diff --git a/refpolicy/policy/modules/apps/ada.fc b/refpolicy/policy/modules/apps/ada.fc new file mode 100644 index 0000000..01a8572 --- /dev/null +++ b/refpolicy/policy/modules/apps/ada.fc @@ -0,0 +1,9 @@ +# +# /usr +# +ifdef(`targeted_policy',` +/usr/bin/gnatbind -- gen_context(system_u:object_r:ada_exec_t,s0) +/usr/bin/gnatls -- gen_context(system_u:object_r:ada_exec_t,s0) +/usr/bin/gnatmake -- gen_context(system_u:object_r:ada_exec_t,s0) +/usr/libexec/gcc(/.*)?/gnat1 -- gen_context(system_u:object_r:ada_exec_t,s0) +') diff --git a/refpolicy/policy/modules/apps/ada.if b/refpolicy/policy/modules/apps/ada.if new file mode 100644 index 0000000..6d8950f --- /dev/null +++ b/refpolicy/policy/modules/apps/ada.if @@ -0,0 +1,29 @@ +## GNAT Ada95 compiler + +######################################## +## +## Execute the ada program in the ada domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`ada_domtrans',` + ifdef(`targeted_policy',` + gen_require(` + type ada_t, ada_exec_t; + ') + + corecmd_search_bin($1) + domain_auto_trans($1, ada_exec_t, ada_t) + + allow $1 ada_t:fd use; + allow ada_t $1:fd use; + allow ada_t $1:fifo_file rw_file_perms; + allow ada_t $1:process sigchld; + ',` + errprint(`Warning: $0($1) has no effect in strict policy.'__endline__) + ') +') diff --git a/refpolicy/policy/modules/apps/ada.te b/refpolicy/policy/modules/apps/ada.te new file mode 100644 index 0000000..f8167b8 --- /dev/null +++ b/refpolicy/policy/modules/apps/ada.te @@ -0,0 +1,23 @@ + +policy_module(ada,1.0.0) + +######################################## +# +# Declarations +# + +type ada_t; +type ada_exec_t; +domain_type(ada_t) +domain_entry_file(ada_t,ada_exec_t) + +######################################## +# +# Local policy +# + +ifdef(`targeted_policy',` + allow ada_t self:process { execstack execmem }; + unconfined_domain_noaudit(ada_t) + role system_r types ada_t; +') diff --git a/refpolicy/policy/modules/apps/mono.te b/refpolicy/policy/modules/apps/mono.te index a3bfa8b..1715c18 100644 --- a/refpolicy/policy/modules/apps/mono.te +++ b/refpolicy/policy/modules/apps/mono.te @@ -1,5 +1,5 @@ -policy_module(mono,1.1.0) +policy_module(mono,1.1.1) ######################################## # @@ -21,4 +21,12 @@ ifdef(`targeted_policy',` allow mono_t self:process { execheap execmem }; unconfined_domain_noaudit(mono_t) role system_r types mono_t; + + optional_policy(` + avahi_dbus_chat(mono_t) + ') + + optional_policy(` + hal_dbus_chat(mono_t) + ') ') diff --git a/refpolicy/policy/modules/kernel/devices.if b/refpolicy/policy/modules/kernel/devices.if index 1ee19c4..62ff408 100644 --- a/refpolicy/policy/modules/kernel/devices.if +++ b/refpolicy/policy/modules/kernel/devices.if @@ -2532,6 +2532,25 @@ interface(`dev_list_usbfs',` ######################################## ## +## Set the attributes of usbfs filesystem. +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_setattr_usbfs_files',` + gen_require(` + type usbfs_t; + ') + + allow $1 usbfs_t:dir r_dir_perms; + allow $1 usbfs_t:file setattr; +') + +######################################## +## ## Read USB hardware information using ## the usbfs filesystem interface. ## diff --git a/refpolicy/policy/modules/kernel/devices.te b/refpolicy/policy/modules/kernel/devices.te index 8e9f377..8f6bd83 100644 --- a/refpolicy/policy/modules/kernel/devices.te +++ b/refpolicy/policy/modules/kernel/devices.te @@ -1,5 +1,5 @@ -policy_module(devices,1.1.9) +policy_module(devices,1.1.10) ######################################## # diff --git a/refpolicy/policy/modules/services/hal.te b/refpolicy/policy/modules/services/hal.te index 6895d46..877926b 100644 --- a/refpolicy/policy/modules/services/hal.te +++ b/refpolicy/policy/modules/services/hal.te @@ -1,5 +1,5 @@ -policy_module(hal,1.3.3) +policy_module(hal,1.3.4) ######################################## # @@ -80,6 +80,8 @@ dev_read_lvm_control(hald_t) dev_getattr_all_chr_files(hald_t) dev_manage_generic_chr_files(hald_t) dev_rw_generic_usb_dev(hald_t) +dev_setattr_generic_usb_dev(hald_t) +dev_setattr_usbfs_files(hald_t) # hal is now execing pm-suspend dev_rw_sysfs(hald_t) diff --git a/refpolicy/policy/modules/system/unconfined.te b/refpolicy/policy/modules/system/unconfined.te index 0674249..1d48a90 100644 --- a/refpolicy/policy/modules/system/unconfined.te +++ b/refpolicy/policy/modules/system/unconfined.te @@ -1,5 +1,5 @@ -policy_module(unconfined,1.3.4) +policy_module(unconfined,1.3.5) ######################################## # @@ -41,9 +41,9 @@ ifdef(`targeted_policy',` userdom_unconfined(unconfined_t) userdom_priveleged_home_dir_manager(unconfined_t) -# optional_policy(` -# ada_domtrans(unconfined_t) -# ') + optional_policy(` + ada_domtrans(unconfined_t) + ') optional_policy(` amanda_domtrans_recover(unconfined_t)