diff --git a/policy-20071130.patch b/policy-20071130.patch index fadb74c..560400f 100644 --- a/policy-20071130.patch +++ b/policy-20071130.patch @@ -2452,7 +2452,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if s ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.2.7/policy/modules/apps/gpg.te --- nsaserefpolicy/policy/modules/apps/gpg.te 2007-12-19 05:32:09.000000000 -0500 -+++ serefpolicy-3.2.7/policy/modules/apps/gpg.te 2008-02-11 14:16:30.000000000 -0500 ++++ serefpolicy-3.2.7/policy/modules/apps/gpg.te 2008-02-12 12:01:08.000000000 -0500 @@ -7,15 +7,232 @@ # @@ -2549,7 +2549,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s +# GPG helper local policy +# + -+allow gpg_helper_t self:process getsched; ++allow gpg_helper_t self:process { getsched setsched }; + +# for helper programs (which automatically fetch keys) +# Note: this is only tested with the hkp interface. If you use eg the @@ -5647,7 +5647,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # etc_runtime_t is the type of various diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.2.7/policy/modules/kernel/filesystem.if --- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-10-24 15:00:24.000000000 -0400 -+++ serefpolicy-3.2.7/policy/modules/kernel/filesystem.if 2008-02-06 11:02:29.000000000 -0500 ++++ serefpolicy-3.2.7/policy/modules/kernel/filesystem.if 2008-02-12 09:41:43.000000000 -0500 @@ -310,6 +310,25 @@ ######################################## @@ -5735,6 +5735,90 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ## Relabel block nodes on tmpfs filesystems. ## ## +@@ -3551,3 +3608,83 @@ + relabelfrom_blk_files_pattern($1,noxattrfs,noxattrfs) + relabelfrom_chr_files_pattern($1,noxattrfs,noxattrfs) + ') ++ ++######################################## ++## ++## Create, read, write, and delete directories ++## on a FUSEFS filesystem. ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++# ++interface(`fs_manage_fusefs_dirs',` ++ gen_require(` ++ type fusefs_t; ++ ') ++ ++ allow $1 fusefs_t:dir manage_dir_perms; ++') ++ ++######################################## ++## ++## Do not audit attempts to create, read, ++## write, and delete directories ++## on a FUSEFS filesystem. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`fs_dontaudit_manage_fusefs_dirs',` ++ gen_require(` ++ type fusefs_t; ++ ') ++ ++ dontaudit $1 fusefs_t:dir manage_dir_perms; ++') ++ ++######################################## ++## ++## Create, read, write, and delete files ++## on a FUSEFS filesystem. ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++# ++interface(`fs_manage_fusefs_files',` ++ gen_require(` ++ type fusefs_t; ++ ') ++ ++ manage_files_pattern($1,fusefs_t,fusefs_t) ++') ++ ++######################################## ++## ++## Do not audit attempts to create, ++## read, write, and delete files ++## on a FUSEFS filesystem. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`fs_dontaudit_manage_fusefs_files',` ++ gen_require(` ++ type fusefs_t; ++ ') ++ ++ dontaudit $1 fusefs_t:file manage_file_perms; ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.2.7/policy/modules/kernel/filesystem.te --- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-12-19 05:32:07.000000000 -0500 +++ serefpolicy-3.2.7/policy/modules/kernel/filesystem.te 2008-02-06 11:02:29.000000000 -0500 @@ -9223,7 +9307,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.2.7/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.2.7/policy/modules/services/cups.te 2008-02-06 11:02:29.000000000 -0500 ++++ serefpolicy-3.2.7/policy/modules/services/cups.te 2008-02-12 10:06:49.000000000 -0500 @@ -43,14 +43,12 @@ type cupsd_var_run_t; @@ -9443,7 +9527,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups fs_getattr_all_fs(cupsd_config_t) fs_search_auto_mountpoints(cupsd_config_t) -@@ -372,6 +404,10 @@ +@@ -353,6 +385,7 @@ + logging_send_syslog_msg(cupsd_config_t) + + miscfiles_read_localization(cupsd_config_t) ++miscfiles_read_hwdata(cupsd_config_t) + + seutil_dontaudit_search_config(cupsd_config_t) + +@@ -372,6 +405,10 @@ ') optional_policy(` @@ -9454,7 +9546,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups cron_system_entry(cupsd_config_t, cupsd_config_exec_t) ') -@@ -387,6 +423,7 @@ +@@ -387,6 +424,7 @@ optional_policy(` hal_domtrans(cupsd_config_t) hal_read_tmp_files(cupsd_config_t) @@ -9462,7 +9554,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups ') optional_policy(` -@@ -499,14 +536,12 @@ +@@ -499,14 +537,12 @@ allow hplip_t self:udp_socket create_socket_perms; allow hplip_t self:rawip_socket create_socket_perms; @@ -9481,7 +9573,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t) files_pid_filetrans(hplip_t,hplip_var_run_t,file) -@@ -537,14 +572,14 @@ +@@ -537,14 +573,14 @@ dev_read_urand(hplip_t) dev_read_rand(hplip_t) dev_rw_generic_usb_dev(hplip_t) @@ -9498,7 +9590,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups domain_use_interactive_fds(hplip_t) files_read_etc_files(hplip_t) -@@ -565,6 +600,7 @@ +@@ -565,6 +601,7 @@ userdom_dontaudit_search_all_users_home_content(hplip_t) lpd_read_config(cupsd_t) @@ -9851,7 +9943,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru # Local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.7/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500 -+++ serefpolicy-3.2.7/policy/modules/services/dbus.if 2008-02-11 17:07:47.000000000 -0500 ++++ serefpolicy-3.2.7/policy/modules/services/dbus.if 2008-02-12 12:42:53.000000000 -0500 @@ -53,6 +53,7 @@ gen_require(` type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t; @@ -9860,7 +9952,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ') ############################## -@@ -84,14 +85,20 @@ +@@ -64,8 +65,6 @@ + domain_entry_file($1_dbusd_t,system_dbusd_exec_t) + role $3 types $1_dbusd_t; + +- type $1_dbusd_$1_t; +- + type $1_dbusd_tmp_t; + files_tmp_file($1_dbusd_tmp_t) + +@@ -84,14 +83,18 @@ allow $1_dbusd_t self:tcp_socket create_stream_socket_perms; allow $1_dbusd_t self:netlink_selinux_socket create_socket_perms; @@ -9869,12 +9970,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus + # For connecting to the bus - allow $2 $1_dbusd_t:unix_stream_socket connectto; +- type_change $2 $1_dbusd_t:dbus $1_dbusd_$1_t; + allow $2 $1_dbusd_t:unix_stream_socket { getattr connectto }; + allow $2 $1_dbusd_t:unix_dgram_socket getattr; - type_change $2 $1_dbusd_t:dbus $1_dbusd_$1_t; # SE-DBus specific permissions - allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg; +- allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg; allow $2 $1_dbusd_t:dbus { send_msg acquire_svc }; - allow $1_t system_dbusd_t:dbus { send_msg acquire_svc }; + allow $1_dbusd_t $2:dbus send_msg; @@ -9883,7 +9984,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms; read_files_pattern($1_dbusd_t,dbusd_etc_t,dbusd_etc_t) -@@ -102,10 +109,9 @@ +@@ -102,10 +105,9 @@ files_tmp_filetrans($1_dbusd_t, $1_dbusd_tmp_t, { file dir }) domtrans_pattern($2, system_dbusd_exec_t, $1_dbusd_t) @@ -9896,7 +9997,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus allow $1_dbusd_t $2:process sigkill; allow $2 $1_dbusd_t:fd use; allow $2 $1_dbusd_t:fifo_file rw_fifo_file_perms; -@@ -139,6 +145,7 @@ +@@ -139,6 +141,7 @@ fs_getattr_romfs($1_dbusd_t) fs_getattr_xattr_fs($1_dbusd_t) @@ -9904,7 +10005,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus selinux_get_fs_mount($1_dbusd_t) selinux_validate_context($1_dbusd_t) -@@ -161,12 +168,23 @@ +@@ -161,12 +164,23 @@ seutil_read_config($1_dbusd_t) seutil_read_default_contexts($1_dbusd_t) @@ -9912,7 +10013,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus + userdom_dontaudit_search_sysadm_home_dirs($1_dbusd_t) + userdom_read_unpriv_users_home_content_files($1_dbusd_t) + userdom_dontaudit_append_unpriv_home_content_files($1_dbusd_t) -+ userdom_dontaudit_use_user_terminals($1, $1_dbusd_t) ++ term_dontaudit_use_all_user_ptys($1_dbusd_t) ifdef(`hide_broken_symptoms', ` dontaudit $2 $1_dbusd_t:netlink_selinux_socket { read write }; @@ -9929,7 +10030,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus tunable_policy(`read_default_t',` files_list_default($1_dbusd_t) files_read_default_files($1_dbusd_t) -@@ -182,6 +200,7 @@ +@@ -182,6 +196,7 @@ optional_policy(` xserver_use_xdm_fds($1_dbusd_t) xserver_rw_xdm_pipes($1_dbusd_t) @@ -9937,17 +10038,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ') ') -@@ -214,7 +233,8 @@ +@@ -209,12 +224,9 @@ + class dbus send_msg; + ') +-# type $1_dbusd_system_t; +-# type_change $2 system_dbusd_t:dbus $1_dbusd_system_t; +- # SE-DBus specific permissions - # allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg; +-# allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg; - allow $2 { system_dbusd_t self }:dbus send_msg; + allow $2 { system_dbusd_t $2 }:dbus send_msg; + allow system_dbusd_t $2:dbus send_msg; read_files_pattern($2, system_dbusd_var_lib_t, system_dbusd_var_lib_t) files_search_var_lib($2) -@@ -223,6 +243,10 @@ +@@ -223,6 +235,10 @@ files_search_pids($2) stream_connect_pattern($2,system_dbusd_var_run_t,system_dbusd_var_run_t,system_dbusd_t) dbus_read_config($2) @@ -9958,7 +10064,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ') ####################################### -@@ -251,6 +275,7 @@ +@@ -251,18 +267,16 @@ template(`dbus_user_bus_client_template',` gen_require(` type $1_dbusd_t; @@ -9966,7 +10072,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus class dbus send_msg; ') -@@ -263,6 +288,7 @@ +-# type $2_dbusd_$1_t; +-# type_change $3 $1_dbusd_t:dbus $2_dbusd_$1_t; +- + # SE-DBus specific permissions +-# allow $2_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg; + allow $3 { $1_dbusd_t self }:dbus send_msg; # For connecting to the bus allow $3 $1_dbusd_t:unix_stream_socket connectto; @@ -9974,7 +10085,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ') ######################################## -@@ -292,6 +318,59 @@ +@@ -292,6 +306,59 @@ ######################################## ## @@ -10034,7 +10145,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ## Read dbus configuration. ## ## -@@ -366,3 +445,55 @@ +@@ -366,3 +433,55 @@ allow $1 system_dbusd_t:dbus *; ') @@ -16181,8 +16292,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.2.7/policy/modules/services/prelude.te --- nsaserefpolicy/policy/modules/services/prelude.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.2.7/policy/modules/services/prelude.te 2008-02-08 14:54:04.000000000 -0500 -@@ -0,0 +1,140 @@ ++++ serefpolicy-3.2.7/policy/modules/services/prelude.te 2008-02-12 12:37:44.000000000 -0500 +@@ -0,0 +1,142 @@ +policy_module(prelude,1.0.0) + +######################################## @@ -16250,6 +16361,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel +manage_dirs_pattern(prelude_t,prelude_spool_t,prelude_spool_t) +manage_files_pattern(prelude_t,prelude_spool_t,prelude_spool_t) + ++auth_use_nsswitch(prelude_t) ++ +libs_use_ld_so(prelude_t) +libs_use_shared_libs(prelude_t) + @@ -18021,7 +18134,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.2.7/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.2.7/policy/modules/services/samba.te 2008-02-08 14:53:50.000000000 -0500 ++++ serefpolicy-3.2.7/policy/modules/services/samba.te 2008-02-12 09:43:12.000000000 -0500 @@ -26,28 +26,28 @@ ## @@ -18055,7 +18168,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ##

##
gen_tunable(samba_run_unconfined,false) -@@ -73,11 +73,9 @@ +@@ -59,6 +59,13 @@ + ## + gen_tunable(samba_share_nfs,false) + ++## ++##

