From 7c9448b0b9a9250ed95dbc8a5c406b40ecb1bc34 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Jun 05 2012 08:50:38 +0000 Subject: Fix merge for the first group based on "a" letter --- diff --git a/acct.if b/acct.if index 3c48163..993a1e9 100644 --- a/acct.if +++ b/acct.if @@ -78,7 +78,6 @@ interface(`acct_manage_data',` manage_files_pattern($1, acct_data_t, acct_data_t) manage_lnk_files_pattern($1, acct_data_t, acct_data_t) ') -<<<<<<< HEAD ######################################## ## @@ -97,5 +96,3 @@ interface(`acct_dontaudit_list_data',` dontaudit $1 acct_data_t:dir list_dir_perms; ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 diff --git a/acct.te b/acct.te index 6acedf9..1627428 100644 --- a/acct.te +++ b/acct.te @@ -55,11 +55,8 @@ files_list_usr(acct_t) # for nscd files_dontaudit_search_pids(acct_t) -<<<<<<< HEAD auth_use_nsswitch(acct_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 init_use_fds(acct_t) init_use_script_ptys(acct_t) init_exec_script_files(acct_t) @@ -82,13 +79,10 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD -======= nscd_socket_use(acct_t) ') optional_policy(` ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 seutil_sigchld_newrole(acct_t) ') diff --git a/ada.te b/ada.te index e61be11..057d8b1 100644 --- a/ada.te +++ b/ada.te @@ -17,11 +17,7 @@ role system_r types ada_t; allow ada_t self:process { execstack execmem }; -<<<<<<< HEAD userdom_use_inherited_user_terminals(ada_t) -======= -userdom_use_user_terminals(ada_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 optional_policy(` unconfined_domain(ada_t) diff --git a/afs.if b/afs.if index 6ffafe4..641044e 100644 --- a/afs.if +++ b/afs.if @@ -97,17 +97,12 @@ interface(`afs_admin',` type afs_t, afs_initrc_exec_t; ') -<<<<<<< HEAD allow $1 afs_t:process signal_perms; ps_process_pattern($1, afs_t) tunable_policy(`deny_ptrace',`',` allow $1 afs_t:process ptrace; ') -======= - allow $1 afs_t:process { ptrace signal_perms getattr }; - read_files_pattern($1, afs_t, afs_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # Allow afs_admin to restart the afs service afs_initrc_domtrans($1) diff --git a/afs.te b/afs.te index 7c15a4e..847609a 100644 --- a/afs.te +++ b/afs.te @@ -107,13 +107,10 @@ miscfiles_read_localization(afs_t) sysnet_dns_name_resolve(afs_t) -<<<<<<< HEAD ifdef(`hide_broken_symptoms',` kernel_rw_unlabeled_files(afs_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # # AFS bossserver local policy diff --git a/aiccu.te b/aiccu.te index c6f6e94..4114d9b 100644 --- a/aiccu.te +++ b/aiccu.te @@ -45,17 +45,11 @@ corecmd_exec_shell(aiccu_t) corenet_all_recvfrom_netlabel(aiccu_t) corenet_all_recvfrom_unlabeled(aiccu_t) -<<<<<<< HEAD corenet_tcp_bind_generic_node(aiccu_t) corenet_tcp_sendrecv_generic_if(aiccu_t) corenet_tcp_sendrecv_generic_node(aiccu_t) corenet_tcp_sendrecv_generic_port(aiccu_t) corenet_sendrecv_sixxsconfig_client_packets(aiccu_t) -======= -corenet_tcp_sendrecv_generic_if(aiccu_t) -corenet_tcp_sendrecv_generic_node(aiccu_t) -corenet_tcp_sendrecv_generic_port(aiccu_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 corenet_tcp_sendrecv_sixxsconfig_port(aiccu_t) corenet_tcp_bind_generic_node(aiccu_t) corenet_tcp_connect_sixxsconfig_port(aiccu_t) diff --git a/aide.fc b/aide.fc index 4c4553f..7798464 100644 --- a/aide.fc +++ b/aide.fc @@ -1,12 +1,6 @@ -<<<<<<< HEAD -/usr/sbin/aide -- gen_context(system_u:object_r:aide_exec_t,s0) - -/var/lib/aide(/.*)? gen_context(system_u:object_r:aide_db_t,mls_systemhigh) -======= /usr/sbin/aide -- gen_context(system_u:object_r:aide_exec_t,mls_systemhigh) /var/lib/aide(/.*) gen_context(system_u:object_r:aide_db_t,mls_systemhigh) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /var/log/aide(/.*)? gen_context(system_u:object_r:aide_log_t,mls_systemhigh) /var/log/aide\.log -- gen_context(system_u:object_r:aide_log_t,mls_systemhigh) diff --git a/aide.if b/aide.if index 7afe8e2..33981e0 100644 --- a/aide.if +++ b/aide.if @@ -33,10 +33,6 @@ interface(`aide_domtrans',` ## The role to allow the AIDE domain. ## ## -<<<<<<< HEAD -## -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # interface(`aide_run',` gen_require(` @@ -64,7 +60,6 @@ interface(`aide_admin',` type aide_t, aide_db_t, aide_log_t; ') -<<<<<<< HEAD allow $1 aide_t:process signal_perms; ps_process_pattern($1, aide_t) @@ -72,11 +67,6 @@ interface(`aide_admin',` allow $1 aide_t:process ptrace; ') -======= - allow $1 aide_t:process { ptrace signal_perms }; - ps_process_pattern($1, aide_t) - ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 files_list_etc($1) admin_pattern($1, aide_db_t) diff --git a/aide.te b/aide.te index 6585674..289b753 100644 --- a/aide.te +++ b/aide.te @@ -49,8 +49,4 @@ logging_send_syslog_msg(aide_t) seutil_use_newrole_fds(aide_t) -<<<<<<< HEAD userdom_use_inherited_user_terminals(aide_t) -======= -userdom_use_user_terminals(aide_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 diff --git a/aisexec.if b/aisexec.if index 7506caf..c2d68a4 100644 --- a/aisexec.if +++ b/aisexec.if @@ -5,15 +5,9 @@ ## Execute a domain transition to run aisexec. ## ## -<<<<<<< HEAD -## -## Domain allowed to transition. -## -======= ## ## Domain allowed to transition. ## ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## # interface(`aisexec_domtrans',` @@ -88,7 +82,6 @@ interface(`aisexecd_admin',` type aisexec_initrc_exec_t; ') -<<<<<<< HEAD allow $1 aisexec_t:process signal_perms; ps_process_pattern($1, aisexec_t) @@ -96,11 +89,6 @@ interface(`aisexecd_admin',` allow $1 aisexec_t:process ptrace; ') -======= - allow $1 aisexec_t:process { ptrace signal_perms }; - ps_process_pattern($1, aisexec_t) - ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 init_labeled_script_domtrans($1, aisexec_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 aisexec_initrc_exec_t system_r; diff --git a/aisexec.te b/aisexec.te index 9b8b1de..7fa5ec1 100644 --- a/aisexec.te +++ b/aisexec.te @@ -1,8 +1,4 @@ -<<<<<<< HEAD -policy_module(aisexec, 1.0.1) -======= policy_module(aisexec, 1.1.0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # @@ -68,10 +64,7 @@ files_pid_filetrans(aisexec_t, aisexec_var_run_t, { file sock_file }) kernel_read_system_state(aisexec_t) corecmd_exec_bin(aisexec_t) -<<<<<<< HEAD corecmd_exec_shell(aisexec_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 corenet_udp_bind_netsupport_port(aisexec_t) corenet_tcp_bind_reserved_port(aisexec_t) @@ -97,13 +90,10 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD corosync_domtrans(aisexec_t) ') optional_policy(` -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # to communication with RHCS rhcs_rw_dlm_controld_semaphores(aisexec_t) diff --git a/alsa.fc b/alsa.fc index 3cd5fc3..230a2f6 100644 --- a/alsa.fc +++ b/alsa.fc @@ -11,22 +11,14 @@ HOME_DIR/\.asoundrc -- gen_context(system_u:object_r:alsa_home_t,s0) /sbin/salsa -- gen_context(system_u:object_r:alsa_exec_t,s0) /usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0) -<<<<<<< HEAD /usr/bin/alsaunmute -- gen_context(system_u:object_r:alsa_exec_t,s0) /usr/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0) /usr/sbin/salsa -- gen_context(system_u:object_r:alsa_exec_t,s0) -======= - -/usr/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /usr/share/alsa/alsa\.conf gen_context(system_u:object_r:alsa_etc_rw_t,s0) /usr/share/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0) /var/lib/alsa(/.*)? gen_context(system_u:object_r:alsa_var_lib_t,s0) -<<<<<<< HEAD /usr/lib/systemd/system/alsa.* -- gen_context(system_u:object_r:alsa_unit_file_t,s0) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 diff --git a/alsa.te b/alsa.te index 4ffc7f2..b688045 100644 --- a/alsa.te +++ b/alsa.te @@ -1,8 +1,4 @@ -<<<<<<< HEAD -policy_module(alsa, 1.10.2) -======= policy_module(alsa, 1.11.0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # @@ -26,12 +22,9 @@ files_type(alsa_var_lib_t) type alsa_home_t; userdom_user_home_content(alsa_home_t) -<<<<<<< HEAD type alsa_unit_file_t; systemd_unit_file(alsa_unit_file_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # # Local policy diff --git a/amanda.fc b/amanda.fc index 445a8e4..967c1ef 100644 --- a/amanda.fc +++ b/amanda.fc @@ -7,15 +7,9 @@ /root/restore -d gen_context(system_u:object_r:amanda_recover_dir_t,s0) -<<<<<<< HEAD -/usr/lib/amanda -d gen_context(system_u:object_r:amanda_usr_lib_t,s0) -/usr/lib/amanda/.+ -- gen_context(system_u:object_r:amanda_exec_t,s0) -/usr/lib/amanda/amandad -- gen_context(system_u:object_r:amanda_inetd_exec_t,s0) -======= /usr/lib/amanda -d gen_context(system_u:object_r:amanda_usr_lib_t,s0) /usr/lib/amanda/.+ -- gen_context(system_u:object_r:amanda_exec_t,s0) /usr/lib/amanda/amandad -- gen_context(system_u:object_r:amanda_inetd_exec_t,s0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /usr/lib/amanda/amidxtaped -- gen_context(system_u:object_r:amanda_inetd_exec_t,s0) /usr/lib/amanda/amindexd -- gen_context(system_u:object_r:amanda_inetd_exec_t,s0) diff --git a/amanda.te b/amanda.te index 04c9fc0..ae601d8 100644 --- a/amanda.te +++ b/amanda.te @@ -1,8 +1,4 @@ -<<<<<<< HEAD -policy_module(amanda, 1.13.0) -======= policy_module(amanda, 1.13.1) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ####################################### # @@ -62,11 +58,7 @@ optional_policy(` # allow amanda_t self:capability { chown dac_override setuid kill }; -<<<<<<< HEAD allow amanda_t self:process { getsched setsched setpgid signal }; -======= -allow amanda_t self:process { setpgid signal }; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 allow amanda_t self:fifo_file rw_fifo_file_perms; allow amanda_t self:unix_stream_socket create_stream_socket_perms; allow amanda_t self:unix_dgram_socket create_socket_perms; @@ -79,10 +71,7 @@ allow amanda_t amanda_config_t:file read_file_perms; manage_dirs_pattern(amanda_t, amanda_data_t, amanda_data_t) manage_files_pattern(amanda_t, amanda_data_t, amanda_data_t) -<<<<<<< HEAD manage_lnk_files_pattern(amanda_t, amanda_data_t, amanda_data_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 filetrans_pattern(amanda_t, amanda_config_t, amanda_data_t, { file dir }) allow amanda_t amanda_dumpdates_t:file rw_file_perms; @@ -212,17 +201,13 @@ files_search_pids(amanda_recover_t) auth_use_nsswitch(amanda_recover_t) -<<<<<<< HEAD -======= fstools_domtrans(amanda_t) fstools_signal(amanda_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 logging_search_logs(amanda_recover_t) miscfiles_read_localization(amanda_recover_t) -<<<<<<< HEAD userdom_use_inherited_user_terminals(amanda_recover_t) userdom_search_user_home_content(amanda_recover_t) @@ -230,7 +215,3 @@ optional_policy(` fstools_domtrans(amanda_t) fstools_signal(amanda_t) ') -======= -userdom_use_user_terminals(amanda_recover_t) -userdom_search_user_home_content(amanda_recover_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 diff --git a/amavis.fc b/amavis.fc index 5fcbde1..446ee16 100644 --- a/amavis.fc +++ b/amavis.fc @@ -1,9 +1,5 @@ -<<<<<<< HEAD -/etc/amavis\.conf -- gen_context(system_u:object_r:amavis_etc_t,s0) -======= /etc/amavis(d)?\.conf -- gen_context(system_u:object_r:amavis_etc_t,s0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /etc/amavisd(/.*)? gen_context(system_u:object_r:amavis_etc_t,s0) /etc/rc\.d/init\.d/amavis -- gen_context(system_u:object_r:amavis_initrc_exec_t,s0) diff --git a/amavis.if b/amavis.if index a54a2e3..e515cb8 100644 --- a/amavis.if +++ b/amavis.if @@ -231,7 +231,6 @@ interface(`amavis_admin',` type amavis_initrc_exec_t; ') -<<<<<<< HEAD allow $1 amavis_t:process signal_perms; ps_process_pattern($1, amavis_t) @@ -239,11 +238,6 @@ interface(`amavis_admin',` allow $1 amavis_t:process ptrace; ') -======= - allow $1 amavis_t:process { ptrace signal_perms }; - ps_process_pattern($1, amavis_t) - ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 amavis_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 amavis_initrc_exec_t system_r; diff --git a/amavis.te b/amavis.te index aaac7d8..b310d7a 100644 --- a/amavis.te +++ b/amavis.te @@ -1,8 +1,4 @@ -<<<<<<< HEAD -policy_module(amavis, 1.11.1) -======= policy_module(amavis, 1.13.1) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # @@ -42,11 +38,7 @@ type amavis_quarantine_t; files_type(amavis_quarantine_t) type amavis_spool_t; -<<<<<<< HEAD files_spool_file(amavis_spool_t) -======= -files_type(amavis_spool_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # @@ -136,10 +128,7 @@ corenet_tcp_connect_razor_port(amavis_t) dev_read_rand(amavis_t) dev_read_urand(amavis_t) -<<<<<<< HEAD dev_read_sysfs(amavis_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 domain_use_interactive_fds(amavis_t) @@ -149,10 +138,7 @@ files_read_usr_files(amavis_t) fs_getattr_xattr_fs(amavis_t) -<<<<<<< HEAD auth_use_nsswitch(amavis_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 auth_dontaudit_read_shadow(amavis_t) # uses uptime which reads utmp - redhat bug 561383 @@ -169,23 +155,12 @@ sysnet_use_ldap(amavis_t) userdom_dontaudit_search_user_home_dirs(amavis_t) -<<<<<<< HEAD -======= -# Cron handling -cron_use_fds(amavis_t) -cron_use_system_job_fds(amavis_t) -cron_rw_pipes(amavis_t) - -mta_read_config(amavis_t) - ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 optional_policy(` clamav_stream_connect(amavis_t) clamav_domtrans_clamscan(amavis_t) ') optional_policy(` -<<<<<<< HEAD #Cron handling cron_use_fds(amavis_t) cron_use_system_job_fds(amavis_t) @@ -193,20 +168,15 @@ optional_policy(` ') optional_policy(` -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 dcc_domtrans_client(amavis_t) dcc_stream_connect_dccifd(amavis_t) ') optional_policy(` -<<<<<<< HEAD mta_read_config(amavis_t) ') optional_policy(` -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 nslcd_stream_connect(amavis_t) ') diff --git a/amtu.te b/amtu.te index 70ae7d2..c75e9e9 100644 --- a/amtu.te +++ b/amtu.te @@ -23,11 +23,7 @@ files_read_etc_files(amtu_t) logging_send_audit_msgs(amtu_t) -<<<<<<< HEAD userdom_use_inherited_user_terminals(amtu_t) -======= -userdom_use_user_terminals(amtu_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 optional_policy(` nscd_dontaudit_search_pid(amtu_t) diff --git a/anaconda.te b/anaconda.te index 23ac0a9..63ab279 100644 --- a/anaconda.te +++ b/anaconda.te @@ -22,12 +22,6 @@ kernel_domtrans_to(anaconda_t, anaconda_exec_t) init_domtrans_script(anaconda_t) -<<<<<<< HEAD -logging_send_syslog_msg(anaconda_t) - -seutil_domtrans_semanage(anaconda_t) -seutil_domtrans_setsebool(anaconda_t) -======= libs_domtrans_ldconfig(anaconda_t) logging_send_syslog_msg(anaconda_t) @@ -36,7 +30,7 @@ modutils_domtrans_insmod(anaconda_t) modutils_domtrans_depmod(anaconda_t) seutil_domtrans_semanage(anaconda_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 +seutil_domtrans_setsebool(anaconda_t) userdom_user_home_dir_filetrans_user_home_content(anaconda_t, { dir file lnk_file fifo_file sock_file }) @@ -45,13 +39,6 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD - modutils_domtrans_insmod(anaconda_t) - modutils_domtrans_depmod(anaconda_t) -') -optional_policy(` -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 rpm_domtrans(anaconda_t) rpm_domtrans_script(anaconda_t) ') @@ -65,11 +52,7 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD unconfined_domain_noaudit(anaconda_t) -======= - unconfined_domain(anaconda_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') optional_policy(` diff --git a/apache.fc b/apache.fc index 43e4458..84bc8d6 100644 --- a/apache.fc +++ b/apache.fc @@ -1,5 +1,4 @@ HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0) -<<<<<<< HEAD HOME_DIR/((www)|(web)|(public_html))/cgi-bin(/.