From 291103d8a19dfba7a900503424cfb9f290ed9610 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Jul 31 2007 21:01:35 +0000 Subject: - Fix prelink to handle execmod - Allow mount_ntfs to search file_type:dir --- diff --git a/policy-20070501.patch b/policy-20070501.patch index 9015fec..655cd38 100644 --- a/policy-20070501.patch +++ b/policy-20070501.patch @@ -1,6 +1,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-2.6.4/man/man8/ftpd_selinux.8 --- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/man/man8/ftpd_selinux.8 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/man/man8/ftpd_selinux.8 2007-07-31 16:39:53.000000000 -0400 @@ -12,7 +12,7 @@ .TP chcon -R -t public_content_t /var/ftp @@ -12,7 +12,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 sere .TP diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-2.6.4/policy/flask/access_vectors --- nsaserefpolicy/policy/flask/access_vectors 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/flask/access_vectors 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/flask/access_vectors 2007-07-31 16:39:53.000000000 -0400 @@ -598,6 +598,8 @@ shmempwd shmemgrp @@ -43,7 +43,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/security_classes serefpolicy-2.6.4/policy/flask/security_classes --- nsaserefpolicy/policy/flask/security_classes 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/flask/security_classes 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/flask/security_classes 2007-07-31 16:39:53.000000000 -0400 @@ -97,4 +97,6 @@ class dccp_socket @@ -53,7 +53,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/security_classe # FLASK diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans serefpolicy-2.6.4/policy/global_booleans --- nsaserefpolicy/policy/global_booleans 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/global_booleans 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/global_booleans 2007-07-31 16:39:53.000000000 -0400 @@ -4,7 +4,6 @@ # file should be used. # @@ -72,7 +72,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans seref ##

diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-2.6.4/policy/global_tunables --- nsaserefpolicy/policy/global_tunables 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/global_tunables 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/global_tunables 2007-07-31 16:39:53.000000000 -0400 @@ -102,12 +102,6 @@ ## gen_tunable(use_samba_home_dirs,false) @@ -101,7 +101,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.4/policy/mls --- nsaserefpolicy/policy/mls 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/mls 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/mls 2007-07-31 16:39:53.000000000 -0400 @@ -89,12 +89,14 @@ mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton } (( l1 eq l2 ) or @@ -175,7 +175,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.4 mlsconstrain association { polmatch } diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-2.6.4/policy/modules/admin/acct.te --- nsaserefpolicy/policy/modules/admin/acct.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/acct.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/acct.te 2007-07-31 16:39:53.000000000 -0400 @@ -9,6 +9,7 @@ type acct_t; type acct_exec_t; @@ -186,7 +186,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te logging_log_file(acct_data_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-2.6.4/policy/modules/admin/alsa.fc --- nsaserefpolicy/policy/modules/admin/alsa.fc 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/alsa.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/alsa.fc 2007-07-31 16:39:53.000000000 -0400 @@ -1,4 +1,7 @@ /etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0) @@ -197,7 +197,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc +/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-2.6.4/policy/modules/admin/alsa.te --- nsaserefpolicy/policy/modules/admin/alsa.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/alsa.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/alsa.te 2007-07-31 16:39:53.000000000 -0400 @@ -20,20 +20,24 @@ # Local policy # @@ -246,7 +246,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.te serefpolicy-2.6.4/policy/modules/admin/amanda.te --- nsaserefpolicy/policy/modules/admin/amanda.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/amanda.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/amanda.te 2007-07-31 16:39:53.000000000 -0400 @@ -85,7 +85,7 @@ # access to amandas data structure @@ -268,14 +268,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda. logging_log_filetrans(amanda_t,amanda_log_t,{ file dir }) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.fc serefpolicy-2.6.4/policy/modules/admin/amtu.fc --- nsaserefpolicy/policy/modules/admin/amtu.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/amtu.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/amtu.fc 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,3 @@ + +/usr/bin/amtu -- gen_context(system_u:object_r:amtu_exec_t,s0) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if serefpolicy-2.6.4/policy/modules/admin/amtu.if --- nsaserefpolicy/policy/modules/admin/amtu.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/amtu.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/amtu.if 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,53 @@ +##

+## abstract Machine Test Utility @@ -332,7 +332,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te serefpolicy-2.6.4/policy/modules/admin/amtu.te --- nsaserefpolicy/policy/modules/admin/amtu.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/amtu.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/amtu.te 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,57 @@ +policy_module(amtu,1.0.23) + @@ -393,7 +393,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-2.6.4/policy/modules/admin/bootloader.te --- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/bootloader.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/bootloader.te 2007-07-31 16:39:53.000000000 -0400 @@ -65,6 +65,8 @@ files_tmp_filetrans(bootloader_t,bootloader_tmp_t,{ dir file lnk_file chr_file blk_file }) # for tune2fs (cjp: ?) @@ -413,7 +413,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-2.6.4/policy/modules/admin/consoletype.te --- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/consoletype.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/consoletype.te 2007-07-31 16:39:53.000000000 -0400 @@ -8,7 +8,12 @@ type consoletype_t; @@ -458,7 +458,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-2.6.4/policy/modules/admin/dmesg.te --- nsaserefpolicy/policy/modules/admin/dmesg.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/dmesg.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/dmesg.te 2007-07-31 16:39:53.000000000 -0400 @@ -10,6 +10,7 @@ type dmesg_t; type dmesg_exec_t; @@ -469,7 +469,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.t diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-2.6.4/policy/modules/admin/kudzu.te --- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/kudzu.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/kudzu.te 2007-07-31 16:39:53.000000000 -0400 @@ -21,8 +21,8 @@ # Local policy # @@ -492,7 +492,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t init_telinit(kudzu_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-2.6.4/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/logrotate.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/logrotate.te 2007-07-31 16:39:53.000000000 -0400 @@ -75,6 +75,7 @@ mls_file_read_up(logrotate_t) mls_file_write_down(logrotate_t) @@ -503,7 +503,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota selinux_get_enforce_mode(logrotate_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-2.6.4/policy/modules/admin/logwatch.te --- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/logwatch.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/logwatch.te 2007-07-31 16:39:53.000000000 -0400 @@ -30,7 +30,6 @@ allow logwatch_t self:process signal; allow logwatch_t self:fifo_file rw_file_perms; @@ -574,7 +574,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-2.6.4/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/netutils.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/netutils.te 2007-07-31 16:39:53.000000000 -0400 @@ -31,6 +31,7 @@ type traceroute_t; type traceroute_exec_t; @@ -585,7 +585,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-2.6.4/policy/modules/admin/prelink.te --- nsaserefpolicy/policy/modules/admin/prelink.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/prelink.te 2007-07-24 08:58:20.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/prelink.te 2007-07-31 16:39:53.000000000 -0400 @@ -26,7 +26,7 @@ # Local policy # @@ -633,7 +633,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-2.6.4/policy/modules/admin/readahead.te --- nsaserefpolicy/policy/modules/admin/readahead.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/readahead.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/readahead.te 2007-07-31 16:39:53.000000000 -0400 @@ -18,7 +18,8 @@ # Local policy # @@ -663,7 +663,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-2.6.4/policy/modules/admin/rpm.fc --- nsaserefpolicy/policy/modules/admin/rpm.fc 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/rpm.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/rpm.fc 2007-07-31 16:39:53.000000000 -0400 @@ -21,6 +21,9 @@ /usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -676,7 +676,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-2.6.4/policy/modules/admin/rpm.if --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/rpm.if 2007-07-31 14:04:26.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/rpm.if 2007-07-31 16:39:53.000000000 -0400 @@ -211,6 +211,24 @@ ######################################## @@ -821,7 +821,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-2.6.4/policy/modules/admin/rpm.te --- nsaserefpolicy/policy/modules/admin/rpm.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/rpm.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/rpm.te 2007-07-31 16:39:53.000000000 -0400 @@ -9,6 +9,8 @@ type rpm_t; type rpm_exec_t; @@ -833,7 +833,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te domain_system_change_exemption(rpm_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-2.6.4/policy/modules/admin/sudo.if --- nsaserefpolicy/policy/modules/admin/sudo.if 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/sudo.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/sudo.if 2007-07-31 16:39:53.000000000 -0400 @@ -69,7 +69,6 @@ allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms; allow $1_sudo_t self:unix_dgram_socket sendto; @@ -882,7 +882,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-2.6.4/policy/modules/admin/su.if --- nsaserefpolicy/policy/modules/admin/su.if 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/su.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/su.if 2007-07-31 16:39:53.000000000 -0400 @@ -41,12 +41,11 @@ allow $2 $1_su_t:process signal; @@ -958,7 +958,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-2.6.4/policy/modules/admin/usermanage.if --- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/usermanage.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/usermanage.if 2007-07-31 16:39:53.000000000 -0400 @@ -278,5 +278,5 @@ type crack_db_t; ') @@ -968,7 +968,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-2.6.4/policy/modules/admin/usermanage.te --- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/usermanage.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/usermanage.te 2007-07-31 16:39:53.000000000 -0400 @@ -99,6 +99,7 @@ dev_read_urand(chfn_t) @@ -1138,7 +1138,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-2.6.4/policy/modules/admin/vbetool.te --- nsaserefpolicy/policy/modules/admin/vbetool.te 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/vbetool.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/admin/vbetool.te 2007-07-31 16:39:53.000000000 -0400 @@ -32,4 +32,5 @@ optional_policy(` @@ -1147,7 +1147,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc serefpolicy-2.6.4/policy/modules/apps/games.fc --- nsaserefpolicy/policy/modules/apps/games.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/games.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/games.fc 2007-07-31 16:39:53.000000000 -0400 @@ -1,22 +1,16 @@ # # /usr @@ -1176,7 +1176,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc /usr/bin/gataxx -- gen_context(system_u:object_r:games_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-2.6.4/policy/modules/apps/gnome.if --- nsaserefpolicy/policy/modules/apps/gnome.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/gnome.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/gnome.if 2007-07-31 16:39:53.000000000 -0400 @@ -35,6 +35,7 @@ template(`gnome_per_role_template',` gen_require(` @@ -1232,7 +1232,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if ## This is a templated interface, and should only diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-2.6.4/policy/modules/apps/gpg.fc --- nsaserefpolicy/policy/modules/apps/gpg.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/gpg.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/gpg.fc 2007-07-31 16:39:53.000000000 -0400 @@ -7,6 +7,4 @@ /usr/lib/gnupg/.* -- gen_context(system_u:object_r:gpg_exec_t,s0) /usr/lib/gnupg/gpgkeys.* -- gen_context(system_u:object_r:gpg_helper_exec_t,s0) @@ -1242,7 +1242,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc s -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-2.6.4/policy/modules/apps/java.if --- nsaserefpolicy/policy/modules/apps/java.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/java.