From fc8ff2feac6a9eff90177ab6e940b3bfde392c4f Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Aug 20 2009 00:02:37 +0000 Subject: - Allow libvirt to change user componant of virt_domain --- diff --git a/policy-F12.patch b/policy-F12.patch index a773c6f..cc7c045 100644 --- a/policy-F12.patch +++ b/policy-F12.patch @@ -1,3 +1,13 @@ +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/Changelog serefpolicy-3.6.28/Changelog +--- nsaserefpolicy/Changelog 2009-08-18 18:39:50.000000000 -0400 ++++ serefpolicy-3.6.28/Changelog 2009-08-18 13:23:29.000000000 -0400 +@@ -1,6 +1,3 @@ +-- Misc Gentoo fixes from Corentin Labbe. +-- Debian policykit fixes from Martin Orr. +-- Fix unconfined_r use of unconfined_java_t. + - Add missing x_device rules for XI2 functions, from Eamon Walsh. + - Add missing rules to make unconfined_cronjob_t a valid cron job domain. + - Add btrfs and ext4 to labeling targets. diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_contexts serefpolicy-3.6.28/config/appconfig-mcs/default_contexts --- nsaserefpolicy/config/appconfig-mcs/default_contexts 2009-07-14 14:19:57.000000000 -0400 +++ serefpolicy-3.6.28/config/appconfig-mcs/default_contexts 2009-08-18 13:23:29.000000000 -0400 @@ -632,6 +642,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.te serefpolicy-3.6.28/policy/modules/admin/portage.te --- nsaserefpolicy/policy/modules/admin/portage.te 2009-08-18 18:39:50.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/admin/portage.te 2009-08-18 13:23:29.000000000 -0400 +@@ -1,5 +1,5 @@ + +-policy_module(portage, 1.8.1) ++policy_module(portage, 1.8.0) + + ######################################## + # +@@ -119,7 +119,6 @@ + # - setfscreate for merging to live fs + # - setexec to run portage fetch + allow portage_t self:process { setfscreate setexec }; +-allow portage_t self:capability sys_nice; + + allow portage_t portage_log_t:file manage_file_perms; + logging_log_filetrans(portage_t, portage_log_t, file) @@ -196,7 +195,7 @@ # - for rsync and distfile fetching # @@ -3482,8 +3507,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ptchown.te serefpolicy-3.6.28/policy/modules/apps/ptchown.te --- nsaserefpolicy/policy/modules/apps/ptchown.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.6.28/policy/modules/apps/ptchown.te 2009-08-18 13:23:29.000000000 -0400 -@@ -0,0 +1,38 @@ ++++ serefpolicy-3.6.28/policy/modules/apps/ptchown.te 2009-08-19 17:37:18.000000000 -0400 +@@ -0,0 +1,39 @@ +policy_module(ptchown,1.0.0) + +######################################## @@ -3503,7 +3528,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +# ptchown local policy +# + -+allow ptchown_t self:capability { fowner chown setuid }; ++allow ptchown_t self:capability { chown fowner fsetid setuid }; +allow ptchown_t self:process { getcap setcap }; + +# Init script handling @@ -3517,9 +3542,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + +fs_rw_anon_inodefs_files(ptchown_t) + -+term_use_generic_ptys(ptchown_t) +term_setattr_generic_ptys(ptchown_t) +term_setattr_all_user_ptys(ptchown_t) ++term_use_generic_ptys(ptchown_t) ++term_use_ptmx(ptchown_t) + +miscfiles_read_localization(ptchown_t) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te @@ -5137,7 +5163,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.6.28/policy/modules/kernel/domain.if --- nsaserefpolicy/policy/modules/kernel/domain.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/kernel/domain.if 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/kernel/domain.if 2009-08-19 16:58:54.000000000 -0400 @@ -44,34 +44,6 @@ interface(`domain_type',` # start with basic domain @@ -10709,6 +10735,25 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol manage_files_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t) + files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir }) ') +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.6.28/policy/modules/services/dbus.fc +--- nsaserefpolicy/policy/modules/services/dbus.fc 2009-08-18 18:39:50.