From cd5169d4161231cd82ba526e5d9a7cd4dc39aa21 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Jan 06 2010 17:58:23 +0000 Subject: - Add labeling for /etc/NetworkManager directory - Add home_cert type and appropriate labeling - Allow virt_domain to read /dev/random --- diff --git a/policy-20090521.patch b/policy-20090521.patch index e9d8a49..3075ff7 100644 --- a/policy-20090521.patch +++ b/policy-20090521.patch @@ -691,6 +691,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol userdom_manage_user_home_content_dirs(useradd_t) userdom_manage_user_home_content_files(useradd_t) userdom_home_filetrans_user_home_dir(useradd_t) +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.6.12/policy/modules/admin/vpn.te +--- nsaserefpolicy/policy/modules/admin/vpn.te 2009-04-07 21:54:49.000000000 +0200 ++++ serefpolicy-3.6.12/policy/modules/admin/vpn.te 2010-01-06 16:12:18.000000000 +0100 +@@ -104,6 +104,7 @@ + sysnet_etc_filetrans_config(vpnc_t) + sysnet_manage_config(vpnc_t) + ++userdom_read_home_certs(vpnc_t) + userdom_use_all_users_fds(vpnc_t) + userdom_dontaudit_search_user_home_content(vpnc_t) + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.te serefpolicy-3.6.12/policy/modules/apps/awstats.te --- nsaserefpolicy/policy/modules/apps/awstats.te 2009-06-25 10:19:43.000000000 +0200 +++ serefpolicy-3.6.12/policy/modules/apps/awstats.te 2009-08-19 18:08:12.000000000 +0200 @@ -1115,8 +1126,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.te serefpolicy-3.6.12/policy/modules/apps/qemu.te --- nsaserefpolicy/policy/modules/apps/qemu.te 2009-06-25 10:19:43.000000000 +0200 -+++ serefpolicy-3.6.12/policy/modules/apps/qemu.te 2009-06-25 10:21:01.000000000 +0200 -@@ -88,11 +88,16 @@ ++++ serefpolicy-3.6.12/policy/modules/apps/qemu.te 2010-01-06 14:48:15.000000000 +0100 +@@ -50,6 +50,9 @@ + storage_raw_write_removable_device(qemu_t) + storage_raw_read_removable_device(qemu_t) + ++dev_read_rand(qemu_t) ++dev_read_urand(qemu_t) ++ + userdom_search_user_home_content(qemu_t) + userdom_read_user_tmpfs_files(qemu_t) + userdom_signull_unpriv_users(qemu_t) +@@ -88,11 +91,16 @@ ') optional_policy(` @@ -2391,10 +2412,59 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +/var/www/svn(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t,s0) +/var/www/svn/hooks(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) +/var/www/svn/conf(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.6.12/policy/modules/services/apache.if +--- nsaserefpolicy/policy/modules/services/apache.if 2009-06-25 10:19:44.000000000 +0200 ++++ serefpolicy-3.6.12/policy/modules/services/apache.if 2010-01-06 15:18:20.000000000 +0100 +@@ -16,6 +16,7 @@ + attribute httpd_exec_scripts; + attribute httpd_script_exec_type; + type httpd_t, httpd_suexec_t, httpd_log_t; ++ type httpd_sys_content_t; + ') + #This type is for webpages + type httpd_$1_content_t; +@@ -124,6 +125,8 @@ + allow httpd_t httpd_$1_content_t:dir list_dir_perms; + read_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_content_t) + read_lnk_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_content_t) ++ ++ allow httpd_$1_script_t httpd_sys_content_t:dir search_dir_perms; + ') + + tunable_policy(`httpd_enable_cgi',` diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.6.12/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2009-06-25 10:19:44.000000000 +0200 -+++ serefpolicy-3.6.12/policy/modules/services/apache.te 2009-09-16 13:39:43.000000000 +0200 -@@ -681,6 +681,7 @@ ++++ serefpolicy-3.6.12/policy/modules/services/apache.te 2010-01-06 14:38:36.000000000 +0100 +@@ -110,6 +110,13 @@ + + ## + ##

