diff --git a/policy/global_booleans b/policy/global_booleans index 111d004..844fc78 100644 --- a/policy/global_booleans +++ b/policy/global_booleans @@ -4,6 +4,7 @@ # file should be used. # +ifdef(`strict_policy',` ## ##

## Enabling secure mode disallows programs, such as @@ -12,6 +13,7 @@ ##

##
gen_bool(secure_mode,false) +') ## ##

diff --git a/policy/global_tunables b/policy/global_tunables index ec5cc93..0cb55b8 100644 --- a/policy/global_tunables +++ b/policy/global_tunables @@ -19,6 +19,14 @@ gen_tunable(allow_cvs_read_shadow,false) ## ##

+## Allow zebra daemon to write it configuration files +##

+##
+# +gen_tunable(allow_zebra_write_config,false) + +## +##

## Allow making the heap executable. ##

##
@@ -89,6 +97,13 @@ gen_tunable(allow_httpd_anon_write,false) ## ##

+## Allow Apache to use mod_auth_pam +##

+##
+gen_tunable(allow_httpd_mod_auth_pam,false) + +## +##

## Allow java executable stack ##

##
@@ -132,12 +147,6 @@ gen_tunable(allow_saslauthd_read_shadow,false) ## gen_tunable(allow_smbd_anon_write,false) -## -##

-## Allow sysadm to ptrace all processes -##

-##
-gen_tunable(allow_ptrace,false) ## ##

@@ -290,13 +299,6 @@ gen_tunable(read_default_t,false) ## ##

-## Allow ssh to run from inetd instead of as a daemon. -##

-##
-gen_tunable(run_ssh_inetd,false) - -## -##

## Allow samba to export user home directories. ##

##
@@ -311,13 +313,6 @@ gen_tunable(samba_share_nfs,false) ## ##

-## Allow spamassassin to do DNS lookups -##

-##
-gen_tunable(spamassasin_can_network,false) - -## -##

## Allow squid to connect to all ports, not just ## HTTP, FTP, and Gopher ports. ##

@@ -326,13 +321,6 @@ gen_tunable(squid_connect_any,false) ## ##

-## Allow ssh logins as sysadm_r:sysadm_t -##

-##
-gen_tunable(ssh_sysadm_login,false) - -## -##

## Configure stunnel to be a standalone daemon or ## inetd service. ##

@@ -353,6 +341,12 @@ gen_tunable(use_nfs_home_dirs,false) ##
gen_tunable(use_samba_home_dirs,false) +######################################## +# +# Strict policy specific +# + +ifdef(`strict_policy',` ## ##

## Control users use of ping and traceroute @@ -360,12 +354,6 @@ gen_tunable(use_samba_home_dirs,false) ## gen_tunable(user_ping,false) -######################################## -# -# Strict policy specific -# - -ifdef(`strict_policy',` ## ##

