diff --git a/modules-targeted.conf b/modules-targeted.conf index a17d64d..0f73c3b 100644 --- a/modules-targeted.conf +++ b/modules-targeted.conf @@ -674,6 +674,13 @@ lvm = base # mailman = base +# Layer: services +# Module: mailscanner +# +# Anti-Virus and Anti-Spam Filter +# +mailscanner = module + # Layer: kernel # Module: mcs # Required in base diff --git a/policy-20070501.patch b/policy-20070501.patch index 19cdfb5..233296f 100644 --- a/policy-20070501.patch +++ b/policy-20070501.patch @@ -1,6 +1,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-2.6.4/man/man8/ftpd_selinux.8 --- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/man/man8/ftpd_selinux.8 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/man/man8/ftpd_selinux.8 2007-06-18 10:18:55.000000000 -0400 @@ -12,7 +12,7 @@ .TP chcon -R -t public_content_t /var/ftp @@ -12,7 +12,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 sere .TP diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-2.6.4/policy/flask/access_vectors --- nsaserefpolicy/policy/flask/access_vectors 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/flask/access_vectors 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/flask/access_vectors 2007-06-18 10:18:55.000000000 -0400 @@ -598,6 +598,8 @@ shmempwd shmemgrp @@ -33,7 +33,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors class key diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans serefpolicy-2.6.4/policy/global_booleans --- nsaserefpolicy/policy/global_booleans 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/global_booleans 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/global_booleans 2007-06-18 10:18:55.000000000 -0400 @@ -4,7 +4,6 @@ # file should be used. # @@ -52,7 +52,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans seref ##

diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-2.6.4/policy/global_tunables --- nsaserefpolicy/policy/global_tunables 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/global_tunables 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/global_tunables 2007-06-18 10:18:55.000000000 -0400 @@ -102,12 +102,6 @@ ## gen_tunable(use_samba_home_dirs,false) @@ -81,7 +81,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.4/policy/mls --- nsaserefpolicy/policy/mls 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/mls 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/mls 2007-06-18 10:18:55.000000000 -0400 @@ -89,12 +89,14 @@ mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton } (( l1 eq l2 ) or @@ -155,7 +155,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.4 mlsconstrain association { polmatch } diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-2.6.4/policy/modules/admin/acct.te --- nsaserefpolicy/policy/modules/admin/acct.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/acct.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/acct.te 2007-06-18 10:18:55.000000000 -0400 @@ -9,6 +9,7 @@ type acct_t; type acct_exec_t; @@ -166,7 +166,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te logging_log_file(acct_data_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-2.6.4/policy/modules/admin/alsa.fc --- nsaserefpolicy/policy/modules/admin/alsa.fc 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/alsa.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/alsa.fc 2007-06-18 10:18:55.000000000 -0400 @@ -1,4 +1,7 @@ /etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0) @@ -177,7 +177,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc +/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-2.6.4/policy/modules/admin/alsa.te --- nsaserefpolicy/policy/modules/admin/alsa.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/alsa.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/alsa.te 2007-06-18 10:18:55.000000000 -0400 @@ -20,20 +20,24 @@ # Local policy # @@ -226,7 +226,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.te serefpolicy-2.6.4/policy/modules/admin/amanda.te --- nsaserefpolicy/policy/modules/admin/amanda.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/amanda.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/amanda.te 2007-06-18 10:18:55.000000000 -0400 @@ -85,7 +85,7 @@ # access to amandas data structure @@ -248,14 +248,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda. logging_log_filetrans(amanda_t,amanda_log_t,{ file dir }) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.fc serefpolicy-2.6.4/policy/modules/admin/amtu.fc --- nsaserefpolicy/policy/modules/admin/amtu.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/amtu.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/amtu.fc 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1,3 @@ + +/usr/bin/amtu -- gen_context(system_u:object_r:amtu_exec_t,s0) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if serefpolicy-2.6.4/policy/modules/admin/amtu.if --- nsaserefpolicy/policy/modules/admin/amtu.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/amtu.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/amtu.if 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1,53 @@ +##

+## abstract Machine Test Utility @@ -312,7 +312,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te serefpolicy-2.6.4/policy/modules/admin/amtu.te --- nsaserefpolicy/policy/modules/admin/amtu.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/amtu.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/amtu.te 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1,57 @@ +policy_module(amtu,1.0.23) + @@ -373,7 +373,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-2.6.4/policy/modules/admin/bootloader.te --- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/bootloader.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/bootloader.te 2007-06-18 10:18:55.000000000 -0400 @@ -65,6 +65,8 @@ files_tmp_filetrans(bootloader_t,bootloader_tmp_t,{ dir file lnk_file chr_file blk_file }) # for tune2fs (cjp: ?) @@ -393,7 +393,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-2.6.4/policy/modules/admin/consoletype.te --- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/consoletype.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/consoletype.te 2007-06-18 11:02:19.000000000 -0400 @@ -8,7 +8,12 @@ type consoletype_t; @@ -425,9 +425,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console domain_use_interactive_fds(consoletype_t) +@@ -93,6 +99,10 @@ + ') + + optional_policy(` ++ hotplug_dontaudit_use_fds(consoletype_t) ++') ++ ++optional_policy(` + logrotate_dontaudit_use_fds(consoletype_t) + ') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-2.6.4/policy/modules/admin/dmesg.te --- nsaserefpolicy/policy/modules/admin/dmesg.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/dmesg.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/dmesg.te 2007-06-18 10:18:55.000000000 -0400 @@ -10,6 +10,7 @@ type dmesg_t; type dmesg_exec_t; @@ -438,7 +449,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.t diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-2.6.4/policy/modules/admin/kudzu.te --- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/kudzu.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/kudzu.te 2007-06-18 10:18:55.000000000 -0400 @@ -21,8 +21,8 @@ # Local policy # @@ -461,7 +472,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t init_telinit(kudzu_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-2.6.4/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/logrotate.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/logrotate.te 2007-06-18 10:18:55.000000000 -0400 @@ -75,6 +75,7 @@ mls_file_read_up(logrotate_t) mls_file_write_down(logrotate_t) @@ -472,7 +483,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota selinux_get_enforce_mode(logrotate_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-2.6.4/policy/modules/admin/logwatch.te --- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/logwatch.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/logwatch.te 2007-06-18 10:18:55.000000000 -0400 @@ -30,7 +30,6 @@ allow logwatch_t self:process signal; allow logwatch_t self:fifo_file rw_file_perms; @@ -533,7 +544,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-2.6.4/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/netutils.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/netutils.te 2007-06-18 10:18:55.000000000 -0400 @@ -31,6 +31,7 @@ type traceroute_t; type traceroute_exec_t; @@ -544,7 +555,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-2.6.4/policy/modules/admin/prelink.te --- nsaserefpolicy/policy/modules/admin/prelink.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/prelink.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/prelink.te 2007-06-18 10:18:55.000000000 -0400 @@ -26,7 +26,7 @@ # Local policy # @@ -554,17 +565,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink allow prelink_t self:process { execheap execmem execstack signal }; allow prelink_t self:fifo_file rw_fifo_file_perms; -@@ -65,6 +65,7 @@ +@@ -65,6 +65,8 @@ files_read_etc_files(prelink_t) files_read_etc_runtime_files(prelink_t) files_dontaudit_read_all_symlinks(prelink_t) +files_manage_usr_files(prelink_t) ++files_relabelfrom_usr_files(prelink_t) fs_getattr_xattr_fs(prelink_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-2.6.4/policy/modules/admin/readahead.te --- nsaserefpolicy/policy/modules/admin/readahead.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/readahead.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/readahead.te 2007-06-18 10:18:55.000000000 -0400 @@ -18,7 +18,8 @@ # Local policy # @@ -594,7 +606,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-2.6.4/policy/modules/admin/rpm.fc --- nsaserefpolicy/policy/modules/admin/rpm.fc 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/rpm.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/rpm.fc 2007-06-18 10:18:55.000000000 -0400 @@ -21,6 +21,9 @@ /usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -607,8 +619,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-2.6.4/policy/modules/admin/rpm.if --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/rpm.if 2007-06-12 11:16:32.000000000 -0400 -@@ -225,8 +225,29 @@ ++++ serefpolicy-2.6.4/policy/modules/admin/rpm.if 2007-06-18 11:07:56.000000000 -0400 +@@ -211,6 +211,24 @@ + + ######################################## + ## ++## dontaudit and use file descriptors from RPM scripts. ++## ++## ++## ++## The type of the process performing this action. ++## ++## ++# ++interface(`rpm_dontaudit_use_script_fds',` ++ gen_require(` ++ type rpm_script_t; ++ ') ++ ++ dontaudit $1 rpm_script_t:fd use; ++') ++ ++######################################## ++## + ## Create, read, write, and delete RPM + ## script temporary files. + ## +@@ -225,8 +243,29 @@ type rpm_script_tmp_t; ') @@ -639,7 +676,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if ') ######################################## -@@ -290,3 +311,46 @@ +@@ -290,3 +329,46 @@ dontaudit $1 rpm_var_lib_t:file manage_file_perms; dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms; ') @@ -688,7 +725,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-2.6.4/policy/modules/admin/rpm.te --- nsaserefpolicy/policy/modules/admin/rpm.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/rpm.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/rpm.te 2007-06-18 10:18:55.000000000 -0400 @@ -9,6 +9,8 @@ type rpm_t; type rpm_exec_t; @@ -700,7 +737,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te domain_system_change_exemption(rpm_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-2.6.4/policy/modules/admin/sudo.if --- nsaserefpolicy/policy/modules/admin/sudo.if 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/sudo.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/sudo.if 2007-06-18 10:18:55.000000000 -0400 @@ -69,7 +69,6 @@ allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms; allow $1_sudo_t self:unix_dgram_socket sendto; @@ -749,7 +786,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-2.6.4/policy/modules/admin/su.if --- nsaserefpolicy/policy/modules/admin/su.if 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/su.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/su.if 2007-06-18 10:18:55.000000000 -0400 @@ -41,12 +41,11 @@ allow $2 $1_su_t:process signal; @@ -825,7 +862,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-2.6.4/policy/modules/admin/usermanage.if --- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/usermanage.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/usermanage.if 2007-06-18 10:18:55.000000000 -0400 @@ -278,5 +278,5 @@ type crack_db_t; ') @@ -835,7 +872,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-2.6.4/policy/modules/admin/usermanage.te --- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/usermanage.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/usermanage.te 2007-06-18 10:18:55.000000000 -0400 @@ -184,7 +184,7 @@ # Groupadd local policy # @@ -997,16 +1034,45 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-2.6.4/policy/modules/admin/vbetool.te --- nsaserefpolicy/policy/modules/admin/vbetool.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/vbetool.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/vbetool.te 2007-06-18 10:18:55.000000000 -0400 @@ -32,4 +32,5 @@ optional_policy(` hal_rw_pid_files(vbetool_t) + hal_write_log(vbetool_t) ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc serefpolicy-2.6.4/policy/modules/apps/games.fc +--- nsaserefpolicy/policy/modules/apps/games.fc 2007-05-07 14:51:02.