++## Allow Apache to execute tmp content. ++##

++## ++gen_tunable(httpd_tmp_exec, false) ++ ++## ++##

+ ## Unify HTTPD to communicate with the terminal. + ## Needed for entering the passphrase for certificates at + ## the terminal. +@@ -519,6 +526,14 @@ + manage_lnk_files_pattern(httpd_t, httpdcontent, httpdcontent) + ') + ++tunable_policy(`httpd_tmp_exec && httpd_builtin_scripting',` ++ can_exec(httpd_t, httpd_tmp_t) ++') ++ ++tunable_policy(`httpd_tmp_exec && httpd_enable_cgi',` ++ can_exec(httpd_sys_script_t, httpd_tmp_t) ++') ++ + tunable_policy(`httpd_enable_ftp_server',` + corenet_tcp_bind_ftp_port(httpd_t) + ') +@@ -681,6 +696,7 @@ unconfined_domain(httpd_unconfined_script_t) role system_r types httpd_unconfined_script_t; @@ -3581,18 +3651,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.6.12/policy/modules/services/networkmanager.fc --- nsaserefpolicy/policy/modules/services/networkmanager.fc 2009-06-25 10:19:44.000000000 +0200 -+++ serefpolicy-3.6.12/policy/modules/services/networkmanager.fc 2009-12-09 16:25:03.000000000 +0100 -@@ -12,6 +12,7 @@ ++++ serefpolicy-3.6.12/policy/modules/services/networkmanager.fc 2010-01-06 11:15:05.000000000 +0100 +@@ -12,7 +12,9 @@ /usr/sbin/nm-system-settings -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) /var/lib/wicd(/.*)? gen_context(system_u:object_r:NetworkManager_var_lib_t, s0) +/var/lib/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_lib_t, s0) /etc/NetworkManager/system-connections(/.*)? gen_context(system_u:object_r:NetworkManager_var_lib_t, s0) ++/etc/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_lib_t, s0) /var/log/wicd(/.*)? gen_context(system_u:object_r:NetworkManager_log_t,s0) + /var/log/wpa_supplicant.* -- gen_context(system_u:object_r:NetworkManager_log_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.6.12/policy/modules/services/networkmanager.te --- nsaserefpolicy/policy/modules/services/networkmanager.te 2009-06-25 10:19:44.000000000 +0200 -+++ serefpolicy-3.6.12/policy/modules/services/networkmanager.te 2009-12-09 16:22:09.000000000 +0100 ++++ serefpolicy-3.6.12/policy/modules/services/networkmanager.te 2010-01-06 16:11:15.000000000 +0100 @@ -57,7 +57,9 @@ manage_sock_files_pattern(NetworkManager_t, NetworkManager_tmp_t, NetworkManager_tmp_t) files_tmp_filetrans(NetworkManager_t, NetworkManager_tmp_t, sock_file) @@ -3603,6 +3675,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol manage_dirs_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t) manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t) +@@ -148,6 +150,7 @@ + userdom_dontaudit_use_unpriv_user_fds(NetworkManager_t) + userdom_dontaudit_use_user_ttys(NetworkManager_t) + # Read gnome-keyring ++userdom_read_home_certs(NetworkManager_t) + userdom_read_user_home_content_files(NetworkManager_t) + userdom_dgram_send(NetworkManager_t) + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.6.12/policy/modules/services/nis.te --- nsaserefpolicy/policy/modules/services/nis.te 2009-06-25 10:19:44.000000000 +0200 +++ serefpolicy-3.6.12/policy/modules/services/nis.te 2009-06-26 15:48:39.000000000 +0200 @@ -4034,7 +4114,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.6.12/policy/modules/services/postfix.te --- nsaserefpolicy/policy/modules/services/postfix.te 2009-06-25 10:19:44.000000000 +0200 -+++ serefpolicy-3.6.12/policy/modules/services/postfix.te 2009-07-31 13:05:36.000000000 +0200 ++++ serefpolicy-3.6.12/policy/modules/services/postfix.te 2010-01-05 18:40:19.000000000 +0100 @@ -42,9 +42,6 @@ mta_manage_spool(postfix_local_t) ') @@ -4081,7 +4161,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` locallogin_dontaudit_use_fds(postfix_map_t) ') -@@ -508,7 +490,7 @@ +@@ -469,6 +451,7 @@ + + optional_policy(` + spamassassin_domtrans_client(postfix_pipe_t) ++ spamassassin_kill_client(postfix_pipe_t) + ') + + optional_policy(` +@@ -508,7 +491,7 @@ ') optional_policy(` @@ -4090,7 +4178,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -640,7 +622,7 @@ +@@ -640,7 +623,7 @@ mta_read_aliases(postfix_smtpd_t) optional_policy(` @@ -4099,7 +4187,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -665,10 +647,6 @@ +@@ -665,10 +648,6 @@ allow postfix_virtual_t postfix_spool_t:file rw_file_perms; @@ -4307,16 +4395,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol auth_read_all_symlinks_except_shadow(rsync_t) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.12/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2009-06-25 10:19:44.000000000 +0200 -+++ serefpolicy-3.6.12/policy/modules/services/samba.te 2009-09-22 17:53:46.000000000 +0200 -@@ -280,6 +280,7 @@ ++++ serefpolicy-3.6.12/policy/modules/services/samba.te 2010-01-06 13:53:59.000000000 +0100 +@@ -280,6 +280,9 @@ files_pid_filetrans(smbd_t, smbd_var_run_t, file) allow smbd_t winbind_var_run_t:sock_file rw_sock_file_perms; +allow smbd_t winbind_t:process { signal signull }; ++ ++allow smbd_t swat_t:process signal; kernel_getattr_core_if(smbd_t) kernel_getattr_message_if(smbd_t) -@@ -342,6 +343,8 @@ +@@ -342,6 +345,8 @@ miscfiles_read_localization(smbd_t) miscfiles_read_public_files(smbd_t) @@ -4325,7 +4415,26 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol userdom_use_unpriv_users_fds(smbd_t) userdom_dontaudit_search_user_home_dirs(smbd_t) -@@ -924,3 +927,6 @@ +@@ -472,6 +477,8 @@ + + manage_files_pattern(nmbd_t, samba_var_t, samba_var_t) + ++allow nmbd_t swat_t:process signal; ++ + allow nmbd_t smbd_var_run_t:dir rw_dir_perms; + + kernel_getattr_core_if(nmbd_t) +@@ -622,7 +629,8 @@ + allow swat_t smbd_var_run_t:file { lock unlink }; + + allow swat_t nmbd_exec_t:file mmap_file_perms; +-can_exec(swat_t, nmbd_exec_t) ++samba_domtrans_nmb(swat_t) ++#can_exec(swat_t, nmbd_exec_t) + allow swat_t nmbd_port_t:udp_socket name_bind; + allow swat_t nmbd_t:process { signal signull }; + allow swat_t nmbd_var_run_t:file { lock read unlink }; +@@ -924,3 +932,6 @@ allow winbind_t smbcontrol_t:process signal; allow smbcontrol_t nmbd_var_run_t:file { read lock }; @@ -4823,7 +4932,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## All of the rules required to administrate diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.6.12/policy/modules/services/snmp.te --- nsaserefpolicy/policy/modules/services/snmp.te 2009-06-25 10:19:44.000000000 +0200 -+++ serefpolicy-3.6.12/policy/modules/services/snmp.te 2009-09-16 13:08:08.000000000 +0200 ++++ serefpolicy-3.6.12/policy/modules/services/snmp.te 2010-01-05 18:41:36.000000000 +0100 +@@ -27,7 +27,7 @@ + # + allow snmpd_t self:capability { dac_override kill ipc_lock sys_ptrace net_admin sys_nice sys_tty_config }; + dontaudit snmpd_t self:capability { sys_module sys_tty_config }; +-allow snmpd_t self:process { getsched setsched }; ++allow snmpd_t self:process { signal getsched setsched }; + allow snmpd_t self:fifo_file rw_fifo_file_perms; + allow snmpd_t self:unix_dgram_socket create_socket_perms; + allow snmpd_t self:unix_stream_socket create_stream_socket_perms; @@ -71,6 +71,8 @@ corenet_tcp_bind_snmp_port(snmpd_t) corenet_udp_bind_snmp_port(snmpd_t) @@ -4861,6 +4979,34 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol -/var/spool/MIMEDefang(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) +/var/spool/MD-Quarantine(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) +/var/spool/MIMEDefang(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.6.12/policy/modules/services/spamassassin.if +--- nsaserefpolicy/policy/modules/services/spamassassin.if 2009-06-25 10:19:44.000000000 +0200 ++++ serefpolicy-3.6.12/policy/modules/services/spamassassin.if 2010-01-05 18:39:03.000000000 +0100 +@@ -246,6 +246,24 @@ + stream_connect_pattern($1, spamd_var_run_t, spamd_var_run_t, spamd_t) + ') + ++####################################### ++##

++## Send kill signal to spamassassin client ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`spamassassin_kill_client',` ++ gen_require(` ++ type spamc_t; ++ ') ++ ++ allow $1 spamc_t:process sigkill; ++') ++ + ######################################## + ## + ## All of the rules required to administrate diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.6.12/policy/modules/services/spamassassin.te --- nsaserefpolicy/policy/modules/services/spamassassin.te 2009-06-25 10:19:44.000000000 +0200 +++ serefpolicy-3.6.12/policy/modules/services/spamassassin.te 2009-09-16 12:19:24.000000000 +0200 @@ -5150,7 +5296,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol /var/run/libvirt(/.*)? gen_context(system_u:object_r:virt_var_run_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.12/policy/modules/services/virt.te --- nsaserefpolicy/policy/modules/services/virt.te 2009-06-25 10:19:44.000000000 +0200 -+++ serefpolicy-3.6.12/policy/modules/services/virt.te 2009-08-14 08:33:53.000000000 +0200 ++++ serefpolicy-3.6.12/policy/modules/services/virt.te 2010-01-06 14:47:34.000000000 +0100 @@ -22,6 +22,13 @@ ## @@ -5206,7 +5352,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow svirt_t svirt_image_t:dir search_dir_perms; manage_dirs_pattern(svirt_t, svirt_image_t, svirt_image_t) manage_files_pattern(svirt_t, svirt_image_t, svirt_image_t) -@@ -316,16 +334,17 @@ +@@ -316,16 +334,20 @@ dontaudit svirt_t virt_content_t:file write_file_perms; dontaudit svirt_t virt_content_t:dir write; @@ -5221,13 +5367,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow svirt_t self:udp_socket create_socket_perms; ++dev_read_rand(svirt_t) ++dev_read_urand(svirt_t) ++ +corecmd_exec_bin(svirt_t) +corecmd_exec_shell(svirt_t) + corenet_udp_sendrecv_generic_if(svirt_t) corenet_udp_sendrecv_generic_node(svirt_t) corenet_udp_sendrecv_all_ports(svirt_t) -@@ -353,7 +372,7 @@ +@@ -353,7 +375,7 @@ ') optional_policy(` @@ -6136,7 +6285,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.6.12/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2009-06-25 10:19:44.000000000 +0200 -+++ serefpolicy-3.6.12/policy/modules/system/libraries.fc 2009-11-16 15:27:21.000000000 +0100 ++++ serefpolicy-3.6.12/policy/modules/system/libraries.fc 2010-01-05 18:53:24.000000000 +0100 @@ -139,8 +139,10 @@ /usr/lib(64)?/(nvidia/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/fglrx/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -6193,7 +6342,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol /var/lib/spamassassin/compiled/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0) ifdef(`distro_suse',` -@@ -366,9 +378,14 @@ +@@ -366,9 +378,17 @@ /usr/matlab.*\.so(\.[^/]*)* gen_context(system_u:object_r:textrel_shlib_t,s0) /opt/local/matlab.*\.so(\.[^/]*)* gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/local/matlab.*\.so(\.