diff --git a/policy-20071130.patch b/policy-20071130.patch index d7307fb..b963760 100644 --- a/policy-20071130.patch +++ b/policy-20071130.patch @@ -957,7 +957,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400 -+++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2008-01-08 08:11:14.000000000 -0500 ++++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2008-01-11 15:53:03.000000000 -0500 @@ -152,6 +152,24 @@ ######################################## @@ -1180,7 +1180,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if + +######################################## +## -+## Transition to system_r when execute an init script ++## Transition to system_r when execute an rpm script +## +## +##

@@ -2702,7 +2702,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc +/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.2.5/policy/modules/apps/java.if --- nsaserefpolicy/policy/modules/apps/java.if 2007-10-12 08:56:02.000000000 -0400 -+++ serefpolicy-3.2.5/policy/modules/apps/java.if 2007-12-22 07:16:08.000000000 -0500 ++++ serefpolicy-3.2.5/policy/modules/apps/java.if 2008-01-13 08:11:05.000000000 -0500 @@ -32,7 +32,7 @@ ## ## @@ -2712,23 +2712,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if gen_require(` type java_exec_t; ') -@@ -57,7 +57,7 @@ +@@ -57,14 +57,16 @@ # Local policy # - allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem }; -+ allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem execstack }; ++ allow $1_javaplugin_t self:process { execmem execstack signal_perms getsched ptrace setsched }; allow $1_javaplugin_t self:fifo_file rw_fifo_file_perms; - allow $1_javaplugin_t self:tcp_socket create_socket_perms; +- allow $1_javaplugin_t self:tcp_socket create_socket_perms; ++ allow $1_javaplugin_t self:tcp_socket create_stream_socket_perms; allow $1_javaplugin_t self:udp_socket create_socket_perms; -@@ -76,13 +76,10 @@ + ++ allow $1_javaplugin_t $1_t:process signull; ++ allow $1_javaplugin_t $1_t:unix_stream_socket connectto; ++ allow $1_t $1_javaplugin_t:unix_stream_socket connectto; + allow $1_javaplugin_t $2:unix_stream_socket connectto; + allow $1_javaplugin_t $2:unix_stream_socket { read write }; +- userdom_write_user_tmp_sockets($1,$1_javaplugin_t) + + manage_dirs_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t) + manage_files_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t) +@@ -76,13 +78,9 @@ manage_sock_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t) fs_tmpfs_filetrans($1_javaplugin_t,$1_javaplugin_tmpfs_t,{ file lnk_file sock_file fifo_file }) - rw_files_pattern($1_javaplugin_t,$1_home_t,$1_home_t) - read_files_pattern($1_javaplugin_t,$1_home_t,$1_home_t) - -+ userdom_manage_unpriv_users_home_content_files($1_javaplugin_t) can_exec($1_javaplugin_t, java_exec_t) - # The user role is authorized for this domain. @@ -2737,11 +2747,65 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if allow $1_javaplugin_t $2:fd use; # Unrestricted inheritance from the caller. allow $2 $1_javaplugin_t:process { noatsecure siginh rlimitinh }; -@@ -166,6 +163,62 @@ +@@ -94,7 +92,7 @@ + kernel_read_system_state($1_javaplugin_t) + + # Search bin directory under javaplugin for javaplugin executable +- corecmd_search_bin($1_javaplugin_t) ++ corecmd_exec_bin($1_javaplugin_t) + + corenet_all_recvfrom_unlabeled($1_javaplugin_t) + corenet_all_recvfrom_netlabel($1_javaplugin_t) +@@ -107,10 +105,12 @@ + corenet_tcp_connect_all_ports($1_javaplugin_t) + corenet_sendrecv_all_client_packets($1_javaplugin_t) + ++ dev_list_sysfs($1_javaplugin_t) + dev_read_sound($1_javaplugin_t) + dev_write_sound($1_javaplugin_t) + dev_read_urand($1_javaplugin_t) + dev_read_rand($1_javaplugin_t) ++ dev_write_rand($1_javaplugin_t) + + files_read_etc_files($1_javaplugin_t) + files_read_usr_files($1_javaplugin_t) +@@ -122,6 +122,9 @@ + + fs_getattr_xattr_fs($1_javaplugin_t) + fs_dontaudit_rw_tmpfs_files($1_javaplugin_t) ++ fs_getattr_tmpfs($1_javaplugin_t) ++ ++ auth_use_nsswitch($1_javaplugin_t) + + libs_use_ld_so($1_javaplugin_t) + libs_use_shared_libs($1_javaplugin_t) +@@ -132,11 +135,14 @@ + # Read global fonts and font config + miscfiles_read_fonts($1_javaplugin_t) + +- sysnet_read_config($1_javaplugin_t) +- ++ userdom_manage_unpriv_users_home_content_files($1_javaplugin_t) + userdom_dontaudit_use_user_terminals($1,$1_javaplugin_t) + userdom_dontaudit_setattr_user_home_content_files($1,$1_javaplugin_t) + userdom_dontaudit_exec_user_home_content_files($1,$1_javaplugin_t) ++ userdom_manage_user_tmp_dirs($1,$1_javaplugin_t) ++ userdom_manage_user_tmp_files($1,$1_javaplugin_t) ++ userdom_manage_user_tmp_sockets($1,$1_javaplugin_t) ++ userdom_read_user_tmpfs_files($1,$1_javaplugin_t) + userdom_manage_user_home_content_dirs($1,$1_javaplugin_t) + userdom_manage_user_home_content_files($1,$1_javaplugin_t) + userdom_manage_user_home_content_symlinks($1,$1_javaplugin_t) +@@ -156,15 +162,63 @@ + ') + optional_policy(` - xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t) +- nis_use_ypbind($1_javaplugin_t) ++ xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t) ') -+ + +- optional_policy(` +- nscd_socket_use($1_javaplugin_t) +') + +####################################### @@ -2774,8 +2838,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if +template(`java_per_role_template',` + gen_require(` + type java_exec_t; -+ ') -+ + ') + + type $1_java_t; + domain_type($1_java_t) + domain_entry_file($1_java_t,java_exec_t) @@ -2794,13 +2858,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if + + fs_dontaudit_rw_tmpfs_files($1_java_t) + -+ optional_policy(` + optional_policy(` +- xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t) + xserver_xdm_rw_shm($1_java_t) -+ ') + ') ') - ######################################## -@@ -219,3 +272,67 @@ +@@ -219,3 +273,67 @@ corecmd_search_bin($1) domtrans_pattern($1, java_exec_t, java_t) ') @@ -3073,7 +3137,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. # /bin diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.2.5/policy/modules/apps/mozilla.if --- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-29 07:52:48.000000000 -0400 -+++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2008-01-11 13:41:19.000000000 -0500 ++++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2008-01-13 08:06:37.000000000 -0500 @@ -35,7 +35,10 @@ template(`mozilla_per_role_template',` gen_require(` @@ -4929,6 +4993,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ') ######################################## +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.2.5/policy/modules/kernel/kernel.te +--- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-12-19 05:32:07.000000000 -0500 ++++ serefpolicy-3.2.5/policy/modules/kernel/kernel.te 2008-01-11 15:13:01.000000000 -0500 +@@ -363,7 +363,7 @@ + + allow kern_unconfined proc_type:{ dir file lnk_file } *; + +-allow kern_unconfined sysctl_t:{ dir file } *; ++allow kern_unconfined sysctl_type:{ dir file } *; + + allow kern_unconfined kernel_t:system *; + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.2.5/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-11-16 13:45:14.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/kernel/selinux.if 2007-12-19 05:38:09.000000000 -0500 @@ -16194,7 +16270,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.2.5/policy/modules/system/sysnetwork.if --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-16 14:09:49.000000000 -0400 -+++ serefpolicy-3.2.5/policy/modules/system/sysnetwork.if 2007-12-19 05:38:09.000000000 -0500 ++++ serefpolicy-3.2.5/policy/modules/system/sysnetwork.if 2008-01-11 15:56:47.000000000 -0500 @@ -145,6 +145,25 @@ ######################################## @@ -16241,7 +16317,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet ') ######################################## -@@ -556,3 +581,23 @@ +@@ -556,3 +581,49 @@ files_search_etc($1) allow $1 net_conf_t:file read_file_perms; ') @@ -16265,6 +16341,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet + dontaudit $1 dhcpc_t:fd use; +') + ++######################################## ++##

++## Transition to system_r when execute an dhclient script ++## ++## ++##

++## Execute dhclient script in a specified role ++##

++##

++## No interprocess communication (signals, pipes, ++## etc.) is provided by this interface since ++## the domains are not owned by this module. ++##