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/games.fc 2007-06-18 11:46:13.000000000 -0400 +@@ -1,22 +1,16 @@ + # + # /usr + # +-/usr/games/powermanga -- gen_context(system_u:object_r:games_exec_t,s0) +-/usr/games/nethack-3.4.3/nethack -- gen_context(system_u:object_r:games_exec_t,s0) +-/usr/games/vulturesclaw/vulturesclaw -- gen_context(system_u:object_r:games_exec_t,s0) +-/usr/games/vultureseye/vultureseye -- gen_context(system_u:object_r:games_exec_t,s0) +- + /usr/lib/games(/.*)? gen_context(system_u:object_r:games_exec_t,s0) ++/usr/games/.* -- gen_context(system_u:object_r:games_exec_t,s0) + + # + # /var + # + /var/lib/games(/.*)? gen_context(system_u:object_r:games_data_t,s0) +- +-ifdef(`distro_debian', ` +-/usr/games/.* -- gen_context(system_u:object_r:games_exec_t,s0) + /var/games(/.*)? gen_context(system_u:object_r:games_data_t,s0) +-', ` ++ ++ifdef(`distro_debian', `', ` + /usr/bin/micq -- gen_context(system_u:object_r:games_exec_t,s0) + /usr/bin/blackjack -- gen_context(system_u:object_r:games_exec_t,s0) + /usr/bin/gataxx -- gen_context(system_u:object_r:games_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-2.6.4/policy/modules/apps/gnome.if --- nsaserefpolicy/policy/modules/apps/gnome.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/gnome.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/gnome.if 2007-06-18 10:18:55.000000000 -0400 @@ -35,6 +35,7 @@ template(`gnome_per_role_template',` gen_require(` @@ -1062,7 +1128,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if ## This is a templated interface, and should only diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-2.6.4/policy/modules/apps/gpg.fc --- nsaserefpolicy/policy/modules/apps/gpg.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/gpg.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/gpg.fc 2007-06-18 10:18:55.000000000 -0400 @@ -7,6 +7,4 @@ /usr/lib/gnupg/.* -- gen_context(system_u:object_r:gpg_exec_t,s0) /usr/lib/gnupg/gpgkeys.* -- gen_context(system_u:object_r:gpg_helper_exec_t,s0) @@ -1072,7 +1138,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc s -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-2.6.4/policy/modules/apps/java.if --- nsaserefpolicy/policy/modules/apps/java.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/java.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/java.if 2007-06-18 10:18:55.000000000 -0400 @@ -224,3 +224,35 @@ refpolicywarn(`$0($1) has no effect in strict policy.') ') @@ -1111,7 +1177,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.if serefpolicy-2.6.4/policy/modules/apps/loadkeys.if --- nsaserefpolicy/policy/modules/apps/loadkeys.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/loadkeys.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/loadkeys.if 2007-06-18 10:18:55.000000000 -0400 @@ -11,16 +11,12 @@ ## # @@ -1180,7 +1246,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-2.6.4/policy/modules/apps/mozilla.if --- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/mozilla.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/mozilla.if 2007-06-18 10:18:55.000000000 -0400 @@ -150,6 +150,7 @@ corenet_dontaudit_tcp_bind_generic_port($1_mozilla_t) @@ -1191,7 +1257,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. dev_dontaudit_rw_dri($1_mozilla_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-2.6.4/policy/modules/apps/slocate.te --- nsaserefpolicy/policy/modules/apps/slocate.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/slocate.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/slocate.te 2007-06-18 10:18:55.000000000 -0400 @@ -29,8 +29,11 @@ manage_dirs_pattern(locate_t,locate_var_lib_t,locate_var_lib_t) manage_files_pattern(locate_t,locate_var_lib_t,locate_var_lib_t) @@ -1221,7 +1287,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate. libs_use_ld_so(locate_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if serefpolicy-2.6.4/policy/modules/apps/uml.if --- nsaserefpolicy/policy/modules/apps/uml.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/uml.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/uml.if 2007-06-18 10:18:55.000000000 -0400 @@ -193,33 +193,6 @@ nis_use_ypbind($1_uml_t) ') @@ -1258,7 +1324,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if s ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-2.6.4/policy/modules/kernel/corecommands.fc --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.fc 2007-06-18 10:18:55.000000000 -0400 @@ -36,6 +36,11 @@ /etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0) /etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0) @@ -1295,7 +1361,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco +/etc/apcupsd/onbattery -- gen_context(system_u:object_r:bin_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-2.6.4/policy/modules/kernel/corecommands.if --- nsaserefpolicy/policy/modules/kernel/corecommands.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.if 2007-06-18 10:18:55.000000000 -0400 @@ -988,3 +988,23 @@ mmap_files_pattern($1,bin_t,exec_type) @@ -1322,7 +1388,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-2.6.4/policy/modules/kernel/corenetwork.te.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/corenetwork.te.in 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/corenetwork.te.in 2007-06-18 10:18:55.000000000 -0400 @@ -48,6 +48,11 @@ type reserved_port_t, port_type, reserved_port_type; @@ -1373,7 +1439,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-2.6.4/policy/modules/kernel/devices.fc --- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/devices.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/devices.fc 2007-06-18 10:18:55.000000000 -0400 @@ -19,6 +19,7 @@ /dev/evtchn -c gen_context(system_u:object_r:xen_device_t,s0) /dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0) @@ -1393,7 +1459,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-2.6.4/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/devices.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/devices.if 2007-06-18 10:18:55.000000000 -0400 @@ -2729,6 +2729,24 @@ ######################################## @@ -1500,7 +1566,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-2.6.4/policy/modules/kernel/devices.te --- nsaserefpolicy/policy/modules/kernel/devices.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/devices.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/devices.te 2007-06-18 10:18:55.000000000 -0400 @@ -139,6 +139,12 @@ # # Type for sound devices and mixers @@ -1516,7 +1582,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-2.6.4/policy/modules/kernel/domain.if --- nsaserefpolicy/policy/modules/kernel/domain.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/domain.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/domain.if 2007-06-18 10:18:55.000000000 -0400 @@ -1254,3 +1254,21 @@ typeattribute $1 can_change_object_identity; typeattribute $1 set_curr_context; @@ -1541,7 +1607,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-2.6.4/policy/modules/kernel/domain.te --- nsaserefpolicy/policy/modules/kernel/domain.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/domain.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/domain.te 2007-06-18 10:18:55.000000000 -0400 @@ -6,6 +6,29 @@ # Declarations # @@ -1601,7 +1667,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-2.6.4/policy/modules/kernel/files.fc --- nsaserefpolicy/policy/modules/kernel/files.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/files.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/files.fc 2007-06-18 10:18:55.000000000 -0400 @@ -45,7 +45,6 @@ /etc -d gen_context(system_u:object_r:etc_t,s0) /etc/.* gen_context(system_u:object_r:etc_t,s0) @@ -1620,7 +1686,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. /etc/nologin.* -- gen_context(system_u:object_r:etc_runtime_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.6.4/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/files.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/files.if 2007-06-18 10:18:55.000000000 -0400 @@ -343,8 +343,7 @@ ######################################## @@ -1714,7 +1780,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## Get the attributes of files in /usr. ## ## -@@ -3432,6 +3466,24 @@ +@@ -3386,6 +3420,24 @@ + + ######################################## + ## ++## Relabel a file from the type used in /usr. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_relabelfrom_usr_files',` ++ gen_require(` ++ type usr_t; ++ ') ++ ++ relabelfrom_files_pattern($1,usr_t,usr_t) ++') ++ ++######################################## ++## + ## Read symbolic links in /usr. + ## + ## +@@ -3432,6 +3484,24 @@ ######################################## ## @@ -1739,7 +1830,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## Do not audit attempts to search /usr/src. ## ## -@@ -3637,7 +3689,7 @@ +@@ -3637,7 +3707,7 @@ type var_t; ') @@ -1748,7 +1839,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -3993,7 +4045,7 @@ +@@ -3993,7 +4063,7 @@ type var_lock_t; ') @@ -1757,7 +1848,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4012,7 +4064,7 @@ +@@ -4012,7 +4082,7 @@ type var_t, var_lock_t; ') @@ -1766,7 +1857,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4181,7 +4233,7 @@ +@@ -4181,7 +4251,7 @@ type var_run_t; ') @@ -1775,7 +1866,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4529,6 +4581,8 @@ +@@ -4529,6 +4599,8 @@ # Need to give access to /selinux/member selinux_compute_member($1) @@ -1784,7 +1875,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # Need sys_admin capability for mounting allow $1 self:capability { chown fsetid sys_admin }; -@@ -4551,6 +4605,8 @@ +@@ -4551,6 +4623,8 @@ # Default type for mountpoints allow $1 poly_t:dir { create mounton }; fs_unmount_xattr_fs($1) @@ -1793,7 +1884,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4588,3 +4644,28 @@ +@@ -4588,3 +4662,28 @@ allow $1 { file_type -security_file_type }:dir manage_dir_perms; ') @@ -1824,7 +1915,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-2.6.4/policy/modules/kernel/files.te --- nsaserefpolicy/policy/modules/kernel/files.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/files.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/files.te 2007-06-18 10:18:55.000000000 -0400 @@ -54,6 +54,7 @@ files_type(etc_t) # compatibility aliases for removed types: @@ -1835,7 +1926,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # etc_runtime_t is the type of various diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-2.6.4/policy/modules/kernel/filesystem.if --- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.if 2007-06-18 10:18:55.000000000 -0400 @@ -1096,6 +1096,24 @@ ######################################## @@ -1913,7 +2004,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.6.4/policy/modules/kernel/filesystem.te --- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.te 2007-06-18 10:18:55.000000000 -0400 @@ -54,17 +54,29 @@ type capifs_t; @@ -1975,7 +2066,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-2.6.4/policy/modules/kernel/kernel.if --- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/kernel.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/kernel.if 2007-06-18 10:18:55.000000000 -0400 @@ -333,6 +333,24 @@ ######################################## @@ -2040,7 +2131,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-2.6.4/policy/modules/kernel/kernel.te --- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/kernel.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/kernel.te 2007-06-18 10:18:55.000000000 -0400 @@ -146,6 +146,8 @@ type unlabeled_t; sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) @@ -2060,7 +2151,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-2.6.4/policy/modules/kernel/mls.if --- nsaserefpolicy/policy/modules/kernel/mls.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/mls.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/mls.if 2007-06-18 10:18:55.000000000 -0400 @@ -154,6 +154,26 @@ ######################################## ## @@ -2090,7 +2181,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-2.6.4/policy/modules/kernel/mls.te --- nsaserefpolicy/policy/modules/kernel/mls.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/mls.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/mls.te 2007-06-18 10:18:55.000000000 -0400 @@ -18,6 +18,7 @@ attribute mlsnetreadtoclr; attribute mlsnetwrite; @@ -2110,7 +2201,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te attribute privrangetrans; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-2.6.4/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/selinux.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/selinux.if 2007-06-18 10:18:55.000000000 -0400 @@ -51,6 +51,44 @@ ######################################## @@ -2158,7 +2249,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-2.6.4/policy/modules/kernel/storage.if --- nsaserefpolicy/policy/modules/kernel/storage.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/storage.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/storage.if 2007-06-18 10:18:55.000000000 -0400 @@ -100,6 +100,7 @@ dev_list_all_dev_nodes($1) @@ -2177,7 +2268,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-2.6.4/policy/modules/kernel/terminal.if --- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/terminal.