From 28588ba9c38ac65fd7044f263f9e02f2e295ef13 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Apr 15 2013 10:04:44 +0000 Subject: - Allow alsa_t signal_perms, we probaly should search for any app that - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets - Fix deny_ptrace boolean, certain ptrace leaked into the system - Allow winbind to manage kerberos_rcache_host - Allow spamd to create spamd_var_lib_t directories - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to mana - Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface - Allow certmonger to read pki-tomcat lib files - Allow certwatch to execute bin_t - Allow snmp to manage /var/lib/net-snmp files - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_ - Fix vmware_role() interface - Fix cobbler_manage_lib_files() interface - Allow nagios check disk plugins to execute bin_t - Allow quantum to transition to openvswitch_t - Allow postdrop to stream connect to postfix-master - Allow quantum to stream connect to openvswitch - Add xserver_dontaudit_xdm_rw_stream_sockets() interface - Allow daemon to send dgrams to initrc_t - Allow kdm to start the power service to initiate a reboot or powerof --- diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index 7905622..cb989b3 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -22234,7 +22234,7 @@ index d1f64a0..3be3d00 100644 +/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) + diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if -index 6bf0ecc..0ef3955 100644 +index 6bf0ecc..2706448 100644 --- a/policy/modules/services/xserver.if +++ b/policy/modules/services/xserver.if @@ -19,9 +19,10 @@ @@ -23084,7 +23084,33 @@ index 6bf0ecc..0ef3955 100644 gen_require(` type xserver_t; ') -@@ -1226,6 +1595,26 @@ interface(`xserver_stream_connect',` +@@ -1210,6 +1579,25 @@ interface(`xserver_dontaudit_rw_stream_sockets',` + + ######################################## + ## ++## Do not audit attempts to read and write xdm ++## unix domain stream sockets. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`xserver_dontaudit_xdm_rw_stream_sockets',` ++ gen_require(` ++ type xdm_t; ++ ') ++ ++ dontaudit $1 xdm_t:unix_stream_socket { read write }; ++') ++ ++######################################## ++## + ## Connect to the X server over a unix domain + ## stream socket. + ## +@@ -1226,6 +1614,26 @@ interface(`xserver_stream_connect',` files_search_tmp($1) stream_connect_pattern($1, xserver_tmp_t, xserver_tmp_t, xserver_t) @@ -23111,7 +23137,7 @@ index 6bf0ecc..0ef3955 100644 ') ######################################## -@@ -1251,7 +1640,7 @@ interface(`xserver_read_tmp_files',` +@@ -1251,7 +1659,7 @@ interface(`xserver_read_tmp_files',` ## ## Interface to provide X object permissions on a given X server to ## an X client domain. Gives the domain permission to read the @@ -23120,7 +23146,7 @@ index 6bf0ecc..0ef3955 100644 ## ## ## -@@ -1261,13 +1650,23 @@ interface(`xserver_read_tmp_files',` +@@ -1261,13 +1669,23 @@ interface(`xserver_read_tmp_files',` # interface(`xserver_manage_core_devices',` gen_require(` @@ -23145,7 +23171,7 @@ index 6bf0ecc..0ef3955 100644 ') ######################################## -@@ -1284,10 +1683,604 @@ interface(`xserver_manage_core_devices',` +@@ -1284,10 +1702,604 @@ interface(`xserver_manage_core_devices',` # interface(`xserver_unconfined',` gen_require(` @@ -23753,7 +23779,7 @@ index 6bf0ecc..0ef3955 100644 + files_search_tmp($1) +') diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te -index 2696452..48c4924 100644 +index 2696452..d6f03e7 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -26,27 +26,50 @@ gen_require(` @@ -24318,7 +24344,7 @@ index 2696452..48c4924 100644 storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t) -@@ -441,28 +620,42 @@ storage_dontaudit_raw_read_removable_device(xdm_t) +@@ -441,28 +620,43 @@ storage_dontaudit_raw_read_removable_device(xdm_t) storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t) @@ -24361,10 +24387,11 @@ index 2696452..48c4924 100644 -sysnet_read_config(xdm_t) +systemd_write_inhibit_pipes(xdm_t) +systemd_dbus_chat_localed(xdm_t) ++systemd_start_power_services(xdm_t) userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_create_all_users_keys(xdm_t) -@@ -471,24 +664,43 @@ userdom_read_user_home_content_files(xdm_t) +@@ -471,24 +665,43 @@ userdom_read_user_home_content_files(xdm_t) # Search /proc for any user domain processes. userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) @@ -24414,7 +24441,7 @@ index 2696452..48c4924 100644 tunable_policy(`xdm_sysadm_login',` userdom_xsession_spec_domtrans_all_users(xdm_t) # FIXME: -@@ -502,11 +714,26 @@ tunable_policy(`xdm_sysadm_login',` +@@ -502,11 +715,26 @@ tunable_policy(`xdm_sysadm_login',` ') optional_policy(` @@ -24441,7 +24468,7 @@ index 2696452..48c4924 100644 ') optional_policy(` -@@ -514,12 +741,72 @@ optional_policy(` +@@ -514,12 +742,72 @@ optional_policy(` ') optional_policy(` @@ -24514,7 +24541,7 @@ index 2696452..48c4924 100644 hostname_exec(xdm_t) ') -@@ -537,28 +824,78 @@ optional_policy(` +@@ -537,28 +825,78 @@ optional_policy(` ') optional_policy(` @@ -24602,7 +24629,7 @@ index 2696452..48c4924 100644 ') optional_policy(` -@@ -570,6 +907,14 @@ optional_policy(` +@@ -570,6 +908,14 @@ optional_policy(` ') optional_policy(` @@ -24617,7 +24644,7 @@ index 2696452..48c4924 100644 xfs_stream_connect(xdm_t) ') -@@ -594,8 +939,11 @@ allow xserver_t input_xevent_t:x_event send; +@@ -594,8 +940,11 @@ allow xserver_t input_xevent_t:x_event send; # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack @@ -24630,7 +24657,7 @@ index 2696452..48c4924 100644 allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow xserver_t self:fd use; allow xserver_t self:fifo_file rw_fifo_file_perms; -@@ -608,8 +956,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; +@@ -608,8 +957,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:udp_socket create_socket_perms; @@ -24646,7 +24673,7 @@ index 2696452..48c4924 100644 manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) -@@ -617,6 +972,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) +@@ -617,6 +973,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file) @@ -24657,7 +24684,7 @@ index 2696452..48c4924 100644 manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) -@@ -628,12 +987,19 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) +@@ -628,12 +988,19 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) files_search_var_lib(xserver_t) @@ -24679,7 +24706,7 @@ index 2696452..48c4924 100644 kernel_read_system_state(xserver_t) kernel_read_device_sysctls(xserver_t) -@@ -641,12 +1007,12 @@ kernel_read_modprobe_sysctls(xserver_t) +@@ -641,12 +1008,12 @@ kernel_read_modprobe_sysctls(xserver_t) # Xorg wants to check if kernel is tainted kernel_read_kernel_sysctls(xserver_t) kernel_write_proc_files(xserver_t) @@ -24693,7 +24720,7 @@ index 2696452..48c4924 100644 corenet_all_recvfrom_netlabel(xserver_t) corenet_tcp_sendrecv_generic_if(xserver_t) corenet_udp_sendrecv_generic_if(xserver_t) -@@ -667,23 +1033,27 @@ dev_rw_apm_bios(xserver_t) +@@ -667,23 +1034,27 @@ dev_rw_apm_bios(xserver_t) dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) @@ -24724,7 +24751,7 @@ index 2696452..48c4924 100644 # brought on by rhgb files_search_mnt(xserver_t) -@@ -694,7 +1064,16 @@ fs_getattr_xattr_fs(xserver_t) +@@ -694,7 +1065,16 @@ fs_getattr_xattr_fs(xserver_t) fs_search_nfs(xserver_t) fs_search_auto_mountpoints(xserver_t) fs_search_ramfs(xserver_t) @@ -24742,7 +24769,7 @@ index 2696452..48c4924 100644 mls_xwin_read_to_clearance(xserver_t) selinux_validate_context(xserver_t) -@@ -708,20 +1087,18 @@ init_getpgid(xserver_t) +@@ -708,20 +1088,18 @@ init_getpgid(xserver_t) term_setattr_unallocated_ttys(xserver_t) term_use_unallocated_ttys(xserver_t) @@ -24766,7 +24793,7 @@ index 2696452..48c4924 100644 userdom_search_user_home_dirs(xserver_t) userdom_use_user_ttys(xserver_t) -@@ -729,8 +1106,6 @@ userdom_setattr_user_ttys(xserver_t) +@@ -729,8 +1107,6 @@ userdom_setattr_user_ttys(xserver_t) userdom_read_user_tmp_files(xserver_t) userdom_rw_user_tmpfs_files(xserver_t) @@ -24775,7 +24802,7 @@ index 2696452..48c4924 100644 ifndef(`distro_redhat',` allow xserver_t self:process { execmem execheap execstack }; domain_mmap_low_uncond(xserver_t) -@@ -775,16 +1150,44 @@ optional_policy(` +@@ -775,16 +1151,44 @@ optional_policy(` ') optional_policy(` @@ -24821,7 +24848,7 @@ index 2696452..48c4924 100644 unconfined_domtrans(xserver_t) ') -@@ -793,6 +1196,10 @@ optional_policy(` +@@ -793,6 +1197,10 @@ optional_policy(` ') optional_policy(` @@ -24832,7 +24859,7 @@ index 2696452..48c4924 100644 xfs_stream_connect(xserver_t) ') -@@ -808,10 +1215,10 @@ allow xserver_t xdm_t:shm rw_shm_perms; +@@ -808,10 +1216,10 @@ allow xserver_t xdm_t:shm rw_shm_perms; # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open # handle of a file inside the dir!!! @@ -24846,7 +24873,7 @@ index 2696452..48c4924 100644 # Label pid and temporary files with derived types. manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) -@@ -819,7 +1226,7 @@ manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) +@@ -819,7 +1227,7 @@ manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) manage_sock_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) # Run xkbcomp. @@ -24855,7 +24882,7 @@ index 2696452..48c4924 100644 can_exec(xserver_t, xkb_var_lib_t) # VNC v4 module in X server -@@ -832,26 +1239,21 @@ init_use_fds(xserver_t) +@@ -832,26 +1240,21 @@ init_use_fds(xserver_t) # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_user_home_content_files(xserver_t) @@ -24890,7 +24917,7 @@ index 2696452..48c4924 100644 ') optional_policy(` -@@ -902,7 +1304,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy +@@ -902,7 +1305,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show }; # operations allowed on my windows allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; @@ -24899,7 +24926,7 @@ index 2696452..48c4924 100644 # operations allowed on all windows allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child }; -@@ -956,11 +1358,31 @@ allow x_domain self:x_resource { read write }; +@@ -956,11 +1359,31 @@ allow x_domain self:x_resource { read write }; # can mess with the screensaver allow x_domain xserver_t:x_screen { getattr saver_getattr }; @@ -24931,7 +24958,7 @@ index 2696452..48c4924 100644 tunable_policy(`! xserver_object_manager',` # should be xserver_unconfined(x_domain), # but typeattribute doesnt work in conditionals -@@ -982,18 +1404,40 @@ tunable_policy(`! xserver_object_manager',` +@@ -982,18 +1405,40 @@ tunable_policy(`! xserver_object_manager',` allow x_domain xevent_type:{ x_event x_synthetic_event } *; ') @@ -28170,7 +28197,7 @@ index 24e7804..1894886 100644 + allow $1 init_t:system undefined; +') diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te -index dd3be8d..84ffb31 100644 +index dd3be8d..969bda2 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -11,10 +11,24 @@ gen_require(` @@ -28277,7 +28304,7 @@ index dd3be8d..84ffb31 100644 # is ~sys_module really needed? observed: # sys_boot # sys_tty_config -@@ -110,12 +145,32 @@ allow init_t self:fifo_file rw_fifo_file_perms; +@@ -110,12 +145,33 @@ allow init_t self:fifo_file rw_fifo_file_perms; # Re-exec itself can_exec(init_t, init_exec_t) @@ -28291,6 +28318,7 @@ index dd3be8d..84ffb31 100644 +manage_files_pattern(init_t, initrc_state_t, initrc_state_t) +can_exec(init_t, initrc_state_t) + ++allow daemon initrc_t:unix_dgram_socket sendto; +allow init_t initrc_t:unix_stream_socket { connectto create_stream_socket_perms }; +allow initrc_t init_t:unix_stream_socket { connectto rw_stream_socket_perms sendto }; +allow initrc_t init_t:fifo_file rw_fifo_file_perms; @@ -28316,7 +28344,7 @@ index dd3be8d..84ffb31 100644 allow init_t initctl_t:fifo_file manage_fifo_file_perms; dev_filetrans(init_t, initctl_t, fifo_file) -@@ -125,13 +180,17 @@ allow init_t initrc_var_run_t:file { rw_file_perms setattr }; +@@ -125,13 +181,17 @@ allow init_t initrc_var_run_t:file { rw_file_perms setattr }; kernel_read_system_state(init_t) kernel_share_state(init_t) @@ -28335,7 +28363,7 @@ index dd3be8d..84ffb31 100644 domain_getpgid_all_domains(init_t) domain_kill_all_domains(init_t) -@@ -139,14 +198,20 @@ domain_signal_all_domains(init_t) +@@ -139,14 +199,20 @@ domain_signal_all_domains(init_t) domain_signull_all_domains(init_t) domain_sigstop_all_domains(init_t) domain_sigchld_all_domains(init_t) @@ -28356,7 +28384,7 @@ index dd3be8d..84ffb31 100644 # file descriptors inherited from the rootfs: files_dontaudit_rw_root_files(init_t) files_dontaudit_rw_root_chr_files(init_t) -@@ -156,28 +221,48 @@ fs_list_inotifyfs(init_t) +@@ -156,28 +222,48 @@ fs_list_inotifyfs(init_t) fs_write_ramfs_sockets(init_t) mcs_process_set_categories(init_t) @@ -28408,7 +28436,7 @@ index dd3be8d..84ffb31 100644 ifdef(`distro_gentoo',` allow init_t self:process { getcap setcap }; -@@ -186,29 +271,178 @@ ifdef(`distro_gentoo',` +@@ -186,29 +272,178 @@ ifdef(`distro_gentoo',` ') ifdef(`distro_redhat',` @@ -28595,7 +28623,7 @@ index dd3be8d..84ffb31 100644 ') optional_policy(` -@@ -216,6 +450,27 @@ optional_policy(` +@@ -216,6 +451,27 @@ optional_policy(` ') optional_policy(` @@ -28623,7 +28651,7 @@ index dd3be8d..84ffb31 100644 unconfined_domain(init_t) ') -@@ -225,8 +480,9 @@ optional_policy(` +@@ -225,8 +481,9 @@ optional_policy(` # allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; @@ -28635,7 +28663,7 @@ index dd3be8d..84ffb31 100644 allow initrc_t self:passwd rootok; allow initrc_t self:key manage_key_perms; -@@ -257,12 +513,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) +@@ -257,12 +514,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) allow initrc_t initrc_var_run_t:file manage_file_perms; files_pid_filetrans(initrc_t, initrc_var_run_t, file) @@ -28652,7 +28680,7 @@ index dd3be8d..84ffb31 100644 manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) -@@ -278,23 +538,36 @@ kernel_change_ring_buffer_level(initrc_t) +@@ -278,23 +539,36 @@ kernel_change_ring_buffer_level(initrc_t) kernel_clear_ring_buffer(initrc_t) kernel_get_sysvipc_info(initrc_t) kernel_read_all_sysctls(initrc_t) @@ -28695,7 +28723,7 @@ index dd3be8d..84ffb31 100644 corenet_tcp_sendrecv_all_ports(initrc_t) corenet_udp_sendrecv_all_ports(initrc_t) corenet_tcp_connect_all_ports(initrc_t) -@@ -302,9 +575,11 @@ corenet_sendrecv_all_client_packets(initrc_t) +@@ -302,9 +576,11 @@ corenet_sendrecv_all_client_packets(initrc_t) dev_read_rand(initrc_t) dev_read_urand(initrc_t) @@ -28707,7 +28735,7 @@ index dd3be8d..84ffb31 100644 dev_rw_sysfs(initrc_t) dev_list_usbfs(initrc_t) dev_read_framebuffer(initrc_t) -@@ -312,8 +587,10 @@ dev_write_framebuffer(initrc_t) +@@ -312,8 +588,10 @@ dev_write_framebuffer(initrc_t) dev_read_realtime_clock(initrc_t) dev_read_sound_mixer(initrc_t) dev_write_sound_mixer(initrc_t) @@ -28718,7 +28746,7 @@ index dd3be8d..84ffb31 100644 dev_delete_lvm_control_dev(initrc_t) dev_manage_generic_symlinks(initrc_t) dev_manage_generic_files(initrc_t) -@@ -321,8 +598,7 @@ dev_manage_generic_files(initrc_t) +@@ -321,8 +599,7 @@ dev_manage_generic_files(initrc_t) dev_delete_generic_symlinks(initrc_t) dev_getattr_all_blk_files(initrc_t) dev_getattr_all_chr_files(initrc_t) @@ -28728,7 +28756,7 @@ index dd3be8d..84ffb31 100644 domain_kill_all_domains(initrc_t) domain_signal_all_domains(initrc_t) -@@ -331,7 +607,6 @@ domain_sigstop_all_domains(initrc_t) +@@ -331,7 +608,6 @@ domain_sigstop_all_domains(initrc_t) domain_sigchld_all_domains(initrc_t) domain_read_all_domains_state(initrc_t) domain_getattr_all_domains(initrc_t) @@ -28736,7 +28764,7 @@ index dd3be8d..84ffb31 100644 domain_getsession_all_domains(initrc_t) domain_use_interactive_fds(initrc_t) # for lsof which is used by alsa shutdown: -@@ -339,6 +614,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) +@@ -339,6 +615,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) domain_dontaudit_getattr_all_tcp_sockets(initrc_t) domain_dontaudit_getattr_all_dgram_sockets(initrc_t) domain_dontaudit_getattr_all_pipes(initrc_t) @@ -28744,7 +28772,7 @@ index dd3be8d..84ffb31 100644 files_getattr_all_dirs(initrc_t) files_getattr_all_files(initrc_t) -@@ -346,14 +622,15 @@ files_getattr_all_symlinks(initrc_t) +@@ -346,14 +623,15 @@ files_getattr_all_symlinks(initrc_t) files_getattr_all_pipes(initrc_t) files_getattr_all_sockets(initrc_t) files_purge_tmp(initrc_t) @@ -28762,7 +28790,7 @@ index dd3be8d..84ffb31 100644 files_read_usr_files(initrc_t) files_manage_urandom_seed(initrc_t) files_manage_generic_spool(initrc_t) -@@ -363,8 +640,12 @@ files_list_isid_type_dirs(initrc_t) +@@ -363,8 +641,12 @@ files_list_isid_type_dirs(initrc_t) files_mounton_isid_type_dirs(initrc_t) files_list_default(initrc_t) files_mounton_default(initrc_t) @@ -28776,7 +28804,7 @@ index dd3be8d..84ffb31 100644 fs_list_inotifyfs(initrc_t) fs_register_binary_executable_type(initrc_t) # rhgb-console writes to ramfs -@@ -374,10 +655,11 @@ fs_mount_all_fs(initrc_t) +@@ -374,10 +656,11 @@ fs_mount_all_fs(initrc_t) fs_unmount_all_fs(initrc_t) fs_remount_all_fs(initrc_t) fs_getattr_all_fs(initrc_t) @@ -28790,7 +28818,7 @@ index dd3be8d..84ffb31 100644 mcs_process_set_categories(initrc_t) mls_file_read_all_levels(initrc_t) -@@ -386,6 +668,7 @@ mls_process_read_up(initrc_t) +@@ -386,6 +669,7 @@ mls_process_read_up(initrc_t) mls_process_write_down(initrc_t) mls_rangetrans_source(initrc_t) mls_fd_share_all_levels(initrc_t) @@ -28798,7 +28826,7 @@ index dd3be8d..84ffb31 100644 selinux_get_enforce_mode(initrc_t) -@@ -397,6 +680,7 @@ term_use_all_terms(initrc_t) +@@ -397,6 +681,7 @@ term_use_all_terms(initrc_t) term_reset_tty_labels(initrc_t) auth_rw_login_records(initrc_t) @@ -28806,7 +28834,7 @@ index dd3be8d..84ffb31 100644 auth_setattr_login_records(initrc_t) auth_rw_lastlog(initrc_t) auth_read_pam_pid(initrc_t) -@@ -415,20 +699,18 @@ logging_read_all_logs(initrc_t) +@@ -415,20 +700,18 @@ logging_read_all_logs(initrc_t) logging_append_all_logs(initrc_t) logging_read_audit_config(initrc_t) @@ -28830,7 +28858,7 @@ index dd3be8d..84ffb31 100644 ifdef(`distro_debian',` dev_setattr_generic_dirs(initrc_t) -@@ -450,7 +732,6 @@ ifdef(`distro_gentoo',` +@@ -450,7 +733,6 @@ ifdef(`distro_gentoo',` allow initrc_t self:process setfscreate; dev_create_null_dev(initrc_t) dev_create_zero_dev(initrc_t) @@ -28838,7 +28866,7 @@ index dd3be8d..84ffb31 100644 term_create_console_dev(initrc_t) # unfortunately /sbin/rc does stupid tricks -@@ -485,6 +766,10 @@ ifdef(`distro_gentoo',` +@@ -485,6 +767,10 @@ ifdef(`distro_gentoo',` sysnet_setattr_config(initrc_t) optional_policy(` @@ -28849,7 +28877,7 @@ index dd3be8d..84ffb31 100644 alsa_read_lib(initrc_t) ') -@@ -505,7 +790,7 @@ ifdef(`distro_redhat',` +@@ -505,7 +791,7 @@ ifdef(`distro_redhat',` # Red Hat systems seem to have a stray # fd open from the initrd @@ -28858,7 +28886,7 @@ index dd3be8d..84ffb31 100644 files_dontaudit_read_root_files(initrc_t) # These seem to be from the initrd -@@ -520,6 +805,7 @@ ifdef(`distro_redhat',` +@@ -520,6 +806,7 @@ ifdef(`distro_redhat',` files_create_boot_dirs(initrc_t) files_create_boot_flag(initrc_t) files_rw_boot_symlinks(initrc_t) @@ -28866,7 +28894,7 @@ index dd3be8d..84ffb31 100644 # wants to read /.fonts directory files_read_default_files(initrc_t) files_mountpoint(initrc_tmp_t) -@@ -540,6 +826,7 @@ ifdef(`distro_redhat',` +@@ -540,6 +827,7 @@ ifdef(`distro_redhat',` miscfiles_rw_localization(initrc_t) miscfiles_setattr_localization(initrc_t) miscfiles_relabel_localization(initrc_t) @@ -28874,7 +28902,7 @@ index dd3be8d..84ffb31 100644 miscfiles_read_fonts(initrc_t) miscfiles_read_hwdata(initrc_t) -@@ -549,8 +836,44 @@ ifdef(`distro_redhat',` +@@ -549,8 +837,44 @@ ifdef(`distro_redhat',` ') optional_policy(` @@ -28919,7 +28947,7 @@ index dd3be8d..84ffb31 100644 ') optional_policy(` -@@ -558,14 +881,31 @@ ifdef(`distro_redhat',` +@@ -558,14 +882,31 @@ ifdef(`distro_redhat',` rpc_write_exports(initrc_t) rpc_manage_nfs_state_data(initrc_t) ') @@ -28951,7 +28979,7 @@ index dd3be8d..84ffb31 100644 ') ') -@@ -576,6 +916,39 @@ ifdef(`distro_suse',` +@@ -576,6 +917,39 @@ ifdef(`distro_suse',` ') ') @@ -28991,7 +29019,7 @@ index dd3be8d..84ffb31 100644 optional_policy(` amavis_search_lib(initrc_t) amavis_setattr_pid_files(initrc_t) -@@ -588,6 +961,8 @@ optional_policy(` +@@ -588,6 +962,8 @@ optional_policy(` optional_policy(` apache_read_config(initrc_t) apache_list_modules(initrc_t) @@ -29000,7 +29028,7 @@ index dd3be8d..84ffb31 100644 ') optional_policy(` -@@ -609,6 +984,7 @@ optional_policy(` +@@ -609,6 +985,7 @@ optional_policy(` optional_policy(` cgroup_stream_connect_cgred(initrc_t) @@ -29008,7 +29036,7 @@ index dd3be8d..84ffb31 100644 ') optional_policy(` -@@ -625,6 +1001,17 @@ optional_policy(` +@@ -625,6 +1002,17 @@ optional_policy(` ') optional_policy(` @@ -29026,7 +29054,7 @@ index dd3be8d..84ffb31 100644 dev_getattr_printer_dev(initrc_t) cups_read_log(initrc_t) -@@ -641,9 +1028,13 @@ optional_policy(` +@@ -641,9 +1029,13 @@ optional_policy(` dbus_connect_system_bus(initrc_t) dbus_system_bus_client(initrc_t) dbus_read_config(initrc_t) @@ -29040,7 +29068,7 @@ index dd3be8d..84ffb31 100644 ') optional_policy(` -@@ -656,15 +1047,11 @@ optional_policy(` +@@ -656,15 +1048,11 @@ optional_policy(` ') optional_policy(` @@ -29058,7 +29086,7 @@ index dd3be8d..84ffb31 100644 ') optional_policy(` -@@ -685,6 +1072,15 @@ optional_policy(` +@@ -685,6 +1073,15 @@ optional_policy(` ') optional_policy(` @@ -29074,7 +29102,7 @@ index dd3be8d..84ffb31 100644 inn_exec_config(initrc_t) ') -@@ -725,6 +1121,7 @@ optional_policy(` +@@ -725,6 +1122,7 @@ optional_policy(` lpd_list_spool(initrc_t) lpd_read_config(initrc_t) @@ -29082,7 +29110,7 @@ index dd3be8d..84ffb31 100644 ') optional_policy(` -@@ -742,7 +1139,14 @@ optional_policy(` +@@ -742,7 +1140,14 @@ optional_policy(` ') optional_policy(` @@ -29097,7 +29125,7 @@ index dd3be8d..84ffb31 100644 mta_dontaudit_read_spool_symlinks(initrc_t) ') -@@ -765,6 +1169,10 @@ optional_policy(` +@@ -765,6 +1170,10 @@ optional_policy(` ') optional_policy(` @@ -29108,7 +29136,7 @@ index dd3be8d..84ffb31 100644 postgresql_manage_db(initrc_t) postgresql_read_config(initrc_t) ') -@@ -774,10 +1182,20 @@ optional_policy(` +@@ -774,10 +1183,20 @@ optional_policy(` ') optional_policy(` @@ -29129,7 +29157,7 @@ index dd3be8d..84ffb31 100644 quota_manage_flags(initrc_t) ') -@@ -786,6 +1204,10 @@ optional_policy(` +@@ -786,6 +1205,10 @@ optional_policy(` ') optional_policy(` @@ -29140,7 +29168,7 @@ index dd3be8d..84ffb31 100644 fs_write_ramfs_sockets(initrc_t) fs_search_ramfs(initrc_t) -@@ -807,8 +1229,6 @@ optional_policy(` +@@ -807,8 +1230,6 @@ optional_policy(` # bash tries ioctl for some reason files_dontaudit_ioctl_all_pids(initrc_t) @@ -29149,7 +29177,7 @@ index dd3be8d..84ffb31 100644 ') optional_policy(` -@@ -817,6 +1237,10 @@ optional_policy(` +@@ -817,6 +1238,10 @@ optional_policy(` ') optional_policy(` @@ -29160,7 +29188,7 @@ index dd3be8d..84ffb31 100644 # shorewall-init script run /var/lib/shorewall/firewall shorewall_lib_domtrans(initrc_t) ') -@@ -826,10 +1250,12 @@ optional_policy(` +@@ -826,10 +1251,12 @@ optional_policy(` squid_manage_logs(initrc_t) ') @@ -29173,7 +29201,7 @@ index dd3be8d..84ffb31 100644 optional_policy(` ssh_dontaudit_read_server_keys(initrc_t) -@@ -856,12 +1282,27 @@ optional_policy(` +@@ -856,12 +1283,27 @@ optional_policy(` ') optional_policy(` @@ -29202,7 +29230,7 @@ index dd3be8d..84ffb31 100644 ifdef(`distro_redhat',` # system-config-services causes avc messages that should be dontaudited -@@ -871,6 +1312,18 @@ optional_policy(` +@@ -871,6 +1313,18 @@ optional_policy(` optional_policy(` mono_domtrans(initrc_t) ') @@ -29221,7 +29249,7 @@ index dd3be8d..84ffb31 100644 ') optional_policy(` -@@ -886,6 +1339,10 @@ optional_policy(` +@@ -886,6 +1340,10 @@ optional_policy(` ') optional_policy(` @@ -29232,7 +29260,7 @@ index dd3be8d..84ffb31 100644 # Set device ownerships/modes. xserver_setattr_console_pipes(initrc_t) -@@ -896,3 +1353,196 @@ optional_policy(` +@@ -896,3 +1354,196 @@ optional_policy(` optional_policy(` zebra_read_config(initrc_t) ') @@ -29989,7 +30017,7 @@ index 5dfa44b..aa4d8fc 100644 optional_policy(` diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc -index 73bb3c0..dbd708d 100644 +index 73bb3c0..aadfba0 100644 --- a/policy/modules/system/libraries.fc +++ b/policy/modules/system/libraries.fc @@ -1,3 +1,4 @@ @@ -30063,16 +30091,18 @@ index 73bb3c0..dbd708d 100644 /usr/lib/libADM5.