diff --git a/policy-20070703.patch b/policy-20070703.patch index 41066ab..7696f8f 100644 --- a/policy-20070703.patch +++ b/policy-20070703.patch @@ -2425,6 +2425,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain + kernel_udp_recvfrom_unlabeled(domain) + ') +') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.0.8/policy/modules/kernel/files.fc +--- nsaserefpolicy/policy/modules/kernel/files.fc 2007-09-12 10:34:49.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/files.fc 2007-09-18 20:56:27.000000000 -0400 +@@ -210,6 +210,7 @@ + /usr/lost\+found/.* <> + + /usr/share(/.*)?/lib(64)?(/.*)? gen_context(system_u:object_r:usr_t,s0) ++/usr/share/doc(/.*)?/README.* gen_context(system_u:object_r:usr_t,s0) + + /usr/src(/.*)? gen_context(system_u:object_r:src_t,s0) + /usr/src/kernels/.+/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.8/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2007-07-03 07:05:38.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/kernel/files.if 2007-09-17 16:20:18.000000000 -0400 @@ -2686,7 +2697,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.0.8/policy/modules/kernel/files.te --- nsaserefpolicy/policy/modules/kernel/files.te 2007-09-12 10:34:49.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/files.te 2007-09-17 16:20:18.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/files.te 2007-09-18 12:11:13.000000000 -0400 @@ -1,5 +1,5 @@ -policy_module(files,1.6.1) @@ -2694,16 +2705,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ######################################## # -@@ -55,6 +55,8 @@ +@@ -55,6 +55,9 @@ # compatibility aliases for removed types: typealias etc_t alias automount_etc_t; typealias etc_t alias snmpd_etc_t; +typealias etc_t alias gconf_etc_t; +typealias etc_t alias soundd_etc_t; ++typealias etc_t alias hplip_etc_t; # # etc_runtime_t is the type of various -@@ -188,6 +190,7 @@ +@@ -188,6 +191,7 @@ fs_associate(file_type) fs_associate_noxattr(file_type) fs_associate_tmpfs(file_type) @@ -4240,6 +4252,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind corenet_sendrecv_rndc_client_packets(ndc_t) fs_getattr_xattr_fs(ndc_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.0.8/policy/modules/services/bluetooth.te +--- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-08-02 08:17:27.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/bluetooth.te 2007-09-18 13:32:50.000000000 -0400 +@@ -128,6 +128,7 @@ + dbus_system_bus_client_template(bluetooth,bluetooth_t) + dbus_connect_system_bus(bluetooth_t) + dbus_send_system_bus(bluetooth_t) ++ allow bluetooth_t self:dbus send_msg; + ') + + optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.8/policy/modules/services/clamav.te --- nsaserefpolicy/policy/modules/services/clamav.te 2007-09-12 10:34:50.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/services/clamav.te 2007-09-17 16:20:18.000000000 -0400 @@ -4736,8 +4759,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ifdef(`TODO',` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.8/policy/modules/services/cups.fc --- nsaserefpolicy/policy/modules/services/cups.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cups.fc 2007-09-18 10:39:32.000000000 -0400 -@@ -8,6 +8,7 @@ ++++ serefpolicy-3.0.8/policy/modules/services/cups.fc 2007-09-18 12:31:53.000000000 -0400 +@@ -8,17 +8,14 @@ /etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/printers\.conf.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -4745,7 +4768,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups /etc/cups/certs -d gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/certs/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) -@@ -17,8 +18,6 @@ +-/etc/hp(/.*)? gen_context(system_u:object_r:hplip_etc_t,s0) +- + /etc/printcap.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /usr/bin/cups-config-daemon -- gen_context(system_u:object_r:cupsd_config_exec_t,s0) @@ -4754,11 +4779,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups /usr/lib(64)?/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0) /usr/libexec/hal_lpadmin -- gen_context(system_u:object_r:cupsd_config_exec_t,s0) -@@ -26,6 +25,7 @@ +@@ -26,6 +23,9 @@ /usr/sbin/cupsd -- gen_context(system_u:object_r:cupsd_exec_t,s0) /usr/sbin/hal_lpadmin -- gen_context(system_u:object_r:cupsd_config_exec_t,s0) /usr/sbin/hpiod -- gen_context(system_u:object_r:hplip_exec_t,s0) +/usr/sbin/hp-[^/]+ -- gen_context(system_u:object_r:hplip_exec_t,s0) ++/usr/lib(64)?/cups/backend/hp.* -- gen_context(system_u:object_r:hplip_exec_t,s0) ++ /usr/sbin/printconf-backend -- gen_context(system_u:object_r:cupsd_config_exec_t,s0) /usr/sbin/ptal-printd -- gen_context(system_u:object_r:ptal_exec_t,s0) /usr/sbin/ptal-mlcd -- gen_context(system_u:object_r:ptal_exec_t,s0) @@ -4769,8 +4796,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups +/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.8/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2007-09-12 10:34:50.