From 2fac1d665541b86f4d00b07bfbe386b37884c3ce Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Jul 26 2007 17:54:24 +0000 Subject: - Update with latest changes from upstream --- diff --git a/.cvsignore b/.cvsignore index 1927067..c3738bc 100644 --- a/.cvsignore +++ b/.cvsignore @@ -121,3 +121,4 @@ serefpolicy-2.6.5.tgz serefpolicy-3.0.1.tgz serefpolicy-3.0.2.tgz serefpolicy-3.0.3.tgz +serefpolicy-3.0.4.tgz diff --git a/policy-20070703.patch b/policy-20070703.patch index d7af10d..9928244 100644 --- a/policy-20070703.patch +++ b/policy-20070703.patch @@ -1,14 +1,14 @@ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/guest_u_default_contexts serefpolicy-3.0.3/config/appconfig-strict-mls/guest_u_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/guest_u_default_contexts serefpolicy-3.0.4/config/appconfig-strict-mls/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-strict-mls/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/config/appconfig-strict-mls/guest_u_default_contexts 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/config/appconfig-strict-mls/guest_u_default_contexts 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,4 @@ +system_r:local_login_t:s0 guest_r:guest_t:s0 +system_r:remote_login_t:s0 guest_r:guest_t:s0 +system_r:sshd_t:s0 guest_r:guest_t:s0 +system_r:crond_t:s0 guest_r:guest_crond_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/staff_u_default_contexts serefpolicy-3.0.3/config/appconfig-strict-mls/staff_u_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/staff_u_default_contexts serefpolicy-3.0.4/config/appconfig-strict-mls/staff_u_default_contexts --- nsaserefpolicy/config/appconfig-strict-mls/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/config/appconfig-strict-mls/staff_u_default_contexts 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/config/appconfig-strict-mls/staff_u_default_contexts 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,9 @@ +system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +system_r:remote_login_t:s0 staff_r:staff_t:s0 @@ -19,9 +19,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/ +staff_r:staff_sudo_t:s0 staff_r:staff_t:s0 +sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 +sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/user_u_default_contexts serefpolicy-3.0.3/config/appconfig-strict-mls/user_u_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/user_u_default_contexts serefpolicy-3.0.4/config/appconfig-strict-mls/user_u_default_contexts --- nsaserefpolicy/config/appconfig-strict-mls/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/config/appconfig-strict-mls/user_u_default_contexts 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/config/appconfig-strict-mls/user_u_default_contexts 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,7 @@ +system_r:local_login_t:s0 user_r:user_t:s0 +system_r:remote_login_t:s0 user_r:user_t:s0 @@ -30,31 +30,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/ +system_r:xdm_t:s0 user_r:user_t:s0 +user_r:user_su_t:s0 user_r:user_t:s0 +user_r:user_sudo_t:s0 user_r:user_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/default_type serefpolicy-3.0.3/config/appconfig-targeted-mcs/default_type +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/default_type serefpolicy-3.0.4/config/appconfig-targeted-mcs/default_type --- nsaserefpolicy/config/appconfig-targeted-mcs/default_type 2007-05-25 09:09:09.000000000 -0400 -+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/default_type 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/default_type 2007-07-25 13:27:51.000000000 -0400 @@ -1 +1,4 @@ system_r:unconfined_t +sysadm_r:sysadm_t +staff_r:staff_t +user_r:user_t -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/guest_u_default_contexts serefpolicy-3.0.3/config/appconfig-targeted-mcs/guest_u_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/guest_u_default_contexts serefpolicy-3.0.4/config/appconfig-targeted-mcs/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-targeted-mcs/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/guest_u_default_contexts 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/guest_u_default_contexts 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,4 @@ +system_r:local_login_t:s0 guest_r:guest_t:s0 +system_r:remote_login_t:s0 guest_r:guest_t:s0 +system_r:sshd_t:s0 guest_r:guest_t:s0 +system_r:crond_t:s0 guest_r:guest_crond_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/initrc_context serefpolicy-3.0.3/config/appconfig-targeted-mcs/initrc_context +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/initrc_context serefpolicy-3.0.4/config/appconfig-targeted-mcs/initrc_context --- nsaserefpolicy/config/appconfig-targeted-mcs/initrc_context 2007-05-25 09:09:09.000000000 -0400 -+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/initrc_context 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/initrc_context 2007-07-25 13:27:51.000000000 -0400 @@ -1 +1 @@ -user_u:system_r:initrc_t:s0 +system_u:system_r:initrc_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/root_default_contexts serefpolicy-3.0.3/config/appconfig-targeted-mcs/root_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/root_default_contexts serefpolicy-3.0.4/config/appconfig-targeted-mcs/root_default_contexts --- nsaserefpolicy/config/appconfig-targeted-mcs/root_default_contexts 2007-05-25 09:09:09.000000000 -0400 -+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/root_default_contexts 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/root_default_contexts 2007-07-25 13:27:51.000000000 -0400 @@ -1,2 +1,10 @@ -system_r:unconfined_t:s0 system_r:unconfined_t:s0 -system_r:initrc_t:s0 system_r:unconfined_t:s0 @@ -68,16 +68,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mc +# +#system_r:sshd_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/seusers serefpolicy-3.0.3/config/appconfig-targeted-mcs/seusers +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/seusers serefpolicy-3.0.4/config/appconfig-targeted-mcs/seusers --- nsaserefpolicy/config/appconfig-targeted-mcs/seusers 2007-05-31 15:35:39.000000000 -0400 -+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/seusers 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/seusers 2007-07-25 13:27:51.000000000 -0400 @@ -1,2 +1,2 @@ root:root:s0-mcs_systemhigh -__default__:user_u:s0 +__default__:system_u:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/staff_u_default_contexts serefpolicy-3.0.3/config/appconfig-targeted-mcs/staff_u_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/staff_u_default_contexts serefpolicy-3.0.4/config/appconfig-targeted-mcs/staff_u_default_contexts --- nsaserefpolicy/config/appconfig-targeted-mcs/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/staff_u_default_contexts 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/staff_u_default_contexts 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,9 @@ +system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +system_r:remote_login_t:s0 staff_r:staff_t:s0 @@ -88,9 +88,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mc +staff_r:staff_sudo_t:s0 staff_r:staff_t:s0 +sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 +sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/user_u_default_contexts serefpolicy-3.0.3/config/appconfig-targeted-mcs/user_u_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/user_u_default_contexts serefpolicy-3.0.4/config/appconfig-targeted-mcs/user_u_default_contexts --- nsaserefpolicy/config/appconfig-targeted-mcs/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/user_u_default_contexts 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/user_u_default_contexts 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,7 @@ +system_r:local_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +system_r:remote_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 @@ -99,9 +99,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mc +system_r:xdm_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +user_r:user_su_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +user_r:user_sudo_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.0.3/Makefile ---- nsaserefpolicy/Makefile 2007-05-29 13:53:56.000000000 -0400 -+++ serefpolicy-3.0.3/Makefile 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.0.4/Makefile +--- nsaserefpolicy/Makefile 2007-07-25 10:37:43.000000000 -0400 ++++ serefpolicy-3.0.4/Makefile 2007-07-25 13:27:51.000000000 -0400 @@ -158,8 +158,18 @@ headerdir = $(modpkgdir)/include docsdir = $(prefix)/share/doc/$(PKGNAME) @@ -131,9 +131,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.0.3/M M4PARAM += -D enable_mcs CHECKPOLICY += -M CHECKMODULE += -M -diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.0.3/man/man8/ftpd_selinux.8 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.0.4/man/man8/ftpd_selinux.8 --- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-05-25 09:09:10.000000000 -0400 -+++ serefpolicy-3.0.3/man/man8/ftpd_selinux.8 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/man/man8/ftpd_selinux.8 2007-07-25 13:27:51.000000000 -0400 @@ -12,7 +12,7 @@ .TP chcon -R -t public_content_t /var/ftp @@ -143,19 +143,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 sere .TP chcon -t public_content_rw_t /var/ftp/incoming .TP -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.0.3/policy/flask/access_vectors ---- nsaserefpolicy/policy/flask/access_vectors 2007-06-19 16:23:34.000000000 -0400 -+++ serefpolicy-3.0.3/policy/flask/access_vectors 2007-07-17 15:46:25.000000000 -0400 -@@ -598,6 +598,8 @@ - shmempwd - shmemgrp - shmemhost -+ getserv -+ shmemserv - } - - # Define the access vector interpretation for controlling -@@ -623,6 +625,8 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.0.4/policy/flask/access_vectors +--- nsaserefpolicy/policy/flask/access_vectors 2007-07-25 10:37:36.000000000 -0400 ++++ serefpolicy-3.0.4/policy/flask/access_vectors 2007-07-25 13:27:51.000000000 -0400 +@@ -625,6 +625,8 @@ send recv relabelto @@ -164,9 +155,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors } class key -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.0.3/policy/global_tunables +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.0.4/policy/global_tunables --- nsaserefpolicy/policy/global_tunables 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/global_tunables 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/global_tunables 2007-07-25 13:27:51.000000000 -0400 @@ -133,3 +133,10 @@ ## gen_tunable(write_untrusted_content,false) @@ -178,9 +169,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref +## +gen_tunable(allow_console_login,false) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.0.3/policy/mls +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.0.4/policy/mls --- nsaserefpolicy/policy/mls 2007-07-03 07:06:36.000000000 -0400 -+++ serefpolicy-3.0.3/policy/mls 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/mls 2007-07-25 13:27:51.000000000 -0400 @@ -89,12 +89,14 @@ mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton } (( l1 eq l2 ) or @@ -263,9 +254,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.0.3 ( t2 == unlabeled_t )); mlsconstrain association { polmatch } -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-3.0.3/policy/modules/admin/acct.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-3.0.4/policy/modules/admin/acct.te --- nsaserefpolicy/policy/modules/admin/acct.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/acct.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/acct.te 2007-07-25 13:27:51.000000000 -0400 @@ -9,6 +9,7 @@ type acct_t; type acct_exec_t; @@ -274,9 +265,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te type acct_data_t; logging_log_file(acct_data_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.0.3/policy/modules/admin/alsa.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.0.4/policy/modules/admin/alsa.fc --- nsaserefpolicy/policy/modules/admin/alsa.fc 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/alsa.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/alsa.fc 2007-07-25 13:27:51.000000000 -0400 @@ -1,4 +1,7 @@ /etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0) @@ -285,10 +276,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc /usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0) +/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.0.3/policy/modules/admin/alsa.te ---- nsaserefpolicy/policy/modules/admin/alsa.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/alsa.te 2007-07-17 15:46:25.000000000 -0400 -@@ -20,20 +20,24 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.0.4/policy/modules/admin/alsa.te +--- nsaserefpolicy/policy/modules/admin/alsa.te 2007-07-25 10:37:43.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/alsa.te 2007-07-25 13:27:51.000000000 -0400 +@@ -19,20 +19,24 @@ # Local policy # @@ -316,7 +307,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te libs_use_ld_so(alsa_t) libs_use_shared_libs(alsa_t) -@@ -44,7 +48,14 @@ +@@ -43,7 +47,14 @@ userdom_manage_unpriv_user_semaphores(alsa_t) userdom_manage_unpriv_user_shared_mem(alsa_t) @@ -331,9 +322,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te + hal_write_log(alsa_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.0.3/policy/modules/admin/anaconda.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.0.4/policy/modules/admin/anaconda.te --- nsaserefpolicy/policy/modules/admin/anaconda.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/anaconda.te 2007-07-23 09:26:54.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/anaconda.te 2007-07-25 13:27:51.000000000 -0400 @@ -31,16 +31,13 @@ modutils_domtrans_insmod(anaconda_t) @@ -352,10 +343,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anacond kudzu_domtrans(anaconda_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-3.0.3/policy/modules/admin/bootloader.te ---- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/bootloader.te 2007-07-17 15:46:25.000000000 -0400 -@@ -182,6 +182,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-3.0.4/policy/modules/admin/bootloader.te +--- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-07-25 10:37:43.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/bootloader.te 2007-07-25 13:27:51.000000000 -0400 +@@ -180,6 +180,7 @@ optional_policy(` hal_dontaudit_append_lib_files(bootloader_t) @@ -363,34 +354,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.0.3/policy/modules/admin/consoletype.te ---- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/consoletype.te 2007-07-17 15:46:25.000000000 -0400 -@@ -8,12 +8,21 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.0.4/policy/modules/admin/consoletype.te +--- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-07-25 10:37:43.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/consoletype.te 2007-07-26 10:21:26.000000000 -0400 +@@ -8,9 +8,11 @@ type consoletype_t; type consoletype_exec_t; +-application_executable_file(consoletype_exec_t) -init_domain(consoletype_t,consoletype_exec_t) -init_system_domain(consoletype_t,consoletype_exec_t) +#dont transition from initrc +#init_domain(consoletype_t,consoletype_exec_t) -+domain_type(consoletype_t) -+domain_entry_file(consoletype_t,consoletype_exec_t) -+role system_r types consoletype_t; ++#init_system_domain(consoletype_t,consoletype_exec_t) ++application_domain(consoletype_t, consoletype_exec_t) + mls_file_read_up(consoletype_t) mls_file_write_down(consoletype_t) role system_r types consoletype_t; - -+ifdef(`targeted_policy',`',` -+ init_system_domain(consoletype_t,consoletype_exec_t) -+') -+application_executable_file(consoletype_exec_t) -+ - ######################################## - # - # Local declarations -@@ -46,7 +55,7 @@ +@@ -47,7 +49,7 @@ init_use_fds(consoletype_t) init_use_script_ptys(consoletype_t) init_use_script_fds(consoletype_t) @@ -399,7 +381,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console domain_use_interactive_fds(consoletype_t) -@@ -86,6 +95,10 @@ +@@ -87,6 +89,10 @@ ') optional_policy(` @@ -410,9 +392,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console logrotate_dontaudit_use_fds(consoletype_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.0.3/policy/modules/admin/kudzu.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.0.4/policy/modules/admin/kudzu.te --- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/kudzu.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/kudzu.te 2007-07-25 13:27:51.000000000 -0400 @@ -21,8 +21,8 @@ # Local policy # @@ -449,9 +431,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t ifdef(`TODO',` allow kudzu_t modules_conf_t:file unlink; optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.0.3/policy/modules/admin/logrotate.te ---- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-06-19 16:23:35.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/logrotate.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.0.4/policy/modules/admin/logrotate.te +--- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-07-25 10:37:43.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/logrotate.te 2007-07-25 13:27:51.000000000 -0400 @@ -75,11 +75,13 @@ mls_file_read_up(logrotate_t) mls_file_write_down(logrotate_t) @@ -490,10 +472,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota slrnpull_manage_spool(logrotate_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.0.3/policy/modules/admin/logwatch.te ---- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/logwatch.te 2007-07-17 15:46:25.000000000 -0400 -@@ -30,7 +30,6 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.0.4/policy/modules/admin/logwatch.te +--- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-07-25 10:37:43.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/logwatch.te 2007-07-25 13:27:51.000000000 -0400 +@@ -29,7 +29,6 @@ allow logwatch_t self:process signal; allow logwatch_t self:fifo_file rw_file_perms; allow logwatch_t self:unix_stream_socket create_stream_socket_perms; @@ -501,7 +483,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc manage_dirs_pattern(logwatch_t,logwatch_cache_t,logwatch_cache_t) manage_files_pattern(logwatch_t,logwatch_cache_t,logwatch_cache_t) -@@ -69,6 +68,9 @@ +@@ -68,6 +67,9 @@ fs_getattr_all_fs(logwatch_t) fs_dontaudit_list_auto_mountpoints(logwatch_t) @@ -511,7 +493,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc term_dontaudit_getattr_pty_dirs(logwatch_t) term_dontaudit_list_ptys(logwatch_t) -@@ -97,6 +99,10 @@ +@@ -96,6 +98,10 @@ ') optional_policy(` @@ -522,7 +504,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc avahi_dontaudit_search_pid(logwatch_t) ') -@@ -118,14 +124,6 @@ +@@ -117,14 +123,6 @@ ') optional_policy(` @@ -537,15 +519,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc ntp_domtrans(logwatch_t) ') -@@ -135,4 +133,5 @@ +@@ -134,4 +132,5 @@ optional_policy(` samba_read_log(logwatch_t) + samba_read_share_files(logwatch_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.0.3/policy/modules/admin/netutils.te ---- nsaserefpolicy/policy/modules/admin/netutils.te 2007-07-03 07:06:36.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/netutils.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.0.4/policy/modules/admin/netutils.te +--- nsaserefpolicy/policy/modules/admin/netutils.te 2007-07-25 10:37:43.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/netutils.te 2007-07-25 13:27:51.000000000 -0400 @@ -29,6 +29,7 @@ type traceroute_t; type traceroute_exec_t; @@ -554,9 +536,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil role system_r types traceroute_t; ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.if serefpolicy-3.0.3/policy/modules/admin/portage.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.if serefpolicy-3.0.4/policy/modules/admin/portage.if --- nsaserefpolicy/policy/modules/admin/portage.if 2007-07-03 07:06:36.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/portage.if 2007-07-23 09:28:12.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/portage.if 2007-07-25 13:27:51.000000000 -0400 @@ -324,6 +324,7 @@ seutil_domtrans_setfiles($1) # run semodule @@ -565,9 +547,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage portage_domtrans_gcc_config($1) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.0.3/policy/modules/admin/prelink.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.0.4/policy/modules/admin/prelink.te --- nsaserefpolicy/policy/modules/admin/prelink.te 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/prelink.te 2007-07-24 08:59:27.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/prelink.te 2007-07-25 13:27:51.000000000 -0400 @@ -26,7 +26,7 @@ # Local policy # @@ -625,17 +607,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink optional_policy(` amanda_manage_lib(prelink_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.fc serefpolicy-3.0.3/policy/modules/admin/readahead.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.fc serefpolicy-3.0.4/policy/modules/admin/readahead.fc --- nsaserefpolicy/policy/modules/admin/readahead.fc 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/readahead.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/readahead.fc 2007-07-25 13:27:51.000000000 -0400 @@ -2,3 +2,4 @@ # /usr # /usr/sbin/readahead -- gen_context(system_u:object_r:readahead_exec_t,s0) +/etc/readahead.d(/.*)? gen_context(system_u:object_r:readahead_etc_rw_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.if serefpolicy-3.0.3/policy/modules/admin/readahead.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.if serefpolicy-3.0.4/policy/modules/admin/readahead.if --- nsaserefpolicy/policy/modules/admin/readahead.if 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/readahead.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/readahead.if 2007-07-25 13:27:51.000000000 -0400 @@ -1 +1,20 @@ ## Readahead, read files into page cache for improved performance + @@ -657,10 +639,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe + corecmd_search_bin($1) + domtrans_pattern($1,readahead_exec_t,readahead_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.0.3/policy/modules/admin/readahead.te ---- nsaserefpolicy/policy/modules/admin/readahead.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/readahead.te 2007-07-17 15:46:25.000000000 -0400 -@@ -13,14 +13,20 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.0.4/policy/modules/admin/readahead.te +--- nsaserefpolicy/policy/modules/admin/readahead.te 2007-07-25 10:37:43.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/readahead.te 2007-07-25 13:27:51.000000000 -0400 +@@ -9,19 +9,24 @@ + type readahead_t; + type readahead_exec_t; + init_daemon_domain(readahead_t,readahead_exec_t) +-application_domain(readahead_t,readahead_exec_t) + type readahead_var_run_t; files_pid_file(readahead_var_run_t) @@ -682,7 +669,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe manage_files_pattern(readahead_t,readahead_var_run_t,readahead_var_run_t) files_pid_filetrans(readahead_t,readahead_var_run_t,file) -@@ -36,7 +42,7 @@ +@@ -37,7 +42,7 @@ dev_dontaudit_read_all_blk_files(readahead_t) dev_dontaudit_getattr_memory_dev(readahead_t) dev_dontaudit_getattr_nvram_dev(readahead_t) @@ -691,7 +678,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe domain_use_interactive_fds(readahead_t) -@@ -76,3 +82,7 @@ +@@ -77,3 +82,7 @@ optional_policy(` seutil_sigchld_newrole(readahead_t) ') @@ -699,9 +686,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe +optional_policy(` + logging_dontaudit_search_audit_config(readahead_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.0.3/policy/modules/admin/rpm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.0.4/policy/modules/admin/rpm.fc --- nsaserefpolicy/policy/modules/admin/rpm.fc 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/rpm.