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/terminal.if 2007-06-18 10:18:55.000000000 -0400 @@ -278,6 +278,25 @@ ######################################## @@ -2215,7 +2306,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-2.6.4/policy/modules/kernel/terminal.te --- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/terminal.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/terminal.te 2007-06-18 10:18:55.000000000 -0400 @@ -28,6 +28,7 @@ type devpts_t; files_mountpoint(devpts_t) @@ -2226,7 +2317,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.fc serefpolicy-2.6.4/policy/modules/services/aide.fc --- nsaserefpolicy/policy/modules/services/aide.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/aide.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/aide.fc 2007-06-18 10:18:55.000000000 -0400 @@ -2,5 +2,5 @@ /var/lib/aide(/.*) gen_context(system_u:object_r:aide_db_t,mls_systemhigh) @@ -2236,7 +2327,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide +/var/log/aide(/.*)? gen_context(system_u:object_r:aide_log_t,mls_systemhigh) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.te serefpolicy-2.6.4/policy/modules/services/aide.te --- nsaserefpolicy/policy/modules/services/aide.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/aide.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/aide.te 2007-06-18 10:18:55.000000000 -0400 @@ -26,7 +26,7 @@ allow aide_t self:capability { dac_override fowner }; @@ -2248,7 +2339,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide manage_files_pattern(aide_t,aide_db_t,aide_db_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.if serefpolicy-2.6.4/policy/modules/services/amavis.if --- nsaserefpolicy/policy/modules/services/amavis.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/amavis.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/amavis.if 2007-06-18 10:18:55.000000000 -0400 @@ -167,3 +167,22 @@ allow $1 amavis_var_run_t:file setattr; files_search_pids($1) @@ -2274,7 +2365,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-2.6.4/policy/modules/services/amavis.te --- nsaserefpolicy/policy/modules/services/amavis.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/amavis.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/amavis.te 2007-06-18 10:18:55.000000000 -0400 @@ -170,6 +170,7 @@ optional_policy(` @@ -2285,7 +2376,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-2.6.4/policy/modules/services/apache.fc --- nsaserefpolicy/policy/modules/services/apache.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apache.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apache.fc 2007-06-18 10:18:55.000000000 -0400 @@ -1,10 +1,5 @@ # temporary hack till genhomedircon is fixed -ifdef(`targeted_policy',` @@ -2319,7 +2410,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-2.6.4/policy/modules/services/apache.if --- nsaserefpolicy/policy/modules/services/apache.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apache.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apache.if 2007-06-18 10:18:55.000000000 -0400 @@ -18,10 +18,6 @@ attribute httpd_script_exec_type; type httpd_t, httpd_suexec_t, httpd_log_t; @@ -2540,7 +2631,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-2.6.4/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apache.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apache.te 2007-06-18 10:18:55.000000000 -0400 @@ -47,6 +47,13 @@ ## Allow http daemon to tcp connect ##

@@ -2700,7 +2791,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms; read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t) -@@ -730,11 +796,21 @@ +@@ -720,6 +786,8 @@ + # Should we add a boolean? + apache_domtrans_rotatelogs(httpd_sys_script_t) + ++sysnet_read_config(httpd_sys_script_t) ++ + ifdef(`distro_redhat',` + allow httpd_sys_script_t httpd_log_t:file { getattr append }; + ') +@@ -730,11 +798,21 @@ ') ') @@ -2722,7 +2822,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_sys_script_t) fs_read_cifs_symlinks(httpd_sys_script_t) -@@ -788,3 +864,19 @@ +@@ -788,3 +866,19 @@ term_dontaudit_use_generic_ptys(httpd_rotatelogs_t) term_dontaudit_use_unallocated_ttys(httpd_rotatelogs_t) ') @@ -2744,7 +2844,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-2.6.4/policy/modules/services/apcupsd.fc --- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apcupsd.fc 2007-06-18 10:18:55.000000000 -0400 @@ -3,3 +3,8 @@ /var/log/apcupsd\.events.* -- gen_context(system_u:object_r:apcupsd_log_t,s0) @@ -2756,7 +2856,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +/var/www/apcupsd/upsstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-2.6.4/policy/modules/services/apcupsd.if --- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apcupsd.if 2007-06-18 10:18:55.000000000 -0400 @@ -79,3 +79,25 @@ allow $1 apcupsd_log_t:dir list_dir_perms; allow $1 apcupsd_log_t:file { getattr append }; @@ -2785,7 +2885,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-2.6.4/policy/modules/services/apcupsd.te --- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.te 2007-06-13 15:57:29.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apcupsd.te 2007-06-18 10:24:44.000000000 -0400 @@ -24,6 +24,7 @@ # apcupsd local policy # @@ -2813,20 +2913,34 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu dev_rw_generic_usb_dev(apcupsd_t) -@@ -54,6 +58,10 @@ +@@ -54,6 +58,12 @@ files_read_etc_files(apcupsd_t) files_search_locks(apcupsd_t) -+init_dontaudit_write_utmp(apcupsd_t) ++#apcupsd runs shutdown, probably need a shutdown domain ++init_rw_utmp(apcupsd_t) ++init_telinit(apcupsd_t) + +kernel_read_system_state(apcupsd_t) + libs_use_ld_so(apcupsd_t) libs_use_shared_libs(apcupsd_t) -@@ -65,3 +73,26 @@ - term_dontaudit_use_unallocated_ttys(apcupsd_t) - term_dontaudit_use_generic_ptys(apcupsd_t) +@@ -61,7 +71,35 @@ + + miscfiles_read_localization(apcupsd_t) + +-ifdef(`targeted_policy',` +- term_dontaudit_use_unallocated_ttys(apcupsd_t) +- term_dontaudit_use_generic_ptys(apcupsd_t) ++userdom_use_unpriv_users_ttys(apcupsd_t) ++userdom_use_unpriv_users_ptys(apcupsd_t) ++ ++term_use_unallocated_ttys(apcupsd_t) ++term_dontaudit_use_generic_ptys(apcupsd_t) ++ ++optional_policy(` ++ mta_send_mail(apcupsd_t) ') + +######################################## @@ -2853,7 +2967,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.te serefpolicy-2.6.4/policy/modules/services/arpwatch.te --- nsaserefpolicy/policy/modules/services/arpwatch.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/arpwatch.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/arpwatch.te 2007-06-18 10:18:55.000000000 -0400 @@ -28,7 +28,6 @@ allow arpwatch_t self:process signal_perms; allow arpwatch_t self:unix_dgram_socket create_socket_perms; @@ -2882,7 +2996,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpw optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-2.6.4/policy/modules/services/audioentropy.te --- nsaserefpolicy/policy/modules/services/audioentropy.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/audioentropy.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/audioentropy.te 2007-06-18 10:18:55.000000000 -0400 @@ -18,7 +18,7 @@ # Local policy # @@ -2903,7 +3017,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audi fs_getattr_all_fs(entropyd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-2.6.4/policy/modules/services/automount.te --- nsaserefpolicy/policy/modules/services/automount.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/automount.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/automount.te 2007-06-18 10:18:55.000000000 -0400 @@ -69,6 +69,7 @@ files_mounton_all_mountpoints(automount_t) files_mount_all_file_type_fs(automount_t) @@ -2922,7 +3036,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto domain_use_interactive_fds(automount_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-2.6.4/policy/modules/services/avahi.te --- nsaserefpolicy/policy/modules/services/avahi.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/avahi.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/avahi.te 2007-06-18 10:18:55.000000000 -0400 @@ -18,7 +18,7 @@ # Local policy # @@ -2961,7 +3075,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-2.6.4/policy/modules/services/bind.fc --- nsaserefpolicy/policy/modules/services/bind.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/bind.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/bind.fc 2007-06-18 10:18:55.000000000 -0400 @@ -45,4 +45,7 @@ /var/named/chroot/var/named/slaves(/.*)? gen_context(system_u:object_r:named_cache_t,s0) /var/named/chroot/var/named/data(/.*)? gen_context(system_u:object_r:named_cache_t,s0) @@ -2972,7 +3086,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-2.6.4/policy/modules/services/bind.te --- nsaserefpolicy/policy/modules/services/bind.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/bind.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/bind.te 2007-06-18 10:18:55.000000000 -0400 @@ -236,6 +236,7 @@ corenet_tcp_sendrecv_all_nodes(ndc_t) corenet_tcp_sendrecv_all_ports(ndc_t) @@ -2983,7 +3097,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind fs_getattr_xattr_fs(ndc_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-2.6.4/policy/modules/services/clamav.te --- nsaserefpolicy/policy/modules/services/clamav.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/clamav.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/clamav.te 2007-06-18 10:18:55.000000000 -0400 @@ -126,6 +126,7 @@ amavis_read_lib_files(clamd_t) amavis_read_spool_files(clamd_t) @@ -3002,9 +3116,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam kernel_read_kernel_sysctls(clamscan_t) files_read_etc_files(clamscan_t) +@@ -230,3 +234,7 @@ + optional_policy(` + apache_read_sys_content(clamscan_t) + ') ++ ++optional_policy(` ++ mailscanner_manage_spool(clamscan_t) ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-2.6.4/policy/modules/services/consolekit.te --- nsaserefpolicy/policy/modules/services/consolekit.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/consolekit.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/consolekit.te 2007-06-18 10:18:55.000000000 -0400 @@ -10,7 +10,6 @@ type consolekit_exec_t; init_daemon_domain(consolekit_t, consolekit_exec_t) @@ -3052,7 +3174,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-2.6.4/policy/modules/services/cron.fc --- nsaserefpolicy/policy/modules/services/cron.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cron.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cron.fc 2007-06-18 10:18:55.000000000 -0400 @@ -45,3 +45,4 @@ /var/spool/fcron/systab\.orig -- gen_context(system_u:object_r:system_cron_spool_t,s0) /var/spool/fcron/systab -- gen_context(system_u:object_r:system_cron_spool_t,s0) @@ -3060,7 +3182,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron +/var/lib/misc(/.*)? gen_context(system_u:object_r:crond_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-2.6.4/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cron.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cron.if 2007-06-18 10:18:55.000000000 -0400 @@ -35,6 +35,7 @@ # template(`cron_per_role_template',` @@ -3171,7 +3293,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # fcron wants an instant update of a crontab change for the administrator diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-2.6.4/policy/modules/services/cron.te --- nsaserefpolicy/policy/modules/services/cron.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cron.te 2007-06-12 13:26:56.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cron.te 2007-06-18 11:40:38.000000000 -0400 @@ -42,6 +42,9 @@ type cron_log_t; logging_log_file(cron_log_t) @@ -3199,16 +3321,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron dontaudit crond_t self:capability { sys_resource sys_tty_config }; allow crond_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow crond_t self:process { setexec setfscreate }; -@@ -108,14 +112,12 @@ +@@ -108,14 +112,14 @@ allow crond_t crond_var_run_t:file manage_file_perms; files_pid_filetrans(crond_t,crond_var_run_t,file) -allow crond_t cron_spool_t:dir rw_dir_perms; -allow crond_t cron_spool_t:file read_file_perms; -- ++manage_files_pattern(crond_t,cron_spool_t,cron_spool_t) + -allow crond_t system_cron_spool_t:dir list_dir_perms; -allow crond_t system_cron_spool_t:file read_file_perms; -+manage_files_pattern(crond_t,cron_spool_t,cron_spool_t) ++list_dirs_pattern(crond_t, system_cron_spool_t, system_cron_spool_t) +read_files_pattern(crond_t, system_cron_spool_t, system_cron_spool_t) kernel_read_kernel_sysctls(crond_t) @@ -3217,11 +3340,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron dev_read_sysfs(crond_t) selinux_get_fs_mount(crond_t) -@@ -131,12 +133,23 @@ - fs_search_auto_mountpoints(crond_t) +@@ -132,11 +136,23 @@ # need auth_chkpwd to check for locked accounts. --auth_domtrans_chk_passwd(crond_t) + auth_domtrans_chk_passwd(crond_t) +auth_domtrans_upd_passwd(crond_t) +auth_use_nsswitch(crond_t) @@ -3242,7 +3364,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron domain_use_interactive_fds(crond_t) files_read_etc_files(crond_t) -@@ -152,6 +165,7 @@ +@@ -152,6 +168,7 @@ libs_use_shared_libs(crond_t) logging_send_syslog_msg(crond_t) @@ -3250,7 +3372,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron seutil_read_config(crond_t) seutil_read_default_contexts(crond_t) -@@ -165,6 +179,12 @@ +@@ -165,6 +182,12 @@ mta_send_mail(crond_t) @@ -3263,7 +3385,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ifdef(`distro_debian',` optional_policy(` # Debian logcheck has the home dir set to its cache -@@ -185,34 +205,9 @@ +@@ -185,34 +208,9 @@ locallogin_link_keys(crond_t) ') @@ -3301,7 +3423,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron tunable_policy(`fcron_crond', ` allow crond_t system_cron_spool_t:file manage_file_perms; -@@ -232,11 +227,7 @@ +@@ -232,11 +230,7 @@ ') optional_policy(` @@ -3314,7 +3436,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') optional_policy(` -@@ -258,17 +249,26 @@ +@@ -258,17 +252,26 @@ # System cron process domain # @@ -3341,7 +3463,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # cjp: why? squid_domtrans(system_crond_t) ') -@@ -369,7 +369,7 @@ +@@ -369,7 +372,7 @@ init_read_utmp(system_crond_t) init_dontaudit_rw_utmp(system_crond_t) # prelink tells init to restart it self, we either need to allow or dontaudit @@ -3350,7 +3472,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron libs_use_ld_so(system_crond_t) libs_use_shared_libs(system_crond_t) -@@ -428,6 +428,10 @@ +@@ -428,6 +431,10 @@ ') optional_policy(` @@ -3363,7 +3485,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-2.6.4/policy/modules/services/cups.fc --- nsaserefpolicy/policy/modules/services/cups.