+)? gen_context(system_u:object_r:httpd_user_script_exec_t,s0) HOME_DIR/((www)|(web)|(public_html))(/.*)?/\.htaccess -- gen_context(system_u:object_r:httpd_user_htaccess_t,s0) HOME_DIR/((www)|(web)|(public_html))(/.*)?/logs(/.*)? gen_context(system_u:object_r:httpd_user_ra_content_t,s0) @@ -8,28 +7,18 @@ HOME_DIR/((www)|(web)|(public_html))(/.*)?/logs(/.*)? gen_context(system_u:objec /etc/apache-ssl(2)?(/.*)? gen_context(system_u:object_r:httpd_config_t,s0) /etc/cherokee(/.*)? gen_context(system_u:object_r:httpd_config_t,s0) /etc/drupal.* gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) -======= - -/etc/apache(2)?(/.*)? gen_context(system_u:object_r:httpd_config_t,s0) -/etc/apache-ssl(2)?(/.*)? gen_context(system_u:object_r:httpd_config_t,s0) -/etc/drupal(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /etc/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /etc/httpd(/.*)? gen_context(system_u:object_r:httpd_config_t,s0) /etc/httpd/conf/keytab -- gen_context(system_u:object_r:httpd_keytab_t,s0) /etc/httpd/logs gen_context(system_u:object_r:httpd_log_t,s0) /etc/httpd/modules gen_context(system_u:object_r:httpd_modules_t,s0) -<<<<<<< HEAD /etc/init\.d/cherokee -- gen_context(system_u:object_r:httpd_initrc_exec_t,s0) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /etc/lighttpd(/.*)? gen_context(system_u:object_r:httpd_config_t,s0) /etc/mock/koji(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /etc/rc\.d/init\.d/httpd -- gen_context(system_u:object_r:httpd_initrc_exec_t,s0) /etc/rc\.d/init\.d/lighttpd -- gen_context(system_u:object_r:httpd_initrc_exec_t,s0) /etc/vhosts -- gen_context(system_u:object_r:httpd_config_t,s0) -<<<<<<< HEAD /etc/WebCalendar(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /etc/zabbix/web(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) @@ -38,17 +27,12 @@ HOME_DIR/((www)|(web)|(public_html))(/.*)?/logs(/.*)? gen_context(system_u:objec /usr/libexec/httpd-ssl-pass-dialog -- gen_context(system_u:object_r:httpd_passwd_exec_t,s0) -======= -/etc/zabbix/web(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) - ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /srv/([^/]*/)?www(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /srv/gallery2(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /usr/bin/htsslpass -- gen_context(system_u:object_r:httpd_helper_exec_t,s0) /usr/bin/mongrel_rails -- gen_context(system_u:object_r:httpd_exec_t,s0) -<<<<<<< HEAD /usr/share/jetty/bin/jetty.sh -- gen_context(system_u:object_r:httpd_exec_t,s0) /usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0) @@ -65,20 +49,6 @@ HOME_DIR/((www)|(web)|(public_html))(/.*)?/logs(/.*)? gen_context(system_u:objec /usr/sbin/apache-ssl(2)? -- gen_context(system_u:object_r:httpd_exec_t,s0) /usr/sbin/cherokee -- gen_context(system_u:object_r:httpd_exec_t,s0) /usr/sbin/httpd\.event -- gen_context(system_u:object_r:httpd_exec_t,s0) -======= -/usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0) -/usr/lib/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) -/usr/lib/dirsrv/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) -/usr/lib/apache(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) -/usr/lib/apache2/modules(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) -/usr/lib/apache(2)?/suexec(2)? -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0) -/usr/lib/cgi-bin/(nph-)?cgiwrap(d)? -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0) -/usr/lib/httpd(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) -/usr/lib/lighttpd(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) - -/usr/sbin/apache(2)? -- gen_context(system_u:object_r:httpd_exec_t,s0) -/usr/sbin/apache-ssl(2)? -- gen_context(system_u:object_r:httpd_exec_t,s0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /usr/sbin/httpd(\.worker)? -- gen_context(system_u:object_r:httpd_exec_t,s0) /usr/sbin/lighttpd -- gen_context(system_u:object_r:httpd_exec_t,s0) /usr/sbin/rotatelogs -- gen_context(system_u:object_r:httpd_rotatelogs_exec_t,s0) @@ -88,14 +58,9 @@ ifdef(`distro_suse', ` /usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0) ') -<<<<<<< HEAD /usr/share/drupal.* gen_context(system_u:object_r:httpd_sys_content_t,s0) /usr/share/doc/ghc/html(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) -======= -/usr/share/dirsrv(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) -/usr/share/drupal(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /usr/share/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /usr/share/icecast(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /usr/share/mythweb(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) @@ -105,18 +70,12 @@ ifdef(`distro_suse', ` /usr/share/ntop/html(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /usr/share/openca/htdocs(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /usr/share/selinux-policy[^/]*/html(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) -<<<<<<< HEAD /usr/share/wordpress/.*\.php -- gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) /usr/share/wordpress-mu/wp-config\.php -- gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) /usr/share/wordpress-mu/wp-content(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /usr/share/wordpress/wp-content/uploads(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /usr/share/wordpress/wp-content/upgrade(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /usr/share/wordpress/wp-includes/.*\.php -- gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) -======= -/usr/share/wordpress-mu/wp-config\.php -- gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) -/usr/share/wordpress-mu/wp-content(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) -/usr/share/wordpress/wp-content/uploads(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /var/cache/httpd(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0) /var/cache/lighttpd(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0) @@ -133,7 +92,6 @@ ifdef(`distro_suse', ` /var/cache/ssl.*\.sem -- gen_context(system_u:object_r:httpd_cache_t,s0) /var/lib/cacti/rra(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) -<<<<<<< HEAD /var/lib/cherokee(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) /var/lib/dav(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) /var/lib/dokuwiki(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) @@ -145,42 +103,25 @@ ifdef(`distro_suse', ` /var/lib/squirrelmail/prefs(/.*)? gen_context(system_u:object_r:httpd_squirrelmail_t,s0) /var/lib/svn(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /var/lib/trac(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) -======= -/var/lib/dav(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) -/var/lib/drupal(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) -/var/lib/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) -/var/lib/httpd(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) -/var/lib/php/session(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0) -/var/lib/squirrelmail/prefs(/.*)? gen_context(system_u:object_r:httpd_squirrelmail_t,s0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /var/log/apache(2)?(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) /var/log/apache-ssl(2)?(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) /var/log/cacti(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) /var/log/cgiwrap\.log.* -- gen_context(system_u:object_r:httpd_log_t,s0) -<<<<<<< HEAD /var/log/cherokee(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) /var/log/httpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) /var/log/lighttpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) /var/log/php-fpm(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) /var/log/roundcubemail(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) /var/log/suphp\.log -- gen_context(system_u:object_r:httpd_log_t,s0) -======= -/var/log/httpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) -/var/log/lighttpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) -/var/log/piranha(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ifdef(`distro_debian', ` /var/log/horde2(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) ') -<<<<<<< HEAD /var/lib/pootle/po(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) /var/lib/rt3/data/RT-Shredder(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /var/run/apache.* gen_context(system_u:object_r:httpd_var_run_t,s0) /var/run/gcache_port -s gen_context(system_u:object_r:httpd_var_run_t,s0) /var/run/httpd.* gen_context(system_u:object_r:httpd_var_run_t,s0) @@ -193,15 +134,11 @@ ifdef(`distro_debian', ` /var/spool/viewvc(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t, s0) /var/www(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) -<<<<<<< HEAD -======= /var/www(/.*)?/logs(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /var/www/[^/]*/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) /var/www/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) /var/www/icons(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /var/www/perl(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) -<<<<<<< HEAD /var/www/html/[^/]*/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) @@ -224,5 +161,3 @@ ifdef(`distro_debian', ` /var/run/dirsrv/admin-serv.* gen_context(system_u:object_r:httpd_var_run_t,s0) /opt/dirsrv/var/run/dirsrv/dsgw/cookies(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 diff --git a/apache.if b/apache.if index 9b18b62..d0bf548 100644 --- a/apache.if +++ b/apache.if @@ -13,7 +13,6 @@ # template(`apache_content_template',` gen_require(` -<<<<<<< HEAD attribute httpd_exec_scripts, httpd_script_exec_type; type httpd_t, httpd_suexec_t, httpd_log_t; type httpd_sys_content_t; @@ -23,43 +22,21 @@ template(`apache_content_template',` #This type is for webpages type httpd_$1_content_t; # customizable; typeattribute httpd_$1_content_t httpd_content_type; -======= - attribute httpdcontent; - attribute httpd_exec_scripts; - attribute httpd_script_exec_type; - type httpd_t, httpd_suexec_t, httpd_log_t; - ') - # allow write access to public file transfer - # services files. - gen_tunable(allow_httpd_$1_script_anon_write, false) - - #This type is for webpages - type httpd_$1_content_t, httpdcontent; # customizable ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 typealias httpd_$1_content_t alias httpd_$1_script_ro_t; files_type(httpd_$1_content_t) # This type is used for .htaccess files -<<<<<<< HEAD type httpd_$1_htaccess_t, httpd_content_type; # customizable; typeattribute httpd_$1_htaccess_t httpd_content_type; files_type(httpd_$1_htaccess_t) # Type that CGI scripts run as type httpd_$1_script_t, httpd_script_type; -======= - type httpd_$1_htaccess_t; # customizable; - files_type(httpd_$1_htaccess_t) - - # Type that CGI scripts run as - type httpd_$1_script_t; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 domain_type(httpd_$1_script_t) role system_r types httpd_$1_script_t; # This type is used for executable scripts files type httpd_$1_script_exec_t, httpd_script_exec_type; # customizable; -<<<<<<< HEAD typeattribute httpd_$1_script_exec_t httpd_content_type; domain_entry_file(httpd_$1_script_t, httpd_$1_script_exec_t) @@ -76,39 +53,6 @@ template(`apache_content_template',` # Allow the script process to search the cgi directory, and users directory allow httpd_$1_script_t httpd_$1_content_t:dir search_dir_perms; -======= - corecmd_shell_entry_type(httpd_$1_script_t) - domain_entry_file(httpd_$1_script_t, httpd_$1_script_exec_t) - - type httpd_$1_rw_content_t, httpdcontent; # customizable - typealias httpd_$1_rw_content_t alias { httpd_$1_script_rw_t httpd_$1_content_rw_t }; - files_type(httpd_$1_rw_content_t) - - type httpd_$1_ra_content_t, httpdcontent; # customizable - typealias httpd_$1_ra_content_t alias { httpd_$1_script_ra_t httpd_$1_content_ra_t }; - files_type(httpd_$1_ra_content_t) - - read_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_htaccess_t) - - domtrans_pattern(httpd_suexec_t, httpd_$1_script_exec_t, httpd_$1_script_t) - - allow httpd_t { httpd_$1_content_t httpd_$1_rw_content_t httpd_$1_script_exec_t }:dir search_dir_perms; - allow httpd_suexec_t { httpd_$1_content_t httpd_$1_content_t httpd_$1_rw_content_t httpd_$1_script_exec_t }:dir search_dir_perms; - - allow httpd_$1_script_t self:fifo_file rw_file_perms; - allow httpd_$1_script_t self:unix_stream_socket connectto; - - allow httpd_$1_script_t httpd_t:fifo_file write; - # apache should set close-on-exec - dontaudit httpd_$1_script_t httpd_t:unix_stream_socket { read write }; - - # Allow the script process to search the cgi directory, and users directory - allow httpd_$1_script_t httpd_$1_content_t:dir search_dir_perms; - - append_files_pattern(httpd_$1_script_t, httpd_log_t, httpd_log_t) - logging_search_logs(httpd_$1_script_t) - ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 can_exec(httpd_$1_script_t, httpd_$1_script_exec_t) allow httpd_$1_script_t httpd_$1_script_exec_t:dir list_dir_perms; @@ -126,43 +70,6 @@ template(`apache_content_template',` manage_lnk_files_pattern(httpd_$1_script_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) manage_fifo_files_pattern(httpd_$1_script_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) manage_sock_files_pattern(httpd_$1_script_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) -<<<<<<< HEAD -======= - files_tmp_filetrans(httpd_$1_script_t, httpd_$1_rw_content_t, { dir file lnk_file sock_file fifo_file }) - - kernel_dontaudit_search_sysctl(httpd_$1_script_t) - kernel_dontaudit_search_kernel_sysctl(httpd_$1_script_t) - - dev_read_rand(httpd_$1_script_t) - dev_read_urand(httpd_$1_script_t) - - corecmd_exec_all_executables(httpd_$1_script_t) - - files_exec_etc_files(httpd_$1_script_t) - files_read_etc_files(httpd_$1_script_t) - files_search_home(httpd_$1_script_t) - - libs_exec_ld_so(httpd_$1_script_t) - libs_exec_lib_files(httpd_$1_script_t) - - miscfiles_read_fonts(httpd_$1_script_t) - miscfiles_read_public_files(httpd_$1_script_t) - - seutil_dontaudit_search_config(httpd_$1_script_t) - - tunable_policy(`httpd_enable_cgi && httpd_unified',` - allow httpd_$1_script_t httpdcontent:file entrypoint; - - manage_dirs_pattern(httpd_$1_script_t, httpdcontent, httpdcontent) - manage_files_pattern(httpd_$1_script_t, httpdcontent, httpdcontent) - manage_lnk_files_pattern(httpd_$1_script_t, httpdcontent, httpdcontent) - can_exec(httpd_$1_script_t, httpdcontent) - ') - - tunable_policy(`allow_httpd_$1_script_anon_write',` - miscfiles_manage_public_files(httpd_$1_script_t) - ') ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # Allow the web server to run scripts and serve pages tunable_policy(`httpd_builtin_scripting',` @@ -171,31 +78,16 @@ template(`apache_content_template',` manage_lnk_files_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) rw_sock_files_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) -<<<<<<< HEAD allow httpd_t httpd_$1_ra_content_t:dir { add_entry_dir_perms }; -======= - allow httpd_t httpd_$1_ra_content_t:dir { list_dir_perms add_entry_dir_perms }; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 read_files_pattern(httpd_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t) append_files_pattern(httpd_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t) read_lnk_files_pattern(httpd_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t) -<<<<<<< HEAD -======= - allow httpd_t httpd_$1_content_t:dir list_dir_perms; - read_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_content_t) - read_lnk_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_content_t) - - allow httpd_t httpd_$1_content_t:dir list_dir_perms; - read_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_content_t) - read_lnk_files_pattern(httpd_t, httpd_$1_content_t, httpd_$1_content_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') tunable_policy(`httpd_enable_cgi',` allow httpd_$1_script_t httpd_$1_script_exec_t:file entrypoint; -<<<<<<< HEAD domtrans_pattern(httpd_suexec_t, httpd_$1_script_exec_t, httpd_$1_script_t) # privileged users run the script: @@ -205,53 +97,6 @@ template(`apache_content_template',` # apache runs the script: domtrans_pattern(httpd_t, httpd_$1_script_exec_t, httpd_$1_script_t) -======= - # privileged users run the script: - domtrans_pattern(httpd_exec_scripts, httpd_$1_script_exec_t, httpd_$1_script_t) - - # apache runs the script: - domtrans_pattern(httpd_t, httpd_$1_script_exec_t, httpd_$1_script_t) - - allow httpd_t httpd_$1_script_t:process { signal sigkill sigstop }; - allow httpd_t httpd_$1_script_exec_t:dir list_dir_perms; - - allow httpd_$1_script_t self:process { setsched signal_perms }; - allow httpd_$1_script_t self:unix_stream_socket create_stream_socket_perms; - - allow httpd_$1_script_t httpd_t:fd use; - allow httpd_$1_script_t httpd_t:process sigchld; - - kernel_read_system_state(httpd_$1_script_t) - - dev_read_urand(httpd_$1_script_t) - - fs_getattr_xattr_fs(httpd_$1_script_t) - - files_read_etc_runtime_files(httpd_$1_script_t) - files_read_usr_files(httpd_$1_script_t) - - libs_read_lib_files(httpd_$1_script_t) - - miscfiles_read_localization(httpd_$1_script_t) - ') - - optional_policy(` - tunable_policy(`httpd_enable_cgi && allow_ypbind',` - nis_use_ypbind_uncond(httpd_$1_script_t) - ') - ') - - optional_policy(` - postgresql_unpriv_client(httpd_$1_script_t) - - tunable_policy(`httpd_enable_cgi && httpd_can_network_connect_db',` - postgresql_tcp_connect(httpd_$1_script_t) - ') - ') - - optional_policy(` - nscd_socket_use(httpd_$1_script_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ') @@ -273,14 +118,8 @@ template(`apache_content_template',` interface(`apache_role',` gen_require(` attribute httpdcontent; -<<<<<<< HEAD type httpd_user_content_t, httpd_user_htaccess_t, httpd_user_script_t; type httpd_user_ra_content_t, httpd_user_rw_content_t, httpd_user_script_exec_t; -======= - type httpd_user_content_t, httpd_user_htaccess_t; - type httpd_user_script_t, httpd_user_script_exec_t; - type httpd_user_ra_content_t, httpd_user_rw_content_t; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') role $1 types httpd_user_script_t; @@ -301,7 +140,6 @@ interface(`apache_role',` relabel_files_pattern($2, httpd_user_ra_content_t, httpd_user_ra_content_t) relabel_lnk_files_pattern($2, httpd_user_ra_content_t, httpd_user_ra_content_t) -<<<<<<< HEAD manage_dirs_pattern($2, httpd_user_content_t, httpd_user_content_t) manage_files_pattern($2, httpd_user_content_t, httpd_user_content_t) manage_lnk_files_pattern($2, httpd_user_content_t, httpd_user_content_t) @@ -309,8 +147,6 @@ interface(`apache_role',` relabel_files_pattern($2, httpd_user_content_t, httpd_user_content_t) relabel_lnk_files_pattern($2, httpd_user_content_t, httpd_user_content_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 manage_dirs_pattern($2, httpd_user_rw_content_t, httpd_user_rw_content_t) manage_files_pattern($2, httpd_user_rw_content_t, httpd_user_rw_content_t) manage_lnk_files_pattern($2, httpd_user_rw_content_t, httpd_user_rw_content_t) @@ -325,12 +161,9 @@ interface(`apache_role',` relabel_files_pattern($2, httpd_user_script_exec_t, httpd_user_script_exec_t) relabel_lnk_files_pattern($2, httpd_user_script_exec_t, httpd_user_script_exec_t) -<<<<<<< HEAD apache_exec_modules($2) apache_filetrans_home_content($2) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 tunable_policy(`httpd_enable_cgi',` # If a user starts a script by hand it gets the proper context domtrans_pattern($2, httpd_user_script_exec_t, httpd_user_script_t) @@ -400,7 +233,6 @@ interface(`apache_domtrans',` domtrans_pattern($1, httpd_exec_t, httpd_t) ') -<<<<<<< HEAD ###################################### ## ## Allow the specified domain to execute apache @@ -420,8 +252,6 @@ interface(`apache_exec',` can_exec($1, httpd_exec_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ####################################### ## ## Send a generic signal to apache. @@ -510,11 +340,7 @@ interface(`apache_dontaudit_rw_fifo_file',` type httpd_t; ') -<<<<<<< HEAD dontaudit $1 httpd_t:fifo_file rw_inherited_fifo_file_perms; -======= - dontaudit $1 httpd_t:fifo_file rw_fifo_file_perms; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ######################################## @@ -596,11 +422,7 @@ interface(`apache_setattr_cache_dirs',` type httpd_cache_t; ') -<<<<<<< HEAD allow $1 httpd_cache_t:dir setattr_dir_perms; -======= - allow $1 httpd_cache_t:dir setattr; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ######################################## @@ -644,7 +466,6 @@ interface(`apache_rw_cache_files',` ######################################## ## ## Allow the specified domain to delete -<<<<<<< HEAD ## Apache cache dirs. ## ## @@ -664,8 +485,6 @@ interface(`apache_delete_cache_dirs',` ######################################## ## ## Allow the specified domain to delete -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## Apache cache. ## ## @@ -684,7 +503,6 @@ interface(`apache_delete_cache_files',` ######################################## ## -<<<<<<< HEAD ## Allow the specified domain to search ## apache configuration dirs. ## @@ -705,8 +523,6 @@ interface(`apache_search_config',` ######################################## ## -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## Allow the specified domain to read ## apache configuration files. ## @@ -857,11 +673,7 @@ interface(`apache_dontaudit_append_log',` type httpd_log_t; ') -<<<<<<< HEAD dontaudit $1 httpd_log_t:file append_file_perms; -======= - dontaudit $1 httpd_log_t:file { getattr append }; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ######################################## @@ -907,7 +719,6 @@ interface(`apache_dontaudit_search_modules',` ######################################## ## -<<<<<<< HEAD ## Allow the specified domain to read ## the apache module directories. ## @@ -927,8 +738,6 @@ interface(`apache_read_modules',` ######################################## ## -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## Allow the specified domain to list ## the contents of the apache modules ## directory. @@ -945,10 +754,7 @@ interface(`apache_list_modules',` ') allow $1 httpd_modules_t:dir list_dir_perms; -<<<<<<< HEAD read_lnk_files_pattern($1, httpd_modules_t, httpd_modules_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ######################################## @@ -990,7 +796,6 @@ interface(`apache_domtrans_rotatelogs',` domtrans_pattern($1, httpd_rotatelogs_exec_t, httpd_rotatelogs_t) ') -<<<<<<< HEAD ####################################### ## ## Execute httpd_rotatelogs in the caller domain. @@ -1028,8 +833,6 @@ interface(`apache_exec_sys_script',` can_exec($1, httpd_sys_script_exec_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## ## ## Allow the specified domain to list @@ -1047,10 +850,7 @@ interface(`apache_list_sys_content',` ') list_dirs_pattern($1, httpd_sys_content_t, httpd_sys_content_t) -<<<<<<< HEAD read_lnk_files_pattern($1, httpd_sys_content_t, httpd_sys_content_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 files_search_var($1) ') @@ -1078,7 +878,6 @@ interface(`apache_manage_sys_content',` manage_lnk_files_pattern($1, httpd_sys_content_t, httpd_sys_content_t) ') -<<<<<<< HEAD ###################################### ## ## Allow the specified domain to read @@ -1147,8 +946,6 @@ interface(`apache_delete_sys_content_rw',` delete_sock_files_pattern($1, httpd_sys_rw_content_t, httpd_sys_rw_content_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## ## ## Execute all web scripts in the system @@ -1165,16 +962,12 @@ interface(`apache_delete_sys_content_rw',` interface(`apache_domtrans_sys_script',` gen_require(` attribute httpdcontent; -<<<<<<< HEAD type httpd_sys_script_exec_t; type httpd_sys_script_t, httpd_sys_content_t; ') tunable_policy(`httpd_enable_cgi',` domtrans_pattern($1, httpd_sys_script_exec_t, httpd_sys_script_t) -======= - type httpd_sys_script_t; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') tunable_policy(`httpd_enable_cgi && httpd_unified',` @@ -1233,16 +1026,10 @@ interface(`apache_domtrans_all_scripts',` ## ## ## -<<<<<<< HEAD ## Role allowed access. ## ## ## -======= -## Role allowed access.. -## -## ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # interface(`apache_run_all_scripts',` gen_require(` @@ -1269,11 +1056,7 @@ interface(`apache_read_squirrelmail_data',` type httpd_squirrelmail_t; ') -<<<<<<< HEAD read_files_pattern($1, httpd_squirrelmail_t, httpd_squirrelmail_t) -======= - allow $1 httpd_squirrelmail_t:file read_file_perms; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ######################################## @@ -1414,7 +1197,6 @@ interface(`apache_read_tmp_files',` read_files_pattern($1, httpd_tmp_t, httpd_tmp_t) ') -<<<<<<< HEAD ###################################### ## ## Dontaudit attempts to read and write @@ -1434,8 +1216,6 @@ interface(`apache_dontaudit_rw_tmp_files',` dontaudit $1 httpd_tmp_t:file { read write }; ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## ## ## Dontaudit attempts to write @@ -1452,11 +1232,7 @@ interface(`apache_dontaudit_write_tmp_files',` type httpd_tmp_t; ') -<<<<<<< HEAD dontaudit $1 httpd_tmp_t:file write; -======= - dontaudit $1 httpd_tmp_t:file write_file_perms; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ######################################## @@ -1497,7 +1273,6 @@ interface(`apache_cgi_domain',` ######################################## ## -<<<<<<< HEAD ## Execute httpd server in the httpd domain. ## ## @@ -1523,16 +1298,6 @@ interface(`httpd_systemctl',` ## ## All of the rules required to administrate an apache environment ## -======= -## All of the rules required to administrate an apache environment -## -## -## -## Prefix of the domain. Example, user would be -## the prefix for the uder_t domain. -## -## ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## ## ## Domain allowed access. @@ -1547,7 +1312,6 @@ interface(`httpd_systemctl',` # interface(`apache_admin',` gen_require(` -<<<<<<< HEAD attribute httpdcontent, httpd_script_exec_type; type httpd_t, httpd_config_t, httpd_log_t; type httpd_modules_t, httpd_lock_t, httpd_bool_t; @@ -1563,21 +1327,6 @@ interface(`apache_admin',` allow $1 httpd_t:process ptrace; ') -======= - attribute httpdcontent; - attribute httpd_script_exec_type; - - type httpd_t, httpd_config_t, httpd_log_t; - type httpd_modules_t, httpd_lock_t; - type httpd_var_run_t, httpd_php_tmp_t; - type httpd_suexec_tmp_t, httpd_tmp_t; - type httpd_initrc_exec_t; - ') - - allow $1 httpd_t:process { getattr ptrace signal_perms }; - ps_process_pattern($1, httpd_t) - ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 init_labeled_script_domtrans($1, httpd_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 httpd_initrc_exec_t system_r; @@ -1586,17 +1335,10 @@ interface(`apache_admin',` apache_manage_all_content($1) miscfiles_manage_public_files($1) -<<<<<<< HEAD files_list_etc($1) admin_pattern($1, httpd_config_t) logging_list_logs($1) -======= - files_search_etc($1) - admin_pattern($1, httpd_config_t) - - logging_search_logs($1) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 admin_pattern($1, httpd_log_t) admin_pattern($1, httpd_modules_t) @@ -1607,7 +1349,6 @@ interface(`apache_admin',` admin_pattern($1, httpd_var_run_t) files_pid_filetrans($1, httpd_var_run_t, file) -<<<<<<< HEAD admin_pattern($1, httpdcontent) admin_pattern($1, httpd_script_exec_type) @@ -1697,16 +1438,4 @@ interface(`apache_filetrans_home_content',` filetrans_pattern($1, httpd_user_content_t, httpd_user_script_exec_t, dir, "cgi-bin") filetrans_pattern($1, httpd_user_content_t, httpd_user_content_ra_t, dir, "logs") filetrans_pattern($1, { httpd_user_content_t httpd_user_script_exec_t }, httpd_user_htaccess_t, file, ".htaccess") -======= - kernel_search_proc($1) - allow $1 httpd_t:dir list_dir_perms; - - read_lnk_files_pattern($1, httpd_t, httpd_t) - - admin_pattern($1, httpdcontent) - admin_pattern($1, httpd_script_exec_type) - admin_pattern($1, httpd_tmp_t) - admin_pattern($1, httpd_php_tmp_t) - admin_pattern($1, httpd_suexec_tmp_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') diff --git a/apache.te b/apache.te index c37537b..e15bdb5 100644 --- a/apache.te +++ b/apache.te @@ -1,8 +1,4 @@ -<<<<<<< HEAD -policy_module(apache, 2.2.1) -======= policy_module(apache, 2.3.2) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # # NOTES: @@ -22,149 +18,108 @@ policy_module(apache, 2.3.2) # Declarations # -<<<<<<< HEAD selinux_genbool(httpd_bool_t) ## -##