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/java.if 2007-07-31 16:39:53.000000000 -0400 @@ -224,3 +224,35 @@ refpolicywarn(`$0($1) has no effect in strict policy.') ') @@ -1281,7 +1281,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.if serefpolicy-2.6.4/policy/modules/apps/loadkeys.if --- nsaserefpolicy/policy/modules/apps/loadkeys.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/loadkeys.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/loadkeys.if 2007-07-31 16:39:53.000000000 -0400 @@ -11,16 +11,12 @@ ## # @@ -1350,7 +1350,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-2.6.4/policy/modules/apps/mozilla.if --- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/mozilla.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/mozilla.if 2007-07-31 16:39:53.000000000 -0400 @@ -150,6 +150,7 @@ corenet_dontaudit_tcp_bind_generic_port($1_mozilla_t) @@ -1361,7 +1361,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. dev_dontaudit_rw_dri($1_mozilla_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-2.6.4/policy/modules/apps/slocate.te --- nsaserefpolicy/policy/modules/apps/slocate.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/slocate.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/slocate.te 2007-07-31 16:39:53.000000000 -0400 @@ -29,8 +29,11 @@ manage_dirs_pattern(locate_t,locate_var_lib_t,locate_var_lib_t) manage_files_pattern(locate_t,locate_var_lib_t,locate_var_lib_t) @@ -1391,7 +1391,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate. libs_use_ld_so(locate_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if serefpolicy-2.6.4/policy/modules/apps/uml.if --- nsaserefpolicy/policy/modules/apps/uml.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/uml.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/uml.if 2007-07-31 16:39:53.000000000 -0400 @@ -193,33 +193,6 @@ nis_use_ypbind($1_uml_t) ') @@ -1428,7 +1428,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if s ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-2.6.4/policy/modules/apps/userhelper.if --- nsaserefpolicy/policy/modules/apps/userhelper.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/userhelper.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/apps/userhelper.if 2007-07-31 16:39:53.000000000 -0400 @@ -131,6 +131,7 @@ term_use_all_user_ptys($1_userhelper_t) @@ -1439,7 +1439,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp auth_search_pam_console_data($1_userhelper_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-2.6.4/policy/modules/kernel/corecommands.fc --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.fc 2007-07-31 13:44:59.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.fc 2007-07-31 16:39:53.000000000 -0400 @@ -36,6 +36,11 @@ /etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0) /etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0) @@ -1486,7 +1486,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco +/etc/apcupsd/onbattery -- gen_context(system_u:object_r:bin_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-2.6.4/policy/modules/kernel/corecommands.if --- nsaserefpolicy/policy/modules/kernel/corecommands.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.if 2007-07-17 08:14:36.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.if 2007-07-31 16:39:53.000000000 -0400 @@ -988,3 +988,23 @@ mmap_files_pattern($1,bin_t,exec_type) @@ -1511,9 +1511,74 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco +') + + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.if.in serefpolicy-2.6.4/policy/modules/kernel/corenetwork.if.in +--- nsaserefpolicy/policy/modules/kernel/corenetwork.if.in 2007-05-07 14:51:04.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/corenetwork.if.in 2007-07-31 16:39:53.000000000 -0400 +@@ -2061,3 +2061,61 @@ + + typeattribute $1 corenet_unconfined_type; + ') ++ ++######################################## ++## ++## Receive TCP packets from an unlabled connection. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`corenet_tcp_recvfrom_unlabeled',` ++ kernel_tcp_recvfrom_unlabeled($1) ++ ++ # XXX - at some point the oubound/send access check will be removed ++ # but for right now we need to keep this in place so as not to break ++ # older systems ++ kernel_sendrecv_unlabeled_association($1) ++') ++######################################## ++## ++## Receive packets from an unlabeled connection. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`corenet_all_recvfrom_unlabeled',` ++ kernel_tcp_recvfrom_unlabeled($1) ++ kernel_udp_recvfrom_unlabeled($1) ++ kernel_raw_recvfrom_unlabeled($1) ++ ++ # XXX - at some point the oubound/send access check will be removed ++ # but for right now we need to keep this in place so as not to break ++ # older systems ++ kernel_sendrecv_unlabeled_association($1) ++') ++ ++######################################## ++## ++## Receive packets from a NetLabel connection. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`corenet_all_recvfrom_netlabel',` ++ gen_require(` ++ type netlabel_peer_t; ++ ') ++ ++ allow $1 netlabel_peer_t:{ tcp_socket udp_socket rawip_socket } recvfrom; ++') ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-2.6.4/policy/modules/kernel/corenetwork.te.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/corenetwork.te.in 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/corenetwork.te.in 2007-07-31 16:39:53.000000000 -0400 @@ -48,6 +48,11 @@ type reserved_port_t, port_type, reserved_port_type; @@ -1564,7 +1629,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-2.6.4/policy/modules/kernel/devices.fc --- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/devices.fc 2007-07-31 13:38:08.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/devices.fc 2007-07-31 16:39:53.000000000 -0400 @@ -19,6 +19,8 @@ /dev/evtchn -c gen_context(system_u:object_r:xen_device_t,s0) /dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0) @@ -1602,7 +1667,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-2.6.4/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/devices.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/devices.if 2007-07-31 16:39:53.000000000 -0400 @@ -2729,6 +2729,24 @@ ######################################## @@ -1709,7 +1774,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-2.6.4/policy/modules/kernel/devices.te --- nsaserefpolicy/policy/modules/kernel/devices.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/devices.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/devices.te 2007-07-31 16:39:53.000000000 -0400 @@ -139,6 +139,12 @@ # # Type for sound devices and mixers @@ -1725,7 +1790,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-2.6.4/policy/modules/kernel/domain.if --- nsaserefpolicy/policy/modules/kernel/domain.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/domain.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/domain.if 2007-07-31 16:39:53.000000000 -0400 @@ -64,6 +64,7 @@ ') @@ -1781,7 +1846,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-2.6.4/policy/modules/kernel/domain.te --- nsaserefpolicy/policy/modules/kernel/domain.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/domain.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/domain.te 2007-07-31 16:39:53.000000000 -0400 @@ -6,6 +6,29 @@ # Declarations # @@ -1852,7 +1917,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-2.6.4/policy/modules/kernel/files.fc --- nsaserefpolicy/policy/modules/kernel/files.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/files.fc 2007-07-25 16:22:10.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/files.fc 2007-07-31 16:39:53.000000000 -0400 @@ -45,7 +45,6 @@ /etc -d gen_context(system_u:object_r:etc_t,s0) /etc/.* gen_context(system_u:object_r:etc_t,s0) @@ -1879,7 +1944,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. /usr/src/kernels/.+/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.6.4/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/files.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/files.if 2007-07-31 16:39:53.000000000 -0400 @@ -343,8 +343,7 @@ ######################################## @@ -2108,7 +2173,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-2.6.4/policy/modules/kernel/files.te --- nsaserefpolicy/policy/modules/kernel/files.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/files.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/files.te 2007-07-31 16:39:53.000000000 -0400 @@ -54,6 +54,7 @@ files_type(etc_t) # compatibility aliases for removed types: @@ -2119,7 +2184,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # etc_runtime_t is the type of various diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-2.6.4/policy/modules/kernel/filesystem.if --- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.if 2007-07-30 10:20:41.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.if 2007-07-31 16:40:46.000000000 -0400 @@ -1096,6 +1096,24 @@ ######################################## @@ -2172,7 +2237,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ## Mount a NFS filesystem. ## ## -@@ -3420,3 +3458,42 @@ +@@ -3420,3 +3458,80 @@ relabelfrom_blk_files_pattern($1,noxattrfs,noxattrfs) relabelfrom_chr_files_pattern($1,noxattrfs,noxattrfs) ') @@ -2215,9 +2280,47 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy +') + + ++######################################## ++## ++## Read files of anon_inodefs file system files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`fs_read_anon_inodefs_files',` ++ gen_require(` ++ type anon_inodefs_t; ++ ++ ') ++ ++ read_files_pattern($1,anon_inodefs_t,anon_inodefs_t) ++') ++ ++######################################## ++## ++## Read/wrie files of anon_inodefs file system files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`fs_rw_anon_inodefs_files',` ++ gen_require(` ++ type anon_inodefs_t; ++ ++ ') ++ ++ rw_files_pattern($1,anon_inodefs_t,anon_inodefs_t) ++') ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.6.4/policy/modules/kernel/filesystem.te --- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.te 2007-07-23 10:45:02.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.te 2007-07-31 16:39:53.000000000 -0400 @@ -43,6 +43,11 @@ # # Non-persistent/pseudo filesystems @@ -2291,7 +2394,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-2.6.4/policy/modules/kernel/kernel.if --- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/kernel.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/kernel.if 2007-07-31 16:39:53.000000000 -0400 @@ -333,6 +333,24 @@ ######################################## @@ -2356,7 +2459,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-2.6.4/policy/modules/kernel/kernel.te --- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/kernel.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/kernel.te 2007-07-31 16:39:53.000000000 -0400 @@ -146,6 +146,8 @@ type unlabeled_t; sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) @@ -2376,7 +2479,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-2.6.4/policy/modules/kernel/mls.if --- nsaserefpolicy/policy/modules/kernel/mls.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/mls.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/mls.if 2007-07-31 16:39:53.000000000 -0400 @@ -154,6 +154,26 @@ ######################################## ## @@ -2406,7 +2509,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-2.6.4/policy/modules/kernel/mls.te --- nsaserefpolicy/policy/modules/kernel/mls.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/mls.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/mls.te 2007-07-31 16:39:53.000000000 -0400 @@ -18,6 +18,7 @@ attribute mlsnetreadtoclr; attribute mlsnetwrite; @@ -2426,7 +2529,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te attribute privrangetrans; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-2.6.4/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/selinux.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/selinux.if 2007-07-31 16:39:53.000000000 -0400 @@ -51,6 +51,44 @@ ######################################## @@ -2474,7 +2577,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-2.6.4/policy/modules/kernel/storage.fc --- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/storage.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/storage.fc 2007-07-31 16:39:53.000000000 -0400 @@ -23,6 +23,7 @@ /dev/loop.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/lvm -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) @@ -2485,7 +2588,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag /dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-2.6.4/policy/modules/kernel/storage.if --- nsaserefpolicy/policy/modules/kernel/storage.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/storage.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/storage.if 2007-07-31 16:39:53.000000000 -0400 @@ -100,6 +100,7 @@ dev_list_all_dev_nodes($1) @@ -2504,7 +2607,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-2.6.4/policy/modules/kernel/terminal.fc --- nsaserefpolicy/policy/modules/kernel/terminal.fc 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/terminal.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/terminal.fc 2007-07-31 16:39:53.000000000 -0400 @@ -8,6 +8,7 @@ /dev/dcbri[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0) /dev/hvc.* -c gen_context(system_u:object_r:tty_device_t,s0) @@ -2515,7 +2618,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin /dev/isdn.* -c gen_context(system_u:object_r:tty_device_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-2.6.4/policy/modules/kernel/terminal.if --- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/terminal.