diff --git a/Changelog b/Changelog index 05343f2..97c6488 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,4 @@ +- Remove unused types from dbus. - Add infrastructure for managing all user web content. - Deprecate some old file and dir permission set macros in favor of the newer, more consistently-named macros. diff --git a/policy/modules/admin/updfstab.te b/policy/modules/admin/updfstab.te index 29e2245..bce315f 100644 --- a/policy/modules/admin/updfstab.te +++ b/policy/modules/admin/updfstab.te @@ -90,7 +90,6 @@ optional_policy(` init_dbus_chat_script(updfstab_t) dbus_system_bus_client_template(updfstab,updfstab_t) - dbus_send_system_bus(updfstab_t) ') optional_policy(` diff --git a/policy/modules/admin/vpn.te b/policy/modules/admin/vpn.te index 19cf43a..889e581 100644 --- a/policy/modules/admin/vpn.te +++ b/policy/modules/admin/vpn.te @@ -105,7 +105,7 @@ userdom_dontaudit_search_all_users_home_content(vpnc_t) optional_policy(` dbus_system_bus_client_template(vpnc,vpnc_t) - dbus_send_system_bus(vpnc_t) + optional_policy(` networkmanager_dbus_chat(vpnc_t) ') diff --git a/policy/modules/apps/evolution.if b/policy/modules/apps/evolution.if index 133c62e..3480e41 100644 --- a/policy/modules/apps/evolution.if +++ b/policy/modules/apps/evolution.if @@ -395,9 +395,7 @@ template(`evolution_per_role_template',` optional_policy(` dbus_system_bus_client_template($1_evolution,$1_evolution_t) - dbus_send_system_bus($1_evolution_t) dbus_user_bus_client_template($1,$1_evolution,$1_evolution_t) - dbus_send_user_bus($1,$1_evolution_t) ') optional_policy(` @@ -528,7 +526,6 @@ template(`evolution_per_role_template',` optional_policy(` dbus_user_bus_client_template($1,$1_evolution_alarm,$1_evolution_alarm_t) - dbus_send_user_bus($1,$1_evolution_alarm_t) ') optional_policy(` diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if index 558208a..e1eb340 100644 --- a/policy/modules/apps/mozilla.if +++ b/policy/modules/apps/mozilla.if @@ -354,9 +354,7 @@ template(`mozilla_per_role_template',` optional_policy(` dbus_system_bus_client_template($1_mozilla,$1_mozilla_t) - dbus_send_system_bus($1_mozilla_t) dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t) - dbus_send_user_bus($1,$1_mozilla_t) ') optional_policy(` diff --git a/policy/modules/apps/thunderbird.if b/policy/modules/apps/thunderbird.if index 68a97e6..80e87d5 100644 --- a/policy/modules/apps/thunderbird.if +++ b/policy/modules/apps/thunderbird.if @@ -314,8 +314,6 @@ template(`thunderbird_per_role_template',` optional_policy(` dbus_system_bus_client_template($1_thunderbird,$1_thunderbird_t) dbus_user_bus_client_template($1,$1_thunderbird,$1_thunderbird_t) - dbus_send_system_bus($1_thunderbird_t) - dbus_send_user_bus($1,$1_thunderbird_t) ') optional_policy(` diff --git a/policy/modules/services/avahi.te b/policy/modules/services/avahi.te index 68d1137..724f10b 100644 --- a/policy/modules/services/avahi.te +++ b/policy/modules/services/avahi.te @@ -83,7 +83,7 @@ userdom_dontaudit_search_sysadm_home_dirs(avahi_t) optional_policy(` dbus_system_bus_client_template(avahi,avahi_t) dbus_connect_system_bus(avahi_t) - dbus_send_system_bus(avahi_t) + init_dbus_chat_script(avahi_t) ') diff --git a/policy/modules/services/bind.te b/policy/modules/services/bind.te index d06e411..bed8859 100644 --- a/policy/modules/services/bind.te +++ b/policy/modules/services/bind.te @@ -156,19 +156,12 @@ tunable_policy(`named_write_master_zones',` ') optional_policy(` - gen_require(` - class dbus send_msg; - ') - - allow named_t self:dbus send_msg; - init_dbus_chat_script(named_t) sysnet_dbus_chat_dhcpc(named_t) dbus_system_bus_client_template(named,named_t) dbus_connect_system_bus(named_t) - dbus_send_system_bus(named_t) optional_policy(` networkmanager_dbus_chat(named_t) diff --git a/policy/modules/services/bluetooth.if b/policy/modules/services/bluetooth.if index 4f79278..4a5c03d 100644 --- a/policy/modules/services/bluetooth.if +++ b/policy/modules/services/bluetooth.if @@ -97,9 +97,9 @@ template(`bluetooth_per_role_template',` optional_policy(` bluetooth_dbus_chat($1_bluetooth_t) + dbus_system_bus_client_template($1_bluetooth, $1_bluetooth_t) dbus_connect_system_bus($1_bluetooth_t) - dbus_send_system_bus($1_bluetooth_t) ') optional_policy(` diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te index 6e0fa5a..0dcd6ab 100644 --- a/policy/modules/services/bluetooth.te +++ b/policy/modules/services/bluetooth.te @@ -127,7 +127,6 @@ userdom_dontaudit_search_sysadm_home_dirs(bluetooth_t) optional_policy(` dbus_system_bus_client_template(bluetooth,bluetooth_t) dbus_connect_system_bus(bluetooth_t) - dbus_send_system_bus(bluetooth_t) ') optional_policy(` diff --git a/policy/modules/services/consolekit.te b/policy/modules/services/consolekit.te index 40c3e93..8c986ab 100644 --- a/policy/modules/services/consolekit.te +++ b/policy/modules/services/consolekit.te @@ -54,7 +54,6 @@ miscfiles_read_localization(consolekit_t) optional_policy(` dbus_system_bus_client_template(consolekit, consolekit_t) - dbus_send_system_bus(consolekit_t) dbus_connect_system_bus(consolekit_t) hal_dbus_chat(consolekit_t) diff --git a/policy/modules/services/cups.te b/policy/modules/services/cups.te index b7fae31..f2b9847 100644 --- a/policy/modules/services/cups.te +++ b/policy/modules/services/cups.te @@ -241,7 +241,6 @@ optional_policy(` optional_policy(` dbus_system_bus_client_template(cupsd,cupsd_t) - dbus_send_system_bus(cupsd_t) userdom_dbus_send_all_users(cupsd_t) @@ -383,7 +382,6 @@ optional_policy(` optional_policy(` dbus_system_bus_client_template(cupsd_config,cupsd_config_t) dbus_connect_system_bus(cupsd_config_t) - dbus_send_system_bus(cupsd_config_t) optional_policy(` hal_dbus_chat(cupsd_config_t) diff --git a/policy/modules/services/dbus.if b/policy/modules/services/dbus.if index 054f4c8..3f01887 100644 --- a/policy/modules/services/dbus.if +++ b/policy/modules/services/dbus.if @@ -214,11 +214,12 @@ template(`dbus_system_bus_client_template',` class dbus send_msg; ') - type $1_dbusd_system_t; - type_change $2 system_dbusd_t:dbus $1_dbusd_system_t; +# type $1_dbusd_system_t; +# type_change $2 system_dbusd_t:dbus $1_dbusd_system_t; # SE-DBus specific permissions - allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg; +# allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg; + allow $2 { system_dbusd_t self }:dbus send_msg; read_files_pattern($2, system_dbusd_var_lib_t, system_dbusd_var_lib_t) files_search_var_lib($2) @@ -258,11 +259,12 @@ template(`dbus_user_bus_client_template',` class dbus send_msg; ') - type $2_dbusd_$1_t; - type_change $3 $1_dbusd_t:dbus $2_dbusd_$1_t; +# type $2_dbusd_$1_t; +# type_change $3 $1_dbusd_t:dbus $2_dbusd_$1_t; # SE-DBus specific permissions - allow $2_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg; +# allow $2_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg; + allow $3 { $1_dbusd_t self }:dbus send_msg; # For connecting to the bus allow $3 $1_dbusd_t:unix_stream_socket connectto; diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te index 3be3456..860998e 100644 --- a/policy/modules/services/dbus.te +++ b/policy/modules/services/dbus.te @@ -1,5 +1,5 @@ -policy_module(dbus,1.7.2) +policy_module(dbus,1.7.3) gen_require(` class dbus all_dbus_perms; diff --git a/policy/modules/services/dhcp.te b/policy/modules/services/dhcp.te index c7b711f..1356e41 100644 --- a/policy/modules/services/dhcp.te +++ b/policy/modules/services/dhcp.te @@ -113,7 +113,6 @@ optional_policy(` optional_policy(` dbus_system_bus_client_template(dhcpd,dhcpd_t) dbus_connect_system_bus(dhcpd_t) - dbus_send_system_bus(dhcpd_t) ') optional_policy(` diff --git a/policy/modules/services/hal.te b/policy/modules/services/hal.te index 8f94a13..e0063bd 100644 --- a/policy/modules/services/hal.te +++ b/policy/modules/services/hal.te @@ -229,9 +229,7 @@ optional_policy(` optional_policy(` dbus_system_bus_client_template(hald,hald_t) - dbus_send_system_bus(hald_t) dbus_connect_system_bus(hald_t) - allow hald_t self:dbus send_msg; init_dbus_chat_script(hald_t) diff --git a/policy/modules/services/networkmanager.te b/policy/modules/services/networkmanager.te index 3b7c51c..8f78ec9 100644 --- a/policy/modules/services/networkmanager.te +++ b/policy/modules/services/networkmanager.te @@ -129,15 +129,8 @@ optional_policy(` ') optional_policy(` - gen_require(` - class dbus send_msg; - ') - - allow NetworkManager_t self:dbus send_msg; - dbus_system_bus_client_template(NetworkManager,NetworkManager_t) dbus_connect_system_bus(NetworkManager_t) - dbus_send_system_bus(NetworkManager_t) ') optional_policy(` diff --git a/policy/modules/services/oddjob.te b/policy/modules/services/oddjob.te index 3635b8c..1f4f3c2 100644 --- a/policy/modules/services/oddjob.te +++ b/policy/modules/services/oddjob.te @@ -56,7 +56,6 @@ locallogin_dontaudit_use_fds(oddjob_t) optional_policy(` dbus_system_bus_client_template(oddjob,oddjob_t) - dbus_send_system_bus(oddjob_t) dbus_connect_system_bus(oddjob_t) ') diff --git a/policy/modules/services/openvpn.te b/policy/modules/services/openvpn.te index 064331a..1531543 100644 --- a/policy/modules/services/openvpn.te +++ b/policy/modules/services/openvpn.te @@ -107,7 +107,6 @@ optional_policy(` optional_policy(` dbus_system_bus_client_template(openvpn,openvpn_t) dbus_connect_system_bus(openvpn_t) - dbus_send_system_bus(openvpn_t) networkmanager_dbus_chat(openvpn_t) ') diff --git a/policy/modules/services/ricci.te b/policy/modules/services/ricci.te index 4923e40..da4fde8 100644 --- a/policy/modules/services/ricci.te +++ b/policy/modules/services/ricci.te @@ -159,7 +159,7 @@ optional_policy(` optional_policy(` dbus_system_bus_client_template(ricci,ricci_t) - dbus_send_system_bus(ricci_t) + oddjob_dbus_chat(ricci_t) ') diff --git a/policy/modules/services/setroubleshoot.te b/policy/modules/services/setroubleshoot.te index 00c722f..549d365 100644 --- a/policy/modules/services/setroubleshoot.te +++ b/policy/modules/services/setroubleshoot.te @@ -109,7 +109,6 @@ userdom_dontaudit_read_sysadm_home_content_files(setroubleshootd_t) optional_policy(` dbus_system_bus_client_template(setroubleshootd, setroubleshootd_t) - dbus_send_system_bus(setroubleshootd_t) dbus_connect_system_bus(setroubleshootd_t) ') diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index a6e0697..20e5ff2 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -550,7 +550,6 @@ optional_policy(` optional_policy(` dbus_connect_system_bus(initrc_t) - dbus_send_system_bus(initrc_t) dbus_system_bus_client_template(initrc,initrc_t) dbus_read_config(initrc_t) diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te index bb8d897..d453ec3 100644 --- a/policy/modules/system/locallogin.te +++ b/policy/modules/system/locallogin.te @@ -162,7 +162,6 @@ optional_policy(` optional_policy(` dbus_system_bus_client_template(local_login, local_login_t) - dbus_send_system_bus(local_login_t) consolekit_dbus_chat(local_login_t) ') diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te index 77d51c6..f62664c 100644 --- a/policy/modules/system/sysnetwork.te +++ b/policy/modules/system/sysnetwork.te @@ -147,17 +147,10 @@ optional_policy(` ') optional_policy(` - gen_require(` - class dbus send_msg; - ') - - allow dhcpc_t self:dbus send_msg; - init_dbus_chat_script(dhcpc_t) dbus_system_bus_client_template(dhcpc,dhcpc_t) dbus_connect_system_bus(dhcpc_t) - dbus_send_system_bus(dhcpc_t) optional_policy(` networkmanager_dbus_chat(dhcpc_t) diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index ee39d61..c124f40 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -826,7 +826,6 @@ template(`userdom_common_user_template',` ') optional_policy(` - allow $1_t self:dbus send_msg; dbus_system_bus_client_template($1,$1_t) optional_policy(`