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/rpm.fc 2007-07-25 13:27:51.000000000 -0400 @@ -21,6 +21,9 @@ /usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -712,9 +699,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc ') /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.3/policy/modules/admin/rpm.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.4/policy/modules/admin/rpm.if --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/rpm.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/rpm.if 2007-07-25 13:27:51.000000000 -0400 @@ -210,6 +210,24 @@ ######################################## @@ -837,9 +824,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if + + dontaudit $1 rpm_tmp_t:file rw_file_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.3/policy/modules/admin/rpm.te ---- nsaserefpolicy/policy/modules/admin/rpm.te 2007-07-03 07:06:36.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/rpm.te 2007-07-20 17:08:28.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.4/policy/modules/admin/rpm.te +--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-07-25 10:37:43.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/rpm.te 2007-07-25 13:27:51.000000000 -0400 @@ -9,6 +9,8 @@ type rpm_t; type rpm_exec_t; @@ -857,10 +844,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te userdom_use_all_users_fds(rpm_script_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.3/policy/modules/admin/sudo.if ---- nsaserefpolicy/policy/modules/admin/sudo.if 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/sudo.if 2007-07-17 15:46:25.000000000 -0400 -@@ -69,7 +69,6 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.4/policy/modules/admin/sudo.if +--- nsaserefpolicy/policy/modules/admin/sudo.if 2007-07-25 10:37:43.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/sudo.if 2007-07-25 13:27:51.000000000 -0400 +@@ -68,7 +68,6 @@ allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms; allow $1_sudo_t self:unix_dgram_socket sendto; allow $1_sudo_t self:unix_stream_socket connectto; @@ -868,7 +855,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if allow $1_sudo_t self:netlink_route_socket r_netlink_socket_perms; # Enter this derived domain from the user domain -@@ -77,6 +76,7 @@ +@@ -76,6 +75,7 @@ # By default, revert to the calling domain when a shell is executed. corecmd_shell_domtrans($1_sudo_t,$2) @@ -876,7 +863,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if allow $2 $1_sudo_t:fd use; allow $2 $1_sudo_t:fifo_file rw_file_perms; allow $2 $1_sudo_t:process sigchld; -@@ -91,8 +91,10 @@ +@@ -90,8 +90,10 @@ fs_getattr_xattr_fs($1_sudo_t) auth_domtrans_chk_passwd($1_sudo_t) @@ -887,7 +874,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if corecmd_read_bin_symlinks($1_sudo_t) corecmd_getattr_all_executables($1_sudo_t) -@@ -113,6 +115,7 @@ +@@ -112,6 +114,7 @@ libs_use_ld_so($1_sudo_t) libs_use_shared_libs($1_sudo_t) @@ -895,7 +882,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if logging_send_syslog_msg($1_sudo_t) miscfiles_read_localization($1_sudo_t) -@@ -127,6 +130,10 @@ +@@ -126,6 +129,10 @@ userdom_dontaudit_search_all_users_home_content($1_sudo_t) optional_policy(` @@ -906,9 +893,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if nis_use_ypbind($1_sudo_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.3/policy/modules/admin/su.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.4/policy/modules/admin/su.if --- nsaserefpolicy/policy/modules/admin/su.if 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/su.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/su.if 2007-07-25 13:27:51.000000000 -0400 @@ -41,12 +41,11 @@ allow $2 $1_su_t:process signal; @@ -1001,9 +988,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s ifdef(`TODO',` allow $1_su_t $1_home_t:file manage_file_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.if serefpolicy-3.0.3/policy/modules/admin/tmpreaper.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.if serefpolicy-3.0.4/policy/modules/admin/tmpreaper.if --- nsaserefpolicy/policy/modules/admin/tmpreaper.if 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/tmpreaper.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/tmpreaper.if 2007-07-25 13:27:51.000000000 -0400 @@ -2,6 +2,25 @@ ######################################## @@ -1030,9 +1017,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreap ## Execute tmpreaper in the caller domain. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.0.3/policy/modules/admin/usermanage.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.0.4/policy/modules/admin/usermanage.if --- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/usermanage.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/usermanage.if 2007-07-25 13:27:51.000000000 -0400 @@ -278,5 +278,5 @@ type crack_db_t; ') @@ -1040,10 +1027,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman - allow $1 crack_db_t:file read_file_perms; + read_files_pattern($1,crack_db_t,crack_db_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.0.3/policy/modules/admin/usermanage.te ---- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/usermanage.te 2007-07-17 15:46:25.000000000 -0400 -@@ -99,6 +99,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.0.4/policy/modules/admin/usermanage.te +--- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-07-25 10:37:43.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/usermanage.te 2007-07-25 13:27:51.000000000 -0400 +@@ -92,6 +92,7 @@ dev_read_urand(chfn_t) auth_domtrans_chk_passwd(chfn_t) @@ -1051,7 +1038,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman auth_dontaudit_read_shadow(chfn_t) # allow checking if a shell is executable -@@ -198,7 +199,6 @@ +@@ -191,7 +192,6 @@ allow groupadd_t self:unix_stream_socket create_stream_socket_perms; allow groupadd_t self:unix_dgram_socket sendto; allow groupadd_t self:unix_stream_socket connectto; @@ -1059,7 +1046,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman fs_getattr_xattr_fs(groupadd_t) fs_search_auto_mountpoints(groupadd_t) -@@ -230,6 +230,7 @@ +@@ -223,6 +223,7 @@ # Execute /usr/bin/{passwd,chfn,chsh} and /usr/sbin/{useradd,vipw}. corecmd_exec_bin(groupadd_t) @@ -1067,7 +1054,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman logging_send_syslog_msg(groupadd_t) miscfiles_read_localization(groupadd_t) -@@ -252,8 +253,13 @@ +@@ -245,8 +246,13 @@ ') optional_policy(` @@ -1081,7 +1068,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') ######################################## -@@ -261,7 +267,7 @@ +@@ -254,7 +260,7 @@ # Passwd local policy # @@ -1090,7 +1077,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman allow passwd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow passwd_t self:process { setrlimit setfscreate }; allow passwd_t self:fd use; -@@ -271,7 +277,6 @@ +@@ -264,7 +270,6 @@ allow passwd_t self:unix_stream_socket create_stream_socket_perms; allow passwd_t self:unix_dgram_socket sendto; allow passwd_t self:unix_stream_socket connectto; @@ -1098,7 +1085,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman allow passwd_t self:shm create_shm_perms; allow passwd_t self:sem create_sem_perms; allow passwd_t self:msgq create_msgq_perms; -@@ -323,6 +328,7 @@ +@@ -316,6 +321,7 @@ libs_use_ld_so(passwd_t) libs_use_shared_libs(passwd_t) @@ -1106,7 +1093,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman logging_send_syslog_msg(passwd_t) miscfiles_read_localization(passwd_t) -@@ -343,6 +349,7 @@ +@@ -336,6 +342,7 @@ optional_policy(` nscd_socket_use(passwd_t) @@ -1114,7 +1101,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') ######################################## -@@ -433,6 +440,7 @@ +@@ -426,6 +433,7 @@ optional_policy(` nscd_socket_use(sysadm_passwd_t) @@ -1122,7 +1109,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') ######################################## -@@ -440,7 +448,7 @@ +@@ -433,7 +441,7 @@ # Useradd local policy # @@ -1131,7 +1118,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman dontaudit useradd_t self:capability sys_tty_config; allow useradd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow useradd_t self:process setfscreate; -@@ -454,7 +462,6 @@ +@@ -447,7 +455,6 @@ allow useradd_t self:unix_stream_socket create_stream_socket_perms; allow useradd_t self:unix_dgram_socket sendto; allow useradd_t self:unix_stream_socket connectto; @@ -1139,7 +1126,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman # for getting the number of groups kernel_read_kernel_sysctls(useradd_t) -@@ -499,6 +506,7 @@ +@@ -492,6 +499,7 @@ libs_use_ld_so(useradd_t) libs_use_shared_libs(useradd_t) @@ -1147,7 +1134,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman logging_send_syslog_msg(useradd_t) miscfiles_read_localization(useradd_t) -@@ -508,6 +516,9 @@ +@@ -501,6 +509,9 @@ seutil_read_default_contexts(useradd_t) seutil_domtrans_semanage(useradd_t) seutil_domtrans_setfiles(useradd_t) @@ -1157,7 +1144,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman userdom_use_unpriv_users_fds(useradd_t) # for when /root is the cwd -@@ -521,11 +532,26 @@ +@@ -514,11 +525,26 @@ mta_manage_spool(useradd_t) optional_policy(` @@ -1184,18 +1171,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman rpm_rw_pipes(useradd_t) + rpm_dontaudit_rw_tmp_files(useradd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.0.3/policy/modules/admin/vbetool.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.0.4/policy/modules/admin/vbetool.te --- nsaserefpolicy/policy/modules/admin/vbetool.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/admin/vbetool.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/admin/vbetool.te 2007-07-25 13:27:51.000000000 -0400 @@ -32,4 +32,5 @@ optional_policy(` hal_rw_pid_files(vbetool_t) + hal_write_log(vbetool_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if serefpolicy-3.0.3/policy/modules/apps/ada.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if serefpolicy-3.0.4/policy/modules/apps/ada.if --- nsaserefpolicy/policy/modules/apps/ada.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/ada.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/ada.if 2007-07-25 13:27:51.000000000 -0400 @@ -18,3 +18,34 @@ corecmd_search_bin($1) domtrans_pattern($1, ada_exec_t, ada_t) @@ -1231,9 +1218,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if s + role $2 types ada_t; + allow ada_t $3:chr_file rw_term_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc serefpolicy-3.0.3/policy/modules/apps/games.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc serefpolicy-3.0.4/policy/modules/apps/games.fc --- nsaserefpolicy/policy/modules/apps/games.fc 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/games.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/games.fc 2007-07-25 13:27:51.000000000 -0400 @@ -1,22 +1,16 @@ # # /usr @@ -1260,9 +1247,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc /usr/bin/micq -- gen_context(system_u:object_r:games_exec_t,s0) /usr/bin/blackjack -- gen_context(system_u:object_r:games_exec_t,s0) /usr/bin/gataxx -- gen_context(system_u:object_r:games_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.0.3/policy/modules/apps/gnome.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.0.4/policy/modules/apps/gnome.fc --- nsaserefpolicy/policy/modules/apps/gnome.fc 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/gnome.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/gnome.fc 2007-07-25 13:27:51.000000000 -0400 @@ -1,8 +1,7 @@ +HOME_DIR/.gnome2(/.*)? gen_context(system_u:object_r:ROLE_gnome_home_t,s0) HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:ROLE_gnome_home_t,s0) @@ -1273,9 +1260,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc /tmp/gconfd-USER/.* -- gen_context(system_u:object_r:ROLE_gconf_tmp_t,s0) /usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.0.3/policy/modules/apps/gnome.if ---- nsaserefpolicy/policy/modules/apps/gnome.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/gnome.if 2007-07-23 14:19:32.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.0.4/policy/modules/apps/gnome.if +--- nsaserefpolicy/policy/modules/apps/gnome.if 2007-07-25 10:37:37.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/gnome.if 2007-07-25 13:27:51.000000000 -0400 @@ -33,6 +33,51 @@ ## # @@ -1328,7 +1315,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if gen_require(` type gconfd_exec_t; attribute gnomedomain; -@@ -51,9 +96,6 @@ +@@ -50,9 +95,6 @@ type $1_gconf_home_t; userdom_user_home_content($1, $1_gconf_home_t) @@ -1338,7 +1325,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if type $1_gconf_tmp_t; files_tmp_file($1_gconf_tmp_t) -@@ -78,9 +120,6 @@ +@@ -77,9 +119,6 @@ allow $1_gconfd_t $2:fifo_file write; allow $1_gconfd_t $2:unix_stream_socket connectto; @@ -1348,7 +1335,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if ps_process_pattern($2,$1_gconfd_t) dev_read_urand($1_gconfd_t) -@@ -101,9 +140,18 @@ +@@ -100,9 +139,18 @@ gnome_stream_connect_gconf_template($1,$2) optional_policy(` @@ -1367,7 +1354,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if optional_policy(` xserver_use_xdm_fds($1_gconfd_t) xserver_rw_xdm_pipes($1_gconfd_t) -@@ -136,13 +184,32 @@ +@@ -135,13 +183,32 @@ allow $2 $1_gconfd_t:unix_stream_socket connectto; ') @@ -1401,7 +1388,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if ##

##

## This is a templated interface, and should only -@@ -171,6 +238,30 @@ +@@ -170,6 +237,30 @@ ######################################## ##

@@ -1432,7 +1419,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if ## manage gnome homedir content (.config) ## ## -@@ -190,6 +281,26 @@ +@@ -189,6 +280,26 @@ type $1_gnome_home_t; ') @@ -1461,9 +1448,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if + can_exec($1, gconfd_exec_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.0.3/policy/modules/apps/gnome.te ---- nsaserefpolicy/policy/modules/apps/gnome.te 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/gnome.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.0.4/policy/modules/apps/gnome.te +--- nsaserefpolicy/policy/modules/apps/gnome.te 2007-07-25 10:37:37.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/gnome.te 2007-07-25 13:27:51.000000000 -0400 @@ -8,8 +8,5 @@ attribute gnomedomain; @@ -1472,10 +1459,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te -files_type(gconf_etc_t) - type gconfd_exec_t; - corecmd_executable_file(gconfd_exec_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.3/policy/modules/apps/java.if ---- nsaserefpolicy/policy/modules/apps/java.if 2007-07-03 07:05:43.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/java.if 2007-07-23 16:11:58.000000000 -0400 + application_executable_file(gconfd_exec_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.4/policy/modules/apps/java.if +--- nsaserefpolicy/policy/modules/apps/java.if 2007-07-25 10:37:37.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/java.if 2007-07-25 13:27:51.000000000 -0400 @@ -32,7 +32,7 @@ ## ## @@ -1485,7 +1472,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if gen_require(` type java_exec_t; ') -@@ -82,8 +82,7 @@ +@@ -81,8 +81,7 @@ can_exec($1_javaplugin_t, java_exec_t) @@ -1495,7 +1482,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if allow $1_javaplugin_t $2:fd use; # Unrestricted inheritance from the caller. allow $2 $1_javaplugin_t:process { noatsecure siginh rlimitinh }; -@@ -168,6 +167,53 @@ +@@ -167,6 +166,53 @@ optional_policy(` xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t) ') @@ -1549,7 +1536,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if ') ######################################## -@@ -221,3 +267,66 @@ +@@ -220,3 +266,66 @@ corecmd_search_bin($1) domtrans_pattern($1, java_exec_t, java_t) ') @@ -1616,9 +1603,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if + role $2 types java_t; + allow java_t $3:chr_file rw_term_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.0.3/policy/modules/apps/java.te ---- nsaserefpolicy/policy/modules/apps/java.te 2007-07-03 07:05:43.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/java.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.0.4/policy/modules/apps/java.te +--- nsaserefpolicy/policy/modules/apps/java.te 2007-07-25 10:37:37.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/java.te 2007-07-25 13:27:51.000000000 -0400 @@ -31,3 +31,7 @@ unconfined_domain_noaudit(java_t) unconfined_dbus_chat(java_t) @@ -1627,9 +1614,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te +optional_policy(` + xserver_xdm_rw_shm(java_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.0.3/policy/modules/apps/loadkeys.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.0.4/policy/modules/apps/loadkeys.te --- nsaserefpolicy/policy/modules/apps/loadkeys.te 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/loadkeys.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/loadkeys.te 2007-07-25 13:27:51.000000000 -0400 @@ -40,3 +40,8 @@ locallogin_use_fds(loadkeys_t) @@ -1639,9 +1626,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys + nscd_dontaudit_search_pid(loadkeys_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.0.3/policy/modules/apps/mono.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.0.4/policy/modules/apps/mono.if --- nsaserefpolicy/policy/modules/apps/mono.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/mono.if 2007-07-23 16:14:31.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/mono.if 2007-07-25 13:27:51.000000000 -0400 @@ -18,3 +18,98 @@ corecmd_search_bin($1) domtrans_pattern($1, mono_exec_t, mono_t) @@ -1741,9 +1728,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if + xserver_xdm_rw_shm($1_mono_t) + ') +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.0.3/policy/modules/apps/mono.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.0.4/policy/modules/apps/mono.te --- nsaserefpolicy/policy/modules/apps/mono.te 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/mono.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/mono.te 2007-07-25 13:27:51.000000000 -0400 @@ -46,3 +46,7 @@ unconfined_dbus_chat(mono_t) unconfined_dbus_connect(mono_t) @@ -1752,9 +1739,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te +optional_policy(` + xserver_xdm_rw_shm(mono_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.3/policy/modules/apps/mozilla.if ---- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-07-03 07:05:43.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/mozilla.if 2007-07-24 15:39:13.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.4/policy/modules/apps/mozilla.if +--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-07-25 10:37:37.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/mozilla.if 2007-07-25 13:27:51.000000000 -0400 @@ -36,6 +36,8 @@ gen_require(` type mozilla_conf_t, mozilla_exec_t; @@ -1764,7 +1751,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ######################################## # -@@ -53,6 +55,14 @@ +@@ -52,6 +54,14 @@ type $1_mozilla_tmpfs_t; files_tmpfs_file($1_mozilla_tmpfs_t) @@ -1779,7 +1766,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ######################################## # # Local policy -@@ -97,15 +107,37 @@ +@@ -96,15 +106,37 @@ relabel_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t) relabel_lnk_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t) @@ -1824,7 +1811,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. # Unrestricted inheritance from the caller. allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh }; -@@ -116,8 +148,9 @@ +@@ -115,8 +147,9 @@ kernel_read_kernel_sysctls($1_mozilla_t) kernel_read_network_state($1_mozilla_t) # Access /proc, sysctl @@ -1836,7 +1823,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. # Look for plugins corecmd_list_bin($1_mozilla_t) -@@ -166,11 +199,20 @@ +@@ -165,11 +198,20 @@ files_read_var_files($1_mozilla_t) files_read_var_symlinks($1_mozilla_t) files_dontaudit_getattr_boot_dirs($1_mozilla_t) @@ -1857,7 +1844,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. term_dontaudit_getattr_pty_dirs($1_mozilla_t) libs_use_ld_so($1_mozilla_t) -@@ -186,16 +228,14 @@ +@@ -185,16 +227,14 @@ sysnet_dns_name_resolve($1_mozilla_t) sysnet_read_config($1_mozilla_t) @@ -1878,7 +1865,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. tunable_policy(`allow_execmem',` allow $1_mozilla_t self:process { execmem execstack }; -@@ -213,131 +253,8 @@ +@@ -212,131 +252,8 @@ fs_manage_cifs_symlinks($1_mozilla_t) ') @@ -2012,7 +1999,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') optional_policy(` -@@ -352,21 +269,28 @@ +@@ -351,21 +268,28 @@ optional_policy(` cups_read_rw_config($1_mozilla_t) cups_dbus_chat($1_mozilla_t) @@ -2044,7 +2031,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') optional_policy(` -@@ -386,25 +310,6 @@ +@@ -385,25 +309,6 @@ thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t) ') @@ -2070,7 +2057,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') ######################################## -@@ -577,3 +482,27 @@ +@@ -576,3 +481,27 @@ allow $2 $1_mozilla_t:tcp_socket rw_socket_perms; ') @@ -2098,9 +2085,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. + + allow $2 $1_mozilla_t:unix_stream_socket connectto; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.0.3/policy/modules/apps/mozilla.te ---- nsaserefpolicy/policy/modules/apps/mozilla.te 2007-07-03 07:05:43.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/mozilla.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.0.4/policy/modules/apps/mozilla.te +--- nsaserefpolicy/policy/modules/apps/mozilla.te 2007-07-25 10:37:37.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/mozilla.te 2007-07-25 13:27:51.000000000 -0400 @@ -6,13 +6,6 @@ # Declarations # @@ -2115,9 +2102,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. type mozilla_conf_t; files_config_file(mozilla_conf_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.0.3/policy/modules/apps/slocate.te ---- nsaserefpolicy/policy/modules/apps/slocate.te 2007-06-15 14:54:31.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/slocate.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.0.4/policy/modules/apps/slocate.te +--- nsaserefpolicy/policy/modules/apps/slocate.te 2007-07-25 10:37:37.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/slocate.te 2007-07-25 13:27:51.000000000 -0400 @@ -29,6 +29,8 @@ manage_dirs_pattern(locate_t,locate_var_lib_t,locate_var_lib_t) manage_files_pattern(locate_t,locate_var_lib_t,locate_var_lib_t) @@ -2127,10 +2114,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate. kernel_read_system_state(locate_t) kernel_dontaudit_search_sysctl(locate_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.0.3/policy/modules/apps/userhelper.if ---- nsaserefpolicy/policy/modules/apps/userhelper.