diff --git a/modules-minimum.conf b/modules-minimum.conf index 09561ad..94c79ba 100644 --- a/modules-minimum.conf +++ b/modules-minimum.conf @@ -233,6 +233,13 @@ certwatch = module certmaster = module # Layer: services +# Module: certmonger +# +# Certificate status monitor and PKI enrollment client +# +certmonger = module + +# Layer: services # Module: cipe # # Encrypted tunnel daemon @@ -1555,6 +1562,13 @@ sysstat = module # tcpd = module +# Layer: services +# Module: tgtd +# +# Linux Target Framework Daemon. +# +tgtd = module + # Layer: system # Module: udev # @@ -1579,7 +1593,7 @@ unconfined = module # Layer: services # Module: ulogd # -# +# netfilter/iptables ULOG daemon # ulogd = module diff --git a/modules-mls.conf b/modules-mls.conf index 39f3cb8..9eaf94a 100644 --- a/modules-mls.conf +++ b/modules-mls.conf @@ -1372,6 +1372,13 @@ sysstat = module # tcpd = module +# Layer: services +# Module: tgtd +# +# Linux Target Framework Daemon. +# +tgtd = module + # Layer: system # Module: udev # diff --git a/modules-targeted.conf b/modules-targeted.conf index 09561ad..94c79ba 100644 --- a/modules-targeted.conf +++ b/modules-targeted.conf @@ -233,6 +233,13 @@ certwatch = module certmaster = module # Layer: services +# Module: certmonger +# +# Certificate status monitor and PKI enrollment client +# +certmonger = module + +# Layer: services # Module: cipe # # Encrypted tunnel daemon @@ -1555,6 +1562,13 @@ sysstat = module # tcpd = module +# Layer: services +# Module: tgtd +# +# Linux Target Framework Daemon. +# +tgtd = module + # Layer: system # Module: udev # @@ -1579,7 +1593,7 @@ unconfined = module # Layer: services # Module: ulogd # -# +# netfilter/iptables ULOG daemon # ulogd = module diff --git a/policy-F13.patch b/policy-F13.patch index 9c32780..1b5ca1c 100644 --- a/policy-F13.patch +++ b/policy-F13.patch @@ -1789,7 +1789,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ######################################## diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.7.4/policy/modules/admin/tmpreaper.te --- nsaserefpolicy/policy/modules/admin/tmpreaper.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/admin/tmpreaper.te 2009-12-04 12:33:34.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/admin/tmpreaper.te 2009-12-11 15:00:25.000000000 -0500 @@ -42,6 +42,7 @@ cron_system_entry(tmpreaper_t, tmpreaper_exec_t) @@ -1798,11 +1798,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol userdom_delete_user_home_content_dirs(tmpreaper_t) userdom_delete_user_home_content_files(tmpreaper_t) userdom_delete_user_home_content_symlinks(tmpreaper_t) -@@ -52,6 +53,11 @@ +@@ -52,6 +53,12 @@ ') optional_policy(` + apache_delete_sys_content_rw(tmpreaper_t) ++ apache_list_cache(tmpreaper_t) + apache_delete_cache(tmpreaper_t) +') + @@ -1810,7 +1811,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kismet_manage_log(tmpreaper_t) ') -@@ -60,5 +66,9 @@ +@@ -60,5 +67,9 @@ ') optional_policy(` @@ -3562,7 +3563,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.7.4/policy/modules/apps/mozilla.te --- nsaserefpolicy/policy/modules/apps/mozilla.te 2009-12-04 09:43:33.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/apps/mozilla.te 2009-12-10 15:39:39.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/apps/mozilla.te 2009-12-11 09:38:55.000000000 -0500 @@ -91,6 +91,7 @@ corenet_raw_sendrecv_generic_node(mozilla_t) corenet_tcp_sendrecv_http_port(mozilla_t) @@ -6142,7 +6143,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol #network_node(multicast, s0 - mls_systemhigh, ff00::, ff00::) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.7.4/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2009-11-20 10:51:41.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/kernel/devices.if 2009-12-10 14:19:30.