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/terminal.if 2007-07-31 16:39:53.000000000 -0400 @@ -278,6 +278,25 @@ ######################################## @@ -2553,7 +2656,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-2.6.4/policy/modules/kernel/terminal.te --- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/terminal.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/terminal.te 2007-07-31 16:39:53.000000000 -0400 @@ -28,6 +28,7 @@ type devpts_t; files_mountpoint(devpts_t) @@ -2564,7 +2667,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.fc serefpolicy-2.6.4/policy/modules/services/aide.fc --- nsaserefpolicy/policy/modules/services/aide.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/aide.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/aide.fc 2007-07-31 16:39:53.000000000 -0400 @@ -2,5 +2,5 @@ /var/lib/aide(/.*) gen_context(system_u:object_r:aide_db_t,mls_systemhigh) @@ -2574,7 +2677,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide +/var/log/aide(/.*)? gen_context(system_u:object_r:aide_log_t,mls_systemhigh) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.te serefpolicy-2.6.4/policy/modules/services/aide.te --- nsaserefpolicy/policy/modules/services/aide.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/aide.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/aide.te 2007-07-31 16:39:53.000000000 -0400 @@ -26,7 +26,7 @@ allow aide_t self:capability { dac_override fowner }; @@ -2586,7 +2689,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide manage_files_pattern(aide_t,aide_db_t,aide_db_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.if serefpolicy-2.6.4/policy/modules/services/amavis.if --- nsaserefpolicy/policy/modules/services/amavis.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/amavis.if 2007-07-18 09:59:37.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/amavis.if 2007-07-31 16:39:53.000000000 -0400 @@ -37,7 +37,7 @@ ') @@ -2621,7 +2724,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-2.6.4/policy/modules/services/amavis.te --- nsaserefpolicy/policy/modules/services/amavis.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/amavis.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/amavis.te 2007-07-31 16:39:53.000000000 -0400 @@ -170,6 +170,7 @@ optional_policy(` @@ -2632,7 +2735,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-2.6.4/policy/modules/services/apache.fc --- nsaserefpolicy/policy/modules/services/apache.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apache.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apache.fc 2007-07-31 16:39:53.000000000 -0400 @@ -1,10 +1,5 @@ # temporary hack till genhomedircon is fixed -ifdef(`targeted_policy',` @@ -2666,7 +2769,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-2.6.4/policy/modules/services/apache.if --- nsaserefpolicy/policy/modules/services/apache.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apache.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apache.if 2007-07-31 16:52:28.000000000 -0400 @@ -18,10 +18,6 @@ attribute httpd_script_exec_type; type httpd_t, httpd_suexec_t, httpd_log_t; @@ -2689,7 +2792,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac # Allow the web server to run scripts and serve pages tunable_policy(`httpd_builtin_scripting',` manage_dirs_pattern(httpd_t,httpd_$1_script_rw_t,httpd_$1_script_rw_t) -@@ -268,8 +260,11 @@ +@@ -214,10 +206,6 @@ + ') + + optional_policy(` +- mta_send_mail(httpd_$1_script_t) +- ') +- +- optional_policy(` + tunable_policy(`httpd_enable_cgi && allow_ypbind',` + nis_use_ypbind_uncond(httpd_$1_script_t) + ') +@@ -268,8 +256,11 @@ ') apache_content_template($1) @@ -2702,7 +2816,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac userdom_user_home_content($1,httpd_$1_content_t) role $3 types httpd_$1_script_t; -@@ -434,6 +429,24 @@ +@@ -434,6 +425,24 @@ ######################################## ## @@ -2727,7 +2841,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ## Inherit and use file descriptors from Apache. ## ## -@@ -752,6 +765,7 @@ +@@ -752,6 +761,7 @@ ') allow $1 httpd_modules_t:dir list_dir_perms; @@ -2735,7 +2849,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -923,7 +937,7 @@ +@@ -923,7 +933,7 @@ type httpd_squirrelmail_t; ') @@ -2744,7 +2858,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -1000,3 +1014,159 @@ +@@ -1000,3 +1010,159 @@ allow $1 httpd_sys_script_t:dir search_dir_perms; ') @@ -2906,7 +3020,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-2.6.4/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apache.te 2007-07-26 13:46:31.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apache.te 2007-07-31 16:50:17.000000000 -0400 @@ -1,5 +1,5 @@ -policy_module(apache,1.6.0) @@ -2979,19 +3093,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac attribute httpdcontent; # domains that can exec all users scripts -@@ -201,11 +236,6 @@ - type squirrelmail_spool_t; - files_tmp_file(squirrelmail_spool_t) - --ifdef(`targeted_policy',` -- typealias httpd_sys_content_t alias httpd_user_content_t; -- typealias httpd_sys_script_exec_t alias httpd_user_script_exec_t; --') -- - optional_policy(` - prelink_object_file(httpd_modules_t) - ') -@@ -215,7 +245,7 @@ +@@ -215,7 +250,7 @@ # Apache server local policy # @@ -3000,7 +3102,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac dontaudit httpd_t self:capability { net_admin sys_tty_config }; allow httpd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow httpd_t self:fd use; -@@ -257,6 +287,7 @@ +@@ -257,6 +292,7 @@ allow httpd_t httpd_modules_t:dir list_dir_perms; mmap_files_pattern(httpd_t,httpd_modules_t,httpd_modules_t) read_files_pattern(httpd_t,httpd_modules_t,httpd_modules_t) @@ -3008,19 +3110,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac apache_domtrans_rotatelogs(httpd_t) # Apache-httpd needs to be able to send signals to the log rotate procs. -@@ -297,8 +328,10 @@ +@@ -297,6 +333,7 @@ kernel_read_kernel_sysctls(httpd_t) # for modules that want to access /proc/meminfo kernel_read_system_state(httpd_t) +kernel_search_network_sysctl(httpd_t) --corenet_non_ipsec_sendrecv(httpd_t) -+corenet_all_recvfrom_unlabeled(httpd_t) -+corenet_all_recvfrom_netlabel(httpd_t) + corenet_non_ipsec_sendrecv(httpd_t) corenet_tcp_sendrecv_all_if(httpd_t) - corenet_udp_sendrecv_all_if(httpd_t) - corenet_tcp_sendrecv_all_nodes(httpd_t) -@@ -342,6 +375,9 @@ +@@ -342,6 +379,9 @@ files_read_var_lib_symlinks(httpd_t) fs_search_auto_mountpoints(httpd_sys_script_t) @@ -3030,18 +3128,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac libs_use_ld_so(httpd_t) libs_use_shared_libs(httpd_t) -@@ -360,16 +396,12 @@ +@@ -360,16 +400,14 @@ userdom_use_unpriv_users_fds(httpd_t) -mta_send_mail(httpd_t) - --ifdef(`targeted_policy',` -- term_dontaudit_use_unallocated_ttys(httpd_t) -- term_dontaudit_use_generic_ptys(httpd_t) -- files_dontaudit_read_root_files(httpd_t) -+optional_policy(` -+ nscd_socket_use(httpd_t) + ifdef(`targeted_policy',` + term_dontaudit_use_unallocated_ttys(httpd_t) + term_dontaudit_use_generic_ptys(httpd_t) + files_dontaudit_read_root_files(httpd_t) +') - tunable_policy(`httpd_enable_homedirs',` @@ -3052,7 +3148,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') tunable_policy(`allow_httpd_anon_write',` -@@ -382,6 +414,7 @@ +@@ -382,6 +420,7 @@ # tunable_policy(`allow_httpd_mod_auth_pam',` auth_domtrans_chk_passwd(httpd_t) @@ -3060,7 +3156,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ') -@@ -389,6 +422,16 @@ +@@ -389,6 +428,16 @@ corenet_tcp_connect_all_ports(httpd_t) ') @@ -3077,7 +3173,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_can_network_connect_db',` # allow httpd to connect to mysql/posgresql corenet_tcp_connect_postgresql_port(httpd_t) -@@ -416,6 +459,10 @@ +@@ -416,6 +465,10 @@ allow httpd_t httpd_unconfined_script_exec_t:dir list_dir_perms; ') @@ -3088,7 +3184,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',` domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t) -@@ -433,11 +480,21 @@ +@@ -433,11 +486,21 @@ fs_read_nfs_symlinks(httpd_t) ') @@ -3110,17 +3206,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_ssi_exec',` corecmd_shell_domtrans(httpd_t,httpd_sys_script_t) allow httpd_sys_script_t httpd_t:fd use; -@@ -459,10 +516,20 @@ - ') - - optional_policy(` -+ tunable_policy(`httpd_tty_comm',` -+ unconfined_use_terminals(httpd_t) -+ ') -+') -+ -+optional_policy(` - calamaris_read_www_files(httpd_t) +@@ -463,6 +526,10 @@ ') optional_policy(` @@ -3131,55 +3217,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac daemontools_service_domain(httpd_t, httpd_exec_t) ') -@@ -537,10 +604,16 @@ - tunable_policy(`httpd_tty_comm',` - # cjp: this is redundant: - term_use_controlling_term(httpd_helper_t) -- - userdom_use_sysadm_terms(httpd_helper_t) - ') +@@ -606,6 +673,8 @@ + manage_files_pattern(httpd_suexec_t,httpd_suexec_tmp_t,httpd_suexec_tmp_t) + files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir }) -+optional_policy(` -+ tunable_policy(`httpd_tty_comm',` -+ unconfined_use_terminals(httpd_helper_t) -+ ') -+') ++auth_use_nsswitch(httpd_suexec_t) + -+ - ######################################## - # - # Apache PHP script local policy -@@ -631,17 +704,16 @@ - - miscfiles_read_localization(httpd_suexec_t) - --ifdef(`targeted_policy',` -- tunable_policy(`httpd_enable_homedirs',` -- userdom_search_generic_user_home_dirs(httpd_suexec_t) -- ') -+tunable_policy(`httpd_enable_homedirs',` -+ userdom_search_generic_user_home_dirs(httpd_suexec_t) - ') - - tunable_policy(`httpd_can_network_connect',` - allow httpd_suexec_t self:tcp_socket create_stream_socket_perms; - allow httpd_suexec_t self:udp_socket create_socket_perms; - -- corenet_non_ipsec_sendrecv(httpd_suexec_t) -+ corenet_all_recvfrom_unlabeled(httpd_suexec_t) -+ corenet_all_recvfrom_netlabel(httpd_suexec_t) - corenet_tcp_sendrecv_all_if(httpd_suexec_t) - corenet_udp_sendrecv_all_if(httpd_suexec_t) - corenet_tcp_sendrecv_all_nodes(httpd_suexec_t) -@@ -650,7 +722,6 @@ - corenet_udp_sendrecv_all_ports(httpd_suexec_t) - corenet_tcp_connect_all_ports(httpd_suexec_t) - corenet_sendrecv_all_client_packets(httpd_suexec_t) -- - sysnet_read_config(httpd_suexec_t) - ') - -@@ -668,6 +739,12 @@ + kernel_read_kernel_sysctls(httpd_suexec_t) + kernel_list_proc(httpd_suexec_t) + kernel_read_proc_symlinks(httpd_suexec_t) +@@ -668,6 +737,12 @@ fs_exec_nfs_files(httpd_suexec_t) ') @@ -3192,7 +3239,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_suexec_t) fs_read_cifs_symlinks(httpd_suexec_t) -@@ -706,7 +783,8 @@ +@@ -689,13 +764,6 @@ + nagios_domtrans_cgi(httpd_suexec_t) + ') + +-optional_policy(` +- nis_use_ypbind(httpd_suexec_t) +-') +- +-optional_policy(` +- nscd_socket_use(httpd_suexec_t) +-') + + ######################################## + # +@@ -706,7 +774,8 @@ dontaudit httpd_sys_script_t httpd_config_t:dir search; @@ -3202,7 +3263,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms; read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t) -@@ -720,21 +798,66 @@ +@@ -720,21 +789,64 @@ # Should we add a boolean? apache_domtrans_rotatelogs(httpd_sys_script_t) @@ -3235,8 +3296,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms; + allow httpd_sys_script_t self:udp_socket create_socket_perms; + -+ corenet_all_recvfrom_unlabeled(httpd_sys_script_t) -+ corenet_all_recvfrom_netlabel(httpd_sys_script_t) ++ corenet_non_ipsec_sendrecv(httpd_sys_script_t) + corenet_tcp_sendrecv_all_if(httpd_sys_script_t) + corenet_udp_sendrecv_all_if(httpd_sys_script_t) + corenet_tcp_sendrecv_all_nodes(httpd_sys_script_t) @@ -3253,8 +3313,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms; + allow httpd_sys_script_t self:udp_socket create_socket_perms; + -+ corenet_all_recvfrom_unlabeled(httpd_sys_script_t) -+ corenet_all_recvfrom_netlabel(httpd_sys_script_t) ++ corenet_non_ipsec_sendrecv(httpd_sys_script_t) + corenet_tcp_sendrecv_all_if(httpd_sys_script_t) + corenet_udp_sendrecv_all_if(httpd_sys_script_t) + corenet_tcp_sendrecv_all_nodes(httpd_sys_script_t) @@ -3274,7 +3333,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_sys_script_t) fs_read_cifs_symlinks(httpd_sys_script_t) -@@ -754,14 +877,12 @@ +@@ -754,14 +866,8 @@ # Apache unconfined script local policy # @@ -3282,16 +3341,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac - optional_policy(` - cron_system_entry(httpd_t, httpd_exec_t) -+ nscd_socket_use(httpd_unconfined_script_t) - ') - - optional_policy(` +-') +- +-optional_policy(` - nscd_socket_use(httpd_unconfined_script_t) + unconfined_domain(httpd_unconfined_script_t) ') ######################################## -@@ -784,7 +905,25 @@ +@@ -784,7 +890,25 @@ miscfiles_read_localization(httpd_rotatelogs_t) @@ -3322,7 +3380,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-2.6.4/policy/modules/services/apcupsd.fc --- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.fc 2007-07-30 11:42:49.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apcupsd.fc 2007-07-31 16:39:53.000000000 -0400 @@ -1,5 +1,11 @@ /usr/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0) @@ -3337,7 +3395,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +/var/www/apcupsd/upsstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-2.6.4/policy/modules/services/apcupsd.if --- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apcupsd.if 2007-07-31 16:39:53.000000000 -0400 @@ -79,3 +79,25 @@ allow $1 apcupsd_log_t:dir list_dir_perms; allow $1 apcupsd_log_t:file { getattr append }; @@ -3366,7 +3424,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-2.6.4/policy/modules/services/apcupsd.te --- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.te 2007-07-30 11:42:24.