##
-## The template for creating a unprivileged user roughly
-## equivalent to a regular linux user.
--##
++## The template containing the most basic rules common to all users.
+ ##
-##
-+## The template for creating a unprivileged user roughly
-+## equivalent to a regular linux user.
-+##
+##
## This template creates a user domain, types, and
## rules for the user's tty, pty, home directories,
## tmp, and tmpfs files.
-@@ -1160,7 +1163,6 @@
+@@ -1160,7 +1162,6 @@
# Need the following rule to allow users to run vpnc
corenet_tcp_bind_xserver_port($1_t)
@@ -33839,7 +33656,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
# cjp: why?
files_read_kernel_symbol_table($1_t)
-@@ -1178,32 +1180,45 @@
+@@ -1178,36 +1179,45 @@
')
')
@@ -33865,13 +33682,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ ppp_run_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
')
+ optional_policy(`
+- postgresql_userdom_template($1,$1_t,$1_r)
++ games_rw_data($1_usertype)
+ ')
+
- # Run pppd in pppd_t by default for user
optional_policy(`
- ppp_run_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
-+ games_rw_data($1_usertype)
-+ ')
-+
-+ optional_policy(`
+ mount_run($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
+ ')
+
@@ -33881,14 +33699,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+
+ optional_policy(`
+ polkit_per_role_template($1, $1_usertype, $1_r)
++ ')
++
++ optional_policy(`
++ java_per_role_template($1, $1_t, $1_r)
')
optional_policy(`
- setroubleshoot_stream_connect($1_t)
-+ java_per_role_template($1, $1_t, $1_r)
-+ ')
-+
-+ optional_policy(`
+ mono_per_role_template($1, $1_t, $1_r)
+ ')
+
@@ -33897,7 +33715,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
')
-@@ -1280,8 +1295,6 @@
+@@ -1284,8 +1294,6 @@
# Manipulate other users crontab.
allow $1_t self:passwd crontab;
@@ -33906,7 +33724,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
kernel_getattr_message_if($1_t)
-@@ -1303,8 +1316,6 @@
+@@ -1307,8 +1315,6 @@
dev_getattr_generic_blk_files($1_t)
dev_getattr_generic_chr_files($1_t)
@@ -33915,7 +33733,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
# Allow MAKEDEV to work
dev_create_all_blk_files($1_t)
dev_create_all_chr_files($1_t)
-@@ -1359,13 +1370,6 @@
+@@ -1363,13 +1369,6 @@
# But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t)
@@ -33927,9 +33745,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
- ')
-
optional_policy(`
- userhelper_exec($1_t)
+ postgresql_unconfined($1_t)
')
-@@ -1413,6 +1417,7 @@
+@@ -1421,6 +1420,7 @@
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@@ -33937,7 +33755,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
-@@ -1442,10 +1447,6 @@
+@@ -1450,10 +1450,6 @@
seutil_run_semanage($1,$2,$3)
seutil_run_setfiles($1, $2, $3)
@@ -33948,7 +33766,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
optional_policy(`
aide_run($1,$2, $3)
')
-@@ -1465,12 +1466,30 @@
+@@ -1473,12 +1469,30 @@
optional_policy(`
netlabel_run_mgmt($1,$2, $3)
')
@@ -33979,7 +33797,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
##
##
## The prefix of the user role (e.g., user
-@@ -1480,8 +1499,7 @@
+@@ -1488,8 +1502,7 @@
##
#
template(`userdom_role_change_generic_user',`
@@ -33989,7 +33807,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1508,14 +1526,23 @@
+@@ -1516,14 +1529,23 @@
##
#
template(`userdom_role_change_from_generic_user',`
@@ -34015,7 +33833,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
##
##
## The prefix of the user role (e.g., user
-@@ -1525,8 +1552,7 @@
+@@ -1533,8 +1555,7 @@
##
#
template(`userdom_role_change_staff',`
@@ -34025,7 +33843,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1553,14 +1579,23 @@
+@@ -1561,14 +1582,23 @@
##
#
template(`userdom_role_change_from_staff',`
@@ -34051,7 +33869,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
##
##
## The prefix of the user role (e.g., user
-@@ -1570,8 +1605,7 @@
+@@ -1578,8 +1608,7 @@
##
#
template(`userdom_role_change_sysadm',`
@@ -34061,7 +33879,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1598,14 +1632,23 @@
+@@ -1606,14 +1635,23 @@
##
#
template(`userdom_role_change_from_sysadm',`