## Allow gpg executable stack @@ -382,6 +370,13 @@ gen_tunable(allow_mplayer_execstack,false) ## ##

+## Allow sysadm to ptrace all processes +##

+##
+gen_tunable(allow_ptrace,false) + +## +##

## allow host key based authentication ##

##
@@ -482,6 +477,13 @@ gen_tunable(read_untrusted_content,false) ## ##

+## Allow ssh to run from inetd instead of as a daemon. +##

+##
+gen_tunable(run_ssh_inetd,false) + +## +##

## Allow user spamassassin clients to use the network. ##

##
@@ -489,6 +491,13 @@ gen_tunable(spamassassin_can_network,false) ## ##

+## Allow ssh logins as sysadm_r:sysadm_t +##

+##
+gen_tunable(ssh_sysadm_login,false) + +## +##

## Allow staff_r users to search the sysadm home ## dir and read files (such as ~/.bashrc) ##

diff --git a/policy/mcs b/policy/mcs index c33b667..5a47877 100644 --- a/policy/mcs +++ b/policy/mcs @@ -160,7 +160,7 @@ mlsconstrain process { transition dyntransition } (( h1 dom h2 ) or ( t1 == mcssetcats )); mlsconstrain process { ptrace } - ( h1 dom h2 ); + (( h1 dom h2) or ( t1 == mcsptraceall )); mlsconstrain process { sigkill sigstop } (( h1 dom h2 ) or ( t1 == mcskillall )); diff --git a/policy/modules/admin/bootloader.te b/policy/modules/admin/bootloader.te index 41b4027..529bfe2 100644 --- a/policy/modules/admin/bootloader.te +++ b/policy/modules/admin/bootloader.te @@ -1,5 +1,5 @@ -policy_module(bootloader,1.2.4) +policy_module(bootloader,1.2.5) ######################################## # @@ -48,7 +48,7 @@ logging_log_file(var_log_ksyms_t) # bootloader local policy # -allow bootloader_t self:capability { dac_read_search fsetid sys_rawio sys_admin mknod chown }; +allow bootloader_t self:capability { dac_override dac_read_search fsetid sys_rawio sys_admin mknod chown }; allow bootloader_t self:process { sigkill sigstop signull signal execmem }; allow bootloader_t self:fifo_file rw_file_perms; @@ -67,6 +67,7 @@ files_tmp_filetrans(bootloader_t,bootloader_tmp_t,{ dir file lnk_file chr_file b files_root_filetrans(bootloader_t,bootloader_tmp_t,file) kernel_getattr_core_if(bootloader_t) +kernel_read_network_state(bootloader_t) kernel_read_system_state(bootloader_t) kernel_read_software_raid_state(bootloader_t) kernel_read_kernel_sysctls(bootloader_t) @@ -86,7 +87,10 @@ dev_read_sysfs(bootloader_t) dev_read_raw_memory(bootloader_t) fs_getattr_xattr_fs(bootloader_t) +fs_getattr_tmpfs(bootloader_t) fs_read_tmpfs_symlinks(bootloader_t) +#Needed for ia64 +fs_manage_dos_files(bootloader_t) mls_file_read_up(bootloader_t) diff --git a/policy/modules/admin/firstboot.te b/policy/modules/admin/firstboot.te index b03616f..b875c3f 100644 --- a/policy/modules/admin/firstboot.te +++ b/policy/modules/admin/firstboot.te @@ -1,5 +1,5 @@ -policy_module(firstboot,1.1.2) +policy_module(firstboot,1.1.3) gen_require(` class passwd rootok; @@ -106,6 +106,10 @@ ifdef(`targeted_policy',` ') optional_policy(` + hal_dbus_send(firstboot_t) +') + +optional_policy(` nis_use_ypbind(firstboot_t) ') diff --git a/policy/modules/admin/netutils.te b/policy/modules/admin/netutils.te index d5766aa..d70fa2a 100644 --- a/policy/modules/admin/netutils.te +++ b/policy/modules/admin/netutils.te @@ -1,5 +1,5 @@ -policy_module(netutils,1.1.4) +policy_module(netutils,1.1.5) ######################################## # @@ -211,11 +211,11 @@ sysnet_read_config(traceroute_t) ifdef(`targeted_policy',` term_use_unallocated_ttys(traceroute_t) term_use_generic_ptys(traceroute_t) -') - -tunable_policy(`user_ping',` - term_use_all_user_ttys(traceroute_t) - term_use_all_user_ptys(traceroute_t) +',` + tunable_policy(`user_ping',` + term_use_all_user_ttys(traceroute_t) + term_use_all_user_ptys(traceroute_t) + ') ') optional_policy(` diff --git a/policy/modules/admin/prelink.te b/policy/modules/admin/prelink.te index 506215a..c53929b 100644 --- a/policy/modules/admin/prelink.te +++ b/policy/modules/admin/prelink.te @@ -1,5 +1,5 @@ -policy_module(prelink,1.1.4) +policy_module(prelink,1.1.5) ######################################## # @@ -48,6 +48,7 @@ corecmd_manage_all_executables(prelink_t) corecmd_relabel_all_executables(prelink_t) corecmd_mmap_all_executables(prelink_t) corecmd_read_sbin_symlinks(prelink_t) +corecmd_read_bin_symlinks(prelink_t) dev_read_urand(prelink_t) diff --git a/policy/modules/admin/rpm.if b/policy/modules/admin/rpm.if index 00f1b98..9b37218 100644 --- a/policy/modules/admin/rpm.if +++ b/policy/modules/admin/rpm.if @@ -211,7 +211,7 @@ interface(`rpm_read_db',` files_search_var_lib($1) allow $1 rpm_var_lib_t:dir r_dir_perms; - allow $1 rpm_var_lib_t:file { getattr read }; + allow $1 rpm_var_lib_t:file r_file_perms; allow $1 rpm_var_lib_t:lnk_file r_file_perms; ') @@ -232,8 +232,8 @@ interface(`rpm_manage_db',` files_search_var_lib($1) allow $1 rpm_var_lib_t:dir rw_dir_perms; - allow $1 rpm_var_lib_t:file { getattr create read write append unlink }; - allow $1 rpm_var_lib_t:lnk_file { getattr read write unlink }; + allow $1 rpm_var_lib_t:file manage_file_perms; + allow $1 rpm_var_lib_t:lnk_file create_lnk_perms; ') ######################################## diff --git a/policy/modules/admin/rpm.te b/policy/modules/admin/rpm.te index a12a0d4..da38ad5 100644 --- a/policy/modules/admin/rpm.te +++ b/policy/modules/admin/rpm.te @@ -1,5 +1,5 @@ -policy_module(rpm,1.3.9) +policy_module(rpm,1.3.10) ######################################## # diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te index 5472419..0cc9adc 100644 --- a/policy/modules/admin/usermanage.te +++ b/policy/modules/admin/usermanage.te @@ -1,5 +1,5 @@ -policy_module(usermanage,1.3.7) +policy_module(usermanage,1.3.8) ######################################## # @@ -260,6 +260,7 @@ optional_policy(` ') optional_policy(` + nscd_exec(groupadd_t) nscd_socket_use(groupadd_t) ') @@ -534,6 +535,7 @@ optional_policy(` ') optional_policy(` + nscd_exec(useradd_t) nscd_socket_use(useradd_t) ') diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index e809365..f27cc83 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -1,5 +1,5 @@ -policy_module(corenetwork,1.1.12) +policy_module(corenetwork,1.1.13) ######################################## # @@ -62,7 +62,7 @@ network_port(amavisd_recv, tcp,10024,s0) network_port(amavisd_send, tcp,10025,s0) network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0, udp,5060,s0) network_port(auth, tcp,113,s0) -network_port(bgp, tcp,179,s0, udp,179,s0) +network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0) type biff_port_t, port_type, reserved_port_type; dnl network_port(biff) # no defined portcon in current strict network_port(clamd, tcp,3310,s0) network_port(clockspeed, udp,4041,s0) @@ -145,7 +145,7 @@ network_port(uucpd, tcp,540,s0) network_port(vnc, tcp,5900,s0) network_port(xen, tcp,8002,s0) network_port(xserver, tcp, 6000, s0, tcp,6001,s0, tcp,6002,s0, tcp,6003,s0, tcp,6004,s0, tcp,6005,s0, tcp,6006,s0, tcp,6007,s0, tcp,6008,s0, tcp,6009,s0, tcp,6010,s0, tcp,6011,s0, tcp,6012,s0, tcp,6013,s0, tcp,6014,s0, tcp,6015,s0, tcp,6016,s0, tcp,6017,s0, tcp,6018,s0, tcp,6019,s0) -network_port(zebra, tcp,2601,s0) +network_port(zebra, tcp,2600,s0, tcp,2601,s0, tcp,2602,s0, tcp,2603,s0, tcp,2604,s0, tcp,2606,s0, udp,2600,s0, udp,2601,s0, udp,2602,s0, udp,2603,s0, udp,2604,s0, udp,2606,s0) network_port(zope, tcp,8021,s0) # Defaults for reserved ports. Earlier portcon entries take precedence; diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc index f83f36f..e1e67f6 100644 --- a/policy/modules/kernel/devices.fc +++ b/policy/modules/kernel/devices.fc @@ -19,7 +19,9 @@ /dev/evtchn -c gen_context(system_u:object_r:xen_device_t,s0) /dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0) /dev/full -c gen_context(system_u:object_r:null_device_t,s0) +/dev/hiddev.* -c gen_context(system_u:object_r:usb_device_t,s0) /dev/hw_random -c gen_context(system_u:object_r:random_device_t,s0) +/dev/hwrng -c gen_context(system_u:object_r:random_device_t,s0) /dev/i915 -c gen_context(system_u:object_r:dri_device_t,s0) /dev/irlpt[0-9]+ -c gen_context(system_u:object_r:printer_device_t,s0) /dev/js.* -c gen_context(system_u:object_r:mouse_device_t,s0) @@ -54,6 +56,7 @@ /dev/sndstat -c gen_context(system_u:object_r:sound_device_t,s0) /dev/tlk[0-3] -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/urandom -c gen_context(system_u:object_r:urandom_device_t,s0) +/dev/usbdev.