From 2ab64bf7b4f6912174af8853e81d1b44c89f4d48 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Jun 11 2007 18:21:53 +0000 Subject: - Allow locate to lookup uid/gid --- diff --git a/policy-20070501.patch b/policy-20070501.patch index 725d236..5db74a8 100644 --- a/policy-20070501.patch +++ b/policy-20070501.patch @@ -1,6 +1,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-2.6.4/man/man8/ftpd_selinux.8 --- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/man/man8/ftpd_selinux.8 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/man/man8/ftpd_selinux.8 2007-06-11 10:47:17.000000000 -0400 @@ -12,7 +12,7 @@ .TP chcon -R -t public_content_t /var/ftp @@ -12,7 +12,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 sere .TP diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-2.6.4/policy/flask/access_vectors --- nsaserefpolicy/policy/flask/access_vectors 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/flask/access_vectors 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/flask/access_vectors 2007-06-11 10:47:17.000000000 -0400 @@ -598,6 +598,8 @@ shmempwd shmemgrp @@ -33,7 +33,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors class key diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans serefpolicy-2.6.4/policy/global_booleans --- nsaserefpolicy/policy/global_booleans 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/global_booleans 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/global_booleans 2007-06-11 10:47:17.000000000 -0400 @@ -4,7 +4,6 @@ # file should be used. # @@ -52,7 +52,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans seref ##

diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-2.6.4/policy/global_tunables --- nsaserefpolicy/policy/global_tunables 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/global_tunables 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/global_tunables 2007-06-11 10:47:17.000000000 -0400 @@ -102,12 +102,6 @@ ## gen_tunable(use_samba_home_dirs,false) @@ -81,7 +81,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.4/policy/mls --- nsaserefpolicy/policy/mls 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/mls 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/mls 2007-06-11 10:47:17.000000000 -0400 @@ -89,12 +89,14 @@ mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton } (( l1 eq l2 ) or @@ -155,7 +155,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.4 mlsconstrain association { polmatch } diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-2.6.4/policy/modules/admin/acct.te --- nsaserefpolicy/policy/modules/admin/acct.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/acct.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/acct.te 2007-06-11 10:47:17.000000000 -0400 @@ -9,6 +9,7 @@ type acct_t; type acct_exec_t; @@ -166,7 +166,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te logging_log_file(acct_data_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-2.6.4/policy/modules/admin/alsa.fc --- nsaserefpolicy/policy/modules/admin/alsa.fc 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/alsa.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/alsa.fc 2007-06-11 10:47:17.000000000 -0400 @@ -1,4 +1,7 @@ /etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0) @@ -177,7 +177,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc +/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-2.6.4/policy/modules/admin/alsa.te --- nsaserefpolicy/policy/modules/admin/alsa.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/alsa.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/alsa.te 2007-06-11 10:47:17.000000000 -0400 @@ -20,20 +20,24 @@ # Local policy # @@ -226,7 +226,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.te serefpolicy-2.6.4/policy/modules/admin/amanda.te --- nsaserefpolicy/policy/modules/admin/amanda.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/amanda.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/amanda.te 2007-06-11 10:47:17.000000000 -0400 @@ -85,7 +85,7 @@ # access to amandas data structure @@ -248,14 +248,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda. logging_log_filetrans(amanda_t,amanda_log_t,{ file dir }) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.fc serefpolicy-2.6.4/policy/modules/admin/amtu.fc --- nsaserefpolicy/policy/modules/admin/amtu.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/amtu.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/amtu.fc 2007-06-11 10:47:17.000000000 -0400 @@ -0,0 +1,3 @@ + +/usr/bin/amtu -- gen_context(system_u:object_r:amtu_exec_t,s0) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if serefpolicy-2.6.4/policy/modules/admin/amtu.if --- nsaserefpolicy/policy/modules/admin/amtu.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/amtu.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/amtu.if 2007-06-11 10:47:17.000000000 -0400 @@ -0,0 +1,53 @@ +##

+## abstract Machine Test Utility @@ -312,7 +312,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te serefpolicy-2.6.4/policy/modules/admin/amtu.te --- nsaserefpolicy/policy/modules/admin/amtu.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/amtu.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/amtu.te 2007-06-11 10:47:17.000000000 -0400 @@ -0,0 +1,57 @@ +policy_module(amtu,1.0.23) + @@ -373,7 +373,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-2.6.4/policy/modules/admin/bootloader.te --- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/bootloader.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/bootloader.te 2007-06-11 10:47:17.000000000 -0400 @@ -65,6 +65,8 @@ files_tmp_filetrans(bootloader_t,bootloader_tmp_t,{ dir file lnk_file chr_file blk_file }) # for tune2fs (cjp: ?) @@ -393,7 +393,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-2.6.4/policy/modules/admin/consoletype.te --- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/consoletype.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/consoletype.te 2007-06-11 10:47:17.000000000 -0400 @@ -8,7 +8,12 @@ type consoletype_t; @@ -427,7 +427,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-2.6.4/policy/modules/admin/dmesg.te --- nsaserefpolicy/policy/modules/admin/dmesg.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/dmesg.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/dmesg.te 2007-06-11 10:47:17.000000000 -0400 @@ -10,6 +10,7 @@ type dmesg_t; type dmesg_exec_t; @@ -438,7 +438,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.t diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-2.6.4/policy/modules/admin/kudzu.te --- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/kudzu.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/kudzu.te 2007-06-11 10:47:17.000000000 -0400 @@ -21,8 +21,8 @@ # Local policy # @@ -461,7 +461,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t init_telinit(kudzu_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-2.6.4/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/logrotate.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/logrotate.te 2007-06-11 10:47:17.000000000 -0400 @@ -75,6 +75,7 @@ mls_file_read_up(logrotate_t) mls_file_write_down(logrotate_t) @@ -472,7 +472,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota selinux_get_enforce_mode(logrotate_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-2.6.4/policy/modules/admin/logwatch.te --- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/logwatch.te 2007-06-04 13:38:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/logwatch.te 2007-06-11 10:47:17.000000000 -0400 @@ -30,7 +30,6 @@ allow logwatch_t self:process signal; allow logwatch_t self:fifo_file rw_file_perms; @@ -533,7 +533,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-2.6.4/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/netutils.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/netutils.te 2007-06-11 10:47:17.000000000 -0400 @@ -31,6 +31,7 @@ type traceroute_t; type traceroute_exec_t; @@ -544,7 +544,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-2.6.4/policy/modules/admin/prelink.te --- nsaserefpolicy/policy/modules/admin/prelink.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/prelink.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/prelink.te 2007-06-11 10:47:17.000000000 -0400 @@ -26,7 +26,7 @@ # Local policy # @@ -564,7 +564,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-2.6.4/policy/modules/admin/readahead.te --- nsaserefpolicy/policy/modules/admin/readahead.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/readahead.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/readahead.te 2007-06-11 10:47:17.000000000 -0400 @@ -18,7 +18,8 @@ # Local policy # @@ -594,7 +594,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-2.6.4/policy/modules/admin/rpm.fc --- nsaserefpolicy/policy/modules/admin/rpm.fc 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/rpm.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/rpm.fc 2007-06-11 10:47:17.000000000 -0400 @@ -21,6 +21,9 @@ /usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -607,7 +607,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-2.6.4/policy/modules/admin/rpm.if --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/rpm.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/rpm.if 2007-06-11 10:47:17.000000000 -0400 @@ -225,8 +225,29 @@ type rpm_script_tmp_t; ') @@ -688,7 +688,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-2.6.4/policy/modules/admin/rpm.te --- nsaserefpolicy/policy/modules/admin/rpm.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/rpm.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/rpm.te 2007-06-11 10:47:17.000000000 -0400 @@ -9,6 +9,8 @@ type rpm_t; type rpm_exec_t; @@ -700,7 +700,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te domain_system_change_exemption(rpm_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-2.6.4/policy/modules/admin/sudo.if --- nsaserefpolicy/policy/modules/admin/sudo.if 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/sudo.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/sudo.if 2007-06-11 10:47:17.000000000 -0400 @@ -69,7 +69,6 @@ allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms; allow $1_sudo_t self:unix_dgram_socket sendto; @@ -749,7 +749,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-2.6.4/policy/modules/admin/su.if --- nsaserefpolicy/policy/modules/admin/su.if 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/su.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/su.if 2007-06-11 10:47:17.000000000 -0400 @@ -41,12 +41,11 @@ allow $2 $1_su_t:process signal; @@ -825,7 +825,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-2.6.4/policy/modules/admin/usermanage.if --- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/usermanage.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/usermanage.if 2007-06-11 10:47:17.000000000 -0400 @@ -278,5 +278,5 @@ type crack_db_t; ') @@ -835,7 +835,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-2.6.4/policy/modules/admin/usermanage.te --- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/usermanage.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/usermanage.te 2007-06-11 10:47:17.000000000 -0400 @@ -184,7 +184,7 @@ # Groupadd local policy # @@ -997,7 +997,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-2.6.4/policy/modules/admin/vbetool.te --- nsaserefpolicy/policy/modules/admin/vbetool.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/vbetool.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/vbetool.te 2007-06-11 10:47:17.000000000 -0400 @@ -32,4 +32,5 @@ optional_policy(` @@ -1006,7 +1006,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-2.6.4/policy/modules/apps/gnome.if --- nsaserefpolicy/policy/modules/apps/gnome.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/gnome.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/gnome.if 2007-06-11 10:47:17.000000000 -0400 @@ -35,6 +35,7 @@ template(`gnome_per_role_template',` gen_require(` @@ -1062,7 +1062,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if ## This is a templated interface, and should only diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-2.6.4/policy/modules/apps/gpg.fc --- nsaserefpolicy/policy/modules/apps/gpg.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/gpg.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/gpg.fc 2007-06-11 10:47:17.000000000 -0400 @@ -7,6 +7,4 @@ /usr/lib/gnupg/.* -- gen_context(system_u:object_r:gpg_exec_t,s0) /usr/lib/gnupg/gpgkeys.* -- gen_context(system_u:object_r:gpg_helper_exec_t,s0) @@ -1072,7 +1072,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc s -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-2.6.4/policy/modules/apps/java.if --- nsaserefpolicy/policy/modules/apps/java.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/java.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/java.if 2007-06-11 10:47:17.000000000 -0400 @@ -224,3 +224,35 @@ refpolicywarn(`$0($1) has no effect in strict policy.') ') @@ -1111,7 +1111,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.if serefpolicy-2.6.4/policy/modules/apps/loadkeys.if --- nsaserefpolicy/policy/modules/apps/loadkeys.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/loadkeys.