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/userhelper.if 2007-07-17 15:46:25.000000000 -0400 -@@ -131,6 +131,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.0.4/policy/modules/apps/userhelper.if +--- nsaserefpolicy/policy/modules/apps/userhelper.if 2007-07-25 10:37:37.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/userhelper.if 2007-07-25 13:27:51.000000000 -0400 +@@ -130,6 +130,7 @@ term_use_all_user_ptys($1_userhelper_t) auth_domtrans_chk_passwd($1_userhelper_t) @@ -2138,9 +2125,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp auth_manage_pam_pid($1_userhelper_t) auth_manage_var_auth($1_userhelper_t) auth_search_pam_console_data($1_userhelper_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.3/policy/modules/apps/vmware.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.4/policy/modules/apps/vmware.fc --- nsaserefpolicy/policy/modules/apps/vmware.fc 2007-07-03 07:05:43.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/vmware.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/vmware.fc 2007-07-25 13:27:51.000000000 -0400 @@ -23,6 +23,7 @@ /usr/bin/vmware-smbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) /usr/bin/vmware-smbpasswd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) @@ -2149,9 +2136,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.f /usr/bin/vmware-wizard -- gen_context(system_u:object_r:vmware_exec_t,s0) /usr/bin/vmware -- gen_context(system_u:object_r:vmware_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.0.3/policy/modules/apps/vmware.te ---- nsaserefpolicy/policy/modules/apps/vmware.te 2007-07-03 07:05:43.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/vmware.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.0.4/policy/modules/apps/vmware.te +--- nsaserefpolicy/policy/modules/apps/vmware.te 2007-07-25 10:37:37.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/vmware.te 2007-07-25 13:27:51.000000000 -0400 @@ -29,7 +29,7 @@ allow vmware_host_t self:capability { setuid net_raw }; @@ -2170,9 +2157,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.t corenet_tcp_connect_all_ports(vmware_host_t) corenet_sendrecv_all_client_packets(vmware_host_t) corenet_sendrecv_all_server_packets(vmware_host_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.3/policy/modules/apps/wine.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.4/policy/modules/apps/wine.if --- nsaserefpolicy/policy/modules/apps/wine.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/apps/wine.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/apps/wine.if 2007-07-25 13:27:51.000000000 -0400 @@ -18,3 +18,34 @@ corecmd_search_bin($1) domtrans_pattern($1, wine_exec_t, wine_t) @@ -2208,9 +2195,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if + role $2 types wine_t; + allow wine_t $3:chr_file rw_term_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.3/policy/modules/kernel/corecommands.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.4/policy/modules/kernel/corecommands.fc --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/corecommands.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/corecommands.fc 2007-07-25 13:27:51.000000000 -0400 @@ -36,6 +36,11 @@ /etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0) /etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0) @@ -2231,9 +2218,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco /usr/share/system-config-rootpassword/system-config-rootpassword -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-samba/system-config-samba\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-securitylevel/system-config-securitylevel\.py -- gen_context(system_u:object_r:bin_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.0.3/policy/modules/kernel/corenetwork.te.in +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.0.4/policy/modules/kernel/corenetwork.te.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/corenetwork.te.in 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/corenetwork.te.in 2007-07-25 13:27:51.000000000 -0400 @@ -55,6 +55,11 @@ type reserved_port_t, port_type, reserved_port_type; @@ -2292,9 +2279,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene portcon tcp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0) portcon udp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.0.3/policy/modules/kernel/devices.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.0.4/policy/modules/kernel/devices.fc --- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/devices.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/devices.fc 2007-07-25 13:27:51.000000000 -0400 @@ -53,7 +53,7 @@ /dev/radio.* -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/random -c gen_context(system_u:object_r:random_device_t,s0) @@ -2320,9 +2307,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device +/etc/udev/devices -d gen_context(system_u:object_r:device_t,s0) +/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.0.3/policy/modules/kernel/devices.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.0.4/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/devices.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/devices.if 2007-07-25 13:27:51.000000000 -0400 @@ -2803,6 +2803,24 @@ ######################################## @@ -2348,9 +2335,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device ## Do not audit attempts to get the attributes ## of a directory in the usb filesystem. ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.3/policy/modules/kernel/domain.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.4/policy/modules/kernel/domain.if --- nsaserefpolicy/policy/modules/kernel/domain.if 2007-06-19 16:23:34.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/domain.if 2007-07-20 16:52:28.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/domain.if 2007-07-25 13:27:51.000000000 -0400 @@ -45,6 +45,11 @@ # start with basic domain domain_base_type($1) @@ -2392,9 +2379,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain + + allow $1 domain:association { sendto recvfrom }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.3/policy/modules/kernel/domain.te ---- nsaserefpolicy/policy/modules/kernel/domain.te 2007-06-19 16:23:34.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/domain.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.4/policy/modules/kernel/domain.te +--- nsaserefpolicy/policy/modules/kernel/domain.te 2007-07-25 10:37:36.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/domain.te 2007-07-25 13:27:51.000000000 -0400 @@ -6,6 +6,29 @@ # Declarations # @@ -2451,9 +2438,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain + ipsec_labeled(domain) + ') +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.3/policy/modules/kernel/files.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.4/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/files.if 2007-07-24 13:47:36.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/files.if 2007-07-25 13:27:51.000000000 -0400 @@ -343,8 +343,7 @@ ######################################## @@ -2633,9 +2620,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. + allow $1 root_t:dir rw_dir_perms; + allow $1 root_t:file { create getattr write }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.3/policy/modules/kernel/filesystem.te ---- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/filesystem.te 2007-07-24 13:44:42.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.4/policy/modules/kernel/filesystem.te +--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-07-25 10:37:36.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/filesystem.te 2007-07-25 13:27:51.000000000 -0400 @@ -43,6 +43,12 @@ # # Non-persistent/pseudo filesystems @@ -2657,10 +2644,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy # Use a transition SID based on the allocating task SID and the # filesystem SID to label inodes in the following filesystem types, -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.3/policy/modules/kernel/kernel.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.4/policy/modules/kernel/kernel.if --- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/kernel.if 2007-07-24 13:50:13.000000000 -0400 -@@ -1848,6 +1848,27 @@ ++++ serefpolicy-3.0.4/policy/modules/kernel/kernel.if 2007-07-25 14:26:57.000000000 -0400 +@@ -108,6 +108,24 @@ + + ######################################## + ## ++## Set the process scheduler of kernel threads. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`kernel_setsched',` ++ gen_require(` ++ type kernel_t; ++ ') ++ ++ allow $1 kernel_t:process setsched; ++') ++ ++######################################## ++## + ## Send a SIGCHLD signal to kernel threads. + ## + ## +@@ -1848,6 +1866,27 @@ ######################################## ## @@ -2688,9 +2700,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ## Do not audit attempts to list unlabeled directories. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.0.3/policy/modules/kernel/kernel.te ---- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-07-17 14:52:26.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/kernel.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.0.4/policy/modules/kernel/kernel.te +--- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-07-25 10:37:36.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/kernel.te 2007-07-25 13:27:51.000000000 -0400 @@ -26,9 +26,6 @@ role staff_r; role user_r; @@ -2709,9 +2721,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-3.0.3/policy/modules/kernel/mls.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-3.0.4/policy/modules/kernel/mls.if --- nsaserefpolicy/policy/modules/kernel/mls.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/mls.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/mls.if 2007-07-25 13:27:51.000000000 -0400 @@ -154,6 +154,26 @@ ######################################## ## @@ -2739,9 +2751,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if ## for writing to sockets at any level. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-3.0.3/policy/modules/kernel/mls.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-3.0.4/policy/modules/kernel/mls.te --- nsaserefpolicy/policy/modules/kernel/mls.te 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/mls.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/mls.te 2007-07-25 13:27:51.000000000 -0400 @@ -18,6 +18,7 @@ attribute mlsnetreadtoclr; attribute mlsnetwrite; @@ -2759,9 +2771,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te attribute mlstrustedobject; attribute privrangetrans; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.0.3/policy/modules/kernel/selinux.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.0.4/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/selinux.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/selinux.if 2007-07-25 13:27:51.000000000 -0400 @@ -32,20 +32,21 @@ ######################################## @@ -2830,9 +2842,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu allow $1 security_t:dir list_dir_perms; allow $1 security_t:file { getattr read }; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.0.3/policy/modules/kernel/storage.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.0.4/policy/modules/kernel/storage.fc --- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/storage.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/storage.fc 2007-07-25 13:27:51.000000000 -0400 @@ -23,6 +23,7 @@ /dev/loop.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/lvm -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) @@ -2841,9 +2853,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag /dev/mmcblk.* -b gen_context(system_u:object_r:removable_device_t,s0) /dev/nb[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.0.3/policy/modules/kernel/storage.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.0.4/policy/modules/kernel/storage.if --- nsaserefpolicy/policy/modules/kernel/storage.if 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/storage.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/storage.if 2007-07-25 13:27:51.000000000 -0400 @@ -100,6 +100,7 @@ dev_list_all_dev_nodes($1) @@ -2860,9 +2872,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag typeattribute $1 fixed_disk_raw_write; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.0.3/policy/modules/kernel/terminal.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.0.4/policy/modules/kernel/terminal.fc --- nsaserefpolicy/policy/modules/kernel/terminal.fc 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/terminal.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/terminal.fc 2007-07-25 13:27:51.000000000 -0400 @@ -8,6 +8,7 @@ /dev/dcbri[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0) /dev/hvc.* -c gen_context(system_u:object_r:tty_device_t,s0) @@ -2871,9 +2883,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin /dev/ircomm[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0) /dev/ip2[^/]* -c gen_context(system_u:object_r:tty_device_t,s0) /dev/isdn.* -c gen_context(system_u:object_r:tty_device_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.0.3/policy/modules/kernel/terminal.te ---- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/kernel/terminal.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.0.4/policy/modules/kernel/terminal.te +--- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-07-25 10:37:36.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/kernel/terminal.te 2007-07-25 13:27:51.000000000 -0400 @@ -28,9 +28,15 @@ type devpts_t; files_mountpoint(devpts_t) @@ -2901,9 +2913,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin # # usbtty_device_t is the type of /dev/usr/tty* # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.0.3/policy/modules/services/amavis.te ---- nsaserefpolicy/policy/modules/services/amavis.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/amavis.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.0.4/policy/modules/services/amavis.te +--- nsaserefpolicy/policy/modules/services/amavis.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/amavis.te 2007-07-25 13:27:51.000000000 -0400 @@ -166,6 +166,7 @@ optional_policy(` @@ -2912,9 +2924,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.3/policy/modules/services/apache.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.4/policy/modules/services/apache.fc --- nsaserefpolicy/policy/modules/services/apache.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/apache.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/apache.fc 2007-07-25 13:27:51.000000000 -0400 @@ -16,7 +16,6 @@ /usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0) @@ -2935,9 +2947,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +#viewvc file context +/var/spool/viewvc(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t, s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.0.3/policy/modules/services/apache.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.0.4/policy/modules/services/apache.if --- nsaserefpolicy/policy/modules/services/apache.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/apache.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/apache.if 2007-07-25 13:27:51.000000000 -0400 @@ -18,10 +18,6 @@ attribute httpd_script_exec_type; type httpd_t, httpd_suexec_t, httpd_log_t; @@ -3234,9 +3246,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + + dontaudit $1 httpd_bugzilla_script_t:unix_stream_socket { read write }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.3/policy/modules/services/apache.te ---- nsaserefpolicy/policy/modules/services/apache.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/apache.te 2007-07-23 16:18:28.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.4/policy/modules/services/apache.te +--- nsaserefpolicy/policy/modules/services/apache.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/apache.te 2007-07-26 10:06:52.000000000 -0400 @@ -30,6 +30,13 @@ ## @@ -3423,7 +3435,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_ssi_exec',` corecmd_shell_domtrans(httpd_t,httpd_sys_script_t) allow httpd_sys_script_t httpd_t:fd use; -@@ -606,6 +692,10 @@ +@@ -430,6 +516,12 @@ + ') + + optional_policy(` ++ tunable_policy(`httpd_tty_comm',` ++ unconfined_use_terminals(httpd_t) ++ ') ++') ++ ++optional_policy(` + calamaris_read_www_files(httpd_t) + ') + +@@ -512,10 +604,16 @@ + tunable_policy(`httpd_tty_comm',` + # cjp: this is redundant: + term_use_controlling_term(httpd_helper_t) +- + userdom_use_sysadm_terms(httpd_helper_t) + ') + ++optional_policy(` ++ tunable_policy(`httpd_tty_comm',` ++ unconfined_use_terminals(httpd_helper_t) ++ ') ++') ++ ++ + ######################################## + # + # Apache PHP script local policy +@@ -606,6 +704,10 @@ miscfiles_read_localization(httpd_suexec_t) @@ -3434,7 +3477,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_can_network_connect',` allow httpd_suexec_t self:tcp_socket create_stream_socket_perms; allow httpd_suexec_t self:udp_socket create_socket_perms; -@@ -620,10 +710,13 @@ +@@ -620,10 +722,13 @@ corenet_udp_sendrecv_all_ports(httpd_suexec_t) corenet_tcp_connect_all_ports(httpd_suexec_t) corenet_sendrecv_all_client_packets(httpd_suexec_t) @@ -3449,7 +3492,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_cgi && httpd_unified',` domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t) ') -@@ -634,6 +727,12 @@ +@@ -634,6 +739,12 @@ fs_exec_nfs_files(httpd_suexec_t) ') @@ -3462,7 +3505,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_suexec_t) fs_read_cifs_symlinks(httpd_suexec_t) -@@ -672,7 +771,8 @@ +@@ -672,7 +783,8 @@ dontaudit httpd_sys_script_t httpd_config_t:dir search; @@ -3472,7 +3515,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms; read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t) -@@ -686,15 +786,66 @@ +@@ -686,15 +798,66 @@ # Should we add a boolean? apache_domtrans_rotatelogs(httpd_sys_script_t) @@ -3540,7 +3583,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_sys_script_t) fs_read_cifs_symlinks(httpd_sys_script_t) -@@ -711,6 +862,19 @@ +@@ -711,6 +874,19 @@ ######################################## # @@ -3560,7 +3603,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac # httpd_rotatelogs local policy # -@@ -728,3 +892,26 @@ +@@ -728,3 +904,26 @@ logging_search_logs(httpd_rotatelogs_t) miscfiles_read_localization(httpd_rotatelogs_t) @@ -3587,10 +3630,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + avahi_dbus_chat(httpd_t) + ') +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-3.0.3/policy/modules/services/apcupsd.fc ---- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/apcupsd.fc 2007-07-17 15:46:25.000000000 -0400 -@@ -3,3 +3,8 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-3.0.4/policy/modules/services/apcupsd.fc +--- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/apcupsd.fc 2007-07-25 13:27:51.000000000 -0400 +@@ -1,9 +1,10 @@ +-ifdef(`distro_debian',` +-/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0) +-') +- + /usr/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0) + /var/log/apcupsd\.events.* -- gen_context(system_u:object_r:apcupsd_log_t,s0) /var/run/apcupsd\.pid -- gen_context(system_u:object_r:apcupsd_var_run_t,s0) @@ -3599,9 +3648,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +/var/www/apcupsd/upsfstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) +/var/www/apcupsd/upsimage.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) +/var/www/apcupsd/upsstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.0.3/policy/modules/services/apcupsd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.0.4/policy/modules/services/apcupsd.if --- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/apcupsd.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/apcupsd.if 2007-07-25 13:27:51.000000000 -0400 @@ -79,3 +79,25 @@ allow $1 apcupsd_log_t:dir list_dir_perms; allow $1 apcupsd_log_t:file { getattr append }; @@ -3628,9 +3677,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu + allow httpd_apcupsd_cgi_script_t $1:fifo_file rw_file_perms; + allow httpd_apcupsd_cgi_script_t $1:process sigchld; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.3/policy/modules/services/apcupsd.te ---- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/apcupsd.te 2007-07-18 08:57:22.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.4/policy/modules/services/apcupsd.te +--- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/apcupsd.te 2007-07-25 13:27:51.000000000 -0400 @@ -16,6 +16,9 @@ type apcupsd_log_t; logging_log_file(apcupsd_log_t) @@ -3727,9 +3776,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +corenet_udp_sendrecv_all_nodes(httpd_apcupsd_cgi_script_t) +corenet_udp_sendrecv_all_ports(httpd_apcupsd_cgi_script_t) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.3/policy/modules/services/audioentropy.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.4/policy/modules/services/audioentropy.te --- nsaserefpolicy/policy/modules/services/audioentropy.te 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/audioentropy.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/audioentropy.te 2007-07-25 13:27:51.000000000 -0400 @@ -18,7 +18,7 @@ # Local policy # @@ -3748,9 +3797,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audi dev_read_sound(entropyd_t) fs_getattr_all_fs(entropyd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.3/policy/modules/services/automount.te ---- nsaserefpolicy/policy/modules/services/automount.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/automount.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.4/policy/modules/services/automount.te +--- nsaserefpolicy/policy/modules/services/automount.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/automount.te 2007-07-25 13:27:51.000000000 -0400 @@ -69,6 +69,7 @@ files_mounton_all_mountpoints(automount_t) files_mount_all_file_type_fs(automount_t) @@ -3778,9 +3827,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto bind_search_cache(automount_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.0.3/policy/modules/services/avahi.te ---- nsaserefpolicy/policy/modules/services/avahi.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/avahi.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.0.4/policy/modules/services/avahi.te +--- nsaserefpolicy/policy/modules/services/avahi.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/avahi.te 2007-07-25 13:27:51.000000000 -0400 @@ -57,6 +57,7 @@ fs_getattr_all_fs(avahi_t) @@ -3789,9 +3838,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah domain_use_interactive_fds(avahi_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.3/policy/modules/services/bind.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.4/policy/modules/services/bind.fc --- nsaserefpolicy/policy/modules/services/bind.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/bind.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/bind.fc 2007-07-25 13:27:51.000000000 -0400 @@ -45,4 +45,6 @@ /var/named/chroot/var/named/slaves(/.*)? gen_context(system_u:object_r:named_cache_t,s0) /var/named/chroot/var/named/data(/.*)? gen_context(system_u:object_r:named_cache_t,s0) @@ -3799,9 +3848,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind +/var/named/dynamic(/.