-## Allow Apache to modify public files -## used for public file transfer services, directories/files must -## be labeled public_content_rw_t. -##

-======= -## ##

## Allow Apache to modify public files ## used for public file transfer services. Directories/Files must ## be labeled public_content_rw_t. ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(allow_httpd_anon_write, false) ## -<<<<<<< HEAD -##

-## Allow Apache to use mod_auth_pam -##

-======= ##

## Allow Apache to use mod_auth_pam ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(allow_httpd_mod_auth_pam, false) ## -<<<<<<< HEAD -##

-## Allow Apache to use mod_auth_ntlm_winbind -##

+##

+## Allow Apache to use mod_auth_ntlm_winbind +##

## gen_tunable(allow_httpd_mod_auth_ntlm_winbind, false) ## -##

-## Allow httpd scripts and modules execmem/execstack -##

+##

+## Allow httpd scripts and modules execmem/execstack +##

## gen_tunable(httpd_execmem, false) ## -##

-## Allow httpd processes to manage IPA content -##

+##

+## Allow httpd processes to manage IPA content +##

## gen_tunable(httpd_manage_ipa, false) ## -##

-## Allow httpd daemon to change system limits -##

+##

+## Allow httpd daemon to change system limits +##

## gen_tunable(httpd_setrlimit, false) ## -##

-## Allow httpd to use built in scripting (usually php) -##

-======= ##

## Allow httpd to use built in scripting (usually php) ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(httpd_builtin_scripting, false) ## -<<<<<<< HEAD -##

-## Allow HTTPD scripts and modules to connect to the network using any TCP port. -##

-======= ##

## Allow HTTPD scripts and modules to connect to the network using TCP. ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(httpd_can_network_connect, false) ## -<<<<<<< HEAD -##

-## Allow HTTPD scripts and modules to connect to cobbler over the network. -##

+##

+## Allow HTTPD scripts and modules to connect to cobbler over the network. +##

## gen_tunable(httpd_can_network_connect_cobbler, false) ## -##

-## Allow HTTPD to connect to port 80 for graceful shutdown -##

+##

+## Allow HTTPD to connect to port 80 for graceful shutdown +##

## gen_tunable(httpd_graceful_shutdown, false) ## -##

-## Allow HTTPD scripts and modules to connect to databases over the network. -##

-======= ##

## Allow HTTPD scripts and modules to connect to databases over the network. ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(httpd_can_network_connect_db, false) ## -<<<<<<< HEAD -##

-## Allow httpd to connect to memcache server -##

+##

+## Allow httpd to connect to memcache server +##

## gen_tunable(httpd_can_network_memcache, false) ## -##

-## Allow httpd to act as a relay -##

-======= ##

## Allow httpd to act as a relay ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(httpd_can_network_relay, false) ## -<<<<<<< HEAD -##

-## Allow http daemon to send mail -##

+##

+## Allow http daemon to send mail +##

## gen_tunable(httpd_can_sendmail, false) - ## ##

## Allow http daemon to connect to zabbix @@ -173,17 +128,13 @@ gen_tunable(httpd_can_sendmail, false) gen_tunable(httpd_can_connect_zabbix, false) ## -##

-## Allow http daemon to check spam -##

+##

+## Allow http daemon to check spam +##

## gen_tunable(httpd_can_check_spam, false) ## -##

-## Allow Apache to communicate with avahi service via dbus -##

-======= ##

## Allow http daemon to send mail ##

@@ -194,44 +145,29 @@ gen_tunable(httpd_can_sendmail, false) ##

## Allow Apache to communicate with avahi service via dbus ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(httpd_dbus_avahi, false) ## -<<<<<<< HEAD -##

-## Allow httpd to execute cgi scripts -##

-======= ##

## Allow httpd cgi support ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(httpd_enable_cgi, false) ## -<<<<<<< HEAD -##

-## Allow httpd to act as a FTP server by -## listening on the ftp port. -##

-======= ##

## Allow httpd to act as a FTP server by ## listening on the ftp port. ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(httpd_enable_ftp_server, false) ## -<<<<<<< HEAD -##

-## Allow httpd to act as a FTP client -## connecting to the ftp port and ephemeral ports -##

+##

+## Allow httpd to act as a FTP client +## connecting to the ftp port and ephemeral ports +##

## gen_tunable(httpd_can_connect_ftp, false) @@ -243,37 +179,27 @@ gen_tunable(httpd_can_connect_ftp, false) gen_tunable(httpd_can_connect_ldap, false) ## -##

-## Allow httpd to read home directories -##

-======= ##

## Allow httpd to read home directories ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(httpd_enable_homedirs, false) ## -<<<<<<< HEAD -##

-## Allow httpd to read user content -##

+##

+## Allow httpd to read user content +##

## gen_tunable(httpd_read_user_content, false) ## -##

-## Allow Apache to run in stickshift mode, not transition to passenger -##

+##

+## Allow Apache to run in stickshift mode, not transition to passenger +##

## gen_tunable(httpd_run_stickshift, false) ## -##

-## Allow HTTPD to run SSI executables in the same domain as system CGI scripts. -##

-======= ##

## Allow httpd daemon to change its resource limits ##

@@ -284,130 +210,92 @@ gen_tunable(httpd_setrlimit, false) ##

## Allow HTTPD to run SSI executables in the same domain as system CGI scripts. ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(httpd_ssi_exec, false) ## -<<<<<<< HEAD -##

-## Allow Apache to execute tmp content. -##

+##

+## Allow Apache to execute tmp content. +##

## gen_tunable(httpd_tmp_exec, false) ## -##

-## Unify HTTPD to communicate with the terminal. -## Needed for entering the passphrase for certificates at -## the terminal. -##

-======= ##

## Unify HTTPD to communicate with the terminal. ## Needed for entering the passphrase for certificates at ## the terminal. -##

>>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(httpd_tty_comm, false) ## -<<<<<<< HEAD -##

-## Unify HTTPD handling of all content files. -##

-======= ##

## Unify HTTPD handling of all content files. ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(httpd_unified, false) ## -<<<<<<< HEAD -##

-## Allow httpd to access openstack ports -##

+##

+## Allow httpd to access openstack ports +##

## gen_tunable(httpd_use_openstack, false) ## -##

-## Allow httpd to access cifs file systems -##

-======= ##

## Allow httpd to access cifs file systems ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(httpd_use_cifs, false) ## -<<<<<<< HEAD -##

-## Allow httpd to access cifs file systems -##

+##

+## Allow httpd to access cifs file systems +##

## gen_tunable(httpd_use_fusefs, false) ## -##

-## Allow httpd to run gpg in gpg-web domain -##

-======= ##

## Allow httpd to run gpg ##

->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## gen_tunable(httpd_use_gpg, false) ## -<<<<<<< HEAD -##

-## Allow httpd to access nfs file systems -##

+##

+## Allow httpd to access nfs file systems +##

## gen_tunable(httpd_use_nfs, false) ## -##

-## Allow apache scripts to write to public content, directories/files must be labeled public_rw_content_t. -##

+##

+## Allow apache scripts to write to public content, directories/files must be labeled public_rw_content_t. +##

## gen_tunable(allow_httpd_sys_script_anon_write, false) ## -##

-## Allow httpd to communicate with oddjob to start up a service -##

+##

+## Allow httpd to communicate with oddjob to start up a service +##

## gen_tunable(httpd_use_oddjob, false) attribute httpdcontent; attribute httpd_user_content_type; attribute httpd_content_type; -======= -##