* -c gen_context(system_u:object_r:usb_device_t,s0) /dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0) ifdef(`distro_suse', ` /dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0) diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te index a1940b4..6c06c8c 100644 --- a/policy/modules/kernel/devices.te +++ b/policy/modules/kernel/devices.te @@ -1,5 +1,5 @@ -policy_module(devices,1.1.14) +policy_module(devices,1.1.15) ######################################## # diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc index b3a21ea..e2c8421 100644 --- a/policy/modules/kernel/files.fc +++ b/policy/modules/kernel/files.fc @@ -11,6 +11,7 @@ ifdef(`distro_redhat',` /\.autofsck -- gen_context(system_u:object_r:etc_runtime_t,s0) /\.autorelabel -- gen_context(system_u:object_r:etc_runtime_t,s0) +/\.suspended -- gen_context(system_u:object_r:etc_runtime_t,s0) /fastboot -- gen_context(system_u:object_r:etc_runtime_t,s0) /forcefsck -- gen_context(system_u:object_r:etc_runtime_t,s0) /fsckoptions -- gen_context(system_u:object_r:etc_runtime_t,s0) diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te index e3f7b8f..cf92894 100644 --- a/policy/modules/kernel/files.te +++ b/policy/modules/kernel/files.te @@ -1,5 +1,5 @@ -policy_module(files,1.2.12) +policy_module(files,1.2.13) ######################################## # diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if index 1c08a77..512192a 100644 --- a/policy/modules/kernel/filesystem.if +++ b/policy/modules/kernel/filesystem.if @@ -1019,6 +1019,26 @@ interface(`fs_relabelfrom_dos_fs',` ######################################## ## +## Create, read, write, and delete files +## on a DOS filesystem. +## +## +## +## Domain allowed access. +## +## +# +interface(`fs_manage_dos_files',` + gen_require(` + type dosfs_t; + ') + + allow $1 dosfs_t:dir rw_dir_perms; + allow $1 dosfs_t:file manage_file_perms; +') + +######################################## +## ## Read eventpollfs files. ## ## diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te index 104b56b..23753bd 100644 --- a/policy/modules/kernel/filesystem.te +++ b/policy/modules/kernel/filesystem.te @@ -1,5 +1,5 @@ -policy_module(filesystem,1.3.12) +policy_module(filesystem,1.3.13) ######################################## # diff --git a/policy/modules/kernel/mcs.if b/policy/modules/kernel/mcs.if index 3caa6f7..ed1e022 100644 --- a/policy/modules/kernel/mcs.if +++ b/policy/modules/kernel/mcs.if @@ -6,7 +6,7 @@ ######################################## ## ## This domain is allowed to sigkill and sigstop -## all domains regardless of their MCS level. +## all domains regardless of their MCS category set. ## ## ## @@ -24,6 +24,26 @@ interface(`mcs_killall',` ######################################## ## +## This domain is allowed to ptrace +## all domains regardless of their MCS +## category set. +## +## +## +## Domain target for user exemption. +## +## +# +interface(`mcs_ptrace_all',` + gen_require(` + attribute mcsptraceall; + ') + + typeattribute $1 mcsptraceall; +') + +######################################## +## ## Make specified domain MCS trusted ## for setting any category set for ## the processes it executes. diff --git a/policy/modules/kernel/mcs.te b/policy/modules/kernel/mcs.te index 88a6e98..5f8b1f4 100644 --- a/policy/modules/kernel/mcs.te +++ b/policy/modules/kernel/mcs.te @@ -1,5 +1,5 @@ -policy_module(mcs,1.0.2) +policy_module(mcs,1.0.3) ######################################## # @@ -7,6 +7,7 @@ policy_module(mcs,1.0.2) # attribute mcskillall; +attribute mcsptraceall; attribute mcssetcats; ######################################## diff --git a/policy/modules/kernel/selinux.if b/policy/modules/kernel/selinux.if index c4f9d7e..f10b677 100644 --- a/policy/modules/kernel/selinux.if +++ b/policy/modules/kernel/selinux.if @@ -150,7 +150,11 @@ interface(`selinux_set_enforce_mode',` if(!secure_mode_policyload) { allow $1 security_t:security setenforce; - auditallow $1 security_t:security setenforce; + + ifdef(`distro_rhel4',` + # needed for systems without audit support + auditallow $1 security_t:security setenforce; + ') } ') @@ -177,7 +181,11 @@ interface(`selinux_load_policy',` if(!secure_mode_policyload) { allow $1 security_t:security load_policy; - auditallow $1 security_t:security load_policy; + + ifdef(`distro_rhel4',` + # needed for systems without audit support + auditallow $1 security_t:security load_policy; + ') } ') diff --git a/policy/modules/kernel/selinux.te b/policy/modules/kernel/selinux.te index b62940e..d0e2750 100644 --- a/policy/modules/kernel/selinux.te +++ b/policy/modules/kernel/selinux.te @@ -1,5 +1,5 @@ -policy_module(selinux,1.1.1) +policy_module(selinux,1.1.2) ######################################## # @@ -40,10 +40,9 @@ allow selinux_unconfined_type security_t:security ~{ load_policy setenforce setb if(!secure_mode_policyload) { allow selinux_unconfined_type security_t:security { load_policy setenforce setbool }; - auditallow selinux_unconfined_type security_t:security { load_policy setenforce }; ifdef(`distro_rhel4',` # needed for systems without audit support - auditallow selinux_unconfined_type security_t:security setbool; + auditallow selinux_unconfined_type security_t:security { load_policy setenforce setbool }; ') } diff --git a/policy/modules/kernel/storage.fc b/policy/modules/kernel/storage.fc index 30d7868..8d52958 100644 --- a/policy/modules/kernel/storage.fc +++ b/policy/modules/kernel/storage.fc @@ -21,8 +21,9 @@ /dev/jsfd -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255) /dev/jsflash -c gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255) /dev/loop.* -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255) -/dev/lvm -c gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255) +/dev/lvm -c gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255) /dev/mcdx? -b gen_context(system_u:object_r:removable_device_t,s0) +/dev/mmcblk.* -b gen_context(system_u:object_r:removable_device_t,s0) /dev/nb[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,s15:c0.c255) /dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0) /dev/p[fg][0-3] -b gen_context(system_u:object_r:removable_device_t,s0) diff --git a/policy/modules/kernel/storage.te b/policy/modules/kernel/storage.te index e78c43c..59d716b 100644 --- a/policy/modules/kernel/storage.te +++ b/policy/modules/kernel/storage.te @@ -1,5 +1,5 @@ -policy_module(storage,1.0.1) +policy_module(storage,1.0.2) ######################################## # diff --git a/policy/modules/services/automount.te b/policy/modules/services/automount.te index 67020c0..c92b118 100644 --- a/policy/modules/services/automount.te +++ b/policy/modules/services/automount.te @@ -1,5 +1,5 @@ -policy_module(automount,1.2.7) +policy_module(automount,1.2.8) ######################################## # @@ -36,10 +36,12 @@ allow automount_t self:unix_stream_socket create_socket_perms; allow automount_t self:unix_dgram_socket create_socket_perms; allow automount_t self:tcp_socket create_stream_socket_perms; allow automount_t self:udp_socket create_socket_perms; +allow automount_t self:netlink_route_socket r_netlink_socket_perms; allow automount_t automount_etc_t:file { getattr read }; # because config files can be shell scripts can_exec(automount_t, automount_etc_t) +can_exec(automount_t, automount_exec_t) allow automount_t automount_lock_t:file create_file_perms; files_lock_filetrans(automount_t,automount_lock_t,file) @@ -169,6 +171,12 @@ optional_policy(` ') optional_policy(` + kerberos_read_keytab(automount_t) + kerberos_read_config(automount_t) + kerberos_dontaudit_write_config(automount_t) +') + +optional_policy(` nis_use_ypbind(automount_t) ') diff --git a/policy/modules/services/avahi.te b/policy/modules/services/avahi.te index 86a2b04..d1d378f 100644 --- a/policy/modules/services/avahi.te +++ b/policy/modules/services/avahi.te @@ -1,5 +1,5 @@ -policy_module(avahi,1.2.3) +policy_module(avahi,1.2.4) ######################################## # @@ -78,6 +78,7 @@ logging_send_syslog_msg(avahi_t) miscfiles_read_localization(avahi_t) sysnet_read_config(avahi_t) +sysnet_use_ldap(avahi_t) userdom_dontaudit_use_unpriv_user_fds(avahi_t) userdom_dontaudit_search_sysadm_home_dirs(avahi_t) diff --git a/policy/modules/services/bind.fc b/policy/modules/services/bind.fc index b63564d..d4ad4d7 100644 --- a/policy/modules/services/bind.fc +++ b/policy/modules/services/bind.fc @@ -28,7 +28,8 @@ ifdef(`distro_gentoo',` ') ifdef(`distro_redhat',` -/etc/named\.conf -- gen_context(system_u:object_r:named_conf_t,s0) +/etc/named\.rfc1912.zones -- gen_context(system_u:object_r:named_conf_t,s0) +/etc/named\.conf -- gen_context(system_u:object_r:named_conf_t,s0) /etc/named\.caching-nameserver\.conf -- gen_context(system_u:object_r:named_conf_t,s0) /var/named(/.*)? gen_context(system_u:object_r:named_zone_t,s0) /var/named/slaves(/.*)? gen_context(system_u:object_r:named_cache_t,s0) diff --git a/policy/modules/services/bind.te b/policy/modules/services/bind.te index e284ddf..1d2dd9f 100644 --- a/policy/modules/services/bind.te +++ b/policy/modules/services/bind.te @@ -1,5 +1,5 @@ -policy_module(bind,1.1.6) +policy_module(bind,1.1.7) ######################################## # diff --git a/policy/modules/services/bluetooth.if b/policy/modules/services/bluetooth.if index 0b67fac..8eefbb5 100644 --- a/policy/modules/services/bluetooth.if +++ b/policy/modules/services/bluetooth.if @@ -2,6 +2,27 @@ ######################################## ## +## Execute bluetooth in the bluetooth domain. +## +## +## +## The type of the process performing this action. +## +## +# +interface(`bluetooth_domtrans',` + gen_require(` + type bluetooth_t, bluetooth_exec_t; + ') + + domain_auto_trans($1,bluetooth_exec_t,bluetooth_t) + allow bluetooth_t $1:fd use; + allow bluetooth_t $1:fifo_file rw_file_perms; + allow bluetooth_t $1:process sigchld; +') + +######################################## +## ## Read bluetooth daemon configuration. ## ## diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te index 3a78044..dac26bf 100644 --- a/policy/modules/services/bluetooth.te +++ b/policy/modules/services/bluetooth.te @@ -1,5 +1,5 @@ -policy_module(bluetooth,1.2.8) +policy_module(bluetooth,1.2.9) ######################################## # @@ -173,6 +173,7 @@ allow bluetooth_helper_t self:fifo_file rw_file_perms; allow bluetooth_helper_t self:shm create_shm_perms; allow bluetooth_helper_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow bluetooth_helper_t self:tcp_socket create_socket_perms; +allow bluetooth_helper_t self:netlink_route_socket r_netlink_socket_perms; allow bluetooth_helper_t bluetooth_t:socket { read write }; @@ -222,6 +223,8 @@ ifdef(`targeted_policy',` userdom_manage_generic_user_home_content_files(bluetooth_helper_t) optional_policy(` + corenet_tcp_connect_xserver_port(bluetooth_helper_t) + xserver_stream_connect_xdm(bluetooth_helper_t) xserver_use_xdm_fds(bluetooth_helper_t) xserver_rw_xdm_pipes(bluetooth_helper_t) diff --git a/policy/modules/services/clamav.fc b/policy/modules/services/clamav.fc index 874f1e5..f9790aa 100644 --- a/policy/modules/services/clamav.fc +++ b/policy/modules/services/clamav.fc @@ -7,9 +7,10 @@ /usr/sbin/clamd -- gen_context(system_u:object_r:clamd_exec_t,s0) +/var/run/amavis(d)?