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/kernel/devices.if 2009-12-11 14:54:55.000000000 -0500 @@ -783,6 +783,24 @@ ######################################## @@ -7067,8 +7068,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.7.4/policy/modules/kernel/files.te --- nsaserefpolicy/policy/modules/kernel/files.te 2009-11-25 11:47:19.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/kernel/files.te 2009-12-04 12:33:34.000000000 -0500 -@@ -43,6 +43,7 @@ ++++ serefpolicy-3.7.4/policy/modules/kernel/files.te 2009-12-11 09:33:22.000000000 -0500 +@@ -12,6 +12,7 @@ + attribute mountpoint; + attribute pidfile; + attribute configfile; ++attribute etcfile; + + # For labeling types that are to be polyinstantiated + attribute polydir; +@@ -43,6 +44,7 @@ # type boot_t; files_mountpoint(boot_t) @@ -7076,7 +7085,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # default_t is the default type for files that do not # match any specification in the file_contexts configuration -@@ -194,6 +195,7 @@ +@@ -194,6 +196,7 @@ fs_associate_noxattr(file_type) fs_associate_tmpfs(file_type) fs_associate_ramfs(file_type) @@ -7757,7 +7766,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.te serefpolicy-3.7.4/policy/modules/roles/sysadm.te --- nsaserefpolicy/policy/modules/roles/sysadm.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/roles/sysadm.te 2009-12-09 08:29:51.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/roles/sysadm.te 2009-12-11 15:18:11.000000000 -0500 @@ -15,7 +15,7 @@ role sysadm_r; @@ -7800,7 +7809,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol backup_run(sysadm_t, sysadm_r) ') -@@ -99,18 +97,10 @@ +@@ -99,15 +97,11 @@ ') optional_policy(` @@ -7813,13 +7822,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` - cdrecord_role(sysadm_r, sysadm_t) --') -- --optional_policy(` - certwatch_run(sysadm_t, sysadm_r) ++ certmonger_dbus_chat(sysadm_t) ') -@@ -127,7 +117,7 @@ + optional_policy(` +@@ -127,7 +121,7 @@ ') optional_policy(` @@ -7828,7 +7835,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -135,10 +125,6 @@ +@@ -135,10 +129,6 @@ ') optional_policy(` @@ -7839,7 +7846,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol dcc_run_cdcc(sysadm_t, sysadm_r) dcc_run_client(sysadm_t, sysadm_r) dcc_run_dbclean(sysadm_t, sysadm_r) -@@ -166,10 +152,6 @@ +@@ -166,10 +156,6 @@ ') optional_policy(` @@ -7850,7 +7857,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol firstboot_run(sysadm_t, sysadm_r) ') -@@ -178,22 +160,6 @@ +@@ -178,22 +164,6 @@ ') optional_policy(` @@ -7873,7 +7880,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol hostname_run(sysadm_t, sysadm_r) ') -@@ -205,6 +171,9 @@ +@@ -205,6 +175,9 @@ ipsec_stream_connect(sysadm_t) # for lsof ipsec_getattr_key_sockets(sysadm_t) @@ -7883,7 +7890,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -212,11 +181,7 @@ +@@ -212,11 +185,7 @@ ') optional_policy(` @@ -7896,7 +7903,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -228,10 +193,6 @@ +@@ -228,10 +197,6 @@ ') optional_policy(` @@ -7907,7 +7914,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol logrotate_run(sysadm_t, sysadm_r) ') -@@ -255,14 +216,6 @@ +@@ -255,14 +220,6 @@ ') optional_policy(` @@ -7922,7 +7929,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol mta_role(sysadm_r, sysadm_t) ') -@@ -290,11 +243,6 @@ +@@ -290,11 +247,6 @@ ') optional_policy(` @@ -7934,7 +7941,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol pcmcia_run_cardctl(sysadm_t, sysadm_r) ') -@@ -308,7 +256,7 @@ +@@ -308,7 +260,7 @@ ') optional_policy(` @@ -7943,7 +7950,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -320,10 +268,6 @@ +@@ -320,10 +272,6 @@ ') optional_policy(` @@ -7954,7 +7961,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol rpc_domtrans_nfsd(sysadm_t) ') -@@ -332,10 +276,6 @@ +@@ -332,10 +280,6 @@ ') optional_policy(` @@ -7965,7 +7972,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol rsync_exec(sysadm_t) ') -@@ -345,10 +285,6 @@ +@@ -345,10 +289,6 @@ ') optional_policy(` @@ -7976,7 +7983,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol secadm_role_change(sysadm_r) ') -@@ -358,35 +294,15 @@ +@@ -358,35 +298,15 @@ ') optional_policy(` @@ -8012,7 +8019,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol tripwire_run_siggen(sysadm_t, sysadm_r) tripwire_run_tripwire(sysadm_t, sysadm_r) tripwire_run_twadmin(sysadm_t, sysadm_r) -@@ -394,18 +310,10 @@ +@@ -394,18 +314,10 @@ ') optional_policy(` @@ -8031,7 +8038,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol unconfined_domtrans(sysadm_t) ') -@@ -418,17 +326,13 @@ +@@ -418,17 +330,13 @@ ') optional_policy(` @@ -8050,7 +8057,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -440,13 +343,16 @@ +@@ -440,13 +347,16 @@ ') optional_policy(` @@ -8084,7 +8091,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.if serefpolicy-3.7.4/policy/modules/roles/unconfineduser.if --- nsaserefpolicy/policy/modules/roles/unconfineduser.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/roles/unconfineduser.if 2009-12-04 12:33:34.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/roles/unconfineduser.if 2009-12-11 11:30:20.000000000 -0500 @@ -0,0 +1,667 @@ +## Unconfiend user role + @@ -9634,7 +9641,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## All of the rules required to administrate diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.te serefpolicy-3.7.4/policy/modules/services/abrt.te --- nsaserefpolicy/policy/modules/services/abrt.te 2009-09-16 09:09:20.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/services/abrt.te 2009-12-10 13:04:52.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/abrt.te 2009-12-11 11:26:03.000000000 -0500 @@ -33,12 +33,25 @@ type abrt_var_run_t; files_pid_file(abrt_var_run_t) @@ -10225,7 +10232,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.7.4/policy/modules/services/apache.if --- nsaserefpolicy/policy/modules/services/apache.if 2009-07-28 15:51:13.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/services/apache.if 2009-12-04 12:33:34.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/apache.if 2009-12-11 15:00:30.000000000 -0500 @@ -13,21 +13,16 @@ # template(`apache_content_template',` @@ -10548,10 +10555,29 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## TCP sockets. ## ## -@@ -503,6 +462,67 @@ +@@ -503,6 +462,86 @@ ######################################## ## ++## Allow the specified domain to list ++## Apache cache. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`apache_list_cache',` ++ gen_require(` ++ type httpd_cache_t; ++ ') ++ ++ list_dirs_pattern($1, httpd_cache_t, httpd_cache_t) ++') ++ ++######################################## ++## +## Allow the specified domain to delete +## Apache cache. +## @@ -10616,7 +10642,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## Allow the specified domain to read ## apache configuration files. ## -@@ -579,7 +599,7 @@ +@@ -579,7 +618,7 @@ ## ## ## @@ -10625,7 +10651,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## ## ## -@@ -715,6 +735,7 @@ +@@ -715,6 +754,7 @@ ') allow $1 httpd_modules_t:dir list_dir_perms; @@ -10633,7 +10659,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -782,6 +803,32 @@ +@@ -782,6 +822,32 @@ ######################################## ## @@ -10666,7 +10692,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## Execute all web scripts in the system ## script domain. ## -@@ -791,16 +838,18 @@ +@@ -791,16 +857,18 @@ ## ## # @@ -10689,7 +10715,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ') -@@ -859,6 +908,8 @@ +@@ -859,6 +927,8 @@ ## ## # @@ -10698,7 +10724,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol interface(`apache_run_all_scripts',` gen_require(` attribute