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/apcupsd.te 2007-07-31 16:58:45.000000000 -0400 @@ -16,6 +16,9 @@ type apcupsd_log_t; logging_log_file(apcupsd_log_t) @@ -3418,7 +3476,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu files_search_locks(apcupsd_t) +# Creates /etc/nologin +files_manage_etc_runtime_files(apcupsd_t) -+files_etc_filetrans_etc_runtime(apcuspd_t,file) ++files_etc_filetrans_etc_runtime(apcupsd_t,file) + +#apcupsd runs shutdown, probably need a shutdown domain +init_rw_utmp(apcupsd_t) @@ -3473,7 +3531,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.te serefpolicy-2.6.4/policy/modules/services/arpwatch.te --- nsaserefpolicy/policy/modules/services/arpwatch.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/arpwatch.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/arpwatch.te 2007-07-31 16:39:53.000000000 -0400 @@ -28,7 +28,6 @@ allow arpwatch_t self:process signal_perms; allow arpwatch_t self:unix_dgram_socket create_socket_perms; @@ -3502,7 +3560,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpw optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-2.6.4/policy/modules/services/audioentropy.te --- nsaserefpolicy/policy/modules/services/audioentropy.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/audioentropy.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/audioentropy.te 2007-07-31 16:39:53.000000000 -0400 @@ -18,7 +18,7 @@ # Local policy # @@ -3523,7 +3581,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audi fs_getattr_all_fs(entropyd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-2.6.4/policy/modules/services/automount.te --- nsaserefpolicy/policy/modules/services/automount.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/automount.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/automount.te 2007-07-31 16:39:53.000000000 -0400 @@ -69,6 +69,7 @@ files_mounton_all_mountpoints(automount_t) files_mount_all_file_type_fs(automount_t) @@ -3542,7 +3600,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto domain_use_interactive_fds(automount_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-2.6.4/policy/modules/services/avahi.te --- nsaserefpolicy/policy/modules/services/avahi.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/avahi.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/avahi.te 2007-07-31 16:39:53.000000000 -0400 @@ -18,7 +18,7 @@ # Local policy # @@ -3581,7 +3639,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-2.6.4/policy/modules/services/bind.fc --- nsaserefpolicy/policy/modules/services/bind.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/bind.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/bind.fc 2007-07-31 16:39:53.000000000 -0400 @@ -45,4 +45,7 @@ /var/named/chroot/var/named/slaves(/.*)? gen_context(system_u:object_r:named_cache_t,s0) /var/named/chroot/var/named/data(/.*)? gen_context(system_u:object_r:named_cache_t,s0) @@ -3592,7 +3650,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-2.6.4/policy/modules/services/bind.te --- nsaserefpolicy/policy/modules/services/bind.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/bind.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/bind.te 2007-07-31 16:39:53.000000000 -0400 @@ -119,6 +119,10 @@ corenet_sendrecv_rndc_server_packets(named_t) corenet_sendrecv_rndc_client_packets(named_t) @@ -3614,7 +3672,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind fs_getattr_xattr_fs(ndc_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-2.6.4/policy/modules/services/clamav.te --- nsaserefpolicy/policy/modules/services/clamav.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/clamav.te 2007-07-18 09:57:41.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/clamav.te 2007-07-31 16:39:53.000000000 -0400 @@ -126,6 +126,7 @@ amavis_read_lib_files(clamd_t) amavis_read_spool_files(clamd_t) @@ -3649,7 +3707,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-2.6.4/policy/modules/services/consolekit.te --- nsaserefpolicy/policy/modules/services/consolekit.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/consolekit.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/consolekit.te 2007-07-31 16:39:53.000000000 -0400 @@ -10,7 +10,6 @@ type consolekit_exec_t; init_daemon_domain(consolekit_t, consolekit_exec_t) @@ -3697,7 +3755,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-2.6.4/policy/modules/services/courier.te --- nsaserefpolicy/policy/modules/services/courier.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/courier.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/courier.te 2007-07-31 16:39:53.000000000 -0400 @@ -58,6 +58,7 @@ files_getattr_tmp_dirs(courier_authdaemon_t) @@ -3708,7 +3766,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cour diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-2.6.4/policy/modules/services/cron.fc --- nsaserefpolicy/policy/modules/services/cron.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cron.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cron.fc 2007-07-31 16:39:53.000000000 -0400 @@ -17,6 +17,8 @@ /var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0) /var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) @@ -3725,7 +3783,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron +/var/lib/misc(/.*)? gen_context(system_u:object_r:crond_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-2.6.4/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cron.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cron.if 2007-07-31 16:39:53.000000000 -0400 @@ -35,6 +35,7 @@ # template(`cron_per_role_template',` @@ -3862,7 +3920,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-2.6.4/policy/modules/services/cron.te --- nsaserefpolicy/policy/modules/services/cron.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cron.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cron.te 2007-07-31 16:39:53.000000000 -0400 @@ -42,6 +42,9 @@ type cron_log_t; logging_log_file(cron_log_t) @@ -4072,7 +4130,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-2.6.4/policy/modules/services/cups.fc --- nsaserefpolicy/policy/modules/services/cups.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cups.fc 2007-07-31 13:45:11.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cups.fc 2007-07-31 16:39:53.000000000 -0400 @@ -8,6 +8,7 @@ /etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -4098,7 +4156,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups +/usr/local/Brother/lpd(/.*)? gen_context(system_u:object_r:cupsd_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-2.6.4/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cups.te 2007-07-31 12:58:13.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cups.te 2007-07-31 16:41:27.000000000 -0400 @@ -93,8 +93,6 @@ # generic socket here until appletalk socket is available in kernels allow cupsd_t self:socket create_socket_perms; @@ -4117,7 +4175,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups allow cupsd_t cupsd_exec_t:lnk_file read; manage_files_pattern(cupsd_t,cupsd_log_t,cupsd_log_t) -@@ -151,14 +149,16 @@ +@@ -151,20 +149,23 @@ corenet_tcp_bind_reserved_port(cupsd_t) corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t) corenet_tcp_connect_all_ports(cupsd_t) @@ -4135,7 +4193,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups dev_getattr_printer_dev(cupsd_t) domain_read_all_domains_state(cupsd_t) -@@ -177,6 +177,7 @@ + + fs_getattr_all_fs(cupsd_t) + fs_search_auto_mountpoints(cupsd_t) ++fs_read_anon_inodefs_files(cupsd_t) + + mls_fd_use_all_levels(cupsd_t) + mls_file_downgrade(cupsd_t) +@@ -177,6 +178,7 @@ term_search_ptys(cupsd_t) auth_domtrans_chk_passwd(cupsd_t) @@ -4143,7 +4208,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups auth_dontaudit_read_pam_pid(cupsd_t) # Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp -@@ -207,6 +208,7 @@ +@@ -207,6 +209,7 @@ selinux_compute_access_vector(cupsd_t) init_exec_script_files(cupsd_t) @@ -4151,7 +4216,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups libs_use_ld_so(cupsd_t) libs_use_shared_libs(cupsd_t) -@@ -214,6 +216,7 @@ +@@ -214,6 +217,7 @@ libs_read_lib_files(cupsd_t) logging_send_syslog_msg(cupsd_t) @@ -4159,7 +4224,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups miscfiles_read_localization(cupsd_t) # invoking ghostscript needs to read fonts -@@ -223,6 +226,7 @@ +@@ -223,6 +227,7 @@ sysnet_read_config(cupsd_t) @@ -4167,7 +4232,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups userdom_dontaudit_use_unpriv_user_fds(cupsd_t) userdom_dontaudit_search_all_users_home_content(cupsd_t) -@@ -233,6 +237,10 @@ +@@ -233,6 +238,10 @@ lpd_relabel_spool(cupsd_t) ') @@ -4178,7 +4243,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups ifdef(`targeted_policy',` files_dontaudit_read_root_files(cupsd_t) -@@ -284,6 +292,10 @@ +@@ -284,6 +293,10 @@ ') optional_policy(` @@ -4189,7 +4254,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups nscd_socket_use(cupsd_t) ') -@@ -294,6 +306,10 @@ +@@ -294,6 +307,10 @@ ') optional_policy(` @@ -4200,7 +4265,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups seutil_sigchld_newrole(cupsd_t) ') -@@ -587,7 +603,7 @@ +@@ -587,7 +604,7 @@ dev_read_urand(hplip_t) dev_read_rand(hplip_t) dev_rw_generic_usb_dev(hplip_t) @@ -4211,7 +4276,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups fs_search_auto_mountpoints(hplip_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-2.6.4/policy/modules/services/cvs.te --- nsaserefpolicy/policy/modules/services/cvs.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cvs.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cvs.te 2007-07-31 16:39:53.000000000 -0400 @@ -16,6 +16,7 @@ type cvs_t; type cvs_exec_t; @@ -4238,7 +4303,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-2.6.4/policy/modules/services/cyrus.te --- nsaserefpolicy/policy/modules/services/cyrus.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cyrus.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/cyrus.te 2007-07-31 16:39:53.000000000 -0400 @@ -145,6 +145,7 @@ optional_policy(` @@ -4249,7 +4314,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-2.6.4/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dbus.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dbus.if 2007-07-31 16:39:53.000000000 -0400 @@ -49,6 +49,12 @@ ## # @@ -4379,7 +4444,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-2.6.4/policy/modules/services/dbus.te --- nsaserefpolicy/policy/modules/services/dbus.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dbus.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dbus.te 2007-07-31 16:39:53.000000000 -0400 @@ -40,8 +40,6 @@ # Receive notifications of policy reloads and enforcing status changes. allow system_dbusd_t self:netlink_selinux_socket { create bind read }; @@ -4410,7 +4475,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-2.6.4/policy/modules/services/dhcp.te --- nsaserefpolicy/policy/modules/services/dhcp.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dhcp.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dhcp.te 2007-07-31 16:39:53.000000000 -0400 @@ -119,6 +119,8 @@ dbus_system_bus_client_template(dhcpd,dhcpd_t) dbus_connect_system_bus(dhcpd_t) @@ -4422,7 +4487,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-2.6.4/policy/modules/services/djbdns.te --- nsaserefpolicy/policy/modules/services/djbdns.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/djbdns.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/djbdns.te 2007-07-31 16:39:53.000000000 -0400 @@ -44,4 +44,7 @@ libs_use_ld_so(djbdns_axfrdns_t) libs_use_shared_libs(djbdns_axfrdns_t) @@ -4434,7 +4499,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbd + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-2.6.4/policy/modules/services/dovecot.fc --- nsaserefpolicy/policy/modules/services/dovecot.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dovecot.fc 2007-07-23 09:12:37.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dovecot.fc 2007-07-31 16:39:53.000000000 -0400 @@ -17,16 +17,19 @@ ifdef(`distro_debian', ` @@ -4457,7 +4522,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-2.6.4/policy/modules/services/dovecot.if --- nsaserefpolicy/policy/modules/services/dovecot.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dovecot.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dovecot.if 2007-07-31 16:39:53.000000000 -0400 @@ -18,3 +18,43 @@ manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t) manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t) @@ -4504,7 +4569,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-2.6.4/policy/modules/services/dovecot.te --- nsaserefpolicy/policy/modules/services/dovecot.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dovecot.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/dovecot.te 2007-07-31 16:39:53.000000000 -0400 @@ -15,6 +15,12 @@ domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t) role system_r types dovecot_auth_t; @@ -4651,7 +4716,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-2.6.4/policy/modules/services/ftp.te --- nsaserefpolicy/policy/modules/services/ftp.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ftp.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ftp.te 2007-07-31 16:39:53.000000000 -0400 @@ -88,6 +88,7 @@ allow ftpd_t self:unix_stream_socket create_stream_socket_perms; allow ftpd_t self:tcp_socket create_stream_socket_perms; @@ -4695,7 +4760,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. tunable_policy(`ftp_home_dir && use_nfs_home_dirs',` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-2.6.4/policy/modules/services/hal.fc --- nsaserefpolicy/policy/modules/services/hal.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/hal.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/hal.fc 2007-07-31 16:39:53.000000000 -0400 @@ -2,15 +2,20 @@ /etc/hal/device\.d/printer_remove\.hal -- gen_context(system_u:object_r:hald_exec_t,s0) /etc/hal/capability\.d/printer_update\.hal -- gen_context(system_u:object_r:hald_exec_t,s0) @@ -4724,7 +4789,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-2.6.4/policy/modules/services/hal.if --- nsaserefpolicy/policy/modules/services/hal.