++## Allow samba to export ntfs/fusefs volumes. ++##

++##
++gen_tunable(samba_share_fusefs,false) ++ + type nmbd_t; + type nmbd_exec_t; + init_daemon_domain(nmbd_t,nmbd_exec_t) +@@ -73,11 +80,9 @@ logging_log_file(samba_log_t) type samba_net_t; @@ -18069,7 +18196,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb type samba_net_tmp_t; files_tmp_file(samba_net_tmp_t) -@@ -139,6 +137,14 @@ +@@ -139,6 +144,14 @@ type winbind_var_run_t; files_pid_file(winbind_var_run_t) @@ -18084,7 +18211,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ######################################## # # Samba net local policy -@@ -193,7 +199,10 @@ +@@ -193,7 +206,10 @@ miscfiles_read_localization(samba_net_t) @@ -18095,7 +18222,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb optional_policy(` kerberos_use(samba_net_t) -@@ -213,7 +222,7 @@ +@@ -213,7 +229,7 @@ allow smbd_t self:msgq create_msgq_perms; allow smbd_t self:sem create_sem_perms; allow smbd_t self:shm create_shm_perms; @@ -18104,7 +18231,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow smbd_t self:tcp_socket create_stream_socket_perms; allow smbd_t self:udp_socket create_socket_perms; allow smbd_t self:unix_dgram_socket { create_socket_perms sendto }; -@@ -221,10 +230,8 @@ +@@ -221,10 +237,8 @@ allow smbd_t samba_etc_t:file { rw_file_perms setattr }; @@ -18117,7 +18244,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow smbd_t samba_net_tmp_t:file getattr; -@@ -234,6 +241,7 @@ +@@ -234,6 +248,7 @@ manage_dirs_pattern(smbd_t,samba_share_t,samba_share_t) manage_files_pattern(smbd_t,samba_share_t,samba_share_t) manage_lnk_files_pattern(smbd_t,samba_share_t,samba_share_t) @@ -18125,7 +18252,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb manage_dirs_pattern(smbd_t,samba_var_t,samba_var_t) manage_files_pattern(smbd_t,samba_var_t,samba_var_t) -@@ -251,7 +259,7 @@ +@@ -251,7 +266,7 @@ manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t) files_pid_filetrans(smbd_t,smbd_var_run_t,file) @@ -18134,7 +18261,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_getattr_core_if(smbd_t) kernel_getattr_message_if(smbd_t) -@@ -320,6 +328,8 @@ +@@ -320,6 +335,8 @@ userdom_dontaudit_use_unpriv_user_fds(smbd_t) userdom_use_unpriv_users_fds(smbd_t) @@ -18143,7 +18270,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ifdef(`hide_broken_symptoms', ` files_dontaudit_getattr_default_dirs(smbd_t) files_dontaudit_getattr_boot_dirs(smbd_t) -@@ -340,6 +350,17 @@ +@@ -340,6 +357,23 @@ tunable_policy(`samba_share_nfs',` fs_manage_nfs_dirs(smbd_t) fs_manage_nfs_files(smbd_t) @@ -18152,6 +18279,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb + fs_manage_nfs_named_sockets(smbd_t) +') + ++# Support Samba sharing of ntfs/fusefs mount points ++tunable_policy(`samba_share_fusefs',` ++ fs_manage_fusefs_dirs(smbd_t) ++ fs_manage_fusefs_files(smbd_t) ++') ++ +optional_policy(` + kerberos_read_keytab(smbd_t) +') @@ -18161,7 +18294,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') optional_policy(` -@@ -391,7 +412,7 @@ +@@ -391,7 +425,7 @@ allow nmbd_t self:msgq create_msgq_perms; allow nmbd_t self:sem create_sem_perms; allow nmbd_t self:shm create_shm_perms; @@ -18170,7 +18303,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow nmbd_t self:tcp_socket create_stream_socket_perms; allow nmbd_t self:udp_socket create_socket_perms; allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto }; -@@ -403,8 +424,7 @@ +@@ -403,8 +437,7 @@ read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t) manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t) @@ -18180,7 +18313,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb read_files_pattern(nmbd_t,samba_log_t,samba_log_t) create_files_pattern(nmbd_t,samba_log_t,samba_log_t) -@@ -439,6 +459,7 @@ +@@ -439,6 +472,7 @@ dev_getattr_mtrr_dev(nmbd_t) fs_getattr_all_fs(nmbd_t) @@ -18188,7 +18321,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb fs_search_auto_mountpoints(nmbd_t) domain_use_interactive_fds(nmbd_t) -@@ -522,6 +543,7 @@ +@@ -522,6 +556,7 @@ storage_raw_write_fixed_disk(smbmount_t) term_list_ptys(smbmount_t) @@ -18196,7 +18329,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb corecmd_list_bin(smbmount_t) -@@ -546,28 +568,37 @@ +@@ -546,28 +581,37 @@ userdom_use_all_users_fds(smbmount_t) @@ -18241,7 +18374,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow swat_t smbd_var_run_t:file read; manage_dirs_pattern(swat_t,swat_tmp_t,swat_tmp_t) -@@ -577,7 +608,9 @@ +@@ -577,7 +621,9 @@ manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t) files_pid_filetrans(swat_t,swat_var_run_t,file) @@ -18252,7 +18385,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_read_kernel_sysctls(swat_t) kernel_read_system_state(swat_t) -@@ -602,6 +635,7 @@ +@@ -602,6 +648,7 @@ dev_read_urand(swat_t) @@ -18260,7 +18393,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb files_read_etc_files(swat_t) files_search_home(swat_t) files_read_usr_files(swat_t) -@@ -614,6 +648,7 @@ +@@ -614,6 +661,7 @@ libs_use_shared_libs(swat_t) logging_send_syslog_msg(swat_t) @@ -18268,7 +18401,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb logging_search_logs(swat_t) miscfiles_read_localization(swat_t) -@@ -631,6 +666,17 @@ +@@ -631,6 +679,17 @@ kerberos_use(swat_t) ') @@ -18286,7 +18419,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ######################################## # # Winbind local policy -@@ -679,6 +725,8 @@ +@@ -679,6 +738,8 @@ manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t) files_pid_filetrans(winbind_t,winbind_var_run_t,file) @@ -18295,7 +18428,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_read_kernel_sysctls(winbind_t) kernel_list_proc(winbind_t) kernel_read_proc_symlinks(winbind_t) -@@ -766,6 +814,7 @@ +@@ -766,6 +827,7 @@ optional_policy(` squid_read_log(winbind_helper_t) squid_append_log(winbind_helper_t) @@ -18303,7 +18436,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') ######################################## -@@ -790,3 +839,37 @@ +@@ -790,3 +852,37 @@ domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t) ') ') @@ -20992,7 +21125,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser /var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.2.7/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2007-12-04 11:02:50.000000000 -0500 -+++ serefpolicy-3.2.7/policy/modules/services/xserver.if 2008-02-06 11:02:30.000000000 -0500 ++++ serefpolicy-3.2.7/policy/modules/services/xserver.if 2008-02-12 12:15:41.000000000 -0500 @@ -15,6 +15,7 @@ template(`xserver_common_domain_template',` gen_require(` @@ -21714,7 +21847,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.2.7/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.2.7/policy/modules/services/xserver.te 2008-02-11 14:21:09.000000000 -0500 ++++ serefpolicy-3.2.7/policy/modules/services/xserver.te 2008-02-12 12:43:50.000000000 -0500 @@ -16,6 +16,13 @@ ## @@ -21919,31 +22052,36 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t) -@@ -304,7 +363,23 @@ +@@ -304,7 +363,27 @@ ') optional_policy(` +- consolekit_dbus_chat(xdm_t) + bootloader_domtrans(xdm_t) +') + +optional_policy(` + consolekit_read_log(xdm_t) -+') + +optional_policy(` - consolekit_dbus_chat(xdm_t) -+ dbus_system_bus_client_template(xdm, xdm_t) + dbus_per_role_template(xdm, xdm_t, system_r) ++ dbus_system_bus_client_template(xdm, xdm_t) ++ ++ optional_policy(` ++ consolekit_dbus_chat(xdm_t) ++ ') ++ + optional_policy(` + hal_dbus_chat(xdm_t) + ') ++ + optional_policy(` + networkmanager_dbus_chat(xdm_t) + ') ') optional_policy(` -@@ -322,6 +397,10 @@ +@@ -322,6 +401,10 @@ ') optional_policy(` @@ -21954,7 +22092,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser loadkeys_exec(xdm_t) ') -@@ -335,6 +414,11 @@ +@@ -335,6 +418,11 @@ ') optional_policy(` @@ -21966,7 +22104,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser seutil_sigchld_newrole(xdm_t) ') -@@ -343,8 +427,8 @@ +@@ -343,8 +431,8 @@ ') optional_policy(` @@ -21976,7 +22114,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ifndef(`distro_redhat',` allow xdm_t self:process { execheap execmem }; -@@ -380,7 +464,7 @@ +@@ -380,7 +468,7 @@ allow xdm_xserver_t xdm_var_lib_t:file { getattr read }; dontaudit xdm_xserver_t xdm_var_lib_t:dir search; @@ -21985,7 +22123,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # Label pid and temporary files with derived types. manage_files_pattern(xdm_xserver_t,xdm_tmp_t,xdm_tmp_t) -@@ -392,6 +476,15 @@ +@@ -392,6 +480,15 @@ can_exec(xdm_xserver_t, xkb_var_lib_t) files_search_var_lib(xdm_xserver_t) @@ -22001,7 +22139,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # VNC v4 module in X server corenet_tcp_bind_vnc_port(xdm_xserver_t) -@@ -404,6 +497,7 @@ +@@ -404,6 +501,7 @@ # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_unpriv_users_home_content_files(xdm_xserver_t) @@ -22009,7 +22147,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser xserver_use_all_users_fonts(xdm_xserver_t) -@@ -420,6 +514,14 @@ +@@ -420,6 +518,14 @@ ') optional_policy(` @@ -22024,7 +22162,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser resmgr_stream_connect(xdm_t) ') -@@ -429,47 +531,103 @@ +@@ -429,47 +535,103 @@ ') optional_policy(` @@ -22048,6 +22186,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser + # xserver signals unconfined user on startx + unconfined_signal(xdm_xserver_t) + unconfined_getpgid(xdm_xserver_t) ++') ++ ++ ++tunable_policy(`allow_xserver_execmem', ` ++ allow xdm_xserver_t self:process { execheap execmem execstack }; ++') ++ ++ifndef(`distro_redhat',` ++ allow xdm_xserver_t self:process { execheap execmem }; ') -ifdef(`TODO',` @@ -22071,19 +22218,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser -allow xdm_t polymember:lnk_file { create unlink }; -# xdm needs access for copying .Xauthority into new home -allow xdm_t polymember:file { create getattr write }; -+ -+tunable_policy(`allow_xserver_execmem', ` -+ allow xdm_xserver_t self:process { execheap execmem execstack }; - ') - -+ifndef(`distro_redhat',` -+ allow xdm_xserver_t self:process { execheap execmem }; -+') -+ +ifdef(`distro_rhel4',` + allow xdm_xserver_t self:process { execheap execmem }; -+') -+ + ') + +############################## # -# Wants to delete .xsession-errors file @@ -25316,8 +25454,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet xen_append_log(ifconfig_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.2.7/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2007-12-19 05:32:17.000000000 -0500 -+++ serefpolicy-3.2.7/policy/modules/system/udev.te 2008-02-06 11:02:30.000000000 -0500 -@@ -96,9 +96,6 @@ ++++ serefpolicy-3.2.7/policy/modules/system/udev.te 2008-02-12 12:02:58.000000000 -0500 +@@ -83,6 +83,7 @@ + kernel_rw_unix_dgram_sockets(udev_t) + kernel_dgram_send(udev_t) + kernel_signal(udev_t) ++kernel_search_debugfs(udev_t) + + #https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182 + kernel_rw_net_sysctls(udev_t) +@@ -96,9 +97,6 @@ dev_delete_generic_files(udev_t) dev_search_usbfs(udev_t) dev_relabel_all_dev_nodes(udev_t) @@ -25327,7 +25473,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t domain_read_all_domains_state(udev_t) domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these -@@ -189,6 +186,7 @@ +@@ -189,6 +187,7 @@ optional_policy(` alsa_domtrans(udev_t) @@ -25335,7 +25481,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t alsa_read_rw_config(udev_t) ') -@@ -197,6 +195,10 @@ +@@ -197,6 +196,10 @@ ') optional_policy(`