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/libatiadlxx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/win32/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -@@ -141,6 +151,8 @@ ifdef(`distro_redhat',` +@@ -141,19 +151,21 @@ ifdef(`distro_redhat',` /usr/lib/ati-fglrx/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/fglrx/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/libjs\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib/libjavascriptcoregtk[^/]*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib/libzvbi\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/sse2/libx264\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) - /usr/lib(/.*)?/libnvidia.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +-/usr/lib(/.*)?/libnvidia.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) ++/usr/lib/libnvidia\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) ++/usr/lib.*/libnvidia\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(/.*)?/nvidia_drv.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -@@ -148,12 +160,11 @@ ifdef(`distro_redhat',` + /usr/lib/nero/plug-ins/libMP3\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/nvidia-graphics(-[^/]*/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/nvidia-graphics(-[^/]*/)?libnvidia.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/nvidia-graphics(-[^/]*/)?libXvMCNVIDIA\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -30088,7 +30118,7 @@ index 73bb3c0..dbd708d 100644 /usr/NX/lib/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/NX/lib/libjpeg\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -@@ -182,11 +193,13 @@ ifdef(`distro_redhat',` +@@ -182,11 +194,13 @@ ifdef(`distro_redhat',` # Fedora Core packages: gstreamer-plugins, compat-libstdc++, Glide3, libdv # HelixPlayer, SDL, xorg-x11, xorg-x11-libs, Hermes, valgrind, openoffice.org-libs, httpd - php HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -30102,7 +30132,7 @@ index 73bb3c0..dbd708d 100644 /usr/lib/libfglrx_gamma\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/mozilla/plugins/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/mozilla/plugins/libvlcplugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) -@@ -241,13 +254,11 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_ +@@ -241,13 +255,11 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_ # Livna.org packages: xmms-mp3, ffmpeg, xvidcore, xine-lib, gsm, lame /usr/lib.*/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -30118,7 +30148,7 @@ index 73bb3c0..dbd708d 100644 # Jai, Sun Microsystems (Jpackage SPRM) /usr/lib/libmlib_jai\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) -@@ -269,20 +280,19 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te +@@ -269,20 +281,19 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te # Java, Sun Microsystems (JPackage SRPM) /usr/(.*/)?jre.*/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -30149,7 +30179,7 @@ index 73bb3c0..dbd708d 100644 /usr/(.*/)?intellinux/SPPlugins/ADMPlugin\.apl -- gen_context(system_u:object_r:textrel_shlib_t,s0) -@@ -299,17 +309,154 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te +@@ -299,17 +310,151 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te # /var/cache/ldconfig(/.*)? gen_context(system_u:object_r:ldconfig_cache_t,s0) @@ -30201,8 +30231,6 @@ index 73bb3c0..dbd708d 100644 +/usr/lib/googleearth/.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib/google-earth/.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/opt/google-earth/.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -+/opt/google/.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -+/opt/google/chrome/.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) + +/usr/lib/nspluginwrapper/np.*\.so -- gen_context(system_u:object_r:lib_t,s0) + @@ -30307,7 +30335,6 @@ index 73bb3c0..dbd708d 100644 +/opt/lgtonmc/bin/.*\.so(\.[0-9])? -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/opt/google/picasa/.*\.dll -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/opt/google/picasa/.*\.yti -- gen_context(system_u:object_r:textrel_shlib_t,s0) -+/opt/google/talkplugin/.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) + +/usr/sbin/ldconfig -- gen_context(system_u:object_r:ldconfig_exec_t,s0) diff --git a/policy/modules/system/libraries.if b/policy/modules/system/libraries.if diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index 8b4d3ad..f3956ec 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -1817,7 +1817,7 @@ index 708b743..c2edd9a 100644 + ps_process_pattern($1, alsa_t) +') diff --git a/alsa.te b/alsa.te -index cda6d20..f19402e 100644 +index cda6d20..32d74d1 100644 --- a/alsa.te +++ b/alsa.te @@ -24,6 +24,9 @@ files_type(alsa_var_lib_t) @@ -1830,7 +1830,15 @@ index cda6d20..f19402e 100644 ######################################## # # Local policy -@@ -59,7 +62,6 @@ dev_read_sound(alsa_t) +@@ -31,6 +34,7 @@ userdom_user_home_content(alsa_home_t) + + allow alsa_t self:capability { dac_read_search dac_override setgid setuid ipc_owner }; + dontaudit alsa_t self:capability sys_admin; ++allow alsa_t self:process signal_perms; + allow alsa_t self:sem create_sem_perms; + allow alsa_t self:shm create_shm_perms; + allow alsa_t self:unix_stream_socket { accept listen }; +@@ -59,7 +63,6 @@ dev_read_sound(alsa_t) dev_read_sysfs(alsa_t) dev_write_sound(alsa_t) @@ -1838,7 +1846,7 @@ index cda6d20..f19402e 100644 files_search_var_lib(alsa_t) term_dontaudit_use_console(alsa_t) -@@ -72,8 +74,6 @@ init_use_fds(alsa_t) +@@ -72,8 +75,6 @@ init_use_fds(alsa_t) logging_send_syslog_msg(alsa_t) @@ -4398,7 +4406,7 @@ index 83e899c..c0ece1b 100644 + filetrans_pattern($1, { httpd_user_content_t httpd_user_script_exec_t }, httpd_user_htaccess_t, file, ".htaccess") ') diff --git a/apache.te b/apache.te -index 1a82e29..dfaef83 100644 +index 1a82e29..25bd127 100644 --- a/apache.te +++ b/apache.te @@ -1,297 +1,353 @@ @@ -5627,7 +5635,7 @@ index 1a82e29..dfaef83 100644 ') optional_policy(` -@@ -836,20 +952,34 @@ optional_policy(` +@@ -836,20 +952,38 @@ optional_policy(` ') optional_policy(` @@ -5660,15 +5668,19 @@ index 1a82e29..dfaef83 100644 - ') +optional_policy(` + puppet_read_lib(httpd_t) ++') ++ ++optional_policy(` ++ pwauth_domtrans(httpd_t) ') optional_policy(` - puppet_read_lib_files(httpd_t) -+ pwauth_domtrans(httpd_t) ++ rpm_dontaudit_read_db(httpd_t) ') optional_policy(` -@@ -857,6 +987,16 @@ optional_policy(` +@@ -857,6 +991,16 @@ optional_policy(` ') optional_policy(` @@ -5685,7 +5697,7 @@ index 1a82e29..dfaef83 100644 seutil_sigchld_newrole(httpd_t) ') -@@ -865,6 +1005,7 @@ optional_policy(` +@@ -865,6 +1009,7 @@ optional_policy(` ') optional_policy(` @@ -5693,7 +5705,7 @@ index 1a82e29..dfaef83 100644 snmp_dontaudit_read_snmp_var_lib_files(httpd_t) snmp_dontaudit_write_snmp_var_lib_files(httpd_t) ') -@@ -877,65 +1018,166 @@ optional_policy(` +@@ -877,65 +1022,166 @@ optional_policy(` yam_read_content(httpd_t) ') @@ -5759,11 +5771,10 @@ index 1a82e29..dfaef83 100644 -',` - userdom_dontaudit_use_user_terminals(httpd_helper_t) + userdom_use_inherited_user_terminals(httpd_helper_t) - ') - - ######################################## - # --# Suexec