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/loadkeys.if 2007-06-11 10:47:17.000000000 -0400 @@ -11,16 +11,12 @@ ## # @@ -1180,7 +1180,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-2.6.4/policy/modules/apps/mozilla.if --- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/mozilla.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/mozilla.if 2007-06-11 10:47:17.000000000 -0400 @@ -150,6 +150,7 @@ corenet_dontaudit_tcp_bind_generic_port($1_mozilla_t) @@ -1191,8 +1191,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. dev_dontaudit_rw_dri($1_mozilla_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-2.6.4/policy/modules/apps/slocate.te --- nsaserefpolicy/policy/modules/apps/slocate.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/slocate.te 2007-05-31 10:23:55.000000000 -0400 -@@ -39,11 +39,13 @@ ++++ serefpolicy-2.6.4/policy/modules/apps/slocate.te 2007-06-11 10:47:17.000000000 -0400 +@@ -29,8 +29,11 @@ + manage_dirs_pattern(locate_t,locate_var_lib_t,locate_var_lib_t) + manage_files_pattern(locate_t,locate_var_lib_t,locate_var_lib_t) + ++auth_use_nsswitch(locate_t) ++ + kernel_read_system_state(locate_t) + kernel_dontaudit_search_sysctl(locate_t) ++kernel_dontaudit_search_key(locate_t) + + corecmd_exec_bin(locate_t) + +@@ -39,11 +42,13 @@ files_list_all(locate_t) files_getattr_all_files(locate_t) @@ -1209,7 +1221,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate. libs_use_ld_so(locate_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if serefpolicy-2.6.4/policy/modules/apps/uml.if --- nsaserefpolicy/policy/modules/apps/uml.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/uml.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/uml.if 2007-06-11 10:47:17.000000000 -0400 @@ -193,33 +193,6 @@ nis_use_ypbind($1_uml_t) ') @@ -1246,7 +1258,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if s ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-2.6.4/policy/modules/kernel/corecommands.fc --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.fc 2007-06-11 10:47:17.000000000 -0400 @@ -36,6 +36,11 @@ /etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0) /etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0) @@ -1267,15 +1279,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco /var/qmail/bin -d gen_context(system_u:object_r:bin_t,s0) /var/qmail/bin(/.*)? gen_context(system_u:object_r:bin_t,s0) -@@ -256,3 +262,5 @@ +@@ -256,3 +262,13 @@ ifdef(`distro_suse',` /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) ') +/usr/lib/vmware-tools/sbin32(/.*)? gen_context(system_u:object_r:bin_t,s0) + ++/etc/apcupsd/apccontrol -- gen_context(system_u:object_r:bin_t,s0) ++/etc/apcupsd/changeme -- gen_context(system_u:object_r:bin_t,s0) ++/etc/apcupsd/commfailure -- gen_context(system_u:object_r:bin_t,s0) ++/etc/apcupsd/commok -- gen_context(system_u:object_r:bin_t,s0) ++/etc/apcupsd/masterconnect -- gen_context(system_u:object_r:bin_t,s0) ++/etc/apcupsd/mastertimeout -- gen_context(system_u:object_r:bin_t,s0) ++/etc/apcupsd/offbattery -- gen_context(system_u:object_r:bin_t,s0) ++/etc/apcupsd/onbattery -- gen_context(system_u:object_r:bin_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-2.6.4/policy/modules/kernel/corecommands.if --- nsaserefpolicy/policy/modules/kernel/corecommands.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.if 2007-06-11 10:47:17.000000000 -0400 @@ -988,3 +988,23 @@ mmap_files_pattern($1,bin_t,exec_type) @@ -1302,7 +1322,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-2.6.4/policy/modules/kernel/corenetwork.te.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/corenetwork.te.in 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/corenetwork.te.in 2007-06-11 10:47:17.000000000 -0400 @@ -48,6 +48,11 @@ type reserved_port_t, port_type, reserved_port_type; @@ -1353,7 +1373,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-2.6.4/policy/modules/kernel/devices.fc --- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/devices.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/devices.fc 2007-06-11 10:47:17.000000000 -0400 @@ -19,6 +19,7 @@ /dev/evtchn -c gen_context(system_u:object_r:xen_device_t,s0) /dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0) @@ -1373,7 +1393,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-2.6.4/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/devices.if 2007-06-04 12:01:54.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/devices.if 2007-06-11 10:47:17.000000000 -0400 @@ -2729,6 +2729,24 @@ ######################################## @@ -1480,7 +1500,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-2.6.4/policy/modules/kernel/devices.te --- nsaserefpolicy/policy/modules/kernel/devices.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/devices.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/devices.te 2007-06-11 10:47:17.000000000 -0400 @@ -139,6 +139,12 @@ # # Type for sound devices and mixers @@ -1496,7 +1516,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-2.6.4/policy/modules/kernel/domain.if --- nsaserefpolicy/policy/modules/kernel/domain.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/domain.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/domain.if 2007-06-11 10:47:17.000000000 -0400 @@ -1254,3 +1254,21 @@ typeattribute $1 can_change_object_identity; typeattribute $1 set_curr_context; @@ -1521,7 +1541,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-2.6.4/policy/modules/kernel/domain.te --- nsaserefpolicy/policy/modules/kernel/domain.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/domain.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/domain.te 2007-06-11 10:47:17.000000000 -0400 @@ -6,6 +6,29 @@ # Declarations # @@ -1581,7 +1601,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-2.6.4/policy/modules/kernel/files.fc --- nsaserefpolicy/policy/modules/kernel/files.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/files.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/files.fc 2007-06-11 10:47:17.000000000 -0400 @@ -45,7 +45,6 @@ /etc -d gen_context(system_u:object_r:etc_t,s0) /etc/.* gen_context(system_u:object_r:etc_t,s0) @@ -1600,7 +1620,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. /etc/nologin.* -- gen_context(system_u:object_r:etc_runtime_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.6.4/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/files.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/files.if 2007-06-11 10:47:17.000000000 -0400 @@ -343,8 +343,7 @@ ######################################## @@ -1804,7 +1824,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-2.6.4/policy/modules/kernel/files.te --- nsaserefpolicy/policy/modules/kernel/files.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/files.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/files.te 2007-06-11 10:47:17.000000000 -0400 @@ -54,6 +54,7 @@ files_type(etc_t) # compatibility aliases for removed types: @@ -1815,7 +1835,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # etc_runtime_t is the type of various diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-2.6.4/policy/modules/kernel/filesystem.if --- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.if 2007-06-11 10:47:17.000000000 -0400 @@ -1096,6 +1096,24 @@ ######################################## @@ -1893,7 +1913,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.6.4/policy/modules/kernel/filesystem.te --- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.te 2007-06-11 10:47:17.000000000 -0400 @@ -54,17 +54,29 @@ type capifs_t; @@ -1955,8 +1975,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-2.6.4/policy/modules/kernel/kernel.if --- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/kernel.if 2007-05-31 10:23:55.000000000 -0400 -@@ -1848,6 +1848,26 @@ ++++ serefpolicy-2.6.4/policy/modules/kernel/kernel.if 2007-06-11 10:47:17.000000000 -0400 +@@ -333,6 +333,24 @@ + + ######################################## + ## ++## dontaudit search the kernel key ring. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`kernel_dontaudit_search_key',` ++ gen_require(` ++ type kernel_t; ++ ') ++ ++ dontaudit $1 kernel_t:key search; ++') ++ ++######################################## ++## + ## Allow link to the kernel key ring. + ## + ## +@@ -1848,6 +1866,26 @@ ######################################## ## @@ -1983,7 +2028,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ## Do not audit attempts to list unlabeled directories. ## ## -@@ -2158,9 +2178,6 @@ +@@ -2158,9 +2196,6 @@ ') allow $1 unlabeled_t:association { sendto recvfrom }; @@ -1995,7 +2040,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-2.6.4/policy/modules/kernel/kernel.te --- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/kernel.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/kernel.te 2007-06-11 10:47:17.000000000 -0400 @@ -146,6 +146,8 @@ type unlabeled_t; sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) @@ -2015,7 +2060,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-2.6.4/policy/modules/kernel/mls.if --- nsaserefpolicy/policy/modules/kernel/mls.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/mls.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/mls.if 2007-06-11 10:47:17.000000000 -0400 @@ -154,6 +154,26 @@ ######################################## ## @@ -2045,7 +2090,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-2.6.4/policy/modules/kernel/mls.te --- nsaserefpolicy/policy/modules/kernel/mls.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/mls.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/mls.te 2007-06-11 10:47:17.000000000 -0400 @@ -18,6 +18,7 @@ attribute mlsnetreadtoclr; attribute mlsnetwrite; @@ -2065,7 +2110,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te attribute privrangetrans; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-2.6.4/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/selinux.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/selinux.if 2007-06-11 10:47:17.000000000 -0400 @@ -51,6 +51,44 @@ ######################################## @@ -2113,7 +2158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-2.6.4/policy/modules/kernel/storage.if --- nsaserefpolicy/policy/modules/kernel/storage.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/storage.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/storage.if 2007-06-11 10:47:17.000000000 -0400 @@ -100,6 +100,7 @@ dev_list_all_dev_nodes($1) @@ -2132,7 +2177,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-2.6.4/policy/modules/kernel/terminal.if --- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/terminal.if 2007-06-01 09:36:15.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/terminal.if 2007-06-11 10:47:17.000000000 -0400 @@ -278,6 +278,25 @@ ######################################## @@ -2170,7 +2215,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-2.6.4/policy/modules/kernel/terminal.te --- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/terminal.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/terminal.te 2007-06-11 10:47:17.000000000 -0400 @@ -28,6 +28,7 @@ type devpts_t; files_mountpoint(devpts_t) @@ -2181,7 +2226,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.fc serefpolicy-2.6.4/policy/modules/services/aide.fc --- nsaserefpolicy/policy/modules/services/aide.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/aide.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/aide.fc 2007-06-11 10:47:17.000000000 -0400 @@ -2,5 +2,5 @@ /var/lib/aide(/.*) gen_context(system_u:object_r:aide_db_t,mls_systemhigh) @@ -2191,7 +2236,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide +/var/log/aide(/.*)? gen_context(system_u:object_r:aide_log_t,mls_systemhigh) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.te serefpolicy-2.6.4/policy/modules/services/aide.te --- nsaserefpolicy/policy/modules/services/aide.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/aide.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/aide.te 2007-06-11 10:47:17.000000000 -0400 @@ -26,7 +26,7 @@ allow aide_t self:capability { dac_override fowner }; @@ -2203,7 +2248,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide manage_files_pattern(aide_t,aide_db_t,aide_db_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.if serefpolicy-2.6.4/policy/modules/services/amavis.if --- nsaserefpolicy/policy/modules/services/amavis.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/amavis.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/amavis.if 2007-06-11 10:47:17.000000000 -0400 @@ -167,3 +167,22 @@ allow $1 amavis_var_run_t:file setattr; files_search_pids($1) @@ -2229,7 +2274,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-2.6.4/policy/modules/services/amavis.te --- nsaserefpolicy/policy/modules/services/amavis.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/amavis.te 2007-05-31 10:50:15.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/amavis.te 2007-06-11 14:09:10.000000000 -0400 @@ -170,6 +170,7 @@ optional_policy(` @@ -2240,7 +2285,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-2.6.4/policy/modules/services/apache.fc --- nsaserefpolicy/policy/modules/services/apache.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apache.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apache.fc 2007-06-11 10:47:17.000000000 -0400 @@ -1,10 +1,5 @@ # temporary hack till genhomedircon is fixed -ifdef(`targeted_policy',` @@ -2274,7 +2319,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-2.6.4/policy/modules/services/apache.if --- nsaserefpolicy/policy/modules/services/apache.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apache.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apache.if 2007-06-11 10:47:17.000000000 -0400 @@ -18,10 +18,6 @@ attribute httpd_script_exec_type; type httpd_t, httpd_suexec_t, httpd_log_t; @@ -2495,7 +2540,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-2.6.4/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apache.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apache.te 2007-06-11 10:47:17.000000000 -0400 @@ -47,6 +47,13 @@ ## Allow http daemon to tcp connect ##