*)? gen_context(system_u:object_r:named_cache_t,s0) +/var/named/chroot/var/named/dynamic(/.*)? gen_context(system_u:object_r:named_cache_t,s0) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.3/policy/modules/services/bind.te ---- nsaserefpolicy/policy/modules/services/bind.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/bind.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.4/policy/modules/services/bind.te +--- nsaserefpolicy/policy/modules/services/bind.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/bind.te 2007-07-25 13:27:51.000000000 -0400 @@ -119,6 +119,11 @@ corenet_sendrecv_dns_client_packets(named_t) corenet_sendrecv_rndc_server_packets(named_t) @@ -3822,9 +3871,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind corenet_sendrecv_rndc_client_packets(ndc_t) fs_getattr_xattr_fs(ndc_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.0.3/policy/modules/services/bluetooth.te ---- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/bluetooth.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.0.4/policy/modules/services/bluetooth.te +--- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/bluetooth.te 2007-07-25 13:27:51.000000000 -0400 @@ -134,6 +134,7 @@ dbus_system_bus_client_template(bluetooth,bluetooth_t) dbus_connect_system_bus(bluetooth_t) @@ -3884,9 +3933,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue +optional_policy(` + xserver_stream_connect_xdm(bluetooth_helper_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.3/policy/modules/services/clamav.te ---- nsaserefpolicy/policy/modules/services/clamav.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/clamav.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.4/policy/modules/services/clamav.te +--- nsaserefpolicy/policy/modules/services/clamav.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/clamav.te 2007-07-25 13:27:51.000000000 -0400 @@ -208,9 +208,12 @@ files_tmp_filetrans(clamscan_t,clamscan_tmp_t,{ file dir }) @@ -3909,9 +3958,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam +optional_policy(` + mailscanner_manage_spool(clamscan_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.3/policy/modules/services/consolekit.te ---- nsaserefpolicy/policy/modules/services/consolekit.te 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/consolekit.te 2007-07-24 15:38:28.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.4/policy/modules/services/consolekit.te +--- nsaserefpolicy/policy/modules/services/consolekit.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/consolekit.te 2007-07-25 13:27:51.000000000 -0400 @@ -10,7 +10,6 @@ type consolekit_exec_t; init_daemon_domain(consolekit_t, consolekit_exec_t) @@ -3970,9 +4019,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons + unconfined_ptrace(consolekit_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.3/policy/modules/services/courier.te ---- nsaserefpolicy/policy/modules/services/courier.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/courier.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.4/policy/modules/services/courier.te +--- nsaserefpolicy/policy/modules/services/courier.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/courier.te 2007-07-25 13:27:51.000000000 -0400 @@ -58,6 +58,7 @@ files_getattr_tmp_dirs(courier_authdaemon_t) @@ -3981,9 +4030,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cour libs_read_lib_files(courier_authdaemon_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.3/policy/modules/services/cron.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.4/policy/modules/services/cron.fc --- nsaserefpolicy/policy/modules/services/cron.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/cron.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/cron.fc 2007-07-25 13:27:51.000000000 -0400 @@ -17,6 +17,8 @@ /var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0) /var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) @@ -3998,9 +4047,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron /var/spool/fcron/systab -- gen_context(system_u:object_r:system_cron_spool_t,s0) /var/spool/fcron/new\.systab -- gen_context(system_u:object_r:system_cron_spool_t,s0) +/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.3/policy/modules/services/cron.if ---- nsaserefpolicy/policy/modules/services/cron.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/cron.if 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.4/policy/modules/services/cron.if +--- nsaserefpolicy/policy/modules/services/cron.if 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/cron.if 2007-07-25 13:27:51.000000000 -0400 @@ -35,6 +35,7 @@ # template(`cron_per_role_template',` @@ -4009,8 +4058,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron attribute cron_spool_type; type crond_t, cron_spool_t, crontab_exec_t; ') -@@ -54,9 +55,6 @@ - domain_entry_file($1_crontab_t,crontab_exec_t) +@@ -53,9 +54,6 @@ + application_domain($1_crontab_t,crontab_exec_t) role $3 types $1_crontab_t; - type $1_crontab_tmp_t; @@ -4019,7 +4068,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ############################## # # $1_crond_t local policy -@@ -67,6 +65,7 @@ +@@ -66,6 +64,7 @@ allow $1_crond_t self:fifo_file rw_fifo_file_perms; allow $1_crond_t self:unix_stream_socket create_stream_socket_perms; allow $1_crond_t self:unix_dgram_socket create_socket_perms; @@ -4027,7 +4076,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # The entrypoint interface is not used as this is not # a regular entrypoint. Since crontab files are -@@ -135,55 +134,38 @@ +@@ -134,55 +133,38 @@ miscfiles_read_localization($1_crond_t) @@ -4091,7 +4140,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ############################## # -@@ -196,6 +178,7 @@ +@@ -195,6 +177,7 @@ # Transition from the user domain to the derived domain. domtrans_pattern($2, crontab_exec_t, $1_crontab_t) @@ -4099,7 +4148,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # crontab shows up in user ps ps_process_pattern($2,$1_crontab_t) -@@ -206,9 +189,6 @@ +@@ -205,9 +188,6 @@ # Allow crond to read those crontabs in cron spool. allow crond_t $1_cron_spool_t:file manage_file_perms; @@ -4109,7 +4158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # create files in /var/spool/cron manage_files_pattern($1_crontab_t,cron_spool_t,$1_cron_spool_t) filetrans_pattern($1_crontab_t,cron_spool_t,$1_cron_spool_t,file) -@@ -244,10 +224,12 @@ +@@ -243,10 +223,12 @@ userdom_manage_user_tmp_dirs($1,$1_crontab_t) userdom_manage_user_tmp_files($1,$1_crontab_t) @@ -4122,7 +4171,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron tunable_policy(`fcron_crond',` # fcron wants an instant update of a crontab change for the administrator -@@ -439,6 +421,25 @@ +@@ -438,6 +420,25 @@ ######################################## ## @@ -4148,9 +4197,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ## Read, and write cron daemon TCP sockets. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.3/policy/modules/services/cron.te ---- nsaserefpolicy/policy/modules/services/cron.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/cron.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.4/policy/modules/services/cron.te +--- nsaserefpolicy/policy/modules/services/cron.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/cron.te 2007-07-25 14:02:38.000000000 -0400 @@ -50,6 +50,7 @@ type crond_tmp_t; @@ -4208,7 +4257,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # need auth_chkpwd to check for locked accounts. auth_domtrans_chk_passwd(crond_t) -+auth_domtrans_upd_passwd(crond_t) ++auth_domtrans_upd_passwd_chk(crond_t) +auth_search_key(crond_t) corecmd_exec_shell(crond_t) @@ -4376,9 +4425,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') ifdef(`TODO',` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.3/policy/modules/services/cups.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.4/policy/modules/services/cups.fc --- nsaserefpolicy/policy/modules/services/cups.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/cups.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/cups.fc 2007-07-25 13:27:51.000000000 -0400 @@ -8,6 +8,7 @@ /etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -4392,9 +4441,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups /var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) +/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,mls_systemhigh) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.3/policy/modules/services/cups.te ---- nsaserefpolicy/policy/modules/services/cups.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/cups.te 2007-07-24 16:22:33.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.4/policy/modules/services/cups.te +--- nsaserefpolicy/policy/modules/services/cups.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/cups.te 2007-07-25 14:08:39.000000000 -0400 @@ -81,12 +81,11 @@ # /usr/lib/cups/backend/serial needs sys_admin(?!) allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config }; @@ -4432,7 +4481,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups term_search_ptys(cupsd_t) auth_domtrans_chk_passwd(cupsd_t) -+auth_domtrans_upd_passwd(cupsd_t) ++auth_domtrans_upd_passwd_chk(cupsd_t) auth_dontaudit_read_pam_pid(cupsd_t) # Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp @@ -4556,9 +4605,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups optional_policy(` seutil_sigchld_newrole(hplip_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.3/policy/modules/services/cvs.te ---- nsaserefpolicy/policy/modules/services/cvs.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/cvs.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.4/policy/modules/services/cvs.te +--- nsaserefpolicy/policy/modules/services/cvs.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/cvs.te 2007-07-25 14:08:45.000000000 -0400 @@ -16,6 +16,7 @@ type cvs_t; type cvs_exec_t; @@ -4571,7 +4620,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs. fs_getattr_xattr_fs(cvs_t) auth_domtrans_chk_passwd(cvs_t) -+auth_domtrans_upd_passwd(cvs_t) ++auth_domtrans_upd_passwd_chk(cvs_t) corecmd_exec_bin(cvs_t) corecmd_exec_shell(cvs_t) @@ -4583,9 +4632,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs. miscfiles_read_localization(cvs_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.3/policy/modules/services/dbus.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.4/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/dbus.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/dbus.if 2007-07-25 13:27:51.000000000 -0400 @@ -50,6 +50,12 @@ ## # @@ -4700,9 +4749,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus +') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.0.3/policy/modules/services/dhcp.te ---- nsaserefpolicy/policy/modules/services/dhcp.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/dhcp.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.0.4/policy/modules/services/dhcp.te +--- nsaserefpolicy/policy/modules/services/dhcp.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/dhcp.te 2007-07-25 13:27:51.000000000 -0400 @@ -114,6 +114,8 @@ dbus_system_bus_client_template(dhcpd,dhcpd_t) dbus_connect_system_bus(dhcpd_t) @@ -4712,9 +4761,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.3/policy/modules/services/dovecot.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.4/policy/modules/services/dovecot.fc --- nsaserefpolicy/policy/modules/services/dovecot.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/dovecot.fc 2007-07-23 09:12:16.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/dovecot.fc 2007-07-25 13:27:51.000000000 -0400 @@ -17,16 +17,19 @@ ifdef(`distro_debian', ` @@ -4735,9 +4784,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove /var/lib/dovecot(/.*)? gen_context(system_u:object_r:dovecot_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.3/policy/modules/services/dovecot.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.4/policy/modules/services/dovecot.if --- nsaserefpolicy/policy/modules/services/dovecot.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/dovecot.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/dovecot.if 2007-07-25 13:27:51.000000000 -0400 @@ -18,3 +18,43 @@ manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t) manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t) @@ -4782,9 +4831,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + domtrans_pattern($1,dovecot_deliver_exec_t,dovecot_deliver_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.3/policy/modules/services/dovecot.te ---- nsaserefpolicy/policy/modules/services/dovecot.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/dovecot.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.4/policy/modules/services/dovecot.te +--- nsaserefpolicy/policy/modules/services/dovecot.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/dovecot.te 2007-07-25 13:27:51.000000000 -0400 @@ -15,6 +15,12 @@ domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t) role system_r types dovecot_auth_t; @@ -4924,9 +4973,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove +optional_policy(` + mta_manage_spool(dovecot_deliver_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.3/policy/modules/services/ftp.te ---- nsaserefpolicy/policy/modules/services/ftp.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/ftp.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.4/policy/modules/services/ftp.te +--- nsaserefpolicy/policy/modules/services/ftp.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/ftp.te 2007-07-25 16:26:05.000000000 -0400 @@ -88,6 +88,7 @@ allow ftpd_t self:unix_stream_socket create_stream_socket_perms; allow ftpd_t self:tcp_socket create_stream_socket_perms; @@ -4939,7 +4988,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. auth_use_nsswitch(ftpd_t) auth_domtrans_chk_passwd(ftpd_t) -+auth_domtrans_upd_passwd(ftpd_t) ++auth_domtrans_upd_passwd_chk(ftpd_t) # Append to /var/log/wtmp. auth_append_login_records(ftpd_t) #kerberized ftp requires the following @@ -4968,9 +5017,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. ') tunable_policy(`ftp_home_dir && use_nfs_home_dirs',` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.3/policy/modules/services/hal.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.4/policy/modules/services/hal.fc --- nsaserefpolicy/policy/modules/services/hal.fc 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/hal.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/hal.fc 2007-07-25 13:27:51.000000000 -0400 @@ -8,9 +8,14 @@ /usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) @@ -4986,9 +5035,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. + +/var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.0.3/policy/modules/services/hal.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.0.4/policy/modules/services/hal.if --- nsaserefpolicy/policy/modules/services/hal.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/hal.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/hal.if 2007-07-25 13:27:51.000000000 -0400 @@ -208,3 +208,98 @@ files_search_pids($1) allow $1 hald_var_run_t:file rw_file_perms; @@ -5088,9 +5137,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. + allow $1 hald_t:process ptrace; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.3/policy/modules/services/hal.te ---- nsaserefpolicy/policy/modules/services/hal.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/hal.te 2007-07-20 15:18:42.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.4/policy/modules/services/hal.te +--- nsaserefpolicy/policy/modules/services/hal.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/hal.te 2007-07-25 13:27:51.000000000 -0400 @@ -22,6 +22,12 @@ type hald_log_t; files_type(hald_log_t) @@ -5202,9 +5251,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. +miscfiles_read_localization(hald_keymap_t) + +dev_rw_input_dev(hald_keymap_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.3/policy/modules/services/inetd.te ---- nsaserefpolicy/policy/modules/services/inetd.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/inetd.te 2007-07-20 09:21:48.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.4/policy/modules/services/inetd.te +--- nsaserefpolicy/policy/modules/services/inetd.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/inetd.te 2007-07-25 13:27:51.000000000 -0400 @@ -80,16 +80,21 @@ corenet_udp_bind_comsat_port(inetd_t) corenet_tcp_bind_dbskkd_port(inetd_t) @@ -5274,9 +5323,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet unconfined_domain(inetd_child_t) + inetd_service_domain(inetd_child_t,bin_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.3/policy/modules/services/kerberos.te ---- nsaserefpolicy/policy/modules/services/kerberos.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/kerberos.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.4/policy/modules/services/kerberos.te +--- nsaserefpolicy/policy/modules/services/kerberos.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/kerberos.te 2007-07-25 13:27:51.000000000 -0400 @@ -91,6 +91,7 @@ kernel_read_kernel_sysctls(kadmind_t) kernel_list_proc(kadmind_t) @@ -5311,10 +5360,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t) userdom_dontaudit_search_sysadm_home_dirs(krb5kdc_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.3/policy/modules/services/lpd.if ---- nsaserefpolicy/policy/modules/services/lpd.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/lpd.if 2007-07-17 15:46:25.000000000 -0400 -@@ -395,3 +395,22 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.4/policy/modules/services/lpd.if +--- nsaserefpolicy/policy/modules/services/lpd.if 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/lpd.if 2007-07-25 13:27:51.000000000 -0400 +@@ -394,3 +394,22 @@ domtrans_pattern($2, lpr_exec_t, $1_lpr_t) ') @@ -5337,26 +5386,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd. + + can_exec($1,lpr_exec_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.3/policy/modules/services/mailman.te ---- nsaserefpolicy/policy/modules/services/mailman.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/mailman.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.4/policy/modules/services/mailman.te +--- nsaserefpolicy/policy/modules/services/mailman.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/mailman.te 2007-07-25 14:09:02.000000000 -0400 @@ -96,6 +96,7 @@ kernel_read_proc_symlinks(mailman_queue_t) auth_domtrans_chk_passwd(mailman_queue_t) -+auth_domtrans_upd_passwd(mailman_queue_t) ++auth_domtrans_upd_passwd_chk(mailman_queue_t) files_dontaudit_search_pids(mailman_queue_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.3/policy/modules/services/mailscanner.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.4/policy/modules/services/mailscanner.fc --- nsaserefpolicy/policy/modules/services/mailscanner.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/services/mailscanner.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/mailscanner.fc 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,2 @@ +/var/spool/MailScanner(/.*)? gen_context(system_u:object_r:mailscanner_spool_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.3/policy/modules/services/mailscanner.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.4/policy/modules/services/mailscanner.if --- nsaserefpolicy/policy/modules/services/mailscanner.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/services/mailscanner.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/mailscanner.if 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,59 @@ +## Anti-Virus and Anti-Spam Filter + @@ -5417,19 +5466,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail + files_search_spool($1) + manage_files_pattern($1,mailscanner_spool_t,mailscanner_spool_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.3/policy/modules/services/mailscanner.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.4/policy/modules/services/mailscanner.te --- nsaserefpolicy/policy/modules/services/mailscanner.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/services/mailscanner.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/mailscanner.te 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,5 @@ + +policy_module(mailscanner,1.0.0) + +type mailscanner_spool_t; +files_type(mailscanner_spool_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.3/policy/modules/services/mta.if ---- nsaserefpolicy/policy/modules/services/mta.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/mta.if 2007-07-24 15:41:08.000000000 -0400 -@@ -393,6 +393,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.4/policy/modules/services/mta.if +--- nsaserefpolicy/policy/modules/services/mta.if 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/mta.if 2007-07-25 13:27:51.000000000 -0400 +@@ -392,6 +392,7 @@ allow $1 mail_spool_t:dir list_dir_perms; create_files_pattern($1,mail_spool_t,mail_spool_t) read_files_pattern($1,mail_spool_t,mail_spool_t) @@ -5437,18 +5486,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. create_lnk_files_pattern($1,mail_spool_t,mail_spool_t) read_lnk_files_pattern($1,mail_spool_t,mail_spool_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.3/policy/modules/services/mta.te ---- nsaserefpolicy/policy/modules/services/mta.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/mta.te 2007-07-17 15:46:25.000000000 -0400 -@@ -27,6 +27,7 @@ - - type sendmail_exec_t; - files_type(sendmail_exec_t) -+application_executable_file(sendmail_exec_t) - - mta_base_mail_template(system) - role system_r types system_mail_t; -@@ -52,15 +53,44 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.4/policy/modules/services/mta.te +--- nsaserefpolicy/policy/modules/services/mta.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/mta.te 2007-07-25 13:27:51.000000000 -0400 +@@ -52,15 +52,44 @@ userdom_use_sysadm_terms(system_mail_t) userdom_dontaudit_search_sysadm_home_dirs(system_mail_t) @@ -5493,7 +5534,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. ') optional_policy(` -@@ -73,6 +103,7 @@ +@@ -73,6 +102,7 @@ optional_policy(` cron_read_system_job_tmp_files(system_mail_t) @@ -5501,9 +5542,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. cron_dontaudit_write_pipes(system_mail_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.0.3/policy/modules/services/networkmanager.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.0.4/policy/modules/services/networkmanager.fc --- nsaserefpolicy/policy/modules/services/networkmanager.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/networkmanager.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/networkmanager.fc 2007-07-25 13:27:51.000000000 -0400 @@ -1,5 +1,6 @@ /usr/(s)?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) @@ -5511,9 +5552,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw /var/run/NetworkManager\.pid -- gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.3/policy/modules/services/networkmanager.te ---- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/networkmanager.