional_policy(` oddjob_dbus_chat(unconfined_t) ') @@ -14646,7 +12881,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -118,11 +138,11 @@ +@@ -118,11 +134,11 @@ ') optional_policy(` @@ -14660,7 +12895,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -134,11 +154,7 @@ +@@ -134,11 +150,7 @@ ') optional_policy(` @@ -14673,7 +12908,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -155,32 +171,23 @@ +@@ -155,32 +167,23 @@ optional_policy(` postfix_run_map(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) @@ -14710,7 +12945,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -205,11 +212,22 @@ +@@ -205,11 +208,22 @@ ') optional_policy(` @@ -14735,7 +12970,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') ######################################## -@@ -225,8 +243,19 @@ +@@ -219,14 +233,26 @@ + + allow unconfined_execmem_t self:process { execstack execmem }; + unconfined_domain_noaudit(unconfined_execmem_t) ++allow unconfined_execmem_t unconfined_t:process transition; + + optional_policy(` + dbus_stub(unconfined_execmem_t) init_dbus_chat_script(unconfined_execmem_t) unconfined_dbus_chat(unconfined_execmem_t) @@ -14757,7 +12999,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.1.0/policy/modules/system/userdomain.fc --- nsaserefpolicy/policy/modules/system/userdomain.fc 2007-02-19 11:32:53.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/system/userdomain.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/userdomain.fc 2007-11-06 09:28:35.000000000 -0500 @@ -1,4 +1,4 @@ HOME_DIR -d gen_context(system_u:object_r:ROLE_home_dir_t,s0-mls_systemhigh) +HOME_DIR -l gen_context(system_u:object_r:ROLE_home_dir_t,s0-mls_systemhigh) @@ -14765,8 +13007,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo - /tmp/gconfd-USER -d gen_context(system_u:object_r:ROLE_tmp_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.1.0/policy/modules/system/userdomain.if ---- nsaserefpolicy/policy/modules/system/userdomain.if 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/userdomain.if 2007-10-24 15:06:50.000000000 -0400 +--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-10-29 07:52:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/userdomain.if 2007-11-07 11:01:16.000000000 -0500 @@ -29,8 +29,9 @@ ') @@ -15216,7 +13458,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo # cjp: some of this probably can be removed selinux_get_fs_mount($1_t) selinux_validate_context($1_t) -@@ -755,31 +731,15 @@ +@@ -755,31 +731,14 @@ storage_getattr_fixed_disk_dev($1_t) auth_read_login_records($1_t) @@ -15224,7 +13466,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo auth_search_pam_console_data($1_t) auth_run_pam($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) auth_run_utempter($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) -+ auth_run_upd_passwd_chk($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) init_read_utmp($1_t) - # The library functions always try to open read-write first, @@ -15249,7 +13490,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo seutil_run_newrole($1_t,$1_r,{ $1_devpts_t $1_tty_device_t }) seutil_exec_checkpolicy($1_t) seutil_exec_setfiles($1_t) -@@ -794,19 +754,12 @@ +@@ -794,19 +753,12 @@ files_read_default_symlinks($1_t) files_read_default_sockets($1_t) files_read_default_pipes($1_t) @@ -15269,7 +13510,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo optional_policy(` alsa_read_rw_config($1_t) ') -@@ -821,11 +774,6 @@ +@@ -821,11 +773,7 @@ ') optional_policy(` @@ -15278,10 +13519,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo - ') - - optional_policy(` - allow $1_t self:dbus send_msg; ++ allow $1_t self:dbus send_msg; dbus_system_bus_client_template($1,$1_t) -@@ -834,20 +782,20 @@ + optional_policy(` +@@ -833,20 +781,20 @@ ') optional_policy(` @@ -15307,7 +13549,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ') -@@ -876,17 +824,17 @@ +@@ -875,17 +823,17 @@ ') optional_policy(` @@ -15333,7 +13575,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') optional_policy(` -@@ -900,16 +848,6 @@ +@@ -899,16 +847,6 @@ ') optional_policy(` @@ -15350,7 +13592,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo resmgr_stream_connect($1_t) ') -@@ -919,11 +857,6 @@ +@@ -918,11 +856,6 @@ ') optional_policy(` @@ -15362,7 +13604,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo samba_stream_connect_winbind($1_t) ') -@@ -954,21 +887,167 @@ +@@ -953,21 +886,166 @@ ## ## # @@ -15451,8 +13693,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + + fs_get_all_fs_quotas($1_usertype) + fs_getattr_all_fs($1_usertype) -+ fs_getattr_all_dirs($1_usertype) -+ fs_search_auto_mountpoints($1_usertype) ++ fs_search_all($1_usertype) + fs_list_inotifyfs($1_usertype) + + fs_rw_anon_inodefs_files($1_usertype) @@ -15536,7 +13777,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo domain_interactive_fd($1_t) typeattribute $1_devpts_t user_ptynode; -@@ -977,23 +1056,51 @@ +@@ -976,23 +1054,51 @@ typeattribute $1_tmp_t user_tmpfile; typeattribute $1_tty_device_t user_ttynode; @@ -15599,7 +13840,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo # port access is audited even if dac would not have allowed it, so dontaudit it here corenet_dontaudit_tcp_bind_all_reserved_ports($1_t) -@@ -1029,15 +1136,11 @@ +@@ -1028,23 +1134,14 @@ # and may change other protocols tunable_policy(`user_tcp_server',` corenet_tcp_bind_all_nodes($1_t) @@ -15609,15 +13850,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo optional_policy(` - kerberos_use($1_t) -- ') -- -- optional_policy(` -- loadkeys_run($1_t,$1_r,$1_tty_device_t) + hal_dbus_chat($1_t) ') +- optional_policy(` +- loadkeys_run($1_t,$1_r,$1_tty_device_t) +- ') +- +- optional_policy(` +- netutils_run_ping_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) +- netutils_run_traceroute_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) +- ') +- +- # Run pppd in pppd_t by default for user ++ # Run pppd in pppd_t by default for user optional_policy(` -@@ -1054,17 +1157,6 @@ + ppp_run_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) + ') +@@ -1053,17 +1150,6 @@ setroubleshoot_stream_connect($1_t) ') @@ -15635,7 +13885,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ####################################### -@@ -1102,6 +1194,8 @@ +@@ -1101,6 +1187,8 @@ class passwd { passwd chfn chsh rootok crontab }; ') @@ -15644,7 +13894,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ############################## # # Declarations -@@ -1127,7 +1221,7 @@ +@@ -1126,7 +1214,7 @@ # $1_t local policy # @@ -15653,7 +13903,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1_t self:process { setexec setfscreate }; # Set password information for other users. -@@ -1139,7 +1233,11 @@ +@@ -1138,7 +1226,11 @@ # Manipulate other users crontab. allow $1_t self:passwd crontab; @@ -15666,7 +13916,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo kernel_read_software_raid_state($1_t) kernel_getattr_core_if($1_t) -@@ -1277,6 +1375,7 @@ +@@ -1276,6 +1368,7 @@ dev_relabel_all_dev_nodes($1) files_create_boot_flag($1) @@ -15674,7 +13924,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo # Necessary for managing /boot/efi fs_manage_dos_files($1) -@@ -1353,7 +1452,7 @@ +@@ -1352,7 +1445,7 @@ ## # template(`userdom_role_change_generic_user',` @@ -15683,7 +13933,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1380,7 +1479,7 @@ +@@ -1379,7 +1472,7 @@ ## # template(`userdom_role_change_from_generic_user',` @@ -15692,7 +13942,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1406,7 +1505,7 @@ +@@ -1405,7 +1498,7 @@ ## # template(`userdom_role_change_staff',` @@ -15701,7 +13951,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1433,7 +1532,7 @@ +@@ -1432,7 +1525,7 @@ ## # template(`userdom_role_change_from_staff',` @@ -15710,7 +13960,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1459,7 +1558,7 @@ +@@ -1458,7 +1551,7 @@ ## # template(`userdom_role_change_sysadm',` @@ -15719,7 +13969,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1486,7 +1585,7 @@ +@@ -1485,7 +1578,7 @@ ## # template(`userdom_role_change_from_sysadm',` @@ -15728,7 +13978,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1642,9 +1741,13 @@ +@@ -1641,9 +1734,13 @@ template(`userdom_user_home_content',` gen_require(` attribute $1_file_type; @@ -15742,7 +13992,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo files_type($2) ') -@@ -1711,7 +1814,7 @@ +@@ -1710,7 +1807,7 @@ type $1_devpts_t; ') @@ -15751,7 +14001,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1894,10 +1997,46 @@ +@@ -1893,10 +1990,46 @@ template(`userdom_manage_user_home_content_dirs',` gen_require(` type $1_home_dir_t, $1_home_t; @@ -15799,16 +14049,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -2667,7 +2806,7 @@ - type $1_tmp_t; - ') - -- dontaudit $2 $1_tmp_t:file read_file_perms; -+ dontaudit $2 $1_tmp_t:file r_file_perms; - ') - - ######################################## -@@ -3078,7 +3217,7 @@ +@@ -3077,7 +3210,7 @@ # template(`userdom_tmp_filetrans_user_tmp',` gen_require(` @@ -15817,16 +14058,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') files_tmp_filetrans($2,$1_tmp_t,$3) -@@ -3491,7 +3630,7 @@ - type $1_untrusted_content_tmp_t; - ') - -- dontaudit $2 $1_untrusted_content_tmp_t:file read_file_perms; -+ dontaudit $2 $1_untrusted_content_tmp_t:file r_file_perms; - ') - - ######################################## -@@ -3912,7 +4051,7 @@ +@@ -3911,7 +4044,7 @@ type sysadm_t; ') @@ -15835,7 +14067,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow sysadm_t $1:fd use; allow sysadm_t $1:fifo_file rw_file_perms; allow sysadm_t $1:process sigchld; -@@ -4202,11 +4341,11 @@ +@@ -4201,11 +4334,11 @@ ## # interface(`userdom_sigchld_sysadm',` @@ -15851,16 +14083,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4504,7 +4643,7 @@ - - dontaudit $1 sysadm_home_dir_t:dir search_dir_perms; - dontaudit $1 sysadm_home_t:dir search_dir_perms; -- dontaudit $1 sysadm_home_t:file read_file_perms; -+ dontaudit $1 sysadm_home_t:file r_file_perms; - ') - - ######################################## -@@ -4572,8 +4711,8 @@ +@@ -4571,8 +4704,8 @@ files_search_home($1) allow $1 { sysadm_home_dir_t sysadm_home_t }:dir list_dir_perms; @@ -15871,7 +14094,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4593,8 +4732,8 @@ +@@ -4592,8 +4725,8 @@ files_search_tmp($1) allow $1 sysadm_tmp_t:dir list_dir_perms; @@ -15882,7 +14105,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4609,11 +4748,29 @@ +@@ -4608,11 +4741,29 @@ # interface(`userdom_search_all_users_home_dirs',` gen_require(` @@ -15913,7 +14136,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4633,6 +4790,14 @@ +@@ -4632,6 +4783,14 @@ files_list_home($1) allow $1 home_dir_type:dir list_dir_perms; @@ -15928,7 +14151,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4951,7 +5116,7 @@ +@@ -4950,7 +5109,7 @@ # interface(`userdom_manage_generic_user_home_content_dirs',` gen_require(` @@ -15937,7 +14160,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') files_search_home($1) -@@ -5069,7 +5234,7 @@ +@@ -5068,7 +5227,7 @@ # interface(`userdom_manage_generic_user_home_content_symlinks',` gen_require(` @@ -15946,7 +14169,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') files_search_home($1) -@@ -5089,7 +5254,7 @@ +@@ -5088,7 +5247,7 @@ # interface(`userdom_manage_generic_user_home_content_pipes',` gen_require(` @@ -15955,7 +14178,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') files_search_home($1) -@@ -5109,7 +5274,7 @@ +@@ -5108,7 +5267,7 @@ # interface(`userdom_manage_generic_user_home_content_sockets',` gen_require(` @@ -15964,16 +14187,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') files_search_home($1) -@@ -5323,7 +5488,7 @@ +@@ -5322,7 +5481,7 @@ attribute user_tmpfile; ') - allow $1 user_tmpfile:file { read getattr }; -+ allow $1 user_tmpfile:file r_file_perms; ++ allow $1 user_tmpfile:file read_file_perms; ') ######################################## -@@ -5559,3 +5724,382 @@ +@@ -5528,6 +5687,24 @@ + + ######################################## + ## ++## Manage keys for all user domains. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`userdom_manage_all_users_keys',` ++ gen_require(` ++ attribute userdomain; ++ ') ++ ++ allow $1 userdomain:key manage_key_perms; ++') ++ ++######################################## ++## + ## Send a dbus message to all user domains. + ## + ## +@@ -5558,3 +5735,379 @@ interface(`userdom_unconfined',` refpolicywarn(`$0($*) has been deprecated.') ') @@ -16216,9 +14464,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + ') + +') -+optional_policy(` -+ setroubleshoot_dontaudit_stream_connect($1_usertype) -+') + +# gnome keyring wants to read this. Needs to be exlicitly granted +dev_dontaudit_read_rand($1_usertype) @@ -16358,8 +14603,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.1.0/policy/modules/system/userdomain.te --- nsaserefpolicy/policy/modules/system/userdomain.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/userdomain.te 2007-10-24 15:06:50.000000000 -0400 -@@ -24,13 +24,6 @@ ++++ serefpolicy-3.1.0/policy/modules/system/userdomain.te 2007-11-06 16:05:43.000000000 -0500 +@@ -17,20 +17,13 @@ + + ## + ##

+-## Allow sysadm to ptrace all processes ++## Allow sysadm to debug or ptrace all processes + ##

+ ## + gen_tunable(allow_ptrace,false) ## ##

@@ -16478,7 +14731,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ', ` userdom_security_admin_template(sysadm_t, sysadm_r, admin_terminal) ') -@@ -494,3 +497,7 @@ +@@ -494,3 +497,15 @@ optional_policy(` yam_run(sysadm_t, sysadm_r, admin_terminal) ') @@ -16486,14 +14739,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo +tunable_policy(`allow_console_login', ` + term_use_console(userdomain) +') ++ ++optional_policy(` ++ netutils_run_ping_cond(user_t,user_r,{ user_tty_device_t user_devpts_t }) ++ netutils_run_ping_cond(staff_t,staff_r,{ staff_tty_device_t staff_devpts_t }) ++ netutils_run_traceroute_cond(user_t,user_r,{ user_tty_device_t user_devpts_t }) ++ netutils_run_traceroute_cond(staff_t,staff_r,{ staff_tty_device_t staff_devpts_t }) ++') ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.fc serefpolicy-3.1.0/policy/modules/system/virt.fc --- nsaserefpolicy/policy/modules/system/virt.