diff --git a/booleans-targeted.conf b/booleans-targeted.conf index a0b90da..64f8102 100644 --- a/booleans-targeted.conf +++ b/booleans-targeted.conf @@ -158,18 +158,10 @@ use_samba_home_dirs = false # user_ping = true -# Allow gpg executable stack -# -allow_gpg_execstack = false - # allow host key based authentication # allow_ssh_keysign = false -# Allow users to connect to mysql -# -allow_user_mysql_connect = false - # Allow pppd to be run for a regular user # pppd_for_user = false @@ -226,14 +218,6 @@ allow_polyinstantiation = false # allow_daemons_dump_core = true -# Allow mount command to mounton any directory -# -allow_mounton_anydir = true - -# Allow unlabeled packets to flow -# -allow_unlabeled_packets = true - # Allow samba to act as the domain controller # samba_domain_controller = false diff --git a/policy-20070703.patch b/policy-20070703.patch index c761aaa..8650c89 100644 --- a/policy-20070703.patch +++ b/policy-20070703.patch @@ -1,6 +1,58 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.8/Rules.modular +--- nsaserefpolicy/Rules.modular 2007-10-22 13:21:44.000000000 -0400 ++++ serefpolicy-3.0.8/Rules.modular 2008-04-04 16:11:04.000000000 -0400 +@@ -96,6 +96,9 @@ + @test -d $(builddir) || mkdir -p $(builddir) + $(verbose) $(SEMOD_PKG) -o $@ -m $(base_mod) -f $(base_fc) -u $(users_extra) -s $(tmpdir)/seusers + ++ifneq "$(UNK_PERMS)" "" ++$(base_mod): CHECKMODULE += -U $(UNK_PERMS) ++endif + $(base_mod): $(base_conf) + @echo "Compiling $(NAME) base module" + $(verbose) $(CHECKMODULE) $^ -o $@ +@@ -144,6 +147,7 @@ + + $(tmpdir)/rolemap.conf: M4PARAM += -D self_contained_policy + $(tmpdir)/rolemap.conf: $(rolemap) ++ $(verbose) echo "" > $@ + $(call parse-rolemap,base,$@) + + $(tmpdir)/all_te_files.conf: M4PARAM += -D self_contained_policy +diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.monolithic serefpolicy-3.0.8/Rules.monolithic +--- nsaserefpolicy/Rules.monolithic 2007-10-22 13:21:43.000000000 -0400 ++++ serefpolicy-3.0.8/Rules.monolithic 2008-04-04 16:11:04.000000000 -0400 +@@ -63,6 +63,9 @@ + # + # Build a binary policy locally + # ++ifneq "$(UNK_PERMS)" "" ++$(polver): CHECKPOLICY += -U $(UNK_PERMS) ++endif + $(polver): $(policy_conf) + @echo "Compiling $(NAME) $(polver)" + ifneq ($(pv),$(kv)) +@@ -76,6 +79,9 @@ + # + # Install a binary policy + # ++ifneq "$(UNK_PERMS)" "" ++$(loadpath): CHECKPOLICY += -U $(UNK_PERMS) ++endif + $(loadpath): $(policy_conf) + @mkdir -p $(policypath) + @echo "Compiling and installing $(NAME) $(loadpath)" +@@ -127,6 +133,7 @@ + @echo "divert" >> $@ + + $(tmpdir)/rolemap.conf: $(rolemap) ++ $(verbose) echo "" > $@ + $(call parse-rolemap,base,$@) + + $(tmpdir)/all_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf $(all_te_files) $(tmpdir)/rolemap.conf diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_contexts serefpolicy-3.0.8/config/appconfig-mcs/default_contexts --- nsaserefpolicy/config/appconfig-mcs/default_contexts 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mcs/default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mcs/default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -1,15 +1,9 @@ -system_r:crond_t:s0 user_r:user_crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 unconfined_r:unconfined_crond_t:s0 -system_r:local_login_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0 @@ -28,7 +80,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default +system_r:xdm_t:s0 system_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_type serefpolicy-3.0.8/config/appconfig-mcs/default_type --- nsaserefpolicy/config/appconfig-mcs/default_type 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mcs/default_type 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mcs/default_type 2008-04-04 16:11:03.000000000 -0400 @@ -1,4 +1,4 @@ +system_r:unconfined_t sysadm_r:sysadm_t @@ -37,13 +89,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default user_r:user_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/failsafe_context serefpolicy-3.0.8/config/appconfig-mcs/failsafe_context --- nsaserefpolicy/config/appconfig-mcs/failsafe_context 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mcs/failsafe_context 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mcs/failsafe_context 2008-04-04 16:11:03.000000000 -0400 @@ -1 +1 @@ -sysadm_r:sysadm_t:s0 +system_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/guest_u_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mcs/guest_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mcs/guest_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,4 @@ +system_r:local_login_t:s0 guest_r:guest_t:s0 +system_r:remote_login_t:s0 guest_r:guest_t:s0 @@ -51,7 +103,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/guest_u +system_r:crond_t:s0 guest_r:guest_crond_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/root_default_contexts --- nsaserefpolicy/config/appconfig-mcs/root_default_contexts 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mcs/root_default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mcs/root_default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -1,11 +1,10 @@ -system_r:crond_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0 -system_r:local_login_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 @@ -73,7 +125,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_de + diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/seusers serefpolicy-3.0.8/config/appconfig-mcs/seusers --- nsaserefpolicy/config/appconfig-mcs/seusers 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mcs/seusers 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mcs/seusers 2008-04-04 16:11:03.000000000 -0400 @@ -1,3 +1,2 @@ -system_u:system_u:s0-mcs_systemhigh root:root:s0-mcs_systemhigh @@ -81,7 +133,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/seusers +__default__:system_u:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/staff_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mcs/staff_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mcs/staff_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,9 @@ +system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +system_r:remote_login_t:s0 staff_r:staff_t:s0 @@ -92,15 +144,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/staff_u +staff_r:staff_sudo_t:s0 staff_r:staff_t:s0 +sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 +sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/userhelper_context serefpolicy-3.0.8/config/appconfig-mcs/userhelper_context ---- nsaserefpolicy/config/appconfig-mcs/userhelper_context 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mcs/userhelper_context 2007-12-02 21:15:34.000000000 -0500 -@@ -1 +1 @@ --system_u:sysadm_r:sysadm_t:s0 -+system_u:system_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/user_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mcs/user_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mcs/user_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,7 @@ +system_r:local_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +system_r:remote_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 @@ -109,9 +155,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/user_u_ +system_r:xdm_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +user_r:user_su_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +user_r:user_sudo_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/userhelper_context serefpolicy-3.0.8/config/appconfig-mcs/userhelper_context +--- nsaserefpolicy/config/appconfig-mcs/userhelper_context 2007-10-22 13:21:43.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mcs/userhelper_context 2008-04-04 16:11:03.000000000 -0400 +@@ -1 +1 @@ +-system_u:sysadm_r:sysadm_t:s0 ++system_u:system_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/xguest_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mcs/xguest_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mcs/xguest_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,5 @@ +system_r:local_login_t xguest_r:xguest_t:s0 +system_r:remote_login_t xguest_r:xguest_t:s0 @@ -120,7 +172,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_ +system_r:xdm_t xguest_r:xguest_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default_contexts serefpolicy-3.0.8/config/appconfig-mls/default_contexts --- nsaserefpolicy/config/appconfig-mls/default_contexts 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mls/default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mls/default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -1,15 +1,12 @@ -system_r:crond_t:s0 user_r:user_crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 unconfined_r:unconfined_crond_t:s0 -system_r:local_login_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0 @@ -150,7 +202,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default +user_r:user_sudo_t:s0 sysadm_r:sysadm_t:s0 user_r:user_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/guest_u_default_contexts serefpolicy-3.0.8/config/appconfig-mls/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-mls/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mls/guest_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mls/guest_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,4 @@ +system_r:local_login_t:s0 guest_r:guest_t:s0 +system_r:remote_login_t:s0 guest_r:guest_t:s0 @@ -158,7 +210,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/guest_u +system_r:crond_t:s0 guest_r:guest_crond_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/root_default_contexts serefpolicy-3.0.8/config/appconfig-mls/root_default_contexts --- nsaserefpolicy/config/appconfig-mls/root_default_contexts 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mls/root_default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mls/root_default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -1,11 +1,9 @@ -system_r:crond_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0 -system_r:local_login_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 @@ -179,7 +231,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/root_de +#system_r:sshd_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/staff_u_default_contexts serefpolicy-3.0.8/config/appconfig-mls/staff_u_default_contexts --- nsaserefpolicy/config/appconfig-mls/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mls/staff_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mls/staff_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,9 @@ +system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +system_r:remote_login_t:s0 staff_r:staff_t:s0 @@ -192,7 +244,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/staff_u +sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/user_u_default_contexts serefpolicy-3.0.8/config/appconfig-mls/user_u_default_contexts --- nsaserefpolicy/config/appconfig-mls/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mls/user_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-mls/user_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,7 @@ +system_r:local_login_t:s0 user_r:user_t:s0 +system_r:remote_login_t:s0 user_r:user_t:s0 @@ -203,7 +255,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/user_u_ +user_r:user_sudo_t:s0 user_r:user_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/guest_u_default_contexts serefpolicy-3.0.8/config/appconfig-standard/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-standard/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-standard/guest_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-standard/guest_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,4 @@ +system_r:local_login_t guest_r:guest_t +system_r:remote_login_t guest_r:guest_t @@ -211,7 +263,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/gu +system_r:crond_t