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/hal.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/hal.if 2007-07-31 16:39:53.000000000 -0400 @@ -208,3 +208,98 @@ files_search_pids($1) allow $1 hald_var_run_t:file rw_file_perms; @@ -4826,7 +4891,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-2.6.4/policy/modules/services/hal.te --- nsaserefpolicy/policy/modules/services/hal.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/hal.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/hal.te 2007-07-31 16:39:53.000000000 -0400 @@ -61,8 +61,6 @@ # For backwards compatibility with older kernels allow hald_t self:netlink_socket create_socket_perms; @@ -4891,7 +4956,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. dev_setattr_usbfs_files(hald_acl_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-2.6.4/policy/modules/services/inetd.te --- nsaserefpolicy/policy/modules/services/inetd.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/inetd.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/inetd.te 2007-07-31 16:39:53.000000000 -0400 @@ -135,8 +135,8 @@ mls_fd_use_all_levels(inetd_t) mls_fd_share_all_levels(inetd_t) @@ -4914,7 +4979,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet manage_dirs_pattern(inetd_child_t,inetd_child_tmp_t,inetd_child_tmp_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-2.6.4/policy/modules/services/kerberos.if --- nsaserefpolicy/policy/modules/services/kerberos.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/kerberos.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/kerberos.if 2007-07-31 16:39:53.000000000 -0400 @@ -33,43 +33,10 @@ # interface(`kerberos_use',` @@ -5063,7 +5128,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-2.6.4/policy/modules/services/kerberos.te --- nsaserefpolicy/policy/modules/services/kerberos.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/kerberos.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/kerberos.te 2007-07-31 16:39:53.000000000 -0400 @@ -5,6 +5,7 @@ # # Declarations @@ -5145,7 +5210,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-2.6.4/policy/modules/services/lpd.if --- nsaserefpolicy/policy/modules/services/lpd.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/lpd.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/lpd.if 2007-07-31 16:39:53.000000000 -0400 @@ -394,3 +394,22 @@ domtrans_pattern($2, lpr_exec_t, $1_lpr_t) @@ -5171,7 +5236,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-2.6.4/policy/modules/services/mailman.if --- nsaserefpolicy/policy/modules/services/mailman.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/mailman.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/mailman.if 2007-07-31 16:39:53.000000000 -0400 @@ -275,6 +275,25 @@ ####################################### @@ -5200,7 +5265,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-2.6.4/policy/modules/services/mailman.te --- nsaserefpolicy/policy/modules/services/mailman.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/mailman.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/mailman.te 2007-07-31 16:39:53.000000000 -0400 @@ -96,6 +96,7 @@ kernel_read_proc_symlinks(mailman_queue_t) @@ -5211,13 +5276,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-2.6.4/policy/modules/services/mailscanner.fc --- nsaserefpolicy/policy/modules/services/mailscanner.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/mailscanner.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/mailscanner.fc 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,2 @@ +/var/spool/MailScanner(/.*)? gen_context(system_u:object_r:mailscanner_spool_t,s0) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-2.6.4/policy/modules/services/mailscanner.if --- nsaserefpolicy/policy/modules/services/mailscanner.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/mailscanner.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/mailscanner.if 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,59 @@ +## Anti-Virus and Anti-Spam Filter + @@ -5280,7 +5345,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-2.6.4/policy/modules/services/mailscanner.te --- nsaserefpolicy/policy/modules/services/mailscanner.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/mailscanner.te 2007-07-14 07:34:09.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/mailscanner.te 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,8 @@ + +policy_module(mailscanner,1.0.0) @@ -5292,7 +5357,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-2.6.4/policy/modules/services/mta.if --- nsaserefpolicy/policy/modules/services/mta.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/mta.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/mta.if 2007-07-31 16:39:53.000000000 -0400 @@ -394,6 +394,7 @@ allow $1 mail_spool_t:dir list_dir_perms; create_files_pattern($1,mail_spool_t,mail_spool_t) @@ -5329,7 +5394,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. ## Read sendmail binary. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-2.6.4/policy/modules/services/mta.te --- nsaserefpolicy/policy/modules/services/mta.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/mta.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/mta.te 2007-07-31 16:39:53.000000000 -0400 @@ -27,6 +27,7 @@ type sendmail_exec_t; @@ -5363,7 +5428,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-2.6.4/policy/modules/services/nagios.te --- nsaserefpolicy/policy/modules/services/nagios.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nagios.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nagios.te 2007-07-31 16:39:53.000000000 -0400 @@ -73,8 +73,10 @@ corenet_udp_sendrecv_all_nodes(nagios_t) corenet_tcp_sendrecv_all_ports(nagios_t) @@ -5395,7 +5460,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-2.6.4/policy/modules/services/networkmanager.fc --- nsaserefpolicy/policy/modules/services/networkmanager.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/networkmanager.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/networkmanager.fc 2007-07-31 16:39:53.000000000 -0400 @@ -1,5 +1,6 @@ /usr/(s)?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) @@ -5405,7 +5470,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw /var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-2.6.4/policy/modules/services/networkmanager.if --- nsaserefpolicy/policy/modules/services/networkmanager.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/networkmanager.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/networkmanager.if 2007-07-31 16:39:53.000000000 -0400 @@ -78,3 +78,22 @@ allow $1 NetworkManager_t:dbus send_msg; allow NetworkManager_t $1:dbus send_msg; @@ -5431,7 +5496,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-2.6.4/policy/modules/services/networkmanager.te --- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/networkmanager.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/networkmanager.te 2007-07-31 16:39:53.000000000 -0400 @@ -41,6 +41,8 @@ kernel_read_kernel_sysctls(NetworkManager_t) kernel_load_module(NetworkManager_t) @@ -5460,7 +5525,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-2.6.4/policy/modules/services/nis.fc --- nsaserefpolicy/policy/modules/services/nis.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nis.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nis.fc 2007-07-31 16:39:53.000000000 -0400 @@ -4,6 +4,7 @@ /sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0) @@ -5471,7 +5536,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. /usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.6.4/policy/modules/services/nis.if --- nsaserefpolicy/policy/modules/services/nis.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nis.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nis.if 2007-07-31 16:39:53.000000000 -0400 @@ -48,8 +48,8 @@ corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) @@ -5485,7 +5550,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_tcp_connect_portmap_port($1) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-2.6.4/policy/modules/services/nis.te --- nsaserefpolicy/policy/modules/services/nis.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nis.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nis.te 2007-07-31 16:39:53.000000000 -0400 @@ -120,6 +120,13 @@ ') @@ -5539,7 +5604,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_tcp_connect_all_ports(ypxfr_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-2.6.4/policy/modules/services/nscd.te --- nsaserefpolicy/policy/modules/services/nscd.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nscd.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/nscd.te 2007-07-31 16:39:53.000000000 -0400 @@ -28,14 +28,14 @@ # Local policy # @@ -5603,7 +5668,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-2.6.4/policy/modules/services/ntp.te --- nsaserefpolicy/policy/modules/services/ntp.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ntp.te 2007-07-19 10:44:29.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ntp.te 2007-07-31 16:39:53.000000000 -0400 @@ -36,6 +36,7 @@ dontaudit ntpd_t self:capability { net_admin sys_tty_config fsetid sys_nice }; allow ntpd_t self:process { signal_perms setcap setsched setrlimit }; @@ -5643,7 +5708,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-2.6.4/policy/modules/services/oddjob.te --- nsaserefpolicy/policy/modules/services/oddjob.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/oddjob.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/oddjob.te 2007-07-31 16:39:53.000000000 -0400 @@ -27,7 +27,7 @@ # oddjob local policy # @@ -5655,7 +5720,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj allow oddjob_t self:unix_stream_socket create_stream_socket_perms; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.fc serefpolicy-2.6.4/policy/modules/services/openct.fc --- nsaserefpolicy/policy/modules/services/openct.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openct.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openct.fc 2007-07-31 16:39:53.000000000 -0400 @@ -2,6 +2,7 @@ # /usr # @@ -5666,7 +5731,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open # /var diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.if serefpolicy-2.6.4/policy/modules/services/openct.if --- nsaserefpolicy/policy/modules/services/openct.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openct.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openct.if 2007-07-31 16:39:53.000000000 -0400 @@ -1 +1,83 @@ -## Service for handling smart card readers. + @@ -5754,7 +5819,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-2.6.4/policy/modules/services/openct.te --- nsaserefpolicy/policy/modules/services/openct.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openct.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openct.te 2007-07-31 16:39:53.000000000 -0400 @@ -21,9 +21,13 @@ dontaudit openct_t self:capability sys_tty_config; allow openct_t self:process signal_perms; @@ -5780,7 +5845,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.fc serefpolicy-2.6.4/policy/modules/services/openvpn.fc --- nsaserefpolicy/policy/modules/services/openvpn.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openvpn.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openvpn.fc 2007-07-31 16:39:53.000000000 -0400 @@ -11,5 +11,5 @@ # # /var @@ -5791,7 +5856,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open +/var/run/openvpn(/.*)? gen_context(system_u:object_r:openvpn_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-2.6.4/policy/modules/services/openvpn.if --- nsaserefpolicy/policy/modules/services/openvpn.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openvpn.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openvpn.if 2007-07-31 16:39:53.000000000 -0400 @@ -22,3 +22,71 @@ read_files_pattern($1,openvpn_etc_t,openvpn_etc_t) read_lnk_files_pattern($1,openvpn_etc_t,openvpn_etc_t) @@ -5866,7 +5931,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-2.6.4/policy/modules/services/openvpn.te --- nsaserefpolicy/policy/modules/services/openvpn.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openvpn.te 2007-07-14 07:58:50.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/openvpn.te 2007-07-31 16:39:53.000000000 -0400 @@ -1,11 +1,18 @@ -policy_module(openvpn,1.2.0) @@ -5951,7 +6016,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-2.6.4/policy/modules/services/pcscd.te --- nsaserefpolicy/policy/modules/services/pcscd.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pcscd.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/pcscd.te 2007-07-31 16:39:53.000000000 -0400 @@ -21,6 +21,7 @@ # @@ -5976,7 +6041,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcsc + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-2.6.4/policy/modules/services/pegasus.if --- nsaserefpolicy/policy/modules/services/pegasus.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pegasus.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/pegasus.if 2007-07-31 16:39:53.000000000 -0400 @@ -1 +1,19 @@ ## The Open Group Pegasus CIM/WBEM Server. + @@ -5999,7 +6064,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-2.6.4/policy/modules/services/pegasus.te --- nsaserefpolicy/policy/modules/services/pegasus.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pegasus.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/pegasus.te 2007-07-31 16:39:53.000000000 -0400 @@ -38,8 +38,6 @@ allow pegasus_t self:unix_stream_socket create_stream_socket_perms; allow pegasus_t self:tcp_socket create_stream_socket_perms; @@ -6044,7 +6109,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-2.6.4/policy/modules/services/portslave.te --- nsaserefpolicy/policy/modules/services/portslave.