/clamd\.pid -- gen_context(system_u:object_r:clamd_var_run_t,s0) /var/run/clamav(/.*)? gen_context(system_u:object_r:clamd_var_run_t,s0) -/var/run/clamav/clamd\.ctl -s gen_context(system_u:object_r:clamd_sock_t,s0) /var/lib/clamav(/.*)? gen_context(system_u:object_r:clamd_var_lib_t,s0) /var/log/clamav -d gen_context(system_u:object_r:clamd_var_log_t,s0) /var/log/clamav/clamav.* -- gen_context(system_u:object_r:clamd_var_log_t,s0) /var/log/clamav/freshclam.* -- gen_context(system_u:object_r:freshclam_var_log_t,s0) +/var/spool/amavisd/clamd\.sock -s gen_context(system_u:object_r:clamd_var_run_t,s0) diff --git a/policy/modules/services/clamav.if b/policy/modules/services/clamav.if index 3263dbb..9c9c3fa 100644 --- a/policy/modules/services/clamav.if +++ b/policy/modules/services/clamav.if @@ -35,11 +35,11 @@ interface(`clamav_domtrans',` # interface(`clamav_stream_connect',` gen_require(` - type clamd_t, clamd_sock_t, clamd_var_run_t; + type clamd_t, clamd_var_run_t; ') allow $1 clamd_var_run_t:dir search; - allow $1 clamd_sock_t:sock_file write; + allow $1 clamd_var_run_t:sock_file write; allow $1 clamd_t:unix_stream_socket connectto; ') diff --git a/policy/modules/services/clamav.te b/policy/modules/services/clamav.te index 14f06d6..e79e014 100644 --- a/policy/modules/services/clamav.te +++ b/policy/modules/services/clamav.te @@ -1,5 +1,5 @@ -policy_module(clamav,1.0.4) +policy_module(clamav,1.0.5) ######################################## # @@ -15,10 +15,6 @@ init_daemon_domain(clamd_t, clamd_exec_t) type clamd_etc_t; files_type(clamd_etc_t) -# named socket type -type clamd_sock_t; -files_type(clamd_sock_t) - # tmp files type clamd_tmp_t; files_tmp_file(clamd_tmp_t) @@ -34,6 +30,7 @@ files_type(clamd_var_lib_t) # pid files type clamd_var_run_t; files_pid_file(clamd_var_run_t) +typealias clamd_var_run_t alias clamd_sock_t; type clamscan_t; type clamscan_exec_t; @@ -67,12 +64,6 @@ allow clamd_t clamd_etc_t:dir r_dir_perms; allow clamd_t clamd_etc_t:file r_file_perms; allow clamd_t clamd_etc_t:lnk_file { getattr read }; -# socket file -allow clamd_t clamd_sock_t:file manage_file_perms; -allow clamd_t clamd_sock_t:sock_file manage_file_perms; -allow clamd_t clamd_sock_t:dir rw_dir_perms; -files_pid_filetrans(clamd_t,clamd_sock_t,sock_file) - # tmp files allow clamd_t clamd_tmp_t:file create_file_perms; allow clamd_t clamd_tmp_t:dir create_dir_perms; @@ -80,14 +71,10 @@ files_tmp_filetrans(clamd_t,clamd_tmp_t,{ file dir }) # var/lib files for clamd allow clamd_t clamd_var_lib_t:file create_file_perms; -allow clamd_t clamd_var_lib_t:sock_file create_file_perms; allow clamd_t clamd_var_lib_t:dir create_dir_perms; -files_var_filetrans(clamd_t,clamd_var_lib_t,{ file dir sock_file }) -files_var_lib_filetrans(clamd_t,clamd_var_lib_t,file) # log files allow clamd_t clamd_var_log_t:file create_file_perms; -allow clamd_t clamd_var_log_t:sock_file create_file_perms; allow clamd_t clamd_var_log_t:dir { rw_dir_perms setattr }; logging_log_filetrans(clamd_t,clamd_var_log_t,file) @@ -161,10 +148,7 @@ allow freshclam_t clamd_etc_t:lnk_file { getattr read }; # var/lib files together with clamd allow freshclam_t clamd_var_lib_t:file create_file_perms; -allow freshclam_t clamd_var_lib_t:sock_file create_file_perms; allow freshclam_t clamd_var_lib_t:dir create_dir_perms; -files_var_filetrans(freshclam_t,clamd_var_lib_t,{ file dir sock_file }) -files_var_lib_filetrans(freshclam_t,clamd_var_lib_t,file) # pidfiles- var/run together with clamd allow freshclam_t clamd_var_run_t:file manage_file_perms; @@ -174,7 +158,6 @@ files_pid_filetrans(freshclam_t,clamd_var_run_t,file) # log files (own logfiles only) allow freshclam_t freshclam_var_log_t:file create_file_perms; -allow freshclam_t freshclam_var_log_t:sock_file create_file_perms; allow freshclam_t freshclam_var_log_t:dir { rw_dir_perms setattr }; allow freshclam_t clamd_var_log_t:dir search; logging_log_filetrans(freshclam_t,freshclam_var_log_t,file) @@ -234,7 +217,6 @@ files_tmp_filetrans(clamscan_t,clamscan_tmp_t,{ file dir }) # var/lib files together with clamd allow clamscan_t clamd_var_lib_t:file r_file_perms; -allow clamscan_t clamd_var_lib_t:sock_file rw_file_perms; allow clamscan_t clamd_var_lib_t:dir r_dir_perms; kernel_read_kernel_sysctls(clamscan_t) diff --git a/policy/modules/services/cyrus.te b/policy/modules/services/cyrus.te index 21dc5da..6199142 100644 --- a/policy/modules/services/cyrus.te +++ b/policy/modules/services/cyrus.te @@ -1,5 +1,5 @@ -policy_module(cyrus,1.1.3) +policy_module(cyrus,1.1.4) ######################################## # @@ -41,6 +41,7 @@ allow cyrus_t self:unix_dgram_socket sendto; allow cyrus_t self:unix_stream_socket connectto; allow cyrus_t self:tcp_socket create_stream_socket_perms; allow cyrus_t self:udp_socket create_socket_perms; +allow cyrus_t self:netlink_route_socket r_netlink_socket_perms; allow cyrus_t cyrus_tmp_t:dir create_dir_perms; allow cyrus_t cyrus_tmp_t:file create_file_perms; @@ -123,6 +124,10 @@ optional_policy(` ') optional_policy(` + ldap_stream_connect(cyrus_t) +') + +optional_policy(` nis_use_ypbind(cyrus_t) ') diff --git a/policy/modules/services/dovecot.fc b/policy/modules/services/dovecot.fc index a6a0023..48ba580 100644 --- a/policy/modules/services/dovecot.fc +++ b/policy/modules/services/dovecot.fc @@ -28,6 +28,8 @@ ifdef(`distro_redhat', ` # /var/run/dovecot(-login)?(/.*)? gen_context(system_u:object_r:dovecot_var_run_t,s0) +/var/lib/dovecot(/.*)? gen_context(system_u:object_r:dovecot_var_lib_t,s0) + /var/spool/dovecot(/.*)? gen_context(system_u:object_r:dovecot_spool_t,s0) diff --git a/policy/modules/services/dovecot.te b/policy/modules/services/dovecot.te index 166d4dc..642e3ce 100644 --- a/policy/modules/services/dovecot.te +++ b/policy/modules/services/dovecot.te @@ -1,5 +1,5 @@ -policy_module(dovecot,1.2.4) +policy_module(dovecot,1.2.5) ######################################## # @@ -9,6 +9,12 @@ type dovecot_t; type dovecot_exec_t; init_daemon_domain(dovecot_t,dovecot_exec_t) +type dovecot_auth_t; +type dovecot_auth_exec_t; +domain_type(dovecot_auth_t) +domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t) +role system_r types dovecot_auth_t; + type dovecot_cert_t; files_type(dovecot_cert_t) @@ -21,15 +27,13 @@ files_type(dovecot_passwd_t) type dovecot_spool_t; files_type(dovecot_spool_t) +# /var/lib/dovecot holds SSL parameters file +type dovecot_var_lib_t; +files_type(dovecot_var_lib_t) + type dovecot_var_run_t; files_pid_file(dovecot_var_run_t) -type dovecot_auth_t; -type dovecot_auth_exec_t; -domain_type(dovecot_auth_t) -domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t) -role system_r types dovecot_auth_t; - ######################################## # # dovecot local policy @@ -161,6 +165,11 @@ allow dovecot_auth_t dovecot_t:unix_stream_socket { getattr accept read write io allow dovecot_auth_t dovecot_passwd_t:file { getattr read }; +# Allow dovecot to create and read SSL parameters file +allow dovecot_t dovecot_var_lib_t:dir rw_dir_perms; +allow dovecot_t dovecot_var_lib_t:file manage_file_perms; +files_search_var_lib(dovecot_t) + allow dovecot_auth_t dovecot_var_run_t:dir r_dir_perms; kernel_read_all_sysctls(dovecot_auth_t) diff --git a/policy/modules/services/ftp.te b/policy/modules/services/ftp.te index fb09648..df7e7f2 100644 --- a/policy/modules/services/ftp.te +++ b/policy/modules/services/ftp.te @@ -1,5 +1,5 @@ -policy_module(ftp,1.2.6) +policy_module(ftp,1.2.7) ######################################## # @@ -50,6 +50,7 @@ allow ftpd_t self:unix_dgram_socket { sendto create_socket_perms }; allow ftpd_t self:unix_stream_socket create_stream_socket_perms; allow ftpd_t self:tcp_socket create_stream_socket_perms; allow ftpd_t self:udp_socket create_socket_perms; +allow ftpd_t self:netlink_route_socket r_netlink_socket_perms; allow ftpd_t ftpd_etc_t:file r_file_perms; @@ -206,6 +207,12 @@ tunable_policy(`ftpd_is_daemon',` ') optional_policy(` + tunable_policy(`ftp_home_dir',` + apache_search_sys_content(ftpd_t) + ') +') + +optional_policy(` corecmd_exec_shell(ftpd_t) files_read_usr_files(ftpd_t) diff --git a/policy/modules/services/hal.te b/policy/modules/services/hal.te index 47786ad..8c7a872 100644 --- a/policy/modules/services/hal.te +++ b/policy/modules/services/hal.te @@ -1,5 +1,5 @@ -policy_module(hal,1.3.10) +policy_module(hal,1.3.11) ######################################## # @@ -22,7 +22,7 @@ files_pid_file(hald_var_run_t) # # execute openvt which needs setuid -allow hald_t self:capability { chown setuid setgid kill net_admin sys_admin sys_nice dac_override dac_read_search mknod sys_rawio sys_tty_config }; +allow hald_t self:capability { audit_write