guest_r:guest_crond_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/staff_u_default_contexts serefpolicy-3.0.8/config/appconfig-standard/staff_u_default_contexts --- nsaserefpolicy/config/appconfig-standard/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-standard/staff_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-standard/staff_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,9 @@ +system_r:local_login_t staff_r:staff_t sysadm_r:sysadm_t +system_r:remote_login_t staff_r:staff_t @@ -224,7 +276,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/st +sysadm_r:sysadm_sudo_t sysadm_r:sysadm_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/user_u_default_contexts serefpolicy-3.0.8/config/appconfig-standard/user_u_default_contexts --- nsaserefpolicy/config/appconfig-standard/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-standard/user_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-standard/user_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,7 @@ +system_r:local_login_t system_r:unconfined_t user_r:user_t +system_r:remote_login_t system_r:unconfined_t user_r:user_t @@ -235,7 +287,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/us +user_r:user_sudo_t system_r:unconfined_t user_r:user_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/xguest_u_default_contexts serefpolicy-3.0.8/config/appconfig-standard/xguest_u_default_contexts --- nsaserefpolicy/config/appconfig-standard/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-standard/xguest_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/config/appconfig-standard/xguest_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,5 @@ +system_r:local_login_t xguest_r:xguest_t +system_r:remote_login_t xguest_r:xguest_t @@ -244,7 +296,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/xg +system_r:xdm_t xguest_r:xguest_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.0.8/man/man8/ftpd_selinux.8 --- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-10-22 13:21:44.000000000 -0400 -+++ serefpolicy-3.0.8/man/man8/ftpd_selinux.8 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/man/man8/ftpd_selinux.8 2008-04-04 16:11:03.000000000 -0400 @@ -12,7 +12,7 @@ .TP chcon -R -t public_content_t /var/ftp @@ -256,7 +308,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 sere .TP diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/httpd_selinux.8 serefpolicy-3.0.8/man/man8/httpd_selinux.8 --- nsaserefpolicy/man/man8/httpd_selinux.8 2007-10-22 13:21:44.000000000 -0400 -+++ serefpolicy-3.0.8/man/man8/httpd_selinux.8 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/man/man8/httpd_selinux.8 2008-04-04 16:11:03.000000000 -0400 @@ -30,7 +30,7 @@ .EX httpd_sys_script_ro_t @@ -268,7 +320,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/httpd_selinux.8 ser .EE diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/samba_selinux.8 serefpolicy-3.0.8/man/man8/samba_selinux.8 --- nsaserefpolicy/man/man8/samba_selinux.8 2007-10-22 13:21:44.000000000 -0400 -+++ serefpolicy-3.0.8/man/man8/samba_selinux.8 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/man/man8/samba_selinux.8 2008-04-04 16:11:03.000000000 -0400 @@ -1,50 +1,83 @@ -.TH "samba_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "Samba Selinux Policy documentation" +.TH "samba_selinux" "8" "9 Nov 2007" "dwalsh@redhat.com" "Samba Selinux Policy documentation" @@ -389,7 +441,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/samba_selinux.8 ser +selinux(8), semanage(8), samba(7), chcon(1), setsebool(8), restorecon(8), diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/ftpd_selinux.8 serefpolicy-3.0.8/man/ru/man8/ftpd_selinux.8 --- nsaserefpolicy/man/ru/man8/ftpd_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/ftpd_selinux.8 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/man/ru/man8/ftpd_selinux.8 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,57 @@ +.TH "ftpd_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "ftpd Selinux Policy documentation" +.SH "НАЗВАНИЕ" @@ -450,7 +502,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/ftpd_selinux.8 s + diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/httpd_selinux.8 serefpolicy-3.0.8/man/ru/man8/httpd_selinux.8 --- nsaserefpolicy/man/ru/man8/httpd_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/httpd_selinux.8 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/man/ru/man8/httpd_selinux.8 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,137 @@ +.TH "httpd_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "httpd Selinux Policy documentation" +.de EX @@ -591,7 +643,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/httpd_selinux.8 + diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/kerberos_selinux.8 serefpolicy-3.0.8/man/ru/man8/kerberos_selinux.8 --- nsaserefpolicy/man/ru/man8/kerberos_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/kerberos_selinux.8 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/man/ru/man8/kerberos_selinux.8 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,30 @@ +.TH "kerberos_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "kerberos Selinux Policy documentation" +.de EX @@ -625,7 +677,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/kerberos_selinux +selinux(8), kerberos(1), chcon(1), setsebool(8) diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/named_selinux.8 serefpolicy-3.0.8/man/ru/man8/named_selinux.8 --- nsaserefpolicy/man/ru/man8/named_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/named_selinux.8 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/man/ru/man8/named_selinux.8 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,31 @@ +.TH "named_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "named Selinux Policy documentation" +.de EX @@ -660,7 +712,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/named_selinux.8 + diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/nfs_selinux.8 serefpolicy-3.0.8/man/ru/man8/nfs_selinux.8 --- nsaserefpolicy/man/ru/man8/nfs_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/nfs_selinux.8 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/man/ru/man8/nfs_selinux.8 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,33 @@ +.TH "nfs_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "nfs Selinux Policy documentation" +.SH "НАЗВАНИЕ" @@ -697,7 +749,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/nfs_selinux.8 se +selinux(8), chcon(1), setsebool(8) diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/rsync_selinux.8 serefpolicy-3.0.8/man/ru/man8/rsync_selinux.8 --- nsaserefpolicy/man/ru/man8/rsync_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/rsync_selinux.8 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/man/ru/man8/rsync_selinux.8 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,50 @@ +.TH "rsync_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "rsync Selinux Policy documentation" +.de EX @@ -751,7 +803,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/rsync_selinux.8 +selinux(8), rsync(1), chcon(1), setsebool(8) diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/samba_selinux.8 serefpolicy-3.0.8/man/ru/man8/samba_selinux.8 --- nsaserefpolicy/man/ru/man8/samba_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/samba_selinux.8 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/man/ru/man8/samba_selinux.8 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,60 @@ +.TH "samba_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "Samba Selinux Policy documentation" +.SH "НАЗВАНИЕ" @@ -815,7 +867,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/samba_selinux.8 +selinux(8), samba(7), chcon(1), setsebool(8) diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/ypbind_selinux.8 serefpolicy-3.0.8/man/ru/man8/ypbind_selinux.8 --- nsaserefpolicy/man/ru/man8/ypbind_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/ypbind_selinux.8 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/man/ru/man8/ypbind_selinux.8 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,19 @@ +.TH "ypbind_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "ypbind Selinux Policy documentation" +.SH "НАЗВАНИЕ" @@ -838,7 +890,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/ypbind_selinux.8 +selinux(8), ypbind(8), chcon(1), setsebool(8) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.0.8/policy/flask/access_vectors --- nsaserefpolicy/policy/flask/access_vectors 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/flask/access_vectors 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/flask/access_vectors 2008-04-04 16:11:03.000000000 -0400 @@ -639,6 +639,8 @@ send recv @@ -850,7 +902,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors class key diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.0.8/policy/global_tunables --- nsaserefpolicy/policy/global_tunables 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/policy/global_tunables 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/global_tunables 2008-04-04 16:11:03.000000000 -0400 @@ -133,3 +133,18 @@ ## gen_tunable(write_untrusted_content,false) @@ -872,7 +924,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.0.8/policy/modules/admin/alsa.fc --- nsaserefpolicy/policy/modules/admin/alsa.fc 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/alsa.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/alsa.fc 2008-04-04 16:11:03.000000000 -0400 @@ -1,4 +1,11 @@ +/etc/alsa/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0) @@ -887,7 +939,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc +/bin/alsaunmute -- gen_context(system_u:object_r:alsa_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.if serefpolicy-3.0.8/policy/modules/admin/alsa.if --- nsaserefpolicy/policy/modules/admin/alsa.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/alsa.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/alsa.if 2008-04-04 16:11:03.000000000 -0400 @@ -74,3 +74,39 @@ read_files_pattern($1,alsa_etc_rw_t,alsa_etc_rw_t) read_lnk_files_pattern($1,alsa_etc_rw_t,alsa_etc_rw_t) @@ -930,7 +982,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.0.8/policy/modules/admin/alsa.te --- nsaserefpolicy/policy/modules/admin/alsa.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/alsa.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/alsa.te 2008-04-04 16:11:03.000000000 -0400 @@ -8,31 +8,47 @@ type alsa_t; @@ -1000,7 +1052,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.if serefpolicy-3.0.8/policy/modules/admin/amanda.if --- nsaserefpolicy/policy/modules/admin/amanda.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/amanda.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/amanda.if 2008-04-04 16:11:03.000000000 -0400 @@ -71,6 +71,26 @@ ######################################## @@ -1035,7 +1087,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.te serefpolicy-3.0.8/policy/modules/admin/amanda.te --- nsaserefpolicy/policy/modules/admin/amanda.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/amanda.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/amanda.te 2008-04-04 16:11:03.000000000 -0400 @@ -74,7 +74,6 @@ allow amanda_t self:unix_dgram_socket create_socket_perms; allow amanda_t self:tcp_socket create_stream_socket_perms; @@ -1103,7 +1155,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda. -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.0.8/policy/modules/admin/anaconda.te --- nsaserefpolicy/policy/modules/admin/anaconda.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/anaconda.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/anaconda.te 2008-04-04 16:11:03.000000000 -0400 @@ -31,16 +31,13 @@ modutils_domtrans_insmod(anaconda_t) @@ -1124,7 +1176,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anacond diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-3.0.8/policy/modules/admin/bootloader.te --- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/bootloader.