@@ -2699,7 +2744,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-2.6.4/policy/modules/services/apcupsd.fc --- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apcupsd.fc 2007-06-11 10:47:17.000000000 -0400 @@ -3,3 +3,8 @@ /var/log/apcupsd\.events.* -- gen_context(system_u:object_r:apcupsd_log_t,s0) @@ -2711,7 +2756,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +/var/www/apcupsd/upsstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-2.6.4/policy/modules/services/apcupsd.if --- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apcupsd.if 2007-06-11 10:47:17.000000000 -0400 @@ -79,3 +79,25 @@ allow $1 apcupsd_log_t:dir list_dir_perms; allow $1 apcupsd_log_t:file { getattr append }; @@ -2740,7 +2785,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-2.6.4/policy/modules/services/apcupsd.te --- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apcupsd.te 2007-06-11 10:47:17.000000000 -0400 @@ -24,6 +24,7 @@ # apcupsd local policy # @@ -2789,7 +2834,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.te serefpolicy-2.6.4/policy/modules/services/arpwatch.te --- nsaserefpolicy/policy/modules/services/arpwatch.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/arpwatch.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/arpwatch.te 2007-06-11 10:47:17.000000000 -0400 @@ -28,7 +28,6 @@ allow arpwatch_t self:process signal_perms; allow arpwatch_t self:unix_dgram_socket create_socket_perms; @@ -2816,9 +2861,30 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpw ') optional_policy(` +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-2.6.4/policy/modules/services/audioentropy.te +--- nsaserefpolicy/policy/modules/services/audioentropy.te 2007-05-07 14:50:57.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/audioentropy.te 2007-06-11 14:18:22.000000000 -0400 +@@ -18,7 +18,7 @@ + # Local policy + # + +-allow entropyd_t self:capability { ipc_lock sys_admin }; ++allow entropyd_t self:capability { dac_override ipc_lock sys_admin }; + dontaudit entropyd_t self:capability sys_tty_config; + allow entropyd_t self:process signal_perms; + +@@ -32,6 +32,8 @@ + dev_read_sysfs(entropyd_t) + dev_read_urand(entropyd_t) + dev_write_urand(entropyd_t) ++dev_read_rand(entropyd_t) ++dev_write_rand(entropyd_t) + dev_read_sound(entropyd_t) + + fs_getattr_all_fs(entropyd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-2.6.4/policy/modules/services/automount.te --- nsaserefpolicy/policy/modules/services/automount.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/automount.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/automount.te 2007-06-11 10:47:17.000000000 -0400 @@ -69,6 +69,7 @@ files_mounton_all_mountpoints(automount_t) files_mount_all_file_type_fs(automount_t) @@ -2837,7 +2903,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto domain_use_interactive_fds(automount_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-2.6.4/policy/modules/services/avahi.te --- nsaserefpolicy/policy/modules/services/avahi.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/avahi.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/avahi.te 2007-06-11 10:47:17.000000000 -0400 @@ -18,7 +18,7 @@ # Local policy # @@ -2876,7 +2942,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-2.6.4/policy/modules/services/bind.fc --- nsaserefpolicy/policy/modules/services/bind.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/bind.fc 2007-06-04 14:05:52.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/bind.fc 2007-06-11 10:47:17.000000000 -0400 @@ -45,4 +45,7 @@ /var/named/chroot/var/named/slaves(/.*)? gen_context(system_u:object_r:named_cache_t,s0) /var/named/chroot/var/named/data(/.*)? gen_context(system_u:object_r:named_cache_t,s0) @@ -2887,7 +2953,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-2.6.4/policy/modules/services/bind.te --- nsaserefpolicy/policy/modules/services/bind.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/bind.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/bind.te 2007-06-11 10:47:17.000000000 -0400 @@ -236,6 +236,7 @@ corenet_tcp_sendrecv_all_nodes(ndc_t) corenet_tcp_sendrecv_all_ports(ndc_t) @@ -2898,7 +2964,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind fs_getattr_xattr_fs(ndc_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-2.6.4/policy/modules/services/clamav.te --- nsaserefpolicy/policy/modules/services/clamav.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/clamav.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/clamav.te 2007-06-11 13:36:38.000000000 -0400 @@ -126,6 +126,7 @@ amavis_read_lib_files(clamd_t) amavis_read_spool_files(clamd_t) @@ -2907,9 +2973,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam ') ######################################## +@@ -213,6 +214,9 @@ + read_files_pattern(clamscan_t,clamd_var_lib_t,clamd_var_lib_t) + allow clamscan_t clamd_var_lib_t:dir list_dir_perms; + ++init_read_utmp(clamscan_t) ++init_dontaudit_write_utmp(clamscan_t) ++ + kernel_read_kernel_sysctls(clamscan_t) + + files_read_etc_files(clamscan_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-2.6.4/policy/modules/services/consolekit.te --- nsaserefpolicy/policy/modules/services/consolekit.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/consolekit.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/consolekit.te 2007-06-11 10:47:17.000000000 -0400 @@ -10,7 +10,6 @@ type consolekit_exec_t; init_daemon_domain(consolekit_t, consolekit_exec_t) @@ -2957,7 +3033,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-2.6.4/policy/modules/services/cron.fc --- nsaserefpolicy/policy/modules/services/cron.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cron.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cron.fc 2007-06-11 10:47:17.000000000 -0400 @@ -45,3 +45,4 @@ /var/spool/fcron/systab\.orig -- gen_context(system_u:object_r:system_cron_spool_t,s0) /var/spool/fcron/systab -- gen_context(system_u:object_r:system_cron_spool_t,s0) @@ -2965,7 +3041,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron +/var/lib/misc(/.*)? gen_context(system_u:object_r:crond_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-2.6.4/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cron.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cron.if 2007-06-11 10:47:17.000000000 -0400 @@ -35,6 +35,7 @@ # template(`cron_per_role_template',` @@ -3076,7 +3152,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # fcron wants an instant update of a crontab change for the administrator diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-2.6.4/policy/modules/services/cron.te --- nsaserefpolicy/policy/modules/services/cron.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cron.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cron.te 2007-06-11 10:47:17.000000000 -0400 @@ -42,6 +42,9 @@ type cron_log_t; logging_log_file(cron_log_t) @@ -3216,7 +3292,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-2.6.4/policy/modules/services/cups.fc --- nsaserefpolicy/policy/modules/services/cups.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cups.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cups.fc 2007-06-11 10:47:17.000000000 -0400 @@ -8,6 +8,7 @@ /etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -3227,7 +3303,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-2.6.4/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cups.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cups.te 2007-06-11 10:47:17.000000000 -0400 @@ -93,8 +93,6 @@ # generic socket here until appletalk socket is available in kernels allow cupsd_t self:socket create_socket_perms; @@ -3289,7 +3365,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-2.6.4/policy/modules/services/cvs.te --- nsaserefpolicy/policy/modules/services/cvs.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cvs.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cvs.te 2007-06-11 10:47:17.000000000 -0400 @@ -16,6 +16,7 @@ type cvs_t; type cvs_exec_t; @@ -3300,7 +3376,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs. type cvs_data_t; # customizable diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-2.6.4/policy/modules/services/cyrus.te --- nsaserefpolicy/policy/modules/services/cyrus.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cyrus.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cyrus.te 2007-06-11 10:47:17.000000000 -0400 @@ -145,6 +145,7 @@ optional_policy(` @@ -3311,7 +3387,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-2.6.4/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dbus.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dbus.if 2007-06-11 10:47:17.000000000 -0400 @@ -49,6 +49,12 @@ ## # @@ -3441,7 +3517,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-2.6.4/policy/modules/services/dbus.te --- nsaserefpolicy/policy/modules/services/dbus.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dbus.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dbus.te 2007-06-11 10:47:17.000000000 -0400 @@ -40,8 +40,6 @@ # Receive notifications of policy reloads and enforcing status changes. allow system_dbusd_t self:netlink_selinux_socket { create bind read }; @@ -3472,7 +3548,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-2.6.4/policy/modules/services/dhcp.te --- nsaserefpolicy/policy/modules/services/dhcp.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dhcp.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dhcp.te 2007-06-11 10:47:17.000000000 -0400 @@ -119,6 +119,8 @@ dbus_system_bus_client_template(dhcpd,dhcpd_t) dbus_connect_system_bus(dhcpd_t) @@ -3484,7 +3560,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-2.6.4/policy/modules/services/djbdns.te --- nsaserefpolicy/policy/modules/services/djbdns.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/djbdns.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/djbdns.te 2007-06-11 10:47:17.000000000 -0400 @@ -44,4 +44,7 @@ libs_use_ld_so(djbdns_axfrdns_t) libs_use_shared_libs(djbdns_axfrdns_t) @@ -3496,7 +3572,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbd + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-2.6.4/policy/modules/services/dovecot.fc --- nsaserefpolicy/policy/modules/services/dovecot.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dovecot.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dovecot.fc 2007-06-11 10:47:17.000000000 -0400 @@ -17,10 +17,12 @@ ifdef(`distro_debian', ` @@ -3512,7 +3588,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-2.6.4/policy/modules/services/dovecot.if --- nsaserefpolicy/policy/modules/services/dovecot.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dovecot.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dovecot.if 2007-06-11 10:47:17.000000000 -0400 @@ -18,3 +18,43 @@ manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t) manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t) @@ -3559,7 +3635,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-2.6.4/policy/modules/services/dovecot.te --- nsaserefpolicy/policy/modules/services/dovecot.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dovecot.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dovecot.te 2007-06-11 10:47:17.000000000 -0400 @@ -15,6 +15,12 @@ domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t) role system_r types dovecot_auth_t; @@ -3704,7 +3780,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-2.6.4/policy/modules/services/ftp.te --- nsaserefpolicy/policy/modules/services/ftp.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ftp.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ftp.te 2007-06-11 10:47:17.000000000 -0400 @@ -168,6 +168,7 @@ libs_use_shared_libs(ftpd_t) @@ -3731,7 +3807,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. tunable_policy(`ftp_home_dir && use_nfs_home_dirs',` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-2.6.4/policy/modules/services/hal.fc --- nsaserefpolicy/policy/modules/services/hal.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/hal.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/hal.fc 2007-06-11 10:47:17.000000000 -0400 @@ -2,15 +2,20 @@ /etc/hal/device\.d/printer_remove\.hal -- gen_context(system_u:object_r:hald_exec_t,s0) /etc/hal/capability\.d/printer_update\.hal -- gen_context(system_u:object_r:hald_exec_t,s0) @@ -3760,7 +3836,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-2.6.4/policy/modules/services/hal.if --- nsaserefpolicy/policy/modules/services/hal.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/hal.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/hal.if 2007-06-11 10:47:17.000000000 -0400 @@ -208,3 +208,98 @@ files_search_pids($1) allow $1 hald_var_run_t:file rw_file_perms; @@ -3862,7 +3938,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-2.6.4/policy/modules/services/hal.te --- nsaserefpolicy/policy/modules/services/hal.