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cups.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cups.fc 2007-06-18 10:18:55.000000000 -0400 @@ -8,6 +8,7 @@ /etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -3374,7 +3496,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-2.6.4/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cups.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cups.te 2007-06-18 10:18:55.000000000 -0400 @@ -93,8 +93,6 @@ # generic socket here until appletalk socket is available in kernels allow cupsd_t self:socket create_socket_perms; @@ -3436,7 +3558,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-2.6.4/policy/modules/services/cvs.te --- nsaserefpolicy/policy/modules/services/cvs.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cvs.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cvs.te 2007-06-18 10:18:55.000000000 -0400 @@ -16,6 +16,7 @@ type cvs_t; type cvs_exec_t; @@ -3447,7 +3569,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs. type cvs_data_t; # customizable diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-2.6.4/policy/modules/services/cyrus.te --- nsaserefpolicy/policy/modules/services/cyrus.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cyrus.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cyrus.te 2007-06-18 10:18:55.000000000 -0400 @@ -145,6 +145,7 @@ optional_policy(` @@ -3458,7 +3580,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-2.6.4/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dbus.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dbus.if 2007-06-18 10:18:55.000000000 -0400 @@ -49,6 +49,12 @@ ## # @@ -3588,7 +3710,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-2.6.4/policy/modules/services/dbus.te --- nsaserefpolicy/policy/modules/services/dbus.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dbus.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dbus.te 2007-06-18 10:18:55.000000000 -0400 @@ -40,8 +40,6 @@ # Receive notifications of policy reloads and enforcing status changes. allow system_dbusd_t self:netlink_selinux_socket { create bind read }; @@ -3619,7 +3741,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-2.6.4/policy/modules/services/dhcp.te --- nsaserefpolicy/policy/modules/services/dhcp.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dhcp.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dhcp.te 2007-06-18 10:18:55.000000000 -0400 @@ -119,6 +119,8 @@ dbus_system_bus_client_template(dhcpd,dhcpd_t) dbus_connect_system_bus(dhcpd_t) @@ -3631,7 +3753,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-2.6.4/policy/modules/services/djbdns.te --- nsaserefpolicy/policy/modules/services/djbdns.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/djbdns.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/djbdns.te 2007-06-18 10:18:55.000000000 -0400 @@ -44,4 +44,7 @@ libs_use_ld_so(djbdns_axfrdns_t) libs_use_shared_libs(djbdns_axfrdns_t) @@ -3643,7 +3765,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbd + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-2.6.4/policy/modules/services/dovecot.fc --- nsaserefpolicy/policy/modules/services/dovecot.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dovecot.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dovecot.fc 2007-06-18 10:18:55.000000000 -0400 @@ -17,10 +17,12 @@ ifdef(`distro_debian', ` @@ -3659,7 +3781,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-2.6.4/policy/modules/services/dovecot.if --- nsaserefpolicy/policy/modules/services/dovecot.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dovecot.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dovecot.if 2007-06-18 10:18:55.000000000 -0400 @@ -18,3 +18,43 @@ manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t) manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t) @@ -3706,7 +3828,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-2.6.4/policy/modules/services/dovecot.te --- nsaserefpolicy/policy/modules/services/dovecot.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dovecot.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dovecot.te 2007-06-18 10:18:55.000000000 -0400 @@ -15,6 +15,12 @@ domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t) role system_r types dovecot_auth_t; @@ -3759,7 +3881,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove seutil_sigchld_newrole(dovecot_t) ') -@@ -150,25 +149,29 @@ +@@ -150,33 +149,39 @@ # dovecot auth local policy # @@ -3791,7 +3913,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove dev_read_urand(dovecot_auth_t) auth_domtrans_chk_passwd(dovecot_auth_t) -@@ -177,6 +180,7 @@ ++auth_domtrans_upd_passwd(dovecot_auth_t) + auth_use_nsswitch(dovecot_auth_t) + files_read_etc_files(dovecot_auth_t) files_read_etc_runtime_files(dovecot_auth_t) files_search_pids(dovecot_auth_t) @@ -3799,7 +3923,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove files_read_usr_symlinks(dovecot_auth_t) files_search_tmp(dovecot_auth_t) files_read_var_lib_files(dovecot_t) -@@ -190,12 +194,46 @@ +@@ -190,12 +195,46 @@ seutil_dontaudit_search_config(dovecot_auth_t) @@ -3851,7 +3975,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-2.6.4/policy/modules/services/ftp.te --- nsaserefpolicy/policy/modules/services/ftp.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ftp.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ftp.te 2007-06-18 10:18:55.000000000 -0400 @@ -168,6 +168,7 @@ libs_use_shared_libs(ftpd_t) @@ -3878,7 +4002,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. tunable_policy(`ftp_home_dir && use_nfs_home_dirs',` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-2.6.4/policy/modules/services/hal.fc --- nsaserefpolicy/policy/modules/services/hal.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/hal.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/hal.fc 2007-06-18 10:18:55.000000000 -0400 @@ -2,15 +2,20 @@ /etc/hal/device\.d/printer_remove\.hal -- gen_context(system_u:object_r:hald_exec_t,s0) /etc/hal/capability\.d/printer_update\.hal -- gen_context(system_u:object_r:hald_exec_t,s0) @@ -3907,7 +4031,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-2.6.4/policy/modules/services/hal.if --- nsaserefpolicy/policy/modules/services/hal.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/hal.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/hal.if 2007-06-18 10:18:55.000000000 -0400 @@ -208,3 +208,98 @@ files_search_pids($1) allow $1 hald_var_run_t:file rw_file_perms; @@ -4009,7 +4133,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-2.6.4/policy/modules/services/hal.te --- nsaserefpolicy/policy/modules/services/hal.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/hal.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/hal.te 2007-06-18 10:18:55.000000000 -0400 @@ -61,8 +61,6 @@ # For backwards compatibility with older kernels allow hald_t self:netlink_socket create_socket_perms; @@ -4074,7 +4198,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. dev_setattr_usbfs_files(hald_acl_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-2.6.4/policy/modules/services/inetd.te --- nsaserefpolicy/policy/modules/services/inetd.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/inetd.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/inetd.te 2007-06-18 10:18:55.000000000 -0400 @@ -135,8 +135,8 @@ mls_fd_use_all_levels(inetd_t) mls_fd_share_all_levels(inetd_t) @@ -4097,7 +4221,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet manage_dirs_pattern(inetd_child_t,inetd_child_tmp_t,inetd_child_tmp_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-2.6.4/policy/modules/services/kerberos.if --- nsaserefpolicy/policy/modules/services/kerberos.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/kerberos.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/kerberos.if 2007-06-18 10:18:55.000000000 -0400 @@ -33,43 +33,10 @@ # interface(`kerberos_use',` @@ -4246,7 +4370,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-2.6.4/policy/modules/services/kerberos.te --- nsaserefpolicy/policy/modules/services/kerberos.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/kerberos.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/kerberos.te 2007-06-18 10:18:55.000000000 -0400 @@ -5,6 +5,7 @@ # # Declarations @@ -4310,7 +4434,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-2.6.4/policy/modules/services/lpd.if --- nsaserefpolicy/policy/modules/services/lpd.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/lpd.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/lpd.if 2007-06-18 10:18:55.000000000 -0400 @@ -394,3 +394,22 @@ domtrans_pattern($2, lpr_exec_t, $1_lpr_t) @@ -4336,7 +4460,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-2.6.4/policy/modules/services/mailman.if --- nsaserefpolicy/policy/modules/services/mailman.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/mailman.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/mailman.if 2007-06-18 10:18:55.000000000 -0400 @@ -275,6 +275,25 @@ ####################################### @@ -4363,9 +4487,90 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail ## Allow domain to read mailman archive files. ## ## +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-2.6.4/policy/modules/services/mailscanner.fc +--- nsaserefpolicy/policy/modules/services/mailscanner.fc 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-2.6.4/policy/modules/services/mailscanner.fc 2007-06-18 10:18:55.000000000 -0400 +@@ -0,0 +1,2 @@ ++/var/spool/MailScanner(/.*)? gen_context(system_u:object_r:mailscanner_spool_t,s0) ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-2.6.4/policy/modules/services/mailscanner.if +--- nsaserefpolicy/policy/modules/services/mailscanner.if 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-2.6.4/policy/modules/services/mailscanner.if 2007-06-18 10:18:55.000000000 -0400 +@@ -0,0 +1,59 @@ ++## Anti-Virus and Anti-Spam Filter ++ ++######################################## ++## ++## Search mailscanner spool directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`mailscanner_search_spool',` ++ gen_require(` ++ type mailscanner_spool_t; ++ ') ++ ++ files_search_spool($1) ++ allow $1 mailscanner_spool_t:dir search_dir_perms; ++') ++ ++######################################## ++## ++## read mailscanner spool files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`mailscanner_read_spool',` ++ gen_require(` ++ type mailscanner_spool_t; ++ ') ++ ++ files_search_spool($1) ++ read_files_pattern($1,mailscanner_spool_t,mailscanner_spool_t) ++') ++ ++######################################## ++## ++## Create, read, write, and delete ++## mailscanner spool files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`mailscanner_manage_spool',` ++ gen_require(` ++ type mailscanner_spool_t; ++ ') ++ ++ files_search_spool($1) ++ manage_files_pattern($1,mailscanner_spool_t,mailscanner_spool_t) ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-2.6.4/policy/modules/services/mailscanner.te +--- nsaserefpolicy/policy/modules/services/mailscanner.te 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-2.6.4/policy/modules/services/mailscanner.te 2007-06-18 10:18:55.000000000 -0400 +@@ -0,0 +1,8 @@ ++ ++policy_module(moilscanner,1.0.0) ++ ++type mailscanner_spool_t; ++files_type(mailscanner_spool_t) ++ ++ ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-2.6.4/policy/modules/services/mta.if --- nsaserefpolicy/policy/modules/services/mta.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/mta.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/mta.if 2007-06-18 10:18:55.000000000 -0400 @@ -394,6 +394,7 @@ allow $1 mail_spool_t:dir list_dir_perms; create_files_pattern($1,mail_spool_t,mail_spool_t) @@ -4402,7 +4607,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. ## Read sendmail binary. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-2.6.4/policy/modules/services/mta.te --- nsaserefpolicy/policy/modules/services/mta.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/mta.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/mta.te 2007-06-18 10:18:55.000000000 -0400 @@ -27,6 +27,7 @@ type sendmail_exec_t; @@ -4421,7 +4626,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. apache_dontaudit_append_log(system_mail_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-2.6.4/policy/modules/services/nagios.te --- nsaserefpolicy/policy/modules/services/nagios.