++## Allow cluster administrative domains to connect to the network using TCP. ++##
++##++## Allow cluster administrative domains to manage all files on a system. ++##
++##++## Allow cluster administrative cluster domains memcheck-amd64- to use executable memory ++##
++##-+## Allow rsync servers to share cifs files systems ++## Allow rsync to run as a client +##
##-## Determine whether rsync can -## use fuse file systems. @@ -68200,11 +68895,9 @@ index e3e7c96..2574954 100644 -## Determine whether rsync can use -## nfs file systems. -##
-+##-+## Allow rsync servers to share nfs files systems -+##
- ##@@ -68212,10 +68905,11 @@ index e3e7c96..2574954 100644 -## run as a client -##
+##-+## Allow rsync to run as a client ++## Allow rsync to export any files/directories read only. +##
##@@ -68223,21 +68917,15 @@ index e3e7c96..2574954 100644 -## export all content read only. -##
+##-+## Allow rsync to export any files/directories read only. -+##
- ##+## Allow rsync to modify public files +## used for public file transfer services. Files/Directories must be +## labeled public_content_rw_t. +##
-+##
-## Determine whether rsync can modify
-## public files used for public file
@@ -68268,7 +68956,7 @@ index e3e7c96..2574954 100644
files_type(rsync_data_t)
type rsync_log_t;
-@@ -86,15 +79,25 @@ files_pid_file(rsync_var_run_t)
+@@ -86,15 +65,25 @@ files_pid_file(rsync_var_run_t)
allow rsync_t self:capability { chown dac_read_search dac_override fowner fsetid setuid setgid sys_chroot };
allow rsync_t self:process signal_perms;
allow rsync_t self:fifo_file rw_fifo_file_perms;
@@ -68299,7 +68987,7 @@ index e3e7c96..2574954 100644
logging_log_filetrans(rsync_t, rsync_log_t, file)
manage_dirs_pattern(rsync_t, rsync_tmp_t, rsync_tmp_t)
-@@ -108,91 +111,76 @@ kernel_read_kernel_sysctls(rsync_t)
+@@ -108,91 +97,76 @@ kernel_read_kernel_sysctls(rsync_t)
kernel_read_system_state(rsync_t)
kernel_read_network_state(rsync_t)
@@ -75129,7 +75817,7 @@ index 7a9cc9d..86cbca9 100644
init_labeled_script_domtrans($1, snmpd_initrc_exec_t)
domain_system_change_exemption($1)
diff --git a/snmp.te b/snmp.te
-index 81864ce..a56b827 100644
+index 81864ce..54a1bc6 100644
--- a/snmp.te
+++ b/snmp.te
@@ -27,11 +27,13 @@ files_type(snmpd_var_lib_t)
@@ -75195,6 +75883,15 @@ index 81864ce..a56b827 100644
seutil_dontaudit_search_config(snmpd_t)
+@@ -131,7 +133,7 @@ optional_policy(`
+ ')
+
+ optional_policy(`
+- corosync_stream_connect(snmpd_t)
++ rhcs_stream_connect_cluster(snmpd_t)
+ ')
+
+ optional_policy(`
diff --git a/snort.if b/snort.if
index 7d86b34..5f58180 100644
--- a/snort.if
@@ -86819,18 +87516,23 @@ index 1e3aec0..d17ff39 100644
+
')
diff --git a/wdmd.te b/wdmd.te
-index ebbdaf6..63c53ba 100644
+index ebbdaf6..956f8f0 100644
--- a/wdmd.te
+++ b/wdmd.te
-@@ -51,8 +51,6 @@ auth_use_nsswitch(wdmd_t)
+@@ -51,10 +51,8 @@ auth_use_nsswitch(wdmd_t)
logging_send_syslog_msg(wdmd_t)
-miscfiles_read_localization(wdmd_t)
-
optional_policy(`
- corosync_initrc_domtrans(wdmd_t)
- corosync_stream_connect(wdmd_t)
+- corosync_initrc_domtrans(wdmd_t)
+- corosync_stream_connect(wdmd_t)
+- corosync_rw_tmpfs(wdmd_t)
++ rhcs_initrc_domtrans_cluster(wdmd_t)
++ rhcs_stream_connect_cluster(wdmd_t)
++ rhcs_rw_cluster_tmpfs(wdmd_t)
+ ')
diff --git a/webadm.te b/webadm.te
index 708254f..d26f598 100644
--- a/webadm.te
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 45f4167..1d8a7f4 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.12.1
-Release: 16%{?dist}
+Release: 18%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -230,7 +230,7 @@ if [ $? = 0 -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \
rm -f ${FILE_CONTEXT}.pre; \
fi; \
/sbin/restorecon -e /run/media -R /root /var/log /var/run /etc/passwd* /etc/group* /etc/*shadow* 2> /dev/null; \
-/sbin/restorecon -R /home/*/.cache /home/*/.config 2> /dev/null;
+/sbin/restorecon -R /home/*/.cache /home/*/.config 2> /dev/null; \
%define preInstall() \
if [ $1 -ne 1 ] && [ -s /etc/selinux/config ]; then \
@@ -253,7 +253,7 @@ fi;
. %{_sysconfdir}/selinux/config; \
if [ -e /etc/selinux/%2/.rebuild ]; then \
rm /etc/selinux/%2/.rebuild; \
- (cd /etc/selinux/%2/modules/active/modules; rm -f shutdown.pp amavis.pp clamav.pp gnomeclock.pp matahari.pp xfs.pp kudzu.pp kerneloops.pp execmem.pp openoffice.pp ada.pp tzdata.pp hal.pp hotplug.pp howl.pp java.pp mono.pp moilscanner.pp gamin.pp audio_entropy.pp audioentropy.pp iscsid.pp polkit_auth.pp polkit.pp rtkit_daemon.pp ModemManager.pp telepathysofiasip.pp ethereal.pp passanger.pp qpidd.pp pyzor.pp razor.pp pki-selinux.pp phpfpm.pp consoletype.pp ctdbd.pp fcoemon.pp isnsd.pp l2tp.pp ) \
+ (cd /etc/selinux/%2/modules/active/modules; rm -f shutdown.pp amavis.pp clamav.pp gnomeclock.pp matahari.pp xfs.pp kudzu.pp kerneloops.pp execmem.pp openoffice.pp ada.pp tzdata.pp hal.pp hotplug.pp howl.pp java.pp mono.pp moilscanner.pp gamin.pp audio_entropy.pp audioentropy.pp iscsid.pp polkit_auth.pp polkit.pp rtkit_daemon.pp ModemManager.pp telepathysofiasip.pp ethereal.pp passanger.pp qpidd.pp pyzor.pp razor.pp pki-selinux.pp phpfpm.pp consoletype.pp ctdbd.pp fcoemon.pp isnsd.pp l2tp.pp rgmanager.pp corosync.pp aisexec.pp pacemaker.pp ) \
/usr/sbin/semodule -B -n -s %2; \
else \
touch /etc/selinux/%2/modules/active/modules/sandbox.disabled \
@@ -526,6 +526,12 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Mon Mar 4 2013 Miroslav Grepl