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.4/policy/modules/services/networkmanager.te +--- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/networkmanager.te 2007-07-25 13:27:51.000000000 -0400 @@ -41,6 +41,8 @@ kernel_read_kernel_sysctls(NetworkManager_t) kernel_load_module(NetworkManager_t) @@ -5551,9 +5592,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw # Read gnome-keyring unconfined_read_home_content_files(NetworkManager_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.3/policy/modules/services/nis.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.4/policy/modules/services/nis.fc --- nsaserefpolicy/policy/modules/services/nis.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/nis.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/nis.fc 2007-07-25 13:27:51.000000000 -0400 @@ -4,6 +4,7 @@ /sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0) @@ -5562,9 +5603,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. /usr/sbin/rpc\.yppasswdd -- gen_context(system_u:object_r:yppasswdd_exec_t,s0) /usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.3/policy/modules/services/nis.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.4/policy/modules/services/nis.if --- nsaserefpolicy/policy/modules/services/nis.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/nis.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/nis.if 2007-07-25 13:27:51.000000000 -0400 @@ -49,8 +49,8 @@ corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) @@ -5576,9 +5617,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_dontaudit_tcp_bind_all_ports($1) corenet_dontaudit_udp_bind_all_ports($1) corenet_tcp_connect_portmap_port($1) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.3/policy/modules/services/nis.te ---- nsaserefpolicy/policy/modules/services/nis.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/nis.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.4/policy/modules/services/nis.te +--- nsaserefpolicy/policy/modules/services/nis.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/nis.te 2007-07-25 13:27:51.000000000 -0400 @@ -113,6 +113,14 @@ userdom_dontaudit_use_unpriv_user_fds(ypbind_t) userdom_dontaudit_search_sysadm_home_dirs(ypbind_t) @@ -5631,9 +5672,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t) corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t) corenet_tcp_connect_all_ports(ypxfr_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.3/policy/modules/services/nscd.te ---- nsaserefpolicy/policy/modules/services/nscd.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/nscd.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.4/policy/modules/services/nscd.te +--- nsaserefpolicy/policy/modules/services/nscd.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/nscd.te 2007-07-25 13:27:51.000000000 -0400 @@ -28,14 +28,14 @@ # Local policy # @@ -5682,9 +5723,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd + samba_read_config(nscd_t) + samba_read_var_files(nscd_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.0.3/policy/modules/services/ntp.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.0.4/policy/modules/services/ntp.fc --- nsaserefpolicy/policy/modules/services/ntp.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/ntp.fc 2007-07-23 13:11:18.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/ntp.fc 2007-07-25 13:27:51.000000000 -0400 @@ -17,3 +17,7 @@ /var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0) @@ -5693,9 +5734,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. +/etc/ntp/crypto(/.*)? gen_context(system_u:object_r:ntpd_key_t,s0) +/etc/ntp/keys -- gen_context(system_u:object_r:ntpd_key_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.3/policy/modules/services/ntp.te ---- nsaserefpolicy/policy/modules/services/ntp.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/ntp.te 2007-07-23 13:36:54.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.4/policy/modules/services/ntp.te +--- nsaserefpolicy/policy/modules/services/ntp.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/ntp.te 2007-07-25 13:27:51.000000000 -0400 @@ -25,6 +25,9 @@ type ntpdate_exec_t; init_system_domain(ntpd_t,ntpdate_exec_t) @@ -5756,9 +5797,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. udev_read_db(ntpd_t) ') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-3.0.3/policy/modules/services/openvpn.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-3.0.4/policy/modules/services/openvpn.if --- nsaserefpolicy/policy/modules/services/openvpn.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/openvpn.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/openvpn.if 2007-07-25 13:27:51.000000000 -0400 @@ -22,3 +22,71 @@ read_files_pattern($1,openvpn_etc_t,openvpn_etc_t) read_lnk_files_pattern($1,openvpn_etc_t,openvpn_etc_t) @@ -5831,9 +5872,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open + + allow $1 openvpn_t:process signal; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.3/policy/modules/services/openvpn.te ---- nsaserefpolicy/policy/modules/services/openvpn.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/openvpn.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.4/policy/modules/services/openvpn.te +--- nsaserefpolicy/policy/modules/services/openvpn.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/openvpn.te 2007-07-25 13:27:51.000000000 -0400 @@ -6,6 +6,13 @@ # Declarations # @@ -5910,9 +5951,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open + unconfined_use_terminals(openvpn_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.3/policy/modules/services/pegasus.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.4/policy/modules/services/pegasus.if --- nsaserefpolicy/policy/modules/services/pegasus.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/pegasus.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/pegasus.if 2007-07-25 13:27:51.000000000 -0400 @@ -1 +1,19 @@ ## The Open Group Pegasus CIM/WBEM Server. + @@ -5933,14 +5974,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega + + domtrans_pattern($1,pegasus_exec_t,pegasus_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.3/policy/modules/services/pegasus.te ---- nsaserefpolicy/policy/modules/services/pegasus.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/pegasus.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.4/policy/modules/services/pegasus.te +--- nsaserefpolicy/policy/modules/services/pegasus.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/pegasus.te 2007-07-25 14:09:06.000000000 -0400 @@ -95,13 +95,13 @@ auth_use_nsswitch(pegasus_t) auth_domtrans_chk_passwd(pegasus_t) -+auth_domtrans_upd_passwd(pegasus_t) ++auth_domtrans_upd_passwd_chk(pegasus_t) +auth_read_shadow(pegasus_t) domain_use_interactive_fds(pegasus_t) @@ -5975,20 +6016,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega rpm_exec(pegasus_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.3/policy/modules/services/portslave.te ---- nsaserefpolicy/policy/modules/services/portslave.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/portslave.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.4/policy/modules/services/portslave.te +--- nsaserefpolicy/policy/modules/services/portslave.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/portslave.te 2007-07-25 14:09:10.000000000 -0400 @@ -85,6 +85,7 @@ auth_rw_login_records(portslave_t) auth_domtrans_chk_passwd(portslave_t) -+auth_domtrans_upd_passwd(portslave_t) ++auth_domtrans_upd_passwd_chk(portslave_t) init_rw_utmp(portslave_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.3/policy/modules/services/postfix.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.4/policy/modules/services/postfix.fc --- nsaserefpolicy/policy/modules/services/postfix.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/postfix.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/postfix.fc 2007-07-25 13:27:51.000000000 -0400 @@ -14,6 +14,7 @@ /usr/libexec/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0) /usr/libexec/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0) @@ -5997,9 +6038,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ', ` /usr/lib/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0) /usr/lib/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.3/policy/modules/services/postfix.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.4/policy/modules/services/postfix.if --- nsaserefpolicy/policy/modules/services/postfix.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/postfix.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/postfix.if 2007-07-25 13:27:51.000000000 -0400 @@ -41,6 +41,8 @@ allow postfix_$1_t self:unix_stream_socket connectto; @@ -6113,10 +6154,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post + allow $1 postfix_private_t:dir list_dir_perms; + create_sock_files_pattern($1,postfix_private_t,postfix_private_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.3/policy/modules/services/postfix.te ---- nsaserefpolicy/policy/modules/services/postfix.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/postfix.te 2007-07-17 15:46:25.000000000 -0400 -@@ -84,6 +84,12 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.4/policy/modules/services/postfix.te +--- nsaserefpolicy/policy/modules/services/postfix.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/postfix.te 2007-07-25 13:27:51.000000000 -0400 +@@ -83,6 +83,12 @@ type postfix_var_run_t; files_pid_file(postfix_var_run_t) @@ -6129,7 +6170,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ######################################## # # Postfix master process local policy -@@ -169,6 +175,11 @@ +@@ -168,6 +174,11 @@ mta_rw_aliases(postfix_master_t) mta_read_sendmail_bin(postfix_master_t) @@ -6141,7 +6182,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post optional_policy(` cyrus_stream_connect(postfix_master_t) -@@ -180,9 +191,17 @@ +@@ -179,9 +190,17 @@ ') optional_policy(` @@ -6159,7 +6200,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ########################################################### # # Partially converted rules. THESE ARE ONLY TEMPORARY -@@ -378,7 +397,7 @@ +@@ -377,7 +396,7 @@ # Postfix pipe local policy # @@ -6168,7 +6209,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post write_sock_files_pattern(postfix_pipe_t,postfix_private_t,postfix_private_t) -@@ -387,6 +406,10 @@ +@@ -386,6 +405,10 @@ rw_files_pattern(postfix_pipe_t,postfix_spool_t,postfix_spool_t) optional_policy(` @@ -6179,7 +6220,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post procmail_domtrans(postfix_pipe_t) ') -@@ -427,6 +450,11 @@ +@@ -426,6 +449,11 @@ cron_system_entry(postfix_postdrop_t, postfix_postdrop_exec_t) ') @@ -6191,7 +6232,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post optional_policy(` ppp_use_fds(postfix_postqueue_t) ppp_sigchld(postfix_postqueue_t) -@@ -506,8 +534,6 @@ +@@ -505,8 +533,6 @@ # Postfix smtp delivery local policy # @@ -6200,7 +6241,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post # connect to master process stream_connect_pattern(postfix_smtp_t,{ postfix_private_t postfix_public_t },{ postfix_private_t postfix_public_t },postfix_master_t) -@@ -515,6 +541,8 @@ +@@ -514,6 +540,8 @@ allow postfix_smtp_t postfix_spool_t:file rw_file_perms; @@ -6209,7 +6250,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post optional_policy(` cyrus_stream_connect(postfix_smtp_t) ') -@@ -539,9 +567,45 @@ +@@ -538,9 +566,45 @@ mta_read_aliases(postfix_smtpd_t) optional_policy(` @@ -6255,18 +6296,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +# For reading spamassasin +mta_read_config(postfix_virtual_t) +mta_manage_spool(postfix_virtual_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.3/policy/modules/services/procmail.te ---- nsaserefpolicy/policy/modules/services/procmail.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/procmail.te 2007-07-17 15:46:25.000000000 -0400 -@@ -10,6 +10,7 @@ - type procmail_exec_t; - domain_type(procmail_t) - domain_entry_file(procmail_t,procmail_exec_t) -+application_executable_file(procmail_exec_t) - role system_r types procmail_t; - - type procmail_tmp_t; -@@ -31,6 +32,8 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.4/policy/modules/services/procmail.te +--- nsaserefpolicy/policy/modules/services/procmail.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/procmail.te 2007-07-25 13:27:51.000000000 -0400 +@@ -30,6 +30,8 @@ allow procmail_t procmail_tmp_t:file manage_file_perms; files_tmp_filetrans(procmail_t, procmail_tmp_t, file) @@ -6275,7 +6308,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc kernel_read_system_state(procmail_t) kernel_read_kernel_sysctls(procmail_t) -@@ -109,6 +112,9 @@ +@@ -108,6 +110,9 @@ # for a bug in the postfix local program postfix_dontaudit_rw_local_tcp_sockets(procmail_t) postfix_dontaudit_use_fds(procmail_t) @@ -6285,7 +6318,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc ') optional_policy(` -@@ -130,3 +136,7 @@ +@@ -129,3 +134,7 @@ spamassassin_exec_client(procmail_t) spamassassin_read_lib_files(procmail_t) ') @@ -6293,9 +6326,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc +optional_policy(` + mailscanner_read_spool(procmail_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.3/policy/modules/services/pyzor.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.4/policy/modules/services/pyzor.if --- nsaserefpolicy/policy/modules/services/pyzor.if 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/pyzor.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/pyzor.if 2007-07-25 13:27:51.000000000 -0400 @@ -25,16 +25,16 @@ # template(`pyzor_per_role_template',` @@ -6318,10 +6351,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.0.3/policy/modules/services/pyzor.te ---- nsaserefpolicy/policy/modules/services/pyzor.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/pyzor.te 2007-07-17 15:46:25.000000000 -0400 -@@ -71,6 +71,11 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.0.4/policy/modules/services/pyzor.te +--- nsaserefpolicy/policy/modules/services/pyzor.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/pyzor.te 2007-07-25 13:27:51.000000000 -0400 +@@ -70,6 +70,11 @@ userdom_dontaudit_search_sysadm_home_dirs(pyzor_t) @@ -6333,7 +6366,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo optional_policy(` amavis_manage_lib_files(pyzor_t) amavis_manage_spool_files(pyzor_t) -@@ -134,6 +139,10 @@ +@@ -133,6 +138,10 @@ mta_manage_spool(pyzord_t) @@ -6344,14 +6377,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo optional_policy(` logging_send_syslog_msg(pyzord_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.3/policy/modules/services/radius.te ---- nsaserefpolicy/policy/modules/services/radius.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/radius.te 2007-07-23 10:49:33.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.4/policy/modules/services/radius.te +--- nsaserefpolicy/policy/modules/services/radius.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/radius.te 2007-07-25 14:09:14.000000000 -0400 @@ -82,6 +82,7 @@ auth_read_shadow(radiusd_t) auth_domtrans_chk_passwd(radiusd_t) -+auth_domtrans_upd_passwd(radiusd_t) ++auth_domtrans_upd_passwd_chk(radiusd_t) corecmd_exec_bin(radiusd_t) corecmd_exec_shell(radiusd_t) @@ -6363,9 +6396,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi sysnet_read_config(radiusd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.3/policy/modules/services/rhgb.te ---- nsaserefpolicy/policy/modules/services/rhgb.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/rhgb.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.4/policy/modules/services/rhgb.te +--- nsaserefpolicy/policy/modules/services/rhgb.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/rhgb.te 2007-07-25 13:27:51.000000000 -0400 @@ -109,6 +109,7 @@ userdom_dontaudit_use_unpriv_user_fds(rhgb_t) @@ -6374,14 +6407,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb xserver_read_xdm_xserver_tmp_files(rhgb_t) xserver_kill_xdm_xserver(rhgb_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.3/policy/modules/services/ricci.te ---- nsaserefpolicy/policy/modules/services/ricci.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/ricci.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.4/policy/modules/services/ricci.te +--- nsaserefpolicy/policy/modules/services/ricci.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/ricci.te 2007-07-25 14:09:18.000000000 -0400 @@ -138,6 +138,7 @@ files_create_boot_flag(ricci_t) auth_domtrans_chk_passwd(ricci_t) -+auth_domtrans_upd_passwd(ricci_t) ++auth_domtrans_upd_passwd_chk(ricci_t) auth_append_login_records(ricci_t) init_dontaudit_stream_connect_script(ricci_t) @@ -6404,9 +6437,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc optional_policy(` nscd_dontaudit_search_pid(ricci_modlog_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.3/policy/modules/services/rlogin.te ---- nsaserefpolicy/policy/modules/services/rlogin.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/rlogin.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.4/policy/modules/services/rlogin.te +--- nsaserefpolicy/policy/modules/services/rlogin.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/rlogin.te 2007-07-25 13:27:51.000000000 -0400 @@ -65,6 +65,7 @@ fs_search_auto_mountpoints(rlogind_t) @@ -6415,9 +6448,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog auth_rw_login_records(rlogind_t) auth_use_nsswitch(rlogind_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.3/policy/modules/services/rpc.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.4/policy/modules/services/rpcbind.te +--- nsaserefpolicy/policy/modules/services/rpcbind.te 2007-07-03 07:06:27.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/rpcbind.te 2007-07-25 14:28:29.000000000 -0400 +@@ -21,11 +21,13 @@ + # rpcbind local policy + # + +-allow rpcbind_t self:capability setuid; ++allow rpcbind_t self:capability { setuid sys_tty_config }; + allow rpcbind_t self:fifo_file rw_file_perms; + allow rpcbind_t self:unix_stream_socket create_stream_socket_perms; + allow rpcbind_t self:netlink_route_socket r_netlink_socket_perms; + allow rpcbind_t self:udp_socket create_socket_perms; ++# BROKEN ... ++dontaudit rpcbind_t self:udp_socket listen; + allow rpcbind_t self:tcp_socket create_stream_socket_perms; + + manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.4/policy/modules/services/rpc.if --- nsaserefpolicy/policy/modules/services/rpc.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/rpc.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/rpc.if 2007-07-25 13:27:51.000000000 -0400 @@ -81,6 +81,7 @@ corenet_tcp_bind_all_nodes($1_t) corenet_udp_bind_all_nodes($1_t) @@ -6439,9 +6490,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. fs_rw_rpc_named_pipes($1_t) fs_search_auto_mountpoints($1_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.3/policy/modules/services/rpc.te ---- nsaserefpolicy/policy/modules/services/rpc.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/rpc.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.4/policy/modules/services/rpc.te +--- nsaserefpolicy/policy/modules/services/rpc.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/rpc.te 2007-07-25 13:27:51.000000000 -0400 @@ -59,6 +59,8 @@ manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t) files_pid_filetrans(rpcd_t,rpcd_var_run_t,file) @@ -6506,14 +6557,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. tunable_policy(`allow_gssd_read_tmp',` userdom_list_unpriv_users_tmp(gssd_t) userdom_read_unpriv_users_tmp_files(gssd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.3/policy/modules/services/rshd.te ---- nsaserefpolicy/policy/modules/services/rshd.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/rshd.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.4/policy/modules/services/rshd.te +--- nsaserefpolicy/policy/modules/services/rshd.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/rshd.te 2007-07-25 16:26:56.000000000 -0400 @@ -45,6 +45,7 @@ selinux_compute_user_contexts(rshd_t) auth_domtrans_chk_passwd(rshd_t) -+auth_domtrans_upd_passwd(rshd_t) ++auth_domtrans_upd_passwd_chk(rshd_t) corecmd_read_bin_symlinks(rshd_t) @@ -6524,9 +6575,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd - unconfined_domain(rshd_t) unconfined_shell_domtrans(rshd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.3/policy/modules/services/rsync.te ---- nsaserefpolicy/policy/modules/services/rsync.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/rsync.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.4/policy/modules/services/rsync.te +--- nsaserefpolicy/policy/modules/services/rsync.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/rsync.te 2007-07-25 13:27:51.000000000 -0400 @@ -17,6 +17,7 @@ type rsync_t; type rsync_exec_t; @@ -6535,17 +6586,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn role system_r types rsync_t; type rsync_data_t; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-3.0.3/policy/modules/services/rwho.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-3.0.4/policy/modules/services/rwho.fc --- nsaserefpolicy/policy/modules/services/rwho.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/rwho.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/rwho.fc 2007-07-25 13:27:51.000000000 -0400 @@ -1,3 +1,4 @@ /usr/sbin/rwhod -- gen_context(system_u:object_r:rwho_exec_t,s0) /var/spool/rwho(/.*)? gen_context(system_u:object_r:rwho_spool_t,s0) +/var/log/rwhod(/.*)? gen_context(system_u:object_r:rwho_log_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-3.0.3/policy/modules/services/rwho.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-3.0.4/policy/modules/services/rwho.if --- nsaserefpolicy/policy/modules/services/rwho.if 2007-06-15 14:54:33.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/rwho.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/rwho.if 2007-07-25 13:27:51.000000000 -0400 @@ -72,6 +72,47 @@ type rwho_spool_t; ') @@ -6595,9 +6646,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho + logging_search_logs($1) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-3.0.3/policy/modules/services/rwho.te ---- nsaserefpolicy/policy/modules/services/rwho.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/rwho.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-3.0.4/policy/modules/services/rwho.te +--- nsaserefpolicy/policy/modules/services/rwho.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/rwho.te 2007-07-25 13:27:51.000000000 -0400 @@ -10,10 +10,12 @@ type rwho_exec_t; init_daemon_domain(rwho_t, rwho_exec_t) @@ -6623,9 +6674,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho kernel_read_system_state(rwho_t) corenet_all_recvfrom_unlabeled(rwho_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.3/policy/modules/services/samba.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.4/policy/modules/services/samba.fc --- nsaserefpolicy/policy/modules/services/samba.fc 2007-06-19 16:23:34.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/samba.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/samba.fc 2007-07-25 13:27:51.000000000 -0400 @@ -30,6 +30,8 @@ /var/lib/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0) /var/lib/samba/winbindd_privileged(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0) @@ -6635,9 +6686,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb /var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0) /var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.3/policy/modules/services/samba.