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nagios.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nagios.te 2007-06-18 10:18:55.000000000 -0400 @@ -73,8 +73,10 @@ corenet_udp_sendrecv_all_nodes(nagios_t) corenet_tcp_sendrecv_all_ports(nagios_t) @@ -4453,7 +4658,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-2.6.4/policy/modules/services/networkmanager.fc --- nsaserefpolicy/policy/modules/services/networkmanager.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/networkmanager.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/networkmanager.fc 2007-06-18 10:18:55.000000000 -0400 @@ -1,5 +1,6 @@ /usr/(s)?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) @@ -4463,7 +4668,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw /var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-2.6.4/policy/modules/services/networkmanager.if --- nsaserefpolicy/policy/modules/services/networkmanager.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/networkmanager.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/networkmanager.if 2007-06-18 10:18:55.000000000 -0400 @@ -78,3 +78,22 @@ allow $1 NetworkManager_t:dbus send_msg; allow NetworkManager_t $1:dbus send_msg; @@ -4489,7 +4694,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-2.6.4/policy/modules/services/networkmanager.te --- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/networkmanager.te 2007-06-14 09:04:56.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/networkmanager.te 2007-06-18 10:18:55.000000000 -0400 @@ -41,6 +41,8 @@ kernel_read_kernel_sysctls(NetworkManager_t) kernel_load_module(NetworkManager_t) @@ -4518,7 +4723,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-2.6.4/policy/modules/services/nis.fc --- nsaserefpolicy/policy/modules/services/nis.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nis.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nis.fc 2007-06-18 10:18:55.000000000 -0400 @@ -4,6 +4,7 @@ /sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0) @@ -4529,7 +4734,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. /usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.6.4/policy/modules/services/nis.if --- nsaserefpolicy/policy/modules/services/nis.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nis.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nis.if 2007-06-18 10:18:55.000000000 -0400 @@ -48,8 +48,8 @@ corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) @@ -4543,7 +4748,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_tcp_connect_portmap_port($1) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-2.6.4/policy/modules/services/nis.te --- nsaserefpolicy/policy/modules/services/nis.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nis.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nis.te 2007-06-18 10:18:55.000000000 -0400 @@ -120,6 +120,13 @@ ') @@ -4589,7 +4794,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_tcp_connect_all_ports(ypxfr_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-2.6.4/policy/modules/services/nscd.te --- nsaserefpolicy/policy/modules/services/nscd.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nscd.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nscd.te 2007-06-18 10:18:55.000000000 -0400 @@ -28,14 +28,14 @@ # Local policy # @@ -4630,7 +4835,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-2.6.4/policy/modules/services/ntp.te --- nsaserefpolicy/policy/modules/services/ntp.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ntp.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ntp.te 2007-06-18 10:18:55.000000000 -0400 @@ -36,6 +36,7 @@ dontaudit ntpd_t self:capability { net_admin sys_tty_config fsetid sys_nice }; allow ntpd_t self:process { signal_perms setcap setsched setrlimit }; @@ -4652,7 +4857,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-2.6.4/policy/modules/services/oddjob.te --- nsaserefpolicy/policy/modules/services/oddjob.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/oddjob.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/oddjob.te 2007-06-18 10:18:55.000000000 -0400 @@ -27,7 +27,7 @@ # oddjob local policy # @@ -4664,7 +4869,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj allow oddjob_t self:unix_stream_socket create_stream_socket_perms; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.fc serefpolicy-2.6.4/policy/modules/services/openct.fc --- nsaserefpolicy/policy/modules/services/openct.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openct.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openct.fc 2007-06-18 10:18:55.000000000 -0400 @@ -2,6 +2,7 @@ # /usr # @@ -4675,7 +4880,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open # /var diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.if serefpolicy-2.6.4/policy/modules/services/openct.if --- nsaserefpolicy/policy/modules/services/openct.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openct.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openct.if 2007-06-18 10:18:55.000000000 -0400 @@ -1 +1,83 @@ -## Service for handling smart card readers. + @@ -4763,7 +4968,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-2.6.4/policy/modules/services/openct.te --- nsaserefpolicy/policy/modules/services/openct.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openct.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openct.te 2007-06-18 10:18:55.000000000 -0400 @@ -21,9 +21,13 @@ dontaudit openct_t self:capability sys_tty_config; allow openct_t self:process signal_perms; @@ -4789,7 +4994,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.fc serefpolicy-2.6.4/policy/modules/services/openvpn.fc --- nsaserefpolicy/policy/modules/services/openvpn.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openvpn.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openvpn.fc 2007-06-18 10:18:55.000000000 -0400 @@ -11,5 +11,5 @@ # # /var @@ -4800,7 +5005,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open +/var/run/openvpn(/.*)? gen_context(system_u:object_r:openvpn_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-2.6.4/policy/modules/services/openvpn.if --- nsaserefpolicy/policy/modules/services/openvpn.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openvpn.if 2007-06-14 09:06:17.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openvpn.if 2007-06-18 10:18:55.000000000 -0400 @@ -22,3 +22,71 @@ read_files_pattern($1,openvpn_etc_t,openvpn_etc_t) read_lnk_files_pattern($1,openvpn_etc_t,openvpn_etc_t) @@ -4875,7 +5080,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-2.6.4/policy/modules/services/openvpn.te --- nsaserefpolicy/policy/modules/services/openvpn.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openvpn.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openvpn.te 2007-06-18 10:18:55.000000000 -0400 @@ -42,8 +42,8 @@ allow openvpn_t openvpn_var_log_t:file manage_file_perms; logging_log_filetrans(openvpn_t,openvpn_var_log_t,file) @@ -4897,7 +5102,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open dev_read_rand(openvpn_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-2.6.4/policy/modules/services/pcscd.te --- nsaserefpolicy/policy/modules/services/pcscd.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pcscd.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/pcscd.te 2007-06-18 10:18:55.000000000 -0400 @@ -21,6 +21,7 @@ # @@ -4922,7 +5127,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcsc + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-2.6.4/policy/modules/services/pegasus.if --- nsaserefpolicy/policy/modules/services/pegasus.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pegasus.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/pegasus.if 2007-06-18 10:18:55.000000000 -0400 @@ -1 +1,19 @@ ## The Open Group Pegasus CIM/WBEM Server. + @@ -4945,7 +5150,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-2.6.4/policy/modules/services/pegasus.te --- nsaserefpolicy/policy/modules/services/pegasus.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pegasus.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/pegasus.te 2007-06-18 10:18:55.000000000 -0400 @@ -38,8 +38,6 @@ allow pegasus_t self:unix_stream_socket create_stream_socket_perms; allow pegasus_t self:tcp_socket create_stream_socket_perms; @@ -4989,7 +5194,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-2.6.4/policy/modules/services/postfix.fc --- nsaserefpolicy/policy/modules/services/postfix.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/postfix.fc 2007-06-14 09:46:40.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/postfix.fc 2007-06-18 10:18:55.000000000 -0400 @@ -5,6 +5,7 @@ /usr/libexec/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0) /usr/libexec/postfix/lmtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0) @@ -5000,8 +5205,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post /usr/libexec/postfix/(n)?qmgr -- gen_context(system_u:object_r:postfix_qmgr_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-2.6.4/policy/modules/services/postfix.if --- nsaserefpolicy/policy/modules/services/postfix.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/postfix.if 2007-06-12 11:16:32.000000000 -0400 -@@ -137,10 +137,8 @@ ++++ serefpolicy-2.6.4/policy/modules/services/postfix.if 2007-06-18 10:20:10.000000000 -0400 +@@ -124,6 +124,7 @@ + allow postfix_$1_t self:udp_socket create_socket_perms; + + domtrans_pattern(postfix_master_t, postfix_$1_exec_t, postfix_$1_t) ++ allow postfix_$1_t postfix_master_t:file read; + + corenet_non_ipsec_sendrecv(postfix_$1_t) + corenet_tcp_sendrecv_all_if(postfix_$1_t) +@@ -137,10 +138,8 @@ corenet_tcp_connect_all_ports(postfix_$1_t) corenet_sendrecv_all_client_packets(postfix_$1_t) @@ -5013,7 +5226,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ') ') -@@ -439,6 +437,25 @@ +@@ -274,6 +273,24 @@ + + ######################################## + ## ++## Allow domain to read postfix local process state ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`postfix_read_local_state',` ++ gen_require(` ++ type postfix_local_t; ++ ') ++ ++ read_files_pattern($1,postfix_local_t,postfix_local_t) ++') ++ ++######################################## ++## + ## Do not audit attempts to use + ## postfix master process file + ## file descriptors. +@@ -439,6 +456,25 @@ ######################################## ## @@ -5039,7 +5277,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ## Execute postfix user mail programs ## in their respective domains. ## -@@ -455,3 +472,22 @@ +@@ -455,3 +491,22 @@ typeattribute $1 postfix_user_domtrans; ') @@ -5064,7 +5302,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-2.6.4/policy/modules/services/postfix.te --- nsaserefpolicy/policy/modules/services/postfix.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/postfix.te 2007-06-14 09:45:01.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/postfix.te 2007-06-18 10:19:49.000000000 -0400 @@ -84,6 +84,12 @@ type postfix_var_run_t; files_pid_file(postfix_var_run_t) @@ -5108,39 +5346,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post nis_use_ypbind(postfix_master_t) ') -@@ -210,6 +226,7 @@ - - allow postfix_bounce_t self:capability dac_read_search; - allow postfix_bounce_t self:tcp_socket create_socket_perms; -+allow postfix_bounce_t postfix_master_t:file read; - - allow postfix_bounce_t postfix_public_t:sock_file write; - allow postfix_bounce_t postfix_public_t:dir search; -@@ -228,6 +245,7 @@ - # - - allow postfix_cleanup_t self:process setrlimit; -+allow postfix_cleanup_t postfix_master_t:file read; - - # connect to master process - stream_connect_pattern(postfix_cleanup_t,postfix_private_t,postfix_private_t,postfix_master_t) -@@ -250,6 +268,7 @@ - - allow postfix_local_t self:fifo_file rw_fifo_file_perms; - allow postfix_local_t self:process { setsched setrlimit }; -+allow postfix_local_t postfix_master_t:file read; - - manage_dirs_pattern(postfix_local_t,postfix_local_tmp_t,postfix_local_tmp_t) - manage_files_pattern(postfix_local_t,postfix_local_tmp_t,postfix_local_tmp_t) -@@ -369,6 +388,7 @@ - # - - allow postfix_pickup_t self:tcp_socket create_socket_perms; -+allow postfix_pickup_t postfix_master_t:file read; - - stream_connect_pattern(postfix_pickup_t,postfix_private_t,postfix_private_t,postfix_master_t) - -@@ -386,7 +406,7 @@ +@@ -386,7 +402,7 @@ # Postfix pipe local policy # @@ -5149,7 +5355,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post write_sock_files_pattern(postfix_pipe_t,postfix_private_t,postfix_private_t) -@@ -395,6 +415,10 @@ +@@ -395,6 +411,10 @@ rw_files_pattern(postfix_pipe_t,postfix_spool_t,postfix_spool_t) optional_policy(` @@ -5160,7 +5366,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post procmail_domtrans(postfix_pipe_t) ') -@@ -441,6 +465,10 @@ +@@ -441,6 +461,10 @@ ') optional_policy(` @@ -5171,16 +5377,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ppp_use_fds(postfix_postqueue_t) ppp_sigchld(postfix_postqueue_t) ') -@@ -475,6 +503,8 @@ - # Postfix qmgr local policy - # - -+allow postfix_qmgr_t postfix_master_t:file read; -+ - stream_connect_pattern(postfix_qmgr_t,{ postfix_private_t postfix_public_t },{ postfix_private_t postfix_public_t },postfix_master_t) - - rw_fifo_files_pattern(postfix_qmgr_t,postfix_public_t,postfix_public_t) -@@ -519,8 +549,6 @@ +@@ -519,8 +543,6 @@ # Postfix smtp delivery local policy # @@ -5189,7 +5386,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post # connect to master process stream_connect_pattern(postfix_smtp_t,{ postfix_private_t postfix_public_t },{ postfix_private_t postfix_public_t },postfix_master_t) -@@ -552,9 +580,46 @@ +@@ -552,9 +574,45 @@ mta_read_aliases(postfix_smtpd_t) optional_policy(` @@ -5215,7 +5412,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post + +allow postfix_virtual_t self:fifo_file rw_fifo_file_perms; +allow postfix_virtual_t self:process { setsched setrlimit }; -+allow postfix_virtual_t postfix_master_t:file read; + +manage_dirs_pattern(postfix_virtual_t,postfix_virtual_tmp_t,postfix_virtual_tmp_t) +manage_files_pattern(postfix_virtual_t,postfix_virtual_tmp_t,postfix_virtual_tmp_t) @@ -5238,7 +5434,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +mta_manage_spool(postfix_virtual_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-2.6.4/policy/modules/services/ppp.te --- nsaserefpolicy/policy/modules/services/ppp.