@@ -34087,7 +33905,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
##
##
## The prefix of the user role (e.g., user
-@@ -1615,8 +1658,11 @@
+@@ -1623,8 +1661,11 @@
##
#
template(`userdom_role_change_secadm',`
@@ -34101,7 +33919,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1643,14 +1689,27 @@
+@@ -1651,14 +1692,27 @@
##
#
template(`userdom_role_change_from_secadm',`
@@ -34131,7 +33949,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
##
##
## The prefix of the auditadm role (e.g., user
-@@ -1660,8 +1719,11 @@
+@@ -1668,8 +1722,11 @@
##
#
template(`userdom_role_change_auditadm',`
@@ -34145,7 +33963,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1688,8 +1750,11 @@
+@@ -1696,8 +1753,11 @@
##
#
template(`userdom_role_change_from_auditadm',`
@@ -34159,7 +33977,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1722,11 +1787,15 @@
+@@ -1730,11 +1790,15 @@
#
template(`userdom_user_home_content',`
gen_require(`
@@ -34178,7 +33996,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1822,11 +1891,11 @@
+@@ -1830,11 +1894,11 @@
#
template(`userdom_search_user_home_dirs',`
gen_require(`
@@ -34192,7 +34010,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1856,11 +1925,11 @@
+@@ -1864,11 +1928,11 @@
#
template(`userdom_list_user_home_dirs',`
gen_require(`
@@ -34206,7 +34024,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1904,12 +1973,12 @@
+@@ -1912,12 +1976,12 @@
#
template(`userdom_user_home_domtrans',`
gen_require(`
@@ -34222,7 +34040,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1939,10 +2008,11 @@
+@@ -1947,10 +2011,11 @@
#
template(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
@@ -34236,7 +34054,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -1974,11 +2044,47 @@
+@@ -1982,11 +2047,47 @@
#
template(`userdom_manage_user_home_content_dirs',`
gen_require(`
@@ -34286,7 +34104,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2010,10 +2116,10 @@
+@@ -2018,10 +2119,10 @@
#
template(`userdom_dontaudit_setattr_user_home_content_files',`
gen_require(`
@@ -34299,7 +34117,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2043,11 +2149,11 @@
+@@ -2051,11 +2152,11 @@
#
template(`userdom_read_user_home_content_files',`
gen_require(`
@@ -34313,7 +34131,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2077,11 +2183,11 @@
+@@ -2085,11 +2186,11 @@
#
template(`userdom_dontaudit_read_user_home_content_files',`
gen_require(`
@@ -34328,7 +34146,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2111,10 +2217,14 @@
+@@ -2119,10 +2220,14 @@
#
template(`userdom_dontaudit_write_user_home_content_files',`
gen_require(`
@@ -34345,7 +34163,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2144,11 +2254,11 @@
+@@ -2152,11 +2257,11 @@
#
template(`userdom_read_user_home_content_symlinks',`
gen_require(`
@@ -34359,7 +34177,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2178,11 +2288,11 @@
+@@ -2186,11 +2291,11 @@
#
template(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -34373,7 +34191,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2212,10 +2322,10 @@
+@@ -2220,10 +2325,10 @@
#
template(`userdom_dontaudit_exec_user_home_content_files',`
gen_require(`
@@ -34386,7 +34204,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2247,12 +2357,12 @@
+@@ -2255,12 +2360,12 @@
#
template(`userdom_manage_user_home_content_files',`
gen_require(`
@@ -34402,7 +34220,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2284,10 +2394,10 @@
+@@ -2292,10 +2397,10 @@
#
template(`userdom_dontaudit_manage_user_home_content_dirs',`
gen_require(`
@@ -34415,7 +34233,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2319,12 +2429,12 @@
+@@ -2327,12 +2432,12 @@
#
template(`userdom_manage_user_home_content_symlinks',`
gen_require(`
@@ -34431,7 +34249,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2356,12 +2466,12 @@
+@@ -2364,12 +2469,12 @@
#
template(`userdom_manage_user_home_content_pipes',`
gen_require(`
@@ -34447,7 +34265,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2393,12 +2503,12 @@
+@@ -2401,12 +2506,12 @@
#
template(`userdom_manage_user_home_content_sockets',`
gen_require(`