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cups.te 2007-09-18 10:43:40.000000000 -0400 -@@ -81,12 +81,11 @@ ++++ serefpolicy-3.0.8/policy/modules/services/cups.te 2007-09-18 12:15:12.000000000 -0400 +@@ -49,9 +49,6 @@ + type hplip_exec_t; + init_daemon_domain(hplip_t,hplip_exec_t) + +-type hplip_etc_t; +-files_config_file(hplip_etc_t) +- + type hplip_var_run_t; + files_pid_file(hplip_var_run_t) + +@@ -81,12 +78,11 @@ # /usr/lib/cups/backend/serial needs sys_admin(?!) allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config }; dontaudit cupsd_t self:capability { sys_tty_config net_admin }; @@ -4784,7 +4821,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups allow cupsd_t self:tcp_socket create_stream_socket_perms; allow cupsd_t self:udp_socket create_socket_perms; allow cupsd_t self:appletalk_socket create_socket_perms; -@@ -105,7 +104,7 @@ +@@ -105,7 +101,7 @@ # allow cups to execute its backend scripts can_exec(cupsd_t, cupsd_exec_t) @@ -4793,7 +4830,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups allow cupsd_t cupsd_exec_t:lnk_file read; manage_files_pattern(cupsd_t,cupsd_log_t,cupsd_log_t) -@@ -129,6 +128,8 @@ +@@ -122,13 +118,13 @@ + manage_sock_files_pattern(cupsd_t,cupsd_var_run_t,cupsd_var_run_t) + files_pid_filetrans(cupsd_t,cupsd_var_run_t,file) + +-read_files_pattern(cupsd_t,hplip_etc_t,hplip_etc_t) +- + allow cupsd_t hplip_var_run_t:file { read getattr }; + stream_connect_pattern(cupsd_t,ptal_var_run_t,ptal_var_run_t,ptal_t) allow cupsd_t ptal_var_run_t : sock_file setattr; @@ -4802,7 +4846,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups kernel_read_system_state(cupsd_t) kernel_read_network_state(cupsd_t) kernel_read_all_sysctls(cupsd_t) -@@ -150,21 +151,26 @@ +@@ -150,21 +146,26 @@ corenet_tcp_bind_reserved_port(cupsd_t) corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t) corenet_tcp_connect_all_ports(cupsd_t) @@ -4830,7 +4874,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups mls_file_downgrade(cupsd_t) mls_file_write_all_levels(cupsd_t) mls_file_read_all_levels(cupsd_t) -@@ -174,6 +180,7 @@ +@@ -174,6 +175,7 @@ term_search_ptys(cupsd_t) auth_domtrans_chk_passwd(cupsd_t) @@ -4838,7 +4882,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups auth_dontaudit_read_pam_pid(cupsd_t) # Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp -@@ -187,7 +194,7 @@ +@@ -187,7 +189,7 @@ # read python modules files_read_usr_files(cupsd_t) # for /var/lib/defoma @@ -4847,7 +4891,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups files_list_world_readable(cupsd_t) files_read_world_readable_files(cupsd_t) files_read_world_readable_symlinks(cupsd_t) -@@ -202,6 +209,7 @@ +@@ -202,6 +204,7 @@ files_dontaudit_getattr_all_tmp_files(cupsd_t) selinux_compute_access_vector(cupsd_t) @@ -4855,7 +4899,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups init_exec_script_files(cupsd_t) -@@ -221,17 +229,37 @@ +@@ -221,17 +224,37 @@ sysnet_read_config(cupsd_t) @@ -4893,7 +4937,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups apm_domtrans_client(cupsd_t) ') -@@ -263,16 +291,16 @@ +@@ -263,16 +286,16 @@ ') optional_policy(` @@ -4914,7 +4958,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups seutil_sigchld_newrole(cupsd_t) ') -@@ -377,6 +405,14 @@ +@@ -377,6 +400,14 @@ ') optional_policy(` @@ -4929,7 +4973,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups cron_system_entry(cupsd_config_t, cupsd_config_exec_t) ') -@@ -560,7 +596,7 @@ +@@ -526,11 +557,6 @@ + + cups_stream_connect(hplip_t) + +-allow hplip_t hplip_etc_t:dir list_dir_perms; +-read_files_pattern(hplip_t,hplip_etc_t,hplip_etc_t) +-read_lnk_files_pattern(hplip_t,hplip_etc_t,hplip_etc_t) +-files_search_etc(hplip_t) +- + manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t) + files_pid_filetrans(hplip_t,hplip_var_run_t,file) + +@@ -560,7 +586,7 @@ dev_read_urand(hplip_t) dev_read_rand(hplip_t) dev_rw_generic_usb_dev(hplip_t) @@ -4938,7 +4994,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups fs_getattr_all_fs(hplip_t) fs_search_auto_mountpoints(hplip_t) -@@ -587,8 +623,6 @@ +@@ -587,8 +613,6 @@ userdom_dontaudit_search_sysadm_home_dirs(hplip_t) userdom_dontaudit_search_all_users_home_content(hplip_t) diff --git a/selinux-policy.spec b/selinux-policy.spec index 47a3f8c..c01b036 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -17,7 +17,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.0.8 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -362,6 +362,10 @@ exit 0 %endif %changelog +* Tue Sep 18 2007 Dan Walsh 3.0.8-2 +- Remove hplip_etc_t change back to etc_t. + + * Mon Sep 17 2007 Dan Walsh 3.0.8-1 - Allow cron to search nfs and samba homedirs