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ppp.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ppp.te 2007-06-18 10:18:55.000000000 -0400 @@ -155,7 +155,7 @@ files_exec_etc_files(pppd_t) @@ -5250,7 +5446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. # for scripts diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-2.6.4/policy/modules/services/procmail.te --- nsaserefpolicy/policy/modules/services/procmail.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/procmail.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/procmail.te 2007-06-18 10:18:55.000000000 -0400 @@ -10,6 +10,7 @@ type procmail_exec_t; domain_type(procmail_t) @@ -5268,7 +5464,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc kernel_read_system_state(procmail_t) kernel_read_kernel_sysctls(procmail_t) -@@ -101,9 +104,14 @@ +@@ -101,9 +104,15 @@ ') optional_policy(` @@ -5280,10 +5476,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc postfix_dontaudit_rw_local_tcp_sockets(procmail_t) postfix_dontaudit_use_fds(procmail_t) + postfix_read_spool_files(procmail_t) ++ postfix_read_local_state(procmail_t) ') optional_policy(` -@@ -119,8 +127,11 @@ +@@ -119,8 +128,13 @@ optional_policy(` corenet_udp_bind_generic_port(procmail_t) @@ -5294,10 +5491,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc spamassassin_read_lib_files(procmail_t) ') + -+ ++optional_policy(` ++ mailscanner_read_spool(procmail_t) ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-2.6.4/policy/modules/services/pyzor.te --- nsaserefpolicy/policy/modules/services/pyzor.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pyzor.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/pyzor.te 2007-06-18 10:18:55.000000000 -0400 @@ -54,6 +54,11 @@ corenet_udp_sendrecv_all_nodes(pyzor_t) corenet_udp_sendrecv_all_ports(pyzor_t) @@ -5328,7 +5527,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-2.6.4/policy/modules/services/radius.te --- nsaserefpolicy/policy/modules/services/radius.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/radius.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/radius.te 2007-06-18 10:18:55.000000000 -0400 @@ -130,3 +130,7 @@ optional_policy(` udev_read_db(radiusd_t) @@ -5339,7 +5538,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-2.6.4/policy/modules/services/rhgb.te --- nsaserefpolicy/policy/modules/services/rhgb.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rhgb.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rhgb.te 2007-06-18 10:18:55.000000000 -0400 @@ -105,6 +105,7 @@ userdom_dontaudit_use_unpriv_user_fds(rhgb_t) @@ -5348,9 +5547,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb xserver_read_xdm_xserver_tmp_files(rhgb_t) xserver_kill_xdm_xserver(rhgb_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-2.6.4/policy/modules/services/ricci.te +--- nsaserefpolicy/policy/modules/services/ricci.te 2007-05-07 14:50:57.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ricci.te 2007-06-18 11:07:45.000000000 -0400 +@@ -328,6 +328,10 @@ + ') + + optional_policy(` ++ rpm_dontaudit_use_script_fds(ricci_modclusterd_t) ++') ++ ++optional_policy(` + unconfined_use_fds(ricci_modclusterd_t) + ') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-2.6.4/policy/modules/services/rlogin.te --- nsaserefpolicy/policy/modules/services/rlogin.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rlogin.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rlogin.te 2007-06-18 10:18:55.000000000 -0400 @@ -64,6 +64,7 @@ fs_search_auto_mountpoints(rlogind_t) @@ -5361,7 +5574,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.fc serefpolicy-2.6.4/policy/modules/services/rpcbind.fc --- nsaserefpolicy/policy/modules/services/rpcbind.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpcbind.fc 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1,6 @@ + +/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0) @@ -5371,7 +5584,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb +/var/lib/rpcbind(/.*)? gen_context(system_u:object_r:rpcbind_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-2.6.4/policy/modules/services/rpcbind.if --- nsaserefpolicy/policy/modules/services/rpcbind.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpcbind.if 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1,104 @@ + +## policy for rpcbind @@ -5479,7 +5692,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-2.6.4/policy/modules/services/rpcbind.te --- nsaserefpolicy/policy/modules/services/rpcbind.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpcbind.te 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1,83 @@ +policy_module(rpcbind,1.0.0) + @@ -5566,7 +5779,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-2.6.4/policy/modules/services/rpc.if --- nsaserefpolicy/policy/modules/services/rpc.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rpc.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpc.if 2007-06-18 10:18:55.000000000 -0400 @@ -89,8 +89,11 @@ # bind to arbitary unused ports corenet_tcp_bind_generic_port($1_t) @@ -5582,7 +5795,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. fs_search_auto_mountpoints($1_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-2.6.4/policy/modules/services/rpc.te --- nsaserefpolicy/policy/modules/services/rpc.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rpc.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpc.te 2007-06-18 10:18:55.000000000 -0400 @@ -79,6 +79,7 @@ optional_policy(` @@ -5601,7 +5814,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. tunable_policy(`nfs_export_all_ro',` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-2.6.4/policy/modules/services/rsync.te --- nsaserefpolicy/policy/modules/services/rsync.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rsync.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rsync.te 2007-06-18 10:18:55.000000000 -0400 @@ -17,6 +17,7 @@ type rsync_t; type rsync_exec_t; @@ -5612,7 +5825,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn type rsync_data_t; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-2.6.4/policy/modules/services/rwho.if --- nsaserefpolicy/policy/modules/services/rwho.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rwho.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rwho.if 2007-06-18 10:18:55.000000000 -0400 @@ -1 +1,84 @@ -## Who is logged in on other machines? + @@ -5701,7 +5914,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-2.6.4/policy/modules/services/samba.fc --- nsaserefpolicy/policy/modules/services/samba.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/samba.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/samba.fc 2007-06-18 10:18:55.000000000 -0400 @@ -3,6 +3,7 @@ # /etc # @@ -5722,7 +5935,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-2.6.4/policy/modules/services/samba.if --- nsaserefpolicy/policy/modules/services/samba.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/samba.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/samba.if 2007-06-18 10:18:55.000000000 -0400 @@ -177,6 +177,27 @@ ######################################## @@ -5888,7 +6101,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-2.6.4/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/samba.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/samba.te 2007-06-18 10:18:55.000000000 -0400 @@ -28,6 +28,35 @@ ## gen_tunable(samba_share_nfs,false) @@ -6169,7 +6382,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +unconfined_domain(samba_unconfined_script_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-2.6.4/policy/modules/services/sasl.te --- nsaserefpolicy/policy/modules/services/sasl.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/sasl.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/sasl.te 2007-06-18 10:18:55.000000000 -0400 @@ -63,6 +63,7 @@ selinux_compute_access_vector(saslauthd_t) @@ -6189,7 +6402,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-2.6.4/policy/modules/services/sendmail.if --- nsaserefpolicy/policy/modules/services/sendmail.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/sendmail.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/sendmail.if 2007-06-18 10:18:55.000000000 -0400 @@ -76,6 +76,26 @@ ######################################## @@ -6228,7 +6441,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-2.6.4/policy/modules/services/setroubleshoot.te --- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/setroubleshoot.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/setroubleshoot.te 2007-06-18 10:18:55.000000000 -0400 @@ -28,7 +28,7 @@ # @@ -6240,7 +6453,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto }; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-2.6.4/policy/modules/services/smartmon.te --- nsaserefpolicy/policy/modules/services/smartmon.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/smartmon.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/smartmon.te 2007-06-18 10:18:55.000000000 -0400 @@ -60,6 +60,7 @@ fs_search_auto_mountpoints(fsdaemon_t) @@ -6251,7 +6464,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar storage_raw_write_fixed_disk(fsdaemon_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-2.6.4/policy/modules/services/snmp.fc --- nsaserefpolicy/policy/modules/services/snmp.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/snmp.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/snmp.fc 2007-06-18 10:18:55.000000000 -0400 @@ -1,11 +1,5 @@ # @@ -6266,7 +6479,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp /usr/sbin/snmp(trap)?d -- gen_context(system_u:object_r:snmpd_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-2.6.4/policy/modules/services/snmp.te --- nsaserefpolicy/policy/modules/services/snmp.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/snmp.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/snmp.te 2007-06-18 10:18:55.000000000 -0400 @@ -9,9 +9,6 @@ type snmpd_exec_t; init_daemon_domain(snmpd_t,snmpd_exec_t) @@ -6317,9 +6530,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp ') optional_policy(` +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-2.6.4/policy/modules/services/spamassassin.fc +--- nsaserefpolicy/policy/modules/services/spamassassin.fc 2007-05-07 14:50:57.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/spamassassin.fc 2007-06-18 10:50:07.000000000 -0400 +@@ -9,6 +9,10 @@ + /var/lib/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_lib_t,s0) + + /var/spool/spamassassin(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) ++/var/spool/spamd(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) ++ ++/var/run/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) ++/var/run/spamass-milter(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) + + ifdef(`strict_policy',` + HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:ROLE_spamassassin_home_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-2.6.4/policy/modules/services/spamassassin.if --- nsaserefpolicy/policy/modules/services/spamassassin.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/spamassassin.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/spamassassin.if 2007-06-18 10:18:55.000000000 -0400 @@ -466,6 +466,7 @@ ') @@ -6330,7 +6557,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.6.4/policy/modules/services/spamassassin.te --- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/spamassassin.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/spamassassin.te 2007-06-18 10:46:02.000000000 -0400 @@ -6,14 +6,12 @@ # Declarations # @@ -6364,7 +6591,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam ######################################## # -@@ -103,6 +101,7 @@ +@@ -87,8 +85,9 @@ + allow spamd_t spamd_var_lib_t:dir list_dir_perms; + read_files_pattern(spamd_t,spamd_var_lib_t,spamd_var_lib_t) + ++manage_dirs_pattern(spamd_t,spamd_var_run_t,spamd_var_run_t) + manage_files_pattern(spamd_t,spamd_var_run_t,spamd_var_run_t) +-files_pid_filetrans(spamd_t,spamd_var_run_t,file) ++files_pid_filetrans(spamd_t,spamd_var_run_t,{ file dir }) + + kernel_read_all_sysctls(spamd_t) + kernel_read_system_state(spamd_t) +@@ -103,6 +102,7 @@ corenet_tcp_bind_all_nodes(spamd_t) corenet_tcp_bind_spamd_port(spamd_t) corenet_tcp_connect_razor_port(spamd_t) @@ -6372,7 +6610,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam corenet_sendrecv_razor_client_packets(spamd_t) corenet_sendrecv_spamd_server_packets(spamd_t) # spamassassin 3.1 needs this for its -@@ -192,6 +191,11 @@ +@@ -192,6 +192,11 @@ ') optional_policy(` @@ -6386,7 +6624,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-2.6.4/policy/modules/services/squid.fc --- nsaserefpolicy/policy/modules/services/squid.