local policy ++') ++ ++######################################## ++# +# Apache PHP script local policy +# + @@ -5822,10 +5833,11 @@ index 1a82e29..dfaef83 100644 + tunable_policy(`httpd_can_network_connect_db',` + postgresql_tcp_connect(httpd_php_t) + ') -+') -+ -+######################################## -+# + ') + + ######################################## + # +-# Suexec local policy +# Apache suexec local policy # @@ -5882,7 +5894,7 @@ index 1a82e29..dfaef83 100644 files_dontaudit_search_pids(httpd_suexec_t) files_search_home(httpd_suexec_t) -@@ -944,123 +1186,74 @@ auth_use_nsswitch(httpd_suexec_t) +@@ -944,123 +1190,74 @@ auth_use_nsswitch(httpd_suexec_t) logging_search_logs(httpd_suexec_t) logging_send_syslog_msg(httpd_suexec_t) @@ -6037,7 +6049,7 @@ index 1a82e29..dfaef83 100644 mysql_read_config(httpd_suexec_t) tunable_policy(`httpd_can_network_connect_db',` -@@ -1077,172 +1270,104 @@ optional_policy(` +@@ -1077,172 +1274,104 @@ optional_policy(` ') ') @@ -6065,13 +6077,13 @@ index 1a82e29..dfaef83 100644 - -kernel_dontaudit_search_sysctl(httpd_script_domains) -kernel_dontaudit_search_kernel_sysctl(httpd_script_domains) -- ++allow httpd_sys_script_t self:process getsched; + -corenet_all_recvfrom_unlabeled(httpd_script_domains) -corenet_all_recvfrom_netlabel(httpd_script_domains) -corenet_tcp_sendrecv_generic_if(httpd_script_domains) -corenet_tcp_sendrecv_generic_node(httpd_script_domains) -+allow httpd_sys_script_t self:process getsched; - +- -corecmd_exec_all_executables(httpd_script_domains) +allow httpd_sys_script_t httpd_t:unix_stream_socket rw_stream_socket_perms; +allow httpd_sys_script_t httpd_t:tcp_socket { read write }; @@ -6208,7 +6220,8 @@ index 1a82e29..dfaef83 100644 -allow httpd_sys_script_t httpd_t:tcp_socket { read write }; - -dontaudit httpd_sys_script_t httpd_config_t:dir search; -- ++corenet_all_recvfrom_netlabel(httpd_sys_script_t) + -allow httpd_sys_script_t httpd_squirrelmail_t:file { append_file_perms read_file_perms }; - -allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms; @@ -6234,8 +6247,7 @@ index 1a82e29..dfaef83 100644 - corenet_sendrecv_pop_client_packets(httpd_sys_script_t) - corenet_tcp_connect_pop_port(httpd_sys_script_t) - corenet_tcp_sendrecv_pop_port(httpd_sys_script_t) -+corenet_all_recvfrom_netlabel(httpd_sys_script_t) - +- - mta_send_mail(httpd_sys_script_t) - mta_signal_system_mail(httpd_sys_script_t) +tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',` @@ -6273,7 +6285,7 @@ index 1a82e29..dfaef83 100644 ') tunable_policy(`httpd_read_user_content',` -@@ -1250,64 +1375,70 @@ tunable_policy(`httpd_read_user_content',` +@@ -1250,64 +1379,70 @@ tunable_policy(`httpd_read_user_content',` ') tunable_policy(`httpd_use_cifs',` @@ -6367,7 +6379,7 @@ index 1a82e29..dfaef83 100644 ######################################## # -@@ -1315,8 +1446,15 @@ miscfiles_read_localization(httpd_rotatelogs_t) +@@ -1315,8 +1450,15 @@ miscfiles_read_localization(httpd_rotatelogs_t) # optional_policy(` @@ -6384,7 +6396,7 @@ index 1a82e29..dfaef83 100644 ') ######################################## -@@ -1324,49 +1462,36 @@ optional_policy(` +@@ -1324,49 +1466,36 @@ optional_policy(` # User content local policy # @@ -6448,7 +6460,7 @@ index 1a82e29..dfaef83 100644 kernel_read_system_state(httpd_passwd_t) corecmd_exec_bin(httpd_passwd_t) -@@ -1376,38 +1501,99 @@ dev_read_urand(httpd_passwd_t) +@@ -1376,38 +1505,99 @@ dev_read_urand(httpd_passwd_t) domain_use_interactive_fds(httpd_passwd_t) @@ -8727,7 +8739,7 @@ index 02fefaa..fbcef10 100644 + ') ') diff --git a/boinc.te b/boinc.te -index 7c92aa1..4d8b6ae 100644 +index 7c92aa1..0a48a05 100644 --- a/boinc.te +++ b/boinc.te @@ -1,11 +1,13 @@ @@ -8916,7 +8928,7 @@ index 7c92aa1..4d8b6ae 100644 term_getattr_all_ptys(boinc_t) term_getattr_unallocated_ttys(boinc_t) -@@ -130,55 +138,61 @@ init_read_utmp(boinc_t) +@@ -130,55 +138,65 @@ init_read_utmp(boinc_t) logging_send_syslog_msg(boinc_t) @@ -8944,7 +8956,11 @@ index 7c92aa1..4d8b6ae 100644 +allow boinc_t boinc_project_t:process sigkill; +allow boinc_t boinc_project_t:process noatsecure; + -+allow boinc_project_t self:process { ptrace setcap getcap setpgid setsched signal signull sigkill sigstop }; ++allow boinc_project_t self:process { setcap getcap setpgid setsched signal signull sigkill sigstop }; ++tunable_policy(`deny_ptrace',`',` ++ allow boinc_project_t self:process ptrace; ++') ++ +allow boinc_project_t self:process { execstack }; manage_dirs_pattern(boinc_project_t, boinc_project_tmp_t, boinc_project_tmp_t) @@ -9561,6 +9577,21 @@ index b85b53b..476aaa3 100644 ') optional_policy(` +diff --git a/cdrecord.if b/cdrecord.if +index fbc20f6..4de4a00 100644 +--- a/cdrecord.if ++++ b/cdrecord.if +@@ -27,6 +27,9 @@ interface(`cdrecord_role',` + + allow cdrecord_t $2:unix_stream_socket rw_socket_perms; + +- allow $2 cdrecord_t:process { ptrace signal_perms }; ++ allow $2 cdrecord_t:process signal_perms; ++ tunable_policy(`deny_ptrace',`',` ++ allow $2 cdrecord_t:process ptrace; ++ ') + ps_process_pattern($2, cdrecord_t) + ') diff --git a/cdrecord.te b/cdrecord.te index 55fb26a..a7555c0 100644 --- a/cdrecord.te @@ -10224,10 +10255,10 @@ index 0000000..efebae7 +') diff --git a/chrome.te b/chrome.te new file mode 100644 -index 0000000..a54bf63 +index 0000000..6300c78 --- /dev/null +++ b/chrome.te -@@ -0,0 +1,204 @@ +@@ -0,0 +1,205 @@ +policy_module(chrome,1.0.0) + +######################################## @@ -10259,6 +10290,7 @@ index 0000000..a54bf63 +# chrome_sandbox local policy +# +allow chrome_sandbox_t self:capability { chown dac_override fsetid setgid setuid sys_admin sys_chroot sys_ptrace }; ++dontaudit chrome_sandbox_t self:capability sys_nice; +allow chrome_sandbox_t self:process { signal_perms setrlimit execmem execstack }; +allow chrome_sandbox_t self:process setsched; +allow chrome_sandbox_t self:fifo_file manage_fifo_file_perms; @@ -11474,7 +11506,7 @@ index d8e9958..0046a69 100644 corosync_stream_connect(cmirrord_t) ') diff --git a/cobbler.if b/cobbler.if -index c223f81..1f3d0b7 100644 +index c223f81..b2efe4b 100644 --- a/cobbler.if +++ b/cobbler.if @@ -38,6 +38,28 @@ interface(`cobblerd_initrc_domtrans',` @@ -11506,6 +11538,14 @@ index c223f81..1f3d0b7 100644 ######################################## ## ## Read cobbler configuration files. +@@ -132,6 +154,7 @@ interface(`cobbler_manage_lib_files',` + + files_search_var_lib($1) + manage_files_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t) ++ manage_dirs_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t) + ') + + ######################################## diff --git a/cobbler.te b/cobbler.te index 2a71346..7b64dc9 100644 --- a/cobbler.te @@ -23632,10 +23672,22 @@ index 395238e..af76abb 100644 +userdom_use_inherited_user_terminals(giftd_t) +userdom_home_manager(gitd_t) diff --git a/git.if b/git.if -index 1e29af1..a1c464e 100644 +index 1e29af1..c67e44e 100644 --- a/git.if +++ b/git.if -@@ -79,3 +79,21 @@ interface(`git_read_generic_sys_content_files',` +@@ -37,7 +37,10 @@ template(`git_role',` + allow $2 git_user_content_t:file { exec_file_perms manage_file_perms relabel_file_perms }; + userdom_user_home_dir_filetrans($2, git_user_content_t, dir, "public_git") + +- allow $2 git_session_t:process { ptrace signal_perms }; ++ allow $2 git_session_t:process signal_perms; ++ tunable_policy(`deny_ptrace',`',` ++ allow $2 git_session_t:process ptrace; ++ ') + ps_process_pattern($2, git_session_t) + + tunable_policy(`git_session_users',` +@@ -79,3 +82,21 @@ interface(`git_read_generic_sys_content_files',` fs_read_nfs_files($1) ') ') @@ -28311,7 +28363,7 @@ index 48e7739..c3285c2 100644 /etc/irssi\.conf -- gen_context(system_u:object_r:irc_conf_t,s0) diff --git a/irc.if b/irc.if -index ac00fb0..53e4fc7 100644 +index ac00fb0..36ef2e5 100644 --- a/irc.if +++ b/irc.if @@ -20,6 +20,7 @@ interface(`irc_role',` @@ -28322,20 +28374,30 @@ index