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/portslave.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/portslave.te 2007-07-31 16:39:53.000000000 -0400 @@ -84,6 +84,7 @@ auth_rw_login_records(portslave_t) @@ -6055,7 +6120,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-2.6.4/policy/modules/services/postfix.fc --- nsaserefpolicy/policy/modules/services/postfix.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/postfix.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/postfix.fc 2007-07-31 16:39:53.000000000 -0400 @@ -5,6 +5,7 @@ /usr/libexec/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0) /usr/libexec/postfix/lmtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0) @@ -6066,7 +6131,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post /usr/libexec/postfix/(n)?qmgr -- gen_context(system_u:object_r:postfix_qmgr_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-2.6.4/policy/modules/services/postfix.if --- nsaserefpolicy/policy/modules/services/postfix.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/postfix.if 2007-07-16 09:36:11.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/postfix.if 2007-07-31 16:41:46.000000000 -0400 @@ -41,6 +41,7 @@ allow postfix_$1_t self:unix_stream_socket connectto; @@ -6075,7 +6140,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post allow postfix_$1_t postfix_etc_t:dir list_dir_perms; read_files_pattern(postfix_$1_t,postfix_etc_t,postfix_etc_t) -@@ -137,10 +138,8 @@ +@@ -66,6 +67,7 @@ + + fs_search_auto_mountpoints(postfix_$1_t) + fs_getattr_xattr_fs(postfix_$1_t) ++ fs_rw_anon_inodefs_files(postfix_$1_t) + + term_dontaudit_use_console(postfix_$1_t) + +@@ -137,10 +139,8 @@ corenet_tcp_connect_all_ports(postfix_$1_t) corenet_sendrecv_all_client_packets(postfix_$1_t) @@ -6087,7 +6160,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ') ') -@@ -274,6 +273,42 @@ +@@ -274,6 +274,42 @@ ######################################## ## @@ -6130,7 +6203,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ## Do not audit attempts to use ## postfix master process file ## file descriptors. -@@ -439,6 +474,25 @@ +@@ -439,6 +475,25 @@ ######################################## ## @@ -6156,7 +6229,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ## Execute postfix user mail programs ## in their respective domains. ## -@@ -455,3 +509,22 @@ +@@ -455,3 +510,22 @@ typeattribute $1 postfix_user_domtrans; ') @@ -6181,7 +6254,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-2.6.4/policy/modules/services/postfix.te --- nsaserefpolicy/policy/modules/services/postfix.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/postfix.te 2007-07-18 10:00:24.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/postfix.te 2007-07-31 16:39:53.000000000 -0400 @@ -84,6 +84,12 @@ type postfix_var_run_t; files_pid_file(postfix_var_run_t) @@ -6337,7 +6410,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +mta_manage_spool(postfix_virtual_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-2.6.4/policy/modules/services/ppp.te --- nsaserefpolicy/policy/modules/services/ppp.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ppp.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ppp.te 2007-07-31 16:39:53.000000000 -0400 @@ -155,7 +155,7 @@ files_exec_etc_files(pppd_t) @@ -6349,7 +6422,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. # for scripts diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-2.6.4/policy/modules/services/procmail.te --- nsaserefpolicy/policy/modules/services/procmail.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/procmail.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/procmail.te 2007-07-31 16:39:53.000000000 -0400 @@ -10,6 +10,7 @@ type procmail_exec_t; domain_type(procmail_t) @@ -6400,7 +6473,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-2.6.4/policy/modules/services/pyzor.te --- nsaserefpolicy/policy/modules/services/pyzor.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pyzor.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/pyzor.te 2007-07-31 16:39:53.000000000 -0400 @@ -54,6 +54,11 @@ corenet_udp_sendrecv_all_nodes(pyzor_t) corenet_udp_sendrecv_all_ports(pyzor_t) @@ -6431,7 +6504,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-2.6.4/policy/modules/services/radius.te --- nsaserefpolicy/policy/modules/services/radius.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/radius.te 2007-07-23 10:49:13.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/radius.te 2007-07-31 16:39:53.000000000 -0400 @@ -81,6 +81,7 @@ auth_read_shadow(radiusd_t) @@ -6458,7 +6531,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radvd.te serefpolicy-2.6.4/policy/modules/services/radvd.te --- nsaserefpolicy/policy/modules/services/radvd.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/radvd.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/radvd.te 2007-07-31 16:39:53.000000000 -0400 @@ -34,7 +34,7 @@ files_pid_filetrans(radvd_t,radvd_var_run_t,file) @@ -6470,7 +6543,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radv diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-2.6.4/policy/modules/services/rhgb.te --- nsaserefpolicy/policy/modules/services/rhgb.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rhgb.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rhgb.te 2007-07-31 16:39:53.000000000 -0400 @@ -105,6 +105,7 @@ userdom_dontaudit_use_unpriv_user_fds(rhgb_t) @@ -6481,7 +6554,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb xserver_kill_xdm_xserver(rhgb_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-2.6.4/policy/modules/services/ricci.te --- nsaserefpolicy/policy/modules/services/ricci.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ricci.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ricci.te 2007-07-31 16:39:53.000000000 -0400 @@ -137,6 +137,7 @@ files_create_boot_flag(ricci_t) @@ -6503,7 +6576,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-2.6.4/policy/modules/services/rlogin.te --- nsaserefpolicy/policy/modules/services/rlogin.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rlogin.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rlogin.te 2007-07-31 16:39:53.000000000 -0400 @@ -64,6 +64,7 @@ fs_search_auto_mountpoints(rlogind_t) @@ -6514,7 +6587,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.fc serefpolicy-2.6.4/policy/modules/services/rpcbind.fc --- nsaserefpolicy/policy/modules/services/rpcbind.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpcbind.fc 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,6 @@ + +/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0) @@ -6524,7 +6597,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb +/var/lib/rpcbind(/.*)? gen_context(system_u:object_r:rpcbind_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-2.6.4/policy/modules/services/rpcbind.if --- nsaserefpolicy/policy/modules/services/rpcbind.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpcbind.if 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,104 @@ + +## policy for rpcbind @@ -6632,7 +6705,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-2.6.4/policy/modules/services/rpcbind.te --- nsaserefpolicy/policy/modules/services/rpcbind.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpcbind.te 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,83 @@ +policy_module(rpcbind,1.0.0) + @@ -6719,7 +6792,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-2.6.4/policy/modules/services/rpc.if --- nsaserefpolicy/policy/modules/services/rpc.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rpc.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpc.if 2007-07-31 16:39:53.000000000 -0400 @@ -89,8 +89,11 @@ # bind to arbitary unused ports corenet_tcp_bind_generic_port($1_t) @@ -6735,7 +6808,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. fs_search_auto_mountpoints($1_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-2.6.4/policy/modules/services/rpc.te --- nsaserefpolicy/policy/modules/services/rpc.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rpc.te 2007-07-31 14:16:39.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rpc.te 2007-07-31 16:39:53.000000000 -0400 @@ -59,10 +59,13 @@ manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t) files_pid_filetrans(rpcd_t,rpcd_var_run_t,file) @@ -6782,7 +6855,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. tunable_policy(`nfs_export_all_ro',` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-2.6.4/policy/modules/services/rshd.te --- nsaserefpolicy/policy/modules/services/rshd.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rshd.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rshd.te 2007-07-31 16:39:53.000000000 -0400 @@ -44,6 +44,7 @@ selinux_compute_user_contexts(rshd_t) @@ -6793,7 +6866,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-2.6.4/policy/modules/services/rsync.te --- nsaserefpolicy/policy/modules/services/rsync.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rsync.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rsync.te 2007-07-31 16:39:53.000000000 -0400 @@ -17,6 +17,7 @@ type rsync_t; type rsync_exec_t; @@ -6804,7 +6877,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn type rsync_data_t; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-2.6.4/policy/modules/services/rwho.if --- nsaserefpolicy/policy/modules/services/rwho.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rwho.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/rwho.if 2007-07-31 16:39:53.000000000 -0400 @@ -1 +1,84 @@ -## Who is logged in on other machines? + @@ -6893,7 +6966,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-2.6.4/policy/modules/services/samba.fc --- nsaserefpolicy/policy/modules/services/samba.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/samba.fc 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/samba.fc 2007-07-31 16:39:53.000000000 -0400 @@ -3,6 +3,7 @@ # /etc # @@ -6914,7 +6987,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-2.6.4/policy/modules/services/samba.if --- nsaserefpolicy/policy/modules/services/samba.if 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/samba.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/samba.if 2007-07-31 16:39:53.000000000 -0400 @@ -177,6 +177,27 @@ ######################################## @@ -7080,7 +7153,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-2.6.4/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/samba.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/samba.te 2007-07-31 16:39:53.000000000 -0400 @@ -28,6 +28,35 @@ ## gen_tunable(samba_share_nfs,false) @@ -7403,7 +7476,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +unconfined_domain(samba_unconfined_script_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-2.6.4/policy/modules/services/sasl.te --- nsaserefpolicy/policy/modules/services/sasl.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/sasl.te 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/sasl.te 2007-07-31 16:39:53.000000000 -0400 @@ -63,6 +63,7 @@ selinux_compute_access_vector(saslauthd_t) @@ -7423,7 +7496,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-2.6.4/policy/modules/services/sendmail.if --- nsaserefpolicy/policy/modules/services/sendmail.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/sendmail.if 2007-07-13 13:11:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/sendmail.if 2007-07-31 16:39:53.000000000 -0400 @@ -76,6 +76,26 @@ ######################################## @@ -7483,8 +7556,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-2.6.4/policy/modules/services/setroubleshoot.te --- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/setroubleshoot.te 2007-07-13 13:11:47.000000000 -0400 -@@ -28,7 +28,7 @@ ++++ serefpolicy-2.6.4/policy/modules/services/setroubleshoot.te 2007-07-31 16:39:53.000000000 -0400 +@@ -28,12 +28,11 @@ # allow setroubleshootd_t self:capability { dac_override sys_tty_config }; @@ -7493,9 +7566,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr allow setroubleshootd_t self:fifo_file rw_fifo_file_perms; allow setroubleshootd_t self:tcp_socket create_stream_socket_perms; allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto }; + allow setroubleshootd_t self:unix_dgram_socket create_socket_perms; +-allow setroubleshootd_t self:netlink_route_socket r_netlink_socket_perms; + + # database files + allow setroubleshootd_t setroubleshoot_var_lib_t:dir setattr; +@@ -51,6 +50,8 @@ + manage_sock_files_pattern(setroubleshootd_t,setroubleshoot_var_run_t,setroubleshoot_var_run_t) + files_pid_filetrans(setroubleshootd_t,setroubleshoot_var_run_t, { file sock_file }) + ++auth_use_nsswitch(setroubleshootd_t) ++ + kernel_read_kernel_sysctls(setroubleshootd_t) + kernel_read_system_state(setroubleshootd_t) + kernel_read_network_state(setroubleshootd_t) +@@ -111,7 +112,3 @@ + rpm_dontaudit_manage_db(setroubleshootd_t) + rpm_use_script_fds(setroubleshootd_t) + ') +- +-optional_policy(` +- nis_use_ypbind(setroubleshootd_t) +-') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-2.6.4/policy/modules/services/smartmon.te --- nsaserefpolicy/policy/modules/services/smartmon.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/smartmon.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/smartmon.te 2007-07-31 16:39:53.000000000 -0400 @@ -60,6 +60,7 @@ fs_search_auto_mountpoints(fsdaemon_t) @@ -7506,7 +7601,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar storage_raw_write_fixed_disk(fsdaemon_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-2.6.4/policy/modules/services/snmp.fc --- nsaserefpolicy/policy/modules/services/snmp.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/snmp.