chown setuid setgid kill net_admin sys_admin sys_nice dac_override dac_read_search mknod sys_rawio sys_tty_config }; dontaudit hald_t self:capability sys_tty_config; allow hald_t self:process signal_perms; allow hald_t self:fifo_file rw_file_perms; @@ -153,6 +153,10 @@ ifdef(`targeted_policy', ` ') optional_policy(` + bootloader_domtrans(hald_t) +') + +optional_policy(` # For /usr/libexec/hald-addon-acpi # writes to /var/run/acpid.socket apm_stream_connect(hald_t) @@ -163,6 +167,10 @@ optional_policy(` ') optional_policy(` + bluetooth_domtrans(hald_t) +') + +optional_policy(` clock_domtrans(hald_t) ') diff --git a/policy/modules/services/inetd.te b/policy/modules/services/inetd.te index d4c0050..eb53308 100644 --- a/policy/modules/services/inetd.te +++ b/policy/modules/services/inetd.te @@ -1,5 +1,5 @@ -policy_module(inetd,1.1.4) +policy_module(inetd,1.1.5) ######################################## # @@ -218,8 +218,10 @@ miscfiles_read_localization(inetd_child_t) sysnet_read_config(inetd_child_t) -tunable_policy(`run_ssh_inetd',` - corenet_tcp_bind_ssh_port(inetd_t) +ifdef(`strict_policy',` + tunable_policy(`run_ssh_inetd',` + corenet_tcp_bind_ssh_port(inetd_t) + ') ') optional_policy(` diff --git a/policy/modules/services/ldap.fc b/policy/modules/services/ldap.fc index 8ee84ac..d740147 100644 --- a/policy/modules/services/ldap.fc +++ b/policy/modules/services/ldap.fc @@ -6,6 +6,7 @@ /var/lib/ldap(/.*)? gen_context(system_u:object_r:slapd_db_t,s0) /var/lib/ldap/replog(/.*)? gen_context(system_u:object_r:slapd_replog_t,s0) +/var/run/ldapi -s gen_context(system_u:object_r:slapd_var_run_t,s0) /var/run/openldap(/.*)? gen_context(system_u:object_r:slapd_var_run_t,s0) /var/run/slapd\.args -- gen_context(system_u:object_r:slapd_var_run_t,s0) /var/run/slapd\.pid -- gen_context(system_u:object_r:slapd_var_run_t,s0) diff --git a/policy/modules/services/ldap.if b/policy/modules/services/ldap.if index 45b3bd9..03b9d83 100644 --- a/policy/modules/services/ldap.if +++ b/policy/modules/services/ldap.if @@ -57,3 +57,24 @@ interface(`ldap_use',` allow slapd_t $1:tcp_socket { acceptfrom recvfrom }; kernel_tcp_recvfrom($1) ') + + +######################################## +## +## Connect to slapd over an unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`ldap_stream_connect',` + gen_require(` + type slapd_t, slapd_var_run_t; + ') + + files_search_pids($1) + allow $1 slapd_var_run_t:sock_file write; + allow $1 slapd_t:unix_stream_socket connectto; +') diff --git a/policy/modules/services/ldap.te b/policy/modules/services/ldap.te index 315dffb..6731b76 100644 --- a/policy/modules/services/ldap.te +++ b/policy/modules/services/ldap.te @@ -1,5 +1,5 @@ -policy_module(ldap,1.2.3) +policy_module(ldap,1.2.4) ######################################## # diff --git a/policy/modules/services/lpd.if b/policy/modules/services/lpd.if index fd149e4..3d997fa 100644 --- a/policy/modules/services/lpd.if +++ b/policy/modules/services/lpd.if @@ -62,6 +62,7 @@ template(`lpd_per_userdomain_template',` allow $1_lpr_t self:unix_stream_socket create_stream_socket_perms; allow $1_lpr_t self:tcp_socket create_socket_perms; allow $1_lpr_t self:udp_socket create_socket_perms; + allow $1_lpr_t self:netlink_route_socket r_netlink_socket_perms; # lpr can run in lightweight mode, without a local print spooler. allow $1_lpr_t lpd_var_run_t:dir search; @@ -109,7 +110,9 @@ template(`lpd_per_userdomain_template',` allow lpd_t $1_print_spool_t:file link_file_perms; kernel_tcp_recvfrom($1_lpr_t) + kernel_read_kernel_sysctls($1_lpr_t) + corenet_non_ipsec_sendrecv($1_lpr_t) corenet_tcp_sendrecv_generic_if($1_lpr_t) corenet_udp_sendrecv_generic_if($1_lpr_t) corenet_tcp_sendrecv_all_nodes($1_lpr_t) @@ -119,8 +122,8 @@ template(`lpd_per_userdomain_template',` corenet_tcp_connect_all_ports($1_lpr_t) corenet_sendrecv_all_client_packets($1_lpr_t) - # for /dev/null - dev_list_all_dev_nodes($1_lpr_t) + dev_read_rand($1_lpr_t) + dev_read_urand($1_lpr_t) domain_use_interactive_fds($1_lpr_t) @@ -149,6 +152,8 @@ template(`lpd_per_userdomain_template',` userdom_read_user_tmp_symlinks($1,$1_lpr_t) # Write to the user domain tty. userdom_use_user_terminals($1,$1_lpr_t) + userdom_read_user_home_content_files($1,$1_lpr_t) + userdom_read_user_tmp_files($1,$1_lpr_t) tunable_policy(`read_default_t',` files_list_default($1_lpr_t) @@ -158,8 +163,6 @@ template(`lpd_per_userdomain_template',` tunable_policy(`read_untrusted_content',` #list and read user specific untrusted content - files_list_home($1_lpr_t) - userdom_list_user_home_dirs($1,$1_lpr_t) userdom_read_user_untrusted_content_files($1,$1_lpr_t) #list and read user specific temporary untrusted content @@ -186,6 +189,7 @@ template(`lpd_per_userdomain_template',` cups_tcp_connect($1_lpr_t) cups_read_config($2) cups_tcp_connect($2) + cups_stream_connect($1_lpr_t) ') optional_policy(` @@ -199,14 +203,6 @@ template(`lpd_per_userdomain_template',` optional_policy(` nis_use_ypbind($1_lpr_t) ') - - ifdef(`TODO',` - optional_policy(` - allow $1_lpr_t xdm_t:fd use; - allow $1_lpr_t xdm_var_run_t:dir search; - allow $1_lpr_t xdm_t:fifo_file { getattr read write ioctl }; - ') - ') dnl end TODO ') ####################################### diff --git a/policy/modules/services/lpd.te b/policy/modules/services/lpd.te index c2eedbd..0006d34 100644 --- a/policy/modules/services/lpd.te +++ b/policy/modules/services/lpd.te @@ -1,5 +1,5 @@ -policy_module(lpd,1.2.4) +policy_module(lpd,1.2.5) ######################################## # diff --git a/policy/modules/services/mailman.te b/policy/modules/services/mailman.te index f5ccc55..70e5b77 100644 --- a/policy/modules/services/mailman.te +++ b/policy/modules/services/mailman.te @@ -1,5 +1,5 @@ -policy_module(mailman,1.1.5) +policy_module(mailman,1.1.6) ######################################## # @@ -30,12 +30,16 @@ mailman_domain_template(queue) # Mailman CGI local policy # -# cjp: the template invocation for queue should be +# cjp: the template invocation for cgi should be # in the below optional policy; however, there are no # optionals for file contexts yet, so it is promoted # to global scope until such facilities exist. optional_policy(` + allow mailman_cgi_t self:netlink_route_socket r_netlink_socket_perms; + + dev_read_urand(mailman_cgi_t) + allow mailman_cgi_t mailman_archive_t:dir create_dir_perms; allow mailman_cgi_t mailman_archive_t:lnk_file create_lnk_perms; allow mailman_cgi_t mailman_archive_t:file create_file_perms; @@ -52,6 +56,10 @@ optional_policy(` apache_use_fds(mailman_cgi_t) apache_dontaudit_append_log(mailman_cgi_t) apache_search_sys_script_state(mailman_cgi_t) + + optional_policy(` + nscd_socket_use(mailman_cgi_t) + ') ') ######################################## diff --git a/policy/modules/services/nis.te b/policy/modules/services/nis.te index a5fd29b..d9edc35 100644 --- a/policy/modules/services/nis.te +++ b/policy/modules/services/nis.te @@ -1,5 +1,5 @@ -policy_module(nis,1.1.5) +policy_module(nis,1.1.6) ######################################## # @@ -86,6 +86,7 @@ corenet_udp_bind_generic_port(ypbind_t) corenet_tcp_bind_reserved_port(ypbind_t) corenet_udp_bind_reserved_port(ypbind_t) corenet_tcp_bind_all_rpc_ports(ypbind_t) +corenet_udp_bind_all_rpc_ports(ypbind_t) corenet_tcp_connect_all_ports(ypbind_t) corenet_dontaudit_tcp_bind_all_reserved_ports(ypbind_t) corenet_dontaudit_udp_bind_all_reserved_ports(ypbind_t) diff --git a/policy/modules/services/nscd.if b/policy/modules/services/nscd.if index 0625b2d..84ea494 100644 --- a/policy/modules/services/nscd.if +++ b/policy/modules/services/nscd.if @@ -44,6 +44,25 @@ interface(`nscd_domtrans',` ######################################## ## +## Allow the specified domain to execute nscd +## in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`nscd_exec',` + gen_require(` + type nscd_exec_t; + ') + + can_exec($1,nscd_exec_t) +') + +######################################## +## ## Use NSCD services by connecting using ## a unix stream socket. ## diff --git a/policy/modules/services/nscd.te b/policy/modules/services/nscd.te index 94ab050..9b679d0 100644 --- a/policy/modules/services/nscd.te +++ b/policy/modules/services/nscd.te @@ -1,5 +1,5 @@ -policy_module(nscd,1.2.6) +policy_module(nscd,1.2.7) gen_require(` class nscd all_nscd_perms; diff --git a/policy/modules/services/openvpn.te b/policy/modules/services/openvpn.te index 8277b36..512ce2d 100644 --- a/policy/modules/services/openvpn.te +++ b/policy/modules/services/openvpn.te @@ -1,5 +1,5 @@ -policy_module(openvpn,1.0.2) +policy_module(openvpn,1.0.3) ######################################## # @@ -33,6 +33,7 @@ allow openvpn_t self:unix_dgram_socket { create_socket_perms sendto }; allow openvpn_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow openvpn_t self:udp_socket create_socket_perms; allow openvpn_t self:tcp_socket create_socket_perms; +allow openvpn_t self:netlink_route_socket r_netlink_socket_perms; allow openvpn_t openvpn_etc_t:dir r_dir_perms; allow openvpn_t openvpn_etc_t:file r_file_perms; @@ -67,12 +68,15 @@ corenet_udp_bind_openvpn_port(openvpn_t) corenet_sendrecv_openvpn_server_packets(openvpn_t) corenet_rw_tun_tap_dev(openvpn_t) +dev_search_sysfs(openvpn_t) dev_read_rand(openvpn_t) dev_read_urand(openvpn_t) files_read_etc_files(openvpn_t) files_read_etc_runtime_files(openvpn_t) +init_use_fds(openvpn_t) + libs_use_ld_so(openvpn_t) libs_use_shared_libs(openvpn_t) @@ -80,10 +84,12 @@ logging_send_syslog_msg(openvpn_t) miscfiles_read_localization(openvpn_t) +sysnet_dns_name_resolve(openvpn_t) sysnet_exec_ifconfig(openvpn_t) ifdef(`targeted_policy',` - term_dontaudit_use_generic_ptys(openvpn_t) + # Need to interact with terminals if config option "auth-user-pass" is used + term_use_generic_ptys(openvpn_t) ') optional_policy(` diff --git a/policy/modules/services/postfix.te b/policy/modules/services/postfix.te index 8a1dd9f..7fb0b17 100644 --- a/policy/modules/services/postfix.te +++ b/policy/modules/services/postfix.te @@ -1,5 +1,5 @@ -policy_module(postfix,1.2.9) +policy_module(postfix,1.2.10) ######################################## # @@ -160,7 +160,7 @@ files_read_usr_files(postfix_master_t) init_use_script_ptys(postfix_master_t) -miscfiles_dontaudit_search_man_pages(postfix_master_t) +miscfiles_read_man_pages(postfix_master_t) seutil_sigchld_newrole(postfix_master_t) # postfix does a "find" on startup for some reason - keep it quiet @@ -591,5 +591,9 @@ files_read_usr_files(postfix_smtpd_t) mta_read_aliases(postfix_smtpd_t) optional_policy(` + postgrey_stream_connect(postfix_smtpd_t) +') + +optional_policy(` sasl_connect(postfix_smtpd_t) ') diff --git a/policy/modules/services/postgrey.fc b/policy/modules/services/postgrey.fc index 74c88dc..f04d5ba 100644 --- a/policy/modules/services/postgrey.fc +++ b/policy/modules/services/postgrey.fc @@ -3,6 +3,7 @@ /usr/sbin/postgrey -- gen_context(system_u:object_r:postgrey_exec_t,s0) -/var/run/postgrey\.pid -- gen_context(system_u:object_r:postgrey_var_run_t,s0) - /var/lib/postgrey(/.*)? gen_context(system_u:object_r:postgrey_var_lib_t,s0) + +/var/run/postgrey(/.*)? gen_context(system_u:object_r:postgrey_var_run_t,s0) +/var/run/postgrey\.pid -- gen_context(system_u:object_r:postgrey_var_run_t,s0) diff --git a/policy/modules/services/postgrey.if b/policy/modules/services/postgrey.if index f5cae30..90f7a87 100644 --- a/policy/modules/services/postgrey.if +++ b/policy/modules/services/postgrey.if @@ -1 +1,21 @@ ## Postfix grey-listing server + +######################################## +## +## Write to postgrey socket +## +## +## +## Domain allowed to talk to postgrey +## +## +# +interface(`postgrey_stream_connect',` + gen_require(` + type postgrey_var_run_t, postgrey_t; + ') + + allow $1 postgrey_t:unix_stream_socket connectto; + allow $1 postgrey_var_run_t:sock_file write; + files_search_pids($1) +') diff --git a/policy/modules/services/postgrey.te b/policy/modules/services/postgrey.te index b794ca6..93c7482 100644 --- a/policy/modules/services/postgrey.te +++ b/policy/modules/services/postgrey.te @@ -1,5 +1,5 @@ -policy_module(postgrey,1.0.1) +policy_module(postgrey,1.0.2) ######################################## # @@ -38,6 +38,7 @@ allow postgrey_t postgrey_var_lib_t:dir rw_dir_perms; files_var_lib_filetrans(postgrey_t,postgrey_var_lib_t,file) allow postgrey_t postgrey_var_run_t:file create_file_perms; +allow postgrey_t postgrey_var_run_t:sock_file manage_file_perms; allow postgrey_t postgrey_var_run_t:dir rw_dir_perms; files_pid_filetrans(postgrey_t,postgrey_var_run_t,file) diff --git a/policy/modules/services/procmail.te b/policy/modules/services/procmail.te index 29eefae..812f9cd 100644 --- a/policy/modules/services/procmail.te +++ b/policy/modules/services/procmail.te @@ -1,5 +1,5 @@ -policy_module(procmail,1.2.4) +policy_module(procmail,1.2.5) ######################################## # @@ -35,6 +35,7 @@ corenet_tcp_sendrecv_all_nodes(procmail_t) corenet_udp_sendrecv_all_nodes(procmail_t) corenet_tcp_sendrecv_all_ports(procmail_t) corenet_udp_sendrecv_all_ports(procmail_t) +corenet_udp_bind_all_nodes(procmail_t) corenet_tcp_connect_spamd_port(procmail_t) corenet_sendrecv_spamd_client_packets(procmail_t) diff --git a/policy/modules/services/radius.fc b/policy/modules/services/radius.fc index 576f54f..a9ce21d 100644 --- a/policy/modules/services/radius.fc +++ b/policy/modules/services/radius.fc @@ -3,6 +3,7 @@ /etc/cron\.(daily|weekly|monthly)/freeradius -- gen_context(system_u:object_r:radiusd_exec_t,s0) /etc/raddb(/.*)? gen_context(system_u:object_r:radiusd_etc_t,s0) +/etc/raddb/db.daily -- gen_context(system_u:object_r:radiusd_etc_rw_t,s0) /usr/sbin/radiusd -- gen_context(system_u:object_r:radiusd_exec_t,s0) /usr/sbin/freeradius -- gen_context(system_u:object_r:radiusd_exec_t,s0) diff --git a/policy/modules/services/radius.te b/policy/modules/services/radius.te index 4f61a75..6767c83 100644 --- a/policy/modules/services/radius.te +++ b/policy/modules/services/radius.te @@ -1,5 +1,5 @@ -policy_module(radius,1.1.1) +policy_module(radius,1.1.2) ######################################## # @@ -13,6 +13,9 @@ init_daemon_domain(radiusd_t,radiusd_exec_t) type radiusd_etc_t; files_config_file(radiusd_etc_t) +type radiusd_etc_rw_t; +files_type(radiusd_etc_rw_t) + type radiusd_log_t; logging_log_file(radiusd_log_t) @@ -39,6 +42,11 @@ allow radiusd_t radiusd_etc_t:dir r_dir_perms; allow radiusd_t radiusd_etc_t:lnk_file { getattr read }; files_search_etc(radiusd_t) +allow radiusd_t radiusd_etc_rw_t:dir create_dir_perms; +allow radiusd_t radiusd_etc_rw_t:file create_file_perms; +allow radiusd_t radiusd_etc_rw_t:lnk_file create_lnk_perms; +type_transition radiusd_t radiusd_etc_t:{ dir file lnk_file } radiusd_etc_rw_t; + allow radiusd_t radiusd_log_t:file create_file_perms; allow radiusd_t radiusd_log_t:dir create_dir_perms; logging_log_filetrans(radiusd_t,radiusd_log_t,{ file dir }) diff --git a/policy/modules/services/remotelogin.te b/policy/modules/services/remotelogin.te index 18d90dc..5d1ebea 100644 --- a/policy/modules/services/remotelogin.te +++ b/policy/modules/services/remotelogin.te @@ -1,5 +1,5 @@ -policy_module(remotelogin,1.2.0) +policy_module(remotelogin,1.2.1) ######################################## # @@ -37,6 +37,7 @@ allow remote_login_t self:shm create_shm_perms; allow remote_login_t self:sem create_sem_perms; allow remote_login_t self:msgq create_msgq_perms; allow remote_login_t self:msg { send receive }; +allow remote_login_t self:key write; allow remote_login_t remote_login_tmp_t:dir create_dir_perms; allow remote_login_t remote_login_tmp_t:file create_file_perms; diff --git a/policy/modules/services/samba.te b/policy/modules/services/samba.te index 5577c67..37ae73e 100644 --- a/policy/modules/services/samba.te +++ b/policy/modules/services/samba.te @@ -1,5 +1,5 @@ -policy_module(samba,1.2.8) +policy_module(samba,1.2.9) ################################# # @@ -186,11 +186,12 @@ allow smbd_t self:tcp_socket create_stream_socket_perms; allow smbd_t self:udp_socket create_socket_perms; allow smbd_t self:unix_dgram_socket { create_socket_perms sendto }; allow smbd_t self:unix_stream_socket { create_stream_socket_perms connectto }; +allow smbd_t self:netlink_route_socket r_netlink_socket_perms; allow smbd_t samba_etc_t:dir rw_dir_perms; allow smbd_t samba_etc_t:file { rw_file_perms setattr }; -allow smbd_t samba_log_t:dir ra_dir_perms; +allow smbd_t samba_log_t:dir { ra_dir_perms setattr }; dontaudit smbd_t samba_log_t:dir remove_name; allow smbd_t samba_log_t:file { create ra_file_perms }; @@ -313,6 +314,7 @@ tunable_policy(`samba_share_nfs',` optional_policy(` cups_read_rw_config(smbd_t) + cups_stream_connect(smbd_t) ') optional_policy(` @@ -365,7 +367,7 @@ files_pid_filetrans(nmbd_t,nmbd_var_run_t,file) allow nmbd_t samba_etc_t:dir { search getattr }; allow nmbd_t samba_etc_t:file { getattr read }; -allow nmbd_t samba_log_t:dir ra_dir_perms; +allow nmbd_t samba_log_t:dir { ra_dir_perms setattr }; allow nmbd_t samba_log_t:file { create ra_file_perms }; allow nmbd_t samba_var_t:dir rw_dir_perms; diff --git a/policy/modules/services/squid.te b/policy/modules/services/squid.te index a1480f4..c6d21df 100644 --- a/policy/modules/services/squid.te +++ b/policy/modules/services/squid.te @@ -1,5 +1,5 @@ -policy_module(squid,1.1.3) +policy_module(squid,1.1.4) ######################################## # @@ -80,8 +80,10 @@ corenet_udp_sendrecv_all_ports(squid_t) corenet_tcp_bind_all_nodes(squid_t) corenet_udp_bind_all_nodes(squid_t) corenet_tcp_bind_http_cache_port(squid_t) +corenet_udp_bind_http_cache_port(squid_t) corenet_tcp_bind_ftp_port(squid_t) corenet_tcp_bind_gopher_port(squid_t) +corenet_udp_bind_gopher_port(squid_t) corenet_tcp_connect_ftp_port(squid_t) corenet_tcp_connect_gopher_port(squid_t) corenet_tcp_connect_http_port(squid_t) @@ -176,9 +178,6 @@ optional_policy(` ') ifdef(`TODO',` -ifdef(`apache.te',` -can_tcp_connect(squid_t, httpd_t) -') #squid requires the following when run in diskd mode, the recommended setting allow squid_t tmpfs_t:file { read write }; ') dnl end TODO diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if index ef79d3f..0089934 100644 --- a/policy/modules/services/ssh.if +++ b/policy/modules/services/ssh.if @@ -71,6 +71,7 @@ template(`ssh_basic_client_template',` allow $1_ssh_t self:msgq create_msgq_perms; allow $1_ssh_t self:msg { send receive }; allow $1_ssh_t self:tcp_socket create_socket_perms; + allow $1_ssh_t self:netlink_route_socket r_netlink_socket_perms; # for rsync allow $1_ssh_t $2:unix_stream_socket rw_socket_perms; diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te index c8113fb..15ec28f 100644 --- a/policy/modules/services/ssh.te +++ b/policy/modules/services/ssh.te @@ -1,5 +1,5 @@ -policy_module(ssh,1.3.6) +policy_module(ssh,1.3.7) ######################################## # diff --git