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.4/policy/modules/services/samba.if --- nsaserefpolicy/policy/modules/services/samba.if 2007-06-19 16:23:35.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/samba.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/samba.if 2007-07-25 13:27:51.000000000 -0400 @@ -349,6 +349,7 @@ files_search_var($1) files_search_var_lib($1) @@ -6699,9 +6750,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb + read_files_pattern($1, samba_share_t, samba_share_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.3/policy/modules/services/samba.te ---- nsaserefpolicy/policy/modules/services/samba.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/samba.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.4/policy/modules/services/samba.te +--- nsaserefpolicy/policy/modules/services/samba.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/samba.te 2007-07-25 16:27:22.000000000 -0400 @@ -190,6 +190,8 @@ miscfiles_read_localization(samba_net_t) @@ -6830,9 +6881,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb seutil_sigchld_newrole(winbind_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.3/policy/modules/services/sasl.te ---- nsaserefpolicy/policy/modules/services/sasl.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/sasl.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.4/policy/modules/services/sasl.te +--- nsaserefpolicy/policy/modules/services/sasl.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/sasl.te 2007-07-25 13:27:51.000000000 -0400 @@ -64,6 +64,7 @@ selinux_compute_access_vector(saslauthd_t) @@ -6841,9 +6892,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl auth_use_nsswitch(saslauthd_t) domain_use_interactive_fds(saslauthd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.3/policy/modules/services/sendmail.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.4/policy/modules/services/sendmail.if --- nsaserefpolicy/policy/modules/services/sendmail.if 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/sendmail.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/sendmail.if 2007-07-25 13:27:51.000000000 -0400 @@ -131,3 +131,21 @@ logging_log_filetrans($1,sendmail_log_t,file) @@ -6866,9 +6917,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send + allow $1 sendmail_t:process signal; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.0.3/policy/modules/services/setroubleshoot.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.0.4/policy/modules/services/setroubleshoot.if --- nsaserefpolicy/policy/modules/services/setroubleshoot.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/setroubleshoot.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/setroubleshoot.if 2007-07-25 13:27:51.000000000 -0400 @@ -19,3 +19,22 @@ allow $1 setroubleshoot_var_run_t:sock_file write; allow $1 setroubleshootd_t:unix_stream_socket connectto; @@ -6892,9 +6943,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr + dontaudit $1 setroubleshoot_var_run_t:sock_file write; + dontaudit $1 setroubleshootd_t:unix_stream_socket connectto; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.3/policy/modules/services/setroubleshoot.te ---- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/setroubleshoot.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.4/policy/modules/services/setroubleshoot.te +--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/setroubleshoot.te 2007-07-25 13:27:51.000000000 -0400 @@ -76,6 +76,9 @@ files_getattr_all_dirs(setroubleshootd_t) files_getattr_all_files(setroubleshootd_t) @@ -6905,9 +6956,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr selinux_get_enforce_mode(setroubleshootd_t) selinux_validate_context(setroubleshootd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.0.3/policy/modules/services/smartmon.te ---- nsaserefpolicy/policy/modules/services/smartmon.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/smartmon.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.0.4/policy/modules/services/smartmon.te +--- nsaserefpolicy/policy/modules/services/smartmon.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/smartmon.te 2007-07-25 13:27:51.000000000 -0400 @@ -61,6 +61,7 @@ fs_search_auto_mountpoints(fsdaemon_t) @@ -6916,9 +6967,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar storage_raw_read_fixed_disk(fsdaemon_t) storage_raw_write_fixed_disk(fsdaemon_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.0.3/policy/modules/services/snmp.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.0.4/policy/modules/services/snmp.fc --- nsaserefpolicy/policy/modules/services/snmp.fc 2007-06-19 16:23:35.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/snmp.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/snmp.fc 2007-07-25 13:27:51.000000000 -0400 @@ -1,3 +1,10 @@ + +# @@ -6930,9 +6981,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp # # /usr # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.0.3/policy/modules/services/spamassassin.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.0.4/policy/modules/services/spamassassin.fc --- nsaserefpolicy/policy/modules/services/spamassassin.fc 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/spamassassin.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/spamassassin.fc 2007-07-25 13:27:51.000000000 -0400 @@ -10,3 +10,9 @@ /var/lib/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_lib_t,s0) @@ -6943,27 +6994,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam +/var/run/spamass-milter(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.0.3/policy/modules/services/spamassassin.te ---- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/spamassassin.te 2007-07-17 15:46:25.000000000 -0400 -@@ -22,7 +22,7 @@ - - # spamassassin client executable - type spamc_exec_t; --corecmd_executable_file(spamc_exec_t) -+application_executable_file(spamc_exec_t) - - type spamd_t; - type spamd_exec_t; -@@ -42,7 +42,7 @@ - files_pid_file(spamd_var_run_t) - - type spamassassin_exec_t; --corecmd_executable_file(spamassassin_exec_t) -+application_executable_file(spamassassin_exec_t) - - ######################################## - # +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.0.4/policy/modules/services/spamassassin.te +--- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/spamassassin.te 2007-07-25 13:27:51.000000000 -0400 @@ -83,8 +83,9 @@ allow spamd_t spamd_var_lib_t:dir list_dir_perms; read_files_pattern(spamd_t,spamd_var_lib_t,spamd_var_lib_t) @@ -6975,18 +7008,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam kernel_read_all_sysctls(spamd_t) kernel_read_system_state(spamd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.3/policy/modules/services/squid.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.4/policy/modules/services/squid.fc --- nsaserefpolicy/policy/modules/services/squid.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/squid.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/squid.fc 2007-07-25 13:27:51.000000000 -0400 @@ -12,3 +12,5 @@ /var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0) /var/spool/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0) +/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) +/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.3/policy/modules/services/squid.te ---- nsaserefpolicy/policy/modules/services/squid.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/squid.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.4/policy/modules/services/squid.te +--- nsaserefpolicy/policy/modules/services/squid.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/squid.te 2007-07-25 13:27:51.000000000 -0400 @@ -109,6 +109,8 @@ fs_getattr_all_fs(squid_t) @@ -7013,10 +7046,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi + corenet_all_recvfrom_unlabeled(httpd_squid_script_t) + corenet_all_recvfrom_netlabel(httpd_squid_script_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.3/policy/modules/services/ssh.if ---- nsaserefpolicy/policy/modules/services/ssh.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/ssh.if 2007-07-17 15:46:25.000000000 -0400 -@@ -203,6 +203,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.4/policy/modules/services/ssh.if +--- nsaserefpolicy/policy/modules/services/ssh.if 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/ssh.if 2007-07-25 13:27:51.000000000 -0400 +@@ -202,6 +202,7 @@ # template(`ssh_per_role_template',` gen_require(` @@ -7024,7 +7057,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. type ssh_agent_exec_t, ssh_keysign_exec_t; ') -@@ -711,3 +712,42 @@ +@@ -708,3 +709,42 @@ dontaudit $1 sshd_key_t:file { getattr read }; ') @@ -7067,10 +7100,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. + dontaudit $2 $1_ssh_agent_t:fd use; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.3/policy/modules/services/ssh.te ---- nsaserefpolicy/policy/modules/services/ssh.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/ssh.te 2007-07-17 15:46:25.000000000 -0400 -@@ -24,11 +24,11 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.4/policy/modules/services/ssh.te +--- nsaserefpolicy/policy/modules/services/ssh.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/ssh.te 2007-07-25 13:27:51.000000000 -0400 +@@ -24,7 +24,7 @@ # Type for the ssh-agent executable. type ssh_agent_exec_t; @@ -7079,11 +7112,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. # ssh client executable. type ssh_exec_t; --corecmd_executable_file(ssh_exec_t) -+application_executable_file(ssh_exec_t) - - type ssh_keygen_t; - type ssh_keygen_exec_t; @@ -100,6 +100,11 @@ userdom_use_unpriv_users_ptys(sshd_t) ') @@ -7110,9 +7138,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. ') ifdef(`TODO',` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.3/policy/modules/services/uwimap.te ---- nsaserefpolicy/policy/modules/services/uwimap.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/uwimap.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.4/policy/modules/services/uwimap.te +--- nsaserefpolicy/policy/modules/services/uwimap.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/uwimap.te 2007-07-25 13:27:51.000000000 -0400 @@ -64,6 +64,7 @@ fs_search_auto_mountpoints(imapd_t) @@ -7121,20 +7149,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwim libs_use_ld_so(imapd_t) libs_use_shared_libs(imapd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.3/policy/modules/services/w3c.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.4/policy/modules/services/w3c.fc --- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/services/w3c.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/w3c.fc 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,2 @@ +/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0) +/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.3/policy/modules/services/w3c.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.4/policy/modules/services/w3c.if --- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/services/w3c.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/w3c.if 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1 @@ +## W3C -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.3/policy/modules/services/w3c.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.4/policy/modules/services/w3c.te --- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/services/w3c.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/w3c.te 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,14 @@ +policy_module(w3c,1.2.1) + @@ -7150,9 +7178,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c. +corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t) + +miscfiles_read_certs(httpd_w3c_validator_script_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.3/policy/modules/services/xserver.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.4/policy/modules/services/xserver.fc --- nsaserefpolicy/policy/modules/services/xserver.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/xserver.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/xserver.fc 2007-07-25 13:27:51.000000000 -0400 @@ -92,6 +92,7 @@ /var/log/XFree86.* -- gen_context(system_u:object_r:xserver_log_t,s0) /var/log/Xorg.* -- gen_context(system_u:object_r:xserver_log_t,s0) @@ -7161,9 +7189,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser /var/run/[gx]dm\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0) /var/run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.3/policy/modules/services/xserver.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.4/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/xserver.if 2007-07-24 13:48:58.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/xserver.if 2007-07-25 13:27:51.000000000 -0400 @@ -353,12 +353,6 @@ # allow ps to show xauth ps_process_pattern($2,$1_xauth_t) @@ -7438,9 +7466,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser + +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.3/policy/modules/services/xserver.te ---- nsaserefpolicy/policy/modules/services/xserver.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/services/xserver.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.4/policy/modules/services/xserver.te +--- nsaserefpolicy/policy/modules/services/xserver.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/services/xserver.te 2007-07-25 13:27:51.000000000 -0400 @@ -16,6 +16,13 @@ ## @@ -7592,80 +7620,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser -# -allow pam_t xdm_t:fifo_file { getattr ioctl write }; -') dnl end TODO -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-3.0.3/policy/modules/system/application.fc ---- nsaserefpolicy/policy/modules/system/application.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/system/application.fc 2007-07-17 15:46:25.000000000 -0400 -@@ -0,0 +1 @@ -+# No application file contexts. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.3/policy/modules/system/application.if ---- nsaserefpolicy/policy/modules/system/application.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/system/application.if 2007-07-17 15:46:25.000000000 -0400 -@@ -0,0 +1,104 @@ -+## Policy for application domains -+ -+######################################## -+## -+## Make the specified type usable as an application domain. -+## -+## -+## -+## Type to be used as a domain type. -+## -+## -+# -+interface(`application_type',` -+ gen_require(` -+ attribute application_domain_type; -+ ') -+ -+ typeattribute $1 application_domain_type; -+ -+ # start with basic domain -+ domain_type($1) -+') -+ -+######################################## -+## -+## Make the specified type usable for files -+## that are exectuables, such as binary programs. -+## This does not include shared libraries. -+## -+## -+## -+## Type to be used for files. -+## -+## -+# -+interface(`application_executable_file',` -+ gen_require(` -+ attribute application_exec_type; -+ ') -+ -+ typeattribute $1 application_exec_type; -+ -+ corecmd_executable_file($1) -+') -+ -+######################################## -+## -+## Execute application executables in the caller domain. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`application_exec',` -+ gen_require(` -+ attribute application_exec_type; -+ ') -+ -+ can_exec($1, application_exec_type) -+') -+ -+######################################## -+## +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.4/policy/modules/system/application.if +--- nsaserefpolicy/policy/modules/system/application.if 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/application.if 2007-07-25 13:27:51.000000000 -0400 +@@ -63,6 +63,26 @@ + + ######################################## + ## +## Execute all executable files. +## +## @@ -7686,46 +7647,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic + +######################################## +## -+## Create a domain which can be started by users -+## -+## -+## -+## Type to be used as a domain. -+## -+## -+## -+## -+## Type of the program to be used as an entry point to this domain. -+## -+## -+# -+interface(`application_domain',` -+ -+ application_type($1) -+ application_executable_file($2) -+ domain_entry_file($1,$2) -+') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.0.3/policy/modules/system/application.te ---- nsaserefpolicy/policy/modules/system/application.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/system/application.te 2007-07-17 15:46:25.000000000 -0400 -@@ -0,0 +1,14 @@ -+ -+policy_module(application,1.0.0) -+ -+# Attribute of user applications -+attribute application_domain_type; -+ -+# Executables to be run by user -+attribute application_exec_type; -+ -+optional_policy(` -+ ssh_sigchld(application_domain_type) -+ ssh_rw_stream_sockets(application_domain_type) -+') -+ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.3/policy/modules/system/authlogin.fc + ## Create a domain which can be started by users + ## + ## +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.4/policy/modules/system/authlogin.fc --- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/authlogin.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/authlogin.fc 2007-07-25 13:27:51.000000000 -0400 @@ -14,6 +14,7 @@ /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0) /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) @@ -7734,12 +7661,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ifdef(`distro_suse', ` /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.3/policy/modules/system/authlogin.if ---- nsaserefpolicy/policy/modules/system/authlogin.if 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/authlogin.if 2007-07-20 14:51:53.000000000 -0400 -@@ -27,7 +27,8 @@ - domain_type($1_chkpwd_t) - domain_entry_file($1_chkpwd_t,chkpwd_exec_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.4/policy/modules/system/authlogin.if +--- nsaserefpolicy/policy/modules/system/authlogin.if 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/authlogin.if 2007-07-26 10:17:19.000000000 -0400 +@@ -26,7 +26,8 @@ + type $1_chkpwd_t, can_read_shadow_passwords; + application_domain($1_chkpwd_t,chkpwd_exec_t) - allow $1_chkpwd_t self:capability { audit_control setuid }; + allow $1_chkpwd_t self:capability { dac_override setuid }; @@ -7747,7 +7674,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo allow $1_chkpwd_t self:process getattr; files_list_etc($1_chkpwd_t) -@@ -108,7 +109,7 @@ +@@ -107,7 +108,7 @@ role $3 types system_chkpwd_t; # cjp: is this really needed? @@ -7756,7 +7683,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo dontaudit $2 shadow_t:file { getattr read }; -@@ -170,6 +171,9 @@ +@@ -169,6 +170,9 @@ ## # interface(`auth_login_pgm_domain',` @@ -7766,7 +7693,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo domain_type($1) domain_subj_id_change_exemption($1) -@@ -177,6 +181,12 @@ +@@ -176,6 +180,12 @@ domain_obj_id_change_exemption($1) role system_r types $1; @@ -7779,7 +7706,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo # for SSP/ProPolice dev_read_urand($1) -@@ -197,22 +207,27 @@ +@@ -196,22 +206,27 @@ mls_fd_share_all_levels($1) auth_domtrans_chk_passwd($1) @@ -7808,7 +7735,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') ') -@@ -310,9 +325,6 @@ +@@ -309,9 +324,6 @@ type system_chkpwd_t, chkpwd_exec_t, shadow_t; ') @@ -7818,7 +7745,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo corecmd_search_bin($1) domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t) -@@ -348,6 +360,37 @@ +@@ -347,6 +359,37 @@ ######################################## ## @@ -7856,7 +7783,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ## Get the attributes of the shadow passwords file. ## ## -@@ -696,6 +739,24 @@ +@@ -695,6 +738,24 @@ ######################################## ## @@ -7881,7 +7808,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ## Execute pam programs in the PAM domain. ## ## -@@ -1319,14 +1380,9 @@ +@@ -1318,14 +1379,9 @@ ## # interface(`auth_use_nsswitch',` @@ -7896,7 +7823,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo files_list_var_lib($1) miscfiles_read_certs($1) -@@ -1382,3 +1438,114 @@ +@@ -1381,3 +1437,166 @@ typeattribute $1 can_write_shadow_passwords; typeattribute $1 can_relabelto_shadow_passwords; ') @@ -7982,6 +7909,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + +######################################## +## ++## Execute a domain transition to run unix_update in Read Only Mode. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`auth_domtrans_upd_passwd_chk',` ++ gen_require(` ++ type system_chkpwd_t, updpwd_exec_t; ++ ') ++ ++ domain_auto_trans($1,updpwd_exec_t,system_chkpwd_t) ++ allow system_chkpwd_t $1:fd use; ++ allow system_chkpwd_t $1:fifo_file rw_file_perms; ++ allow system_chkpwd_t $1:process sigchld; ++ auth_dontaudit_read_shadow($1) ++ ++') ++ ++######################################## ++## +## Execute updpwd programs in the updpwd domain. +## +## @@ -8008,12 +7958,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + auth_domtrans_upd_passwd($1) + role $2 types updpwd_t; + allow updpwd_t $3:chr_file rw_file_perms; -+ auth_dontaudit_read_shadow($1) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.3/policy/modules/system/authlogin.te ---- nsaserefpolicy/policy/modules/system/authlogin.te 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/authlogin.te 2007-07-17 15:46:25.000000000 -0400 ++######################################## ++## ++## Execute updpwd programs in the chkpwd domain. ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++## ++## The role to allow the updpwd domain. ++## ++## ++## ++## ++## The type of the terminal allow the updpwd domain to use. ++## ++## ++# ++interface(`auth_run_upd_passwd_chk',` ++ gen_require(` ++ type system_chkpwd_t; ++ ') ++ ++ auth_domtrans_upd_passwd_chk($1) ++ role $2 types system_chkpwd_t; ++ allow system_chkpwd_t $3:chr_file rw_file_perms; ++') ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.4/policy/modules/system/authlogin.te +--- nsaserefpolicy/policy/modules/system/authlogin.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/authlogin.te 2007-07-25 13:27:51.000000000 -0400 @@ -9,6 +9,13 @@ attribute can_read_shadow_passwords; attribute can_write_shadow_passwords; @@ -8027,8 +8006,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +role system_r types updpwd_t; type chkpwd_exec_t; - corecmd_executable_file(chkpwd_exec_t) -@@ -161,6 +168,8 @@ + application_executable_file(chkpwd_exec_t) +@@ -159,6 +166,8 @@ dev_setattr_mouse_dev(pam_console_t) dev_getattr_power_mgmt_dev(pam_console_t) dev_setattr_power_mgmt_dev(pam_console_t) @@ -8037,7 +8016,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo dev_getattr_scanner_dev(pam_console_t) dev_setattr_scanner_dev(pam_console_t) dev_getattr_sound_dev(pam_console_t) -@@ -238,7 +247,7 @@ +@@ -236,7 +245,7 @@ optional_policy(` xserver_read_xdm_pid(pam_console_t) @@ -8046,7 +8025,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') ######################################## -@@ -304,3 +313,30 @@ +@@ -302,3 +311,30 @@ xserver_use_xdm_fds(utempter_t) xserver_rw_xdm_pipes(utempter_t) ') @@ -8077,15 +8056,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +optional_policy(` + nscd_socket_use(updpwd_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.fc serefpolicy-3.0.3/policy/modules/system/brctl.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.fc serefpolicy-3.0.4/policy/modules/system/brctl.fc --- nsaserefpolicy/policy/modules/system/brctl.