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/hal.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/hal.te 2007-06-11 10:47:17.000000000 -0400 @@ -61,8 +61,6 @@ # For backwards compatibility with older kernels allow hald_t self:netlink_socket create_socket_perms; @@ -3927,7 +4003,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. dev_setattr_usbfs_files(hald_acl_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-2.6.4/policy/modules/services/inetd.te --- nsaserefpolicy/policy/modules/services/inetd.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/inetd.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/inetd.te 2007-06-11 10:47:17.000000000 -0400 @@ -135,8 +135,8 @@ mls_fd_use_all_levels(inetd_t) mls_fd_share_all_levels(inetd_t) @@ -3950,7 +4026,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet manage_dirs_pattern(inetd_child_t,inetd_child_tmp_t,inetd_child_tmp_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-2.6.4/policy/modules/services/kerberos.if --- nsaserefpolicy/policy/modules/services/kerberos.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/kerberos.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/kerberos.if 2007-06-11 10:47:17.000000000 -0400 @@ -33,43 +33,10 @@ # interface(`kerberos_use',` @@ -4099,7 +4175,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-2.6.4/policy/modules/services/kerberos.te --- nsaserefpolicy/policy/modules/services/kerberos.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/kerberos.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/kerberos.te 2007-06-11 10:47:17.000000000 -0400 @@ -5,6 +5,7 @@ # # Declarations @@ -4161,9 +4237,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb + pcscd_stream_connect(kerberosclient) + ') +') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-2.6.4/policy/modules/services/lpd.if +--- nsaserefpolicy/policy/modules/services/lpd.if 2007-05-07 14:50:57.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/lpd.if 2007-06-11 10:47:17.000000000 -0400 +@@ -394,3 +394,22 @@ + + domtrans_pattern($2, lpr_exec_t, $1_lpr_t) + ') ++ ++######################################## ++## ++## Allow the specified domain to execute lpr ++## in the caller domain. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`lpd_exec_lpr',` ++ gen_require(` ++ type lpr_exec_t; ++ ') ++ ++ can_exec($1,lpr_exec_t) ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-2.6.4/policy/modules/services/mailman.if --- nsaserefpolicy/policy/modules/services/mailman.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/mailman.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/mailman.if 2007-06-11 10:47:17.000000000 -0400 @@ -275,6 +275,25 @@ ####################################### @@ -4192,8 +4294,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-2.6.4/policy/modules/services/mta.if --- nsaserefpolicy/policy/modules/services/mta.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/mta.if 2007-05-31 10:23:55.000000000 -0400 -@@ -847,6 +847,25 @@ ++++ serefpolicy-2.6.4/policy/modules/services/mta.if 2007-06-11 10:47:17.000000000 -0400 +@@ -394,6 +394,7 @@ + allow $1 mail_spool_t:dir list_dir_perms; + create_files_pattern($1,mail_spool_t,mail_spool_t) + read_files_pattern($1,mail_spool_t,mail_spool_t) ++ append_files_pattern($1,mail_spool_t,mail_spool_t) + create_lnk_files_pattern($1,mail_spool_t,mail_spool_t) + read_lnk_files_pattern($1,mail_spool_t,mail_spool_t) + +@@ -847,6 +848,25 @@ manage_files_pattern($1,mqueue_spool_t,mqueue_spool_t) ') @@ -4221,7 +4331,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. ## Read sendmail binary. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-2.6.4/policy/modules/services/mta.te --- nsaserefpolicy/policy/modules/services/mta.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/mta.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/mta.te 2007-06-11 10:47:17.000000000 -0400 @@ -27,6 +27,7 @@ type sendmail_exec_t; @@ -4240,7 +4350,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. apache_dontaudit_append_log(system_mail_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-2.6.4/policy/modules/services/nagios.te --- nsaserefpolicy/policy/modules/services/nagios.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nagios.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nagios.te 2007-06-11 10:47:17.000000000 -0400 @@ -73,8 +73,10 @@ corenet_udp_sendrecv_all_nodes(nagios_t) corenet_tcp_sendrecv_all_ports(nagios_t) @@ -4272,7 +4382,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-2.6.4/policy/modules/services/networkmanager.fc --- nsaserefpolicy/policy/modules/services/networkmanager.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/networkmanager.fc 2007-06-04 11:34:01.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/networkmanager.fc 2007-06-11 10:47:17.000000000 -0400 @@ -1,5 +1,6 @@ /usr/(s)?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) @@ -4282,7 +4392,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw /var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-2.6.4/policy/modules/services/networkmanager.if --- nsaserefpolicy/policy/modules/services/networkmanager.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/networkmanager.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/networkmanager.if 2007-06-11 10:47:17.000000000 -0400 @@ -78,3 +78,22 @@ allow $1 NetworkManager_t:dbus send_msg; allow NetworkManager_t $1:dbus send_msg; @@ -4308,7 +4418,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-2.6.4/policy/modules/services/networkmanager.te --- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/networkmanager.te 2007-06-04 11:34:58.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/networkmanager.te 2007-06-11 10:47:17.000000000 -0400 @@ -41,6 +41,8 @@ kernel_read_kernel_sysctls(NetworkManager_t) kernel_load_module(NetworkManager_t) @@ -4320,7 +4430,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw corenet_udp_sendrecv_all_if(NetworkManager_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-2.6.4/policy/modules/services/nis.fc --- nsaserefpolicy/policy/modules/services/nis.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nis.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nis.fc 2007-06-11 10:47:17.000000000 -0400 @@ -4,6 +4,7 @@ /sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0) @@ -4331,7 +4441,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. /usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.6.4/policy/modules/services/nis.if --- nsaserefpolicy/policy/modules/services/nis.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nis.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nis.if 2007-06-11 10:47:17.000000000 -0400 @@ -48,8 +48,8 @@ corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) @@ -4345,7 +4455,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_tcp_connect_portmap_port($1) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-2.6.4/policy/modules/services/nis.te --- nsaserefpolicy/policy/modules/services/nis.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nis.te 2007-06-04 11:06:08.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nis.te 2007-06-11 10:47:17.000000000 -0400 @@ -120,6 +120,13 @@ ') @@ -4391,7 +4501,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_tcp_connect_all_ports(ypxfr_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-2.6.4/policy/modules/services/nscd.te --- nsaserefpolicy/policy/modules/services/nscd.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nscd.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nscd.te 2007-06-11 10:47:17.000000000 -0400 @@ -28,14 +28,14 @@ # Local policy # @@ -4432,8 +4542,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-2.6.4/policy/modules/services/ntp.te --- nsaserefpolicy/policy/modules/services/ntp.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ntp.te 2007-05-31 10:23:55.000000000 -0400 -@@ -137,6 +137,10 @@ ++++ serefpolicy-2.6.4/policy/modules/services/ntp.te 2007-06-11 10:47:17.000000000 -0400 +@@ -36,6 +36,7 @@ + dontaudit ntpd_t self:capability { net_admin sys_tty_config fsetid sys_nice }; + allow ntpd_t self:process { signal_perms setcap setsched setrlimit }; + allow ntpd_t self:fifo_file { read write getattr }; ++allow ntpd_t self:shm rw_shm_perms; + allow ntpd_t self:unix_dgram_socket create_socket_perms; + allow ntpd_t self:unix_stream_socket create_socket_perms; + allow ntpd_t self:tcp_socket create_stream_socket_perms; +@@ -137,6 +138,10 @@ ') optional_policy(` @@ -4446,7 +4564,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-2.6.4/policy/modules/services/oddjob.te --- nsaserefpolicy/policy/modules/services/oddjob.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/oddjob.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/oddjob.te 2007-06-11 10:47:17.000000000 -0400 @@ -27,7 +27,7 @@ # oddjob local policy # @@ -4458,7 +4576,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj allow oddjob_t self:unix_stream_socket create_stream_socket_perms; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.fc serefpolicy-2.6.4/policy/modules/services/openct.fc --- nsaserefpolicy/policy/modules/services/openct.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openct.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openct.fc 2007-06-11 10:47:17.000000000 -0400 @@ -2,6 +2,7 @@ # /usr # @@ -4469,7 +4587,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open # /var diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.if serefpolicy-2.6.4/policy/modules/services/openct.if --- nsaserefpolicy/policy/modules/services/openct.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openct.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openct.if 2007-06-11 10:47:17.000000000 -0400 @@ -1 +1,83 @@ -## Service for handling smart card readers. + @@ -4557,7 +4675,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-2.6.4/policy/modules/services/openct.te --- nsaserefpolicy/policy/modules/services/openct.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openct.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openct.te 2007-06-11 10:47:17.000000000 -0400 @@ -21,9 +21,13 @@ dontaudit openct_t self:capability sys_tty_config; allow openct_t self:process signal_perms; @@ -4583,7 +4701,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.fc serefpolicy-2.6.4/policy/modules/services/openvpn.fc --- nsaserefpolicy/policy/modules/services/openvpn.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openvpn.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openvpn.fc 2007-06-11 10:47:17.000000000 -0400 @@ -11,5 +11,5 @@ # # /var @@ -4592,9 +4710,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open -/var/run/openvpn.* -- gen_context(system_u:object_r:openvpn_var_run_t,s0) +/var/log/openvpn(/.*)? gen_context(system_u:object_r:openvpn_var_log_t,s0) +/var/run/openvpn(/.*)? gen_context(system_u:object_r:openvpn_var_run_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-2.6.4/policy/modules/services/openvpn.te +--- nsaserefpolicy/policy/modules/services/openvpn.te 2007-05-07 14:50:57.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openvpn.te 2007-06-11 14:13:06.000000000 -0400 +@@ -42,8 +42,8 @@ + allow openvpn_t openvpn_var_log_t:file manage_file_perms; + logging_log_filetrans(openvpn_t,openvpn_var_log_t,file) + +-allow openvpn_t openvpn_var_run_t:file manage_file_perms; +-files_pid_filetrans(openvpn_t, openvpn_var_run_t, file) ++manage_files_pattern(openvpn_t,openvpn_var_run_t,openvpn_var_run_t) ++files_pid_filetrans(openvpn_t, openvpn_var_run_t, { file dir }) + + kernel_read_kernel_sysctls(openvpn_t) + kernel_read_net_sysctls(openvpn_t) +@@ -66,6 +66,7 @@ + corenet_udp_bind_openvpn_port(openvpn_t) + corenet_sendrecv_openvpn_server_packets(openvpn_t) + corenet_rw_tun_tap_dev(openvpn_t) ++corenet_tcp_connect_openvpn_port(openvpn_t) + + dev_search_sysfs(openvpn_t) + dev_read_rand(openvpn_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-2.6.4/policy/modules/services/pcscd.te --- nsaserefpolicy/policy/modules/services/pcscd.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pcscd.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/pcscd.te 2007-06-11 10:47:17.000000000 -0400 @@ -21,6 +21,7 @@ # @@ -4619,7 +4759,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcsc + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-2.6.4/policy/modules/services/pegasus.if --- nsaserefpolicy/policy/modules/services/pegasus.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pegasus.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/pegasus.if 2007-06-11 10:47:17.000000000 -0400 @@ -1 +1,19 @@ ## The Open Group Pegasus CIM/WBEM Server. + @@ -4642,7 +4782,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-2.6.4/policy/modules/services/pegasus.te --- nsaserefpolicy/policy/modules/services/pegasus.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pegasus.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/pegasus.te 2007-06-11 10:47:17.000000000 -0400 @@ -38,8 +38,6 @@ allow pegasus_t self:unix_stream_socket create_stream_socket_perms; allow pegasus_t self:tcp_socket create_stream_socket_perms; @@ -4686,7 +4826,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-2.6.4/policy/modules/services/postfix.if --- nsaserefpolicy/policy/modules/services/postfix.