[^/]*)* gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -6207,6 +6356,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + +# libraries for avidemux +/usr/lib(64)?(/.*)?/libADM.*\.so(\.[^/]*)* gen_context(system_u:object_r:textrel_shlib_t,s0) ++ ++# for chromium browser ++/usr/lib(64)?/chromium-browser/.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.6.12/policy/modules/system/locallogin.te --- nsaserefpolicy/policy/modules/system/locallogin.te 2009-06-25 10:19:44.000000000 +0200 @@ -6440,9 +6592,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kernel_write_xen_state(udev_t) kernel_read_xen_state(udev_t) xen_manage_log(udev_t) +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.6.12/policy/modules/system/userdomain.fc +--- nsaserefpolicy/policy/modules/system/userdomain.fc 2009-06-25 10:19:44.000000000 +0200 ++++ serefpolicy-3.6.12/policy/modules/system/userdomain.fc 2010-01-06 16:10:17.000000000 +0100 +@@ -5,3 +5,4 @@ + /root(/.*)? gen_context(system_u:object_r:admin_home_t,s0) + /dev/shm/pulse-shm.* gen_context(system_u:object_r:user_tmpfs_t,s0) + /dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0) ++HOME_DIR/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.12/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2009-06-25 10:19:44.000000000 +0200 -+++ serefpolicy-3.6.12/policy/modules/system/userdomain.if 2009-09-14 14:33:01.000000000 +0200 ++++ serefpolicy-3.6.12/policy/modules/system/userdomain.if 2010-01-06 16:08:08.000000000 +0100 @@ -443,6 +443,9 @@ dev_rw_usbfs($1) dev_rw_generic_usb_dev($1) @@ -6541,6 +6701,46 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kerneloops_dbus_chat($1_t) ') +@@ -3697,3 +3710,25 @@ + + dontaudit $1 userdomain:unix_stream_socket rw_socket_perms; + ') ++ ++####################################### ++## ++## Read system SSL certificates in the users homedir. ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++# ++interface(`userdom_read_home_certs',` ++ gen_require(` ++ type home_cert_t; ++ ') ++ ++ userdom_search_user_home_dirs($1) ++ allow $1 home_cert_t:dir list_dir_perms; ++ read_files_pattern($1, home_cert_t, home_cert_t) ++ read_lnk_files_pattern($1, home_cert_t, home_cert_t) ++') +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.6.12/policy/modules/system/userdomain.te +--- nsaserefpolicy/policy/modules/system/userdomain.te 2009-06-25 10:19:44.000000000 +0200 ++++ serefpolicy-3.6.12/policy/modules/system/userdomain.te 2010-01-06 16:05:29.000000000 +0100 +@@ -92,6 +92,10 @@ + dev_node(user_tty_device_t) + ubac_constrained(user_tty_device_t) + ++type home_cert_t, user_home_type; ++files_type(home_cert_t) ++ubac_constrained(home_cert_t) ++ + tunable_policy(`allow_console_login',` + term_use_console(userdomain) + ') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virtual.te serefpolicy-3.6.12/policy/modules/system/virtual.te --- nsaserefpolicy/policy/modules/system/virtual.te 2009-06-25 10:19:44.000000000 +0200 +++ serefpolicy-3.6.12/policy/modules/system/virtual.te 2009-06-25 10:21:01.000000000 +0200 diff --git a/selinux-policy.spec b/selinux-policy.spec index e41a760..7e23039 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -20,7 +20,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.6.12 -Release: 92%{?dist} +Release: 93%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -442,6 +442,11 @@ exit 0 %endif %changelog +* Wed Jan 6 2010 Miroslav Grepl 3.6.12-93 +- Add labeling for /etc/NetworkManager directory +- Add home_cert type and appropriate labeling +- Allow virt_domain to read /dev/random + * Wed Dec 9 2009 Miroslav Grepl 3.6.12-92 - Add labeling for /var/lib/NetworkManager directory