diff --git a/Changelog b/Changelog index 9408404..9de9e4a 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,5 @@ +- Several misc changes from the Fedora policy, cherry picked by David + Hrdeman. - Large whitespace fix from Dominick Grift. - Pam_mount fix for local login from Stefan Schulze Frielinghaus. - Issuing commands to upstart is over a datagram socket, not the initctl diff --git a/config/appconfig-mcs/unconfined_u_default_contexts b/config/appconfig-mcs/unconfined_u_default_contexts new file mode 100644 index 0000000..53b04ec --- /dev/null +++ b/config/appconfig-mcs/unconfined_u_default_contexts @@ -0,0 +1,9 @@ +system_r:crond_t:s0 unconfined_r:unconfined_t:s0 +system_r:initrc_t:s0 unconfined_r:unconfined_t:s0 +system_r:local_login_t:s0 unconfined_r:unconfined_t:s0 +system_r:remote_login_t:s0 unconfined_r:unconfined_t:s0 +system_r:rshd_t:s0 unconfined_r:unconfined_t:s0 +system_r:sshd_t:s0 unconfined_r:unconfined_t:s0 +system_r:sysadm_su_t:s0 unconfined_r:unconfined_t:s0 +system_r:unconfined_t:s0 unconfined_r:unconfined_t:s0 +system_r:xdm_t:s0 unconfined_r:unconfined_t:s0 diff --git a/config/appconfig-mls/unconfined_u_default_contexts b/config/appconfig-mls/unconfined_u_default_contexts new file mode 100644 index 0000000..53b04ec --- /dev/null +++ b/config/appconfig-mls/unconfined_u_default_contexts @@ -0,0 +1,9 @@ +system_r:crond_t:s0 unconfined_r:unconfined_t:s0 +system_r:initrc_t:s0 unconfined_r:unconfined_t:s0 +system_r:local_login_t:s0 unconfined_r:unconfined_t:s0 +system_r:remote_login_t:s0 unconfined_r:unconfined_t:s0 +system_r:rshd_t:s0 unconfined_r:unconfined_t:s0 +system_r:sshd_t:s0 unconfined_r:unconfined_t:s0 +system_r:sysadm_su_t:s0 unconfined_r:unconfined_t:s0 +system_r:unconfined_t:s0 unconfined_r:unconfined_t:s0 +system_r:xdm_t:s0 unconfined_r:unconfined_t:s0 diff --git a/config/appconfig-standard/unconfined_u_default_contexts b/config/appconfig-standard/unconfined_u_default_contexts new file mode 100644 index 0000000..1b26b60 --- /dev/null +++ b/config/appconfig-standard/unconfined_u_default_contexts @@ -0,0 +1,9 @@ +system_r:crond_t unconfined_r:unconfined_t +system_r:initrc_t unconfined_r:unconfined_t +system_r:local_login_t unconfined_r:unconfined_t +system_r:remote_login_t unconfined_r:unconfined_t +system_r:rshd_t unconfined_r:unconfined_t +system_r:sshd_t unconfined_r:unconfined_t +system_r:sysadm_su_t unconfined_r:unconfined_t +system_r:unconfined_t unconfined_r:unconfined_t +system_r:xdm_t unconfined_r:unconfined_t diff --git a/policy/modules/admin/kismet.te b/policy/modules/admin/kismet.te index 980bba6..57c94e8 100644 --- a/policy/modules/admin/kismet.te +++ b/policy/modules/admin/kismet.te @@ -1,5 +1,5 @@ -policy_module(kismet, 1.0.0) +policy_module(kismet, 1.0.1) ######################################## # @@ -26,6 +26,7 @@ logging_log_file(kismet_log_t) # allow kismet_t self:capability { net_admin setuid setgid }; +allow kismet_t self:packet_socket create_socket_perms; manage_files_pattern(kismet_t, kismet_log_t, kismet_log_t) allow kismet_t kismet_log_t:dir setattr; diff --git a/policy/modules/apps/slocate.te b/policy/modules/apps/slocate.te index f25fb97..7939fb6 100644 --- a/policy/modules/apps/slocate.te +++ b/policy/modules/apps/slocate.te @@ -1,5 +1,5 @@ -policy_module(slocate, 1.7.0) +policy_module(slocate, 1.7.1) ################################# # @@ -47,6 +47,7 @@ files_read_etc_files(locate_t) fs_getattr_all_fs(locate_t) fs_getattr_all_files(locate_t) fs_list_all(locate_t) +fs_list_inotifyfs(locate_t) # getpwnam auth_use_nsswitch(locate_t) diff --git a/policy/modules/roles/secadm.te b/policy/modules/roles/secadm.te index 1831961..665298d 100644 --- a/policy/modules/roles/secadm.te +++ b/policy/modules/roles/secadm.te @@ -1,5 +1,5 @@ -policy_module(secadm, 1.0.0) +policy_module(secadm, 1.0.1) ######################################## # @@ -48,6 +48,10 @@ optional_policy(` ') optional_policy(` + dmesg_exec(secadm_t) +') + +optional_policy(` netlabel_run_mgmt(secadm_t, secadm_r, { secadm_tty_device_t secadm_devpts_t }) ') diff --git a/policy/modules/services/apm.te b/policy/modules/services/apm.te index b408f87..8f8efff 100644 --- a/policy/modules/services/apm.te +++ b/policy/modules/services/apm.te @@ -1,5 +1,5 @@ -policy_module(apm, 1.7.0) +policy_module(apm, 1.7.1) ######################################## # @@ -191,6 +191,10 @@ optional_policy(` dbus_stub(apmd_t) optional_policy(` + consolekit_dbus_chat(apmd_t) + ') + + optional_policy(` networkmanager_dbus_chat(apmd_t) ') ') diff --git a/policy/modules/services/openca.te b/policy/modules/services/openca.te index a097200..0d76e60 100644 --- a/policy/modules/services/openca.te +++ b/policy/modules/services/openca.te @@ -1,5 +1,5 @@ -policy_module(openca, 1.1.0) +policy_module(openca, 1.1.1) ######################################## # @@ -18,7 +18,7 @@ role system_r types openca_ca_t; # /etc/openca standard files type openca_etc_t; -files_type(openca_etc_t) +files_config_file(openca_etc_t) # /etc/openca template files type openca_etc_in_t; diff --git a/policy/modules/services/portslave.te b/policy/modules/services/portslave.te index 8b6eb55..5623b6c 100644 --- a/policy/modules/services/portslave.te +++ b/policy/modules/services/portslave.te @@ -1,5 +1,5 @@ -policy_module(portslave, 1.4.0) +policy_module(portslave, 1.4.1) ######################################## # @@ -12,7 +12,7 @@ init_domain(portslave_t, portslave_exec_t) init_daemon_domain(portslave_t, portslave_exec_t) type portslave_etc_t; -files_type(portslave_etc_t) +files_config_file(portslave_etc_t) type portslave_lock_t; files_lock_file(portslave_lock_t)