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/postfix.if 2007-06-04 13:44:08.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/postfix.if 2007-06-11 10:47:17.000000000 -0400 @@ -137,10 +137,8 @@ corenet_tcp_connect_all_ports(postfix_$1_t) corenet_sendrecv_all_client_packets(postfix_$1_t) @@ -4750,7 +4890,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-2.6.4/policy/modules/services/postfix.te --- nsaserefpolicy/policy/modules/services/postfix.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/postfix.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/postfix.te 2007-06-11 10:47:17.000000000 -0400 @@ -169,12 +169,18 @@ mta_rw_aliases(postfix_master_t) mta_read_sendmail_bin(postfix_master_t) @@ -4883,7 +5023,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-2.6.4/policy/modules/services/ppp.te --- nsaserefpolicy/policy/modules/services/ppp.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ppp.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ppp.te 2007-06-11 10:47:17.000000000 -0400 @@ -155,7 +155,7 @@ files_exec_etc_files(pppd_t) @@ -4895,7 +5035,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. # for scripts diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-2.6.4/policy/modules/services/procmail.te --- nsaserefpolicy/policy/modules/services/procmail.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/procmail.te 2007-06-04 13:43:52.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/procmail.te 2007-06-11 10:47:17.000000000 -0400 @@ -10,6 +10,7 @@ type procmail_exec_t; domain_type(procmail_t) @@ -4933,7 +5073,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-2.6.4/policy/modules/services/pyzor.te --- nsaserefpolicy/policy/modules/services/pyzor.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pyzor.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/pyzor.te 2007-06-11 10:47:17.000000000 -0400 @@ -54,6 +54,11 @@ corenet_udp_sendrecv_all_nodes(pyzor_t) corenet_udp_sendrecv_all_ports(pyzor_t) @@ -4964,7 +5104,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-2.6.4/policy/modules/services/radius.te --- nsaserefpolicy/policy/modules/services/radius.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/radius.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/radius.te 2007-06-11 10:47:17.000000000 -0400 @@ -130,3 +130,7 @@ optional_policy(` udev_read_db(radiusd_t) @@ -4973,9 +5113,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi +optional_policy(` + samba_read_var_files(radiusd_t) +') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-2.6.4/policy/modules/services/rhgb.te +--- nsaserefpolicy/policy/modules/services/rhgb.te 2007-05-07 14:51:01.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rhgb.te 2007-06-11 10:47:17.000000000 -0400 +@@ -105,6 +105,7 @@ + + userdom_dontaudit_use_unpriv_user_fds(rhgb_t) + userdom_dontaudit_search_sysadm_home_dirs(rhgb_t) ++userdom_dontaudit_search_all_users_home_content(rhgb_t) + + xserver_read_xdm_xserver_tmp_files(rhgb_t) + xserver_kill_xdm_xserver(rhgb_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-2.6.4/policy/modules/services/rlogin.te --- nsaserefpolicy/policy/modules/services/rlogin.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rlogin.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rlogin.te 2007-06-11 10:47:17.000000000 -0400 @@ -64,6 +64,7 @@ fs_search_auto_mountpoints(rlogind_t) @@ -4986,7 +5137,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.fc serefpolicy-2.6.4/policy/modules/services/rpcbind.fc --- nsaserefpolicy/policy/modules/services/rpcbind.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpcbind.fc 2007-06-11 10:47:17.000000000 -0400 @@ -0,0 +1,6 @@ + +/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0) @@ -4996,7 +5147,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb +/var/lib/rpcbind(/.*)? gen_context(system_u:object_r:rpcbind_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-2.6.4/policy/modules/services/rpcbind.if --- nsaserefpolicy/policy/modules/services/rpcbind.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpcbind.if 2007-06-11 10:47:17.000000000 -0400 @@ -0,0 +1,104 @@ + +## policy for rpcbind @@ -5104,7 +5255,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-2.6.4/policy/modules/services/rpcbind.te --- nsaserefpolicy/policy/modules/services/rpcbind.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpcbind.te 2007-06-11 10:47:17.000000000 -0400 @@ -0,0 +1,83 @@ +policy_module(rpcbind,1.0.0) + @@ -5191,7 +5342,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-2.6.4/policy/modules/services/rpc.if --- nsaserefpolicy/policy/modules/services/rpc.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rpc.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpc.if 2007-06-11 10:47:17.000000000 -0400 @@ -89,8 +89,11 @@ # bind to arbitary unused ports corenet_tcp_bind_generic_port($1_t) @@ -5207,7 +5358,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. fs_search_auto_mountpoints($1_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-2.6.4/policy/modules/services/rpc.te --- nsaserefpolicy/policy/modules/services/rpc.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rpc.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpc.te 2007-06-11 10:47:17.000000000 -0400 @@ -79,6 +79,7 @@ optional_policy(` @@ -5226,7 +5377,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. tunable_policy(`nfs_export_all_ro',` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-2.6.4/policy/modules/services/rsync.te --- nsaserefpolicy/policy/modules/services/rsync.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rsync.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rsync.te 2007-06-11 10:47:17.000000000 -0400 @@ -17,6 +17,7 @@ type rsync_t; type rsync_exec_t; @@ -5237,7 +5388,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn type rsync_data_t; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-2.6.4/policy/modules/services/rwho.if --- nsaserefpolicy/policy/modules/services/rwho.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rwho.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rwho.if 2007-06-11 10:47:17.000000000 -0400 @@ -1 +1,84 @@ -## Who is logged in on other machines? + @@ -5326,7 +5477,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-2.6.4/policy/modules/services/samba.fc --- nsaserefpolicy/policy/modules/services/samba.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/samba.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/samba.fc 2007-06-11 10:47:17.000000000 -0400 @@ -3,6 +3,7 @@ # /etc # @@ -5347,7 +5498,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-2.6.4/policy/modules/services/samba.if --- nsaserefpolicy/policy/modules/services/samba.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/samba.if 2007-06-04 12:15:43.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/samba.if 2007-06-11 10:47:17.000000000 -0400 @@ -177,6 +177,27 @@ ######################################## @@ -5512,7 +5663,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-2.6.4/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/samba.te 2007-06-04 11:26:12.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/samba.te 2007-06-11 10:47:17.000000000 -0400 @@ -28,6 +28,35 @@ ## gen_tunable(samba_share_nfs,false) @@ -5566,6 +5717,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb sysnet_read_config(samba_net_t) sysnet_use_ldap(samba_net_t) +@@ -191,7 +223,7 @@ + allow smbd_t self:msgq create_msgq_perms; + allow smbd_t self:sem create_sem_perms; + allow smbd_t self:shm create_shm_perms; +-allow smbd_t self:sock_file read_file_perms; ++allow smbd_t self:sock_file read_sock_file_perms; + allow smbd_t self:tcp_socket create_stream_socket_perms; + allow smbd_t self:udp_socket create_socket_perms; + allow smbd_t self:unix_dgram_socket { create_socket_perms sendto }; @@ -200,9 +232,8 @@ allow smbd_t samba_etc_t:file { rw_file_perms setattr }; @@ -5578,7 +5738,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow smbd_t samba_log_t:dir setattr; dontaudit smbd_t samba_log_t:dir remove_name; -@@ -256,6 +287,9 @@ +@@ -231,7 +262,8 @@ + manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t) + files_pid_filetrans(smbd_t,smbd_var_run_t,file) + +-allow smbd_t winbind_var_run_t:sock_file { read write getattr }; ++allow smbd_t winbind_var_run_t:sock_file rw_sock_file_perms; ++read_files_pattern(smbd_t,winbind_tmp_t,winbind_tmp_t) + + kernel_getattr_core_if(smbd_t) + kernel_getattr_message_if(smbd_t) +@@ -256,6 +288,9 @@ corenet_tcp_connect_ipp_port(smbd_t) corenet_tcp_connect_smbd_port(smbd_t) @@ -5588,7 +5758,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb dev_read_sysfs(smbd_t) dev_read_urand(smbd_t) dev_getattr_mtrr_dev(smbd_t) -@@ -265,11 +299,13 @@ +@@ -265,11 +300,13 @@ fs_get_xattr_fs_quotas(smbd_t) fs_search_auto_mountpoints(smbd_t) fs_getattr_rpc_dirs(smbd_t) @@ -5602,7 +5772,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb files_list_var_lib(smbd_t) files_read_etc_files(smbd_t) -@@ -296,6 +332,12 @@ +@@ -296,6 +333,12 @@ userdom_dontaudit_use_unpriv_user_fds(smbd_t) userdom_use_unpriv_users_fds(smbd_t) @@ -5615,7 +5785,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ifdef(`hide_broken_symptoms', ` files_dontaudit_getattr_default_dirs(smbd_t) files_dontaudit_getattr_boot_dirs(smbd_t) -@@ -339,6 +381,23 @@ +@@ -319,6 +362,10 @@ + ') + + optional_policy(` ++ lpd_exec_lpr(smbd_t) ++') ++ ++optional_policy(` + cups_read_rw_config(smbd_t) + cups_stream_connect(smbd_t) + ') +@@ -339,6 +386,23 @@ udev_read_db(smbd_t) ') @@ -5639,7 +5820,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ######################################## # # nmbd Local policy -@@ -362,9 +421,12 @@ +@@ -352,7 +416,7 @@ + allow nmbd_t self:msgq create_msgq_perms; + allow nmbd_t self:sem create_sem_perms; + allow nmbd_t self:shm create_shm_perms; +-allow nmbd_t self:sock_file read_file_perms; ++allow nmbd_t self:sock_file read_sock_file_perms; + allow nmbd_t self:tcp_socket create_stream_socket_perms; + allow nmbd_t self:udp_socket create_socket_perms; + allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto }; +@@ -362,9 +426,12 @@ files_pid_filetrans(nmbd_t,nmbd_var_run_t,file) read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t) @@ -5653,7 +5843,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb read_files_pattern(nmbd_t,samba_log_t,samba_log_t) create_files_pattern(nmbd_t,samba_log_t,samba_log_t) allow nmbd_t samba_log_t:dir setattr; -@@ -391,6 +453,7 @@ +@@ -391,6 +458,7 @@ corenet_udp_bind_nmbd_port(nmbd_t) corenet_sendrecv_nmbd_server_packets(nmbd_t) corenet_sendrecv_nmbd_client_packets(nmbd_t) @@ -5661,7 +5851,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb dev_read_sysfs(nmbd_t) dev_getattr_mtrr_dev(nmbd_t) -@@ -457,6 +520,7 @@ +@@ -457,6 +525,7 @@ allow smbmount_t samba_secrets_t:file manage_file_perms; @@ -5669,7 +5859,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow smbmount_t samba_var_t:dir rw_dir_perms; manage_files_pattern(smbmount_t,samba_var_t,samba_var_t) manage_lnk_files_pattern(smbmount_t,samba_var_t,samba_var_t) -@@ -514,7 +578,7 @@ +@@ -514,7 +583,7 @@ userdom_use_sysadm_ttys(smbmount_t) optional_policy(` @@ -5678,7 +5868,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') optional_policy(` -@@ -534,7 +598,6 @@ +@@ -534,7 +603,6 @@ allow swat_t self:process signal_perms; allow swat_t self:fifo_file rw_file_perms; allow swat_t self:netlink_tcpdiag_socket r_netlink_socket_perms; @@ -5686,7 +5876,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow swat_t self:tcp_socket create_stream_socket_perms; allow swat_t self:udp_socket create_socket_perms; allow swat_t self:netlink_route_socket r_netlink_socket_perms; -@@ -625,6 +688,8 @@ +@@ -625,6 +693,8 @@ # Winbind local policy # @@ -5695,7 +5885,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb dontaudit winbind_t self:capability sys_tty_config; allow winbind_t self:process signal_perms; allow winbind_t self:fifo_file { read write }; -@@ -634,10 +699,15 @@ +@@ -634,10 +704,15 @@ allow winbind_t self:tcp_socket create_stream_socket_perms; allow winbind_t self:udp_socket create_socket_perms; @@ -5711,7 +5901,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb manage_files_pattern(winbind_t,samba_etc_t,samba_secrets_t) filetrans_pattern(winbind_t,samba_etc_t,samba_secrets_t,file) -@@ -645,6 +715,8 @@ +@@ -645,6 +720,8 @@ manage_files_pattern(winbind_t,samba_log_t,samba_log_t) manage_lnk_files_pattern(winbind_t,samba_log_t,samba_log_t) @@ -5720,7 +5910,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb manage_files_pattern(winbind_t,samba_var_t,samba_var_t) manage_lnk_files_pattern(winbind_t,samba_var_t,samba_var_t) -@@ -736,6 +808,7 @@ +@@ -736,6 +813,7 @@ read_files_pattern(winbind_helper_t,samba_etc_t,samba_etc_t) read_lnk_files_pattern(winbind_helper_t,samba_etc_t,samba_etc_t) @@ -5728,7 +5918,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow winbind_helper_t samba_var_t:dir search; stream_connect_pattern(winbind_helper_t,winbind_var_run_t,winbind_var_run_t,winbind_t) -@@ -764,3 +837,23 @@ +@@ -764,3 +842,23 @@ squid_read_log(winbind_helper_t) squid_append_log(winbind_helper_t) ') @@ -5754,7 +5944,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +unconfined_domain(samba_unconfined_script_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-2.6.4/policy/modules/services/sasl.te --- nsaserefpolicy/policy/modules/services/sasl.