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/dbus.fc 2009-08-18 11:41:45.000000000 -0400 +@@ -1,13 +1,12 @@ + /etc/dbus-1(/.*)? gen_context(system_u:object_r:dbusd_etc_t,s0) + ++# Sorting does not work correctly if I combine these next two roles ++/usr/bin/dbus-daemon(-1)? -- gen_context(system_u:object_r:dbusd_exec_t,s0) + /bin/dbus-daemon -- gen_context(system_u:object_r:dbusd_exec_t,s0) + + /lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0) + /lib64/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0) + +-/usr/bin/dbus-daemon(-1)? -- gen_context(system_u:object_r:dbusd_exec_t,s0) +-/usr/libexec/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0) +- + /var/lib/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_lib_t,s0) + + /var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.28/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2009-07-28 13:28:33.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/services/dbus.if 2009-08-18 13:23:29.000000000 -0400 @@ -10806,6 +10851,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.6.28/policy/modules/services/dbus.te --- nsaserefpolicy/policy/modules/services/dbus.te 2009-08-18 18:39:50.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/services/dbus.te 2009-08-18 13:23:29.000000000 -0400 +@@ -1,5 +1,5 @@ + +-policy_module(dbus, 1.11.1) ++policy_module(dbus, 1.11.0) + + gen_require(` + class dbus all_dbus_perms; @@ -86,6 +86,7 @@ dev_read_sysfs(system_dbusd_t) @@ -13443,7 +13495,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ######################################## diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.6.28/policy/modules/services/openvpn.te --- nsaserefpolicy/policy/modules/services/openvpn.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/services/openvpn.te 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/openvpn.te 2009-08-19 17:17:15.000000000 -0400 @@ -86,6 +86,7 @@ corenet_udp_bind_openvpn_port(openvpn_t) corenet_tcp_connect_openvpn_port(openvpn_t) @@ -13452,7 +13504,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corenet_rw_tun_tap_dev(openvpn_t) corenet_sendrecv_openvpn_server_packets(openvpn_t) corenet_sendrecv_openvpn_client_packets(openvpn_t) -@@ -114,6 +115,16 @@ +@@ -98,6 +99,8 @@ + files_read_etc_files(openvpn_t) + files_read_etc_runtime_files(openvpn_t) + ++auth_use_pam(openvpn_t) ++ + logging_send_syslog_msg(openvpn_t) + + miscfiles_read_localization(openvpn_t) +@@ -114,6 +117,16 @@ userdom_read_user_home_content_files(openvpn_t) ') @@ -13598,6 +13659,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow $1 policykit_t:dbus send_msg; allow policykit_t $1:dbus send_msg; ') +@@ -41,7 +43,6 @@ + + ######################################## + ## +-## Execute a policy_auth in the policy_auth domain, and + ## allow the specified role the policy_auth domain, + ## + ## @@ -206,4 +207,47 @@ files_search_var_lib($1) @@ -15590,7 +15659,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.6.28/policy/modules/services/sasl.te --- nsaserefpolicy/policy/modules/services/sasl.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/services/sasl.te 2009-08-18 13:25:10.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/sasl.te 2009-08-19 17:16:45.000000000 -0400 @@ -31,7 +31,7 @@ # Local policy # @@ -17610,7 +17679,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +/var/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_var_run_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.6.28/policy/modules/services/virt.if --- nsaserefpolicy/policy/modules/services/virt.