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/squid.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/squid.fc 2007-06-18 10:18:55.000000000 -0400 @@ -12,3 +12,5 @@ /var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0) @@ -6395,7 +6633,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-2.6.4/policy/modules/services/squid.te --- nsaserefpolicy/policy/modules/services/squid.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/squid.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/squid.te 2007-06-18 10:18:55.000000000 -0400 @@ -185,3 +185,12 @@ #squid requires the following when run in diskd mode, the recommended setting allow squid_t tmpfs_t:file { read write }; @@ -6411,7 +6649,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-2.6.4/policy/modules/services/ssh.if --- nsaserefpolicy/policy/modules/services/ssh.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ssh.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ssh.if 2007-06-18 10:18:55.000000000 -0400 @@ -709,3 +709,42 @@ dontaudit $1 sshd_key_t:file { getattr read }; @@ -6457,7 +6695,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-2.6.4/policy/modules/services/ssh.te --- nsaserefpolicy/policy/modules/services/ssh.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ssh.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ssh.te 2007-06-18 10:18:55.000000000 -0400 @@ -24,11 +24,11 @@ # Type for the ssh-agent executable. @@ -6493,7 +6731,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. # Relabel and access ptys created by sshd diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-2.6.4/policy/modules/services/tftp.te --- nsaserefpolicy/policy/modules/services/tftp.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/tftp.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/tftp.te 2007-06-18 10:18:55.000000000 -0400 @@ -69,6 +69,7 @@ logging_send_syslog_msg(tftpd_t) @@ -6509,18 +6747,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-2.6.4/policy/modules/services/w3c.fc --- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/w3c.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/w3c.fc 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1,2 @@ +/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0) +/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-2.6.4/policy/modules/services/w3c.if --- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/w3c.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/w3c.if 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1 @@ +## W3C diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-2.6.4/policy/modules/services/w3c.te --- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/w3c.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/w3c.te 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1,14 @@ +policy_module(w3c,1.2.1) + @@ -6538,7 +6776,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c. +miscfiles_read_certs(httpd_w3c_validator_script_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-2.6.4/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/xserver.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/xserver.if 2007-06-18 10:18:55.000000000 -0400 @@ -1136,7 +1136,7 @@ type xdm_xserver_tmp_t; ') @@ -6550,12 +6788,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-2.6.4/policy/modules/system/application.fc --- nsaserefpolicy/policy/modules/system/application.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/application.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/application.fc 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1 @@ +# No application file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-2.6.4/policy/modules/system/application.if --- nsaserefpolicy/policy/modules/system/application.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/application.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/application.if 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1,104 @@ +## Policy for application domains + @@ -6663,7 +6901,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-2.6.4/policy/modules/system/application.te --- nsaserefpolicy/policy/modules/system/application.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/application.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/application.te 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1,14 @@ + +policy_module(application,1.0.0) @@ -6681,7 +6919,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-2.6.4/policy/modules/system/authlogin.fc --- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/authlogin.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/authlogin.fc 2007-06-18 10:18:55.000000000 -0400 @@ -14,6 +14,7 @@ /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0) /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) @@ -6692,7 +6930,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-2.6.4/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/authlogin.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/authlogin.if 2007-06-18 10:18:55.000000000 -0400 @@ -27,11 +27,9 @@ domain_type($1_chkpwd_t) domain_entry_file($1_chkpwd_t,chkpwd_exec_t) @@ -6965,7 +7203,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-2.6.4/policy/modules/system/authlogin.te --- nsaserefpolicy/policy/modules/system/authlogin.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/authlogin.te 2007-06-12 13:55:58.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/authlogin.te 2007-06-18 10:18:55.000000000 -0400 @@ -9,6 +9,13 @@ attribute can_read_shadow_passwords; attribute can_write_shadow_passwords; @@ -7057,7 +7295,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-2.6.4/policy/modules/system/clock.te --- nsaserefpolicy/policy/modules/system/clock.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/clock.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/clock.te 2007-06-18 10:18:55.000000000 -0400 @@ -26,8 +26,6 @@ allow hwclock_t self:process signal_perms; allow hwclock_t self:fifo_file { getattr read write }; @@ -7083,7 +7321,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-2.6.4/policy/modules/system/fstools.fc --- nsaserefpolicy/policy/modules/system/fstools.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/fstools.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fstools.fc 2007-06-18 10:18:55.000000000 -0400 @@ -19,7 +19,6 @@ /sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0) @@ -7094,7 +7332,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-2.6.4/policy/modules/system/fstools.if --- nsaserefpolicy/policy/modules/system/fstools.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/fstools.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fstools.if 2007-06-18 10:18:55.000000000 -0400 @@ -124,3 +124,22 @@ allow $1 swapfile_t:file getattr; @@ -7120,7 +7358,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-2.6.4/policy/modules/system/fstools.te --- nsaserefpolicy/policy/modules/system/fstools.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/fstools.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fstools.te 2007-06-18 10:18:55.000000000 -0400 @@ -9,6 +9,7 @@ type fsadm_t; type fsadm_exec_t; @@ -7131,7 +7369,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool type fsadm_log_t; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-2.6.4/policy/modules/system/fusermount.fc --- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/fusermount.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fusermount.fc 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1,6 @@ +# fusermount executable will have: +# label: system_u:object_r:fusermount_exec_t @@ -7141,7 +7379,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm +/usr/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-2.6.4/policy/modules/system/fusermount.if --- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/fusermount.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fusermount.if 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1,41 @@ +## policy for fusermount + @@ -7187,7 +7425,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm \ No newline at end of file diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-2.6.4/policy/modules/system/fusermount.te --- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/fusermount.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fusermount.te 2007-06-18 10:18:55.000000000 -0400 @@ -0,0 +1,51 @@ +policy_module(fusermount,1.0.0) + @@ -7242,7 +7480,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-2.6.4/policy/modules/system/getty.te --- nsaserefpolicy/policy/modules/system/getty.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/getty.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/getty.te 2007-06-18 10:18:55.000000000 -0400 @@ -33,7 +33,8 @@ # @@ -7255,7 +7493,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty. allow getty_t self:fifo_file rw_fifo_file_perms; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-2.6.4/policy/modules/system/hostname.te --- nsaserefpolicy/policy/modules/system/hostname.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/hostname.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/hostname.te 2007-06-18 10:18:55.000000000 -0400 @@ -8,8 +8,12 @@ type hostname_t; @@ -7284,7 +7522,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-2.6.4/policy/modules/system/init.if --- nsaserefpolicy/policy/modules/system/init.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/init.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/init.if 2007-06-18 10:18:55.000000000 -0400 @@ -194,11 +194,14 @@ gen_require(` type initrc_t; @@ -7363,7 +7601,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-2.6.4/policy/modules/system/init.te --- nsaserefpolicy/policy/modules/system/init.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/init.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/init.te 2007-06-18 10:18:55.000000000 -0400 @@ -10,13 +10,20 @@ # Declarations # @@ -7464,7 +7702,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-2.6.4/policy/modules/system/ipsec.if --- nsaserefpolicy/policy/modules/system/ipsec.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/ipsec.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/ipsec.if 2007-06-18 10:18:55.000000000 -0400 @@ -114,6 +114,26 @@ ######################################## @@ -7494,7 +7732,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-2.6.4/policy/modules/system/ipsec.te --- nsaserefpolicy/policy/modules/system/ipsec.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/ipsec.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/ipsec.te 2007-06-18 10:18:55.000000000 -0400 @@ -289,6 +289,7 @@ allow racoon_t self:netlink_selinux_socket { bind create read }; allow racoon_t self:udp_socket create_socket_perms; @@ -7505,7 +7743,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-2.6.4/policy/modules/system/iptables.te --- nsaserefpolicy/policy/modules/system/iptables.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/iptables.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/iptables.te 2007-06-18 10:18:55.000000000 -0400 @@ -56,6 +56,7 @@ domain_use_interactive_fds(iptables_t) @@ -7524,7 +7762,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-2.6.4/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/libraries.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/libraries.fc 2007-06-18 10:18:55.000000000 -0400 @@ -81,8 +81,8 @@ /opt/cisco-vpnclient/lib/libvpnapi\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) /opt/netbeans(.*/)?jdk.*/linux/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -7555,7 +7793,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar /usr/lib(64)?/libGLU\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-2.6.4/policy/modules/system/libraries.te --- nsaserefpolicy/policy/modules/system/libraries.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/libraries.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/libraries.te 2007-06-18 10:18:55.000000000 -0400 @@ -62,7 +62,8 @@ manage_dirs_pattern(ldconfig_t,ldconfig_tmp_t,ldconfig_tmp_t) @@ -7578,7 +7816,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-2.6.4/policy/modules/system/locallogin.te --- nsaserefpolicy/policy/modules/system/locallogin.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/locallogin.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/locallogin.te 2007-06-18 10:18:55.000000000 -0400 @@ -48,6 +48,8 @@ allow local_login_t self:msgq create_msgq_perms; allow local_login_t self:msg { send receive }; @@ -7621,7 +7859,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-2.6.4/policy/modules/system/logging.if --- nsaserefpolicy/policy/modules/system/logging.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/logging.if 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/logging.if 2007-06-18 10:18:55.000000000 -0400 @@ -223,6 +223,25 @@ ######################################## @@ -7816,7 +8054,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-2.6.4/policy/modules/system/logging.te --- nsaserefpolicy/policy/modules/system/logging.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/logging.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/logging.te 2007-06-18 10:18:55.000000000 -0400 @@ -7,10 +7,15 @@ # @@ -7904,7 +8142,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin files_dontaudit_search_isid_type_dirs(syslogd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-2.6.4/policy/modules/system/lvm.fc --- nsaserefpolicy/policy/modules/system/lvm.