From 202bb4cfa30ff580946bc09d9d0b1ef63d785ee8 Mon Sep 17 00:00:00 2001 From: Miroslav Date: Dec 08 2011 16:15:52 +0000 Subject: +- Allow mozilla_plugin_t to manage mozilla_home_t +- Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain +- Add label for tumblerd --- diff --git a/policy-F16.patch b/policy-F16.patch index 34541cc..25d1257 100644 --- a/policy-F16.patch +++ b/policy-F16.patch @@ -8114,7 +8114,7 @@ index fbb5c5a..e187982 100644 + allow $1 mozilla_plugin_rw_t:dir rw_dir_perms; ') diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te -index 2e9318b..fc7a18e 100644 +index 2e9318b..bb90a3b 100644 --- a/policy/modules/apps/mozilla.te +++ b/policy/modules/apps/mozilla.te @@ -23,8 +23,9 @@ type mozilla_conf_t; @@ -8247,9 +8247,9 @@ index 2e9318b..fc7a18e 100644 can_exec(mozilla_plugin_t, mozilla_home_t) -read_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t) -+manage_dirs_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t) -+manage_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t) -+manage_lnk_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t) ++manage_dirs_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t) ++manage_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t) ++manage_lnk_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t) manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) @@ -12732,7 +12732,7 @@ index 223ad43..d95e720 100644 rsync_exec(yam_t) ') diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc -index 3fae11a..5d00aa0 100644 +index 3fae11a..cdd0dcf 100644 --- a/policy/modules/kernel/corecommands.fc +++ b/policy/modules/kernel/corecommands.fc @@ -1,7 +1,7 @@ @@ -12791,7 +12791,7 @@ index 3fae11a..5d00aa0 100644 /opt/gutenprint/cups/lib/filter(/.*)? gen_context(system_u:object_r:bin_t,s0) -@@ -179,67 +174,90 @@ ifdef(`distro_gentoo',` +@@ -179,67 +174,91 @@ ifdef(`distro_gentoo',` /opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0) ') @@ -12900,6 +12900,7 @@ index 3fae11a..5d00aa0 100644 +/usr/lib/rpm/rpmk -- gen_context(system_u:object_r:bin_t,s0) +/usr/lib/rpm/rpmq -- gen_context(system_u:object_r:bin_t,s0) +/usr/lib/rpm/rpmv -- gen_context(system_u:object_r:bin_t,s0) ++/usr/lib/tumbler-[^/]*/tumblerd -- gen_context(system_u:object_r:bin_t,s0) +/usr/lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0) +/usr/lib/sftp-server -- gen_context(system_u:object_r:bin_t,s0) +/usr/lib/vte/gnome-pty-helper -- gen_context(system_u:object_r:bin_t,s0) @@ -12927,7 +12928,7 @@ index 3fae11a..5d00aa0 100644 /usr/libexec(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/libexec/git-core/git-shell -- gen_context(system_u:object_r:shell_exec_t,s0) -@@ -247,11 +265,18 @@ ifdef(`distro_gentoo',` +@@ -247,11 +266,18 @@ ifdef(`distro_gentoo',` /usr/libexec/openssh/sftp-server -- gen_context(system_u:object_r:bin_t,s0) @@ -12947,7 +12948,7 @@ index 3fae11a..5d00aa0 100644 /usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/sbin/smrsh -- gen_context(system_u:object_r:shell_exec_t,s0) -@@ -267,6 +292,10 @@ ifdef(`distro_gentoo',` +@@ -267,6 +293,10 @@ ifdef(`distro_gentoo',` /usr/share/cluster/.*\.sh gen_context(system_u:object_r:bin_t,s0) /usr/share/cluster/ocf-shellfuncs -- gen_context(system_u:object_r:bin_t,s0) /usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0) @@ -12958,7 +12959,7 @@ index 3fae11a..5d00aa0 100644 /usr/share/e16/misc(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/gedit-2/plugins/externaltools/tools(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/gitolite/hooks/common/update -- gen_context(system_u:object_r:bin_t,s0) -@@ -286,15 +315,19 @@ ifdef(`distro_gentoo',` +@@ -286,15 +316,19 @@ ifdef(`distro_gentoo',` /usr/share/smolt/client(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall/compiler\.pl -- gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall/configpath -- gen_context(system_u:object_r:bin_t,s0) @@ -12979,7 +12980,7 @@ index 3fae11a..5d00aa0 100644 ifdef(`distro_gentoo', ` /usr/.