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/services/virt.if 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/virt.if 2009-08-19 17:01:25.000000000 -0400 @@ -103,7 +103,7 @@ ######################################## @@ -17708,7 +17777,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## All of the rules required to administrate ## an virt environment ## -@@ -327,3 +364,77 @@ +@@ -327,3 +364,79 @@ virt_manage_log($1) ') @@ -17734,6 +17803,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + domain_type($1_t) + role system_r types $1_t; + ++ domain_user_exemption_target($1_t) ++ + type $1_tmp_t; + files_tmp_file($1_tmp_t) + @@ -17788,7 +17859,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.28/policy/modules/services/virt.te --- nsaserefpolicy/policy/modules/services/virt.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/services/virt.te 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/virt.te 2009-08-19 17:26:56.000000000 -0400 @@ -20,6 +20,28 @@ ## gen_tunable(virt_use_samba, false) @@ -17897,7 +17968,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corecmd_exec_bin(virtd_t) corecmd_exec_shell(virtd_t) -@@ -96,30 +152,51 @@ +@@ -96,30 +152,52 @@ corenet_tcp_sendrecv_generic_node(virtd_t) corenet_tcp_sendrecv_all_ports(virtd_t) corenet_tcp_bind_generic_node(virtd_t) @@ -17934,6 +18005,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +files_manage_etc_files(virtd_t) + +modutils_read_module_deps(virtd_t) ++modutils_read_module_config(virtd_t) fs_list_auto_mountpoints(virtd_t) +fs_getattr_xattr_fs(virtd_t) @@ -17952,7 +18024,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol term_use_ptmx(virtd_t) auth_use_nsswitch(virtd_t) -@@ -129,7 +206,14 @@ +@@ -129,7 +207,14 @@ logging_send_syslog_msg(virtd_t) @@ -17967,7 +18039,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol tunable_policy(`virt_use_nfs',` fs_manage_nfs_dirs(virtd_t) -@@ -167,22 +251,35 @@ +@@ -167,22 +252,35 @@ dnsmasq_domtrans(virtd_t) dnsmasq_signal(virtd_t) dnsmasq_kill(virtd_t) @@ -18008,7 +18080,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -195,8 +292,159 @@ +@@ -195,8 +293,159 @@ xen_stream_connect(virtd_t) xen_stream_connect_xenstore(virtd_t) @@ -21221,7 +21293,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.6.28/policy/modules/system/ipsec.te --- nsaserefpolicy/policy/modules/system/ipsec.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/system/ipsec.te 2009-08-18 13:42:27.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/system/ipsec.te 2009-08-19 20:01:37.000000000 -0400 @@ -6,6 +6,13 @@ # Declarations # @@ -21246,7 +21318,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # type for file(s) containing ipsec keys - RSA or preshared type ipsec_key_file_t; files_type(ipsec_key_file_t) -@@ -53,21 +63,23 @@ +@@ -43,6 +53,9 @@ + init_daemon_domain(racoon_t, racoon_exec_t) + role system_r types racoon_t; + ++type racoon_tmp_t; ++files_tmp_file(racoon_tmp_t) ++ + type setkey_t; + type setkey_exec_t; + init_system_domain(setkey_t, setkey_exec_t) +@@ -53,21 +66,23 @@ # ipsec Local policy # @@ -21273,7 +21355,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol read_lnk_files_pattern(ipsec_t, ipsec_key_file_t, ipsec_key_file_t) manage_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t) -@@ -76,7 +88,7 @@ +@@ -76,13 +91,13 @@ can_exec(ipsec_t, ipsec_mgmt_exec_t) @@ -21282,7 +21364,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # a shell script, we need to find a way to make things work without # letting all sorts of stuff possibly be run... # so try flipping back into the ipsec_mgmt_t domain -@@ -95,9 +107,6 @@ + corecmd_shell_domtrans(ipsec_t, ipsec_mgmt_t) + allow ipsec_mgmt_t ipsec_t:fd use; +-allow ipsec_mgmt_t ipsec_t:fifo_file