++## ++## ++## ++## Role to transition from. ++## ++## ++interface(`sysnet_role_transition_dhcpc',` ++ gen_require(` ++ type dhclient_exec_t; ++ ') ++ ++ role_transition $1 dhcpc_exec_t system_r; ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.2.5/policy/modules/system/sysnetwork.te --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-12-19 05:32:17.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/system/sysnetwork.te 2007-12-19 05:38:09.000000000 -0500 @@ -16703,8 +16805,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.2.5/policy/modules/system/unconfined.te --- nsaserefpolicy/policy/modules/system/unconfined.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.2.5/policy/modules/system/unconfined.te 2007-12-20 09:13:54.000000000 -0500 -@@ -9,32 +9,49 @@ ++++ serefpolicy-3.2.5/policy/modules/system/unconfined.te 2008-01-11 15:57:35.000000000 -0500 +@@ -9,32 +9,48 @@ # usage in this module of types created by these # calls is not correct, however we dont currently # have another method to add access to these types @@ -16723,7 +16825,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf +allow system_r unconfined_r; +allow unconfined_r system_r; +init_script_role_transition(unconfined_r) -+rpm_role_transition(unconfined_r) type unconfined_execmem_t; type unconfined_execmem_exec_t; @@ -16758,7 +16859,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf libs_run_ldconfig(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) -@@ -42,7 +59,10 @@ +@@ -42,7 +58,10 @@ logging_run_auditctl(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) mount_run_unconfined(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) @@ -16769,7 +16870,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf seutil_run_setfiles(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) seutil_run_semanage(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) -@@ -51,13 +71,13 @@ +@@ -51,13 +70,13 @@ userdom_priveleged_home_dir_manager(unconfined_t) optional_policy(` @@ -16785,7 +16886,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf unconfined_domain(httpd_unconfined_script_t) ') -@@ -69,11 +89,11 @@ +@@ -69,11 +88,11 @@ bootloader_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) ') @@ -16802,7 +16903,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf optional_policy(` init_dbus_chat_script(unconfined_t) -@@ -107,6 +127,10 @@ +@@ -107,6 +126,10 @@ optional_policy(` oddjob_dbus_chat(unconfined_t) ') @@ -16813,7 +16914,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -118,11 +142,7 @@ +@@ -118,11 +141,7 @@ ') optional_policy(` @@ -16826,7 +16927,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -134,14 +154,6 @@ +@@ -134,14 +153,6 @@ ') optional_policy(` @@ -16841,7 +16942,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf oddjob_domtrans_mkhomedir(unconfined_t) ') -@@ -154,33 +166,20 @@ +@@ -154,38 +165,27 @@ ') optional_policy(` @@ -16864,6 +16965,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf rpm_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) + # Allow SELinux aware applications to request rpm_script execution + rpm_transition_script(unconfined_t) ++ rpm_role_transition(unconfined_r) ') optional_policy(` @@ -16879,7 +16981,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -205,11 +204,30 @@ + sysnet_run_dhcpc(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) + sysnet_dbus_chat_dhcpc(unconfined_t) ++ sysnet_role_transition_dhcpc(unconfined_r) + ') + + optional_policy(` +@@ -205,11 +205,30 @@ ') optional_policy(` @@ -16912,7 +17020,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') ######################################## -@@ -219,14 +237,32 @@ +@@ -219,14 +238,32 @@ allow unconfined_execmem_t self:process { execstack execmem }; unconfined_domain_noaudit(unconfined_execmem_t) @@ -20121,8 +20229,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest. +## Policy for xguest user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.te serefpolicy-3.2.5/policy/modules/users/xguest.te --- nsaserefpolicy/policy/modules/users/xguest.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.2.5/policy/modules/users/xguest.te 2007-12-19 16:36:37.000000000 -0500 -@@ -0,0 +1,66 @@ ++++ serefpolicy-3.2.5/policy/modules/users/xguest.te 2008-01-13 08:07:34.000000000 -0500 +@@ -0,0 +1,71 @@ +policy_module(xguest,1.0.1) + +## @@ -20149,7 +20257,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest. +userdom_restricted_xwindows_user_template(xguest) + +optional_policy(` ++ gen_require(` ++ type xguest_mozilla_t; ++ ') + mozilla_per_role_template(xguest, xguest_t, xguest_r) ++ dbus_user_bus_client_template(xguest,xguest_mozilla,xguest_mozilla_t) ++ dbus_connectto_user_bus(xguest,xguest_mozilla_t) +') + +optional_policy(`