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/system/virt.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/virt.fc 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1 @@ +/var/lib/libvirt(/.*)? gen_context(system_u:object_r:virt_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.1.0/policy/modules/system/virt.if --- nsaserefpolicy/policy/modules/system/virt.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/system/virt.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/virt.if 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,78 @@ +##

Virtualization + @@ -16575,14 +14836,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.1.0/policy/modules/system/virt.te --- nsaserefpolicy/policy/modules/system/virt.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/system/virt.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/virt.te 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,3 @@ +# var/lib files +type virt_var_lib_t; +files_type(virt_var_lib_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.1.0/policy/modules/system/xen.if --- nsaserefpolicy/policy/modules/system/xen.if 2007-06-21 09:32:04.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/xen.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/xen.if 2007-11-06 09:28:35.000000000 -0500 @@ -191,3 +191,24 @@ domtrans_pattern($1,xm_exec_t,xm_t) @@ -16610,7 +14871,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.1.0/policy/modules/system/xen.te --- nsaserefpolicy/policy/modules/system/xen.te 2007-10-12 08:56:08.000000000 -0400 -+++ serefpolicy-3.1.0/policy/modules/system/xen.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/system/xen.te 2007-11-06 09:28:35.000000000 -0500 @@ -6,6 +6,13 @@ # Declarations # @@ -16779,17 +15040,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.1.0/policy/modules/users/guest.fc --- nsaserefpolicy/policy/modules/users/guest.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/users/guest.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/users/guest.fc 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1 @@ +# No guest file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.1.0/policy/modules/users/guest.if --- nsaserefpolicy/policy/modules/users/guest.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/users/guest.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/users/guest.if 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1 @@ +## Policy for guest user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.1.0/policy/modules/users/guest.te --- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/users/guest.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/users/guest.te 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1,18 @@ +policy_module(guest,1.0.0) +userdom_unpriv_login_user(guest) @@ -16811,18 +15072,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.t +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.1.0/policy/modules/users/logadm.fc --- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/users/logadm.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/users/logadm.fc 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1 @@ +# No logadm file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.1.0/policy/modules/users/logadm.if --- nsaserefpolicy/policy/modules/users/logadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/users/logadm.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/users/logadm.if 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1 @@ +## Policy for logadm user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.1.0/policy/modules/users/logadm.te --- nsaserefpolicy/policy/modules/users/logadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/users/logadm.te 2007-10-24 15:06:50.000000000 -0400 -@@ -0,0 +1,12 @@ ++++ serefpolicy-3.1.0/policy/modules/users/logadm.te 2007-11-07 12:19:29.000000000 -0500 +@@ -0,0 +1,11 @@ +policy_module(logadm,1.0.0) + +######################################## @@ -16833,26 +15094,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm. + +allow logadm_t self:capability { dac_override dac_read_search kill sys_ptrace sys_nice }; + -+logging_syslog_admin(logadm, logadm_t, logadm_r) -+logging_audit_admin(logadm, logadm_t, logadm_r) ++logging_admin(logadm_t, logadm_r, { logadm_devpts_t logadm_tty_device_t }) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.1.0/policy/modules/users/metadata.xml --- nsaserefpolicy/policy/modules/users/metadata.xml 