@@ -34463,7 +34281,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2443,11 +2553,11 @@
+@@ -2451,11 +2556,11 @@
#
template(`userdom_user_home_dir_filetrans',`
gen_require(`
@@ -34477,7 +34295,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2492,11 +2602,11 @@
+@@ -2500,11 +2605,11 @@
#
template(`userdom_user_home_content_filetrans',`
gen_require(`
@@ -34491,7 +34309,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2536,11 +2646,11 @@
+@@ -2544,11 +2649,11 @@
#
template(`userdom_user_home_dir_filetrans_user_home_content',`
gen_require(`
@@ -34505,7 +34323,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2570,11 +2680,11 @@
+@@ -2578,11 +2683,11 @@
#
template(`userdom_write_user_tmp_sockets',`
gen_require(`
@@ -34519,7 +34337,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2604,11 +2714,11 @@
+@@ -2612,11 +2717,11 @@
#
template(`userdom_list_user_tmp',`
gen_require(`
@@ -34533,7 +34351,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2640,10 +2750,10 @@
+@@ -2648,10 +2753,10 @@
#
template(`userdom_dontaudit_list_user_tmp',`
gen_require(`
@@ -34546,7 +34364,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2675,10 +2785,10 @@
+@@ -2683,10 +2788,10 @@
#
template(`userdom_dontaudit_manage_user_tmp_dirs',`
gen_require(`
@@ -34559,7 +34377,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2708,12 +2818,12 @@
+@@ -2716,12 +2821,12 @@
#
template(`userdom_read_user_tmp_files',`
gen_require(`
@@ -34575,7 +34393,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2745,10 +2855,10 @@
+@@ -2753,10 +2858,10 @@
#
template(`userdom_dontaudit_read_user_tmp_files',`
gen_require(`
@@ -34588,7 +34406,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2780,10 +2890,10 @@
+@@ -2788,10 +2893,10 @@
#
template(`userdom_dontaudit_append_user_tmp_files',`
gen_require(`
@@ -34601,7 +34419,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2813,12 +2923,12 @@
+@@ -2821,12 +2926,12 @@
#
template(`userdom_rw_user_tmp_files',`
gen_require(`
@@ -34617,7 +34435,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2850,10 +2960,10 @@
+@@ -2858,10 +2963,10 @@
#
template(`userdom_dontaudit_manage_user_tmp_files',`
gen_require(`
@@ -34630,7 +34448,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2885,12 +2995,12 @@
+@@ -2893,12 +2998,12 @@
#
template(`userdom_read_user_tmp_symlinks',`
gen_require(`
@@ -34646,7 +34464,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2922,11 +3032,11 @@
+@@ -2930,11 +3035,11 @@
#
template(`userdom_manage_user_tmp_dirs',`
gen_require(`
@@ -34660,7 +34478,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2958,11 +3068,11 @@
+@@ -2966,11 +3071,11 @@
#
template(`userdom_manage_user_tmp_files',`
gen_require(`
@@ -34674,7 +34492,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -2994,11 +3104,11 @@
+@@ -3002,11 +3107,11 @@
#
template(`userdom_manage_user_tmp_symlinks',`
gen_require(`
@@ -34688,7 +34506,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -3030,11 +3140,11 @@
+@@ -3038,11 +3143,11 @@
#
template(`userdom_manage_user_tmp_pipes',`
gen_require(`
@@ -34702,7 +34520,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -3066,11 +3176,11 @@
+@@ -3074,11 +3179,11 @@
#
template(`userdom_manage_user_tmp_sockets',`
gen_require(`
@@ -34716,7 +34534,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -3115,10 +3225,10 @@
+@@ -3123,10 +3228,10 @@
#
template(`userdom_user_tmp_filetrans',`
gen_require(`
@@ -34729,7 +34547,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
files_search_tmp($2)
')
-@@ -3159,19 +3269,19 @@
+@@ -3167,19 +3272,19 @@
#
template(`userdom_tmp_filetrans_user_tmp',`
gen_require(`
@@ -34753,7 +34571,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
##
##
## This is a templated interface, and should only
-@@ -4597,11 +4707,11 @@
+@@ -4605,11 +4710,11 @@
#
interface(`userdom_search_all_users_home_dirs',`
gen_require(`
@@ -34767,12 +34585,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4621,7 +4731,15 @@
+@@ -4629,12 +4734,20 @@
files_list_home($1)
allow $1 home_dir_type:dir list_dir_perms;
-')
-+
+
+-########################################
+-##
+-## Search all users home directories.