*-.*-linux-gnu/gcc-bin/.*(/.*)? gen_context(system_u:object_r:bin_t,s0) -@@ -306,10 +339,11 @@ ifdef(`distro_redhat', ` +@@ -306,10 +340,11 @@ ifdef(`distro_redhat', ` /etc/gdm/[^/]+ -d gen_context(system_u:object_r:bin_t,s0) /etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0) @@ -12993,7 +12994,7 @@ index 3fae11a..5d00aa0 100644 /usr/lib/vmware-tools/(s)?bin32(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/vmware-tools/(s)?bin64(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/authconfig/authconfig-gtk\.py -- gen_context(system_u:object_r:bin_t,s0) -@@ -319,9 +353,11 @@ ifdef(`distro_redhat', ` +@@ -319,9 +354,11 @@ ifdef(`distro_redhat', ` /usr/share/clamav/clamd-gen -- gen_context(system_u:object_r:bin_t,s0) /usr/share/clamav/freshclam-sleep -- gen_context(system_u:object_r:bin_t,s0) /usr/share/createrepo(/.*)? gen_context(system_u:object_r:bin_t,s0) @@ -13005,7 +13006,7 @@ index 3fae11a..5d00aa0 100644 /usr/share/pwlib/make/ptlib-config -- gen_context(system_u:object_r:bin_t,s0) /usr/share/pydict/pydict\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/rhn/rhn_applet/applet\.py -- gen_context(system_u:object_r:bin_t,s0) -@@ -363,7 +399,7 @@ ifdef(`distro_redhat', ` +@@ -363,7 +400,7 @@ ifdef(`distro_redhat', ` ifdef(`distro_suse', ` /usr/lib/cron/run-crons -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/samba/classic/.* -- gen_context(system_u:object_r:bin_t,s0) @@ -13014,7 +13015,7 @@ index 3fae11a..5d00aa0 100644 /usr/share/apache2/[^/]* -- gen_context(system_u:object_r:bin_t,s0) ') -@@ -375,8 +411,8 @@ ifdef(`distro_suse', ` +@@ -375,8 +412,8 @@ ifdef(`distro_suse', ` /var/ftp/bin(/.*)? gen_context(system_u:object_r:bin_t,s0) /var/lib/asterisk/agi-bin(/.*)? gen_context(system_u:object_r:bin_t,s0) @@ -13025,7 +13026,7 @@ index 3fae11a..5d00aa0 100644 /var/qmail/bin -d gen_context(system_u:object_r:bin_t,s0) /var/qmail/bin(/.*)? gen_context(system_u:object_r:bin_t,s0) -@@ -385,3 +421,12 @@ ifdef(`distro_suse', ` +@@ -385,3 +422,12 @@ ifdef(`distro_suse', ` ifdef(`distro_suse',` /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) ') @@ -61166,10 +61167,10 @@ index 078bcd7..84d29ee 100644 +/root/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0) +/root/\.shosts gen_context(system_u:object_r:ssh_home_t,s0) diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if -index 22adaca..c2efd25 100644 +index 22adaca..6ec295a 100644 --- a/policy/modules/services/ssh.if +++ b/policy/modules/services/ssh.if -@@ -32,10 +32,10 @@ +@@ -32,10 +32,11 @@ ## # template(`ssh_basic_client_template',` @@ -61177,11 +61178,12 @@ index 22adaca..c2efd25 100644 gen_require(` attribute ssh_server; type ssh_exec_t, sshd_key_t, sshd_tmp_t; ++ type ssh_keysign_exec_t, ssh_keysign_t; + type ssh_home_t; ') ############################## -@@ -47,10 +47,6 @@ template(`ssh_basic_client_template',` +@@ -47,10 +48,6 @@ template(`ssh_basic_client_template',` application_domain($1_ssh_t, ssh_exec_t) role $3 types $1_ssh_t; @@ -61192,7 +61194,15 @@ index 22adaca..c2efd25 100644 ############################## # # Client local policy -@@ -93,18 +89,18 @@ template(`ssh_basic_client_template',` +@@ -89,22 +86,26 @@ template(`ssh_basic_client_template',` + # or "regular" (not special like sshd_extern_t) servers + allow $2 ssh_server:unix_stream_socket rw_stream_socket_perms; + ++ # derived domain can execute ssh-keysign ++ domtrans_pattern($1_ssh_t, ssh_keysign_exec_t, ssh_keysign_t) ++ role $3 