ac00fb0..53e4fc7 100644 ') ######################################## -@@ -39,10 +40,34 @@ interface(`irc_role',` - ps_process_pattern($2, irc_t) - allow $2 irc_t:process { ptrace signal_perms }; +@@ -37,12 +38,42 @@ interface(`irc_role',` + domtrans_pattern($2, irc_exec_t, irc_t) + ps_process_pattern($2, irc_t) +- allow $2 irc_t:process { ptrace signal_perms }; +- - allow $2 { irc_home_t irc_log_home_t irc_tmp_t }:dir { manage_dir_perms relabel_dir_perms }; - allow $2 { irc_home_t irc_log_home_t irc_tmp_t }:file { manage_file_perms relabel_file_perms }; - allow $2 { irc_home_t irc_log_home_t irc_tmp_t }:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms }; - userdom_user_home_dir_filetrans($2, irc_home_t, dir, ".irssi") - userdom_user_home_dir_filetrans($2, irc_home_t, file, ".ircmotd") - userdom_user_home_dir_filetrans($2, irc_log_home_t, dir, "irclogs") ++ allow $2 irc_t:process signal_perms; ++ tunable_policy(`deny_ptrace',`',` ++ allow $2 irc_t:process ptrace; ++ ') ++ + domtrans_pattern($2, irssi_exec_t, irssi_t) + -+ allow $2 irssi_t:process signal_perms; -+ ps_process_pattern($2, irssi_t) ++ allow $2 irssi_t:process signal_perms; ++ ps_process_pattern($2, irssi_t) ++ tunable_policy(`deny_ptrace',`',` ++ allow $2 irssi_t:process ptrace; ++ ') + + allow $2 { irc_home_t irc_log_home_t irc_tmp_t irssi_home_t }:dir { manage_dir_perms relabel_dir_perms }; + allow $2 { irc_home_t irc_log_home_t irc_tmp_t irssi_home_t }:file { manage_file_perms relabel_file_perms }; @@ -32832,19 +32894,24 @@ index e354181..c6b2383 100644 ######################################## diff --git a/livecd.te b/livecd.te -index 33f64b5..06b1661 100644 +index 33f64b5..dcffc00 100644 --- a/livecd.te +++ b/livecd.te -@@ -21,7 +21,7 @@ files_tmp_file(livecd_tmp_t) +@@ -21,9 +21,11 @@ files_tmp_file(livecd_tmp_t) # Local policy # -dontaudit livecd_t self:capability2 mac_admin; +allow livecd_t self:capability2 mac_admin; - domain_ptrace_all_domains(livecd_t) +-domain_ptrace_all_domains(livecd_t) ++tunable_policy(`deny_ptrace',`',` ++ domain_ptrace_all_domains(livecd_t) ++') -@@ -35,12 +35,13 @@ sysnet_etc_filetrans_config(livecd_t) + manage_dirs_pattern(livecd_t, livecd_tmp_t, livecd_tmp_t) + manage_files_pattern(livecd_t, livecd_tmp_t, livecd_tmp_t) +@@ -35,12 +37,13 @@ sysnet_etc_filetrans_config(livecd_t) optional_policy(` hal_dbus_chat(livecd_t) ') @@ -37051,7 +37118,7 @@ index 6194b80..116d9d2 100644 ') + diff --git a/mozilla.te b/mozilla.te -index 6a306ee..8faac8d 100644 +index 6a306ee..c2bf3d9 100644 --- a/mozilla.te +++ b/mozilla.te @@ -1,4 +1,4 @@ @@ -37149,7 +37216,7 @@ index 6a306ee..8faac8d 100644 ######################################## # # Local policy -@@ -75,23 +79,25 @@ optional_policy(` +@@ -75,27 +79,30 @@ optional_policy(` allow mozilla_t self:capability { sys_nice setgid setuid }; allow mozilla_t self:process { sigkill signal setsched getsched setrlimit }; allow mozilla_t self:fifo_file rw_fifo_file_perms; @@ -37187,7 +37254,13 @@ index 6a306ee..8faac8d 100644 manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) -@@ -103,76 +109,69 @@ manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) +-files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir }) ++# mozilla will manage user_tmp_t, so it will transition to it. ++#files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir }) + + manage_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) + manage_lnk_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) +@@ -103,76 +110,69 @@ manage_fifo_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file }) @@ -37295,7 +37368,7 @@ index 6a306ee..8faac8d 100644 term_dontaudit_getattr_pty_dirs(mozilla_t) -@@ -181,56 +180,73 @@ auth_use_nsswitch(mozilla_t) +@@ -181,56 +181,73 @@ auth_use_nsswitch(mozilla_t) logging_send_syslog_msg(mozilla_t) miscfiles_read_fonts(mozilla_t) @@ -37406,7 +37479,7 @@ index 6a306ee..8faac8d 100644 ') optional_policy(` -@@ -244,19 +260,12 @@ optional_policy(` +@@ -244,19 +261,12 @@ optional_policy(` optional_policy(` cups_read_rw_config(mozilla_t) @@ -37428,7 +37501,7 @@ index 6a306ee..8faac8d 100644 optional_policy(` networkmanager_dbus_chat(mozilla_t) -@@ -265,33 +274,32 @@ optional_policy(` +@@ -265,33 +275,32 @@ optional_policy(` optional_policy(` gnome_stream_connect_gconf(mozilla_t) @@ -37476,7 +37549,7 @@ index 6a306ee..8faac8d 100644 ') optional_policy(` -@@ -300,221 +308,173 @@ optional_policy(` +@@ -300,221 +309,173 @@ optional_policy(` ######################################## # @@ -37792,7 +37865,7 @@ index 6a306ee..8faac8d 100644 ') optional_policy(` -@@ -523,36 +483,47 @@ optional_policy(` +@@ -523,36 +484,47 @@ optional_policy(` ') optional_policy(` @@ -37853,7 +37926,7 @@ index 6a306ee..8faac8d 100644 ') optional_policy(` -@@ -560,7 +531,7 @@ optional_policy(` +@@ -560,7 +532,7 @@ optional_policy(` ') optional_policy(` @@ -37862,7 +37935,7 @@ index 6a306ee..8faac8d 100644 ') optional_policy(` -@@ -568,108 +539,108 @@ optional_policy(` +@@ -568,108 +540,109 @@ optional_policy(` ') optional_policy(` @@ -37877,6 +37950,7 @@ index 6a306ee..8faac8d 100644 + xserver_read_user_xauth(mozilla_plugin_t) + xserver_append_xdm_home_files(mozilla_plugin_t) + xserver_dontaudit_xdm_tmp_dirs(mozilla_plugin_t) ++ xserver_dontaudit_xdm_rw_stream_sockets(mozilla_plugin_t) + xserver_filetrans_fonts_cache_home_content(mozilla_plugin_t) ') @@ -42056,7 +42130,7 @@ index 0641e97..d7d9a79 100644 + admin_pattern($1, nrpe_etc_t) ') diff --git a/nagios.te b/nagios.te -index 44ad3b7..f675581 100644 +index 44ad3b7..5ba0194 100644 --- a/nagios.te +++ b/nagios.te @@ -27,7 +27,7 @@ type nagios_var_run_t; @@ -42182,15 +42256,17 @@ index 44ad3b7..f675581 100644 logging_send_syslog_msg(nagios_mail_plugin_t) sysnet_dns_name_resolve(nagios_mail_plugin_t) -@@ -345,6 +340,7 @@ allow nagios_checkdisk_plugin_t self:capability { sys_admin sys_rawio }; +@@ -345,6 +340,9 @@ allow nagios_checkdisk_plugin_t self:capability { sys_admin sys_rawio }; kernel_read_software_raid_state(nagios_checkdisk_plugin_t) ++corecmd_exec_bin(nagios_checkdisk_plugin_t) ++ +files_getattr_all_dirs(nagios_checkdisk_plugin_t) files_getattr_all_mountpoints(nagios_checkdisk_plugin_t) files_read_etc_runtime_files(nagios_checkdisk_plugin_t) -@@ -357,9 +353,11 @@ storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t) +@@ -357,9 +355,11 @@ storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t) # Services local policy # @@ -42204,7 +42280,7 @@ index 44ad3b7..f675581 100644 corecmd_exec_bin(nagios_services_plugin_t) -@@ -411,6 +409,7 @@ manage_files_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_ +@@ -411,6 +411,7 @@ manage_files_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_ manage_dirs_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_system_plugin_tmp_t) files_tmp_filetrans(nagios_system_plugin_t, nagios_system_plugin_tmp_t, { dir file }) @@ -42212,7 +42288,7 @@ index 44ad3b7..f675581 100644 kernel_read_kernel_sysctls(nagios_system_plugin_t) corecmd_exec_bin(nagios_system_plugin_t) -@@ -420,10 +419,10 @@ dev_read_sysfs(nagios_system_plugin_t) +@@ -420,10 +421,10 @@ dev_read_sysfs(nagios_system_plugin_t) domain_read_all_domains_state(nagios_system_plugin_t) @@ -42225,7 +42301,7 @@ index 44ad3b7..f675581 100644 optional_policy(` init_read_utmp(nagios_system_plugin_t) ') -@@ -442,6 +441,14 @@ corecmd_exec_shell(nagios_eventhandler_plugin_t) +@@ -442,6 +443,14 @@ corecmd_exec_shell(nagios_eventhandler_plugin_t) init_domtrans_script(nagios_eventhandler_plugin_t) @@ -42240,7 +42316,7 @@ index 44ad3b7..f675581 100644 ######################################## # # Unconfined plugin policy -@@ -450,3 +457,6 @@ init_domtrans_script(nagios_eventhandler_plugin_t) +@@ -450,3 +459,6 @@ init_domtrans_script(nagios_eventhandler_plugin_t) optional_policy(` unconfined_domain(nagios_unconfined_plugin_t) ') @@ -47857,10 +47933,10 @@ index 0000000..f2d6119 +/var/run/openshift(/.