From 7f8b4eeeb02e69a7fb06e01af65d6569fff3bf79 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: May 06 2013 09:39:30 +0000 Subject: - Remove userdom_home_manager for xdm_t and move all rules to xserver - Add new xdm_write_home boolean to allow xdm_t to create files in HO - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/ - Allow virsh to read xen lock file - Allow qemu-ga to create files in /run with proper labeling - Allow glusterd to connect to own socket in /tmp - Allow glance-api to connect to http port to make glance image-creat - Allow keystonte_t to execute rpm --- diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index 032efca..f491cf2 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -23869,10 +23869,10 @@ index 6bf0ecc..f0080ba 100644 + files_search_tmp($1) +') diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te -index 2696452..d6f03e7 100644 +index 2696452..cb2c21b 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te -@@ -26,27 +26,50 @@ gen_require(` +@@ -26,27 +26,57 @@ gen_require(` # ## @@ -23914,6 +23914,13 @@ index 2696452..d6f03e7 100644 -##

-## Support X userspace object manager -##

++##

++## Allow the graphical login program to create files in HOME dirs as xdm_home_t. ++##

++## ++gen_tunable(xdm_write_home, false) ++ ++## +##

+## Support X userspace object manager +##

@@ -23932,7 +23939,7 @@ index 2696452..d6f03e7 100644 attribute x_domain; # X Events -@@ -107,44 +130,54 @@ xserver_object_types_template(remote) +@@ -107,44 +137,54 @@ xserver_object_types_template(remote) xserver_common_x_domain_template(remote, remote_t) type user_fonts_t; @@ -23988,7 +23995,7 @@ index 2696452..d6f03e7 100644 typealias xauth_tmp_t alias { auditadm_xauth_tmp_t secadm_xauth_tmp_t }; userdom_user_tmp_file(xauth_tmp_t) -@@ -154,19 +187,28 @@ files_type(xconsole_device_t) +@@ -154,19 +194,28 @@ files_type(xconsole_device_t) fs_associate_tmpfs(xconsole_device_t) files_associate_tmp(xconsole_device_t) @@ -24019,7 +24026,7 @@ index 2696452..d6f03e7 100644 type xdm_var_lib_t; files_type(xdm_var_lib_t) -@@ -174,13 +216,27 @@ files_type(xdm_var_lib_t) +@@ -174,13 +223,27 @@ files_type(xdm_var_lib_t) type xdm_var_run_t; files_pid_file(xdm_var_run_t) @@ -24048,7 +24055,7 @@ index 2696452..d6f03e7 100644 # type for /var/lib/xkb type xkb_var_lib_t; files_type(xkb_var_lib_t) -@@ -193,14 +249,12 @@ typealias xserver_t alias { auditadm_xserver_t secadm_xserver_t xdm_xserver_t }; +@@ -193,14 +256,12 @@ typealias xserver_t alias { auditadm_xserver_t secadm_xserver_t xdm_xserver_t }; init_system_domain(xserver_t, xserver_exec_t) ubac_constrained(xserver_t) @@ -24067,7 +24074,7 @@ index 2696452..d6f03e7 100644 userdom_user_tmpfs_file(xserver_tmpfs_t) type xsession_exec_t; -@@ -225,21 +279,33 @@ optional_policy(` +@@ -225,21 +286,33 @@ optional_policy(` # allow iceauth_t iceauth_home_t:file manage_file_perms; @@ -24110,7 +24117,7 @@ index 2696452..d6f03e7 100644 ') ######################################## -@@ -247,48 +313,83 @@ tunable_policy(`use_samba_home_dirs',` +@@ -247,48 +320,83 @@ tunable_policy(`use_samba_home_dirs',` # Xauth local policy # @@ -24194,18 +24201,18 @@ index 2696452..d6f03e7 100644 +ifdef(`hide_broken_symptoms',` + term_dontaudit_use_unallocated_ttys(xauth_t) + dev_dontaudit_rw_dri(xauth_t) - ') - - optional_policy(` -+ nx_var_lib_filetrans(xauth_t, xauth_home_t, file) +') + +optional_policy(` ++ nx_var_lib_filetrans(xauth_t, xauth_home_t, file) + ') + + optional_policy(` + ssh_use_ptys(xauth_t) ssh_sigchld(xauth_t) ssh_read_pipes(xauth_t) ssh_dontaudit_rw_tcp_sockets(xauth_t) -@@ -299,64 +400,106 @@ optional_policy(` +@@ -299,64 +407,106 @@ optional_policy(` # XDM Local policy # @@ -24322,7 +24329,7 @@ index 2696452..d6f03e7 100644 # connect to xdm xserver over stream socket stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) -@@ -365,20 +508,27 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) +@@ -365,20 +515,27 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) @@ -24352,7 +24359,7 @@ index 2696452..d6f03e7 100644 corenet_all_recvfrom_netlabel(xdm_t) corenet_tcp_sendrecv_generic_if(xdm_t) corenet_udp_sendrecv_generic_if(xdm_t) -@@ -388,38 +538,48 @@ corenet_tcp_sendrecv_all_ports(xdm_t) +@@ -388,38 +545,48 @@ corenet_tcp_sendrecv_all_ports(xdm_t) corenet_udp_sendrecv_all_ports(xdm_t) corenet_tcp_bind_generic_node(xdm_t) corenet_udp_bind_generic_node(xdm_t) @@ -24405,7 +24412,7 @@ index 2696452..d6f03e7 100644 files_read_etc_files(xdm_t) files_read_var_files(xdm_t) -@@ -430,9 +590,28 @@ files_list_mnt(xdm_t) +@@ -430,9 +597,28 @@ files_list_mnt(xdm_t) files_read_usr_files(xdm_t) # Poweroff wants to create the /poweroff file when run from xdm files_create_boot_flag(xdm_t) @@ -24434,7 +24441,7 @@ index 2696452..d6f03e7 100644 storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t) -@@ -441,28 +620,43 @@ storage_dontaudit_raw_read_removable_device(xdm_t) +@@ -441,28 +627,43 @@ storage_dontaudit_raw_read_removable_device(xdm_t) storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t) @@ -24481,7 +24488,7 @@ index 2696452..d6f03e7 100644 userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_create_all_users_keys(xdm_t) -@@ -471,24 +665,43 @@ userdom_read_user_home_content_files(xdm_t) +@@ -471,24 +672,144 @@ userdom_read_user_home_content_files(xdm_t) # Search /proc for any user domain processes. userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) @@ -24490,7 +24497,108 @@ index 2696452..d6f03e7 100644 +userdom_manage_user_tmp_files(xdm_t) +userdom_manage_user_tmp_sockets(xdm_t) +userdom_manage_tmpfs_role(system_r, xdm_t) -+userdom_home_manager(xdm_t) ++ ++#userdom_home_manager(xdm_t) ++tunable_policy(`xdm_write_home',` ++ userdom_user_home_dir_filetrans(xdm_t, xdm_home_t, file) ++',` ++ userdom_user_home_dir_filetrans_user_home_content(xdm_t, { dir file lnk_file fifo_file sock_file }) ++') ++ ++tunable_policy(`use_nfs_home_dirs',` ++ fs_list_auto_mountpoints(xdm_t) ++ fs_manage_nfs_dirs(xdm_t) ++ fs_manage_nfs_files(xdm_t) ++ fs_manage_nfs_symlinks(xdm_t) ++') ++ ++tunable_policy(`use_samba_home_dirs',` ++ fs_manage_cifs_dirs(xdm_t) ++ fs_manage_cifs_files(xdm_t) ++ fs_manage_cifs_symlinks(xdm_t) ++') ++ ++tunable_policy(`use_fusefs_home_dirs',` ++ fs_manage_fusefs_dirs(xdm_t) ++ fs_manage_fusefs_files(xdm_t) ++ fs_manage_fusefs_symlinks(xdm_t) ++') ++ ++tunable_policy(`use_ecryptfs_home_dirs',` ++ fs_manage_ecryptfs_dirs(xdm_t) ++ fs_manage_ecryptfs_files(xdm_t) ++') ++ ++### filename transitions ### ++userdom_filetrans_generic_home_content(xdm_t) ++ ++optional_policy(` ++ gnome_config_filetrans(xdm_t, home_cert_t, dir, "certificates") ++') ++ ++optional_policy(` ++ apache_filetrans_home_content(xdm_t) ++') ++ ++optional_policy(` ++ auth_filetrans_home_content(xdm_t) ++') ++ ++optional_policy(` ++ gnome_filetrans_home_content(xdm_t) ++') ++ ++optional_policy(` ++ gpg_filetrans_home_content(xdm_t) ++') ++ ++optional_policy(` ++ irc_filetrans_home_content(xdm_t) ++') ++ ++optional_policy(` ++ kerberos_filetrans_home_content(xdm_t) ++') ++ ++optional_policy(` ++ mozilla_filetrans_home_content(xdm_t) ++') ++ ++optional_policy(` ++ mta_filetrans_home_content(xdm_t) ++') ++ ++optional_policy(` ++ pulseaudio_filetrans_home_content(xdm_t) ++') ++ ++optional_policy(` ++ spamassassin_filetrans_home_content(xdm_t) ++ spamassassin_filetrans_admin_home_content(xdm_t) ++') ++ ++optional_policy(` ++ ssh_filetrans_admin_home_content(xdm_t) ++ ssh_filetrans_home_content(xdm_t) ++') ++ ++optional_policy(` ++ telepathy_filetrans_home_content(xdm_t) ++') ++ ++optional_policy(` ++ thumb_filetrans_home_content(xdm_t) ++') ++ ++optional_policy(` ++ tvtime_filetrans_home_content(xdm_t) ++') ++ ++optional_policy(` ++ virt_filetrans_home_content(xdm_t) ++') ++ ++### end of filename transitions ### + +application_signal(xdm_t) @@ -24531,7 +24639,7 @@ index 2696452..d6f03e7 100644 tunable_policy(`xdm_sysadm_login',` userdom_xsession_spec_domtrans_all_users(xdm_t) # FIXME: -@@ -502,11 +715,26 @@ tunable_policy(`xdm_sysadm_login',` +@@ -502,11 +823,26 @@ tunable_policy(`xdm_sysadm_login',` ') optional_policy(` @@ -24558,7 +24666,7 @@ index 2696452..d6f03e7 100644 ') optional_policy(` -@@ -514,12 +742,72 @@ optional_policy(` +@@ -514,12 +850,72 @@ optional_policy(` ') optional_policy(` @@ -24619,7 +24727,7 @@ index 2696452..d6f03e7 100644 + gnome_exec_keyringd(xdm_t) + gnome_manage_config(xdm_t) + gnome_manage_gconf_home_files(xdm_t) -+ gnome_filetrans_home_content(xdm_t) ++ #gnome_filetrans_home_content(xdm_t) + gnome_read_config(xdm_t) + gnome_read_usr_config(xdm_t) + gnome_read_gconf_config(xdm_t) @@ -24631,7 +24739,7 @@ index 2696452..d6f03e7 100644 hostname_exec(xdm_t) ') -@@ -537,28 +825,78 @@ optional_policy(` +@@ -537,28 +933,78 @@ optional_policy(` ') optional_policy(` @@ -24719,7 +24827,7 @@ index 2696452..d6f03e7 100644 ') optional_policy(` -@@ -570,6 +908,14 @@ optional_policy(` +@@ -570,6 +1016,14 @@ optional_policy(` ') optional_policy(` @@ -24734,7 +24842,7 @@ index 2696452..d6f03e7 100644 xfs_stream_connect(xdm_t) ') -@@ -594,8 +940,11 @@ allow xserver_t input_xevent_t:x_event send; +@@ -594,8 +1048,11 @@ allow xserver_t input_xevent_t:x_event send; # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack @@ -24747,7 +24855,7 @@ index 2696452..d6f03e7 100644 allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow xserver_t self:fd use; allow xserver_t self:fifo_file rw_fifo_file_perms; -@@ -608,8 +957,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; +@@ -608,8 +1065,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:udp_socket create_socket_perms; @@ -24763,7 +24871,7 @@ index 2696452..d6f03e7 100644 manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) -@@ -617,6 +973,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) +@@ -617,6 +1081,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file) @@ -24774,7 +24882,7 @@ index 2696452..d6f03e7 100644 manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) -@@ -628,12 +988,19 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) +@@ -628,12 +1096,19 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) files_search_var_lib(xserver_t) @@ -24796,7 +24904,7 @@ index 2696452..d6f03e7 100644 kernel_read_system_state(xserver_t) kernel_read_device_sysctls(xserver_t) -@@ -641,12 +1008,12 @@ kernel_read_modprobe_sysctls(xserver_t) +@@ -641,12 +1116,12 @@ kernel_read_modprobe_sysctls(xserver_t) # Xorg wants to check if kernel is tainted kernel_read_kernel_sysctls(xserver_t) kernel_write_proc_files(xserver_t) @@ -24810,7 +24918,7 @@ index 2696452..d6f03e7 100644 corenet_all_recvfrom_netlabel(xserver_t) corenet_tcp_sendrecv_generic_if(xserver_t) corenet_udp_sendrecv_generic_if(xserver_t) -@@ -667,23 +1034,27 @@ dev_rw_apm_bios(xserver_t) +@@ -667,23 +1142,27 @@ dev_rw_apm_bios(xserver_t) dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) @@ -24841,7 +24949,7 @@ index 2696452..d6f03e7 100644 # brought on by rhgb files_search_mnt(xserver_t) -@@ -694,7 +1065,16 @@ fs_getattr_xattr_fs(xserver_t) +@@ -694,7 +1173,16 @@ fs_getattr_xattr_fs(xserver_t) fs_search_nfs(xserver_t) fs_search_auto_mountpoints(xserver_t) fs_search_ramfs(xserver_t) @@ -24859,7 +24967,7 @@ index 2696452..d6f03e7 100644 mls_xwin_read_to_clearance(xserver_t) selinux_validate_context(xserver_t) -@@ -708,20 +1088,18 @@ init_getpgid(xserver_t) +@@ -708,20 +1196,18 @@ init_getpgid(xserver_t) term_setattr_unallocated_ttys(xserver_t) term_use_unallocated_ttys(xserver_t) @@ -24883,7 +24991,7 @@ index 2696452..d6f03e7 100644 userdom_search_user_home_dirs(xserver_t) userdom_use_user_ttys(xserver_t) -@@ -729,8 +1107,6 @@ userdom_setattr_user_ttys(xserver_t) +@@ -729,8 +1215,6 @@ userdom_setattr_user_ttys(xserver_t) userdom_read_user_tmp_files(xserver_t) userdom_rw_user_tmpfs_files(xserver_t) @@ -24892,7 +25000,7 @@ index 2696452..d6f03e7 100644 ifndef(`distro_redhat',` allow xserver_t self:process { execmem execheap execstack }; domain_mmap_low_uncond(xserver_t) -@@ -775,16 +1151,44 @@ optional_policy(` +@@ -775,16 +1259,44 @@ optional_policy(` ') optional_policy(` @@ -24938,7 +25046,7 @@ index 2696452..d6f03e7 100644 unconfined_domtrans(xserver_t) ') -@@ -793,6 +1197,10 @@ optional_policy(` +@@ -793,6 +1305,10 @@ optional_policy(` ') optional_policy(` @@ -24949,7 +25057,7 @@ index 2696452..d6f03e7 100644 xfs_stream_connect(xserver_t) ') -@@ -808,10 +1216,10 @@ allow xserver_t xdm_t:shm rw_shm_perms; +@@ -808,10 +1324,10 @@ allow xserver_t xdm_t:shm rw_shm_perms; # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open # handle of a file inside the dir!!! @@ -24963,7 +25071,7 @@ index 2696452..d6f03e7 100644 # Label pid and temporary files with derived types. manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) -@@ -819,7 +1227,7 @@ manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) +@@ -819,7 +1335,7 @@ manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) manage_sock_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) # Run xkbcomp. @@ -24972,7 +25080,7 @@ index 2696452..d6f03e7 100644 can_exec(xserver_t, xkb_var_lib_t) # VNC v4 module in X server -@@ -832,26 +1240,21 @@ init_use_fds(xserver_t) +@@ -832,26 +1348,21 @@ init_use_fds(xserver_t) # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_user_home_content_files(xserver_t) @@ -25007,7 +25115,7 @@ index 2696452..d6f03e7 100644 ') optional_policy(` -@@ -902,7 +1305,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy +@@ -902,7 +1413,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show }; # operations allowed on my windows allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; @@ -25016,7 +25124,7 @@ index 2696452..d6f03e7 100644 # operations allowed on all windows allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child }; -@@ -956,11 +1359,31 @@ allow x_domain self:x_resource { read write }; +@@ -956,11 +1467,31 @@ allow x_domain self:x_resource { read write }; # can mess with the screensaver allow x_domain xserver_t:x_screen { getattr saver_getattr }; @@ -25048,7 +25156,7 @@ index 2696452..d6f03e7 100644 tunable_policy(`! xserver_object_manager',` # should be xserver_unconfined(x_domain), # but typeattribute doesnt work in conditionals -@@ -982,18 +1405,40 @@ tunable_policy(`! xserver_object_manager',` +@@ -982,18 +1513,41 @@ tunable_policy(`! xserver_object_manager',` allow x_domain xevent_type:{ x_event x_synthetic_event } *; ') @@ -25104,6 +25212,7 @@ index 2696452..d6f03e7 100644 + domtrans_pattern(xdm_t, xdm_unconfined_exec_t, xdm_unconfined_t) + unconfined_domain(xdm_unconfined_t) +') ++ diff --git a/policy/modules/system/application.if b/policy/modules/system/application.if index 1b6619e..be02b96 100644 --- a/policy/modules/system/application.if @@ -39212,7 +39321,7 @@ index db75976..65191bd 100644 + +/var/run/user(/.*)? gen_context(system_u:object_r:user_tmp_t,s0) diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if -index 3c5dba7..df7407b 100644 +index 3c5dba7..e27d755 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -30,9 +30,11 @@ template(`userdom_base_user_template',` @@ -41879,7 +41988,7 @@ index 3c5dba7..df7407b 100644 ## Create keys for all user domains. ## ## -@@ -3438,4 +4197,1390 @@ interface(`userdom_dbus_send_all_users',` +@@ -3438,4 +4197,1415 @@ interface(`userdom_dbus_send_all_users',` ') allow $1 userdomain:dbus send_msg; @@ -43269,6 +43378,31 @@ index 3c5dba7..df7407b 100644 + ') + + filetrans_pattern($1, user_tmpfs_t, $2, $3, $4) ++') ++ ++###################################### ++## ++## File name transition for generic home content files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`userdom_filetrans_generic_home_content',` ++ gen_require(` ++ type home_bin_t; ++ type audio_home_t; ++ type home_cert_t; ++ ') ++ ++ userdom_user_home_dir_filetrans($1, home_bin_t, dir, "bin") ++ userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Audio") ++ userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Music") ++ userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert") ++ userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki") ++ userdom_user_home_dir_filetrans($1, home_cert_t, dir, "certificates") ') diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te index e2b538b..2582882 100644 diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index bdc5d2b..18b44ed 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -23993,7 +23993,7 @@ index 9eacb2c..229782f 100644 init_labeled_script_domtrans($1, { glance_api_initrc_exec_t glance_registry_initrc_exec_t }) domain_system_change_exemption($1) diff --git a/glance.te b/glance.te -index e0a4f46..0a1aec6 100644 +index e0a4f46..16c0ddd 100644 --- a/glance.te +++ b/glance.te @@ -7,8 +7,7 @@ policy_module(glance, 1.0.2) @@ -24072,7 +24072,7 @@ index e0a4f46..0a1aec6 100644 logging_send_syslog_msg(glance_registry_t) -@@ -108,13 +110,20 @@ manage_files_pattern(glance_api_t, glance_tmp_t, glance_tmp_t) +@@ -108,13 +110,21 @@ manage_files_pattern(glance_api_t, glance_tmp_t, glance_tmp_t) files_tmp_filetrans(glance_api_t, glance_tmp_t, { dir file }) can_exec(glance_api_t, glance_tmp_t) @@ -24087,6 +24087,7 @@ index e0a4f46..0a1aec6 100644 corenet_sendrecv_glance_registry_client_packets(glance_api_t) corenet_tcp_connect_glance_registry_port(glance_api_t) +corenet_tcp_connect_mysqld_port(glance_api_t) ++corenet_tcp_connect_http_port(glance_api_t) + +corenet_tcp_connect_all_ephemeral_ports(glance_api_t) + @@ -24278,7 +24279,7 @@ index 0000000..1ed97fe + diff --git a/glusterd.te b/glusterd.te new file mode 100644 -index 0000000..190dcb1 +index 0000000..735cc94 --- /dev/null +++ b/glusterd.te @@ -0,0 +1,146 @@ @@ -24343,7 +24344,7 @@ index 0000000..190dcb1 +allow glusterd_t self:process { setrlimit signal }; +allow glusterd_t self:fifo_file rw_fifo_file_perms; +allow glusterd_t self:tcp_socket { accept listen }; -+allow glusterd_t self:unix_stream_socket { accept listen }; ++allow glusterd_t self:unix_stream_socket { accept listen connectto }; + +manage_dirs_pattern(glusterd_t, glusterd_conf_t, glusterd_conf_t) +manage_files_pattern(glusterd_t, glusterd_conf_t, glusterd_conf_t) @@ -31941,7 +31942,7 @@ index d3e7fc9..f20248c 100644 + ') ') diff --git a/keystone.te b/keystone.te -index 3494d9b..124a2ab 100644 +index 3494d9b..a82637c 100644 --- a/keystone.te +++ b/keystone.te @@ -21,10 +21,14 @@ files_type(keystone_var_lib_t) @@ -31959,7 +31960,7 @@ index 3494d9b..124a2ab 100644 allow keystone_t self:fifo_file rw_fifo_file_perms; allow keystone_t self:unix_stream_socket { accept listen }; -@@ -57,20 +61,25 @@ corenet_all_recvfrom_netlabel(keystone_t) +@@ -57,20 +61,29 @@ corenet_all_recvfrom_netlabel(keystone_t) corenet_tcp_sendrecv_generic_if(keystone_t) corenet_tcp_sendrecv_generic_node(keystone_t) corenet_tcp_bind_generic_node(keystone_t) @@ -31988,6 +31989,10 @@ index 3494d9b..124a2ab 100644 +optional_policy(` + postgresql_stream_connect(keystone_t) +') ++ ++optional_policy(` ++ rpm_exec(keystone_t) ++') diff --git a/kismet.if b/kismet.if index aa2a337..7ff229f 100644 --- a/kismet.if @@ -55192,7 +55197,7 @@ index 2e23946..589bbf2 100644 + postfix_config_filetrans($1, postfix_prng_t, file, "prng_exch") ') diff --git a/postfix.te b/postfix.te -index 191a66f..056b316 100644 +index 191a66f..a9c1d4b 100644 --- a/postfix.te +++ b/postfix.te @@ -1,4 +1,4 @@ @@ -55864,7 +55869,7 @@ index 191a66f..056b316 100644 init_sigchld_script(postfix_postqueue_t) init_use_script_fds(postfix_postqueue_t) -@@ -647,67 +577,77 @@ optional_policy(` +@@ -647,67 +577,78 @@ optional_policy(` ######################################## # @@ -55910,11 +55915,12 @@ index 191a66f..056b316 100644 +allow postfix_showq_t self:tcp_socket create_socket_perms; allow postfix_showq_t postfix_master_t:unix_stream_socket { accept rw_socket_perms }; - ++rw_files_pattern(postfix_showq_t, postfix_var_run_t, postfix_var_run_t) ++ +allow postfix_showq_t postfix_spool_t:file read_file_perms; + +postfix_list_spool(postfix_showq_t) -+ + allow postfix_showq_t postfix_spool_maildrop_t:dir list_dir_perms; allow postfix_showq_t postfix_spool_maildrop_t:file read_file_perms; allow postfix_showq_t postfix_spool_maildrop_t:lnk_file read_lnk_file_perms; @@ -55960,7 +55966,7 @@ index 191a66f..056b316 100644 ') optional_policy(` -@@ -720,24 +660,27 @@ optional_policy(` +@@ -720,24 +661,27 @@ optional_policy(` ######################################## # @@ -55994,7 +56000,7 @@ index 191a66f..056b316 100644 fs_getattr_all_dirs(postfix_smtpd_t) fs_getattr_all_fs(postfix_smtpd_t) -@@ -754,6 +697,7 @@ optional_policy(` +@@ -754,6 +698,7 @@ optional_policy(` optional_policy(` milter_stream_connect_all(postfix_smtpd_t) @@ -56002,7 +56008,7 @@ index 191a66f..056b316 100644 ') optional_policy(` -@@ -764,31 +708,99 @@ optional_policy(` +@@ -764,31 +709,99 @@ optional_policy(` sasl_connect(postfix_smtpd_t) ') @@ -63868,7 +63874,7 @@ index 04babe3..3b92679 100644 + +/var/lib/ipa-client(/.