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/system/brctl.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/brctl.fc 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,2 @@ + +/usr/sbin/brctl -- gen_context(system_u:object_r:brctl_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.if serefpolicy-3.0.3/policy/modules/system/brctl.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.if serefpolicy-3.0.4/policy/modules/system/brctl.if --- nsaserefpolicy/policy/modules/system/brctl.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/system/brctl.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/brctl.if 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,25 @@ + +## Utilities for configuring the linux ethernet bridge @@ -8112,9 +8091,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl. + allow brctl_t $1:fifo_file rw_file_perms; + allow brctl_t $1:process sigchld; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.te serefpolicy-3.0.3/policy/modules/system/brctl.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.te serefpolicy-3.0.4/policy/modules/system/brctl.te --- nsaserefpolicy/policy/modules/system/brctl.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/system/brctl.te 2007-07-19 09:01:33.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/brctl.te 2007-07-25 16:13:13.000000000 -0400 @@ -0,0 +1,50 @@ +policy_module(brctl,1.0.0) + @@ -8138,7 +8117,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl. +allow brctl_t self:tcp_socket create_socket_perms; +allow brctl_t self:unix_dgram_socket create_socket_perms; + -+dev_search_sysfs(brctl_t) ++dev_list_sysfs(brctl_t) + +# Init script handling +domain_use_interactive_fds(brctl_t) @@ -8166,9 +8145,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl. +optional_policy(` + xen_append_log(brctl_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.3/policy/modules/system/fstools.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.4/policy/modules/system/fstools.fc --- nsaserefpolicy/policy/modules/system/fstools.fc 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/fstools.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/fstools.fc 2007-07-25 13:27:51.000000000 -0400 @@ -20,7 +20,6 @@ /sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0) @@ -8177,9 +8156,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.0.3/policy/modules/system/fstools.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.0.4/policy/modules/system/fstools.if --- nsaserefpolicy/policy/modules/system/fstools.if 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/fstools.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/fstools.if 2007-07-25 13:27:51.000000000 -0400 @@ -124,3 +124,22 @@ allow $1 swapfile_t:file getattr; @@ -8203,9 +8182,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool + allow $1 fsdaemon_t:fifo_file read_fifo_file_perms; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.3/policy/modules/system/fstools.te ---- nsaserefpolicy/policy/modules/system/fstools.te 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/fstools.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.4/policy/modules/system/fstools.te +--- nsaserefpolicy/policy/modules/system/fstools.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/fstools.te 2007-07-25 13:27:51.000000000 -0400 @@ -9,6 +9,7 @@ type fsadm_t; type fsadm_exec_t; @@ -8221,11 +8200,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool + +optional_policy(` + xen_append_log(fsadm_t) -+ xen_rw_image_files(udev_t) ++ xen_rw_image_files(fsadm_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.3/policy/modules/system/fusermount.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.4/policy/modules/system/fusermount.fc --- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/system/fusermount.fc 2007-07-23 08:11:14.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/fusermount.fc 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,7 @@ +# fusermount executable will have: +# label: system_u:object_r:fusermount_exec_t @@ -8234,9 +8213,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + +/usr/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) +/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.3/policy/modules/system/fusermount.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.4/policy/modules/system/fusermount.if --- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/system/fusermount.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/fusermount.if 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,41 @@ +## policy for fusermount + @@ -8280,9 +8259,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + allow $1 fusermount_t:fd use; +') \ No newline at end of file -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.3/policy/modules/system/fusermount.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.4/policy/modules/system/fusermount.te --- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/system/fusermount.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/fusermount.te 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,46 @@ +policy_module(fusermount,1.0.0) + @@ -8330,9 +8309,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + mount_ntfs_rw_stream_sockets(fusermount_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.3/policy/modules/system/getty.te ---- nsaserefpolicy/policy/modules/system/getty.te 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/getty.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.4/policy/modules/system/getty.te +--- nsaserefpolicy/policy/modules/system/getty.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/getty.te 2007-07-25 13:27:51.000000000 -0400 @@ -33,7 +33,8 @@ # @@ -8343,9 +8322,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty. dontaudit getty_t self:capability sys_tty_config; allow getty_t self:process { getpgid setpgid getsession signal_perms }; allow getty_t self:fifo_file rw_fifo_file_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.3/policy/modules/system/hostname.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.4/policy/modules/system/hostname.te --- nsaserefpolicy/policy/modules/system/hostname.te 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/hostname.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/hostname.te 2007-07-25 13:27:51.000000000 -0400 @@ -8,8 +8,12 @@ type hostname_t; @@ -8372,25 +8351,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna +optional_policy(` + unconfined_dontaudit_rw_pipes(hostname_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.3/policy/modules/system/init.if ---- nsaserefpolicy/policy/modules/system/init.if 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/init.if 2007-07-17 15:46:25.000000000 -0400 -@@ -194,11 +194,14 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.4/policy/modules/system/init.if +--- nsaserefpolicy/policy/modules/system/init.if 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/init.if 2007-07-25 13:27:51.000000000 -0400 +@@ -194,9 +194,13 @@ gen_require(` type initrc_t; role system_r; + attribute daemon; ') - domain_type($1) - domain_entry_file($1,$2) - -+ typeattribute $1 daemon; +- application_domain($1,$2) ++ domain_type($1) ++ domain_entry_file($1,$2) + ++ typeattribute $1 daemon; + role system_r types $1; - domtrans_pattern(initrc_t,$2,$1) -@@ -1251,7 +1254,7 @@ +@@ -1250,7 +1254,7 @@ type initrc_var_run_t; ') @@ -8399,7 +8378,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -1272,3 +1275,42 @@ +@@ -1271,3 +1275,42 @@ files_search_pids($1) allow $1 initrc_var_run_t:file manage_file_perms; ') @@ -8442,9 +8421,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i + + allow $1 init_t:process ptrace; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.3/policy/modules/system/init.te ---- nsaserefpolicy/policy/modules/system/init.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/init.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.4/policy/modules/system/init.te +--- nsaserefpolicy/policy/modules/system/init.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/init.te 2007-07-25 13:27:51.000000000 -0400 @@ -10,6 +10,20 @@ # Declarations # @@ -8534,7 +8513,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t amavis_search_lib(initrc_t) amavis_setattr_pid_files(initrc_t) ') -@@ -631,12 +677,6 @@ +@@ -636,12 +682,6 @@ mta_read_config(initrc_t) mta_dontaudit_read_spool_symlinks(initrc_t) ') @@ -8547,7 +8526,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t optional_policy(` ifdef(`distro_redhat',` -@@ -702,6 +742,9 @@ +@@ -707,6 +747,9 @@ # why is this needed: rpm_manage_db(initrc_t) @@ -8557,9 +8536,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.0.3/policy/modules/system/ipsec.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.0.4/policy/modules/system/ipsec.if --- nsaserefpolicy/policy/modules/system/ipsec.if 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/ipsec.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/ipsec.if 2007-07-25 13:27:51.000000000 -0400 @@ -114,6 +114,26 @@ ######################################## @@ -8587,9 +8566,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. ## Execute racoon in the racoon domain. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.3/policy/modules/system/ipsec.te ---- nsaserefpolicy/policy/modules/system/ipsec.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/ipsec.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.4/policy/modules/system/ipsec.te +--- nsaserefpolicy/policy/modules/system/ipsec.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/ipsec.te 2007-07-25 13:27:51.000000000 -0400 @@ -283,6 +283,7 @@ allow racoon_t self:netlink_selinux_socket { bind create read }; allow racoon_t self:udp_socket create_socket_perms; @@ -8598,9 +8577,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. # manage pid file manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.3/policy/modules/system/iptables.te ---- nsaserefpolicy/policy/modules/system/iptables.te 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/iptables.te 2007-07-19 09:15:48.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.4/policy/modules/system/iptables.te +--- nsaserefpolicy/policy/modules/system/iptables.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/iptables.te 2007-07-25 13:27:51.000000000 -0400 @@ -44,6 +44,8 @@ corenet_relabelto_all_packets(iptables_t) @@ -8629,9 +8608,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl ppp_dontaudit_use_fds(iptables_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.3/policy/modules/system/libraries.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.4/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/libraries.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/libraries.fc 2007-07-25 13:27:51.000000000 -0400 @@ -158,8 +158,11 @@ /usr/(local/)?.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:shlib_t,s0) /usr/(local/)?lib(64)?/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -8661,9 +8640,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar +/usr/lib/mozilla/plugins/libvlcplugin.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib64/mozilla/plugins/libvlcplugin.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.3/policy/modules/system/libraries.te ---- nsaserefpolicy/policy/modules/system/libraries.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/libraries.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.4/policy/modules/system/libraries.te +--- nsaserefpolicy/policy/modules/system/libraries.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/libraries.te 2007-07-25 13:27:51.000000000 -0400 @@ -97,6 +97,11 @@ ') ') @@ -8688,21 +8667,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar + # run mkinitrd as unconfined user + unconfined_manage_tmp_files(ldconfig_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.3/policy/modules/system/locallogin.te ---- nsaserefpolicy/policy/modules/system/locallogin.te 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/locallogin.te 2007-07-17 15:46:25.000000000 -0400 -@@ -56,6 +56,10 @@ - allow local_login_t local_login_tmp_t:file manage_file_perms; - files_tmp_filetrans(local_login_t, local_login_tmp_t, { file dir }) - -+corecmd_exec_bin(local_login_t) -+ -+kernel_read_network_state(local_login_t) -+kernel_search_network_sysctl(local_login_t) - kernel_read_system_state(local_login_t) - kernel_read_kernel_sysctls(local_login_t) - kernel_search_key(local_login_t) -@@ -98,6 +102,11 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.4/policy/modules/system/locallogin.te +--- nsaserefpolicy/policy/modules/system/locallogin.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/locallogin.te 2007-07-25 13:27:51.000000000 -0400 +@@ -25,6 +25,7 @@ + domain_role_change_exemption(sulogin_t) + domain_interactive_fd(sulogin_t) + init_domain(sulogin_t,sulogin_exec_t) ++init_system_domain(sulogin_t,sulogin_exec_t) + role system_r types sulogin_t; + + ######################################## +@@ -97,6 +98,11 @@ term_setattr_all_user_ttys(local_login_t) term_setattr_unallocated_ttys(local_login_t) @@ -8714,7 +8690,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall auth_rw_login_records(local_login_t) auth_rw_faillog(local_login_t) auth_manage_pam_console_data(local_login_t) -@@ -161,6 +170,15 @@ +@@ -160,6 +166,15 @@ ') optional_policy(` @@ -8730,7 +8706,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall gpm_getattr_gpmctl(local_login_t) gpm_setattr_gpmctl(local_login_t) ') -@@ -179,13 +197,18 @@ +@@ -178,13 +193,18 @@ ') optional_policy(` @@ -8750,9 +8726,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall ################################# # # Sulogin local policy -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.3/policy/modules/system/logging.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.4/policy/modules/system/logging.fc --- nsaserefpolicy/policy/modules/system/logging.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/logging.fc 2007-07-19 11:20:26.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/logging.fc 2007-07-25 13:27:51.000000000 -0400 @@ -1,12 +1,15 @@ - /dev/log -s gen_context(system_u:object_r:devlog_t,s0) @@ -8776,9 +8752,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin /var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) + +/var/log/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.3/policy/modules/system/logging.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.4/policy/modules/system/logging.if --- nsaserefpolicy/policy/modules/system/logging.if 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/logging.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/logging.if 2007-07-25 13:27:51.000000000 -0400 @@ -33,8 +33,13 @@ ## # @@ -9004,9 +8980,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin + typeattribute $1 can_send_audit_msgs; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.3/policy/modules/system/logging.te ---- nsaserefpolicy/policy/modules/system/logging.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/logging.te 2007-07-23 15:43:28.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.4/policy/modules/system/logging.te +--- nsaserefpolicy/policy/modules/system/logging.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/logging.te 2007-07-25 13:27:51.000000000 -0400 @@ -7,10 +7,15 @@ # @@ -9142,9 +9118,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin files_read_etc_runtime_files(syslogd_t) # /initrd is not umounted before minilog starts files_dontaudit_search_isid_type_dirs(syslogd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.3/policy/modules/system/lvm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.4/policy/modules/system/lvm.fc --- nsaserefpolicy/policy/modules/system/lvm.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/lvm.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/lvm.fc 2007-07-25 13:27:51.000000000 -0400 @@ -15,6 +15,7 @@ # /etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0) @@ -9153,9 +9129,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc /etc/lvm/archive(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0) /etc/lvm/backup(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0) /etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.3/policy/modules/system/lvm.te ---- nsaserefpolicy/policy/modules/system/lvm.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/lvm.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.4/policy/modules/system/lvm.te +--- nsaserefpolicy/policy/modules/system/lvm.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/lvm.te 2007-07-25 13:27:51.000000000 -0400 @@ -16,6 +16,7 @@ type lvm_t; type lvm_exec_t; @@ -9208,9 +9184,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te + xen_dontaudit_rw_unix_stream_sockets(lvm_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.0.3/policy/modules/system/miscfiles.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.0.4/policy/modules/system/miscfiles.fc --- nsaserefpolicy/policy/modules/system/miscfiles.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/miscfiles.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/miscfiles.fc 2007-07-25 13:27:51.000000000 -0400 @@ -66,6 +66,7 @@ /var/lib/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0) @@ -9219,10 +9195,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi /var/cache/man(/.*)? gen_context(system_u:object_r:man_t,s0) /var/spool/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.3/policy/modules/system/modutils.te ---- nsaserefpolicy/policy/modules/system/modutils.te 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/modutils.te 2007-07-23 09:23:58.000000000 -0400 -@@ -43,7 +43,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.4/policy/modules/system/modutils.te +--- nsaserefpolicy/policy/modules/system/modutils.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/modutils.te 2007-07-25 14:27:32.000000000 -0400 +@@ -42,7 +42,7 @@ # insmod local policy # @@ -9231,7 +9207,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal }; allow insmod_t self:udp_socket create_socket_perms; -@@ -77,9 +77,7 @@ +@@ -63,6 +63,7 @@ + kernel_read_kernel_sysctls(insmod_t) + kernel_rw_kernel_sysctl(insmod_t) + kernel_read_hotplug_sysctls(insmod_t) ++kernel_setsched(insmod_t) + + files_read_kernel_modules(insmod_t) + # for locking: (cjp: ????) +@@ -76,9 +77,7 @@ dev_read_sound(insmod_t) dev_write_sound(insmod_t) dev_rw_apm_bios(insmod_t) @@ -9242,7 +9226,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti fs_getattr_xattr_fs(insmod_t) -@@ -102,6 +100,7 @@ +@@ -101,6 +100,7 @@ init_use_fds(insmod_t) init_use_script_fds(insmod_t) init_use_script_ptys(insmod_t) @@ -9250,7 +9234,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti libs_use_ld_so(insmod_t) libs_use_shared_libs(insmod_t) -@@ -113,11 +112,25 @@ +@@ -112,11 +112,25 @@ seutil_read_file_contexts(insmod_t) @@ -9276,7 +9260,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti hotplug_search_config(insmod_t) ') -@@ -150,6 +163,7 @@ +@@ -149,6 +163,7 @@ optional_policy(` rpm_rw_pipes(insmod_t) @@ -9284,7 +9268,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti ') optional_policy(` -@@ -180,6 +194,7 @@ +@@ -179,6 +194,7 @@ files_read_kernel_symbol_table(depmod_t) files_read_kernel_modules(depmod_t) @@ -9292,7 +9276,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti fs_getattr_xattr_fs(depmod_t) -@@ -206,9 +221,12 @@ +@@ -205,9 +221,12 @@ userdom_read_staff_home_content_files(depmod_t) userdom_read_sysadm_home_content_files(depmod_t) @@ -9305,18 +9289,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.3/policy/modules/system/mount.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.4/policy/modules/system/mount.fc --- nsaserefpolicy/policy/modules/system/mount.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/mount.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/mount.fc 2007-07-25 13:27:51.000000000 -0400 @@ -1,4 +1,3 @@ /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) - -/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) +/sbin/mount.ntfs-3g -- gen_context(system_u:object_r:mount_ntfs_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-3.0.3/policy/modules/system/mount.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-3.0.4/policy/modules/system/mount.if --- nsaserefpolicy/policy/modules/system/mount.if 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/mount.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/mount.if 2007-07-25 13:27:51.000000000 -0400 @@ -171,3 +171,40 @@ role $2 types unconfined_mount_t; allow unconfined_mount_t $3:chr_file rw_file_perms; @@ -9358,9 +9342,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + + allow $1 mount_ntfs_t:unix_stream_socket { read write }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.3/policy/modules/system/mount.te ---- nsaserefpolicy/policy/modules/system/mount.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/mount.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.4/policy/modules/system/mount.te +--- nsaserefpolicy/policy/modules/system/mount.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/mount.te 2007-07-25 13:27:51.000000000 -0400 @@ -8,6 +8,13 @@ ## @@ -9375,7 +9359,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ## Allow mount to mount any file ##

