From f0d090193ac8e04ad40fac738de4f83109994763 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: May 03 2013 12:21:37 +0000 Subject: - Allow tcpd to execute leafnode - Allow samba-net to read realmd cache files - Dontaudit sys_tty_config for alsactl - Fix allow rules for postfix_var_run - Allow cobblerd to read /etc/passwd - Allow pegasus to read exports - Allow systemd-timedate to read xdm state - Allow mout to stream connect to rpcbind - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki --- diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index 0e35c26..032efca 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -32336,7 +32336,7 @@ index e8c59a5..5c935e3 100644 ') diff --git a/policy/modules/system/miscfiles.fc b/policy/modules/system/miscfiles.fc -index 9fe8e01..fa82aac 100644 +index 9fe8e01..a70c055 100644 --- a/policy/modules/system/miscfiles.fc +++ b/policy/modules/system/miscfiles.fc @@ -9,11 +9,13 @@ ifdef(`distro_gentoo',` @@ -32375,7 +32375,7 @@ index 9fe8e01..fa82aac 100644 /usr/share/X11/locale(/.*)? gen_context(system_u:object_r:locale_t,s0) /usr/share/zoneinfo(/.*)? gen_context(system_u:object_r:locale_t,s0) -+/usr/share/pki(/.*)? gen_context(system_u:object_r:cert_t,s0) ++/usr/share/pki/ca-trust-source(/.*)? gen_context(system_u:object_r:cert_t,s0) /usr/share/ssl/certs(/.*)? gen_context(system_u:object_r:cert_t,s0) /usr/share/ssl/private(/.*)? gen_context(system_u:object_r:cert_t,s0) @@ -33327,7 +33327,7 @@ index 4584457..e432df3 100644 + domtrans_pattern($1, mount_ecryptfs_exec_t, mount_ecryptfs_t) ') diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te -index 6a50270..b34911e 100644 +index 6a50270..117a29a 100644 --- a/policy/modules/system/mount.te +++ b/policy/modules/system/mount.te @@ -10,35 +10,60 @@ policy_module(mount, 1.15.1) @@ -33589,16 +33589,17 @@ index 6a50270..b34911e 100644 corenet_tcp_bind_generic_port(mount_t) corenet_udp_bind_generic_port(mount_t) corenet_tcp_bind_reserved_port(mount_t) -@@ -179,6 +252,8 @@ optional_policy(` +@@ -179,6 +252,9 @@ optional_policy(` fs_search_rpc(mount_t) rpc_stub(mount_t) + + rpc_domtrans_rpcd(mount_t) ++ rpcbind_stream_connect(mount_t) ') optional_policy(` -@@ -186,6 +261,36 @@ optional_policy(` +@@ -186,6 +262,36 @@ optional_policy(` ') optional_policy(` @@ -33635,7 +33636,7 @@ index 6a50270..b34911e 100644 ifdef(`hide_broken_symptoms',` # for a bug in the X server rhgb_dontaudit_rw_stream_sockets(mount_t) -@@ -194,24 +299,128 @@ optional_policy(` +@@ -194,24 +300,128 @@ optional_policy(` ') optional_policy(` @@ -37191,10 +37192,10 @@ index 0000000..2e5b822 +') diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te new file mode 100644 -index 0000000..2c9ccbf +index 0000000..3916463 --- /dev/null +++ b/policy/modules/system/systemd.te -@@ -0,0 +1,643 @@ +@@ -0,0 +1,644 @@ +policy_module(systemd, 1.0.0) + +####################################### @@ -37798,6 +37799,7 @@ index 0000000..2c9ccbf + +optional_policy(` + xserver_manage_config(systemd_timedated_t) ++ xserver_read_state_xdm(systemd_timedated_t) +') + +######################################## diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index cf76426..9b103be 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -1819,10 +1819,10 @@ index 708b743..c2edd9a 100644 + ps_process_pattern($1, alsa_t) +') diff --git a/alsa.te b/alsa.te -index cda6d20..89f2161 100644 +index cda6d20..fbe259e 100644 --- a/alsa.te +++ b/alsa.te -@@ -21,9 +21,15 @@ files_tmp_file(alsa_tmp_t) +@@ -21,16 +21,23 @@ files_tmp_file(alsa_tmp_t) type alsa_var_lib_t; files_type(alsa_var_lib_t) @@ -1838,10 +1838,11 @@ index cda6d20..89f2161 100644 ######################################## # # Local policy -@@ -31,6 +37,7 @@ userdom_user_home_content(alsa_home_t) + # allow alsa_t self:capability { dac_read_search dac_override setgid setuid ipc_owner }; - dontaudit alsa_t self:capability sys_admin; +-dontaudit alsa_t self:capability sys_admin; ++dontaudit alsa_t self:capability { sys_tty_config sys_admin }; +allow alsa_t self:process { getsched setsched signal_perms }; allow alsa_t self:sem create_sem_perms; allow alsa_t self:shm create_shm_perms; @@ -11646,7 +11647,7 @@ index c223f81..83d5104 100644 - admin_pattern($1, { httpd_cobbler_content_t httpd_cobbler_content_ra_t httpd_cobbler_content_rw_t }) ') diff --git a/cobbler.te b/cobbler.te -index 2a71346..bf24fca 100644 +index 2a71346..b3ad8cb 100644 --- a/cobbler.te +++ b/cobbler.te @@ -81,6 +81,7 @@ manage_dirs_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t) @@ -11667,7 +11668,16 @@ index 2a71346..bf24fca 100644 fs_getattr_all_fs(cobblerd_t) fs_read_iso9660_files(cobblerd_t) -@@ -193,12 +192,11 @@ optional_policy(` +@@ -128,6 +127,8 @@ selinux_get_enforce_mode(cobblerd_t) + + term_use_console(cobblerd_t) + ++auth_read_passwd(cobblerd_t) ++ + logging_send_syslog_msg(cobblerd_t) + + miscfiles_read_localization(cobblerd_t) +@@ -193,12 +194,11 @@ optional_policy(` optional_policy(` rsync_read_config(cobblerd_t) @@ -50742,7 +50752,7 @@ index d2fc677..22b745a 100644 + logging_send_syslog_msg(pegasus_openlmi_$1_t) ') diff --git a/pegasus.te b/pegasus.te -index 7bcf327..78d251c 100644 +index 7bcf327..36032a6 100644 --- a/pegasus.te +++ b/pegasus.te @@ -1,17 +1,16 @@ @@ -50908,7 +50918,7 @@ index 7bcf327..78d251c 100644 ') optional_policy(` -@@ -151,16 +165,15 @@ optional_policy(` +@@ -151,16 +165,19 @@ optional_policy(` ') optional_policy(` @@ -50918,17 +50928,21 @@ index 7bcf327..78d251c 100644 optional_policy(` - samba_manage_config(pegasus_t) -+ rpm_exec(pegasus_t) ++ rpc_read_exports(pegasus_t) ') optional_policy(` - seutil_sigchld_newrole(pegasus_t) - seutil_dontaudit_read_config(pegasus_t) ++ rpm_exec(pegasus_t) ++') ++ ++optional_policy(` + samba_manage_config(pegasus_t) ') optional_policy(` -@@ -168,7 +181,7 @@ optional_policy(` +@@ -168,7 +185,7 @@ optional_policy(` ') optional_policy(` @@ -55178,7 +55192,7 @@ index 2e23946..589bbf2 100644 + postfix_config_filetrans($1, postfix_prng_t, file, "prng_exch") ') diff --git a/postfix.te b/postfix.te -index 191a66f..c142af5 100644 +index 191a66f..056b316 100644 --- a/postfix.te +++ b/postfix.te @@ -1,4 +1,4 @@ @@ -56055,7 +56069,7 @@ index 191a66f..c142af5 100644 + +allow postfix_domain postfix_spool_t:dir list_dir_perms; + -+allow postfix_domain postfix_var_run_t:file manage_file_perms; ++manage_files_pattern(postfix_t, postfix_var_run_t, postfix_var_run_t) +files_pid_filetrans(postfix_domain, postfix_var_run_t, file) + +kernel_read_network_state(postfix_domain) @@ -63854,7 +63868,7 @@ index 04babe3..3b92679 100644 + +/var/lib/ipa-client(/.