-## Allow httpd to access nfs file systems -##

-## -gen_tunable(httpd_use_nfs, false) attribute httpdcontent; attribute httpd_user_content_type; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # domains that can exec all users scripts attribute httpd_exec_scripts; -<<<<<<< HEAD attribute httpd_script_type; -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 attribute httpd_script_exec_type; attribute httpd_user_script_exec_type; @@ -426,11 +314,7 @@ files_type(httpd_cache_t) # httpd_config_t is the type given to the configuration files type httpd_config_t; -<<<<<<< HEAD files_config_file(httpd_config_t) -======= -files_type(httpd_config_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 type httpd_helper_t; type httpd_helper_exec_t; @@ -441,12 +325,9 @@ role system_r types httpd_helper_t; type httpd_initrc_exec_t; init_script_file(httpd_initrc_exec_t) -<<<<<<< HEAD type httpd_unit_file_t; systemd_unit_file(httpd_unit_file_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 type httpd_lock_t; files_lock_file(httpd_lock_t) @@ -486,7 +367,6 @@ files_tmp_file(httpd_suexec_tmp_t) # setup the system domain for system CGI scripts apache_content_template(sys) -<<<<<<< HEAD optional_policy(` postgresql_unpriv_client(httpd_sys_script_t) @@ -502,9 +382,6 @@ typealias httpd_sys_content_t alias { httpd_fastcgi_content_t httpd_fastcgi_scri typealias httpd_sys_rw_content_t alias { httpd_fastcgi_rw_content_t httpd_fastcgi_script_rw_t }; typealias httpd_sys_ra_content_t alias httpd_fastcgi_script_ra_t; typealias httpd_sys_script_t alias httpd_fastcgi_script_t; -======= -typealias httpd_sys_content_t alias ntop_http_content_t; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 type httpd_tmp_t; files_tmp_file(httpd_tmp_t) @@ -514,13 +391,11 @@ files_tmpfs_file(httpd_tmpfs_t) apache_content_template(user) ubac_constrained(httpd_user_script_t) -<<<<<<< HEAD + typeattribute httpd_user_content_t httpdcontent; typeattribute httpd_user_rw_content_t httpdcontent; typeattribute httpd_user_ra_content_t httpdcontent; -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 userdom_user_home_content(httpd_user_content_t) userdom_user_home_content(httpd_user_htaccess_t) userdom_user_home_content(httpd_user_script_exec_t) @@ -528,10 +403,7 @@ userdom_user_home_content(httpd_user_ra_content_t) userdom_user_home_content(httpd_user_rw_content_t) typeattribute httpd_user_script_t httpd_script_domains; typealias httpd_user_content_t alias { httpd_staff_content_t httpd_sysadm_content_t }; -<<<<<<< HEAD typealias httpd_user_content_t alias httpd_unconfined_content_t; -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 typealias httpd_user_content_t alias { httpd_auditadm_content_t httpd_secadm_content_t }; typealias httpd_user_content_t alias { httpd_staff_script_ro_t httpd_sysadm_script_ro_t }; typealias httpd_user_content_t alias { httpd_auditadm_script_ro_t httpd_secadm_script_ro_t }; @@ -553,7 +425,6 @@ files_type(httpd_var_lib_t) type httpd_var_run_t; files_pid_file(httpd_var_run_t) -<<<<<<< HEAD # Removal of fastcgi, will cause problems without the following typealias httpd_var_run_t alias httpd_fastcgi_var_run_t; @@ -561,24 +432,16 @@ typealias httpd_var_run_t alias httpd_fastcgi_var_run_t; type squirrelmail_spool_t; files_tmp_file(squirrelmail_spool_t) files_spool_file(squirrelmail_spool_t) -======= -# File Type of squirrelmail attachments -type squirrelmail_spool_t; -files_tmp_file(squirrelmail_spool_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 optional_policy(` prelink_object_file(httpd_modules_t) ') -<<<<<<< HEAD type httpd_passwd_t; type httpd_passwd_exec_t; application_domain(httpd_passwd_t, httpd_passwd_exec_t) role system_r types httpd_passwd_t; -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # # Apache server local policy @@ -598,19 +461,13 @@ allow httpd_t self:unix_dgram_socket { create_socket_perms sendto }; allow httpd_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow httpd_t self:tcp_socket create_stream_socket_perms; allow httpd_t self:udp_socket create_socket_perms; -<<<<<<< HEAD dontaudit httpd_t self:netlink_audit_socket create_socket_perms; -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # Allow httpd_t to put files in /var/cache/httpd etc manage_dirs_pattern(httpd_t, httpd_cache_t, httpd_cache_t) manage_files_pattern(httpd_t, httpd_cache_t, httpd_cache_t) manage_lnk_files_pattern(httpd_t, httpd_cache_t, httpd_cache_t) -<<<<<<< HEAD files_var_filetrans(httpd_t, httpd_cache_t, { file dir }) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # Allow the httpd_t to read the web servers config files allow httpd_t httpd_config_t:dir list_dir_perms; @@ -654,14 +511,9 @@ allow httpd_t httpd_sys_script_t:unix_stream_socket connectto; manage_dirs_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) manage_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) -<<<<<<< HEAD manage_sock_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) manage_lnk_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) files_tmp_filetrans(httpd_t, httpd_tmp_t, { file dir lnk_file sock_file }) -======= -manage_lnk_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) -files_tmp_filetrans(httpd_t, httpd_tmp_t, { file dir lnk_file }) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 manage_dirs_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t) manage_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t) @@ -670,14 +522,9 @@ manage_fifo_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t) manage_sock_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t) fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_file }) -<<<<<<< HEAD manage_dirs_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) files_var_lib_filetrans(httpd_t, httpd_var_lib_t, { dir file }) -======= -manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) -files_var_lib_filetrans(httpd_t, httpd_var_lib_t, file) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) manage_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) @@ -692,12 +539,9 @@ manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) kernel_read_kernel_sysctls(httpd_t) # for modules that want to access /proc/meminfo kernel_read_system_state(httpd_t) -<<<<<<< HEAD kernel_read_network_state(httpd_t) kernel_read_network_state(httpd_t) kernel_search_network_sysctl(httpd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 corenet_all_recvfrom_unlabeled(httpd_t) corenet_all_recvfrom_netlabel(httpd_t) @@ -708,7 +552,6 @@ corenet_udp_sendrecv_generic_node(httpd_t) corenet_tcp_sendrecv_all_ports(httpd_t) corenet_udp_sendrecv_all_ports(httpd_t) corenet_tcp_bind_generic_node(httpd_t) -<<<<<<< HEAD corenet_udp_bind_generic_node(httpd_t) corenet_tcp_bind_http_port(httpd_t) corenet_udp_bind_http_port(httpd_t) @@ -722,13 +565,6 @@ corenet_tcp_bind_puppet_port(httpd_t) tunable_policy(`httpd_graceful_shutdown',` corenet_tcp_connect_http_port(httpd_t) ') -======= -corenet_tcp_bind_http_port(httpd_t) -corenet_tcp_bind_http_cache_port(httpd_t) -corenet_sendrecv_http_server_packets(httpd_t) -# Signal self for shutdown -corenet_tcp_connect_http_port(httpd_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 dev_read_sysfs(httpd_t) dev_read_rand(httpd_t) @@ -737,7 +573,6 @@ dev_rw_crypto(httpd_t) fs_getattr_all_fs(httpd_t) fs_search_auto_mountpoints(httpd_t) -<<<<<<< HEAD fs_read_iso9660_files(httpd_t) fs_read_anon_inodefs_files(httpd_t) fs_read_hugetlbfs_files(httpd_t) @@ -745,14 +580,10 @@ fs_read_hugetlbfs_files(httpd_t) auth_use_nsswitch(httpd_t) application_exec_all(httpd_t) -======= - -auth_use_nsswitch(httpd_t) # execute perl corecmd_exec_bin(httpd_t) corecmd_exec_shell(httpd_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 domain_use_interactive_fds(httpd_t) @@ -760,10 +591,7 @@ files_dontaudit_getattr_all_pids(httpd_t) files_read_usr_files(httpd_t) files_list_mnt(httpd_t) files_search_spool(httpd_t) -<<<<<<< HEAD files_read_var_symlinks(httpd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 files_read_var_lib_files(httpd_t) files_search_home(httpd_t) files_getattr_home_dir(httpd_t) @@ -775,7 +603,6 @@ files_read_etc_files(httpd_t) files_read_var_lib_symlinks(httpd_t) fs_search_auto_mountpoints(httpd_sys_script_t) -<<<<<<< HEAD # php uploads a file to /tmp and then execs programs to acton them manage_dirs_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t) manage_files_pattern(httpd_sys_script_t, httpd_tmp_t, httpd_tmp_t) @@ -790,47 +617,31 @@ ifdef(`hide_broken_symptoms',` libs_exec_lib_files(httpd_t) ') -======= - -libs_read_lib_files(httpd_t) - ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 logging_send_syslog_msg(httpd_t) miscfiles_read_localization(httpd_t) miscfiles_read_fonts(httpd_t) miscfiles_read_public_files(httpd_t) miscfiles_read_generic_certs(httpd_t) -<<<<<<< HEAD miscfiles_read_tetex_data(httpd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 seutil_dontaudit_search_config(httpd_t) userdom_use_unpriv_users_fds(httpd_t) -<<<<<<< HEAD tunable_policy(`httpd_setrlimit',` allow httpd_t self:process setrlimit; allow httpd_t self:capability sys_resource; ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 tunable_policy(`allow_httpd_anon_write',` miscfiles_manage_public_files(httpd_t) ') -<<<<<<< HEAD -======= -ifdef(`TODO', ` ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # # We need optionals to be able to be within booleans to make this work # tunable_policy(`allow_httpd_mod_auth_pam',` -<<<<<<< HEAD auth_domtrans_chkpwd(httpd_t) logging_send_audit_msgs(httpd_t) ') @@ -839,17 +650,12 @@ optional_policy(` tunable_policy(`allow_httpd_mod_auth_ntlm_winbind',` samba_domtrans_winbind_helper(httpd_t) ') -======= - auth_domtrans_chk_passwd(httpd_t) -') ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') tunable_policy(`httpd_can_network_connect',` corenet_tcp_connect_all_ports(httpd_t) ') -<<<<<<< HEAD tunable_policy(`httpd_can_network_connect_db',` corenet_tcp_connect_firebird_port(httpd_t) corenet_tcp_connect_mssql_port(httpd_t) @@ -862,24 +668,18 @@ tunable_policy(`httpd_can_network_memcache',` corenet_tcp_connect_memcache_port(httpd_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 tunable_policy(`httpd_can_network_relay',` # allow httpd to work as a relay corenet_tcp_connect_gopher_port(httpd_t) corenet_tcp_connect_ftp_port(httpd_t) corenet_tcp_connect_http_port(httpd_t) corenet_tcp_connect_http_cache_port(httpd_t) -<<<<<<< HEAD corenet_tcp_connect_squid_port(httpd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 corenet_tcp_connect_memcache_port(httpd_t) corenet_sendrecv_gopher_client_packets(httpd_t) corenet_sendrecv_ftp_client_packets(httpd_t) corenet_sendrecv_http_client_packets(httpd_t) corenet_sendrecv_http_cache_client_packets(httpd_t) -<<<<<<< HEAD corenet_sendrecv_squid_client_packets(httpd_t) corenet_tcp_connect_all_ephemeral_ports(httpd_t) ') @@ -898,8 +698,6 @@ tunable_policy(`httpd_enable_cgi && httpd_unified',` tunable_policy(`allow_httpd_sys_script_anon_write',` miscfiles_manage_public_files(httpd_sys_script_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') tunable_policy(`httpd_enable_cgi && httpd_use_nfs',` @@ -910,7 +708,6 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',` fs_cifs_domtrans(httpd_t, httpd_sys_script_t) ') -<<<<<<< HEAD tunable_policy(`httpd_enable_cgi && httpd_use_fusefs',` fs_fusefs_domtrans(httpd_t, httpd_sys_script_t) ') @@ -921,24 +718,19 @@ tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',` manage_dirs_pattern(httpd_t, httpdcontent, httpd_sys_rw_content_t) manage_files_pattern(httpd_t, httpdcontent, httpd_sys_rw_content_t) manage_lnk_files_pattern(httpd_t, httpdcontent, httpd_sys_rw_content_t) -======= -tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',` - domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 manage_dirs_pattern(httpd_t, httpdcontent, httpdcontent) manage_files_pattern(httpd_t, httpdcontent, httpdcontent) manage_lnk_files_pattern(httpd_t, httpdcontent, httpdcontent) ') -<<<<<<< HEAD tunable_policy(`httpd_can_connect_ftp',` corenet_tcp_connect_ftp_port(httpd_t) corenet_tcp_connect_all_ephemeral_ports(httpd_t) ') tunable_policy(`httpd_can_connect_ldap',` - corenet_tcp_connect_ldap_port(httpd_t) + corenet_tcp_connect_ldap_port(httpd_t) ') tunable_policy(`httpd_can_connect_zabbix',` @@ -960,22 +752,10 @@ tunable_policy(`httpd_tmp_exec && httpd_enable_cgi',` tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` fs_list_auto_mountpoints(httpd_t) -======= -tunable_policy(`httpd_enable_ftp_server',` - corenet_tcp_bind_ftp_port(httpd_t) -') - -tunable_policy(`httpd_enable_homedirs',` - userdom_read_user_home_content_files(httpd_t) -') - -tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 fs_read_nfs_files(httpd_t) fs_read_nfs_symlinks(httpd_t) ') -<<<<<<< HEAD tunable_policy(`httpd_use_nfs',` fs_list_auto_mountpoints(httpd_t) fs_manage_nfs_dirs(httpd_t) @@ -983,8 +763,6 @@ tunable_policy(`httpd_use_nfs',` fs_manage_nfs_symlinks(httpd_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_t) fs_read_cifs_symlinks(httpd_t) @@ -994,7 +772,6 @@ tunable_policy(`httpd_can_sendmail',` # allow httpd to connect to mail servers corenet_tcp_connect_smtp_port(httpd_t) corenet_sendrecv_smtp_client_packets(httpd_t) -<<<<<<< HEAD corenet_tcp_connect_pop_port(httpd_t) corenet_sendrecv_pop_client_packets(httpd_t) mta_send_mail(httpd_t) @@ -1011,14 +788,11 @@ tunable_policy(`httpd_use_fusefs',` fs_manage_fusefs_dirs(httpd_t) fs_manage_fusefs_files(httpd_t) fs_manage_fusefs_symlinks(httpd_t) -======= - mta_send_mail(httpd_t) ') tunable_policy(`httpd_setrlimit',` allow httpd_t self:process setrlimit; allow httpd_t self:capability sys_resource; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') tunable_policy(`httpd_ssi_exec',` @@ -1033,7 +807,6 @@ tunable_policy(`httpd_ssi_exec',` # to run correctly without this permission, so the permission # are dontaudited here. tunable_policy(`httpd_tty_comm',` -<<<<<<< HEAD userdom_use_inherited_user_terminals(httpd_t) userdom_use_inherited_user_terminals(httpd_suexec_t) ',` @@ -1047,11 +820,6 @@ optional_policy(` abrt_manage_spool_retrace(httpd_t) abrt_domtrans_retrace_worker(httpd_t) abrt_read_config(httpd_t) -======= - userdom_use_user_terminals(httpd_t) -',` - userdom_dontaudit_use_user_terminals(httpd_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') optional_policy(` @@ -1063,17 +831,10 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD cobbler_list_config(httpd_t) cobbler_read_config(httpd_t) cobbler_read_lib_files(httpd_t) - - tunable_policy(`httpd_can_network_connect_cobbler',` - corenet_tcp_connect_cobbler_port(httpd_t) - ') -======= cobbler_search_lib(httpd_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') optional_policy(` @@ -1088,7 +849,6 @@ optional_policy(` daemontools_service_domain(httpd_t, httpd_exec_t) ') -<<<<<<< HEAD optional_policy(` dirsrv_manage_config(httpd_t) dirsrv_manage_log(httpd_t) @@ -1101,10 +861,7 @@ optional_policy(` dirsrvadmin_domtrans_unconfined_script_t(httpd_t) ') -optional_policy(` -======= optional_policy(` ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 dbus_system_bus_client(httpd_t) tunable_policy(`httpd_dbus_avahi',` @@ -1113,7 +870,6 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD git_read_generic_system_content_files(httpd_t) gitosis_read_lib_files(httpd_t) ') @@ -1121,21 +877,14 @@ optional_policy(` optional_policy(` tunable_policy(`httpd_enable_cgi && httpd_use_gpg',` gpg_domtrans_web(httpd_t) -======= - tunable_policy(`httpd_enable_cgi && httpd_use_gpg',` - gpg_domtrans(httpd_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ') optional_policy(` -<<<<<<< HEAD jetty_admin(httpd_t) ') optional_policy(` -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 kerberos_keytab_template(httpd, httpd_t) ') @@ -1149,7 +898,6 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD mediawiki_read_tmp_files(httpd_t) mediawiki_delete_tmp_files(httpd_t) ') @@ -1165,9 +913,6 @@ optional_policy(` optional_policy(` # Allow httpd to work with mysql mysql_read_config(httpd_t) -======= - # Allow httpd to work with mysql ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 mysql_stream_connect(httpd_t) mysql_rw_db_sockets(httpd_t) @@ -1178,10 +923,7 @@ optional_policy(` optional_policy(` nagios_read_config(httpd_t) -<<<<<<< HEAD nagios_read_log(httpd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') optional_policy(` @@ -1192,7 +934,6 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD pwauth_domtrans(httpd_t) ') @@ -1220,8 +961,6 @@ optional_policy(` ') optional_policy(` -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # Allow httpd to work with postgresql postgresql_stream_connect(httpd_t) postgresql_unpriv_client(httpd_t) @@ -1236,14 +975,11 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD smokeping_read_lib_files(httpd_t) ') optional_policy(` files_dontaudit_rw_usr_dirs(httpd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 snmp_dontaudit_read_snmp_var_lib_files(httpd_t) snmp_dontaudit_write_snmp_var_lib_files(httpd_t) ') @@ -1256,15 +992,12 @@ optional_policy(` yam_read_content(httpd_t) ') -<<<<<<< HEAD optional_policy(` zarafa_manage_lib_files(httpd_t) zarafa_stream_connect_server(httpd_t) zarafa_search_config(httpd_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # # Apache helper local policy @@ -1278,15 +1011,11 @@ allow httpd_helper_t httpd_log_t:file append_file_perms; logging_send_syslog_msg(httpd_helper_t) -<<<<<<< HEAD userdom_use_inherited_user_terminals(httpd_helper_t) tunable_policy(`httpd_tty_comm',` userdom_use_inherited_user_terminals(httpd_helper_t) ') -======= -userdom_use_user_terminals(httpd_helper_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # @@ -1324,53 +1053,30 @@ libs_exec_lib_files(httpd_php_t) userdom_use_unpriv_users_fds(httpd_php_t) tunable_policy(`httpd_can_network_connect_db',` -<<<<<<< HEAD corenet_tcp_connect_firebird_port(httpd_php_t) corenet_tcp_connect_mssql_port(httpd_php_t) corenet_sendrecv_mssql_client_packets(httpd_php_t) corenet_tcp_connect_oracle_port(httpd_php_t) corenet_sendrecv_oracle_client_packets(httpd_php_t) -======= - corenet_tcp_connect_mysqld_port(httpd_t) - corenet_sendrecv_mysqld_client_packets(httpd_t) - corenet_tcp_connect_mysqld_port(httpd_sys_script_t) - corenet_sendrecv_mysqld_client_packets(httpd_sys_script_t) - corenet_tcp_connect_mysqld_port(httpd_suexec_t) - corenet_sendrecv_mysqld_client_packets(httpd_suexec_t) - - corenet_tcp_connect_mssql_port(httpd_t) - corenet_sendrecv_mssql_client_packets(httpd_t) - corenet_tcp_connect_mssql_port(httpd_sys_script_t) - corenet_sendrecv_mssql_client_packets(httpd_sys_script_t) - corenet_tcp_connect_mssql_port(httpd_suexec_t) - corenet_sendrecv_mssql_client_packets(httpd_suexec_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') optional_policy(` mysql_stream_connect(httpd_php_t) -<<<<<<< HEAD mysql_rw_db_sockets(httpd_php_t) mysql_read_config(httpd_php_t) tunable_policy(`httpd_can_network_connect_db',` mysql_tcp_connect(httpd_php_t) ') -======= - mysql_read_config(httpd_php_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') optional_policy(` postgresql_stream_connect(httpd_php_t) -<<<<<<< HEAD postgresql_unpriv_client(httpd_php_t) tunable_policy(`httpd_can_network_connect_db',` postgresql_tcp_connect(httpd_php_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ######################################## @@ -1380,11 +1086,7 @@ optional_policy(` allow httpd_suexec_t self:capability { setuid setgid }; allow httpd_suexec_t self:process signal_perms; -<<<<<<< HEAD - allow httpd_suexec_t self:fifo_file rw_fifo_file_perms; -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 allow httpd_suexec_t self:unix_stream_socket create_stream_socket_perms; domtrans_pattern(httpd_t, httpd_suexec_exec_t, httpd_suexec_t) @@ -1399,33 +1101,26 @@ manage_dirs_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t) manage_files_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t) files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir }) -<<<<<<< HEAD can_exec(httpd_suexec_t, httpd_sys_script_exec_t) read_files_pattern(httpd_suexec_t, httpd_user_content_t, httpd_user_content_t) read_files_pattern(httpd_suexec_t, httpd_user_rw_content_t, httpd_user_rw_content_t) read_files_pattern(httpd_suexec_t, httpd_user_ra_content_t, httpd_user_ra_content_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 kernel_read_kernel_sysctls(httpd_suexec_t) kernel_list_proc(httpd_suexec_t) kernel_read_proc_symlinks(httpd_suexec_t) dev_read_urand(httpd_suexec_t) -<<<<<<< HEAD fs_read_iso9660_files(httpd_suexec_t) fs_search_auto_mountpoints(httpd_suexec_t) application_exec_all(httpd_suexec_t) -======= -fs_search_auto_mountpoints(httpd_suexec_t) # for shell scripts corecmd_exec_bin(httpd_suexec_t) corecmd_exec_shell(httpd_suexec_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 files_read_etc_files(httpd_suexec_t) files_read_usr_files(httpd_suexec_t) @@ -1456,7 +1151,6 @@ tunable_policy(`httpd_can_network_connect',` corenet_sendrecv_all_client_packets(httpd_suexec_t) ') -<<<<<<< HEAD tunable_policy(`httpd_can_network_connect_db',` corenet_tcp_connect_firebird_port(httpd_suexec_t) corenet_tcp_connect_mssql_port(httpd_suexec_t) @@ -1482,15 +1176,6 @@ tunable_policy(`httpd_enable_cgi && httpd_unified',` tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` fs_list_auto_mountpoints(httpd_suexec_t) -======= -tunable_policy(`httpd_enable_cgi && httpd_unified',` - allow httpd_sys_script_t httpdcontent:file entrypoint; - domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t) - -') - -tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 fs_read_nfs_files(httpd_suexec_t) fs_read_nfs_symlinks(httpd_suexec_t) fs_exec_nfs_files(httpd_suexec_t) @@ -1513,7 +1198,6 @@ optional_policy(` dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write }; ') -<<<<<<< HEAD optional_policy(` mysql_stream_connect(httpd_suexec_t) mysql_rw_db_sockets(httpd_suexec_t) @@ -1533,8 +1217,6 @@ optional_policy(` ') ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # # Apache system script local policy @@ -1555,7 +1237,6 @@ read_lnk_files_pattern(httpd_sys_script_t, squirrelmail_spool_t, squirrelmail_sp kernel_read_kernel_sysctls(httpd_sys_script_t) -<<<<<<< HEAD files_read_var_symlinks(httpd_sys_script_t) files_search_var_lib(httpd_sys_script_t) files_search_spool(httpd_sys_script_t) @@ -1567,14 +1248,6 @@ apache_domtrans_rotatelogs(httpd_sys_script_t) auth_use_nsswitch(httpd_sys_script_t) -======= -files_search_var_lib(httpd_sys_script_t) -files_search_spool(httpd_sys_script_t) - -# Should we add a boolean? -apache_domtrans_rotatelogs(httpd_sys_script_t) - ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ifdef(`distro_redhat',` allow httpd_sys_script_t httpd_log_t:file append_file_perms; ') @@ -1583,7 +1256,6 @@ tunable_policy(`httpd_can_sendmail',` mta_send_mail(httpd_sys_script_t) ') -<<<<<<< HEAD optional_policy(` tunable_policy(`httpd_can_sendmail && httpd_can_check_spam',` spamassassin_domtrans_client(httpd_t) @@ -1616,13 +1288,10 @@ tunable_policy(`httpd_use_nfs',` fs_exec_nfs_files(httpd_suexec_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',` allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms; allow httpd_sys_script_t self:udp_socket create_socket_perms; -<<<<<<< HEAD corenet_tcp_bind_generic_node(httpd_sys_script_t) corenet_udp_bind_generic_node(httpd_sys_script_t) corenet_all_recvfrom_unlabeled(httpd_sys_script_t) @@ -1631,16 +1300,6 @@ tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',` corenet_udp_sendrecv_generic_if(httpd_sys_script_t) corenet_tcp_sendrecv_generic_node(httpd_sys_script_t) corenet_udp_sendrecv_generic_node(httpd_sys_script_t) -======= - corenet_tcp_bind_all_nodes(httpd_sys_script_t) - corenet_udp_bind_all_nodes(httpd_sys_script_t) - corenet_all_recvfrom_unlabeled(httpd_sys_script_t) - corenet_all_recvfrom_netlabel(httpd_sys_script_t) - corenet_tcp_sendrecv_all_if(httpd_sys_script_t) - corenet_udp_sendrecv_all_if(httpd_sys_script_t) - corenet_tcp_sendrecv_all_nodes(httpd_sys_script_t) - corenet_udp_sendrecv_all_nodes(httpd_sys_script_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 corenet_tcp_sendrecv_all_ports(httpd_sys_script_t) corenet_udp_sendrecv_all_ports(httpd_sys_script_t) corenet_tcp_connect_all_ports(httpd_sys_script_t) @@ -1648,23 +1307,15 @@ tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',` ') tunable_policy(`httpd_enable_homedirs',` -<<<<<<< HEAD userdom_search_user_home_dirs(httpd_sys_script_t) ') tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` fs_list_auto_mountpoints(httpd_sys_script_t) -======= - userdom_read_user_home_content_files(httpd_sys_script_t) -') - -tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 fs_read_nfs_files(httpd_sys_script_t) fs_read_nfs_symlinks(httpd_sys_script_t) ') -<<<<<<< HEAD tunable_policy(`httpd_read_user_content',` userdom_read_user_home_content_files(httpd_sys_script_t) ') @@ -1689,8 +1340,6 @@ tunable_policy(`httpd_use_fusefs',` fs_exec_fusefs_files(httpd_suexec_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_sys_script_t) fs_read_cifs_symlinks(httpd_sys_script_t) @@ -1703,26 +1352,20 @@ optional_policy(` optional_policy(` mysql_stream_connect(httpd_sys_script_t) mysql_rw_db_sockets(httpd_sys_script_t) -<<<<<<< HEAD mysql_read_config(httpd_sys_script_t) tunable_policy(`httpd_can_network_connect_db',` mysql_tcp_connect(httpd_sys_script_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') optional_policy(` postgresql_stream_connect(httpd_sys_script_t) -<<<<<<< HEAD postgresql_unpriv_client(httpd_sys_script_t) tunable_policy(`httpd_can_network_connect_db',` postgresql_tcp_connect(httpd_sys_script_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ######################################## @@ -1768,18 +1411,14 @@ optional_policy(` tunable_policy(`httpd_enable_cgi && httpd_unified',` allow httpd_user_script_t httpdcontent:file entrypoint; -<<<<<<< HEAD manage_dirs_pattern(httpd_user_script_t, httpd_user_content_t, httpd_user_content_t) manage_files_pattern(httpd_user_script_t, httpd_user_content_t, httpd_user_content_t) manage_dirs_pattern(httpd_user_script_t, httpd_user_ra_content_t, httpd_user_ra_content_t) manage_files_pattern(httpd_user_script_t, httpd_user_ra_content_t, httpd_user_ra_content_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') # allow accessing files/dirs below the users home dir tunable_policy(`httpd_enable_homedirs',` -<<<<<<< HEAD userdom_search_user_home_content(httpd_t) userdom_search_user_home_content(httpd_suexec_t) userdom_search_user_home_content(httpd_user_script_t) @@ -1915,9 +1554,3 @@ tunable_policy(`httpd_use_openstack',` corenet_tcp_connect_glance_port(httpd_sys_script_t) ') -======= - userdom_search_user_home_dirs(httpd_t) - userdom_search_user_home_dirs(httpd_suexec_t) - userdom_search_user_home_dirs(httpd_user_script_t) -') ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 diff --git a/apcupsd.fc b/apcupsd.fc index c63f9bf..f3506be 100644 --- a/apcupsd.fc +++ b/apcupsd.fc @@ -1,19 +1,13 @@ /etc/rc\.d/init\.d/apcupsd -- gen_context(system_u:object_r:apcupsd_initrc_exec_t,s0) -<<<<<<< HEAD /usr/lib/systemd/system/apcupsd.