httpd_exec_scripts, httpd_script_domains; -@@ -884,7 +935,7 @@ +@@ -884,7 +954,7 @@ type httpd_squirrelmail_t; ') @@ -10707,7 +10733,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1043,6 +1094,44 @@ +@@ -1043,6 +1113,44 @@ ######################################## ## @@ -10752,7 +10778,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## All of the rules required to administrate an apache environment ## ## -@@ -1072,11 +1161,17 @@ +@@ -1072,11 +1180,17 @@ type httpd_modules_t, httpd_lock_t; type httpd_var_run_t, httpd_php_tmp_t; type httpd_suexec_tmp_t, httpd_tmp_t; @@ -10770,7 +10796,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol apache_manage_all_content($1) miscfiles_manage_public_files($1) -@@ -1096,12 +1191,57 @@ +@@ -1096,12 +1210,57 @@ kernel_search_proc($1) allow $1 httpd_t:dir list_dir_perms; @@ -12003,7 +12029,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## All of the rules required to administrate diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.7.4/policy/modules/services/bluetooth.te --- nsaserefpolicy/policy/modules/services/bluetooth.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/services/bluetooth.te 2009-12-04 12:33:34.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/bluetooth.te 2009-12-11 14:46:18.000000000 -0500 @@ -54,9 +54,9 @@ # Bluetooth services local policy # @@ -12174,6 +12200,315 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow certmaster_t self:tcp_socket create_stream_socket_perms; # config files +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.fc serefpolicy-3.7.4/policy/modules/services/certmonger.fc +--- nsaserefpolicy/policy/modules/services/certmonger.fc 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/certmonger.fc 2009-12-11 14:28:45.000000000 -0500 +@@ -0,0 +1,6 @@ ++/etc/rc\.d/init\.d/certmonger -- gen_context(system_u:object_r:certmonger_initrc_exec_t,s0) ++ ++/usr/sbin/certmonger -- gen_context(system_u:object_r:certmonger_exec_t,s0) ++ ++/var/run/certmonger.pid -- gen_context(system_u:object_r:certmonger_var_run_t,s0) ++/var/lib/certmonger(/.*)? gen_context(system_u:object_r:certmonger_var_lib_t,s0) +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.if serefpolicy-3.7.4/policy/modules/services/certmonger.if +--- nsaserefpolicy/policy/modules/services/certmonger.if 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/certmonger.if 2009-12-11 14:32:30.000000000 -0500 +@@ -0,0 +1,217 @@ ++ ++## Certificate status monitor and PKI enrollment client ++ ++######################################## ++## ++## Execute a domain transition to run certmonger. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`certmonger_domtrans',` ++ gen_require(` ++ type certmonger_t, certmonger_exec_t; ++ ') ++ ++ domtrans_pattern($1, certmonger_exec_t, certmonger_t) ++') ++ ++ ++######################################## ++## ++## Execute certmonger server in the certmonger domain. ++## ++## ++## ++## The type of the process performing this action. ++## ++## ++# ++interface(`certmonger_initrc_domtrans',` ++ gen_require(` ++ type certmonger_initrc_exec_t; ++ ') ++ ++ init_labeled_script_domtrans($1, certmonger_initrc_exec_t) ++') ++ ++######################################## ++## ++## Read certmonger PID files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`certmonger_read_pid_files',` ++ gen_require(` ++ type certmonger_var_run_t; ++ ') ++ ++ files_search_pids($1) ++ allow $1 certmonger_var_run_t:file read_file_perms; ++') ++ ++######################################## ++## ++## Manage certmonger var_run files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`certmonger_manage_var_run',` ++ gen_require(` ++ type certmonger_var_run_t; ++ ') ++ ++ manage_dirs_pattern($1, certmonger_var_run_t, certmonger_var_run_t) ++ manage_files_pattern($1, certmonger_var_run_t, certmonger_var_run_t) ++ manage_lnk_files_pattern($1, certmonger_var_run_t, certmonger_var_run_t) ++') ++ ++ ++######################################## ++## ++## Search certmonger lib directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`certmonger_search_lib',` ++ gen_require(` ++ type certmonger_var_lib_t; ++ ') ++ ++ allow $1 certmonger_var_lib_t:dir search_dir_perms; ++ files_search_var_lib($1) ++') ++ ++######################################## ++## ++## Read certmonger lib files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`certmonger_read_lib_files',` ++ gen_require(` ++ type certmonger_var_lib_t; ++ ') ++ ++ files_search_var_lib($1) ++ read_files_pattern($1, certmonger_var_lib_t, certmonger_var_lib_t) ++') ++ ++######################################## ++## ++## Create, read, write, and delete ++## certmonger lib files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`certmonger_manage_lib_files',` ++ gen_require(` ++ type certmonger_var_lib_t; ++ ') ++ ++ files_search_var_lib($1) ++ manage_files_pattern($1, certmonger_var_lib_t, certmonger_var_lib_t) ++') ++ ++######################################## ++## ++## Manage certmonger var_lib files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`certmonger_manage_var_lib',` ++ gen_require(` ++ type certmonger_var_lib_t; ++ ') ++ ++ manage_dirs_pattern($1, certmonger_var_lib_t, certmonger_var_lib_t) ++ manage_files_pattern($1, certmonger_var_lib_t, certmonger_var_lib_t) ++ manage_lnk_files_pattern($1, certmonger_var_lib_t, certmonger_var_lib_t) ++') ++ ++ ++######################################## ++## ++## Send and receive messages from ++## certmonger over dbus. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`certmonger_dbus_chat',` ++ gen_require(` ++ type certmonger_t; ++ class dbus send_msg; ++ ') ++ ++ allow $1 certmonger_t:dbus send_msg; ++ allow certmonger_t $1:dbus send_msg; ++') ++ ++######################################## ++## ++## All of the rules required to administrate ++## an certmonger environment ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++## ++## Role allowed access. ++## ++## ++## ++# ++interface(`certmonger_admin',` ++ gen_require(` ++ type certmonger_t, certmonger_initrc_exec_t; ++ ') ++ ++ allow $1 certmonger_t:process { ptrace signal_perms getattr }; ++ read_files_pattern($1, certmonger_t, certmonger_t) ++ ++ # Allow certmonger_t to restart the apache service ++ certmonger_initrc_domtrans($1) ++ domain_system_change_exemption($1) ++ role_transition $2 certmonger_initrc_exec_t system_r; ++ allow $2 system_r; ++ ++ files_search_var_lib($1) ++ admin_pattern($1, cermonger_var_lib_t) ++ ++ files_search_pids($1) ++ admin_pattern($1, cermonger_var_run_t) ++') +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmonger.te serefpolicy-3.7.4/policy/modules/services/certmonger.te +--- nsaserefpolicy/policy/modules/services/certmonger.te 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/certmonger.te 2009-12-11 14:28:19.000000000 -0500 +@@ -0,0 +1,74 @@ ++policy_module(certmonger,1.0.0) ++ ++######################################## ++# ++# Declarations ++# ++ ++type certmonger_t; ++type certmonger_exec_t; ++init_daemon_domain(certmonger_t, certmonger_exec_t) ++ ++permissive certmonger_t; ++ ++type certmonger_initrc_exec_t; ++init_script_file(certmonger_initrc_exec_t) ++ ++type certmonger_var_run_t; ++files_pid_file(certmonger_var_run_t) ++ ++type certmonger_var_lib_t; ++files_type(certmonger_var_lib_t) ++ ++######################################## ++# ++# certmonger local policy ++# ++ ++allow certmonger_t self:capability { kill sys_nice }; ++allow certmonger_t self:process { fork getsched setsched sigkill }; ++allow certmonger_t self:fifo_file rw_file_perms; ++allow certmonger_t self:unix_stream_socket create_stream_socket_perms; ++allow certmonger_t self:tcp_socket create_stream_socket_perms; ++allow