+-##
+ tunable_policy(`use_nfs_home_dirs',`
+ fs_list_nfs($1)
+ ')
@@ -34781,10 +34603,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ fs_list_cifs($1)
+ ')
+')
-
- ########################################
- ##
-@@ -4702,6 +4820,25 @@
++
++########################################
++##
++## Search all users home directories.
++##
+ ##
+ ##
+ ## Domain allowed access.
+@@ -4710,6 +4823,25 @@
########################################
##
@@ -34810,7 +34637,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Create, read, write, and delete all files
## in all users home directories.
##
-@@ -4927,7 +5064,7 @@
+@@ -4935,7 +5067,7 @@
########################################
##
@@ -34819,7 +34646,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
##
##
##
-@@ -5299,6 +5436,42 @@
+@@ -5307,6 +5439,42 @@
########################################
##
@@ -34862,7 +34689,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Read and write unprivileged user ttys.
##
##
-@@ -5349,7 +5522,7 @@
+@@ -5357,7 +5525,7 @@
attribute userdomain;
')
@@ -34871,7 +34698,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
kernel_search_proc($1)
')
-@@ -5464,6 +5637,42 @@
+@@ -5472,6 +5640,42 @@
########################################
##
@@ -34914,7 +34741,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Send a dbus message to all user domains.
##
##
-@@ -5494,3 +5703,525 @@
+@@ -5502,3 +5706,525 @@
interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.')
')
@@ -35440,9 +35267,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ delete_lnk_files_pattern($1,home_type,home_type)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.4.1/policy/modules/system/userdomain.te
---- nsaserefpolicy/policy/modules/system/userdomain.te 2008-05-19 10:26:42.000000000 -0400
-+++ serefpolicy-3.4.1/policy/modules/system/userdomain.te 2008-06-05 08:23:30.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.4.2/policy/modules/system/userdomain.te
+--- nsaserefpolicy/policy/modules/system/userdomain.te 2008-06-11 08:15:46.000000000 -0400
++++ serefpolicy-3.4.2/policy/modules/system/userdomain.te 2008-06-11 12:02:26.000000000 -0400
@@ -8,13 +8,6 @@
##
@@ -35557,9 +35384,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ manage_fifo_files_pattern(privhome, cifs_t, cifs_t)
+')
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.fc serefpolicy-3.4.1/policy/modules/system/virt.fc
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.fc serefpolicy-3.4.2/policy/modules/system/virt.fc
--- nsaserefpolicy/policy/modules/system/virt.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.4.1/policy/modules/system/virt.fc 2008-06-05 08:23:30.000000000 -0400
++++ serefpolicy-3.4.2/policy/modules/system/virt.fc 2008-06-11 12:02:26.000000000 -0400
@@ -0,0 +1,13 @@
+
+/usr/sbin/libvirtd -- gen_context(system_u:object_r:virtd_exec_t,s0)
@@ -35574,9 +35401,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.f
+/etc/libvirt/[^/]* -- gen_context(system_u:object_r:virt_etc_t,s0)
+/etc/libvirt/[^/]* -d gen_context(system_u:object_r:virt_etc_rw_t,s0)
+/etc/libvirt/.*/.* gen_context(system_u:object_r:virt_etc_rw_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.4.1/policy/modules/system/virt.if
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.4.2/policy/modules/system/virt.if
--- nsaserefpolicy/policy/modules/system/virt.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.4.1/policy/modules/system/virt.if 2008-06-05 08:23:30.000000000 -0400
++++ serefpolicy-3.4.2/policy/modules/system/virt.if 2008-06-11 12:02:26.000000000 -0400
@@ -0,0 +1,324 @@
+
+## policy for virt
@@ -35902,9 +35729,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.i
+')
+
+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.4.1/policy/modules/system/virt.te
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.4.2/policy/modules/system/virt.te