* -- gen_context(system_u:object_r:apcupsd_unit_file_t,s0) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0) /usr/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0) -<<<<<<< HEAD /var/lock/subsys/apcupsd -- gen_context(system_u:object_r:apcupsd_lock_t,s0) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /var/log/apcupsd\.events.* -- gen_context(system_u:object_r:apcupsd_log_t,s0) /var/log/apcupsd\.status.* -- gen_context(system_u:object_r:apcupsd_log_t,s0) @@ -23,7 +17,4 @@ /var/www/apcupsd/upsfstats\.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) /var/www/apcupsd/upsimage\.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) /var/www/apcupsd/upsstats\.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) -<<<<<<< HEAD /var/www/cgi-bin/apcgui(/.*)? gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 diff --git a/apcupsd.te b/apcupsd.te index 72f23e2..77e6e19 100644 --- a/apcupsd.te +++ b/apcupsd.te @@ -24,12 +24,9 @@ files_tmp_file(apcupsd_tmp_t) type apcupsd_var_run_t; files_pid_file(apcupsd_var_run_t) -<<<<<<< HEAD type apcupsd_unit_file_t; systemd_unit_file(apcupsd_unit_file_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # # apcupsd local policy @@ -82,10 +79,7 @@ files_etc_filetrans_etc_runtime(apcupsd_t, file) # https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240805 term_use_unallocated_ttys(apcupsd_t) -<<<<<<< HEAD term_use_usb_ttys(apcupsd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 #apcupsd runs shutdown, probably need a shutdown domain init_rw_utmp(apcupsd_t) @@ -97,24 +91,17 @@ miscfiles_read_localization(apcupsd_t) sysnet_dns_name_resolve(apcupsd_t) -<<<<<<< HEAD userdom_use_inherited_user_ttys(apcupsd_t) -======= -userdom_use_user_ttys(apcupsd_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 optional_policy(` hostname_exec(apcupsd_t) ') optional_policy(` -<<<<<<< HEAD shutdown_domtrans(apcupsd_t) ') optional_policy(` -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 mta_send_mail(apcupsd_t) mta_system_content(apcupsd_tmp_t) ') diff --git a/apm.fc b/apm.fc index fc9706d..f2f0c35 100644 --- a/apm.fc +++ b/apm.fc @@ -1,7 +1,4 @@ -<<<<<<< HEAD /usr/lib/systemd/system/apmd.* -- gen_context(system_u:object_r:apmd_unit_file_t,s0) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # # /usr diff --git a/apm.if b/apm.if index 5c510ae..0b668ae 100644 --- a/apm.if +++ b/apm.if @@ -52,12 +52,7 @@ interface(`apm_write_pipes',` type apmd_t; ') -<<<<<<< HEAD - allow $1 apmd_t:fd use; - allow $1 apmd_t:fifo_file write_fifo_file_perms; -======= allow $1 apmd_t:fifo_file write; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ######################################## @@ -94,20 +89,12 @@ interface(`apm_append_log',` ') logging_search_logs($1) -<<<<<<< HEAD allow $1 apmd_log_t:file append_file_perms; -======= - allow $1 apmd_log_t:file append; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ######################################## ## -<<<<<<< HEAD -## Connect to apmd over a unix stream socket. -======= ## Connect to apmd over an unix stream socket. ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## ## ## @@ -121,7 +108,6 @@ interface(`apm_stream_connect',` ') files_search_pids($1) -<<<<<<< HEAD stream_connect_pattern($1, apmd_var_run_t, apmd_var_run_t, apmd_t) ') @@ -146,8 +132,4 @@ interface(`apmd_systemctl',` allow $1 apmd_unit_file_t:service manage_service_perms; ps_process_pattern($1, apmd_t) -======= - allow $1 apmd_var_run_t:sock_file write; - allow $1 apmd_t:unix_stream_socket connectto; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') diff --git a/apm.te b/apm.te index 851b996..13a6f08 100644 --- a/apm.te +++ b/apm.te @@ -4,10 +4,7 @@ policy_module(apm, 1.11.0) # # Declarations # -<<<<<<< HEAD -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 type apmd_t; type apmd_exec_t; init_daemon_domain(apmd_t, apmd_exec_t) @@ -36,12 +33,9 @@ ifdef(`distro_suse',` files_type(apmd_var_lib_t) ') -<<<<<<< HEAD type apmd_unit_file_t; systemd_unit_file(apmd_unit_file_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # # apm client Local policy @@ -55,11 +49,7 @@ dev_rw_apm_bios(apm_t) fs_getattr_xattr_fs(apm_t) -<<<<<<< HEAD term_use_all_inherited_terms(apm_t) -======= -term_use_all_terms(apm_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 domain_use_interactive_fds(apm_t) @@ -73,16 +63,10 @@ logging_send_syslog_msg(apm_t) # mknod: controlling an orderly resume of PCMCIA requires creating device # nodes 254,{0,1,2} for some reason. allow apmd_t self:capability { sys_admin sys_nice sys_time kill mknod }; -<<<<<<< HEAD dontaudit apmd_t self:capability { setuid dac_override dac_read_search sys_tty_config }; allow apmd_t self:process { signal_perms getsession }; allow apmd_t self:fifo_file rw_fifo_file_perms; allow apmd_t self:netlink_socket create_socket_perms; -======= -dontaudit apmd_t self:capability { setuid dac_override dac_read_search sys_ptrace sys_tty_config }; -allow apmd_t self:process { signal_perms getsession }; -allow apmd_t self:fifo_file rw_fifo_file_perms; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 allow apmd_t self:unix_dgram_socket create_socket_perms; allow apmd_t self:unix_stream_socket create_stream_socket_perms; @@ -102,11 +86,8 @@ kernel_rw_all_sysctls(apmd_t) kernel_read_system_state(apmd_t) kernel_write_proc_files(apmd_t) -<<<<<<< HEAD dev_read_input(apmd_t) dev_read_mouse(apmd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 dev_read_realtime_clock(apmd_t) dev_read_urand(apmd_t) dev_rw_apm_bios(apmd_t) @@ -127,10 +108,7 @@ selinux_search_fs(apmd_t) corecmd_exec_all_executables(apmd_t) domain_read_all_domains_state(apmd_t) -<<<<<<< HEAD -======= domain_dontaudit_ptrace_all_domains(apmd_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 domain_use_interactive_fds(apmd_t) domain_dontaudit_getattr_all_sockets(apmd_t) domain_dontaudit_getattr_all_key_sockets(apmd_t) # Excessive? @@ -143,11 +121,8 @@ files_dontaudit_getattr_all_symlinks(apmd_t) # Excessive? files_dontaudit_getattr_all_pipes(apmd_t) # Excessive? files_dontaudit_getattr_all_sockets(apmd_t) # Excessive? -<<<<<<< HEAD auth_use_nsswitch(apmd_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 init_domtrans_script(apmd_t) init_rw_utmp(apmd_t) init_telinit(apmd_t) @@ -161,15 +136,11 @@ logging_send_audit_msgs(apmd_t) miscfiles_read_localization(apmd_t) miscfiles_read_hwdata(apmd_t) -<<<<<<< HEAD -seutil_dontaudit_read_config(apmd_t) -seutil_sigchld_newrole(apmd_t) -======= modutils_domtrans_insmod(apmd_t) modutils_read_module_config(apmd_t) seutil_dontaudit_read_config(apmd_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 +seutil_sigchld_newrole(apmd_t) userdom_dontaudit_use_unpriv_user_fds(apmd_t) userdom_dontaudit_search_user_home_dirs(apmd_t) @@ -181,14 +152,8 @@ ifdef(`distro_redhat',` can_exec(apmd_t, apmd_var_run_t) -<<<<<<< HEAD optional_policy(` fstools_domtrans(apmd_t) -======= - # ifconfig_exec_t needs to be run in its own domain for Red Hat - optional_policy(` - sysnet_domtrans_ifconfig(apmd_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') optional_policy(` @@ -199,7 +164,6 @@ ifdef(`distro_redhat',` netutils_domtrans(apmd_t) ') -<<<<<<< HEAD # ifconfig_exec_t needs to be run in its own domain for Red Hat optional_policy(` sssd_search_lib(apmd_t) @@ -209,8 +173,6 @@ ifdef(`distro_redhat',` sysnet_domtrans_ifconfig(apmd_t) ') -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ',` # for ifconfig which is run all the time kernel_dontaudit_search_sysctl(apmd_t) @@ -237,15 +199,12 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD devicekit_manage_pid_files(apmd_t) devicekit_manage_log_files(apmd_t) devicekit_relabel_log_files(apmd_t) ') optional_policy(` -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 dbus_system_bus_client(apmd_t) optional_policy(` @@ -266,12 +225,7 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD - modutils_domtrans_insmod(apmd_t) - modutils_read_module_config(apmd_t) -======= nscd_socket_use(apmd_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') optional_policy(` @@ -279,14 +233,9 @@ optional_policy(` pcmcia_domtrans_cardctl(apmd_t) ') -<<<<<<< HEAD optional_policy(` shutdown_domtrans(apmd_t) -======= -optional_policy(` - seutil_sigchld_newrole(apmd_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') optional_policy(` @@ -295,13 +244,10 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD -======= unconfined_domain(apmd_t) ') optional_policy(` ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 vbetool_domtrans(apmd_t) ') diff --git a/apt.fc b/apt.fc index 336fc68..0a29b89 100644 --- a/apt.fc +++ b/apt.fc @@ -10,20 +10,12 @@ # package list repository /var/lib/apt(/.*)? gen_context(system_u:object_r:apt_var_lib_t,s0) -<<<<<<< HEAD -/var/lib/aptitude(/.*)? gen_context(system_u:object_r:apt_var_lib_t,s0) -======= /var/lib/aptitude(/.*)? gen_context(system_u:object_r:apt_var_lib_t,s0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # aptitude lock /var/lock/aptitude gen_context(system_u:object_r:apt_lock_t,s0) # aptitude log -<<<<<<< HEAD -/var/log/aptitude gen_context(system_u:object_r:apt_var_log_t,s0) -======= /var/log/aptitude.* gen_context(system_u:object_r:apt_var_log_t,s0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # dpkg terminal log /var/log/apt(/.*)? gen_context(system_u:object_r:apt_var_log_t,s0) diff --git a/apt.te b/apt.te index a6aefa1..c5a4ce3 100644 --- a/apt.te +++ b/apt.te @@ -1,8 +1,4 @@ -<<<<<<< HEAD -policy_module(apt, 1.6.0) -======= policy_module(apt, 1.7.0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # @@ -125,11 +121,7 @@ fs_getattr_all_fs(apt_t) term_create_pty(apt_t, apt_devpts_t) term_list_ptys(apt_t) -<<<<<<< HEAD term_use_all_inherited_terms(apt_t) -======= -term_use_all_terms(apt_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 libs_exec_ld_so(apt_t) libs_exec_lib_files(apt_t) @@ -142,11 +134,7 @@ seutil_use_newrole_fds(apt_t) sysnet_read_config(apt_t) -<<<<<<< HEAD userdom_use_inherited_user_terminals(apt_t) -======= -userdom_use_user_terminals(apt_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # with boolean, for cron-apt and such? #optional_policy(` diff --git a/arpwatch.fc b/arpwatch.fc index fb3dc3a..ab50afe 100644 --- a/arpwatch.fc +++ b/arpwatch.fc @@ -1,10 +1,7 @@ /etc/rc\.d/init\.d/arpwatch -- gen_context(system_u:object_r:arpwatch_initrc_exec_t,s0) -<<<<<<< HEAD /usr/lib/systemd/system/arpwatch.