types ssh_keysign_t; ++ + # allow ps to show ssh ps_process_pattern($2, $1_ssh_t) # user can manage the keys and config @@ -61219,7 +61229,7 @@ index 22adaca..c2efd25 100644 kernel_read_kernel_sysctls($1_ssh_t) kernel_read_system_state($1_ssh_t) -@@ -116,6 +112,8 @@ template(`ssh_basic_client_template',` +@@ -116,6 +117,8 @@ template(`ssh_basic_client_template',` corenet_tcp_sendrecv_all_ports($1_ssh_t) corenet_tcp_connect_ssh_port($1_ssh_t) corenet_sendrecv_ssh_client_packets($1_ssh_t) @@ -61228,7 +61238,7 @@ index 22adaca..c2efd25 100644 dev_read_urand($1_ssh_t) -@@ -148,6 +146,29 @@ template(`ssh_basic_client_template',` +@@ -148,6 +151,29 @@ template(`ssh_basic_client_template',` ') ') @@ -61258,7 +61268,7 @@ index 22adaca..c2efd25 100644 ####################################### ## ## The template to define a ssh server. -@@ -168,7 +189,7 @@ template(`ssh_basic_client_template',` +@@ -168,7 +194,7 @@ template(`ssh_basic_client_template',` ## ## # @@ -61267,7 +61277,7 @@ index 22adaca..c2efd25 100644 type $1_t, ssh_server; auth_login_pgm_domain($1_t) -@@ -181,16 +202,18 @@ template(`ssh_server_template', ` +@@ -181,16 +207,18 @@ template(`ssh_server_template', ` type $1_var_run_t; files_pid_file($1_var_run_t) @@ -61289,7 +61299,7 @@ index 22adaca..c2efd25 100644 term_create_pty($1_t, $1_devpts_t) manage_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t) -@@ -206,6 +229,7 @@ template(`ssh_server_template', ` +@@ -206,6 +234,7 @@ template(`ssh_server_template', ` kernel_read_kernel_sysctls($1_t) kernel_read_network_state($1_t) @@ -61297,7 +61307,7 @@ index 22adaca..c2efd25 100644 corenet_all_recvfrom_unlabeled($1_t) corenet_all_recvfrom_netlabel($1_t) -@@ -220,10 +244,13 @@ template(`ssh_server_template', ` +@@ -220,10 +249,13 @@ template(`ssh_server_template', ` corenet_tcp_bind_generic_node($1_t) corenet_udp_bind_generic_node($1_t) corenet_tcp_bind_ssh_port($1_t) @@ -61313,7 +61323,7 @@ index 22adaca..c2efd25 100644 auth_rw_login_records($1_t) auth_rw_faillog($1_t) -@@ -234,6 +261,7 @@ template(`ssh_server_template', ` +@@ -234,6 +266,7 @@ template(`ssh_server_template', ` corecmd_getattr_bin_files($1_t) domain_interactive_fd($1_t) @@ -61321,7 +61331,7 @@ index 22adaca..c2efd25 100644 files_read_etc_files($1_t) files_read_etc_runtime_files($1_t) -@@ -243,21 +271,13 @@ template(`ssh_server_template', ` +@@ -243,21 +276,13 @@ template(`ssh_server_template', ` miscfiles_read_localization($1_t) @@ -61345,7 +61355,7 @@ index 22adaca..c2efd25 100644 optional_policy(` kerberos_use($1_t) -@@ -268,6 +288,14 @@ template(`ssh_server_template', ` +@@ -268,6 +293,14 @@ template(`ssh_server_template', ` files_read_var_lib_symlinks($1_t) nx_spec_domtrans_server($1_t) ') @@ -61360,7 +61370,7 @@ index 22adaca..c2efd25 100644 ') ######################################## -@@ -290,11 +318,11 @@ template(`ssh_server_template', ` +@@ -290,11 +323,11 @@ template(`ssh_server_template', ` ## User domain for the role ## ## @@ -61373,7 +61383,7 @@ index 22adaca..c2efd25 100644 type ssh_t, ssh_exec_t, ssh_tmpfs_t, ssh_home_t; type ssh_agent_exec_t, ssh_keysign_t, ssh_tmpfs_t; type ssh_agent_tmp_t; -@@ -327,17 +355,20 @@ template(`ssh_role_template',` +@@ -327,17 +360,20 @@ template(`ssh_role_template',` # allow ps to show ssh ps_process_pattern($3, ssh_t) @@ -61395,7 +61405,7 @@ index 22adaca..c2efd25 100644 ############################## # -@@ -359,7 +390,7 @@ template(`ssh_role_template',` +@@ -359,7 +395,7 @@ template(`ssh_role_template',` stream_connect_pattern($3, ssh_agent_tmp_t, ssh_agent_tmp_t, $1_ssh_agent_t) # Allow the user shell to signal the ssh program. @@ -61404,7 +61414,7 @@ index 22adaca..c2efd25 100644 # allow ps to show ssh ps_process_pattern($3, $1_ssh_agent_t) -@@ -381,7 +412,6 @@ template(`ssh_role_template',` +@@ -381,7 +417,6 @@ template(`ssh_role_template',` files_read_etc_files($1_ssh_agent_t) files_read_etc_runtime_files($1_ssh_agent_t) @@ -61412,7 +61422,7 @@ index 22adaca..c2efd25 100644 libs_read_lib_files($1_ssh_agent_t) -@@ -393,28 +423,15 @@ template(`ssh_role_template',` +@@ -393,28 +428,15 @@ template(`ssh_role_template',` seutil_dontaudit_read_config($1_ssh_agent_t) # Write to the user domain tty. @@ -61428,15 +61438,15 @@ index 22adaca..c2efd25 100644 - - tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_files($1_ssh_agent_t) - +- - # transition back to normal privs upon exec - fs_nfs_domtrans($1_ssh_agent_t, $3) - ') -+ ssh_exec_keygen($3) - tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_files($1_ssh_agent_t) -- ++ ssh_exec_keygen($3) + - # transition back to normal privs upon exec - fs_cifs_domtrans($1_ssh_agent_t, $3) - ') @@ -61444,7 +61454,7 @@ index 22adaca..c2efd25 100644 optional_policy(` nis_use_ypbind($1_ssh_agent_t) -@@ -464,6 +481,24 @@ interface(`ssh_signal',` +@@ -464,6 +486,24 @@ interface(`ssh_signal',` ######################################## ## @@ -61469,7 +61479,7 @@ index 22adaca..c2efd25 100644 ## Read a ssh server unnamed pipe. ## ## -@@ -477,8 +512,27 @@ interface(`ssh_read_pipes',` +@@ -477,8 +517,27 @@ interface(`ssh_read_pipes',` type sshd_t; ') @@ -61498,7 +61508,7 @@ index 22adaca..c2efd25 100644 ######################################## ## ## Read and write a ssh server unnamed pipe. -@@ -494,7 +548,7 @@ interface(`ssh_rw_pipes',` +@@ -494,7 +553,7 @@ interface(`ssh_rw_pipes',` type sshd_t; ') @@ -61507,7 +61517,7 @@ index 22adaca..c2efd25 100644 ') ######################################## -@@ -586,6 +640,24 @@ interface(`ssh_domtrans',` +@@ -586,6 +645,24 @@ interface(`ssh_domtrans',` ######################################## ## @@ -61532,7 +61542,7 @@ index 22adaca..c2efd25 100644 ## Execute the ssh client in the caller domain. ## ## -@@ -618,7 +690,7 @@ interface(`ssh_setattr_key_files',` +@@ -618,7 +695,7 @@ interface(`ssh_setattr_key_files',` type sshd_key_t; ') @@ -61541,7 +61551,7 @@ index 22adaca..c2efd25 100644 files_search_pids($1) ') -@@ -643,6 +715,42 @@ interface(`ssh_agent_exec',` +@@ -643,6 +720,42 @@ interface(`ssh_agent_exec',` ######################################## ## @@ -61584,7 +61594,7 @@ index 22adaca..c2efd25 100644 ## Read ssh home directory content ## ## -@@ -682,6 +790,50 @@ interface(`ssh_domtrans_keygen',` +@@ -682,6 +795,50 @@ interface(`ssh_domtrans_keygen',` ######################################## ## @@ -61635,7 +61645,7 @@ index 22adaca..c2efd25 100644 ## Read ssh server keys ## ## -@@ -695,7 +847,7 @@ interface(`ssh_dontaudit_read_server_keys',` +@@ -695,7 +852,7 @@ interface(`ssh_dontaudit_read_server_keys',` type sshd_key_t; ') @@ -61644,7 +61654,7 @@ index 22adaca..c2efd25 100644 ') ###################################### -@@ -735,3 +887,63 @@ interface(`ssh_delete_tmp',` +@@ -735,3 +892,63 @@ interface(`ssh_delete_tmp',` files_search_tmp($1) delete_files_pattern($1, sshd_tmp_t, sshd_tmp_t) ') diff --git a/selinux-policy.spec b/selinux-policy.spec index aea6f29..503daba 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -17,7 +17,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.10.0 -Release: 66%{?dist} +Release: 67%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -470,6 +470,11 @@ SELinux Reference policy mls base module. %endif %changelog +* Thu Dec 8 2011 Miroslav Grepl 3.10.0-67 +- Allow mozilla_plugin_t to manage mozilla_home_t +- Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain +- Add label for tumblerd + * Wed Dec 7 2011 Miroslav Grepl 3.10.0-66 - Fixes for xguest package