a/policy/modules/services/tftp.te b/policy/modules/services/tftp.te index 4df1189..4c998cd 100644 --- a/policy/modules/services/tftp.te +++ b/policy/modules/services/tftp.te @@ -1,5 +1,5 @@ -policy_module(tftp,1.1.1) +policy_module(tftp,1.1.2) ######################################## # @@ -78,6 +78,7 @@ logging_send_syslog_msg(tftpd_t) miscfiles_read_localization(tftpd_t) sysnet_read_config(tftpd_t) +sysnet_use_ldap(tftpd_t) userdom_dontaudit_use_unpriv_user_fds(tftpd_t) userdom_dontaudit_use_sysadm_ttys(tftpd_t) diff --git a/policy/modules/services/xfs.te b/policy/modules/services/xfs.te index 5752f5d..2a4da55 100644 --- a/policy/modules/services/xfs.te +++ b/policy/modules/services/xfs.te @@ -1,5 +1,5 @@ -policy_module(xfs,1.0.3) +policy_module(xfs,1.0.4) ######################################## # @@ -46,6 +46,8 @@ corecmd_list_bin(xfs_t) corecmd_list_sbin(xfs_t) dev_read_sysfs(xfs_t) +dev_read_urand(xfs_t) +dev_read_rand(xfs_t) fs_getattr_all_fs(xfs_t) fs_search_auto_mountpoints(xfs_t) diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if index e0b8511..6868bb6 100644 --- a/policy/modules/services/xserver.if +++ b/policy/modules/services/xserver.if @@ -317,7 +317,6 @@ template(`xserver_per_userdomain_template',` ') ifdef(`TODO',` - allow $1_t xdm_xserver_tmp_t:dir r_dir_perms; allow $1_t xdm_xserver_t:unix_stream_socket connectto; ifdef(`xdm.te', ` @@ -1126,6 +1125,7 @@ interface(`xserver_stream_connect_xdm_xserver',` ') files_search_tmp($1) + allow $1 xdm_xserver_tmp_t:dir search_dir_perms; allow $1 xdm_xserver_tmp_t:sock_file write; allow $1 xdm_xserver_t:unix_stream_socket connectto; ') diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index 5bc2356..86b30cc 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -1,5 +1,5 @@ -policy_module(xserver,1.1.10) +policy_module(xserver,1.1.11) ######################################## # @@ -88,6 +88,7 @@ allow xdm_t self:unix_stream_socket { connectto create_stream_socket_perms }; allow xdm_t self:unix_dgram_socket create_socket_perms; allow xdm_t self:tcp_socket create_stream_socket_perms; allow xdm_t self:udp_socket create_socket_perms; +allow xdm_t self:key write; # Supress permission check on .ICE-unix dontaudit xdm_t ice_tmp_t:dir { getattr setattr }; @@ -331,7 +332,7 @@ tunable_policy(`use_samba_home_dirs',` ') optional_policy(` - consoletype_domtrans(xdm_t) + consoletype_exec(xdm_t) ') optional_policy(` diff --git a/policy/modules/services/zebra.te b/policy/modules/services/zebra.te index 3d331a3..2cc306e 100644 --- a/policy/modules/services/zebra.te +++ b/policy/modules/services/zebra.te @@ -1,5 +1,5 @@ -policy_module(zebra,1.2.2) +policy_module(zebra,1.2.3) ######################################## # @@ -72,8 +72,10 @@ corenet_tcp_sendrecv_all_ports(zebra_t) corenet_udp_sendrecv_all_ports(zebra_t) corenet_tcp_bind_all_nodes(zebra_t) corenet_udp_bind_all_nodes(zebra_t) +corenet_tcp_bind_bgp_port(zebra_t) corenet_tcp_bind_zebra_port(zebra_t) corenet_udp_bind_router_port(zebra_t) +corenet_tcp_connect_bgp_port(zebra_t) corenet_sendrecv_zebra_server_packets(zebra_t) corenet_sendrecv_router_server_packets(zebra_t) @@ -116,6 +118,11 @@ ifdef(`targeted_policy', ` unconfined_sigchld(zebra_t) ') +tunable_policy(`allow_zebra_write_config',` + allow zebra_t zebra_conf_t:dir write; + allow zebra_t zebra_conf_t:file write; +') + optional_policy(` ldap_use(zebra_t) ') diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te index 7e6ca34..18d1fe8 100644 --- a/policy/modules/system/authlogin.te +++ b/policy/modules/system/authlogin.te @@ -1,5 +1,5 @@ -policy_module(authlogin,1.3.8) +policy_module(authlogin,1.3.9) ######################################## # @@ -193,6 +193,7 @@ term_use_all_user_ptys(pam_console_t) term_setattr_console(pam_console_t) term_getattr_unallocated_ttys(pam_console_t) term_setattr_unallocated_ttys(pam_console_t) +term_use_unallocated_ttys(pam_console_t) auth_use_nsswitch(pam_console_t) diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc index f55036c..dcd5ba6 100644 --- a/policy/modules/system/fstools.fc +++ b/policy/modules/system/fstools.fc @@ -1,3 +1,4 @@ +/sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/blockdev -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/cfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/dosfsck -- gen_context(system_u:object_r:fsadm_exec_t,s0) diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te index 73a8fe0..8d24711 100644 --- a/policy/modules/system/fstools.te +++ b/policy/modules/system/fstools.te @@ -1,5 +1,5 @@ -policy_module(fstools,1.3.2) +policy_module(fstools,1.3.3) ######################################## # diff --git a/policy/modules/system/getty.fc b/policy/modules/system/getty.fc index b778309..ff413c7 100644 --- a/policy/modules/system/getty.fc +++ b/policy/modules/system/getty.fc @@ -9,3 +9,4 @@ /var/run/mgetty\.pid.* -- gen_context(system_u:object_r:getty_var_run_t,s0) /var/spool/fax -- gen_context(system_u:object_r:getty_var_run_t,s0) +/var/spool/voice -- gen_context(system_u:object_r:getty_var_run_t,s0) diff --git a/policy/modules/system/getty.te b/policy/modules/system/getty.te index aaac752..e6a6745 100644 --- a/policy/modules/system/getty.te +++ b/policy/modules/system/getty.te @@ -1,5 +1,5 @@ -policy_module(getty,1.1.2) +policy_module(getty,1.1.3) ######################################## # @@ -37,7 +37,7 @@ files_pid_file(getty_var_run_t) # # Use capabilities. -allow getty_t self:capability { dac_override chown sys_resource sys_tty_config fowner fsetid }; +allow getty_t self:capability { dac_override chown setgid sys_resource sys_tty_config fowner fsetid }; dontaudit getty_t self:capability sys_tty_config; allow getty_t self:process { getpgid getsession signal_perms }; @@ -90,6 +90,7 @@ corecmd_search_sbin(getty_t) files_rw_generic_pids(getty_t) files_read_etc_runtime_files(getty_t) files_read_etc_files(getty_t) +files_search_spool(getty_t) init_rw_utmp(getty_t) init_use_script_ptys(getty_t) diff --git a/policy/modules/system/hotplug.te b/policy/modules/system/hotplug.te index 14bad2d..cddc6c9 100644 --- a/policy/modules/system/hotplug.te +++ b/policy/modules/system/hotplug.te @@ -1,5 +1,5 @@ -policy_module(hotplug,1.2.1) +policy_module(hotplug,1.2.2) ######################################## # @@ -136,7 +136,7 @@ ifdef(`targeted_policy', ` term_dontaudit_use_generic_ptys(hotplug_t) optional_policy(` - consoletype_domtrans(hotplug_t) + consoletype_exec(hotplug_t) ') ') diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index 65cf3de..431483b 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -1,5 +1,5 @@ -policy_module(init,1.3.17) +policy_module(init,1.3.18) gen_require(` class passwd rootok; @@ -286,6 +286,9 @@ fs_unmount_all_fs(initrc_t) fs_remount_all_fs(initrc_t) fs_getattr_all_fs(initrc_t) +# initrc_t needs to do a pidof which requires ptrace +mcs_ptrace_all(initrc_t) + selinux_get_enforce_mode(initrc_t) storage_getattr_fixed_disk_dev(initrc_t) diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc index 11ce8ae..054f2bb 100644 --- a/policy/modules/system/libraries.fc +++ b/policy/modules/system/libraries.fc @@ -198,7 +198,7 @@ ifdef(`distro_redhat',` # Livna.org packages: xmms-mp3, ffmpeg, xvidcore, xine-lib, gsm, lame /usr/lib(64)?.*/libmpg123\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/libpostproc\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -/usr/lib(64)?/libavformat-.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib(64)?/libavformat.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/libavcodec-.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/libavutil-.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/libxvidcore\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) diff --git a/policy/modules/system/libraries.te b/policy/modules/system/libraries.te index 03ce1fa..a1dd7d3 100644 --- a/policy/modules/system/libraries.te +++ b/policy/modules/system/libraries.te @@ -1,5 +1,5 @@ -policy_module(libraries,1.3.9) +policy_module(libraries,1.3.10) ######################################## # diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te index 6a16f92..296b6d9 100644 --- a/policy/modules/system/locallogin.te +++ b/policy/modules/system/locallogin.te @@ -1,5 +1,5 @@ -policy_module(locallogin,1.2.3) +policy_module(locallogin,1.2.4) ######################################## # @@ -51,6 +51,7 @@ allow local_login_t self:shm create_shm_perms; allow local_login_t self:sem create_sem_perms; allow local_login_t self:msgq create_msgq_perms; allow local_login_t self:msg { send receive }; +allow local_login_t self:key write; allow local_login_t local_login_lock_t:file create_file_perms; files_lock_filetrans(local_login_t,local_login_lock_t,file) diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if index 32bf657..4efe47f 100644 --- a/policy/modules/system/logging.if +++ b/policy/modules/system/logging.if @@ -165,7 +165,8 @@ interface(`logging_manage_audit_config',` ') files_search_etc($1) - allow $1 auditd_etc_t:file create_file_perms; + allow $1 auditd_etc_t:dir rw_dir_perms; + allow $1 auditd_etc_t:file manage_file_perms; ') ######################################## @@ -287,6 +288,7 @@ interface(`logging_read_audit_config',` ') files_search_etc($1) + allow $1 auditd_etc_t:dir r_dir_perms; allow $1 auditd_etc_t:file r_file_perms; ') @@ -308,7 +310,7 @@ interface(`logging_search_logs',` ') files_search_var($1) - allow $1 var_log_t:dir