*)? gen_context(system_u:object_r:realmd_var_lib_t,s0) diff --git a/realmd.if b/realmd.if -index bff31df..13ad9e5 100644 +index bff31df..3b5faf0 100644 --- a/realmd.if +++ b/realmd.if @@ -1,8 +1,9 @@ @@ -63883,7 +63889,7 @@ index bff31df..13ad9e5 100644 ## ## ## -@@ -39,3 +40,87 @@ interface(`realmd_dbus_chat',` +@@ -39,3 +40,80 @@ interface(`realmd_dbus_chat',` allow $1 realmd_t:dbus send_msg; allow realmd_t $1:dbus send_msg; ') @@ -63964,13 +63970,6 @@ index bff31df..13ad9e5 100644 + files_search_var($1) + manage_dirs_pattern($1, realmd_var_cache_t, realmd_var_cache_t) +') -+ -+ -+manage_dirs_pattern(realmd_t, realmd_var_cache_t, realmd_var_cache_t) -+manage_files_pattern(realmd_t, realmd_var_cache_t, realmd_var_cache_t) -+manage_lnk_files_pattern(realmd_t, realmd_var_cache_t, realmd_var_cache_t) -+files_var_filetrans(realmd_t, realmd_var_cache_t, { dir file lnk_file }) -+') diff --git a/realmd.te b/realmd.te index 9a8f052..c558c79 100644 --- a/realmd.te @@ -85091,10 +85090,10 @@ index 0be8535..b96e329 100644 optional_policy(` diff --git a/virt.fc b/virt.fc -index c30da4c..014e40c 100644 +index c30da4c..d60e3e4 100644 --- a/virt.fc +++ b/virt.fc -@@ -1,52 +1,80 @@ +@@ -1,52 +1,81 @@ -HOME_DIR/\.libvirt(/.*)? gen_context(system_u:object_r:virt_home_t,s0) -HOME_DIR/\.libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_home_t,s0) -HOME_DIR/\.virtinst(/.*)? gen_context(system_u:object_r:virt_home_t,s0) @@ -85213,6 +85212,7 @@ index c30da4c..014e40c 100644 + +/usr/bin/qemu-ga -- gen_context(system_u:object_r:virt_qemu_ga_exec_t,s0) +/var/run/qemu-ga\.pid -- gen_context(system_u:object_r:virt_qemu_ga_var_run_t,s0) ++/var/run/qga\.state -- gen_context(system_u:object_r:virt_qemu_ga_var_run_t,s0) +/var/log/qemu-ga\.log -- gen_context(system_u:object_r:virt_qemu_ga_log_t,s0) diff --git a/virt.if b/virt.if index 9dec06c..6e25af1 100644 @@ -86883,7 +86883,7 @@ index 9dec06c..6e25af1 100644 + allow $1 svirt_image_t:chr_file rw_file_perms; ') diff --git a/virt.te b/virt.te -index 1f22fba..832423f 100644 +index 1f22fba..9d71252 100644 --- a/virt.te +++ b/virt.te @@ -1,94 +1,98 @@ @@ -87337,24 +87337,24 @@ index 1f22fba..832423f 100644 -filetrans_pattern(svirt_t, virt_home_t, svirt_home_t, dir, "qemu") - -stream_connect_pattern(svirt_t, svirt_home_t, svirt_home_t, virtd_t) -- --corenet_udp_sendrecv_generic_if(svirt_t) --corenet_udp_sendrecv_generic_node(svirt_t) --corenet_udp_sendrecv_all_ports(svirt_t) --corenet_udp_bind_generic_node(svirt_t) +# it was a part of auth_use_nsswitch +allow svirt_t self:netlink_route_socket r_netlink_socket_perms; + corenet_udp_sendrecv_generic_if(svirt_t) + corenet_udp_sendrecv_generic_node(svirt_t) + corenet_udp_sendrecv_all_ports(svirt_t) + corenet_udp_bind_generic_node(svirt_t) +- -corenet_all_recvfrom_unlabeled(svirt_t) -corenet_all_recvfrom_netlabel(svirt_t) -corenet_tcp_sendrecv_generic_if(svirt_t) - corenet_udp_sendrecv_generic_if(svirt_t) +-corenet_udp_sendrecv_generic_if(svirt_t) -corenet_tcp_sendrecv_generic_node(svirt_t) - corenet_udp_sendrecv_generic_node(svirt_t) +-corenet_udp_sendrecv_generic_node(svirt_t) -corenet_tcp_sendrecv_all_ports(svirt_t) - corenet_udp_sendrecv_all_ports(svirt_t) +-corenet_udp_sendrecv_all_ports(svirt_t) -corenet_tcp_bind_generic_node(svirt_t) - corenet_udp_bind_generic_node(svirt_t) +-corenet_udp_bind_generic_node(svirt_t) - -corenet_sendrecv_all_server_packets(svirt_t) corenet_udp_bind_all_ports(svirt_t) @@ -87506,13 +87506,13 @@ index 1f22fba..832423f 100644 - -stream_connect_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t, virtd_lxc_t) -stream_connect_pattern(virtd_t, svirt_var_run_t, svirt_var_run_t, virt_domain) -- --can_exec(virtd_t, virt_tmp_t) +manage_dirs_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +manage_files_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +filetrans_pattern(virtd_t, virt_var_run_t, virt_lxc_var_run_t, dir, "lxc") +stream_connect_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t, virtd_lxc_t) +-can_exec(virtd_t, virt_tmp_t) +- -kernel_read_crypto_sysctls(virtd_t) kernel_read_system_state(virtd_t) kernel_read_network_state(virtd_t) @@ -88116,7 +88116,7 @@ index 1f22fba..832423f 100644 tunable_policy(`virt_use_nfs',` fs_manage_nfs_dirs(virsh_t) fs_manage_nfs_files(virsh_t) -@@ -847,6 +872,10 @@ optional_policy(` +@@ -847,14 +872,19 @@ optional_policy(` ') optional_policy(` @@ -88127,8 +88127,9 @@ index 1f22fba..832423f 100644 rpm_exec(virsh_t) ') -@@ -854,7 +883,7 @@ optional_policy(` + optional_policy(` xen_manage_image_dirs(virsh_t) ++ xen_read_image_files(virsh_t) xen_append_log(virsh_t) xen_domtrans(virsh_t) - xen_read_xenstored_pid_files(virsh_t) @@ -88136,7 +88137,7 @@ index 1f22fba..832423f 100644 xen_stream_connect(virsh_t) xen_stream_connect_xenstore(virsh_t) ') -@@ -879,34 +908,44 @@ optional_policy(` +@@ -879,34 +909,44 @@ optional_policy(` kernel_read_xen_state(virsh_ssh_t) kernel_write_xen_state(virsh_ssh_t) @@ -88190,7 +88191,7 @@ index 1f22fba..832423f 100644 manage_dirs_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) manage_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) -@@ -916,12 +955,17 @@ manage_sock_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) +@@ -916,12 +956,17 @@ manage_sock_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) manage_fifo_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) allow virtd_lxc_t svirt_lxc_file_t:dir_file_class_set { relabelto relabelfrom }; allow virtd_lxc_t svirt_lxc_file_t:filesystem { relabelto relabelfrom }; @@ -88208,7 +88209,7 @@ index 1f22fba..832423f 100644 corecmd_exec_bin(virtd_lxc_t) corecmd_exec_shell(virtd_lxc_t) -@@ -933,10 +977,8 @@ dev_read_urand(virtd_lxc_t) +@@ -933,10 +978,8 @@ dev_read_urand(virtd_lxc_t) domain_use_interactive_fds(virtd_lxc_t) @@ -88219,7 +88220,7 @@ index 1f22fba..832423f 100644 files_relabel_rootfs(virtd_lxc_t) files_mounton_non_security(virtd_lxc_t) files_mount_all_file_type_fs(virtd_lxc_t) -@@ -944,6 +986,7 @@ files_unmount_all_file_type_fs(virtd_lxc_t) +@@ -944,6 +987,7 @@ files_unmount_all_file_type_fs(virtd_lxc_t) files_list_isid_type_dirs(virtd_lxc_t) files_root_filetrans(virtd_lxc_t, svirt_lxc_file_t, dir_file_class_set) @@ -88227,7 +88228,7 @@ index 1f22fba..832423f 100644 fs_getattr_all_fs(virtd_lxc_t) fs_manage_tmpfs_dirs(virtd_lxc_t) fs_manage_tmpfs_chr_files(virtd_lxc_t) -@@ -955,15 +998,11 @@ fs_rw_cgroup_files(virtd_lxc_t) +@@ -955,15 +999,11 @@ fs_rw_cgroup_files(virtd_lxc_t) fs_unmount_all_fs(virtd_lxc_t) fs_relabelfrom_tmpfs(virtd_lxc_t) @@ -88246,7 +88247,7 @@ index 1f22fba..832423f 100644 term_use_generic_ptys(virtd_lxc_t) term_use_ptmx(virtd_lxc_t) -@@ -973,21 +1012,36 @@ auth_use_nsswitch(virtd_lxc_t) +@@ -973,21 +1013,36 @@ auth_use_nsswitch(virtd_lxc_t) logging_send_syslog_msg(virtd_lxc_t) @@ -88291,7 +88292,7 @@ index 1f22fba..832423f 100644 allow svirt_lxc_domain self:fifo_file manage_file_perms; allow svirt_lxc_domain self:sem create_sem_perms; allow svirt_lxc_domain self:shm create_shm_perms; -@@ -995,18 +1049,16 @@ allow svirt_lxc_domain self:msgq create_msgq_perms; +@@ -995,18 +1050,16 @@ allow svirt_lxc_domain self:msgq create_msgq_perms; allow svirt_lxc_domain self:unix_stream_socket { create_stream_socket_perms connectto }; allow svirt_lxc_domain self:unix_dgram_socket { sendto create_socket_perms }; @@ -88318,7 +88319,7 @@ index 1f22fba..832423f 100644 manage_dirs_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) manage_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) -@@ -1015,17 +1067,14 @@ manage_sock_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +@@ -1015,17 +1068,14 @@ manage_sock_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) manage_fifo_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) rw_chr_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) rw_blk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) @@ -88337,7 +88338,7 @@ index 1f22fba..832423f 100644 kernel_dontaudit_search_kernel_sysctl(svirt_lxc_domain) corecmd_exec_all_executables(svirt_lxc_domain) -@@ -1037,21 +1086,20 @@ files_dontaudit_getattr_all_pipes(svirt_lxc_domain) +@@ -1037,21 +1087,20 @@ files_dontaudit_getattr_all_pipes(svirt_lxc_domain) files_dontaudit_getattr_all_sockets(svirt_lxc_domain) files_dontaudit_list_all_mountpoints(svirt_lxc_domain) files_dontaudit_write_etc_runtime_files(svirt_lxc_domain) @@ -88364,7 +88365,7 @@ index 1f22fba..832423f 100644 auth_dontaudit_read_login_records(svirt_lxc_domain) auth_dontaudit_write_login_records(svirt_lxc_domain) auth_search_pam_console_data(svirt_lxc_domain) -@@ -1063,96 +1111,92 @@ init_dontaudit_write_utmp(svirt_lxc_domain) +@@ -1063,96 +1112,92 @@ init_dontaudit_write_utmp(svirt_lxc_domain) libs_dontaudit_setattr_lib_files(svirt_lxc_domain) @@ -88502,7 +88503,7 @@ index 1f22fba..832423f 100644 allow virt_qmf_t self:tcp_socket create_stream_socket_perms; allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms; -@@ -1165,12 +1209,12 @@ dev_read_sysfs(virt_qmf_t) +@@ -1165,12 +1210,12 @@ dev_read_sysfs(virt_qmf_t) dev_read_rand(virt_qmf_t) dev_read_urand(virt_qmf_t) @@ -88517,7 +88518,7 @@ index 1f22fba..832423f 100644 sysnet_read_config(virt_qmf_t) optional_policy(` -@@ -1183,9 +1227,8 @@ optional_policy(` +@@ -1183,9 +1228,8 @@ optional_policy(` ######################################## # @@ -88528,7 +88529,7 @@ index 1f22fba..832423f 100644 allow virt_bridgehelper_t self:process { setcap getcap }; allow virt_bridgehelper_t self:capability { setpcap setgid setuid net_admin }; allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms; -@@ -1198,5 +1241,70 @@ kernel_read_network_state(virt_bridgehelper_t) +@@ -1198,5 +1242,75 @@ kernel_read_network_state(virt_bridgehelper_t) corenet_rw_tun_tap_dev(virt_bridgehelper_t) @@ -88548,7 +88549,7 @@ index 1f22fba..832423f 100644 + +manage_files_pattern(virt_qemu_ga_t, virt_qemu_ga_var_run_t, virt_qemu_ga_var_run_t) +manage_dirs_pattern(virt_qemu_ga_t, virt_qemu_ga_var_run_t, virt_qemu_ga_var_run_t) -+filetrans_pattern(virt_qemu_ga_t, virt_qemu_ga_var_run_t, virt_qemu_ga_var_run_t,{ dir file } ) ++files_pid_filetrans(virt_qemu_ga_t, virt_qemu_ga_var_run_t, { dir file } ) + +manage_files_pattern(virt_qemu_ga_t, virt_qemu_ga_log_t, virt_qemu_ga_log_t) +logging_log_filetrans(virt_qemu_ga_t, virt_qemu_ga_log_t, file ) @@ -88597,6 +88598,11 @@ index 1f22fba..832423f 100644 + shutdown_domtrans(virt_qemu_ga_t) +') + ++####################################### ++# ++# tye for svirt sockets ++# ++ +type svirt_socket_t; +role system_r types svirt_socket_t; +allow virtd_t svirt_socket_t:unix_stream_socket { connectto create_stream_socket_perms }; diff --git a/selinux-policy.spec b/selinux-policy.spec index 0d8d8ec..65a4025 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.12.1 -Release: 40%{?dist} +Release: 41%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -257,7 +257,7 @@ fi; . %{_sysconfdir}/selinux/config; \ if [ -e /etc/selinux/%2/.rebuild ]; then \ rm /etc/selinux/%2/.rebuild; \ - (cd /etc/selinux/%2/modules/active/modules; rm -f shutdown.pp amavis.pp clamav.pp gnomeclock.pp matahari.pp xfs.pp kudzu.pp kerneloops.pp execmem.pp openoffice.pp ada.pp tzdata.pp hal.pp hotplug.pp howl.pp java.pp mono.pp moilscanner.pp gamin.pp audio_entropy.pp audioentropy.pp iscsid.pp polkit_auth.pp polkit.pp rtkit_daemon.pp ModemManager.pp telepathysofiasip.pp ethereal.pp passanger.pp qpidd.pp pyzor.pp razor.pp pki-selinux.pp phpfpm.pp consoletype.pp ctdbd.pp fcoemon.pp isnsd.pp rgmanager.pp corosync.pp aisexec.pp pacemaker.pp ) \ + (cd /etc/selinux/%2/modules/active/modules; rm -f l2tpd.pp shutdown.pp amavis.pp clamav.pp gnomeclock.pp matahari.pp xfs.pp kudzu.pp kerneloops.pp execmem.pp openoffice.pp ada.pp tzdata.pp hal.pp hotplug.pp howl.pp java.pp mono.pp moilscanner.pp gamin.pp audio_entropy.pp audioentropy.pp iscsid.pp polkit_auth.pp polkit.pp rtkit_daemon.pp ModemManager.pp telepathysofiasip.pp ethereal.pp passanger.pp qpidd.pp pyzor.pp razor.pp pki-selinux.pp phpfpm.pp consoletype.pp ctdbd.pp fcoemon.pp isnsd.pp rgmanager.pp corosync.pp aisexec.pp pacemaker.pp ) \ /usr/sbin/semodule -B -n -s %2; \ else \ touch /etc/selinux/%2/modules/active/modules/sandbox.disabled \ @@ -530,6 +530,16 @@ SELinux Reference policy mls base module. %endif %changelog +* Mon May 6 2013 Miroslav Grepl 3.12.1-41 +- Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly +- Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t +- Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid +- Allow virsh to read xen lock file +- Allow qemu-ga to create files in /run with proper labeling +- Allow glusterd to connect to own socket in /tmp +- Allow glance-api to connect to http port to make glance image-create working +- Allow keystonte_t to execute rpm + * Fri May 3 2013 Miroslav Grepl 3.12.1-40 - Fix realmd cache interfaces