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/lvm.fc 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/lvm.fc 2007-06-18 10:18:55.000000000 -0400 @@ -15,6 +15,7 @@ # /etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0) @@ -7915,7 +8153,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc /etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-2.6.4/policy/modules/system/lvm.te --- nsaserefpolicy/policy/modules/system/lvm.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/lvm.te 2007-06-12 11:16:32.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/lvm.te 2007-06-18 10:18:55.000000000 -0400 @@ -16,6 +16,7 @@ type lvm_t; type lvm_exec_t; @@ -7977,8 +8215,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-2.6.4/policy/modules/system/modutils.te --- nsaserefpolicy/policy/modules/system/modutils.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/modutils.te 2007-06-12 11:16:32.000000000 -0400 -@@ -102,6 +102,7 @@ ++++ serefpolicy-2.6.4/policy/modules/system/modutils.te 2007-06-18 10:18:55.000000000 -0400 +@@ -43,7 +43,7 @@ + # insmod local policy + # + +-allow insmod_t self:capability { dac_override net_raw sys_tty_config }; ++allow insmod_t self:capability { dac_override mknod net_raw sys_tty_config }; + allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal }; + + allow insmod_t self:udp_socket create_socket_perms; +@@ -80,6 +80,8 @@ + # cjp: why is this needed? insmod cannot mounton any dir + # and it also transitions to mount + dev_mount_usbfs(insmod_t) ++# currently ++dev_create_generic_chr_files(insmod_t) + + fs_getattr_xattr_fs(insmod_t) + +@@ -102,6 +104,7 @@ init_use_fds(insmod_t) init_use_script_fds(insmod_t) init_use_script_ptys(insmod_t) @@ -7986,7 +8242,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti libs_use_ld_so(insmod_t) libs_use_shared_libs(insmod_t) -@@ -123,6 +124,18 @@ +@@ -123,6 +126,18 @@ ') optional_policy(` @@ -8005,7 +8261,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti hotplug_search_config(insmod_t) ') -@@ -155,6 +168,7 @@ +@@ -155,6 +170,7 @@ optional_policy(` rpm_rw_pipes(insmod_t) @@ -8013,7 +8269,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti ') optional_policy(` -@@ -185,6 +199,7 @@ +@@ -185,6 +201,7 @@ files_read_kernel_symbol_table(depmod_t) files_read_kernel_modules(depmod_t) @@ -8023,7 +8279,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-2.6.4/policy/modules/system/mount.fc --- nsaserefpolicy/policy/modules/system/mount.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/mount.fc 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/mount.fc 2007-06-18 10:18:55.000000000 -0400 @@ -1,4 +1,3 @@ /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) @@ -8032,7 +8288,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. +/sbin/mount.ntfs-3g -- gen_context(system_u:object_r:mount_ntfs_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-2.6.4/policy/modules/system/mount.if --- nsaserefpolicy/policy/modules/system/mount.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/mount.if 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/mount.if 2007-06-18 10:18:55.000000000 -0400 @@ -143,3 +143,40 @@ mount_domtrans($1) ') @@ -8076,7 +8332,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-2.6.4/policy/modules/system/mount.te --- nsaserefpolicy/policy/modules/system/mount.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/mount.te 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/mount.te 2007-06-18 10:18:55.000000000 -0400 @@ -9,6 +9,13 @@ ifdef(`targeted_policy',` ## @@ -8187,7 +8443,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-2.6.4/policy/modules/system/netlabel.te --- nsaserefpolicy/policy/modules/system/netlabel.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/netlabel.te 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/netlabel.te 2007-06-18 10:18:55.000000000 -0400 @@ -20,6 +20,10 @@ allow netlabel_mgmt_t self:capability net_admin; allow netlabel_mgmt_t self:netlink_socket create_socket_perms; @@ -8201,7 +8457,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlab libs_use_ld_so(netlabel_mgmt_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-2.6.4/policy/modules/system/raid.te --- nsaserefpolicy/policy/modules/system/raid.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/raid.te 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/raid.te 2007-06-18 10:18:55.000000000 -0400 @@ -19,7 +19,7 @@ # Local policy # @@ -8221,7 +8477,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-2.6.4/policy/modules/system/selinuxutil.fc --- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.fc 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.fc 2007-06-18 10:18:55.000000000 -0400 @@ -40,6 +40,7 @@ /usr/sbin/setfiles.* -- gen_context(system_u:object_r:setfiles_exec_t,s0) /usr/sbin/setsebool -- gen_context(system_u:object_r:semanage_exec_t,s0) @@ -8232,7 +8488,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-2.6.4/policy/modules/system/selinuxutil.if --- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.if 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.if 2007-06-18 10:18:55.000000000 -0400 @@ -445,6 +445,7 @@ role $2 types run_init_t; allow run_init_t $3:chr_file rw_term_perms; @@ -8269,7 +8525,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-2.6.4/policy/modules/system/selinuxutil.te --- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.te 2007-06-14 08:16:50.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.te 2007-06-18 10:18:55.000000000 -0400 @@ -1,10 +1,8 @@ policy_module(selinuxutil,1.5.0) @@ -8503,7 +8759,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-2.6.4/policy/modules/system/sysnetwork.te --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/sysnetwork.te 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/sysnetwork.te 2007-06-18 10:18:55.000000000 -0400 @@ -164,6 +164,10 @@ dbus_connect_system_bus(dhcpc_t) dbus_send_system_bus(dhcpc_t) @@ -8533,7 +8789,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-2.6.4/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/udev.te 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/udev.te 2007-06-18 11:26:44.000000000 -0400 @@ -18,11 +18,6 @@ type udev_etc_t alias etc_udev_t; files_config_file(udev_etc_t) @@ -8546,21 +8802,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t type udev_tbl_t alias udev_tdb_t; files_type(udev_tbl_t) -@@ -69,7 +64,7 @@ +@@ -68,8 +63,9 @@ + allow udev_t udev_tbl_t:file manage_file_perms; dev_filetrans(udev_t,udev_tbl_t,file) ++manage_dirs_pattern(udev_t,udev_var_run_t,udev_var_run_t) manage_files_pattern(udev_t,udev_var_run_t,udev_var_run_t) -files_pid_filetrans(udev_t,udev_var_run_t,file) +files_pid_filetrans(udev_t,udev_var_run_t,{ file dir }) kernel_read_system_state(udev_t) kernel_getattr_core_if(udev_t) -@@ -83,16 +78,22 @@ +@@ -83,16 +79,22 @@ kernel_dgram_send(udev_t) kernel_signal(udev_t) +#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182 -+kernel_read_net_sysctls(udev_t) ++kernel_rw_net_sysctls(udev_t) +kernel_read_network_state(udev_t) + corecmd_exec_all_executables(udev_t) @@ -8578,11 +8836,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t files_read_etc_runtime_files(udev_t) files_read_etc_files(udev_t) files_exec_etc_files(udev_t) -@@ -142,8 +143,11 @@ +@@ -142,8 +144,12 @@ seutil_read_file_contexts(udev_t) seutil_domtrans_restorecon(udev_t) +sysnet_read_dhcpc_pid(udev_t) ++sysnet_read_dhcp_config(udev_t) +sysnet_delete_dhcpc_pid(udev_t) sysnet_domtrans_ifconfig(udev_t) sysnet_domtrans_dhcpc(udev_t) @@ -8590,7 +8849,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t userdom_use_sysadm_ttys(udev_t) userdom_dontaudit_search_all_users_home_content(udev_t) -@@ -194,5 +198,24 @@ +@@ -194,5 +200,24 @@ ') optional_policy(` @@ -8604,7 +8863,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t +') + +optional_policy(` -+ xen_append_log(udev_t) ++ xen_manage_log(udev_t) + kernel_write_xen_state(udev_t) + kernel_read_xen_state(udev_t) + xen_read_image_files(udev_t) @@ -8617,7 +8876,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-2.6.4/policy/modules/system/unconfined.fc --- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/unconfined.fc 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/unconfined.fc 2007-06-18 10:18:55.000000000 -0400 @@ -10,4 +10,5 @@ /usr/bin/valgrind -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) /usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) @@ -8626,7 +8885,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-2.6.4/policy/modules/system/unconfined.if --- nsaserefpolicy/policy/modules/system/unconfined.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/unconfined.if 2007-06-14 10:40:13.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/unconfined.if 2007-06-18 10:18:55.000000000 -0400 @@ -18,7 +18,7 @@ ') @@ -8712,7 +8971,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-2.6.4/policy/modules/system/unconfined.te --- nsaserefpolicy/policy/modules/system/unconfined.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/unconfined.te 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/unconfined.te 2007-06-18 10:18:55.000000000 -0400 @@ -6,6 +6,15 @@ # Declarations # @@ -8797,7 +9056,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf init_dbus_chat_script(unconfined_execmem_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.6.4/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/userdomain.if 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/userdomain.if 2007-06-18 10:18:55.000000000 -0400 @@ -114,6 +114,22 @@ # Allow making the stack executable via mprotect. allow $1_t self:process execstack; @@ -9349,7 +9608,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.6.4/policy/modules/system/userdomain.te --- nsaserefpolicy/policy/modules/system/userdomain.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/userdomain.te 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/userdomain.te 2007-06-18 10:18:55.000000000 -0400 @@ -15,7 +15,6 @@ # Declarations # @@ -9547,7 +9806,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-2.6.4/policy/modules/system/xen.if --- nsaserefpolicy/policy/modules/system/xen.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/xen.if 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/xen.if 2007-06-18 10:18:55.000000000 -0400 @@ -72,12 +72,35 @@ ') @@ -9612,7 +9871,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-2.6.4/policy/modules/system/xen.te --- nsaserefpolicy/policy/modules/system/xen.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/xen.te 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/xen.te 2007-06-18 10:28:01.000000000 -0400 @@ -25,6 +25,10 @@ domain_type(xend_t) init_daemon_domain(xend_t, xend_exec_t) @@ -9694,6 +9953,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te ######################################## # # Xen console local policy +@@ -250,7 +260,7 @@ + + miscfiles_read_localization(xenconsoled_t) + +-xen_append_log(xenconsoled_t) ++xen_manage_log(xenconsoled_t) + xen_stream_connect_xenstore(xenconsoled_t) + + ######################################## @@ -284,6 +294,12 @@ files_read_usr_files(xenstored_t) @@ -9739,7 +10007,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-2.6.4/policy/support/misc_patterns.spt --- nsaserefpolicy/policy/support/misc_patterns.spt 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/support/misc_patterns.spt 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/support/misc_patterns.spt 2007-06-18 10:18:55.000000000 -0400 @@ -41,11 +41,6 @@ # # Other process permissions @@ -9754,7 +10022,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns allow $1 $2:{ file lnk_file } { read getattr }; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-2.6.4/policy/support/obj_perm_sets.spt --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/support/obj_perm_sets.spt 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/policy/support/obj_perm_sets.spt 2007-06-18 10:18:55.000000000 -0400 @@ -203,7 +203,6 @@ define(`add_entry_dir_perms',`{ getattr search lock ioctl write add_name }') define(`del_entry_dir_perms',`{ getattr search lock ioctl write remove_name }') @@ -9788,7 +10056,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets + diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-2.6.4/Rules.modular --- nsaserefpolicy/Rules.modular 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/Rules.modular 2007-06-12 11:16:33.000000000 -0400 ++++ serefpolicy-2.6.4/Rules.modular 2007-06-18 10:18:55.000000000 -0400 @@ -167,7 +167,7 @@ # these have to run individually because order matters: $(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true diff --git a/selinux-policy.spec b/selinux-policy.spec index fc31e77..754d929 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -17,7 +17,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 2.6.4 -Release: 15%{?dist} +Release: 17%{?dist} License: GPL Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -360,7 +360,13 @@ semodule -b base.pp -r bootloader -r clock -r dpkg -r fstools -r hotplug -r init %endif %changelog -* Wed Jun 6 2007 Dan Walsh 2.6.4-15 +* Thu Jun 14 2007 Dan Walsh 2.6.4-17 +- Allow udev to manage xen logs + +* Thu Jun 14 2007 Dan Walsh 2.6.4-16 +- Allow udev to create directory in /var/run + +* Wed Jun 13 2007 Dan Walsh 2.6.4-15 - Allow udev to signal dhcpc * Wed Jun 6 2007 Dan Walsh 2.6.4-14