search; + allow $1 var_log_t:dir search_dir_perms; ') ####################################### @@ -326,7 +328,7 @@ interface(`logging_dontaudit_search_logs',` type var_log_t; ') - dontaudit $1 var_log_t:dir search; + dontaudit $1 var_log_t:dir search_dir_perms; ') ####################################### diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te index 74aee44..f209df6 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -1,5 +1,5 @@ -policy_module(logging,1.3.7) +policy_module(logging,1.3.8) ######################################## # @@ -140,7 +140,7 @@ term_dontaudit_use_console(auditd_t) # Probably want a transition, and a new auditd_helper app corecmd_exec_sbin(auditd_t) corecmd_exec_bin(auditd_t) - +corecmd_exec_shell(auditd_t) domain_use_interactive_fds(auditd_t) diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te index 5aca3d0..5c4a37d 100644 --- a/policy/modules/system/lvm.te +++ b/policy/modules/system/lvm.te @@ -1,5 +1,5 @@ -policy_module(lvm,1.3.4) +policy_module(lvm,1.3.5) ######################################## # @@ -125,7 +125,7 @@ optional_policy(` # DAC overrides and mknod for modifying /dev entries (vgmknodes) # rawio needed for dmraid -allow lvm_t self:capability { dac_override ipc_lock sys_admin sys_nice mknod chown sys_resource sys_rawio }; +allow lvm_t self:capability { dac_override fowner ipc_lock sys_admin sys_nice mknod chown sys_resource sys_rawio }; dontaudit lvm_t self:capability sys_tty_config; allow lvm_t self:process { sigchld sigkill sigstop signull signal }; # LVM will complain a lot if it cannot set its priority. @@ -200,6 +200,7 @@ dev_create_generic_dirs(lvm_t) fs_getattr_xattr_fs(lvm_t) fs_search_auto_mountpoints(lvm_t) +fs_list_tmpfs(lvm_t) fs_read_tmpfs_symlinks(lvm_t) fs_dontaudit_read_removable_files(lvm_t) diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te index aada013..9488900 100644 --- a/policy/modules/system/selinuxutil.te +++ b/policy/modules/system/selinuxutil.te @@ -1,8 +1,10 @@ -policy_module(selinuxutil,1.2.9) +policy_module(selinuxutil,1.2.10) -gen_require(` - bool secure_mode; +ifdef(`strict_policy',` + gen_require(` + bool secure_mode; + ') ') ######################################## @@ -104,6 +106,7 @@ domain_system_change_exemption(run_init_t) type semanage_t; domain_type(semanage_t) +domain_interactive_fd(semanage_t) type semanage_exec_t; domain_entry_file(semanage_t, semanage_exec_t) @@ -423,18 +426,17 @@ optional_policy(` allow restorecond_t self:capability { dac_override dac_read_search fowner }; allow restorecond_t self:fifo_file rw_file_perms; +allow restorecond_t self:netlink_route_socket r_netlink_socket_perms; allow restorecond_t restorecond_var_run_t:file create_file_perms; files_pid_filetrans(restorecond_t,restorecond_var_run_t, file) -auth_relabel_all_files_except_shadow(restorecond_t ) -auth_read_all_files_except_shadow(restorecond_t) -fs_relabelfrom_noxattr_fs(restorecond_t) - kernel_use_fds(restorecond_t) kernel_rw_pipes(restorecond_t) kernel_read_system_state(restorecond_t) +fs_relabelfrom_noxattr_fs(restorecond_t) +fs_dontaudit_list_nfs(restorecond_t) fs_getattr_xattr_fs(restorecond_t) fs_list_inotifyfs(restorecond_t) @@ -447,7 +449,11 @@ selinux_compute_user_contexts(restorecond_t) term_dontaudit_use_generic_ptys(restorecond_t) +auth_relabel_all_files_except_shadow(restorecond_t ) +auth_read_all_files_except_shadow(restorecond_t) + init_use_fds(restorecond_t) +init_dontaudit_use_script_ptys(restorecond_t) libs_use_ld_so(restorecond_t) libs_use_shared_libs(restorecond_t) @@ -456,6 +462,12 @@ logging_send_syslog_msg(restorecond_t) miscfiles_read_localization(restorecond_t) +optional_policy(` + # restorecond watches for users logging in, + # so it getspwnam when a user logs in to find his homedir + nis_use_ypbind(restorecond_t) +') + ################################# # # Run_init local policy @@ -538,6 +550,7 @@ allow semanage_t self:capability { dac_override audit_write }; allow semanage_t self:unix_stream_socket create_stream_socket_perms; allow semanage_t self:unix_dgram_socket create_socket_perms; allow semanage_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; +allow semanage_t self:netlink_route_socket r_netlink_socket_perms; allow semanage_t policy_config_t:file { read write }; @@ -567,10 +580,15 @@ selinux_set_boolean(semanage_t) term_use_all_terms(semanage_t) +# Running genhomedircon requires this for finding all users +auth_use_nsswitch(semanage_t) + libs_use_ld_so(semanage_t) libs_use_shared_libs(semanage_t) libs_use_lib_files(semanage_t) +locallogin_use_fds(semanage_t) + logging_send_syslog_msg(semanage_t) miscfiles_read_localization(semanage_t) @@ -590,7 +608,7 @@ seutil_get_semanage_read_lock(semanage_t) userdom_search_sysadm_home_dirs(semanage_t) ifdef(`targeted_policy',` -# Handle pp files created in homedir and /tmp + # Handle pp files created in homedir and /tmp files_read_generic_tmp_files(semanage_t) userdom_read_generic_user_home_content_files(semanage_t) ') diff --git a/policy/modules/system/setrans.te b/policy/modules/system/setrans.te index 4ef391e..41ae3d8 100644 --- a/policy/modules/system/setrans.te +++ b/policy/modules/system/setrans.te @@ -1,5 +1,5 @@ -policy_module(setrans,1.0.1) +policy_module(setrans,1.0.2) ######################################## # @@ -68,3 +68,7 @@ logging_send_syslog_msg(setrans_t) miscfiles_read_localization(setrans_t) seutil_read_config(setrans_t) + +optional_policy(` + rpm_use_script_fds(setrans_t) +') diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te index 2404432..fb01981 100644 --- a/policy/modules/system/sysnetwork.te +++ b/policy/modules/system/sysnetwork.te @@ -1,5 +1,5 @@ -policy_module(sysnetwork,1.1.8) +policy_module(sysnetwork,1.1.9) ######################################## # @@ -277,6 +277,7 @@ allow ifconfig_t self:udp_socket create_socket_perms; # for /sbin/ip allow ifconfig_t self:packet_socket create_socket_perms; allow ifconfig_t self:netlink_route_socket create_netlink_socket_perms; +allow ifconfig_t self:netlink_xfrm_socket { create_netlink_socket_perms nlmsg_read }; allow ifconfig_t self:tcp_socket { create ioctl }; files_read_etc_files(ifconfig_t); diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te index 06dec28..785bc3c 100644 --- a/policy/modules/system/udev.te +++ b/policy/modules/system/udev.te @@ -1,5 +1,5 @@ -policy_module(udev,1.3.3) +policy_module(udev,1.3.4) ######################################## # @@ -39,9 +39,9 @@ files_pid_file(udev_var_run_t) # Local policy # -allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin mknod net_raw net_admin sys_nice sys_rawio sys_resource setuid setgid sys_nice }; +allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin mknod net_raw net_admin sys_nice sys_rawio sys_resource setuid setgid sys_nice sys_ptrace }; dontaudit udev_t self:capability sys_tty_config; -allow udev_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; +allow udev_t self:process ~{ setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow udev_t self:process { execmem setfscreate }; allow udev_t self:fd use; allow udev_t self:fifo_file rw_file_perms; diff --git a/policy/modules/system/unconfined.fc b/policy/modules/system/unconfined.fc index d651278..37d3619 100644 --- a/policy/modules/system/unconfined.fc +++ b/policy/modules/system/unconfined.fc @@ -9,4 +9,5 @@ ifdef(`targeted_policy',` /usr/bin/valgrind -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) /usr/local/RealPlay/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) /usr/bin/mplayer -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) +/usr/bin/xine -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) ') diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if index ea38ab7..36d1bf3 100644 --- a/policy/modules/system/unconfined.if +++ b/policy/modules/system/unconfined.if @@ -52,9 +52,10 @@ interface(`unconfined_domain_noaudit',` allow $1 self:process execmem; ') - tunable_policy(`allow_execmem && allow_execstack',` - # Allow making the stack executable via mprotect. - allow $1 self:process execstack; + tunable_policy(`allow_execstack',` + # Allow making the stack executable via mprotect; + # execstack implies execmem; + allow $1 self:process { execstack execmem }; # auditallow $1 self:process execstack; ') diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te index 887ac68..790aa31 100644 --- a/policy/modules/system/unconfined.te +++ b/policy/modules/system/unconfined.te @@ -1,5 +1,5 @@ -policy_module(unconfined,1.3.12) +policy_module(unconfined,1.3.13) ######################################## # @@ -56,10 +56,6 @@ ifdef(`targeted_policy',` ') optional_policy(` - amanda_domtrans_recover(unconfined_t) - ') - - optional_policy(` apache_domtrans_helper(unconfined_t) ') @@ -72,6 +68,10 @@ ifdef(`targeted_policy',` ') optional_policy(` + bootloader_domtrans(unconfined_t) + ') + + optional_policy(` init_dbus_chat_script(unconfined_t) dbus_stub(unconfined_t) diff --git a/policy/modules/system/xen.te b/policy/modules/system/xen.te index 4f80cc0..720cfa7 100644 --- a/policy/modules/system/xen.te +++ b/policy/modules/system/xen.te @@ -1,5 +1,5 @@ -policy_module(xen,1.0.7) +policy_module(xen,1.0.8) ######################################## # @@ -171,7 +171,7 @@ xen_stream_connect_xenstore(xend_t) netutils_domtrans(xend_t) optional_policy(` - consoletype_domtrans(xend_t) + consoletype_exec(xend_t) ') ########################################