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/sasl.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/sasl.te 2007-06-11 10:47:20.000000000 -0400 @@ -63,6 +63,7 @@ selinux_compute_access_vector(saslauthd_t) @@ -5763,17 +5953,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl auth_use_nsswitch(saslauthd_t) domain_use_interactive_fds(saslauthd_t) -@@ -79,6 +80,7 @@ +@@ -79,7 +80,7 @@ libs_use_shared_libs(saslauthd_t) logging_send_syslog_msg(saslauthd_t) +- +logging_send_audit_msg(saslauthd_t) - miscfiles_read_localization(saslauthd_t) miscfiles_read_certs(saslauthd_t) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-2.6.4/policy/modules/services/sendmail.if --- nsaserefpolicy/policy/modules/services/sendmail.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/sendmail.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/sendmail.if 2007-06-11 10:47:17.000000000 -0400 @@ -76,6 +76,26 @@ ######################################## @@ -5812,7 +6003,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-2.6.4/policy/modules/services/setroubleshoot.te --- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/setroubleshoot.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/setroubleshoot.te 2007-06-11 10:47:17.000000000 -0400 @@ -28,7 +28,7 @@ # @@ -5824,7 +6015,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto }; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-2.6.4/policy/modules/services/smartmon.te --- nsaserefpolicy/policy/modules/services/smartmon.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/smartmon.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/smartmon.te 2007-06-11 10:47:17.000000000 -0400 @@ -60,6 +60,7 @@ fs_search_auto_mountpoints(fsdaemon_t) @@ -5835,7 +6026,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar storage_raw_write_fixed_disk(fsdaemon_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-2.6.4/policy/modules/services/snmp.fc --- nsaserefpolicy/policy/modules/services/snmp.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/snmp.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/snmp.fc 2007-06-11 10:47:17.000000000 -0400 @@ -1,11 +1,5 @@ # @@ -5850,7 +6041,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp /usr/sbin/snmp(trap)?d -- gen_context(system_u:object_r:snmpd_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-2.6.4/policy/modules/services/snmp.te --- nsaserefpolicy/policy/modules/services/snmp.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/snmp.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/snmp.te 2007-06-11 10:47:17.000000000 -0400 @@ -9,9 +9,6 @@ type snmpd_exec_t; init_daemon_domain(snmpd_t,snmpd_exec_t) @@ -5903,7 +6094,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-2.6.4/policy/modules/services/spamassassin.if --- nsaserefpolicy/policy/modules/services/spamassassin.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/spamassassin.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/spamassassin.if 2007-06-11 10:47:17.000000000 -0400 @@ -466,6 +466,7 @@ ') @@ -5914,7 +6105,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.6.4/policy/modules/services/spamassassin.te --- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/spamassassin.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/spamassassin.te 2007-06-11 10:47:17.000000000 -0400 @@ -6,14 +6,12 @@ # Declarations # @@ -5970,7 +6161,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-2.6.4/policy/modules/services/squid.fc --- nsaserefpolicy/policy/modules/services/squid.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/squid.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/squid.fc 2007-06-11 10:47:17.000000000 -0400 @@ -12,3 +12,5 @@ /var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0) @@ -5979,7 +6170,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-2.6.4/policy/modules/services/squid.te --- nsaserefpolicy/policy/modules/services/squid.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/squid.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/squid.te 2007-06-11 10:47:17.000000000 -0400 @@ -185,3 +185,12 @@ #squid requires the following when run in diskd mode, the recommended setting allow squid_t tmpfs_t:file { read write }; @@ -5995,7 +6186,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-2.6.4/policy/modules/services/ssh.if --- nsaserefpolicy/policy/modules/services/ssh.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ssh.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ssh.if 2007-06-11 10:47:17.000000000 -0400 @@ -709,3 +709,42 @@ dontaudit $1 sshd_key_t:file { getattr read }; @@ -6041,7 +6232,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-2.6.4/policy/modules/services/ssh.te --- nsaserefpolicy/policy/modules/services/ssh.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ssh.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ssh.te 2007-06-11 10:47:17.000000000 -0400 @@ -24,11 +24,11 @@ # Type for the ssh-agent executable. @@ -6077,7 +6268,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. # Relabel and access ptys created by sshd diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-2.6.4/policy/modules/services/tftp.te --- nsaserefpolicy/policy/modules/services/tftp.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/tftp.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/tftp.te 2007-06-11 10:47:17.000000000 -0400 @@ -69,6 +69,7 @@ logging_send_syslog_msg(tftpd_t) @@ -6093,18 +6284,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-2.6.4/policy/modules/services/w3c.fc --- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/w3c.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/w3c.fc 2007-06-11 10:47:17.000000000 -0400 @@ -0,0 +1,2 @@ +/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0) +/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-2.6.4/policy/modules/services/w3c.if --- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/w3c.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/w3c.if 2007-06-11 10:47:17.000000000 -0400 @@ -0,0 +1 @@ +## W3C diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-2.6.4/policy/modules/services/w3c.te --- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/w3c.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/w3c.te 2007-06-11 10:47:17.000000000 -0400 @@ -0,0 +1,14 @@ +policy_module(w3c,1.2.1) + @@ -6122,7 +6313,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c. +miscfiles_read_certs(httpd_w3c_validator_script_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-2.6.4/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/xserver.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/xserver.if 2007-06-11 10:47:17.000000000 -0400 @@ -1136,7 +1136,7 @@ type xdm_xserver_tmp_t; ') @@ -6134,12 +6325,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-2.6.4/policy/modules/system/application.fc --- nsaserefpolicy/policy/modules/system/application.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/application.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/application.fc 2007-06-11 10:47:17.000000000 -0400 @@ -0,0 +1 @@ +# No application file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-2.6.4/policy/modules/system/application.if --- nsaserefpolicy/policy/modules/system/application.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/application.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/application.if 2007-06-11 10:47:17.000000000 -0400 @@ -0,0 +1,104 @@ +## Policy for application domains + @@ -6247,7 +6438,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-2.6.4/policy/modules/system/application.te --- nsaserefpolicy/policy/modules/system/application.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/application.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/application.te 2007-06-11 10:47:18.000000000 -0400 @@ -0,0 +1,14 @@ + +policy_module(application,1.0.0) @@ -6265,7 +6456,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-2.6.4/policy/modules/system/authlogin.fc --- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/authlogin.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/authlogin.fc 2007-06-11 10:47:18.000000000 -0400 @@ -14,6 +14,7 @@ /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0) /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) @@ -6276,7 +6467,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-2.6.4/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/authlogin.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/authlogin.if 2007-06-11 10:47:18.000000000 -0400 @@ -27,11 +27,9 @@ domain_type($1_chkpwd_t) domain_entry_file($1_chkpwd_t,chkpwd_exec_t) @@ -6290,7 +6481,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo files_list_etc($1_chkpwd_t) allow $1_chkpwd_t shadow_t:file { getattr read }; -@@ -53,6 +51,7 @@ +@@ -53,9 +51,12 @@ libs_use_shared_libs($1_chkpwd_t) logging_send_syslog_msg($1_chkpwd_t) @@ -6298,7 +6489,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo miscfiles_read_localization($1_chkpwd_t) -@@ -109,7 +108,8 @@ ++ selinux_get_fs_mount($1_chkpwd_t) ++ + seutil_read_config($1_chkpwd_t) + + optional_policy(` +@@ -109,7 +110,8 @@ role $3 types system_chkpwd_t; # cjp: is this really needed? @@ -6308,7 +6504,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo dontaudit $2 shadow_t:file { getattr read }; -@@ -152,21 +152,12 @@ +@@ -152,21 +154,12 @@ ## # template(`auth_domtrans_user_chk_passwd',` @@ -6335,7 +6531,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') ######################################## -@@ -180,6 +171,9 @@ +@@ -180,6 +173,9 @@ ## # interface(`auth_login_pgm_domain',` @@ -6345,7 +6541,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo domain_type($1) domain_subj_id_change_exemption($1) -@@ -187,6 +181,11 @@ +@@ -187,6 +183,11 @@ domain_obj_id_change_exemption($1) role system_r types $1; @@ -6357,7 +6553,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo # for SSP/ProPolice dev_read_urand($1) -@@ -211,9 +210,11 @@ +@@ -211,9 +212,11 @@ auth_read_login_records($1) auth_append_login_records($1) auth_rw_lastlog($1) @@ -6370,7 +6566,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo init_rw_utmp($1) logging_send_syslog_msg($1) -@@ -221,6 +222,7 @@ +@@ -221,6 +224,7 @@ seutil_read_config($1) seutil_read_default_contexts($1) @@ -6378,7 +6574,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo tunable_policy(`allow_polyinstantiation',` files_polyinstantiate_all($1) ') -@@ -320,10 +322,6 @@ +@@ -320,10 +324,6 @@ type system_chkpwd_t, chkpwd_exec_t, shadow_t; ') @@ -6389,7 +6585,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo corecmd_search_bin($1) domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t) -@@ -357,6 +355,37 @@ +@@ -357,6 +357,37 @@ ######################################## ## @@ -6427,7 +6623,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ## Get the attributes of the shadow passwords file. ## ## -@@ -1391,3 +1420,114 @@ +@@ -1391,3 +1422,114 @@ typeattribute $1 can_write_shadow_passwords; typeattribute $1 can_relabelto_shadow_passwords; ') @@ -6544,7 +6740,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-2.6.4/policy/modules/system/authlogin.te --- nsaserefpolicy/policy/modules/system/authlogin.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/authlogin.te 2007-06-04 11:27:40.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/authlogin.te 2007-06-11 10:47:18.000000000 -0400 @@ -9,6 +9,13 @@ attribute can_read_shadow_passwords; attribute can_write_shadow_passwords; @@ -6627,7 +6823,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-2.6.4/policy/modules/system/clock.te --- nsaserefpolicy/policy/modules/system/clock.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/clock.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/clock.te 2007-06-11 10:47:18.000000000 -0400 @@ -26,8 +26,6 @@ allow hwclock_t self:process signal_perms; allow hwclock_t self:fifo_file { getattr read write }; @@ -6653,7 +6849,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-2.6.4/policy/modules/system/fstools.fc --- nsaserefpolicy/policy/modules/system/fstools.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/fstools.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fstools.fc 2007-06-11 10:47:18.000000000 -0400 @@ -19,7 +19,6 @@ /sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0) @@ -6664,7 +6860,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-2.6.4/policy/modules/system/fstools.if --- nsaserefpolicy/policy/modules/system/fstools.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/fstools.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fstools.if 2007-06-11 10:47:18.000000000 -0400 @@ -124,3 +124,22 @@ allow $1 swapfile_t:file getattr; @@ -6690,7 +6886,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-2.6.4/policy/modules/system/fstools.te --- nsaserefpolicy/policy/modules/system/fstools.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/fstools.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fstools.te 2007-06-11 10:47:18.000000000 -0400 @@ -9,6 +9,7 @@ type fsadm_t; type fsadm_exec_t; @@ -6701,7 +6897,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool type fsadm_log_t; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-2.6.4/policy/modules/system/fusermount.fc --- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/fusermount.