diff --git a/policy-F12.patch b/policy-F12.patch index 58d3df4..f47dd5a 100644 --- a/policy-F12.patch +++ b/policy-F12.patch @@ -1,3 +1,15 @@ +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.6.29/Makefile +--- nsaserefpolicy/Makefile 2009-08-18 11:41:14.000000000 -0400 ++++ serefpolicy-3.6.29/Makefile 2009-08-31 13:03:03.000000000 -0400 +@@ -244,7 +244,7 @@ + appdir := $(contextpath) + user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts) + user_default_contexts_names := $(addprefix $(contextpath)/users/,$(subst _default_contexts,,$(notdir $(user_default_contexts)))) +-appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts x_contexts customizable_types securetty_types) $(contextpath)/files/media $(user_default_contexts_names) ++appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts x_contexts customizable_types securetty_types virtual_image_context virtual_domain_context) $(contextpath)/files/media $(user_default_contexts_names) + net_contexts := $(builddir)net_contexts + + all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/rsync_selinux.8 serefpolicy-3.6.29/man/man8/rsync_selinux.8 --- nsaserefpolicy/man/man8/rsync_selinux.8 2009-07-14 14:19:57.000000000 -0400 +++ serefpolicy-3.6.29/man/man8/rsync_selinux.8 2009-08-31 09:47:15.000000000 -0400 @@ -460,7 +472,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol /usr/bin/online_update -- gen_context(system_u:object_r:rpm_exec_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.6.29/policy/modules/admin/rpm.if --- nsaserefpolicy/policy/modules/admin/rpm.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.6.29/policy/modules/admin/rpm.if 2009-08-31 09:47:15.000000000 -0400 ++++ serefpolicy-3.6.29/policy/modules/admin/rpm.if 2009-08-31 10:37:32.000000000 -0400 @@ -66,6 +66,11 @@ rpm_domtrans($1) role $2 types rpm_t; @@ -473,7 +485,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol seutil_run_loadpolicy(rpm_script_t, $2) seutil_run_semanage(rpm_script_t, $2) seutil_run_setfiles(rpm_script_t, $2) -@@ -146,6 +151,34 @@ +@@ -146,6 +151,35 @@ ######################################## ## @@ -496,6 +508,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + + dontaudit $1 rpm_t:fifo_file rw_fifo_file_perms; + dontaudit $1 rpm_script_t:fd use; ++ dontaudit $1 rpm_script_t:fifo_file rw_fifo_file_perms; + dontaudit $1 rpm_var_run_t:file write_file_perms; + dontaudit $1 rpm_tmp_t:file rw_file_perms; + dontaudit $1 rpm_t:shm rw_shm_perms; @@ -508,7 +521,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## Send and receive messages from ## rpm over dbus. ## -@@ -167,6 +200,48 @@ +@@ -167,6 +201,48 @@ ######################################## ## @@ -557,7 +570,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## Create, read, write, and delete the RPM log. ## ## -@@ -186,6 +261,24 @@ +@@ -186,6 +262,24 @@ ######################################## ## @@ -582,7 +595,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## Inherit and use file descriptors from RPM scripts. ## ## -@@ -219,7 +312,29 @@ +@@ -219,7 +313,29 @@ ') files_search_tmp($1) @@ -612,7 +625,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -245,6 +360,24 @@ +@@ -245,6 +361,24 @@ ######################################## ## @@ -637,7 +650,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## Create, read, write, and delete the RPM package database. ## ## -@@ -283,3 +416,46 @@ +@@ -283,3 +417,46 @@ dontaudit $1 rpm_var_lib_t:file manage_file_perms; dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms; ') @@ -1269,7 +1282,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.6.29/policy/modules/apps/cpufreqselector.te --- nsaserefpolicy/policy/modules/apps/cpufreqselector.te 2009-07-28 13:28:33.000000000 -0400 -+++ serefpolicy-3.6.29/policy/modules/apps/cpufreqselector.te 2009-08-31 09:47:15.000000000 -0400 ++++ serefpolicy-3.6.29/policy/modules/apps/cpufreqselector.te 2009-08-31 10:08:44.000000000 -0400 @@ -8,7 +8,8 @@ type cpufreqselector_t; @@ -1280,7 +1293,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ######################################## # -@@ -36,6 +37,7 @@ +@@ -26,6 +27,7 @@ + dev_rw_sysfs(cpufreqselector_t) + + userdom_read_all_users_state(cpufreqselector_t) ++userdom_dontaudit_search_admin_dir(cpufreqselector_t) + + optional_policy(` + consolekit_dbus_chat(cpufreqselector_t) +@@ -36,6 +38,7 @@ ') optional_policy(` @@ -1639,7 +1660,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.6.29/policy/modules/apps/gnome.te --- nsaserefpolicy/policy/modules/apps/gnome.te 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.6.29/policy/modules/apps/gnome.te 2009-08-31 09:47:15.000000000 -0400 ++++ serefpolicy-3.6.29/policy/modules/apps/gnome.te 2009-08-31 10:10:01.000000000 -0400 @@ -9,16 +9,18 @@ attribute gnomedomain; @@ -1678,7 +1699,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ############################## # # Local Policy -@@ -73,3 +84,82 @@ +@@ -73,3 +84,83 @@ xserver_use_xdm_fds(gconfd_t) xserver_rw_xdm_pipes(gconfd_t) ') @@ -1744,6 +1765,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +files_read_usr_files(gnomesystemmm_t) + +userdom_read_all_users_state(gnomesystemmm_t) ++userdom_dontaudit_search_admin_dir(gnomesystemmm_t) + +optional_policy(` + consolekit_dbus_chat(gnomesystemmm_t) @@ -2046,8 +2068,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.te serefpolicy-3.6.29/policy/modules/apps/kdumpgui.te --- nsaserefpolicy/policy/modules/apps/kdumpgui.