*)? gen_context(system_u:object_r:openshift_var_run_t,s0) diff --git a/openshift.if b/openshift.if new file mode 100644 -index 0000000..bf9505f +index 0000000..8a1731a --- /dev/null +++ b/openshift.if -@@ -0,0 +1,651 @@ +@@ -0,0 +1,654 @@ + +## policy for openshift + @@ -48254,7 +48330,7 @@ index 0000000..bf9505f +# +interface(`openshift_admin',` + gen_require(` -+ type openshift_t; ++ attribute openshift_domain; + type openshift_initrc_exec_t; + type openshift_cache_t; + type openshift_log_t; @@ -48262,8 +48338,11 @@ index 0000000..bf9505f + type openshift_var_run_t; + ') + -+ allow $1 openshift_t:process { ptrace signal_perms }; -+ ps_process_pattern($1, openshift_t) ++ allow $1 openshift_domain:process signal_perms; ++ tunable_policy(`deny_ptrace',`',` ++ allow $1 openshift_domain:process ptrace; ++ ') ++ ps_process_pattern($1, openshift_domain) + + openshift_initrc_domtrans($1) + domain_system_change_exemption($1) @@ -48514,10 +48593,10 @@ index 0000000..bf9505f +') diff --git a/openshift.te b/openshift.te new file mode 100644 -index 0000000..989a48d +index 0000000..461f551 --- /dev/null +++ b/openshift.te -@@ -0,0 +1,535 @@ +@@ -0,0 +1,541 @@ +policy_module(openshift,1.0.0) + +gen_require(` @@ -48644,7 +48723,11 @@ index 0000000..989a48d +# +# Policy for all openshift domains +# -+allow openshift_domain self:process all_process_perms; ++allow openshift_domain self:process ~ptrace; ++tunable_policy(`deny_ptrace',`',` ++ allow openshift_domain self:process ptrace; ++') ++ +allow openshift_domain self:msg all_msg_perms; +allow openshift_domain self:msgq create_msgq_perms; +allow openshift_domain self:shm create_shm_perms; @@ -48861,7 +48944,9 @@ index 0000000..989a48d +dontaudit openshift_domain openshift_user_domain:process signull; +dontaudit openshift_domain openshift_user_domain:socket_class_set { read write }; + -+allow openshift_user_domain openshift_domain:process ptrace; ++tunable_policy(`deny_ptrace',`',` ++ allow openshift_user_domain openshift_domain:process ptrace; ++') + +mta_signal_user_agent(openshift_user_domain) + @@ -49191,7 +49276,7 @@ index 45d7cc5..baf8d21 100644 -/var/run/openvswitch(/.*)? gen_context(system_u:object_r:openvswitch_var_run_t,s0) +/etc/openvswitch(/.*)? gen_context(system_u:object_r:openvswitch_rw_t,s0) diff --git a/openvswitch.if b/openvswitch.if -index 9b15730..6563dba 100644 +index 9b15730..eedd136 100644 --- a/openvswitch.if +++ b/openvswitch.if @@ -1,13 +1,14 @@ @@ -49255,9 +49340,10 @@ index 9b15730..6563dba 100644 + logging_search_logs($1) + append_files_pattern($1, openvswitch_log_t, openvswitch_log_t) +') -+ -+######################################## -+## + + ######################################## + ## +-## Read openvswitch pid files. +## Manage openvswitch log files +## +## @@ -49333,10 +49419,9 @@ index 9b15730..6563dba 100644 + files_search_var_lib($1) + manage_files_pattern($1, openvswitch_var_lib_t, openvswitch_var_lib_t) +') - - ######################################## - ## --## Read openvswitch pid files. ++ ++######################################## ++## +## Manage openvswitch lib directories. +## +## @@ -49360,22 +49445,41 @@ index 9b15730..6563dba 100644 ## ## ## -@@ -40,44 +176,66 @@ interface(`openvswitch_read_pid_files',` +@@ -40,44 +176,86 @@ interface(`openvswitch_read_pid_files',` ######################################## ## -## All of the rules required to -## administrate an openvswitch environment. -+## Execute openvswitch server in the openvswitch domain. ++## Allow stream connect to openvswitch. ## ## ## --## Domain allowed access. -+## Domain allowed to transition. + ## Domain allowed access. ## ## -## +# ++ ++interface(`openvswitch_stream_connect',` ++ gen_require(` ++ type openvswitch_t, openvswitch_var_run_t; ++ ') ++ ++ files_search_pids($1) ++ stream_connect_pattern($1, openvswitch_var_run_t, openvswitch_var_run_t, openvswitch_t) ++') ++ ++######################################## ++## ++## Execute openvswitch server in the openvswitch domain. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# +interface(`openvswitch_systemctl',` + gen_require(` + type openvswitch_t; @@ -54844,7 +54948,7 @@ index 2e23946..589bbf2 100644 + postfix_config_filetrans($1, postfix_prng_t, file, "prng_exch") ') diff --git a/postfix.te b/postfix.te -index 191a66f..7ceaec2 100644 +index 191a66f..7bb7d5b 100644 --- a/postfix.te +++ b/postfix.te @@ -1,4 +1,4 @@ @@ -55444,7 +55548,7 @@ index 191a66f..7ceaec2 100644 # allow postfix_pipe_t self:process setrlimit; -@@ -576,19 +495,25 @@ optional_policy(` +@@ -576,19 +495,26 @@ optional_policy(` ######################################## # @@ -55459,6 +55563,7 @@ index 191a66f..7ceaec2 100644 + +# Might be a leak, but I need a postfix expert to explain +allow postfix_postdrop_t postfix_local_t:unix_stream_socket { read write }; ++allow postfix_postdrop_t postfix_master_t:unix_stream_socket connectto; rw_fifo_files_pattern(postfix_postdrop_t, postfix_public_t, postfix_public_t) +rw_sock_files_pattern(postfix_postdrop_t, postfix_public_t, postfix_public_t) @@ -55475,7 +55580,7 @@ index 191a66f..7ceaec2 100644 term_dontaudit_use_all_ptys(postfix_postdrop_t) term_dontaudit_use_all_ttys(postfix_postdrop_t) -@@ -603,10 +528,7 @@ optional_policy(` +@@ -603,10 +529,7 @@ optional_policy(` cron_system_entry(postfix_postdrop_t, postfix_postdrop_exec_t) ') @@ -55487,7 +55592,7 @@ index 191a66f..7ceaec2 100644 optional_policy(` fstools_read_pipes(postfix_postdrop_t) ') -@@ -621,17 +543,23 @@ optional_policy(` +@@ -621,17 +544,23 @@ optional_policy(` ####################################### # @@ -55514,7 +55619,7 @@ index 191a66f..7ceaec2 100644 init_sigchld_script(postfix_postqueue_t) init_use_script_fds(postfix_postqueue_t) -@@ -647,67 +575,77 @@ optional_policy(` +@@ -647,67 +576,77 @@ optional_policy(` ######################################## # @@ -55610,7 +55715,7 @@ index 191a66f..7ceaec2 100644 ') optional_policy(` -@@ -720,24 +658,27 @@ optional_policy(` +@@ -720,24 +659,27 @@ optional_policy(` ######################################## # @@ -55644,7 +55749,7 @@ index 191a66f..7ceaec2 100644 fs_getattr_all_dirs(postfix_smtpd_t) fs_getattr_all_fs(postfix_smtpd_t) -@@ -754,6 +695,7 @@ optional_policy(` +@@ -754,6 +696,7 @@ optional_policy(` optional_policy(` milter_stream_connect_all(postfix_smtpd_t) @@ -55652,7 +55757,7 @@ index 191a66f..7ceaec2 100644 ') optional_policy(` -@@ -764,31 +706,100 @@ optional_policy(` +@@ -764,31 +707,100 @@ optional_policy(` sasl_connect(postfix_smtpd_t) ') @@ -61929,7 +62034,7 @@ index afc0068..7616aa4 100644 + ') ') diff --git a/quantum.te b/quantum.te -index 769d1fd..7e6e161 100644 +index 769d1fd..5bbd65f 100644 --- a/quantum.te +++ b/quantum.te @@ -21,6 +21,9 @@ files_tmp_file(quantum_tmp_t) @@ -61966,12 +62071,17 @@ index 769d1fd..7e6e161 100644 sysnet_domtrans_ifconfig(quantum_t) optional_policy(` -@@ -94,3 +96,7 @@ optional_policy(` +@@ -94,3 +96,12 @@ optional_policy(` postgresql_tcp_connect(quantum_t) ') + +optional_policy(` ++ openvswitch_domtrans(quantum_t) ++ openvswitch_stream_connect(quantum_t) ++') ++ ++optional_policy(` + sudo_exec(quantum_t) +') diff --git a/quota.fc b/quota.fc @@ -65118,7 +65228,7 @@ index 56bc01f..895e16e 100644 + allow $1 cluster_unit_file_t:service all_service_perms; ') diff --git a/rhcs.te b/rhcs.te -index 2c2de9a..c839537 100644 +index 2c2de9a..38a33d7 100644 --- a/rhcs.te +++ b/rhcs.te @@ -20,6 +20,27 @@ gen_tunable(fenced_can_network_connect, false) @@ -65515,7 +65625,7 @@ index 2c2de9a..c839537 100644 ####################################### # # foghorn local policy -@@ -223,14 +493,15 @@ corenet_tcp_sendrecv_agentx_port(foghorn_t) +@@ -223,14 +493,16 @@ corenet_tcp_sendrecv_agentx_port(foghorn_t) dev_read_urand(foghorn_t) @@ -65529,11 +65639,12 @@ index 2c2de9a..c839537 100644 optional_policy(` - snmp_read_snmp_var_lib_files(foghorn_t) -+ snmp_manage_var_lib_dirs(foghorn_t) ++ #snmp_manage_var_lib_dirs(foghorn_t) ++ snmp_manage_var_lib_files(foghorn_t) snmp_stream_connect(foghorn_t) ') -@@ -257,6 +528,8 @@ storage_getattr_removable_dev(gfs_controld_t) +@@ -257,6 +529,8 @@ storage_getattr_removable_dev(gfs_controld_t) init_rw_script_tmp_files(gfs_controld_t) @@ -65542,7 +65653,7 @@ index 2c2de9a..c839537 100644 optional_policy(` lvm_exec(gfs_controld_t) dev_rw_lvm_control(gfs_controld_t) -@@ -275,10 +548,10 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) +@@ -275,10 +549,10 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) dev_list_sysfs(groupd_t) @@ -65555,7 +65666,7 @@ index 2c2de9a..c839537 100644 ###################################### # # qdiskd local policy -@@ -321,6 +594,8 @@ storage_raw_write_fixed_disk(qdiskd_t) +@@ -321,6 +595,8 @@ storage_raw_write_fixed_disk(qdiskd_t) auth_use_nsswitch(qdiskd_t) @@ -68129,7 +68240,7 @@ index ebe91fc..1609333 100644 +/sbin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0) ') diff --git a/rpm.if b/rpm.if -index 0628d50..c73d362 100644 +index 0628d50..84f2fd7 100644 --- a/rpm.if +++ b/rpm.if @@ -1,8 +1,8 @@ @@ -68493,16 +68604,37 @@ index 0628d50..c73d362 100644 ## ## ## -@@ -504,7 +565,7 @@ interface(`rpm_manage_db',` +@@ -503,8 +564,28 @@ interface(`rpm_manage_db',` + ######################################## ## ++## Do not audit attempts to create, read,the RPM package database. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`rpm_dontaudit_read_db',` ++ gen_require(` ++ type rpm_var_lib_t; ++ ') ++ ++ dontaudit $1 rpm_var_lib_t:dir list_dir_perms; ++ dontaudit $1 rpm_var_lib_t:file read_file_perms; ++ dontaudit $1 rpm_var_lib_t:lnk_file read_lnk_file_perms; ++') ++ ++######################################## ++## ## Do not audit attempts to create, read, -## write, and delete rpm lib content. +## write, and delete the RPM package database. ## ## ## -@@ -517,7 +578,7 @@ interface(`rpm_dontaudit_manage_db',` +@@ -517,7 +598,7 @@ interface(`rpm_dontaudit_manage_db',` type rpm_var_lib_t; ') @@ -68511,7 +68643,7 @@ index 0628d50..c73d362 100644 dontaudit $1 rpm_var_lib_t:file manage_file_perms; dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms; ') -@@ -543,8 +604,7 @@ interface(`rpm_read_pid_files',` +@@ -543,8 +624,7 @@ interface(`rpm_read_pid_files',` ##################################### ## @@ -68521,7 +68653,7 @@ index 0628d50..c73d362 100644 ## ## ## -@@ -563,8 +623,7 @@ interface(`rpm_manage_pid_files',` +@@ -563,8 +643,7 @@ interface(`rpm_manage_pid_files',` ###################################### ## @@ -68531,7 +68663,7 @@ index 0628d50..c73d362 100644 ## ## ## -@@ -573,94 +632,72 @@ interface(`rpm_manage_pid_files',` +@@ -573,94 +652,72 @@ interface(`rpm_manage_pid_files',` ## # interface(`rpm_pid_filetrans',` @@ -68632,12 +68764,12 @@ index 0628d50..c73d362 100644 - allow $2 system_r; - - admin_pattern($1, rpm_file_t) -- -- files_list_var($1) -- admin_pattern($1, rpm_cache_t) + typeattribute $1 rpm_transition_domain; + allow $1 rpm_script_t:process transition; +- files_list_var($1) +- admin_pattern($1, rpm_cache_t) +- - files_list_tmp($1) - admin_pattern($1, { rpm_tmp_t rpm_script_tmp_t }) - @@ -70849,7 +70981,7 @@ index aee75af..a6bab06 100644 + allow $1 samba_unit_file_t:service all_service_perms; ') diff --git a/samba.te b/samba.te -index 57c034b..b2eac61 100644 +index 57c034b..b4a043c 100644 --- a/samba.te +++ b/samba.te @@ -1,4 +1,4 @@ @@ -71929,7 +72061,7 @@ index 57c034b..b2eac61 100644 optional_policy(` ctdbd_stream_connect(winbind_t) -@@ -936,6 +937,10 @@ optional_policy(` +@@ -936,7 +937,12 @@ optional_policy(` ') optional_policy(` @@ -71938,9 +72070,11 @@ index 57c034b..b2eac61 100644 + +optional_policy(` kerberos_use(winbind_t) ++ kerberos_filetrans_named_content(winbind_t) ') -@@ -952,31 +957,29 @@ optional_policy(` + optional_policy(` +@@ -952,31 +958,29 @@ optional_policy(` # Winbind helper local policy # @@ -71978,7 +72112,7 @@ index 57c034b..b2eac61 100644 optional_policy(` apache_append_log(winbind_helper_t) -@@ -990,25 +993,38 @@ optional_policy(` +@@ -990,25 +994,38 @@ optional_policy(` ######################################## # @@ -77350,7 +77484,7 @@ index 1499b0b..3052bd2 100644 - spamassassin_role($2, $1) ') diff --git a/spamassassin.te b/spamassassin.te -index 4faa7e0..1485a62 100644 +index 4faa7e0..4babad1 100644 --- a/spamassassin.te +++ b/spamassassin.te @@ -1,4 +1,4 @@ @@ -77863,14 +77997,16 @@ index 4faa7e0..1485a62 100644 logging_log_filetrans(spamd_t, spamd_log_t, file) manage_dirs_pattern(spamd_t, spamd_spool_t, spamd_spool_t) -@@ -308,6 +403,7 @@ manage_dirs_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t) +@@ -308,7 +403,8 @@ manage_dirs_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t) manage_files_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t) files_tmp_filetrans(spamd_t, spamd_tmp_t, { file dir }) +-allow spamd_t spamd_var_lib_t:dir list_dir_perms; +# var/lib files for spamd - allow spamd_t spamd_var_lib_t:dir list_dir_perms; ++manage_dirs_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t) manage_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t) manage_lnk_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t) + @@ -317,12 +413,13 @@ manage_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t) manage_sock_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t) files_pid_filetrans(spamd_t, spamd_var_run_t, { file dir }) @@ -87915,6 +88051,23 @@ index 9ead775..b5285e7 100644 userdom_dontaudit_search_user_home_dirs(vlock_t) -userdom_use_user_terminals(vlock_t) +userdom_use_inherited_user_terminals(vlock_t) +diff --git a/vmware.if b/vmware.if +index 20a1fb2..470ea95 100644 +--- a/vmware.if ++++ b/vmware.if +@@ -26,7 +26,11 @@ interface(`vmware_role',` + domtrans_pattern($2, vmware_exec_t, vmware_t) + + ps_process_pattern($2, vmware_t) +- allow $2 vmware_t:process { ptrace signal_perms }; ++ allow $2 vmware_t:process signal_perms; ++ ++ tunable_policy(`deny_ptrace',`',` ++ allow $2 vmware_t:process ptrace; ++ ') + + allow $2 { vmware_tmp_t vmware_file_t }:dir { manage_dir_perms relabel_dir_perms }; + allow $2 { vmware_conf_t vmware_file_t vmware_tmp_t vmware_tmpfs_t }:file { manage_file_perms relabel_file_perms }; diff --git a/vmware.te b/vmware.te index 3a56513..5721057 100644 --- a/vmware.te diff --git a/selinux-policy.spec b/selinux-policy.spec index 202c048..d07c798 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.12.1 -Release: 29%{?dist} +Release: 30%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -526,7 +526,31 @@ SELinux Reference policy mls base module. %endif %changelog -* Thu Apr 11 2013 Miroslav Grepl 3.12.1-29 +* Mon Apr 15 2013 Miroslav Grepl 3.12.1-30 +- Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms... +- Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets +- Fix deny_ptrace boolean, certain ptrace leaked into the system +- Allow winbind to manage kerberos_rcache_host +- Allow spamd to create spamd_var_lib_t directories +- Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs +- Add mising nslcd_dontaudit_write_sock_file() interface +- one more fix +- Fix pki_read_tomcat_lib_files() interface +- Allow certmonger to read pki-tomcat lib files +- Allow certwatch to execute bin_t +- Allow snmp to manage /var/lib/net-snmp files +- Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs +- Fix vmware_role() interface +- Fix cobbler_manage_lib_files() interface +- Allow nagios check disk plugins to execute bin_t +- Allow quantum to transition to openvswitch_t +- Allow postdrop to stream connect to postfix-master +- Allow quantum to stream connect to openvswitch +- Add xserver_dontaudit_xdm_rw_stream_sockets() interface +- Allow daemon to send dgrams to initrc_t +- Allow kdm to start the power service to initiate a reboot or poweroff + +* Thu Apr 11 2013 Miroslav Grepl 3.12.1-29 - Add mising nslcd_dontaudit_write_sock_file() interface - one more fix - Fix pki_read_tomcat_lib_files() interface