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/users/metadata.xml 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/users/metadata.xml 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1 @@ +Policy modules for users diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.1.0/policy/modules/users/webadm.fc --- nsaserefpolicy/policy/modules/users/webadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/users/webadm.fc 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/users/webadm.fc 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1 @@ +# No webadm file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.1.0/policy/modules/users/webadm.if --- nsaserefpolicy/policy/modules/users/webadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/users/webadm.if 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/users/webadm.if 2007-11-06 09:28:35.000000000 -0500 @@ -0,0 +1 @@ +## Policy for webadm user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.1.0/policy/modules/users/webadm.te --- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.1.0/policy/modules/users/webadm.te 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/modules/users/webadm.te 2007-11-07 12:19:49.000000000 -0500 @@ -0,0 +1,42 @@ +policy_module(webadm,1.0.0) + @@ -16889,7 +15149,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm. +userdom_dontaudit_search_sysadm_home_dirs(webadm_t) +userdom_dontaudit_search_generic_user_home_dirs(webadm_t) + -+apache_admin(webadm, webadm_t, webadm_r) ++apache_admin(webadm_t, webadm_r, { webadm_devpts_t webadm_tty_device_t }) + +gen_require(` + type gadmin_t; @@ -16898,7 +15158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm. +allow webadm_t gadmin_t:dir getattr; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.1.0/policy/support/obj_perm_sets.spt --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/policy/support/obj_perm_sets.spt 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/support/obj_perm_sets.spt 2007-11-06 09:28:36.000000000 -0500 @@ -204,7 +204,7 @@ define(`getattr_file_perms',`{ getattr }') define(`setattr_file_perms',`{ setattr }') @@ -16921,10 +15181,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets +define(`all_passwd_perms', `{ passwd chfn chsh rootok crontab } ') +define(`all_association_perms', `{ sendto recvfrom setcontext polmatch } ') + -+ ++define(`manage_key_perms', `{ create link read search setattr view write } ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.1.0/policy/users --- nsaserefpolicy/policy/users 2007-10-12 08:56:09.000000000 -0400 -+++ serefpolicy-3.1.0/policy/users 2007-10-24 15:06:50.000000000 -0400 ++++ serefpolicy-3.1.0/policy/users 2007-11-06 09:28:36.000000000 -0500 @@ -16,7 +16,7 @@ # and a user process should never be assigned the system user # identity. diff --git a/selinux-policy.spec b/selinux-policy.spec index 6f58dda..b92e76c 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -70,6 +70,7 @@ SELinux Policy development package %{_usr}/share/selinux/devel/Makefile %{_usr}/share/selinux/devel/policygentool %{_usr}/share/selinux/devel/example.* +%{_usr}/share/selinux/devel/policy.* %attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp %post devel @@ -166,7 +167,7 @@ fi; %description SELinux Reference Policy - modular. -Based off of reference policy: Checked out revision 2393. +Based off of reference policy: Checked out revision 2483. %build @@ -215,6 +216,7 @@ mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/ install -m 755 $RPM_SOURCE_DIR/policygentool %{buildroot}%{_usr}/share/selinux/devel/ install -m 644 $RPM_SOURCE_DIR/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/ +install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/ echo "htmlview file:///usr/share/doc/selinux-policy-%{version}/html/index.html"> %{buildroot}%{_usr}/share/selinux/devel/policyhelp chmod +x %{buildroot}%{_usr}/share/selinux/devel/policyhelp @@ -288,7 +290,7 @@ semodule -s targeted -r moilscanner 2>/dev/null %loadpolicy targeted if [ $1 = 1 ]; then -semanage user -a -P unconfined -R "unconfined_r system_r" unconfined_u +semanage user -a -P unconfined -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u semanage login -m -s "unconfined_u" __default__ 2> /dev/null semanage login -m -s "system_u" root 2> /dev/null semanage user -a -P guest -R guest_r guest_u @@ -300,6 +302,10 @@ fi exit 0 +%triggerpostun targeted -- selinux-policy-targeted < 3.0.8-44-1 +semanage user -m -r s0-s0:c0.c1023 unconfined_u 2> /dev/null +exit 0 + %triggerpostun targeted -- selinux-policy-targeted < 3.0.8-14-1 setsebool -P use_nfs_home_dirs=1 semanage login -m -s "system_u" __default__ 2> /dev/null