--- nsaserefpolicy/policy/modules/system/virt.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.4.1/policy/modules/system/virt.te 2008-06-05 08:23:30.000000000 -0400
++++ serefpolicy-3.4.2/policy/modules/system/virt.te 2008-06-11 12:02:26.000000000 -0400
@@ -0,0 +1,197 @@
+
+policy_module(virt,1.0.0)
@@ -35961,7 +35788,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.t
+# virtd local policy
+#
+allow virtd_t self:capability { dac_override kill net_admin setgid sys_nice sys_ptrace };
-+allow virtd_t self:process { sigkill signal execmem };
++allow virtd_t self:process { getsched sigkill signal execmem };
+allow virtd_t self:fifo_file rw_file_perms;
+allow virtd_t self:unix_stream_socket create_stream_socket_perms;
+allow virtd_t self:tcp_socket create_stream_socket_perms;
@@ -36103,9 +35930,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.t
+ fs_manage_cifs_files(virtd_t)
+ fs_read_cifs_symlinks(virtd_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc serefpolicy-3.4.1/policy/modules/system/xen.fc
---- nsaserefpolicy/policy/modules/system/xen.fc 2008-05-19 10:26:42.000000000 -0400
-+++ serefpolicy-3.4.1/policy/modules/system/xen.fc 2008-06-10 14:29:53.929331000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc serefpolicy-3.4.2/policy/modules/system/xen.fc
+--- nsaserefpolicy/policy/modules/system/xen.fc 2008-05-29 15:57:51.000000000 -0400
++++ serefpolicy-3.4.2/policy/modules/system/xen.fc 2008-06-11 12:02:26.000000000 -0400
@@ -20,6 +20,7 @@
/var/run/xenconsoled\.pid -- gen_context(system_u:object_r:xenconsoled_var_run_t,s0)
/var/run/xend(/.*)? gen_context(system_u:object_r:xend_var_run_t,s0)
@@ -36114,9 +35941,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc
/var/run/xenstore\.pid -- gen_context(system_u:object_r:xenstored_var_run_t,s0)
/var/run/xenstored(/.*)? gen_context(system_u:object_r:xenstored_var_run_t,s0)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.4.1/policy/modules/system/xen.if
---- nsaserefpolicy/policy/modules/system/xen.if 2008-05-23 09:15:07.000000000 -0400
-+++ serefpolicy-3.4.1/policy/modules/system/xen.if 2008-06-05 08:23:30.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.4.2/policy/modules/system/xen.if
+--- nsaserefpolicy/policy/modules/system/xen.if 2008-05-29 15:57:51.000000000 -0400
++++ serefpolicy-3.4.2/policy/modules/system/xen.if 2008-06-11 12:02:26.000000000 -0400
@@ -167,11 +167,14 @@
#
interface(`xen_stream_connect',`
@@ -36158,9 +35985,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if
+ allow $1 xend_var_lib_t:dir search_dir_perms;
+ rw_files_pattern($1,xen_image_t,xen_image_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.4.1/policy/modules/system/xen.te
---- nsaserefpolicy/policy/modules/system/xen.te 2008-05-19 10:26:42.000000000 -0400
-+++ serefpolicy-3.4.1/policy/modules/system/xen.te 2008-06-10 14:42:41.249644000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.4.2/policy/modules/system/xen.te
+--- nsaserefpolicy/policy/modules/system/xen.te 2008-05-29 15:57:51.000000000 -0400
++++ serefpolicy-3.4.2/policy/modules/system/xen.te 2008-06-11 12:02:26.000000000 -0400
@@ -6,6 +6,13 @@
# Declarations
#
@@ -36397,9 +36224,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te
+optional_policy(`
+ unconfined_domain(xend_t)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/file_patterns.spt serefpolicy-3.4.1/policy/support/file_patterns.spt
---- nsaserefpolicy/policy/support/file_patterns.spt 2008-05-19 10:26:46.000000000 -0400
-+++ serefpolicy-3.4.1/policy/support/file_patterns.spt 2008-06-05 08:23:30.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/file_patterns.spt serefpolicy-3.4.2/policy/support/file_patterns.spt
+--- nsaserefpolicy/policy/support/file_patterns.spt 2008-05-29 15:57:53.000000000 -0400
++++ serefpolicy-3.4.2/policy/support/file_patterns.spt 2008-06-11 12:02:26.000000000 -0400
@@ -537,3 +537,23 @@