* -- gen_context(system_u:object_r:arpwatch_unit_file_t,s0) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # # /usr # diff --git a/arpwatch.te b/arpwatch.te index d77af4e..613f77f 100644 --- a/arpwatch.te +++ b/arpwatch.te @@ -21,12 +21,9 @@ files_tmp_file(arpwatch_tmp_t) type arpwatch_var_run_t; files_pid_file(arpwatch_var_run_t) -<<<<<<< HEAD type arpwatch_unit_file_t; systemd_unit_file(arpwatch_unit_file_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # # Local policy @@ -40,10 +37,7 @@ allow arpwatch_t self:tcp_socket { connect create_stream_socket_perms }; allow arpwatch_t self:udp_socket create_socket_perms; allow arpwatch_t self:packet_socket create_socket_perms; allow arpwatch_t self:socket create_socket_perms; -<<<<<<< HEAD allow arpwatch_t self:netlink_socket create_socket_perms;; -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 manage_dirs_pattern(arpwatch_t, arpwatch_data_t, arpwatch_data_t) manage_files_pattern(arpwatch_t, arpwatch_data_t, arpwatch_data_t) @@ -57,14 +51,9 @@ manage_files_pattern(arpwatch_t, arpwatch_var_run_t, arpwatch_var_run_t) files_pid_filetrans(arpwatch_t, arpwatch_var_run_t, file) kernel_read_network_state(arpwatch_t) -<<<<<<< HEAD # meminfo kernel_read_system_state(arpwatch_t) kernel_read_kernel_sysctls(arpwatch_t) -======= -kernel_read_kernel_sysctls(arpwatch_t) -kernel_list_proc(arpwatch_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 kernel_read_proc_symlinks(arpwatch_t) kernel_request_load_module(arpwatch_t) diff --git a/asterisk.if b/asterisk.if index 039aaf1..313c6e4 100644 --- a/asterisk.if +++ b/asterisk.if @@ -39,8 +39,6 @@ interface(`asterisk_stream_connect',` stream_connect_pattern($1, asterisk_var_run_t, asterisk_var_run_t, asterisk_t) ') -<<<<<<< HEAD -======= ####################################### ## ## Allow changing the attributes of the asterisk log files and directories @@ -82,7 +80,6 @@ interface(`asterisk_setattr_pid_files',` files_search_pids($1) ') ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## ## ## All of the rules required to administrate @@ -108,7 +105,6 @@ interface(`asterisk_admin',` type asterisk_initrc_exec_t; ') -<<<<<<< HEAD allow $1 asterisk_t:process signal_perms; ps_process_pattern($1, asterisk_t) @@ -116,11 +112,6 @@ interface(`asterisk_admin',` allow $1 asterisk_t:process ptrace; ') -======= - allow $1 asterisk_t:process { ptrace signal_perms getattr }; - ps_process_pattern($1, asterisk_t) - ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 init_labeled_script_domtrans($1, asterisk_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 asterisk_initrc_exec_t system_r; diff --git a/asterisk.te b/asterisk.te index d0d99f6..1b02605 100644 --- a/asterisk.te +++ b/asterisk.te @@ -1,8 +1,4 @@ -<<<<<<< HEAD -policy_module(asterisk, 1.9.0) -======= policy_module(asterisk, 1.10.1) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # @@ -12,10 +8,7 @@ policy_module(asterisk, 1.10.1) type asterisk_t; type asterisk_exec_t; init_daemon_domain(asterisk_t, asterisk_exec_t) -<<<<<<< HEAD -======= application_executable_file(asterisk_exec_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 type asterisk_etc_t; files_config_file(asterisk_etc_t) @@ -27,18 +20,11 @@ type asterisk_log_t; logging_log_file(asterisk_log_t) type asterisk_spool_t; -<<<<<<< HEAD files_spool_file(asterisk_spool_t) type asterisk_tmp_t; files_tmp_file(asterisk_tmp_t) mta_system_content(asterisk_tmp_t) -======= -files_type(asterisk_spool_t) - -type asterisk_tmp_t; -files_tmp_file(asterisk_tmp_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 type asterisk_tmpfs_t; files_tmpfs_file(asterisk_tmpfs_t) @@ -55,22 +41,13 @@ files_pid_file(asterisk_var_run_t) # # dac_override for /var/run/asterisk -<<<<<<< HEAD allow asterisk_t self:capability { dac_override chown setgid setuid sys_nice net_admin }; dontaudit asterisk_t self:capability { sys_module sys_tty_config }; -======= -allow asterisk_t self:capability { dac_override setgid setuid sys_nice net_admin chown }; -dontaudit asterisk_t self:capability sys_tty_config; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 allow asterisk_t self:process { getsched setsched signal_perms getcap setcap }; allow asterisk_t self:fifo_file rw_fifo_file_perms; allow asterisk_t self:sem create_sem_perms; allow asterisk_t self:shm create_shm_perms; -<<<<<<< HEAD -allow asterisk_t self:unix_stream_socket connectto; -======= allow asterisk_t self:unix_stream_socket { connectto listen accept }; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 allow asterisk_t self:tcp_socket create_stream_socket_perms; allow asterisk_t self:udp_socket create_socket_perms; @@ -109,13 +86,6 @@ manage_sock_files_pattern(asterisk_t, asterisk_var_run_t, asterisk_var_run_t) files_pid_filetrans(asterisk_t, asterisk_var_run_t, { dir file }) kernel_read_network_state(asterisk_t) -======= -manage_files_pattern(asterisk_t, asterisk_var_run_t, asterisk_var_run_t) -manage_fifo_files_pattern(asterisk_t, asterisk_var_run_t, asterisk_var_run_t) -manage_sock_files_pattern(asterisk_t, asterisk_var_run_t, asterisk_var_run_t) -files_pid_filetrans(asterisk_t, asterisk_var_run_t, file) - ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 kernel_read_system_state(asterisk_t) kernel_read_kernel_sysctls(asterisk_t) kernel_request_load_module(asterisk_t) @@ -143,7 +113,6 @@ corenet_tcp_bind_generic_port(asterisk_t) corenet_udp_bind_generic_port(asterisk_t) corenet_dontaudit_udp_bind_all_ports(asterisk_t) corenet_sendrecv_generic_server_packets(asterisk_t) -<<<<<<< HEAD corenet_tcp_connect_festival_port(asterisk_t) corenet_tcp_connect_jabber_client_port(asterisk_t) corenet_tcp_connect_pktcable_port(asterisk_t) @@ -151,11 +120,6 @@ corenet_tcp_connect_postgresql_port(asterisk_t) corenet_tcp_connect_snmp_port(asterisk_t) corenet_tcp_connect_sip_port(asterisk_t) corenet_tcp_connect_jabber_client_port(asterisk_t) -======= -corenet_tcp_connect_postgresql_port(asterisk_t) -corenet_tcp_connect_snmp_port(asterisk_t) -corenet_tcp_connect_sip_port(asterisk_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 dev_rw_generic_usb_dev(asterisk_t) dev_read_sysfs(asterisk_t) @@ -171,10 +135,7 @@ files_search_spool(asterisk_t) # demo files installed in /usr/share/asterisk/sounds/demo-instruct.gsm # are labeled usr_t files_read_usr_files(asterisk_t) -<<<<<<< HEAD files_dontaudit_search_home(asterisk_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 fs_getattr_all_fs(asterisk_t) fs_list_inotifyfs(asterisk_t) diff --git a/authbind.te b/authbind.te index e78940b..7074612 100644 --- a/authbind.te +++ b/authbind.te @@ -1,8 +1,4 @@ -<<<<<<< HEAD -policy_module(authbind, 1.1.0) -======= policy_module(authbind, 1.1.1) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # diff --git a/automount.fc b/automount.fc index 5bbd044..e4178a4 100644 --- a/automount.fc +++ b/automount.fc @@ -4,11 +4,8 @@ /etc/apm/event\.d/autofs -- gen_context(system_u:object_r:automount_exec_t,s0) /etc/rc\.d/init\.d/autofs -- gen_context(system_u:object_r:automount_initrc_exec_t,s0) -<<<<<<< HEAD /usr/lib/systemd/system/autofs.* -- gen_context(system_u:object_r:automount_unit_file_t,s0) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 # # /usr # diff --git a/automount.if b/automount.if index 5e0cee7..ef740ef 100644 --- a/automount.if +++ b/automount.if @@ -29,10 +29,6 @@ interface(`automount_domtrans',` ## ## # -<<<<<<< HEAD -======= -# ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 interface(`automount_signal',` gen_require(` type automount_t; @@ -71,12 +67,7 @@ interface(`automount_read_state',` type automount_t; ') -<<<<<<< HEAD - kernel_search_proc($1) - ps_process_pattern($1, automount_t) -======= read_files_pattern($1, automount_t, automount_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ######################################## @@ -112,10 +103,6 @@ interface(`automount_dontaudit_write_pipes',` type automount_t; ') -<<<<<<< HEAD - dontaudit $1 automount_t:fd use; -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 dontaudit $1 automount_t:fifo_file write; ') @@ -135,7 +122,6 @@ interface(`automount_dontaudit_getattr_tmp_dirs',` type automount_tmp_t; ') -<<<<<<< HEAD dontaudit $1 automount_tmp_t:dir getattr_dir_perms; ') @@ -160,9 +146,6 @@ interface(`automount_systemctl',` allow $1 automount_unit_file_t:service manage_service_perms; ps_process_pattern($1, automount_t) -======= - dontaudit $1 automount_tmp_t:dir getattr; ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') ######################################## @@ -186,7 +169,6 @@ interface(`automount_admin',` gen_require(` type automount_t, automount_lock_t, automount_tmp_t; type automount_var_run_t, automount_initrc_exec_t; -<<<<<<< HEAD type automount_unit_file_t; ') @@ -197,13 +179,6 @@ interface(`automount_admin',` allow $1 automount_t:process ptrace; ') -======= - ') - - allow $1 automount_t:process { ptrace signal_perms getattr }; - ps_process_pattern($1, automount_t) - ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 init_labeled_script_domtrans($1, automount_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 automount_initrc_exec_t system_r; @@ -217,11 +192,8 @@ interface(`automount_admin',` files_list_pids($1) admin_pattern($1, automount_var_run_t) -<<<<<<< HEAD automount_systemctl($1) admin_pattern($1, automount_unit_file_t) allow $1 automount_unit_file_t:service all_service_perms; -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') diff --git a/automount.te b/automount.te index 8bf66eb..48901a2 100644 --- a/automount.te +++ b/automount.te @@ -22,12 +22,9 @@ type automount_tmp_t; files_tmp_file(automount_tmp_t) files_mountpoint(automount_tmp_t) -<<<<<<< HEAD type automount_unit_file_t; systemd_unit_file(automount_unit_file_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # # Local policy @@ -70,10 +67,7 @@ kernel_read_network_state(automount_t) kernel_list_proc(automount_t) kernel_dontaudit_search_xen_state(automount_t) -<<<<<<< HEAD files_read_usr_files(automount_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 files_search_boot(automount_t) # Automount is slowly adding all mount functionality internally files_search_all(automount_t) @@ -153,13 +147,6 @@ logging_search_logs(automount_t) miscfiles_read_localization(automount_t) miscfiles_read_generic_certs(automount_t) -<<<<<<< HEAD -======= -# Run mount in the mount_t domain. -mount_domtrans(automount_t) -mount_signal(automount_t) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 - userdom_dontaudit_use_unpriv_user_fds(automount_t) userdom_dontaudit_search_user_home_dirs(automount_t) @@ -168,7 +155,6 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD # Run mount in the mount_t domain. mount_domtrans(automount_t) mount_domtrans_showmount(automount_t) @@ -176,8 +162,6 @@ optional_policy(` ') optional_policy(` -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 fstools_domtrans(automount_t) ') diff --git a/avahi.fc b/avahi.fc index f38992b..010b2bc 100644 --- a/avahi.fc +++ b/avahi.fc @@ -1,10 +1,7 @@ /etc/rc\.d/init\.d/avahi.* -- gen_context(system_u:object_r:avahi_initrc_exec_t,s0) -<<<<<<< HEAD /usr/lib/systemd/system/avahi.* -- gen_context(system_u:object_r:avahi_unit_file_t,s0) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 /usr/sbin/avahi-daemon -- gen_context(system_u:object_r:avahi_exec_t,s0) /usr/sbin/avahi-dnsconfd -- gen_context(system_u:object_r:avahi_exec_t,s0) /usr/sbin/avahi-autoipd -- gen_context(system_u:object_r:avahi_exec_t,s0) diff --git a/avahi.if b/avahi.if index 3319864..17b3ecc 100644 --- a/avahi.if +++ b/avahi.if @@ -90,10 +90,6 @@ interface(`avahi_dbus_chat',` class dbus send_msg; ') -<<<<<<< HEAD - allow avahi_t $1:file read; -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 allow $1 avahi_t:dbus send_msg; allow avahi_t $1:dbus send_msg; ') @@ -137,7 +133,6 @@ interface(`avahi_dontaudit_search_pid',` ######################################## ## -<<<<<<< HEAD ## Execute avahi server in the avahi domain. ## ## @@ -161,8 +156,6 @@ interface(`avahi_systemctl',` ######################################## ## -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## All of the rules required to administrate ## an avahi environment ## @@ -181,7 +174,6 @@ interface(`avahi_systemctl',` interface(`avahi_admin',` gen_require(` type avahi_t, avahi_var_run_t, avahi_initrc_exec_t; -<<<<<<< HEAD type avahi_unit_file_t; ') @@ -192,13 +184,6 @@ interface(`avahi_admin',` allow $1 avahi_t:process ptrace; ') -======= - ') - - allow $1 avahi_t:process { ptrace signal_perms }; - ps_process_pattern($1, avahi_t) - ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 init_labeled_script_domtrans($1, avahi_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 avahi_initrc_exec_t system_r; @@ -206,11 +191,8 @@ interface(`avahi_admin',` files_list_pids($1) admin_pattern($1, avahi_var_run_t) -<<<<<<< HEAD avahi_systemctl($1) admin_pattern($1, avahi_unit_file_t) allow $1 avahi_unit_file_t:service all_service_perms; -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ') diff --git a/avahi.te b/avahi.te index 8d9176d..3b01eed 100644 --- a/avahi.te +++ b/avahi.te @@ -17,13 +17,10 @@ files_pid_file(avahi_var_lib_t) type avahi_var_run_t; files_pid_file(avahi_var_run_t) -<<<<<<< HEAD init_sock_file(avahi_var_run_t) type avahi_unit_file_t; systemd_unit_file(avahi_unit_file_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## # @@ -53,10 +50,7 @@ files_pid_filetrans(avahi_t, avahi_var_run_t, { dir file }) kernel_read_system_state(avahi_t) kernel_read_kernel_sysctls(avahi_t) kernel_read_network_state(avahi_t) -<<<<<<< HEAD kernel_request_load_module(avahi_t) -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 corecmd_exec_bin(avahi_t) corecmd_exec_shell(avahi_t) @@ -115,13 +109,10 @@ optional_policy(` ') optional_policy(` -<<<<<<< HEAD rpcbind_signull(avahi_t) ') optional_policy(` -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 seutil_sigchld_newrole(avahi_t) ') diff --git a/awstats.if b/awstats.if index ad542e6..53f9ba1 100644 --- a/awstats.if +++ b/awstats.if @@ -5,7 +5,6 @@ ######################################## ## -<<<<<<< HEAD ## Execute the awstats program in the awstats domain. ## ## @@ -25,8 +24,6 @@ interface(`awstats_domtrans',` ######################################## ## -======= ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ## Read and write awstats unnamed pipes. ## ## diff --git a/awstats.te b/awstats.te index dee09de..6bd3ad3 100644 --- a/awstats.te +++ b/awstats.te @@ -1,8 +1,4 @@ -<<<<<<< HEAD -policy_module(awstats, 1.3.1) -======= policy_module(awstats, 1.4.0) ->>>>>>> 9f8a6a356b99a19e09256fc37630cd6c22da66b4 ######################################## #