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.6.29/policy/modules/apps/kdumpgui.te 2009-08-31 09:47:15.000000000 -0400 -@@ -0,0 +1,64 @@ ++++ serefpolicy-3.6.29/policy/modules/apps/kdumpgui.te 2009-08-31 10:09:48.000000000 -0400 +@@ -0,0 +1,66 @@ +policy_module(kdumpgui,1.0.0) + +######################################## @@ -2102,6 +2124,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + +dontaudit_init_read_all_script_files(kdumpgui_t) + ++userdom_dontaudit_search_admin_dir(kdumpgui_t) ++ +optional_policy(` + dev_rw_lvm_control(kdumpgui_t) +') @@ -3786,8 +3810,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.te serefpolicy-3.6.29/policy/modules/apps/sambagui.te --- nsaserefpolicy/policy/modules/apps/sambagui.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.6.29/policy/modules/apps/sambagui.te 2009-08-31 09:47:15.000000000 -0400 -@@ -0,0 +1,55 @@ ++++ serefpolicy-3.6.29/policy/modules/apps/sambagui.te 2009-08-31 10:08:12.000000000 -0400 +@@ -0,0 +1,56 @@ +policy_module(sambagui,1.0.0) + +######################################## @@ -3797,7 +3821,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + +type sambagui_t; +type sambagui_exec_t; -+ +dbus_system_domain(sambagui_t, sambagui_exec_t) + +######################################## @@ -3836,6 +3859,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +dev_dontaudit_read_urand(sambagui_t) +nscd_dontaudit_search_pid(sambagui_t) + ++userdom_dontaudit_search_admin_dir(sambagui_t) ++ +optional_policy(` + consoletype_exec(sambagui_t) +') @@ -5340,7 +5365,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.6.29/policy/modules/kernel/domain.te --- nsaserefpolicy/policy/modules/kernel/domain.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.29/policy/modules/kernel/domain.te 2009-08-31 09:47:15.000000000 -0400 ++++ serefpolicy-3.6.29/policy/modules/kernel/domain.te 2009-08-31 10:41:13.000000000 -0400 @@ -5,6 +5,13 @@ # # Declarations @@ -5411,7 +5436,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # Act upon any other process. allow unconfined_domain_type domain:process ~{ transition dyntransition execmem execstack execheap }; -@@ -153,3 +174,69 @@ +@@ -153,3 +174,66 @@ # receive from all domains over labeled networking domain_all_recvfrom_all_domains(unconfined_domain_type) @@ -5438,6 +5463,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +optional_policy(` + rpm_use_fds(domain) + rpm_read_pipes(domain) ++ rpm_dontaudit_leaks(domain) ++ rpm_read_script_tmp_files(domain) +') + + @@ -5458,11 +5485,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') + +optional_policy(` -+ rpm_dontaudit_leaks(domain) -+ rpm_read_script_tmp_files(domain) -+') -+ -+optional_policy(` + ssh_rw_pipes(domain) +') + @@ -16066,7 +16088,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.29/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.29/policy/modules/services/samba.te 2009-08-31 09:47:16.000000000 -0400 ++++ serefpolicy-3.6.29/policy/modules/services/samba.te 2009-08-31 11:04:34.000000000 -0400 @@ -66,6 +66,13 @@ ## gen_tunable(samba_share_nfs, false) @@ -16211,7 +16233,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol samba_read_config(smbcontrol_t) samba_rw_var_files(smbcontrol_t) samba_search_var(smbcontrol_t) -@@ -638,6 +669,10 @@ +@@ -536,6 +567,8 @@ + + miscfiles_read_localization(smbcontrol_t) + ++userdom_use_user_terminals(smbcontrol_t) ++ + ######################################## + # + # smbmount Local policy +@@ -638,6 +671,10 @@ allow swat_t smbd_var_run_t:file { lock unlink }; @@ -16222,7 +16253,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol rw_files_pattern(swat_t, samba_etc_t, samba_etc_t) read_lnk_files_pattern(swat_t, samba_etc_t, samba_etc_t) -@@ -713,12 +748,23 @@ +@@ -713,12 +750,23 @@ kerberos_use(swat_t) ') @@ -16247,24 +16278,26 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol dontaudit winbind_t self:capability sys_tty_config; allow winbind_t self:process { signal_perms getsched setsched }; allow winbind_t self:fifo_file rw_fifo_file_perms; -@@ -866,6 +912,16 @@ +@@ -866,6 +914,18 @@ # optional_policy(` + type samba_unconfined_net_t; + domain_type(samba_unconfined_net_t) ++ domain_entry_file(samba_unconfined_net_t, samba_net_exec_t) + role system_r types samba_unconfined_net_t; + + unconfined_domain(samba_unconfined_net_t) + + manage_files_pattern(samba_unconfined_net_t, samba_etc_t, samba_secrets_t) + filetrans_pattern(samba_unconfined_net_t, samba_etc_t, samba_secrets_t, file) ++ userdom_use_user_terminals(samba_unconfined_net_t) +') + type samba_unconfined_script_t; type samba_unconfined_script_exec_t; domain_type(samba_unconfined_script_t) -@@ -876,9 +932,12 @@ +@@ -876,9 +936,12 @@ allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms; allow smbd_t samba_unconfined_script_exec_t:file ioctl;