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/snmp.fc 2007-07-31 16:39:53.000000000 -0400 @@ -1,11 +1,5 @@ # @@ -7521,7 +7616,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp /usr/sbin/snmp(trap)?d -- gen_context(system_u:object_r:snmpd_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-2.6.4/policy/modules/services/snmp.te --- nsaserefpolicy/policy/modules/services/snmp.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/snmp.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/snmp.te 2007-07-31 16:39:53.000000000 -0400 @@ -9,9 +9,6 @@ type snmpd_exec_t; init_daemon_domain(snmpd_t,snmpd_exec_t) @@ -7574,7 +7669,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-2.6.4/policy/modules/services/spamassassin.fc --- nsaserefpolicy/policy/modules/services/spamassassin.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/spamassassin.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/spamassassin.fc 2007-07-31 16:39:53.000000000 -0400 @@ -9,6 +9,10 @@ /var/lib/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_lib_t,s0) @@ -7588,7 +7683,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam HOME_DIR/\.spamassassin(/.*)? gen_context(system_u:object_r:ROLE_spamassassin_home_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-2.6.4/policy/modules/services/spamassassin.if --- nsaserefpolicy/policy/modules/services/spamassassin.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/spamassassin.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/spamassassin.if 2007-07-31 16:39:53.000000000 -0400 @@ -466,6 +466,7 @@ ') @@ -7599,7 +7694,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.6.4/policy/modules/services/spamassassin.te --- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/spamassassin.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/spamassassin.te 2007-07-31 16:39:53.000000000 -0400 @@ -6,14 +6,12 @@ # Declarations # @@ -7666,7 +7761,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-2.6.4/policy/modules/services/squid.fc --- nsaserefpolicy/policy/modules/services/squid.fc 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/squid.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/squid.fc 2007-07-31 16:39:53.000000000 -0400 @@ -12,3 +12,5 @@ /var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0) @@ -7675,7 +7770,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-2.6.4/policy/modules/services/squid.te --- nsaserefpolicy/policy/modules/services/squid.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/squid.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/squid.te 2007-07-31 16:39:53.000000000 -0400 @@ -108,6 +108,8 @@ fs_getattr_all_fs(squid_t) @@ -7703,7 +7798,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-2.6.4/policy/modules/services/ssh.if --- nsaserefpolicy/policy/modules/services/ssh.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ssh.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ssh.if 2007-07-31 16:39:53.000000000 -0400 @@ -709,3 +709,42 @@ dontaudit $1 sshd_key_t:file { getattr read }; @@ -7749,7 +7844,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-2.6.4/policy/modules/services/ssh.te --- nsaserefpolicy/policy/modules/services/ssh.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ssh.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/ssh.te 2007-07-31 16:39:53.000000000 -0400 @@ -24,11 +24,11 @@ # Type for the ssh-agent executable. @@ -7785,7 +7880,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. # Relabel and access ptys created by sshd diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-2.6.4/policy/modules/services/tftp.te --- nsaserefpolicy/policy/modules/services/tftp.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/tftp.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/tftp.te 2007-07-31 16:39:53.000000000 -0400 @@ -69,6 +69,7 @@ logging_send_syslog_msg(tftpd_t) @@ -7801,7 +7896,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-2.6.4/policy/modules/services/uwimap.te --- nsaserefpolicy/policy/modules/services/uwimap.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/uwimap.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/uwimap.te 2007-07-31 16:39:53.000000000 -0400 @@ -63,6 +63,7 @@ fs_search_auto_mountpoints(imapd_t) @@ -7812,18 +7907,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwim libs_use_shared_libs(imapd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-2.6.4/policy/modules/services/w3c.fc --- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/w3c.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/w3c.fc 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,2 @@ +/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0) +/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-2.6.4/policy/modules/services/w3c.if --- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/w3c.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/w3c.if 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1 @@ +## W3C diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-2.6.4/policy/modules/services/w3c.te --- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/w3c.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/w3c.te 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,14 @@ +policy_module(w3c,1.2.1) + @@ -7841,7 +7936,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c. +miscfiles_read_certs(httpd_w3c_validator_script_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-2.6.4/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/xserver.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/xserver.if 2007-07-31 16:39:53.000000000 -0400 @@ -83,6 +83,8 @@ manage_files_pattern($1_xserver_t,xserver_log_t,xserver_log_t) logging_log_filetrans($1_xserver_t,xserver_log_t,file) @@ -7877,7 +7972,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-2.6.4/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2007-05-07 14:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/xserver.te 2007-07-31 10:08:59.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/services/xserver.te 2007-07-31 16:39:53.000000000 -0400 @@ -448,6 +448,10 @@ rhgb_rw_tmpfs_files(xdm_xserver_t) ') @@ -7891,12 +7986,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # perhaps define derived types. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-2.6.4/policy/modules/system/application.fc --- nsaserefpolicy/policy/modules/system/application.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/application.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/application.fc 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1 @@ +# No application file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-2.6.4/policy/modules/system/application.if --- nsaserefpolicy/policy/modules/system/application.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/application.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/application.if 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,104 @@ +## Policy for application domains + @@ -8004,7 +8099,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-2.6.4/policy/modules/system/application.te --- nsaserefpolicy/policy/modules/system/application.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/application.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/application.te 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,14 @@ + +policy_module(application,1.0.0) @@ -8022,7 +8117,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-2.6.4/policy/modules/system/authlogin.fc --- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/authlogin.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/authlogin.fc 2007-07-31 16:39:53.000000000 -0400 @@ -14,6 +14,7 @@ /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0) /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) @@ -8033,7 +8128,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-2.6.4/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/authlogin.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/authlogin.if 2007-07-31 16:39:53.000000000 -0400 @@ -27,11 +27,9 @@ domain_type($1_chkpwd_t) domain_entry_file($1_chkpwd_t,chkpwd_exec_t) @@ -8320,7 +8415,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-2.6.4/policy/modules/system/authlogin.te --- nsaserefpolicy/policy/modules/system/authlogin.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/authlogin.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/authlogin.te 2007-07-31 16:39:53.000000000 -0400 @@ -9,6 +9,13 @@ attribute can_read_shadow_passwords; attribute can_write_shadow_passwords; @@ -8412,13 +8507,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.fc serefpolicy-2.6.4/policy/modules/system/brctl.fc --- nsaserefpolicy/policy/modules/system/brctl.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/brctl.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/brctl.fc 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,2 @@ + +/usr/sbin/brctl -- gen_context(system_u:object_r:brctl_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.if serefpolicy-2.6.4/policy/modules/system/brctl.if --- nsaserefpolicy/policy/modules/system/brctl.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/brctl.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/brctl.if 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,24 @@ + +## policy for brctl @@ -8446,7 +8541,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.te serefpolicy-2.6.4/policy/modules/system/brctl.te --- nsaserefpolicy/policy/modules/system/brctl.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/brctl.te 2007-07-30 11:23:46.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/brctl.te 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,50 @@ +policy_module(brctl,1.0.0) + @@ -8500,7 +8595,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-2.6.4/policy/modules/system/clock.te --- nsaserefpolicy/policy/modules/system/clock.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/clock.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/clock.te 2007-07-31 16:39:53.000000000 -0400 @@ -26,8 +26,6 @@ allow hwclock_t self:process signal_perms; allow hwclock_t self:fifo_file { getattr read write }; @@ -8526,7 +8621,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-2.6.4/policy/modules/system/fstools.fc --- nsaserefpolicy/policy/modules/system/fstools.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/fstools.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fstools.fc 2007-07-31 16:39:53.000000000 -0400 @@ -19,7 +19,6 @@ /sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0) @@ -8537,7 +8632,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-2.6.4/policy/modules/system/fstools.if --- nsaserefpolicy/policy/modules/system/fstools.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/fstools.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fstools.if 2007-07-31 16:39:53.000000000 -0400 @@ -124,3 +124,22 @@ allow $1 swapfile_t:file getattr; @@ -8563,7 +8658,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-2.6.4/policy/modules/system/fstools.te --- nsaserefpolicy/policy/modules/system/fstools.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/fstools.te 2007-07-25 10:26:51.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fstools.te 2007-07-31 16:39:53.000000000 -0400 @@ -9,6 +9,7 @@ type fsadm_t; type fsadm_exec_t; @@ -8584,7 +8679,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-2.6.4/policy/modules/system/fusermount.fc --- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/fusermount.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fusermount.fc 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,6 @@ +# fusermount executable will have: +# label: system_u:object_r:fusermount_exec_t @@ -8594,7 +8689,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm +/usr/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-2.6.4/policy/modules/system/fusermount.if --- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/fusermount.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fusermount.if 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,41 @@ +## policy for fusermount + @@ -8640,7 +8735,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm \ No newline at end of file diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-2.6.4/policy/modules/system/fusermount.te --- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/fusermount.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/fusermount.te 2007-07-31 16:39:53.000000000 -0400 @@ -0,0 +1,51 @@ +policy_module(fusermount,1.0.0) + @@ -8695,7 +8790,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-2.6.4/policy/modules/system/getty.te --- nsaserefpolicy/policy/modules/system/getty.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/getty.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/getty.te 2007-07-31 16:39:53.000000000 -0400 @@ -33,7 +33,8 @@ # @@ -8708,7 +8803,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty. allow getty_t self:fifo_file rw_fifo_file_perms; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-2.6.4/policy/modules/system/hostname.te --- nsaserefpolicy/policy/modules/system/hostname.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/hostname.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/hostname.te 2007-07-31 16:39:53.000000000 -0400 @@ -8,8 +8,12 @@ type hostname_t; @@ -8737,7 +8832,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-2.6.4/policy/modules/system/init.if --- nsaserefpolicy/policy/modules/system/init.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/init.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/init.if 2007-07-31 16:39:53.000000000 -0400 @@ -194,11 +194,14 @@ gen_require(` type initrc_t; @@ -8816,7 +8911,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-2.6.4/policy/modules/system/init.te --- nsaserefpolicy/policy/modules/system/init.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/init.