*)? gen_context(system_u:object_r:realmd_var_lib_t,s0) diff --git a/realmd.if b/realmd.if -index bff31df..e38693b 100644 +index bff31df..041893c 100644 --- a/realmd.if +++ b/realmd.if @@ -1,8 +1,9 @@ @@ -63869,6 +63883,93 @@ index bff31df..e38693b 100644 ## ## ## +@@ -39,3 +40,86 @@ interface(`realmd_dbus_chat',` + allow $1 realmd_t:dbus send_msg; + allow realmd_t $1:dbus send_msg; + ') ++ ++######################################## ++## ++## Search realmd cache directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`realmd_search_cache',` ++ gen_require(` ++ type realmd_cache_t; ++ ') ++ ++ allow $1 realmd_cache_t:dir search_dir_perms; ++ files_search_var($1) ++') ++ ++######################################## ++## ++## Read realmd cache files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`realmd_read_cache_files',` ++ gen_require(` ++ type realmd_cache_t; ++ ') ++ ++ files_search_var($1) ++ read_files_pattern($1, realmd_cache_t, realmd_cache_t) ++') ++ ++######################################## ++## ++## Create, read, write, and delete ++## realmd cache files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`realmd_manage_cache_files',` ++ gen_require(` ++ type realmd_cache_t; ++ ') ++ ++ files_search_var($1) ++ manage_files_pattern($1, realmd_cache_t, realmd_cache_t) ++') ++ ++######################################## ++## ++## Manage realmd cache dirs. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`realmd_manage_cache_dirs',` ++ gen_require(` ++ type realmd_cache_t; ++ ') ++ ++ files_search_var($1) ++ manage_dirs_pattern($1, realmd_cache_t, realmd_cache_t) ++') ++ ++ ++manage_dirs_pattern(realmd_t, realmd_cache_t, realmd_cache_t) ++manage_files_pattern(realmd_t, realmd_cache_t, realmd_cache_t) ++manage_lnk_files_pattern(realmd_t, realmd_cache_t, realmd_cache_t) ++files_var_filetrans(realmd_t, realmd_cache_t, { dir file lnk_file }) diff --git a/realmd.te b/realmd.te index 9a8f052..c558c79 100644 --- a/realmd.te @@ -71284,7 +71385,7 @@ index aee75af..a6bab06 100644 + allow $1 samba_unit_file_t:service all_service_perms; ') diff --git a/samba.te b/samba.te -index 57c034b..b4a043c 100644 +index 57c034b..7369a2c 100644 --- a/samba.te +++ b/samba.te @@ -1,4 +1,4 @@ @@ -71555,9 +71656,14 @@ index 57c034b..b4a043c 100644 ') optional_policy(` -@@ -246,37 +237,42 @@ optional_policy(` +@@ -245,38 +236,47 @@ optional_policy(` + ') optional_policy(` ++ realmd_read_cache_files(samba_net_t) ++') ++ ++optional_policy(` kerberos_use(samba_net_t) - kerberos_etc_filetrans_keytab(samba_net_t, file) + kerberos_etc_filetrans_keytab(samba_net_t) @@ -71589,14 +71695,14 @@ index 57c034b..b4a043c 100644 +allow smbd_t self:udp_socket create_socket_perms; +allow smbd_t self:unix_dgram_socket { create_socket_perms sendto }; +allow smbd_t self:unix_stream_socket { create_stream_socket_perms connectto }; - --allow smbd_t { swat_t winbind_t smbcontrol_t nmbd_t }:process { signal signull }; ++ +allow smbd_t nmbd_t:process { signal signull }; --allow smbd_t samba_etc_t:file { rw_file_perms setattr_file_perms }; +-allow smbd_t { swat_t winbind_t smbcontrol_t nmbd_t }:process { signal signull }; +allow smbd_t nmbd_var_run_t:file rw_file_perms; +stream_connect_pattern(smbd_t, nmbd_var_run_t, nmbd_var_run_t, nmbd_t) -+ + +-allow smbd_t samba_etc_t:file { rw_file_perms setattr_file_perms }; +allow smbd_t samba_etc_t:file { rw_file_perms setattr }; manage_dirs_pattern(smbd_t, samba_log_t, samba_log_t) @@ -71610,7 +71716,7 @@ index 57c034b..b4a043c 100644 manage_files_pattern(smbd_t, samba_secrets_t, samba_secrets_t) filetrans_pattern(smbd_t, samba_etc_t, samba_secrets_t, file) -@@ -292,6 +288,8 @@ manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t) +@@ -292,6 +292,8 @@ manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_sock_files_pattern(smbd_t, samba_var_t, samba_var_t) files_var_filetrans(smbd_t, samba_var_t, dir, "samba") @@ -71619,7 +71725,7 @@ index 57c034b..b4a043c 100644 manage_dirs_pattern(smbd_t, smbd_tmp_t, smbd_tmp_t) manage_files_pattern(smbd_t, smbd_tmp_t, smbd_tmp_t) files_tmp_filetrans(smbd_t, smbd_tmp_t, { file dir }) -@@ -301,11 +299,11 @@ manage_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t) +@@ -301,11 +303,11 @@ manage_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t) manage_sock_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t) files_pid_filetrans(smbd_t, smbd_var_run_t, { dir file }) @@ -71635,7 +71741,7 @@ index 57c034b..b4a043c 100644 kernel_getattr_core_if(smbd_t) kernel_getattr_message_if(smbd_t) -@@ -315,43 +313,33 @@ kernel_read_kernel_sysctls(smbd_t) +@@ -315,43 +317,33 @@ kernel_read_kernel_sysctls(smbd_t) kernel_read_software_raid_state(smbd_t) kernel_read_system_state(smbd_t) @@ -71690,7 +71796,7 @@ index 57c034b..b4a043c 100644 fs_getattr_all_fs(smbd_t) fs_getattr_all_dirs(smbd_t) fs_get_xattr_fs_quotas(smbd_t) -@@ -360,44 +348,54 @@ fs_getattr_rpc_dirs(smbd_t) +@@ -360,44 +352,54 @@ fs_getattr_rpc_dirs(smbd_t) fs_list_inotifyfs(smbd_t) fs_get_all_fs_quotas(smbd_t) @@ -71756,7 +71862,7 @@ index 57c034b..b4a043c 100644 ') tunable_policy(`samba_domain_controller',` -@@ -413,20 +411,10 @@ tunable_policy(`samba_domain_controller',` +@@ -413,20 +415,10 @@ tunable_policy(`samba_domain_controller',` ') tunable_policy(`samba_enable_home_dirs',` @@ -71779,7 +71885,7 @@ index 57c034b..b4a043c 100644 tunable_policy(`samba_share_nfs',` fs_manage_nfs_dirs(smbd_t) fs_manage_nfs_files(smbd_t) -@@ -435,6 +423,7 @@ tunable_policy(`samba_share_nfs',` +@@ -435,6 +427,7 @@ tunable_policy(`samba_share_nfs',` fs_manage_nfs_named_sockets(smbd_t) ') @@ -71787,7 +71893,7 @@ index 57c034b..b4a043c 100644 tunable_policy(`samba_share_fusefs',` fs_manage_fusefs_dirs(smbd_t) fs_manage_fusefs_files(smbd_t) -@@ -442,17 +431,6 @@ tunable_policy(`samba_share_fusefs',` +@@ -442,17 +435,6 @@ tunable_policy(`samba_share_fusefs',` fs_search_fusefs(smbd_t) ') @@ -71805,7 +71911,7 @@ index 57c034b..b4a043c 100644 optional_policy(` ccs_read_config(smbd_t) ') -@@ -473,6 +451,11 @@ optional_policy(` +@@ -473,6 +455,11 @@ optional_policy(` ') optional_policy(` @@ -71817,7 +71923,7 @@ index 57c034b..b4a043c 100644 lpd_exec_lpr(smbd_t) ') -@@ -493,9 +476,33 @@ optional_policy(` +@@ -493,9 +480,33 @@ optional_policy(` udev_read_db(smbd_t) ') @@ -71852,7 +71958,7 @@ index 57c034b..b4a043c 100644 # dontaudit nmbd_t self:capability sys_tty_config; -@@ -506,9 +513,11 @@ allow nmbd_t self:msg { send receive }; +@@ -506,9 +517,11 @@ allow nmbd_t self:msg { send receive }; allow nmbd_t self:msgq create_msgq_perms; allow nmbd_t self:sem create_sem_perms; allow nmbd_t self:shm create_shm_perms; @@ -71867,7 +71973,7 @@ index 57c034b..b4a043c 100644 manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t) manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t) -@@ -520,20 +529,15 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) +@@ -520,20 +533,15 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t) @@ -71891,7 +71997,7 @@ index 57c034b..b4a043c 100644 kernel_getattr_core_if(nmbd_t) kernel_getattr_message_if(nmbd_t) -@@ -542,52 +546,40 @@ kernel_read_network_state(nmbd_t) +@@ -542,52 +550,40 @@ kernel_read_network_state(nmbd_t) kernel_read_software_raid_state(nmbd_t) kernel_read_system_state(nmbd_t) @@ -71956,7 +72062,7 @@ index 57c034b..b4a043c 100644 ') optional_policy(` -@@ -600,17 +592,24 @@ optional_policy(` +@@ -600,17 +596,24 @@ optional_policy(` ######################################## # @@ -71976,16 +72082,16 @@ index 57c034b..b4a043c 100644 -read_files_pattern(smbcontrol_t, { nmbd_var_run_t smbd_var_run_t }, { nmbd_var_run_t smbd_var_run_t }) +allow smbcontrol_t nmbd_t:process { signal signull }; +read_files_pattern(smbcontrol_t, nmbd_var_run_t, nmbd_var_run_t) - ++ +allow smbcontrol_t smbd_t:process { signal signull }; +read_files_pattern(smbcontrol_t, smbd_var_run_t, smbd_var_run_t) +allow smbcontrol_t winbind_t:process { signal signull }; -+ + +files_search_var_lib(smbcontrol_t) samba_read_config(smbcontrol_t) samba_rw_var_files(smbcontrol_t) samba_search_var(smbcontrol_t) -@@ -620,16 +619,12 @@ domain_use_interactive_fds(smbcontrol_t) +@@ -620,16 +623,12 @@ domain_use_interactive_fds(smbcontrol_t) dev_read_urand(smbcontrol_t) @@ -72003,7 +72109,7 @@ index 57c034b..b4a043c 100644 optional_policy(` ctdbd_stream_connect(smbcontrol_t) -@@ -637,22 +632,23 @@ optional_policy(` +@@ -637,22 +636,23 @@ optional_policy(` ######################################## # @@ -72035,7 +72141,7 @@ index 57c034b..b4a043c 100644 allow smbmount_t samba_secrets_t:file manage_file_perms; -@@ -661,26 +657,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) +@@ -661,26 +661,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t) files_var_filetrans(smbmount_t, samba_var_t, dir, "samba") @@ -72071,7 +72177,7 @@ index 57c034b..b4a043c 100644 fs_getattr_cifs(smbmount_t) fs_mount_cifs(smbmount_t) -@@ -692,58 +684,77 @@ fs_read_cifs_files(smbmount_t) +@@ -692,58 +688,77 @@ fs_read_cifs_files(smbmount_t) storage_raw_read_fixed_disk(smbmount_t) storage_raw_write_fixed_disk(smbmount_t) @@ -72163,7 +72269,7 @@ index 57c034b..b4a043c 100644 manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t) manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t) -@@ -752,17 +763,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) +@@ -752,17 +767,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t) files_pid_filetrans(swat_t, swat_var_run_t, file) @@ -72187,7 +72293,7 @@ index 57c034b..b4a043c 100644 kernel_read_kernel_sysctls(swat_t) kernel_read_system_state(swat_t) -@@ -770,36 +777,25 @@ kernel_read_network_state(swat_t) +@@ -770,36 +781,25 @@ kernel_read_network_state(swat_t) corecmd_search_bin(swat_t) @@ -72230,7 +72336,7 @@ index 57c034b..b4a043c 100644 auth_domtrans_chk_passwd(swat_t) auth_use_nsswitch(swat_t) -@@ -811,10 +807,11 @@ logging_send_syslog_msg(swat_t) +@@ -811,10 +811,11 @@ logging_send_syslog_msg(swat_t) logging_send_audit_msgs(swat_t) logging_search_logs(swat_t) @@ -72244,7 +72350,7 @@ index 57c034b..b4a043c 100644 optional_policy(` cups_read_rw_config(swat_t) cups_stream_connect(swat_t) -@@ -837,13 +834,15 @@ allow winbind_t self:capability { dac_override ipc_lock setuid sys_nice }; +@@ -837,13 +838,15 @@ allow winbind_t self:capability { dac_override ipc_lock setuid sys_nice }; dontaudit winbind_t self:capability sys_tty_config; allow winbind_t self:process { signal_perms getsched setsched }; allow winbind_t self:fifo_file rw_fifo_file_perms; @@ -72264,7 +72370,7 @@ index 57c034b..b4a043c 100644 allow winbind_t samba_etc_t:dir list_dir_perms; read_files_pattern(winbind_t, samba_etc_t, samba_etc_t) -@@ -853,9 +852,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) +@@ -853,9 +856,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file) manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t) @@ -72275,7 +72381,7 @@ index 57c034b..b4a043c 100644 manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t) manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t) -@@ -866,23 +863,21 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba") +@@ -866,23 +867,21 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba") rw_files_pattern(winbind_t, smbd_tmp_t, smbd_tmp_t) @@ -72305,7 +72411,7 @@ index 57c034b..b4a043c 100644 manage_sock_files_pattern(winbind_t, smbd_var_run_t, smbd_var_run_t) kernel_read_network_state(winbind_t) -@@ -891,13 +886,17 @@ kernel_read_system_state(winbind_t) +@@ -891,13 +890,17 @@ kernel_read_system_state(winbind_t) corecmd_exec_bin(winbind_t) @@ -72326,7 +72432,7 @@ index 57c034b..b4a043c 100644 corenet_tcp_connect_smbd_port(winbind_t) corenet_tcp_connect_epmap_port(winbind_t) corenet_tcp_connect_all_unreserved_ports(winbind_t) -@@ -905,10 +904,6 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) +@@ -905,10 +908,6 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) dev_read_sysfs(winbind_t) dev_read_urand(winbind_t) @@ -72337,7 +72443,7 @@ index 57c034b..b4a043c 100644 fs_getattr_all_fs(winbind_t) fs_search_auto_mountpoints(winbind_t) -@@ -917,18 +912,24 @@ auth_domtrans_chk_passwd(winbind_t) +@@ -917,18 +916,24 @@ auth_domtrans_chk_passwd(winbind_t) auth_use_nsswitch(winbind_t) auth_manage_cache(winbind_t) @@ -72364,7 +72470,7 @@ index 57c034b..b4a043c 100644 optional_policy(` ctdbd_stream_connect(winbind_t) -@@ -936,7 +937,12 @@ optional_policy(` +@@ -936,7 +941,12 @@ optional_policy(` ') optional_policy(` @@ -72377,7 +72483,7 @@ index 57c034b..b4a043c 100644 ') optional_policy(` -@@ -952,31 +958,29 @@ optional_policy(` +@@ -952,31 +962,29 @@ optional_policy(` # Winbind helper local policy # @@ -72415,7 +72521,7 @@ index 57c034b..b4a043c 100644 optional_policy(` apache_append_log(winbind_helper_t) -@@ -990,25 +994,38 @@ optional_policy(` +@@ -990,25 +998,38 @@ optional_policy(` ######################################## # @@ -80385,7 +80491,7 @@ index 6c06a84..0000000 - rpm_exec(stapserver_t) -') diff --git a/tcpd.te b/tcpd.te -index f388db3..3c5c32e 100644 +index f388db3..1e1a075 100644 --- a/tcpd.te +++ b/tcpd.te @@ -23,7 +23,6 @@ manage_dirs_pattern(tcpd_t, tcpd_tmp_t, tcpd_tmp_t) @@ -80396,9 +80502,12 @@ index f388db3..3c5c32e 100644 corenet_all_recvfrom_netlabel(tcpd_t) corenet_tcp_sendrecv_generic_if(tcpd_t) corenet_tcp_sendrecv_generic_node(tcpd_t) -@@ -33,13 +32,10 @@ fs_getattr_xattr_fs(tcpd_t) +@@ -31,15 +30,12 @@ corenet_tcp_sendrecv_all_ports(tcpd_t) + + fs_getattr_xattr_fs(tcpd_t) - corecmd_search_bin(tcpd_t) +-corecmd_search_bin(tcpd_t) ++corecmd_exec_bin(tcpd_t) -files_read_etc_files(tcpd_t) files_dontaudit_search_var(tcpd_t) diff --git a/selinux-policy.spec b/selinux-policy.spec index b5bdd7c..5ed207f 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.12.1 -Release: 38%{?dist} +Release: 39%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -530,6 +530,17 @@ SELinux Reference policy mls base module. %endif %changelog +* Fri May 3 2013 Miroslav Grepl 3.12.1-39 +- Allow tcpd to execute leafnode +- Allow samba-net to read realmd cache files +- Dontaudit sys_tty_config for alsactl +- Fix allow rules for postfix_var_run +- Allow cobblerd to read /etc/passwd +- Allow pegasus to read exports +- Allow systemd-timedate to read xdm state +- Allow mout to stream connect to rpcbind +- Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki + * Tue Apr 30 2013 Miroslav Grepl 3.12.1-38 - Allow thumbnails to share memory with apps which run thumbnails - Allow postfix-postqueue block_suspend