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/bootloader.te 2008-04-04 16:11:03.000000000 -0400 @@ -215,3 +215,7 @@ userdom_dontaudit_search_staff_home_dirs(bootloader_t) userdom_dontaudit_search_sysadm_home_dirs(bootloader_t) @@ -1135,7 +1187,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/brctl.if serefpolicy-3.0.8/policy/modules/admin/brctl.if --- nsaserefpolicy/policy/modules/admin/brctl.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/brctl.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/brctl.if 2008-04-04 16:11:03.000000000 -0400 @@ -17,3 +17,21 @@ domtrans_pattern($1,brctl_exec_t,brctl_t) @@ -1160,7 +1212,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/brctl.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/brctl.te serefpolicy-3.0.8/policy/modules/admin/brctl.te --- nsaserefpolicy/policy/modules/admin/brctl.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/brctl.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/brctl.te 2008-04-04 16:11:03.000000000 -0400 @@ -25,6 +25,7 @@ kernel_read_network_state(brctl_t) kernel_read_sysctl(brctl_t) @@ -1177,7 +1229,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/brctl.t ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.0.8/policy/modules/admin/consoletype.te --- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/consoletype.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/consoletype.te 2008-04-04 16:11:03.000000000 -0400 @@ -8,9 +8,11 @@ type consoletype_t; @@ -1230,7 +1282,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmidecode.te serefpolicy-3.0.8/policy/modules/admin/dmidecode.te --- nsaserefpolicy/policy/modules/admin/dmidecode.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/dmidecode.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/dmidecode.te 2008-04-04 16:11:03.000000000 -0400 @@ -20,6 +20,7 @@ # Allow dmidecode to read /dev/mem @@ -1241,7 +1293,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmideco diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstboot.te serefpolicy-3.0.8/policy/modules/admin/firstboot.te --- nsaserefpolicy/policy/modules/admin/firstboot.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/firstboot.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/firstboot.te 2008-04-04 16:11:03.000000000 -0400 @@ -120,6 +120,10 @@ usermanage_domtrans_admin_passwd(firstboot_t) ') @@ -1263,16 +1315,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstbo ') dnl end TODO diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.fc serefpolicy-3.0.8/policy/modules/admin/kismet.fc --- nsaserefpolicy/policy/modules/admin/kismet.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/admin/kismet.fc 2008-05-02 15:51:19.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/kismet.fc 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,5 @@ + -+/usr/bin/kismet_server -- gen_context(system_u:object_r:kismet_exec_t,s0) ++/usr/bin/kismet -- gen_context(system_u:object_r:kismet_exec_t,s0) +/var/run/kismet_server.pid -- gen_context(system_u:object_r:kismet_var_run_t,s0) +/var/lib/kismet(/.*)? gen_context(system_u:object_r:kismet_var_lib_t,s0) +/var/log/kismet(/.*)? gen_context(system_u:object_r:kismet_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.if serefpolicy-3.0.8/policy/modules/admin/kismet.if --- nsaserefpolicy/policy/modules/admin/kismet.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/admin/kismet.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/kismet.if 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,277 @@ + +## policy for kismet @@ -1509,7 +1561,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. + + kismet_domtrans($1) + role $2 types kismet_t; -+ dontaudit kismet_t $3:chr_file rw_term_perms; ++ allow kismet_t $3:chr_file rw_term_perms; +') + + @@ -1553,9 +1605,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.te serefpolicy-3.0.8/policy/modules/admin/kismet.te --- nsaserefpolicy/policy/modules/admin/kismet.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/admin/kismet.te 2008-05-02 15:51:08.000000000 -0400 -@@ -0,0 +1,69 @@ -+ ++++ serefpolicy-3.0.8/policy/modules/admin/kismet.te 2008-04-04 16:11:03.000000000 -0400 +@@ -0,0 +1,57 @@ +policy_module(kismet,1.0.0) + +######################################## @@ -1568,6 +1619,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. +application_domain(kismet_t, kismet_exec_t) +role system_r types kismet_t; + ++ +type kismet_var_run_t; +files_pid_file(kismet_var_run_t) + @@ -1582,28 +1634,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. +# kismet local policy +# + -+allow kismet_t self:capability { net_raw net_admin setuid setgid }; -+allow kismet_t self:process { signal sigkill }; -+allow kismet_t self:fifo_file rw_file_perms; -+allow kismet_t self:tcp_socket create_stream_socket_perms; -+allow kismet_t self:unix_dgram_socket create_socket_perms; -+allow kismet_t self:unix_stream_socket create_stream_socket_perms; -+allow kismet_t self:packet_socket create_socket_perms; ++allow kismet_t self:capability { net_admin setuid setgid }; + +corecmd_exec_bin(kismet_t) + -+corenet_all_recvfrom_unlabeled(kismet_t) -+corenet_all_recvfrom_netlabel(kismet_t) -+corenet_tcp_bind_all_nodes(kismet_t) -+corenet_tcp_sendrecv_all_ports(kismet_t) -+corenet_tcp_sendrecv_all_if(kismet_t) -+corenet_tcp_sendrecv_all_nodes(kismet_t) -+corenet_tcp_bind_rtsclient_port(kismet_t) -+ +auth_use_nsswitch(kismet_t) + ++allow kismet_t self:fifo_file rw_file_perms; ++allow kismet_t self:unix_stream_socket create_stream_socket_perms; ++ +files_read_etc_files(kismet_t) + ++kernel_load_module(kismet_t) ++ +libs_use_ld_so(kismet_t) +libs_use_shared_libs(kismet_t) + @@ -1621,12 +1664,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. +allow kismet_t kismet_log_t:dir { rw_dir_perms setattr }; +logging_log_filetrans(kismet_t,kismet_log_t,{ file dir }) + -+optional_policy(` -+ dbus_system_bus_client_template(kismet,kismet_t) -+') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.0.8/policy/modules/admin/kudzu.te --- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/kudzu.te 2007-12-18 13:49:54.