certmonger_t self:netlink_route_socket r_netlink_socket_perms; ++ ++manage_dirs_pattern(certmonger_t, certmonger_var_run_t, certmonger_var_run_t) ++manage_files_pattern(certmonger_t, certmonger_var_run_t, certmonger_var_run_t) ++files_pid_filetrans(certmonger_t, certmonger_var_run_t, { file dir }) ++ ++manage_dirs_pattern(certmonger_t, certmonger_var_lib_t, certmonger_var_lib_t) ++manage_files_pattern(certmonger_t, certmonger_var_lib_t, certmonger_var_lib_t) ++files_var_lib_filetrans(certmonger_t, certmonger_var_lib_t, { file dir } ) ++ ++domain_use_interactive_fds(certmonger_t) ++ ++corenet_tcp_sendrecv_generic_if(certmonger_t) ++corenet_tcp_sendrecv_generic_node(certmonger_t) ++corenet_tcp_sendrecv_all_ports(certmonger_t) ++corenet_tcp_connect_certmaster_port(certmonger_t) ++ ++dev_read_urand(certmonger_t) ++ ++files_read_etc_files(certmonger_t) ++files_read_usr_files(certmonger_t) ++files_list_tmp(certmonger_t) ++ ++miscfiles_read_localization(certmonger_t) ++miscfiles_manage_cert_files(certmonger_t) ++ ++logging_send_syslog_msg(certmonger_t) ++ ++sysnet_dns_name_resolve(certmonger_t) ++ ++optional_policy(` ++ dbus_system_bus_client(certmonger_t) ++ dbus_connect_system_bus(certmonger_t) ++') ++ ++optional_policy(` ++ kerberos_use(certmonger_t) ++') ++ ++optional_policy(` ++ unconfined_dbus_send(certmonger_t) ++') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/chronyd.fc serefpolicy-3.7.4/policy/modules/services/chronyd.fc --- nsaserefpolicy/policy/modules/services/chronyd.fc 1969-12-31 19:00:00.000000000 -0500 +++ serefpolicy-3.7.4/policy/modules/services/chronyd.fc 2009-12-04 12:33:34.000000000 -0500 @@ -24440,7 +24775,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.7.4/policy/modules/services/virt.te --- nsaserefpolicy/policy/modules/services/virt.te 2009-11-17 10:54:26.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/services/virt.te 2009-12-04 12:33:34.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/virt.te 2009-12-11 14:52:36.000000000 -0500 @@ -20,6 +20,28 @@ ## gen_tunable(virt_use_samba, false) @@ -24486,7 +24821,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol type virt_log_t; logging_log_file(virt_log_t) -@@ -48,27 +75,55 @@ +@@ -48,27 +75,56 @@ type virtd_initrc_exec_t; init_script_file(virtd_initrc_exec_t) @@ -24520,6 +24855,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow virtd_t self:tcp_socket create_stream_socket_perms; -allow virtd_t self:tun_socket create; +allow virtd_t self:tun_socket create_socket_perms; ++allow virtd_t self:netlink_kobject_uevent_socket create_socket_perms; + +allow virtd_t virt_domain:process { getattr getsched setsched transition signal signull sigkill }; @@ -24546,7 +24882,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t) manage_files_pattern(virtd_t, virt_log_t, virt_log_t) -@@ -76,6 +131,7 @@ +@@ -76,6 +132,7 @@ manage_dirs_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t) manage_files_pattern(virtd_t, virt_var_lib_t, virt_var_lib_t) @@ -24554,7 +24890,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_var_lib_filetrans(virtd_t, virt_var_lib_t, { file dir }) manage_dirs_pattern(virtd_t, virt_var_run_t, virt_var_run_t) -@@ -86,7 +142,8 @@ +@@ -86,7 +143,8 @@ kernel_read_system_state(virtd_t) kernel_read_network_state(virtd_t) kernel_rw_net_sysctls(virtd_t) @@ -24564,7 +24900,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corecmd_exec_bin(virtd_t) corecmd_exec_shell(virtd_t) -@@ -97,30 +154,50 @@ +@@ -97,40 +155,75 @@ corenet_tcp_sendrecv_generic_node(virtd_t) corenet_tcp_sendrecv_all_ports(virtd_t) corenet_tcp_bind_generic_node(virtd_t) @@ -24576,10 +24912,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corenet_rw_tun_tap_dev(virtd_t) -dev_read_sysfs(virtd_t) -+dev_rw_sysfs(virtd_t) ++dev_getattr_all_chr_files(virtd_t) dev_read_rand(virtd_t) +dev_rw_kvm(virtd_t) -+dev_getattr_all_chr_files(virtd_t) ++dev_rw_mtrr(virtd_t) ++dev_rw_sysfs(virtd_t) # Init