rw_file_perms; ++allow ipsec_mgmt_t ipsec_t:fifo_file rw_fifo_file_perms; + allow ipsec_mgmt_t ipsec_t:process sigchld; + + kernel_read_kernel_sysctls(ipsec_t) +@@ -95,9 +110,6 @@ kernel_getattr_core_if(ipsec_t) kernel_getattr_message_if(ipsec_t) @@ -21292,7 +21381,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # Pluto needs network access corenet_all_recvfrom_unlabeled(ipsec_t) corenet_tcp_sendrecv_all_if(ipsec_t) -@@ -118,21 +127,26 @@ +@@ -107,10 +119,11 @@ + corenet_tcp_sendrecv_all_ports(ipsec_t) + corenet_tcp_bind_all_nodes(ipsec_t) + corenet_udp_bind_all_nodes(ipsec_t) ++corenet_udp_bind_isakmp_port(ipsec_t) + corenet_tcp_bind_reserved_port(ipsec_t) + corenet_tcp_bind_isakmp_port(ipsec_t) +-corenet_udp_bind_isakmp_port(ipsec_t) + corenet_udp_bind_ipsecnat_port(ipsec_t) ++ + corenet_sendrecv_generic_server_packets(ipsec_t) + corenet_sendrecv_isakmp_server_packets(ipsec_t) + +@@ -118,21 +131,26 @@ dev_read_rand(ipsec_t) dev_read_urand(ipsec_t) @@ -21324,7 +21426,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol logging_send_syslog_msg(ipsec_t) miscfiles_read_localization(ipsec_t) -@@ -154,12 +168,12 @@ +@@ -154,12 +172,12 @@ # allow ipsec_mgmt_t self:capability { net_admin sys_tty_config dac_override dac_read_search }; @@ -21339,7 +21441,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow ipsec_mgmt_t ipsec_mgmt_lock_t:file manage_file_perms; files_lock_filetrans(ipsec_mgmt_t, ipsec_mgmt_lock_t, file) -@@ -209,15 +223,21 @@ +@@ -209,15 +227,21 @@ files_read_kernel_symbol_table(ipsec_mgmt_t) files_getattr_kernel_modules(ipsec_mgmt_t) @@ -21364,7 +21466,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol domain_use_interactive_fds(ipsec_mgmt_t) # denials when ps tries to search /proc. Do not audit these denials. domain_dontaudit_list_all_domains_state(ipsec_mgmt_t) -@@ -232,12 +252,6 @@ +@@ -232,12 +256,6 @@ files_dontaudit_getattr_default_dirs(ipsec_mgmt_t) files_dontaudit_getattr_default_files(ipsec_mgmt_t) @@ -21377,17 +21479,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol init_use_script_ptys(ipsec_mgmt_t) init_exec_script_files(ipsec_mgmt_t) init_use_fds(ipsec_mgmt_t) -@@ -280,6 +294,9 @@ +@@ -280,6 +298,13 @@ allow racoon_t self:netlink_selinux_socket { bind create read }; allow racoon_t self:udp_socket create_socket_perms; allow racoon_t self:key_socket create_socket_perms; +allow racoon_t self:fifo_file rw_fifo_file_perms; + ++manage_dirs_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t) ++manage_files_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t) ++files_tmp_filetrans(racoon_t, racoon_tmp_t, { dir file }) ++ +can_exec(racoon_t, setkey_exec_t) # manage pid file manage_files_pattern(racoon_t, ipsec_var_run_t, ipsec_var_run_t) -@@ -297,6 +314,13 @@ +@@ -297,6 +322,13 @@ kernel_read_system_state(racoon_t) kernel_read_network_state(racoon_t) @@ -21401,7 +21507,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corenet_all_recvfrom_unlabeled(racoon_t) corenet_tcp_sendrecv_all_if(racoon_t) corenet_udp_sendrecv_all_if(racoon_t) -@@ -314,13 +338,15 @@ +@@ -314,13 +346,15 @@ files_read_etc_files(racoon_t) @@ -21419,10 +21525,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol locallogin_use_fds(racoon_t) logging_send_syslog_msg(racoon_t) -@@ -328,6 +354,11 @@ +@@ -328,6 +362,13 @@ miscfiles_read_localization(racoon_t) ++auth_use_pam(racoon_t) ++ +auth_can_read_shadow_passwords(racoon_t) +tunable_policy(`racoon_read_shadow',` + auth_tunable_read_shadow(racoon_t) @@ -21431,7 +21539,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ######################################## # # Setkey local policy -@@ -347,6 +378,7 @@ +@@ -347,6 +388,7 @@ files_read_etc_files(setkey_t) init_dontaudit_use_fds(setkey_t) @@ -27293,7 +27401,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.6.28/policy/modules/system/xen.te --- nsaserefpolicy/policy/modules/system/xen.