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/init.te 2007-07-31 16:39:53.000000000 -0400 @@ -10,13 +10,20 @@ # Declarations # @@ -8917,7 +9012,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-2.6.4/policy/modules/system/ipsec.if --- nsaserefpolicy/policy/modules/system/ipsec.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/ipsec.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/ipsec.if 2007-07-31 16:39:53.000000000 -0400 @@ -114,6 +114,26 @@ ######################################## @@ -8947,7 +9042,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-2.6.4/policy/modules/system/ipsec.te --- nsaserefpolicy/policy/modules/system/ipsec.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/ipsec.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/ipsec.te 2007-07-31 16:39:53.000000000 -0400 @@ -289,6 +289,7 @@ allow racoon_t self:netlink_selinux_socket { bind create read }; allow racoon_t self:udp_socket create_socket_perms; @@ -8958,7 +9053,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-2.6.4/policy/modules/system/iptables.te --- nsaserefpolicy/policy/modules/system/iptables.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/iptables.te 2007-07-19 09:15:31.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/iptables.te 2007-07-31 16:39:53.000000000 -0400 @@ -36,6 +36,8 @@ allow iptables_t iptables_tmp_t:file manage_file_perms; files_tmp_filetrans(iptables_t, iptables_tmp_t, { file dir }) @@ -9008,7 +9103,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-2.6.4/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/libraries.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/libraries.fc 2007-07-31 16:39:53.000000000 -0400 @@ -81,8 +81,8 @@ /opt/cisco-vpnclient/lib/libvpnapi\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) /opt/netbeans(.*/)?jdk.*/linux/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -9057,7 +9152,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar # vmware diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-2.6.4/policy/modules/system/libraries.te --- nsaserefpolicy/policy/modules/system/libraries.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/libraries.te 2007-07-18 09:35:12.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/libraries.te 2007-07-31 16:39:53.000000000 -0400 @@ -62,7 +62,8 @@ manage_dirs_pattern(ldconfig_t,ldconfig_tmp_t,ldconfig_tmp_t) @@ -9088,7 +9183,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-2.6.4/policy/modules/system/locallogin.te --- nsaserefpolicy/policy/modules/system/locallogin.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/locallogin.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/locallogin.te 2007-07-31 16:39:53.000000000 -0400 @@ -48,6 +48,8 @@ allow local_login_t self:msgq create_msgq_perms; allow local_login_t self:msg { send receive }; @@ -9136,7 +9231,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-2.6.4/policy/modules/system/logging.fc --- nsaserefpolicy/policy/modules/system/logging.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/logging.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/logging.fc 2007-07-31 16:39:53.000000000 -0400 @@ -43,3 +43,5 @@ /var/spool/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0) @@ -9145,7 +9240,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin +/var/log/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-2.6.4/policy/modules/system/logging.if --- nsaserefpolicy/policy/modules/system/logging.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/logging.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/logging.if 2007-07-31 16:39:53.000000000 -0400 @@ -223,6 +223,25 @@ ######################################## @@ -9340,7 +9435,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-2.6.4/policy/modules/system/logging.te --- nsaserefpolicy/policy/modules/system/logging.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/logging.te 2007-07-26 14:57:05.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/logging.te 2007-07-31 16:39:53.000000000 -0400 @@ -7,10 +7,15 @@ # @@ -9444,7 +9539,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin files_dontaudit_search_isid_type_dirs(syslogd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-2.6.4/policy/modules/system/lvm.fc --- nsaserefpolicy/policy/modules/system/lvm.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/lvm.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/lvm.fc 2007-07-31 16:39:53.000000000 -0400 @@ -15,6 +15,7 @@ # /etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0) @@ -9455,7 +9550,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc /etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-2.6.4/policy/modules/system/lvm.te --- nsaserefpolicy/policy/modules/system/lvm.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/lvm.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/lvm.te 2007-07-31 16:39:53.000000000 -0400 @@ -16,6 +16,7 @@ type lvm_t; type lvm_exec_t; @@ -9527,7 +9622,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-2.6.4/policy/modules/system/modutils.te --- nsaserefpolicy/policy/modules/system/modutils.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/modutils.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/modutils.te 2007-07-31 16:39:53.000000000 -0400 @@ -43,7 +43,7 @@ # insmod local policy # @@ -9591,7 +9686,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-2.6.4/policy/modules/system/mount.fc --- nsaserefpolicy/policy/modules/system/mount.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/mount.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/mount.fc 2007-07-31 16:39:53.000000000 -0400 @@ -1,4 +1,3 @@ /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) @@ -9600,7 +9695,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. +/sbin/mount.ntfs-3g -- gen_context(system_u:object_r:mount_ntfs_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-2.6.4/policy/modules/system/mount.if --- nsaserefpolicy/policy/modules/system/mount.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/mount.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/mount.if 2007-07-31 16:39:53.000000000 -0400 @@ -143,3 +143,40 @@ mount_domtrans($1) ') @@ -9644,7 +9739,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-2.6.4/policy/modules/system/mount.te --- nsaserefpolicy/policy/modules/system/mount.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/mount.te 2007-07-31 13:48:21.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/mount.te 2007-07-31 16:39:53.000000000 -0400 @@ -9,6 +9,13 @@ ifdef(`targeted_policy',` ## @@ -9785,7 +9880,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-2.6.4/policy/modules/system/netlabel.te --- nsaserefpolicy/policy/modules/system/netlabel.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/netlabel.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/netlabel.te 2007-07-31 16:39:53.000000000 -0400 @@ -20,6 +20,10 @@ allow netlabel_mgmt_t self:capability net_admin; allow netlabel_mgmt_t self:netlink_socket create_socket_perms; @@ -9799,7 +9894,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlab libs_use_ld_so(netlabel_mgmt_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-2.6.4/policy/modules/system/raid.te --- nsaserefpolicy/policy/modules/system/raid.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/raid.te 2007-07-31 09:57:06.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/raid.te 2007-07-31 16:39:53.000000000 -0400 @@ -19,7 +19,7 @@ # Local policy # @@ -9827,7 +9922,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-2.6.4/policy/modules/system/selinuxutil.fc --- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.fc 2007-07-31 16:39:53.000000000 -0400 @@ -40,6 +40,7 @@ /usr/sbin/setfiles.* -- gen_context(system_u:object_r:setfiles_exec_t,s0) /usr/sbin/setsebool -- gen_context(system_u:object_r:semanage_exec_t,s0) @@ -9838,7 +9933,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-2.6.4/policy/modules/system/selinuxutil.if --- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.if 2007-07-31 16:39:53.000000000 -0400 @@ -445,6 +445,7 @@ role $2 types run_init_t; allow run_init_t $3:chr_file rw_term_perms; @@ -9875,7 +9970,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-2.6.4/policy/modules/system/selinuxutil.te --- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.te 2007-07-31 16:39:53.000000000 -0400 @@ -1,10 +1,8 @@ policy_module(selinuxutil,1.5.0) @@ -10109,7 +10204,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-2.6.4/policy/modules/system/sysnetwork.if --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/sysnetwork.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/sysnetwork.if 2007-07-31 16:39:53.000000000 -0400 @@ -520,6 +520,9 @@ files_search_etc($1) @@ -10122,7 +10217,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-2.6.4/policy/modules/system/sysnetwork.te --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/sysnetwork.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/sysnetwork.te 2007-07-31 16:39:53.000000000 -0400 @@ -164,6 +164,10 @@ dbus_connect_system_bus(dhcpc_t) dbus_send_system_bus(dhcpc_t) @@ -10152,7 +10247,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-2.6.4/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/udev.te 2007-07-14 08:51:16.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/udev.te 2007-07-31 16:39:53.000000000 -0400 @@ -18,11 +18,6 @@ type udev_etc_t alias etc_udev_t; files_config_file(udev_etc_t) @@ -10272,7 +10367,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-2.6.4/policy/modules/system/unconfined.fc --- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/unconfined.fc 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/unconfined.fc 2007-07-31 16:39:53.000000000 -0400 @@ -10,4 +10,5 @@ /usr/bin/valgrind -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) /usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) @@ -10281,7 +10376,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-2.6.4/policy/modules/system/unconfined.if --- nsaserefpolicy/policy/modules/system/unconfined.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/unconfined.if 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/unconfined.if 2007-07-31 16:39:53.000000000 -0400 @@ -18,7 +18,7 @@ ') @@ -10367,7 +10462,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-2.6.4/policy/modules/system/unconfined.te --- nsaserefpolicy/policy/modules/system/unconfined.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/unconfined.te 2007-07-16 13:04:12.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/unconfined.te 2007-07-31 16:39:53.000000000 -0400 @@ -6,6 +6,15 @@ # Declarations # @@ -10452,7 +10547,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf init_dbus_chat_script(unconfined_execmem_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.6.4/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/userdomain.if 2007-07-28 11:08:16.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/userdomain.if 2007-07-31 16:39:53.000000000 -0400 @@ -114,6 +114,22 @@ # Allow making the stack executable via mprotect. allow $1_t self:process execstack; @@ -11013,7 +11108,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.6.4/policy/modules/system/userdomain.te --- nsaserefpolicy/policy/modules/system/userdomain.te 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/userdomain.te 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/userdomain.te 2007-07-31 16:39:53.000000000 -0400 @@ -15,7 +15,6 @@ # Declarations # @@ -11211,7 +11306,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-2.6.4/policy/modules/system/xen.if --- nsaserefpolicy/policy/modules/system/xen.if 2007-05-07 14:51:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/xen.if 2007-07-14 08:55:51.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/xen.if 2007-07-31 16:39:53.000000000 -0400 @@ -72,12 +72,34 @@ ') @@ -11296,7 +11391,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-2.6.4/policy/modules/system/xen.te --- nsaserefpolicy/policy/modules/system/xen.te 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/xen.te 2007-07-18 16:21:40.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/system/xen.te 2007-07-31 16:39:53.000000000 -0400 @@ -25,6 +25,10 @@ domain_type(xend_t) init_daemon_domain(xend_t, xend_exec_t) @@ -11440,7 +11535,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-2.6.4/policy/support/misc_patterns.spt --- nsaserefpolicy/policy/support/misc_patterns.spt 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/support/misc_patterns.spt 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/support/misc_patterns.spt 2007-07-31 16:39:53.000000000 -0400 @@ -41,11 +41,6 @@ # # Other process permissions @@ -11455,7 +11550,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns allow $1 $2:{ file lnk_file } { read getattr }; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-2.6.4/policy/support/obj_perm_sets.spt --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/support/obj_perm_sets.spt 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/policy/support/obj_perm_sets.spt 2007-07-31 16:39:53.000000000 -0400 @@ -203,7 +203,6 @@ define(`add_entry_dir_perms',`{ getattr search lock ioctl write add_name }') define(`del_entry_dir_perms',`{ getattr search lock ioctl write remove_name }') @@ -11489,7 +11584,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets + diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-2.6.4/Rules.modular --- nsaserefpolicy/Rules.modular 2007-05-07 14:51:05.000000000 -0400 -+++ serefpolicy-2.6.4/Rules.modular 2007-07-13 13:11:47.000000000 -0400 ++++ serefpolicy-2.6.4/Rules.modular 2007-07-31 16:39:53.000000000 -0400 @@ -167,7 +167,7 @@ # these have to run individually because order matters: $(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true