allow $1 $2:dir rw_dir_perms;
type_transition $1 $2:$4 $3;
@@ -36424,9 +36251,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/file_patterns
+ relabelfrom_fifo_files_pattern($1,$2,$2)
+ relabelfrom_sock_files_pattern($1,$2,$2)
+')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.4.1/policy/support/obj_perm_sets.spt
---- nsaserefpolicy/policy/support/obj_perm_sets.spt 2008-05-29 15:55:44.000000000 -0400
-+++ serefpolicy-3.4.1/policy/support/obj_perm_sets.spt 2008-06-05 08:23:30.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.4.2/policy/support/obj_perm_sets.spt
+--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2008-05-29 15:57:53.000000000 -0400
++++ serefpolicy-3.4.2/policy/support/obj_perm_sets.spt 2008-06-11 12:02:26.000000000 -0400
@@ -316,3 +316,13 @@
#
define(`client_stream_socket_perms', `{ create ioctl read getattr write setattr append bind getopt setopt shutdown }')
@@ -36441,9 +36268,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
+define(`all_association_perms', `{ sendto recvfrom setcontext polmatch } ')
+
+define(`manage_key_perms', `{ create link read search setattr view write } ')
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.4.1/policy/users
---- nsaserefpolicy/policy/users 2008-05-23 09:15:07.000000000 -0400
-+++ serefpolicy-3.4.1/policy/users 2008-06-05 08:23:30.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.4.2/policy/users
+--- nsaserefpolicy/policy/users 2008-05-29 15:57:53.000000000 -0400
++++ serefpolicy-3.4.2/policy/users 2008-06-11 12:02:26.000000000 -0400
@@ -31,11 +31,8 @@
# permit any access to such users, then remove this entry.
#
@@ -36468,3 +36295,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.4
- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
-')
+gen_user(root, user, unconfined_r sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.4.2/Rules.modular
+--- nsaserefpolicy/Rules.modular 2008-05-29 15:57:55.000000000 -0400
++++ serefpolicy-3.4.2/Rules.modular 2008-06-11 12:02:26.000000000 -0400
+@@ -73,8 +73,8 @@
+ $(tmpdir)/%.mod: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf %.te
+ @echo "Compliling $(NAME) $(@F) module"
+ @test -d $(tmpdir) || mkdir -p $(tmpdir)
+- $(call perrole-expansion,$(basename $(@F)),$@.role)
+- $(verbose) $(M4) $(M4PARAM) -s $^ $@.role > $(@:.mod=.tmp)
++# $(call perrole-expansion,$(basename $(@F)),$@.role)
++ $(verbose) $(M4) $(M4PARAM) -s $^ > $(@:.mod=.tmp)
+ $(verbose) $(CHECKMODULE) -m $(@:.mod=.tmp) -o $@
+
+ $(tmpdir)/%.mod.fc: $(m4support) %.fc
+@@ -129,7 +129,7 @@
+ @test -d $(tmpdir) || mkdir -p $(tmpdir)
+ # define all available object classes
+ $(verbose) $(genperm) $(avs) $(secclass) > $@
+- $(verbose) $(call create-base-per-role-tmpl,$(patsubst %.te,%,$(base_mods)),$@)
++# $(verbose) $(call create-base-per-role-tmpl,$(patsubst %.te,%,$(base_mods)),$@)
+ $(verbose) test -f $(booleans) && $(setbools) $(booleans) >> $@ || true
+
+ $(tmpdir)/global_bools.conf: M4PARAM += -D self_contained_policy
+@@ -146,7 +146,7 @@
+ $(tmpdir)/rolemap.conf: M4PARAM += -D self_contained_policy
+ $(tmpdir)/rolemap.conf: $(rolemap)
+ $(verbose) echo "" > $@
+- $(call parse-rolemap,base,$@)
++# $(call parse-rolemap,base,$@)
+
+ $(tmpdir)/all_te_files.conf: M4PARAM += -D self_contained_policy
+ $(tmpdir)/all_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf $(base_te_files) $(tmpdir)/rolemap.conf
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 7ab1eab..063174d 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -16,8 +16,8 @@
%define CHECKPOLICYVER 2.0.16-1
Summary: SELinux policy configuration
Name: selinux-policy
-Version: 3.4.1
-Release: 5%{?dist}
+Version: 3.4.2
+Release: 1%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -375,6 +375,9 @@ exit 0
%endif
%changelog
+* Wed Jun 11 2008 Dan Walsh 3.4.2-1
+- Update to upstream
+
* Wed Jun 4 2008 Dan Walsh 3.4.1-5
- Add livecd policy