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fusermount.fc 2007-06-11 10:47:18.000000000 -0400 @@ -0,0 +1,6 @@ +# fusermount executable will have: +# label: system_u:object_r:fusermount_exec_t @@ -6711,7 +6907,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm +/usr/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-2.6.4/policy/modules/system/fusermount.if --- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/fusermount.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fusermount.if 2007-06-11 10:47:18.000000000 -0400 @@ -0,0 +1,41 @@ +## policy for fusermount + @@ -6757,7 +6953,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm \ No newline at end of file diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-2.6.4/policy/modules/system/fusermount.te --- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/fusermount.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fusermount.te 2007-06-11 10:47:18.000000000 -0400 @@ -0,0 +1,51 @@ +policy_module(fusermount,1.0.0) + @@ -6812,7 +7008,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-2.6.4/policy/modules/system/getty.te --- nsaserefpolicy/policy/modules/system/getty.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/getty.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/getty.te 2007-06-11 10:47:18.000000000 -0400 @@ -33,7 +33,8 @@ # @@ -6825,7 +7021,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty. allow getty_t self:fifo_file rw_fifo_file_perms; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-2.6.4/policy/modules/system/hostname.te --- nsaserefpolicy/policy/modules/system/hostname.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/hostname.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/hostname.te 2007-06-11 10:47:18.000000000 -0400 @@ -8,8 +8,12 @@ type hostname_t; @@ -6854,7 +7050,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-2.6.4/policy/modules/system/init.if --- nsaserefpolicy/policy/modules/system/init.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/init.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/init.if 2007-06-11 10:47:18.000000000 -0400 @@ -194,11 +194,14 @@ gen_require(` type initrc_t; @@ -6879,6 +7075,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## +@@ -1248,7 +1251,7 @@ + type initrc_var_run_t; + ') + +- dontaudit $1 initrc_var_run_t:file { getattr read write append }; ++ dontaudit $1 initrc_var_run_t:file rw_file_perms; + ') + + ######################################## @@ -1269,3 +1272,42 @@ files_search_pids($1) allow $1 initrc_var_run_t:file manage_file_perms; @@ -6924,7 +7129,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-2.6.4/policy/modules/system/init.te --- nsaserefpolicy/policy/modules/system/init.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/init.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/init.te 2007-06-11 10:47:18.000000000 -0400 @@ -10,13 +10,20 @@ # Declarations # @@ -7025,7 +7230,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-2.6.4/policy/modules/system/ipsec.if --- nsaserefpolicy/policy/modules/system/ipsec.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/ipsec.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/ipsec.if 2007-06-11 10:47:18.000000000 -0400 @@ -114,6 +114,26 @@ ######################################## @@ -7055,7 +7260,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-2.6.4/policy/modules/system/ipsec.te --- nsaserefpolicy/policy/modules/system/ipsec.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/ipsec.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/ipsec.te 2007-06-11 10:47:18.000000000 -0400 @@ -289,6 +289,7 @@ allow racoon_t self:netlink_selinux_socket { bind create read }; allow racoon_t self:udp_socket create_socket_perms; @@ -7066,7 +7271,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-2.6.4/policy/modules/system/iptables.te --- nsaserefpolicy/policy/modules/system/iptables.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/iptables.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/iptables.te 2007-06-11 10:47:18.000000000 -0400 @@ -56,6 +56,7 @@ domain_use_interactive_fds(iptables_t) @@ -7085,7 +7290,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-2.6.4/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/libraries.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/libraries.fc 2007-06-11 10:47:18.000000000 -0400 @@ -81,8 +81,8 @@ /opt/cisco-vpnclient/lib/libvpnapi\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) /opt/netbeans(.*/)?jdk.*/linux/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -7116,7 +7321,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar /usr/lib(64)?/libGLU\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-2.6.4/policy/modules/system/libraries.te --- nsaserefpolicy/policy/modules/system/libraries.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/libraries.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/libraries.te 2007-06-11 10:47:18.000000000 -0400 @@ -62,7 +62,8 @@ manage_dirs_pattern(ldconfig_t,ldconfig_tmp_t,ldconfig_tmp_t) @@ -7139,7 +7344,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-2.6.4/policy/modules/system/locallogin.te --- nsaserefpolicy/policy/modules/system/locallogin.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/locallogin.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/locallogin.te 2007-06-11 10:47:18.000000000 -0400 @@ -48,6 +48,8 @@ allow local_login_t self:msgq create_msgq_perms; allow local_login_t self:msg { send receive }; @@ -7182,7 +7387,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-2.6.4/policy/modules/system/logging.if --- nsaserefpolicy/policy/modules/system/logging.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/logging.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/logging.if 2007-06-11 10:47:18.000000000 -0400 @@ -223,6 +223,25 @@ ######################################## @@ -7377,7 +7582,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-2.6.4/policy/modules/system/logging.te --- nsaserefpolicy/policy/modules/system/logging.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/logging.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/logging.te 2007-06-11 10:47:18.000000000 -0400 @@ -7,10 +7,15 @@ # @@ -7465,7 +7670,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin files_dontaudit_search_isid_type_dirs(syslogd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-2.6.4/policy/modules/system/lvm.fc --- nsaserefpolicy/policy/modules/system/lvm.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/lvm.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/lvm.fc 2007-06-11 10:47:18.000000000 -0400 @@ -15,6 +15,7 @@ # /etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0) @@ -7476,7 +7681,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc /etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-2.6.4/policy/modules/system/lvm.te --- nsaserefpolicy/policy/modules/system/lvm.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/lvm.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/lvm.te 2007-06-11 10:47:18.000000000 -0400 @@ -16,6 +16,7 @@ type lvm_t; type lvm_exec_t; @@ -7496,7 +7701,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te dontaudit lvm_t self:capability sys_tty_config; allow lvm_t self:process { sigchld sigkill sigstop signull signal }; # LVM will complain a lot if it cannot set its priority. -@@ -233,6 +236,8 @@ +@@ -165,6 +168,7 @@ + allow lvm_t self:unix_dgram_socket create_socket_perms; + allow lvm_t self:netlink_kobject_uevent_socket create_socket_perms; + ++allow lvm_t self:unix_stream_socket { connectto create_stream_socket_perms }; + allow lvm_t clvmd_t:unix_stream_socket connectto; + + manage_dirs_pattern(lvm_t,lvm_tmp_t,lvm_tmp_t) +@@ -233,6 +237,8 @@ dev_dontaudit_getattr_generic_blk_files(lvm_t) dev_dontaudit_getattr_generic_pipes(lvm_t) dev_create_generic_dirs(lvm_t) @@ -7505,7 +7718,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te fs_getattr_xattr_fs(lvm_t) fs_search_auto_mountpoints(lvm_t) -@@ -251,6 +256,7 @@ +@@ -251,6 +257,7 @@ storage_dev_filetrans_fixed_disk(lvm_t) # Access raw devices and old /dev/lvm (c 109,0). Is this needed? storage_manage_fixed_disk(lvm_t) @@ -7513,7 +7726,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te term_getattr_all_user_ttys(lvm_t) term_list_ptys(lvm_t) -@@ -305,5 +311,14 @@ +@@ -305,5 +312,14 @@ ') optional_policy(` @@ -7530,7 +7743,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-2.6.4/policy/modules/system/modutils.te --- nsaserefpolicy/policy/modules/system/modutils.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/modutils.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/modutils.te 2007-06-11 10:47:18.000000000 -0400 @@ -102,6 +102,7 @@ init_use_fds(insmod_t) init_use_script_fds(insmod_t) @@ -7576,7 +7789,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-2.6.4/policy/modules/system/mount.fc --- nsaserefpolicy/policy/modules/system/mount.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/mount.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/mount.fc 2007-06-11 10:47:18.000000000 -0400 @@ -1,4 +1,3 @@ /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) @@ -7585,7 +7798,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. +/sbin/mount.ntfs-3g -- gen_context(system_u:object_r:mount_ntfs_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-2.6.4/policy/modules/system/mount.if --- nsaserefpolicy/policy/modules/system/mount.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/mount.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/mount.if 2007-06-11 10:47:18.000000000 -0400 @@ -143,3 +143,40 @@ mount_domtrans($1) ') @@ -7629,7 +7842,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-2.6.4/policy/modules/system/mount.te --- nsaserefpolicy/policy/modules/system/mount.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/mount.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/mount.te 2007-06-11 10:47:18.000000000 -0400 @@ -9,6 +9,13 @@ ifdef(`targeted_policy',` ## @@ -7740,7 +7953,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-2.6.4/policy/modules/system/netlabel.te --- nsaserefpolicy/policy/modules/system/netlabel.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/netlabel.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/netlabel.te 2007-06-11 10:47:18.000000000 -0400 @@ -20,6 +20,10 @@ allow netlabel_mgmt_t self:capability net_admin; allow netlabel_mgmt_t self:netlink_socket create_socket_perms; @@ -7754,7 +7967,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlab libs_use_ld_so(netlabel_mgmt_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-2.6.4/policy/modules/system/raid.te --- nsaserefpolicy/policy/modules/system/raid.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/raid.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/raid.te 2007-06-11 10:47:18.000000000 -0400 @@ -19,7 +19,7 @@ # Local policy # @@ -7774,7 +7987,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-2.6.4/policy/modules/system/selinuxutil.fc --- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.fc 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.fc 2007-06-11 10:47:18.000000000 -0400 @@ -40,6 +40,7 @@ /usr/sbin/setfiles.* -- gen_context(system_u:object_r:setfiles_exec_t,s0) /usr/sbin/setsebool -- gen_context(system_u:object_r:semanage_exec_t,s0) @@ -7785,7 +7998,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-2.6.4/policy/modules/system/selinuxutil.if --- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.if 2007-06-11 10:47:18.000000000 -0400 @@ -445,6 +445,7 @@ role $2 types run_init_t; allow run_init_t $3:chr_file rw_term_perms; @@ -7822,7 +8035,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-2.6.4/policy/modules/system/selinuxutil.te --- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.te 2007-06-11 10:47:18.000000000 -0400 @@ -1,10 +1,8 @@ policy_module(selinuxutil,1.5.0) @@ -8038,7 +8251,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-2.6.4/policy/modules/system/sysnetwork.te --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/sysnetwork.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/sysnetwork.te 2007-06-11 13:59:52.000000000 -0400 @@ -164,6 +164,10 @@ dbus_connect_system_bus(dhcpc_t) dbus_send_system_bus(dhcpc_t) @@ -8050,7 +8263,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet optional_policy(` networkmanager_dbus_chat(dhcpc_t) ') -@@ -221,6 +225,7 @@ +@@ -211,6 +215,7 @@ + # dhclient sometimes starts ntpd + init_exec_script_files(dhcpc_t) + ntp_domtrans(dhcpc_t) ++ ntp_domtrans_ntpdate(dhcpc_t) + ') + + optional_policy(` +@@ -221,6 +226,7 @@ optional_policy(` seutil_sigchld_newrole(dhcpc_t) seutil_dontaudit_search_config(dhcpc_t) @@ -8060,8 +8281,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-2.6.4/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/udev.te 2007-06-04 09:47:27.000000000 -0400 -@@ -83,16 +83,24 @@ ++++ serefpolicy-2.6.4/policy/modules/system/udev.te 2007-06-11 14:15:24.000000000 -0400 +@@ -18,11 +18,6 @@ + type udev_etc_t alias etc_udev_t; + files_config_file(udev_etc_t) + +-# udev_runtime_t is the type of the udev table file +-# cjp: this is probably a copy of udev_tbl_t and can be removed +-type udev_runtime_t; +-files_type(udev_runtime_t) +- + type udev_tbl_t alias udev_tdb_t; + files_type(udev_tbl_t) + +@@ -69,7 +64,7 @@ + dev_filetrans(udev_t,udev_tbl_t,file) + + manage_files_pattern(udev_t,udev_var_run_t,udev_var_run_t) +-files_pid_filetrans(udev_t,udev_var_run_t,file) ++files_pid_filetrans(udev_t,udev_var_run_t,{ file dir }) + + kernel_read_system_state(udev_t) + kernel_getattr_core_if(udev_t) +@@ -83,16 +78,24 @@ kernel_dgram_send(udev_t) kernel_signal(udev_t) @@ -8086,7 +8328,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t files_read_etc_runtime_files(udev_t) files_read_etc_files(udev_t) files_exec_etc_files(udev_t) -@@ -194,5 +202,24 @@ +@@ -194,5 +197,24 @@ ') optional_policy(` @@ -8113,28 +8355,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-2.6.4/policy/modules/system/unconfined.fc --- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/unconfined.fc 2007-05-31 10:23:55.000000000 -0400 -@@ -2,12 +2,12 @@ - # e.g.: - # /usr/local/bin/appsrv -- gen_context(system_u:object_r:unconfined_exec_t,s0) - # For the time being until someone writes a sane policy, we need initrc to transition to unconfined_t --/usr/bin/vncserver -- gen_context(system_u:object_r:unconfined_exec_t,s0) -- --ifdef(`targeted_policy',` --/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) - /usr/bin/qemu.