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/system/xen.te 2009-08-18 18:28:36.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/system/xen.te 2009-08-19 17:23:15.000000000 -0400 @@ -1,11 +1,18 @@ -policy_module(xen, 1.9.0) @@ -27432,16 +27540,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol consoletype_exec(xend_t) ') -@@ -239,6 +270,8 @@ +@@ -239,6 +270,10 @@ files_read_usr_files(xenconsoled_t) +fs_list_tmpfs(xenconsoled_t) ++fs_manage_xenfs_dirs(xenconsoled_t) ++fs_manage_xenfs_files(xenconsoled_t) + term_create_pty(xenconsoled_t, xen_devpts_t) term_use_generic_ptys(xenconsoled_t) term_use_console(xenconsoled_t) -@@ -248,7 +281,7 @@ +@@ -248,7 +283,7 @@ miscfiles_read_localization(xenconsoled_t) @@ -27450,7 +27560,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol xen_stream_connect_xenstore(xenconsoled_t) ######################################## -@@ -256,21 +289,33 @@ +@@ -256,21 +291,33 @@ # Xen store local policy # @@ -27485,7 +27595,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kernel_write_xen_state(xenstored_t) kernel_read_xen_state(xenstored_t) -@@ -304,6 +349,7 @@ +@@ -304,6 +351,7 @@ # allow xm_t self:capability { dac_override ipc_lock sys_tty_config }; @@ -27493,7 +27603,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # internal communication is often done using fifo and unix sockets. allow xm_t self:fifo_file rw_fifo_file_perms; -@@ -312,24 +358,28 @@ +@@ -312,24 +360,28 @@ manage_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t) manage_fifo_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t) @@ -27523,11 +27633,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_read_etc_runtime_files(xm_t) files_read_usr_files(xm_t) -@@ -339,15 +389,69 @@ +@@ -339,15 +391,70 @@ storage_raw_read_fixed_disk(xm_t) +fs_getattr_all_fs(xm_t) ++fs_manage_xenfs_dirs(xm_t) ++fs_manage_xenfs_files(xm_t) + term_use_all_terms(xm_t) @@ -27557,6 +27669,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +kernel_read_xen_state(xm_ssh_t) +kernel_write_xen_state(xm_ssh_t) + ++fs_manage_xenfs_dirs(xm_ssh_t) ++fs_manage_xenfs_files(xm_ssh_t) ++ +userdom_search_admin_dir(xm_ssh_t) + +#Should have a boolean wrapping these @@ -27564,6 +27679,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +files_search_mnt(xend_t) +fs_getattr_all_fs(xend_t) +fs_read_dos_files(xend_t) ++fs_manage_xenfs_dirs(xend_t) ++fs_manage_xenfs_files(xend_t) + +tunable_policy(`xen_use_nfs',` + fs_manage_nfs_files(xend_t) @@ -27588,12 +27705,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +manage_sock_files_pattern(evtchnd_t,evtchnd_var_run_t,evtchnd_var_run_t) +files_pid_filetrans(evtchnd_t, evtchnd_var_run_t, { file sock_file dir }) + -+fs_manage_xenfs_dirs(xend_t) -+fs_manage_xenfs_files(xend_t) -+fs_manage_xenfs_dirs(xenstored_t) -+fs_manage_xenfs_files(xenstored_t) -+fs_manage_xenfs_dirs(xm_t) -+fs_manage_xenfs_files(xm_t) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.6.28/policy/support/obj_perm_sets.spt --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2009-07-14 14:19:57.000000000 -0400 +++ serefpolicy-3.6.28/policy/support/obj_perm_sets.spt 2009-08-18 13:23:29.000000000 -0400 diff --git a/selinux-policy.spec b/selinux-policy.spec index 513db90..7088426 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -20,7 +20,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.6.28 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -475,6 +475,9 @@ exit 0 %endif %changelog +* Wed Aug 19 2009 Dan Walsh 3.6.28-2 +- Allow libvirt to change user componant of virt_domain + * Tue Aug 18 2009 Dan Walsh 3.6.28-1 - Allow cupsd_config_t to be started by dbus - Add smoltclient policy