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/kudzu.te 2008-04-04 16:11:03.000000000 -0400 @@ -21,8 +21,8 @@ # Local policy # @@ -1699,7 +1739,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.0.8/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/logrotate.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/logrotate.te 2008-04-04 16:11:03.000000000 -0400 @@ -96,6 +96,7 @@ files_read_etc_files(logrotate_t) files_read_etc_runtime_files(logrotate_t) @@ -1710,7 +1750,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota files_manage_generic_spool_dirs(logrotate_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.0.8/policy/modules/admin/logwatch.te --- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/logwatch.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/logwatch.te 2008-04-04 16:11:03.000000000 -0400 @@ -48,7 +48,7 @@ corecmd_exec_shell(logwatch_t) @@ -1748,9 +1788,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc samba_read_log(logwatch_t) + samba_read_share_files(logwatch_t) ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te serefpolicy-3.0.8/policy/modules/admin/mrtg.te +--- nsaserefpolicy/policy/modules/admin/mrtg.te 2007-10-22 13:21:42.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/mrtg.te 2008-04-17 11:16:21.000000000 -0400 +@@ -78,6 +78,7 @@ + dev_read_urand(mrtg_t) + + domain_use_interactive_fds(mrtg_t) ++domain_dontaudit_search_all_domains_state(mrtg_t) + + files_read_usr_files(mrtg_t) + files_search_var(mrtg_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.0.8/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/netutils.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/netutils.te 2008-04-04 16:11:03.000000000 -0400 @@ -40,7 +40,7 @@ allow netutils_t self:capability { net_admin net_raw setuid setgid }; dontaudit netutils_t self:capability sys_tty_config; @@ -1809,7 +1860,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil kernel_read_system_state(traceroute_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.if serefpolicy-3.0.8/policy/modules/admin/portage.if --- nsaserefpolicy/policy/modules/admin/portage.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/portage.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/portage.if 2008-04-04 16:11:03.000000000 -0400 @@ -324,6 +324,7 @@ seutil_domtrans_setfiles($1) # run semodule @@ -1820,7 +1871,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.0.8/policy/modules/admin/prelink.te --- nsaserefpolicy/policy/modules/admin/prelink.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/prelink.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/prelink.te 2008-04-04 16:11:03.000000000 -0400 @@ -26,7 +26,7 @@ # Local policy # @@ -1882,7 +1933,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.0.8/policy/modules/admin/rpm.fc --- nsaserefpolicy/policy/modules/admin/rpm.fc 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/rpm.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/rpm.fc 2008-04-04 16:11:03.000000000 -0400 @@ -11,6 +11,7 @@ /usr/sbin/system-install-packages -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -1901,9 +1952,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc ') /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) +@@ -29,6 +33,7 @@ + + /var/log/rpmpkgs.* -- gen_context(system_u:object_r:rpm_log_t,s0) + /var/log/yum\.log.* -- gen_context(system_u:object_r:rpm_log_t,s0) ++/var/run/yum.* -- gen_context(system_u:object_r:rpm_var_run_t,s0) + + # SuSE + ifdef(`distro_suse', ` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.8/policy/modules/admin/rpm.if --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/rpm.if 2008-01-08 08:11:19.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/rpm.if 2008-04-04 16:11:03.000000000 -0400 @@ -152,6 +152,45 @@ ######################################## @@ -2006,7 +2065,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if ') ######################################## -@@ -289,3 +369,112 @@ +@@ -289,3 +369,130 @@ dontaudit $1 rpm_var_lib_t:file manage_file_perms; dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms; ') @@ -2119,10 +2178,48 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if + read_lnk_files_pattern($1,rpm_tmpfs_t,rpm_tmpfs_t) +') + ++######################################## ++## ++## Do not audit attempts to write, and delete the ++## RPM var run files ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`rpm_dontaudit_write_pid_files',` ++ gen_require(` ++ type rpm_var_run_t; ++ ') ++ ++ dontaudit $1 rpm_var_run_t:file write_file_perms; ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.8/policy/modules/admin/rpm.te --- nsaserefpolicy/policy/modules/admin/rpm.