## -@@ -16,20 +23,23 @@ +@@ -16,19 +23,22 @@ type mount_t; type mount_exec_t; init_system_domain(mount_t,mount_exec_t) @@ -9396,13 +9380,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. -# this is optionally declared in monolithic -# policy--duplicate type declaration type unconfined_mount_t; - domain_type(unconfined_mount_t) - domain_entry_file(unconfined_mount_t,mount_exec_t) + application_domain(unconfined_mount_t,mount_exec_t) +role system_r types unconfined_mount_t; ######################################## # -@@ -37,7 +47,7 @@ +@@ -36,7 +46,7 @@ # # setuid/setgid needed to mount cifs @@ -9411,7 +9394,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. allow mount_t mount_loopback_t:file read_file_perms; allow mount_t self:netlink_route_socket r_netlink_socket_perms; -@@ -52,6 +62,7 @@ +@@ -51,6 +61,7 @@ kernel_read_system_state(mount_t) kernel_read_kernel_sysctls(mount_t) kernel_dontaudit_getattr_core_if(mount_t) @@ -9419,7 +9402,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. dev_getattr_all_blk_files(mount_t) dev_list_all_dev_nodes(mount_t) -@@ -102,6 +113,8 @@ +@@ -101,6 +112,8 @@ init_use_fds(mount_t) init_use_script_ptys(mount_t) init_dontaudit_getattr_initctl(mount_t) @@ -9428,7 +9411,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. libs_use_ld_so(mount_t) libs_use_shared_libs(mount_t) -@@ -128,10 +141,15 @@ +@@ -127,10 +140,15 @@ ') ') @@ -9445,7 +9428,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ') optional_policy(` -@@ -202,4 +220,53 @@ +@@ -201,4 +219,53 @@ optional_policy(` files_etc_filetrans_etc_runtime(unconfined_mount_t,file) unconfined_domain(unconfined_mount_t) @@ -9499,10 +9482,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + hal_rw_pipes(mount_ntfs_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-3.0.3/policy/modules/system/netlabel.te ---- nsaserefpolicy/policy/modules/system/netlabel.te 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/netlabel.te 2007-07-17 15:46:25.000000000 -0400 -@@ -20,6 +20,8 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-3.0.4/policy/modules/system/netlabel.te +--- nsaserefpolicy/policy/modules/system/netlabel.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/netlabel.te 2007-07-25 13:27:51.000000000 -0400 +@@ -19,6 +19,8 @@ allow netlabel_mgmt_t self:capability net_admin; allow netlabel_mgmt_t self:netlink_socket create_socket_perms; @@ -9511,9 +9494,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlab kernel_read_network_state(netlabel_mgmt_t) libs_use_ld_so(netlabel_mgmt_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.3/policy/modules/system/raid.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.4/policy/modules/system/raid.te --- nsaserefpolicy/policy/modules/system/raid.te 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/raid.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/raid.te 2007-07-25 13:27:51.000000000 -0400 @@ -19,7 +19,7 @@ # Local policy # @@ -9523,9 +9506,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t dontaudit mdadm_t self:capability sys_tty_config; allow mdadm_t self:process { sigchld sigkill sigstop signull signal }; allow mdadm_t self:fifo_file rw_fifo_file_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.3/policy/modules/system/selinuxutil.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.4/policy/modules/system/selinuxutil.fc --- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/selinuxutil.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/selinuxutil.fc 2007-07-25 13:27:51.000000000 -0400 @@ -38,8 +38,9 @@ /usr/sbin/restorecond -- gen_context(system_u:object_r:restorecond_exec_t,s0) /usr/sbin/run_init -- gen_context(system_u:object_r:run_init_exec_t,s0) @@ -9537,14 +9520,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu /usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0) # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.3/policy/modules/system/selinuxutil.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.4/policy/modules/system/selinuxutil.if --- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/selinuxutil.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/selinuxutil.if 2007-07-25 14:07:42.000000000 -0400 @@ -432,6 +432,7 @@ role $2 types run_init_t; allow run_init_t $3:chr_file rw_term_perms; allow $2 system_r; -+ auth_run_upd_passwd($1,$2,$3) ++ auth_run_upd_passwd_chk($1,$2,$3) ') ######################################## @@ -9746,24 +9729,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu +seutil_manage_default_contexts($1) + +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.3/policy/modules/system/selinuxutil.te ---- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/selinuxutil.te 2007-07-24 16:27:49.000000000 -0400 -@@ -24,11 +24,9 @@ - files_type(selinux_config_t) - - type checkpolicy_t, can_write_binary_policy; --domain_type(checkpolicy_t) --role system_r types checkpolicy_t; -- - type checkpolicy_exec_t; --domain_entry_file(checkpolicy_t,checkpolicy_exec_t) -+application_domain(checkpolicy_t, checkpolicy_exec_t) -+role system_r types checkpolicy_t; - - # - # default_context_t is the type applied to -@@ -81,25 +79,26 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.4/policy/modules/system/selinuxutil.te +--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/selinuxutil.te 2007-07-25 14:07:51.000000000 -0400 +@@ -76,7 +76,6 @@ type restorecond_exec_t; init_daemon_domain(restorecond_t,restorecond_exec_t) domain_obj_id_change_exemption(restorecond_t) @@ -9771,23 +9740,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu type restorecond_var_run_t; files_pid_file(restorecond_var_run_t) - - type run_init_t; - type run_init_exec_t; --domain_type(run_init_t) --domain_entry_file(run_init_t,run_init_exec_t) -+application_domain(run_init_t, run_init_exec_t) - domain_system_change_exemption(run_init_t) -+role system_r types run_init_t; - - type semanage_t; --domain_type(semanage_t) --domain_interactive_fd(semanage_t) -- - type semanage_exec_t; --domain_entry_file(semanage_t, semanage_exec_t) -+application_domain(semanage_t, semanage_exec_t) -+domain_interactive_fd(semanage_t) +@@ -94,6 +93,10 @@ + application_domain(semanage_t,semanage_exec_t) role system_r types semanage_t; +type setsebool_exec_t; @@ -9797,7 +9751,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu type semanage_store_t; files_type(semanage_store_t) -@@ -157,6 +156,11 @@ +@@ -151,6 +154,11 @@ userdom_use_all_users_fds(checkpolicy_t) @@ -9809,7 +9763,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ######################################## # # Load_policy local policy -@@ -179,6 +183,7 @@ +@@ -173,6 +181,7 @@ fs_getattr_xattr_fs(load_policy_t) mls_file_read_up(load_policy_t) @@ -9817,7 +9771,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu selinux_get_fs_mount(load_policy_t) selinux_load_policy(load_policy_t) -@@ -201,10 +206,15 @@ +@@ -195,10 +204,15 @@ # cjp: cover up stray file descriptors. dontaudit load_policy_t selinux_config_t:file write; optional_policy(` @@ -9834,7 +9788,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ######################################## # # Newrole local policy -@@ -222,7 +232,7 @@ +@@ -216,7 +230,7 @@ allow newrole_t self:msg { send receive }; allow newrole_t self:unix_dgram_socket sendto; allow newrole_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -9843,17 +9797,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu read_files_pattern(newrole_t,selinux_config_t,selinux_config_t) read_lnk_files_pattern(newrole_t,selinux_config_t,selinux_config_t) -@@ -260,7 +270,9 @@ +@@ -254,7 +268,9 @@ term_dontaudit_use_unallocated_ttys(newrole_t) auth_domtrans_chk_passwd(newrole_t) -+auth_domtrans_upd_passwd(newrole_t) ++auth_domtrans_upd_passwd_chk(newrole_t) auth_rw_faillog(newrole_t) +auth_search_key(newrole_t) corecmd_list_bin(newrole_t) corecmd_read_bin_symlinks(newrole_t) -@@ -280,6 +292,7 @@ +@@ -274,6 +290,7 @@ libs_use_ld_so(newrole_t) libs_use_shared_libs(newrole_t) @@ -9861,7 +9815,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu logging_send_syslog_msg(newrole_t) miscfiles_read_localization(newrole_t) -@@ -368,7 +381,7 @@ +@@ -362,7 +379,7 @@ allow run_init_t self:process setexec; allow run_init_t self:capability setuid; allow run_init_t self:fifo_file rw_file_perms; @@ -9870,15 +9824,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # often the administrator runs such programs from a directory that is owned # by a different user or has restrictive SE permissions, do not want to audit -@@ -382,6 +395,7 @@ +@@ -376,6 +393,7 @@ term_dontaudit_list_ptys(run_init_t) auth_domtrans_chk_passwd(run_init_t) -+auth_domtrans_upd_passwd(run_init_t) ++auth_domtrans_upd_passwd_chk(run_init_t) auth_dontaudit_read_shadow(run_init_t) corecmd_exec_bin(run_init_t) -@@ -438,7 +452,7 @@ +@@ -432,7 +450,7 @@ allow semanage_t self:capability { dac_override audit_write }; allow semanage_t self:unix_stream_socket create_stream_socket_perms; allow semanage_t self:unix_dgram_socket create_socket_perms; @@ -9887,7 +9841,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu allow semanage_t policy_config_t:file { read write }; -@@ -449,7 +463,10 @@ +@@ -443,7 +461,10 @@ kernel_read_system_state(semanage_t) kernel_read_kernel_sysctls(semanage_t) @@ -9898,7 +9852,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu dev_read_urand(semanage_t) -@@ -473,6 +490,8 @@ +@@ -467,6 +488,8 @@ # Running genhomedircon requires this for finding all users auth_use_nsswitch(semanage_t) @@ -9907,7 +9861,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu libs_use_ld_so(semanage_t) libs_use_shared_libs(semanage_t) -@@ -497,6 +516,17 @@ +@@ -491,6 +514,17 @@ # netfilter_contexts: seutil_manage_default_contexts(semanage_t) @@ -9925,7 +9879,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # cjp: need a more general way to handle this: ifdef(`enable_mls',` # read secadm tmp files -@@ -524,6 +554,8 @@ +@@ -518,6 +552,8 @@ allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:file r_file_perms; allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:lnk_file r_file_perms; @@ -9934,7 +9888,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu kernel_read_system_state(setfiles_t) kernel_relabelfrom_unlabeled_dirs(setfiles_t) kernel_relabelfrom_unlabeled_files(setfiles_t) -@@ -540,6 +572,7 @@ +@@ -534,6 +570,7 @@ fs_getattr_xattr_fs(setfiles_t) fs_list_all(setfiles_t) @@ -9942,7 +9896,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu fs_search_auto_mountpoints(setfiles_t) fs_relabelfrom_noxattr_fs(setfiles_t) -@@ -595,6 +628,10 @@ +@@ -589,6 +626,10 @@ ifdef(`hide_broken_symptoms',` optional_policy(` @@ -9953,9 +9907,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu udev_dontaudit_rw_dgram_sockets(setfiles_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.3/policy/modules/system/sysnetwork.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.4/policy/modules/system/sysnetwork.if --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/sysnetwork.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/sysnetwork.if 2007-07-25 13:27:51.000000000 -0400 @@ -522,6 +522,8 @@ files_search_etc($1) @@ -9965,9 +9919,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.3/policy/modules/system/sysnetwork.te ---- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/sysnetwork.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.4/policy/modules/system/sysnetwork.te +--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/sysnetwork.te 2007-07-25 13:27:51.000000000 -0400 @@ -159,6 +159,10 @@ dbus_connect_system_bus(dhcpc_t) dbus_send_system_bus(dhcpc_t) @@ -10004,9 +9958,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet term_dontaudit_use_all_user_ttys(ifconfig_t) term_dontaudit_use_all_user_ptys(ifconfig_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.3/policy/modules/system/udev.te ---- nsaserefpolicy/policy/modules/system/udev.te 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/udev.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.4/policy/modules/system/udev.te +--- nsaserefpolicy/policy/modules/system/udev.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/udev.te 2007-07-25 13:27:51.000000000 -0400 @@ -68,8 +68,9 @@ allow udev_t udev_tbl_t:file manage_file_perms; dev_filetrans(udev_t,udev_tbl_t,file) @@ -10106,9 +10060,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t ') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.3/policy/modules/system/unconfined.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.4/policy/modules/system/unconfined.if --- nsaserefpolicy/policy/modules/system/unconfined.if 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/unconfined.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/unconfined.if 2007-07-25 14:31:13.000000000 -0400 @@ -12,14 +12,13 @@ # interface(`unconfined_domain_noaudit',` @@ -10182,7 +10136,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + + files_search_tmp($1) + manage_files_pattern($1,unconfined_tmp_t,unconfined_tmp_t) -+ read_lnk_files_pattern($1,unconfined_tmp_t,unconfined_tmp_t) ++ manage_lnk_files_pattern($1,unconfined_tmp_t,unconfined_tmp_t) +') + +######################################## @@ -10292,9 +10246,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + + allow $1 unconfined_terminal:chr_file rw_term_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.3/policy/modules/system/unconfined.te ---- nsaserefpolicy/policy/modules/system/unconfined.te 2007-07-17 14:52:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/unconfined.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.4/policy/modules/system/unconfined.te +--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/unconfined.te 2007-07-25 13:27:51.000000000 -0400 @@ -5,28 +5,36 @@ # # Declarations @@ -10487,9 +10441,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') + +corecmd_exec_all_executables(unconfined_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.3/policy/modules/system/userdomain.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.4/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/userdomain.if 2007-07-24 15:42:37.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/userdomain.if 2007-07-26 10:11:38.000000000 -0400 @@ -62,6 +62,10 @@ allow $1_t $1_tty_device_t:chr_file { setattr rw_chr_file_perms }; @@ -10741,7 +10695,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo auth_search_pam_console_data($1_t) auth_run_pam($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) auth_run_utempter($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) -+ auth_run_upd_passwd($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) ++ auth_run_upd_passwd_chk($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) + auth_read_key($1_t) init_read_utmp($1_t) @@ -11510,9 +11464,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + ') + typeattribute $1 user_home_type; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.3/policy/modules/system/userdomain.te ---- nsaserefpolicy/policy/modules/system/userdomain.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/userdomain.te 2007-07-17 15:46:25.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.4/policy/modules/system/userdomain.te +--- nsaserefpolicy/policy/modules/system/userdomain.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/userdomain.te 2007-07-25 13:27:51.000000000 -0400 @@ -74,6 +74,9 @@ # users home directory contents attribute home_type; @@ -11610,9 +11564,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo +tunable_policy(`allow_console_login', ` + term_use_console(userdomain) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.3/policy/modules/system/xen.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.4/policy/modules/system/xen.if --- nsaserefpolicy/policy/modules/system/xen.if 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/xen.if 2007-07-19 08:59:44.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/xen.if 2007-07-25 13:27:51.000000000 -0400 @@ -191,3 +191,24 @@ domtrans_pattern($1,xm_exec_t,xm_t) @@ -11638,9 +11592,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if + allow $1 xend_var_lib_t:dir search_dir_perms; + rw_files_pattern($1,xen_image_t,xen_image_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.3/policy/modules/system/xen.te ---- nsaserefpolicy/policy/modules/system/xen.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.3/policy/modules/system/xen.te 2007-07-18 16:21:11.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.4/policy/modules/system/xen.te +--- nsaserefpolicy/policy/modules/system/xen.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/system/xen.te 2007-07-25 13:27:51.000000000 -0400 +@@ -70,7 +70,7 @@ + type xm_t; + type xm_exec_t; + domain_type(xm_t) +-init_system_domain(xm_t, xm_exec_t) ++init_daemon_domain(xm_t, xm_exec_t) + + ######################################## + # @@ -176,6 +176,7 @@ files_manage_etc_runtime_files(xend_t) files_etc_filetrans_etc_runtime(xend_t,file) @@ -11680,38 +11643,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te +fs_write_nfs_files(xend_t) +fs_read_nfs_files(xend_t) +fs_read_nfs_symlinks(xend_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.3/policy/modules/users/guest.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.4/policy/modules/users/guest.fc --- nsaserefpolicy/policy/modules/users/guest.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/users/guest.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/users/guest.fc 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1 @@ +# No guest file contexts. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.3/policy/modules/users/guest.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.4/policy/modules/users/guest.if --- nsaserefpolicy/policy/modules/users/guest.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/users/guest.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/users/guest.if 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1 @@ +## Policy for guest user -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.3/policy/modules/users/guest.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.4/policy/modules/users/guest.te --- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/users/guest.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/users/guest.te 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,5 @@ +policy_module(guest,1.0.0) +userdom_unpriv_login_user(guest) +userdom_unpriv_login_user(gadmin) +userdom_unpriv_xwindows_login_user(xguest) +mozilla_per_role_template(xguest, xguest_t, xguest_r) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.3/policy/modules/users/logadm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.4/policy/modules/users/logadm.fc --- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/users/logadm.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/users/logadm.fc 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1 @@ +# No logadm file contexts. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.3/policy/modules/users/logadm.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.4/policy/modules/users/logadm.if --- nsaserefpolicy/policy/modules/users/logadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/users/logadm.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/users/logadm.if 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1 @@ +## Policy for logadm user -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.3/policy/modules/users/logadm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.4/policy/modules/users/logadm.te --- nsaserefpolicy/policy/modules/users/logadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/users/logadm.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/users/logadm.te 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,33 @@ +policy_module(logadm,1.0.0) + @@ -11746,24 +11709,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm. + +files_dontaudit_search_all_dirs(logadm_t) +files_dontaudit_getattr_all_files(logadm_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.3/policy/modules/users/metadata.xml +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.4/policy/modules/users/metadata.xml --- nsaserefpolicy/policy/modules/users/metadata.xml 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/users/metadata.xml 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/users/metadata.xml 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1 @@ +Policy modules for users -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.3/policy/modules/users/webadm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.4/policy/modules/users/webadm.fc --- nsaserefpolicy/policy/modules/users/webadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/users/webadm.fc 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/users/webadm.fc 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1 @@ +# No webadm file contexts. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.3/policy/modules/users/webadm.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.4/policy/modules/users/webadm.if --- nsaserefpolicy/policy/modules/users/webadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/users/webadm.if 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/users/webadm.if 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1 @@ +## Policy for webadm user -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.3/policy/modules/users/webadm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.4/policy/modules/users/webadm.te --- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.3/policy/modules/users/webadm.te 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/modules/users/webadm.te 2007-07-25 13:27:51.000000000 -0400 @@ -0,0 +1,70 @@ +policy_module(webadm,1.0.0) + @@ -11835,9 +11798,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm. +allow webadm_t gadmin_t:dir getattr; + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.3/policy/support/obj_perm_sets.spt +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.4/policy/support/obj_perm_sets.spt --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.3/policy/support/obj_perm_sets.spt 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/support/obj_perm_sets.spt 2007-07-25 13:27:51.000000000 -0400 @@ -201,7 +201,7 @@ define(`search_dir_perms',`{ getattr search }') define(`list_dir_perms',`{ getattr search read lock ioctl }') @@ -11870,9 +11833,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets +define(`all_association', `{ sendto recvfrom setcontext polmatch } ') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.3/policy/users +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.4/policy/users --- nsaserefpolicy/policy/users 2007-07-17 14:52:27.000000000 -0400 -+++ serefpolicy-3.0.3/policy/users 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/policy/users 2007-07-25 13:27:51.000000000 -0400 @@ -16,7 +16,7 @@ # and a user process should never be assigned the system user # identity. @@ -11907,9 +11870,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0 - gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) -') +gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.3/Rules.modular +diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.4/Rules.modular --- nsaserefpolicy/Rules.modular 2007-05-25 09:09:10.000000000 -0400 -+++ serefpolicy-3.0.3/Rules.modular 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/Rules.modular 2007-07-25 13:27:51.000000000 -0400 @@ -167,7 +167,7 @@ # these have to run individually because order matters: $(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true @@ -11936,9 +11899,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3. # Clean the sources # clean: -diff --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.0.3/support/Makefile.devel +diff --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.0.4/support/Makefile.devel --- nsaserefpolicy/support/Makefile.devel 2007-05-29 13:53:56.000000000 -0400 -+++ serefpolicy-3.0.3/support/Makefile.devel 2007-07-17 15:46:25.000000000 -0400 ++++ serefpolicy-3.0.4/support/Makefile.devel 2007-07-25 13:27:51.000000000 -0400 @@ -24,7 +24,7 @@ XMLLINT := $(BINDIR)/xmllint diff --git a/selinux-policy.spec b/selinux-policy.spec index 39aa85c..87b2716 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -16,8 +16,8 @@ %define CHECKPOLICYVER 2.0.3-1 Summary: SELinux policy configuration Name: selinux-policy -Version: 3.0.3 -Release: 6%{?dist} +Version: 3.0.4 +Release: 1%{?dist} License: GPL Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -293,7 +293,7 @@ semodule -r moilscanner 2>/dev/null %relabel targeted exit 0 -%triggerpostun targeted -- selinux-policy-targeted <= 3.0.3-5 +%triggerpostun targeted -- selinux-policy-targeted < 3.0.4-1 setsebool -P use_nfs_home_dirs=1 restorecon -R /root /etc/selinux/targeted 2> /dev/null semanage login -m -s "system_u" __default__ 2> /dev/null @@ -359,6 +359,9 @@ exit 0 %endif %changelog +* Tue Jul 23 2007 Dan Walsh 3.0.4-1 +- Update with latest changes from upstream + * Tue Jul 23 2007 Dan Walsh 3.0.3-6 - Fix prelink to handle execmod diff --git a/sources b/sources index 95187b2..0e2abb7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -af54ae49007f995f1cb9e5d6f5baf8bf serefpolicy-3.0.3.tgz +a19850a065ff7c17da5eff9259b86d9c serefpolicy-3.0.4.tgz