script handling domain_use_interactive_fds(virtd_t) @@ -24618,14 +24955,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol term_use_ptmx(virtd_t) auth_use_nsswitch(virtd_t) -@@ -128,9 +205,22 @@ - miscfiles_read_localization(virtd_t) - miscfiles_read_certs(virtd_t) +-miscfiles_read_localization(virtd_t) + miscfiles_read_certs(virtd_t) ++miscfiles_read_hwdata(virtd_t) ++miscfiles_read_localization(virtd_t) ++ +modutils_read_module_deps(virtd_t) +modutils_read_module_config(virtd_t) +modutils_manage_module_config(virtd_t) -+ + logging_send_syslog_msg(virtd_t) +sysnet_domtrans_ifconfig(virtd_t) @@ -24641,7 +24980,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol tunable_policy(`virt_use_nfs',` fs_manage_nfs_dirs(virtd_t) -@@ -168,22 +258,36 @@ +@@ -168,22 +261,36 @@ dnsmasq_domtrans(virtd_t) dnsmasq_signal(virtd_t) dnsmasq_kill(virtd_t) @@ -24652,6 +24991,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` iptables_domtrans(virtd_t) + iptables_initrc_domtrans(virtd_t) ++') ++ ++optional_policy(` ++ kerberos_keytab_template(virtd, virtd_t) ') -#optional_policy(` @@ -24659,11 +25002,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol -# polkit_domtrans_resolve(virtd_t) -#') +optional_policy(` -+ kerberos_keytab_template(virtd, virtd_t) -+') - - optional_policy(` -- qemu_domtrans(virtd_t) + lvm_domtrans(virtd_t) +') + @@ -24673,8 +25011,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + policykit_domtrans_resolve(virtd_t) + policykit_read_lib(virtd_t) +') -+ -+optional_policy(` + + optional_policy(` +- qemu_domtrans(virtd_t) + qemu_spec_domtrans(virtd_t, svirt_t) qemu_read_state(virtd_t) qemu_signal(virtd_t) @@ -24683,7 +25022,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -196,8 +300,152 @@ +@@ -196,8 +303,152 @@ xen_stream_connect(virtd_t) xen_stream_connect_xenstore(virtd_t) diff --git a/selinux-policy.spec b/selinux-policy.spec index 27b5304..af9578e 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -13,14 +13,14 @@ %if %{?BUILD_MLS:0}%{!?BUILD_MLS:1} %define BUILD_MLS 1 %endif -%define POLICYVER 23 -%define libsepolver 2.0.20-1 -%define POLICYCOREUTILSVER 2.0.71-2 -%define CHECKPOLICYVER 2.0.16-3 +%define POLICYVER 24 +%define libsepolver 2.0.41-1 +%define POLICYCOREUTILSVER 2.0.78-3 +%define CHECKPOLICYVER 2.0.21-1 Summary: SELinux policy configuration Name: selinux-policy Version: 3.7.4 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -181,7 +181,7 @@ FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \ selinuxenabled; \ if [ $? = 0 -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \ fixfiles -C ${FILE_CONTEXT}.pre restore; \ - restorecon -R /var/log /var/run 2> /dev/null; \ + restorecon -R /root /var/log /var/run /var/lib 2> /dev/null;\ rm -f ${FILE_CONTEXT}.pre; \ fi; @@ -317,7 +317,7 @@ SELinux Reference policy targeted base module. if [ $1 -eq 1 ]; then packages="%{expand:%%moduleList targeted}" %loadpolicy targeted $packages - restorecon -R /root /var/log /var/run 2> /dev/null + restorecon -R /root /var/log /var/run /var/lib 2> /dev/null else semodule -n -s targeted -r moilscanner -r mailscanner -r gamin -r audio_entropy -r iscsid -r polkit_auth -r polkit -r rtkit_daemon -r ModemManager 2>/dev/null packages="%{expand:%%moduleList targeted}" @@ -373,7 +373,7 @@ semanage -S minimum -i - << __eof login -m -s unconfined_u -r s0-s0:c0.c1023 __default__ login -m -s unconfined_u -r s0-s0:c0.c1023 root __eof -restorecon -R /root /var/log /var/run 2> /dev/null +restorecon -R /root /var/log /var/run /var/lib 2> /dev/null else %relabel minimum fi @@ -449,6 +449,9 @@ exit 0 %endif %changelog +* Fri Dec 11 2009 Dan Walsh 3.7.4-2 +- Add tgtd policy + * Fri Dec 4 2009 Dan Walsh 3.7.4-1 - Update to upstream release