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/rpm.te 2007-12-02 21:15:34.000000000 -0500 -@@ -139,6 +139,7 @@ ++++ serefpolicy-3.0.8/policy/modules/admin/rpm.te 2008-04-04 16:11:03.000000000 -0400 +@@ -31,6 +31,9 @@ + files_type(rpm_var_lib_t) + typealias rpm_var_lib_t alias var_lib_rpm_t; + ++type rpm_var_run_t; ++files_pid_file(rpm_var_run_t) ++ + type rpm_script_t; + type rpm_script_exec_t; + domain_obj_id_change_exemption(rpm_script_t) +@@ -89,6 +92,9 @@ + manage_files_pattern(rpm_t,rpm_var_lib_t,rpm_var_lib_t) + files_var_lib_filetrans(rpm_t,rpm_var_lib_t,dir) + ++manage_files_pattern(rpm_t,rpm_var_run_t,rpm_var_run_t) ++files_pid_filetrans(rpm_t,rpm_var_run_t, file) ++ + kernel_read_system_state(rpm_t) + kernel_read_kernel_sysctls(rpm_t) + +@@ -139,6 +145,7 @@ auth_relabel_all_files_except_shadow(rpm_t) auth_manage_all_files_except_shadow(rpm_t) auth_dontaudit_read_shadow(rpm_t) @@ -2130,7 +2227,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te # transition to rpm script: rpm_domtrans_script(rpm_t) -@@ -180,11 +181,18 @@ +@@ -180,11 +187,18 @@ ') optional_policy(` @@ -2153,7 +2250,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te ') optional_policy(` -@@ -195,6 +203,7 @@ +@@ -195,6 +209,7 @@ unconfined_domain(rpm_t) # yum-updatesd requires this unconfined_dbus_chat(rpm_t) @@ -2161,7 +2258,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te ') ifdef(`TODO',` -@@ -321,6 +330,7 @@ +@@ -321,6 +336,7 @@ seutil_domtrans_loadpolicy(rpm_script_t) seutil_domtrans_setfiles(rpm_script_t) seutil_domtrans_semanage(rpm_script_t) @@ -2169,83 +2266,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te userdom_use_all_users_fds(rpm_script_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.8/policy/modules/admin/sudo.if ---- nsaserefpolicy/policy/modules/admin/sudo.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/sudo.if 2007-12-02 21:15:34.000000000 -0500 -@@ -55,7 +55,7 @@ - # - - # Use capabilities. -- allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_resource }; -+ allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_nice sys_resource }; - allow $1_sudo_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; - allow $1_sudo_t self:process { setexec setrlimit }; - allow $1_sudo_t self:fd use; -@@ -68,7 +68,6 @@ - allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms; - allow $1_sudo_t self:unix_dgram_socket sendto; - allow $1_sudo_t self:unix_stream_socket connectto; -- allow $1_sudo_t self:netlink_audit_socket { create bind write nlmsg_read read }; - allow $1_sudo_t self:netlink_route_socket r_netlink_socket_perms; - - # Enter this derived domain from the user domain -@@ -76,6 +75,7 @@ - - # By default, revert to the calling domain when a shell is executed. - corecmd_shell_domtrans($1_sudo_t,$2) -+ corecmd_bin_domtrans($1_sudo_t,$2) - allow $2 $1_sudo_t:fd use; - allow $2 $1_sudo_t:fifo_file rw_file_perms; - allow $2 $1_sudo_t:process sigchld; -@@ -89,9 +89,11 @@ - fs_search_auto_mountpoints($1_sudo_t) - fs_getattr_xattr_fs($1_sudo_t) - -- auth_domtrans_chk_passwd($1_sudo_t) -+ auth_run_chk_passwd($1_sudo_t, $3, { $1_tty_device_t $1_devpts_t }) -+ auth_run_upd_passwd($1_sudo_t, $3, { $1_tty_device_t $1_devpts_t }) - # sudo stores a token in the pam_pid directory - auth_manage_pam_pid($1_sudo_t) -+ auth_search_key($1_sudo_t) - - corecmd_read_bin_symlinks($1_sudo_t) - corecmd_getattr_all_executables($1_sudo_t) -@@ -106,18 +108,21 @@ - files_getattr_usr_files($1_sudo_t) - # for some PAM modules and for cwd - files_dontaudit_search_home($1_sudo_t) -+ files_list_tmp($1_sudo_t) - - init_rw_utmp($1_sudo_t) - - libs_use_ld_so($1_sudo_t) - libs_use_shared_libs($1_sudo_t) - -+ logging_send_audit_msgs($1_sudo_t) - logging_send_syslog_msg($1_sudo_t) - - miscfiles_read_localization($1_sudo_t) - - userdom_manage_user_home_content_files($1,$1_sudo_t) - userdom_manage_user_home_content_symlinks($1,$1_sudo_t) -+ - userdom_manage_user_tmp_files($1,$1_sudo_t) - userdom_manage_user_tmp_symlinks($1,$1_sudo_t) - userdom_use_user_terminals($1,$1_sudo_t) -@@ -126,6 +131,10 @@ - userdom_dontaudit_search_all_users_home_content($1_sudo_t) - - optional_policy(` -+ locallogin_search_keys($1_sudo_t) -+ ') -+ -+ optional_policy(` - nis_use_ypbind($1_sudo_t) - ') - diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.8/policy/modules/admin/su.if --- nsaserefpolicy/policy/modules/admin/su.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/su.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/su.if 2008-04-04 16:11:03.000000000 -0400 @@ -41,12 +41,11 @@ allow $2 $1_su_t:process signal; @@ -2341,9 +2364,83 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s ifdef(`TODO',` allow $1_su_t $1_home_t:file manage_file_perms; +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.8/policy/modules/admin/sudo.if +--- nsaserefpolicy/policy/modules/admin/sudo.if 2007-10-22 13:21:42.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/sudo.if 2008-04-04 16:11:03.000000000 -0400 +@@ -55,7 +55,7 @@ + # + + # Use capabilities. +- allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_resource }; ++ allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_nice sys_resource }; + allow $1_sudo_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; + allow $1_sudo_t self:process { setexec setrlimit }; + allow $1_sudo_t self:fd use; +@@ -68,7 +68,6 @@ + allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms; + allow $1_sudo_t self:unix_dgram_socket sendto; + allow $1_sudo_t self:unix_stream_socket connectto; +- allow $1_sudo_t self:netlink_audit_socket { create bind write nlmsg_read read }; + allow $1_sudo_t self:netlink_route_socket r_netlink_socket_perms; + + # Enter this derived domain from the user domain +@@ -76,6 +75,7 @@ + + # By default, revert to the calling domain when a shell is executed. + corecmd_shell_domtrans($1_sudo_t,$2) ++ corecmd_bin_domtrans($1_sudo_t,$2) + allow $2 $1_sudo_t:fd use; + allow $2 $1_sudo_t:fifo_file rw_file_perms; + allow $2 $1_sudo_t:process sigchld; +@@ -89,9 +89,11 @@ + fs_search_auto_mountpoints($1_sudo_t) + fs_getattr_xattr_fs($1_sudo_t) + +- auth_domtrans_chk_passwd($1_sudo_t) ++ auth_run_chk_passwd($1_sudo_t, $3, { $1_tty_device_t $1_devpts_t }) ++ auth_run_upd_passwd($1_sudo_t, $3, { $1_tty_device_t $1_devpts_t }) + # sudo stores a token in the pam_pid directory + auth_manage_pam_pid($1_sudo_t) ++ auth_search_key($1_sudo_t) + + corecmd_read_bin_symlinks($1_sudo_t) + corecmd_getattr_all_executables($1_sudo_t) +@@ -106,18 +108,21 @@ + files_getattr_usr_files($1_sudo_t) + # for some PAM modules and for cwd + files_dontaudit_search_home($1_sudo_t) ++ files_list_tmp($1_sudo_t) + + init_rw_utmp($1_sudo_t) + + libs_use_ld_so($1_sudo_t) + libs_use_shared_libs($1_sudo_t) + ++ logging_send_audit_msgs($1_sudo_t) + logging_send_syslog_msg($1_sudo_t) + + miscfiles_read_localization($1_sudo_t) + + userdom_manage_user_home_content_files($1,$1_sudo_t) + userdom_manage_user_home_content_symlinks($1,$1_sudo_t) ++ + userdom_manage_user_tmp_files($1,$1_sudo_t) + userdom_manage_user_tmp_symlinks($1,$1_sudo_t) + userdom_use_user_terminals($1,$1_sudo_t) +@@ -126,6 +131,10 @@ + userdom_dontaudit_search_all_users_home_content($1_sudo_t) + + optional_policy(` ++ locallogin_search_keys($1_sudo_t) ++ ') ++ ++ optional_policy(` + nis_use_ypbind($1_sudo_t) + ') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.0.8/policy/modules/admin/tmpreaper.te --- nsaserefpolicy/policy/modules/admin/tmpreaper.