* -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) ++++ serefpolicy-2.6.4/policy/modules/system/unconfined.fc 2007-06-11 10:47:18.000000000 -0400 +@@ -10,4 +10,5 @@ /usr/bin/valgrind -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) --/usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) -+/usr/bin/vncserver -- gen_context(system_u:object_r:unconfined_exec_t,s0) + /usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) /usr/lib/ia32el/ia32x_loader -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) -+/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) -+/usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) -+ifdef(`targeted_policy',` +/usr/bin/vmware.* -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-2.6.4/policy/modules/system/unconfined.if --- nsaserefpolicy/policy/modules/system/unconfined.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/unconfined.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/unconfined.if 2007-06-11 10:47:18.000000000 -0400 @@ -18,7 +18,7 @@ ') @@ -8203,7 +8433,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-2.6.4/policy/modules/system/unconfined.te --- nsaserefpolicy/policy/modules/system/unconfined.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/unconfined.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/unconfined.te 2007-06-11 10:47:18.000000000 -0400 @@ -6,6 +6,15 @@ # Declarations # @@ -8288,8 +8518,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf init_dbus_chat_script(unconfined_execmem_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.6.4/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/userdomain.if 2007-05-31 10:23:55.000000000 -0400 -@@ -114,6 +114,18 @@ ++++ serefpolicy-2.6.4/policy/modules/system/userdomain.if 2007-06-11 10:47:18.000000000 -0400 +@@ -114,6 +114,22 @@ # Allow making the stack executable via mprotect. allow $1_t self:process execstack; ') @@ -8299,6 +8529,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + ') + + optional_policy(` ++ consolekit_dbus_chat($1_t) ++ ') ++ ++ optional_policy(` + consoletype_exec($1_t) + ') + @@ -8308,7 +8542,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ####################################### -@@ -764,6 +776,8 @@ +@@ -764,6 +780,8 @@ auth_search_pam_console_data($1_t) auth_run_pam($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) auth_run_utempter($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) @@ -8317,7 +8551,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo init_read_utmp($1_t) # The library functions always try to open read-write first, -@@ -953,6 +967,38 @@ +@@ -953,6 +971,38 @@ ## ## # @@ -8356,7 +8590,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo template(`userdom_unpriv_user_template', ` gen_require(` -@@ -979,20 +1025,13 @@ +@@ -979,20 +1029,13 @@ userdom_poly_home_template($1) userdom_poly_tmp_template($1) @@ -8380,7 +8614,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo # port access is audited even if dac would not have allowed it, so dontaudit it here corenet_dontaudit_tcp_bind_all_reserved_ports($1_t) -@@ -1059,10 +1098,6 @@ +@@ -1059,10 +1102,6 @@ dontaudit xdm_t $1_home_t:file rw_file_perms; ') @@ -8391,7 +8625,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') dnl end TODO ') -@@ -1126,7 +1161,7 @@ +@@ -1126,7 +1165,7 @@ # $1_t local policy # @@ -8400,7 +8634,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1_t self:process { setexec setfscreate }; # Set password information for other users. -@@ -1138,8 +1173,6 @@ +@@ -1138,8 +1177,6 @@ # Manipulate other users crontab. allow $1_t self:passwd crontab; @@ -8409,7 +8643,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo kernel_read_software_raid_state($1_t) kernel_getattr_core_if($1_t) kernel_getattr_message_if($1_t) -@@ -1353,11 +1386,7 @@ +@@ -1353,11 +1390,7 @@ ## # template(`userdom_role_change_generic_user',` @@ -8422,7 +8656,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1384,11 +1413,7 @@ +@@ -1384,11 +1417,7 @@ ## # template(`userdom_role_change_from_generic_user',` @@ -8435,7 +8669,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1414,11 +1439,7 @@ +@@ -1414,11 +1443,7 @@ ## # template(`userdom_role_change_staff',` @@ -8448,7 +8682,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1445,11 +1466,7 @@ +@@ -1445,11 +1470,7 @@ ## # template(`userdom_role_change_from_staff',` @@ -8461,7 +8695,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1475,11 +1492,7 @@ +@@ -1475,11 +1496,7 @@ ## # template(`userdom_role_change_sysadm',` @@ -8474,7 +8708,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1506,11 +1519,7 @@ +@@ -1506,11 +1523,7 @@ ## # template(`userdom_role_change_from_sysadm',` @@ -8487,7 +8721,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1698,13 +1707,11 @@ +@@ -1698,13 +1711,11 @@ ## # template(`userdom_setattr_user_ptys',` @@ -8505,7 +8739,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1733,13 +1740,11 @@ +@@ -1733,13 +1744,11 @@ ## # template(`userdom_create_user_pty',` @@ -8523,7 +8757,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -3624,13 +3629,12 @@ +@@ -3624,13 +3633,12 @@ template(`userdom_setattr_user_ttys',` ifdef(`targeted_policy',` term_setattr_unallocated_ttys($2) @@ -8542,7 +8776,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -3661,13 +3665,12 @@ +@@ -3661,13 +3669,12 @@ template(`userdom_use_user_ttys',` ifdef(`targeted_policy',` term_use_unallocated_ttys($2) @@ -8561,7 +8795,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -3696,18 +3699,13 @@ +@@ -3696,18 +3703,13 @@ ## # template(`userdom_use_user_terminals',` @@ -8586,7 +8820,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5353,14 +5351,13 @@ +@@ -5353,14 +5355,13 @@ interface(`userdom_use_unpriv_users_ptys',` ifdef(`targeted_policy',` term_use_generic_ptys($1) @@ -8607,7 +8841,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5377,13 +5374,13 @@ +@@ -5377,13 +5378,13 @@ interface(`userdom_dontaudit_use_unpriv_users_ptys',` ifdef(`targeted_policy',` term_dontaudit_use_generic_ptys($1) @@ -8626,7 +8860,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5436,13 +5433,12 @@ +@@ -5436,13 +5437,12 @@ interface(`userdom_list_unpriv_users_tmp',` ifdef(`targeted_policy',` files_list_tmp($1) @@ -8645,7 +8879,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5458,13 +5454,12 @@ +@@ -5458,13 +5458,12 @@ interface(`userdom_read_unpriv_users_tmp_files',` ifdef(`targeted_policy',` files_read_generic_tmp_files($1) @@ -8664,7 +8898,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5480,13 +5475,12 @@ +@@ -5480,13 +5479,12 @@ interface(`userdom_read_unpriv_users_tmp_symlinks',` ifdef(`targeted_policy',` files_read_generic_tmp_symlinks($1) @@ -8683,7 +8917,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5520,13 +5514,12 @@ +@@ -5520,13 +5518,12 @@ interface(`userdom_use_unpriv_users_ttys',` ifdef(`targeted_policy',` term_use_unallocated_ttys($1) @@ -8702,7 +8936,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5543,13 +5536,12 @@ +@@ -5543,13 +5540,12 @@ interface(`userdom_dontaudit_use_unpriv_users_ttys',` ifdef(`targeted_policy',` term_dontaudit_use_unallocated_ttys($1) @@ -8721,7 +8955,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5721,3 +5713,112 @@ +@@ -5721,3 +5717,112 @@ allow $1 user_home_dir_t:dir manage_dir_perms; files_home_filetrans($1,user_home_dir_t,dir) ') @@ -8836,7 +9070,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.6.4/policy/modules/system/userdomain.te --- nsaserefpolicy/policy/modules/system/userdomain.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/userdomain.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/userdomain.te 2007-06-11 10:47:18.000000000 -0400 @@ -15,7 +15,6 @@ # Declarations # @@ -8999,7 +9233,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo # compatibility for switching from strict # dominance { role secadm_r { role system_r; }} -@@ -548,4 +564,13 @@ +@@ -537,6 +553,18 @@ + filetrans_pattern(privhome,user_home_dir_t,user_home_t,{ dir file lnk_file sock_file fifo_file }) + files_search_home(privhome) + ++ tunable_policy(`use_nfs_home_dirs',` ++ fs_manage_nfs_dirs(privhome) ++ fs_manage_nfs_files(privhome) ++ fs_manage_nfs_symlinks(privhome) ++ ') ++ ++ tunable_policy(`use_samba_home_dirs',` ++ fs_manage_cifs_dirs(privhome) ++ fs_manage_cifs_files(privhome) ++ fs_manage_cifs_symlinks(privhome) ++ ') ++ + ifdef(`enable_mls',` + allow secadm_r system_r; + allow auditadm_r system_r; +@@ -548,4 +576,13 @@ optional_policy(` samba_per_role_template(user) ') @@ -9015,12 +9268,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-2.6.4/policy/modules/system/xen.if --- nsaserefpolicy/policy/modules/system/xen.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/xen.if 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/xen.if 2007-06-11 10:47:18.000000000 -0400 @@ -72,12 +72,35 @@ ') logging_search_logs($1) -+ allow $1 xend_var_log_t:dir search_dir_perms; ++ allow $1 xend_var_log_t:dir rw_dir_perms; allow $1 xend_var_log_t:file { getattr append }; dontaudit $1 xend_var_log_t:file write; ') @@ -9080,7 +9333,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-2.6.4/policy/modules/system/xen.te --- nsaserefpolicy/policy/modules/system/xen.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/xen.te 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/xen.te 2007-06-11 10:47:18.000000000 -0400 @@ -25,6 +25,10 @@ domain_type(xend_t) init_daemon_domain(xend_t, xend_exec_t) @@ -9187,7 +9440,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te kernel_read_system_state(xm_t) kernel_read_kernel_sysctls(xm_t) -@@ -352,3 +373,11 @@ +@@ -352,3 +373,17 @@ xen_append_log(xm_t) xen_stream_connect(xm_t) xen_stream_connect_xenstore(xm_t) @@ -9195,13 +9448,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te +#Should have a boolean wrapping these +fs_list_auto_mountpoints(xend_t) +files_search_mnt(xend_t) -+fs_write_nfs_files(xend_t) -+fs_read_nfs_files(xend_t) +fs_getattr_all_fs(xend_t) +fs_read_dos_files(xend_t) ++ ++fs_write_nfs_files(xend_t) ++fs_read_nfs_files(xend_t) ++fs_read_nfs_symlinks(xend_t) ++ ++ifdef(`targeted_policy',` ++ unconfined_domain(xend_t) ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-2.6.4/policy/support/misc_patterns.spt --- nsaserefpolicy/policy/support/misc_patterns.spt 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/support/misc_patterns.spt 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/support/misc_patterns.spt 2007-06-11 10:47:18.000000000 -0400 @@ -41,11 +41,6 @@ # # Other process permissions @@ -9216,7 +9475,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns allow $1 $2:{ file lnk_file } { read getattr }; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-2.6.4/policy/support/obj_perm_sets.spt --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/support/obj_perm_sets.spt 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/policy/support/obj_perm_sets.spt 2007-06-11 10:47:18.000000000 -0400 @@ -203,7 +203,6 @@ define(`add_entry_dir_perms',`{ getattr search lock ioctl write add_name }') define(`del_entry_dir_perms',`{ getattr search lock ioctl write remove_name }') @@ -9250,7 +9509,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets + diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-2.6.4/Rules.modular --- nsaserefpolicy/Rules.modular 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/Rules.modular 2007-05-31 10:23:55.000000000 -0400 ++++ serefpolicy-2.6.4/Rules.modular 2007-06-11 10:47:18.000000000 -0400 @@ -167,7 +167,7 @@ # these have to run individually because order matters: $(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true diff --git a/selinux-policy.spec b/selinux-policy.spec index 672b2c9..8f58592 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -17,7 +17,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 2.6.4 -Release: 13%{?dist} +Release: 14%{?dist} License: GPL Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -360,6 +360,9 @@ semodule -b base.pp -r bootloader -r clock -r dpkg -r fstools -r hotplug -r init %endif %changelog +* Wed Jun 6 2007 Dan Walsh 2.6.4-14 +- Allow locate to lookup uid/gid + * Mon Jun 4 2007 Dan Walsh 2.6.4-13 - Allow udev to read usr_t