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/tmpreaper.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/tmpreaper.te 2008-04-04 16:11:03.000000000 -0400 @@ -28,6 +28,7 @@ files_purge_tmp(tmpreaper_t) # why does it need setattr? @@ -2352,10 +2449,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreap mls_file_read_all_levels(tmpreaper_t) mls_file_write_all_levels(tmpreaper_t) -@@ -43,5 +44,10 @@ +@@ -43,5 +44,14 @@ cron_system_entry(tmpreaper_t,tmpreaper_exec_t) optional_policy(` ++ amavis_manage_spool_files(tmpreaper_t) ++') ++ ++optional_policy(` + kismet_manage_log(tmpreaper_t) +') + @@ -2365,7 +2466,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreap + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.0.8/policy/modules/admin/usermanage.if --- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/usermanage.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/usermanage.if 2008-04-04 16:11:03.000000000 -0400 @@ -265,6 +265,24 @@ ######################################## @@ -2393,7 +2494,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.0.8/policy/modules/admin/usermanage.te --- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/usermanage.te 2007-12-17 10:55:24.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/usermanage.te 2008-04-04 16:11:03.000000000 -0400 @@ -92,10 +92,12 @@ dev_read_urand(chfn_t) @@ -2407,7 +2508,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman domain_use_interactive_fds(chfn_t) -@@ -297,9 +299,11 @@ +@@ -238,6 +240,7 @@ + userdom_use_unpriv_users_fds(groupadd_t) + # for when /root is the cwd + userdom_dontaudit_search_sysadm_home_dirs(groupadd_t) ++userdom_dontaudit_search_all_users_home_content(groupadd_t) + + optional_policy(` + dpkg_use_fds(groupadd_t) +@@ -297,9 +300,11 @@ term_use_all_user_ttys(passwd_t) term_use_all_user_ptys(passwd_t) @@ -2419,7 +2528,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman # allow checking if a shell is executable corecmd_check_exec_shell(passwd_t) -@@ -315,6 +319,7 @@ +@@ -315,6 +320,7 @@ # /usr/bin/passwd asks for w access to utmp, but it will operate # correctly without it. Do not audit write denials to utmp. init_dontaudit_rw_utmp(passwd_t) @@ -2427,7 +2536,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman libs_use_ld_so(passwd_t) libs_use_shared_libs(passwd_t) -@@ -520,6 +525,10 @@ +@@ -511,6 +517,7 @@ + userdom_use_unpriv_users_fds(useradd_t) + # for when /root is the cwd + userdom_dontaudit_search_sysadm_home_dirs(useradd_t) ++userdom_dontaudit_search_all_users_home_content(useradd_t) + # Add/remove user home directories + userdom_home_filetrans_generic_user_home_dir(useradd_t) + userdom_manage_all_users_home_content_dirs(useradd_t) +@@ -520,6 +527,10 @@ mta_manage_spool(useradd_t) optional_policy(` @@ -2438,7 +2555,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman dpkg_use_fds(useradd_t) dpkg_rw_pipes(useradd_t) ') -@@ -529,6 +538,12 @@ +@@ -529,6 +540,12 @@ ') optional_policy(` @@ -2453,8 +2570,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.0.8/policy/modules/admin/vbetool.te --- nsaserefpolicy/policy/modules/admin/vbetool.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/vbetool.te 2007-12-02 21:15:34.000000000 -0500 -@@ -33,4 +33,5 @@ ++++ serefpolicy-3.0.8/policy/modules/admin/vbetool.te 2008-04-04 16:11:03.000000000 -0400 +@@ -23,6 +23,8 @@ + dev_rwx_zero(vbetool_t) + dev_read_sysfs(vbetool_t) + ++domain_mmap_low(vbetool_t) ++ + term_use_unallocated_ttys(vbetool_t) + + libs_use_ld_so(vbetool_t) +@@ -33,4 +35,5 @@ optional_policy(` hal_rw_pid_files(vbetool_t) hal_write_log(vbetool_t) @@ -2462,7 +2588,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.fc serefpolicy-3.0.8/policy/modules/admin/vpn.fc --- nsaserefpolicy/policy/modules/admin/vpn.fc 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/vpn.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/vpn.fc 2008-04-04 16:11:03.000000000 -0400 @@ -7,3 +7,5 @@ # sbin # @@ -2471,7 +2597,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.fc +/var/run/vpnc(/.*)? gen_context(system_u:object_r:vpnc_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.if serefpolicy-3.0.8/policy/modules/admin/vpn.if --- nsaserefpolicy/policy/modules/admin/vpn.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/vpn.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/vpn.if 2008-04-04 16:11:03.000000000 -0400 @@ -67,3 +67,25 @@ allow $1 vpnc_t:process signal; @@ -2500,7 +2626,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.if + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.0.8/policy/modules/admin/vpn.te --- nsaserefpolicy/policy/modules/admin/vpn.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/vpn.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/admin/vpn.te 2008-04-04 16:11:03.000000000 -0400 @@ -22,7 +22,7 @@ # Local policy # @@ -2547,7 +2673,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if serefpolicy-3.0.8/policy/modules/apps/ada.if --- nsaserefpolicy/policy/modules/apps/ada.if 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/ada.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/ada.if 2008-04-04 16:11:03.000000000 -0400 @@ -18,3 +18,34 @@ corecmd_search_bin($1) domtrans_pattern($1, ada_exec_t, ada_t) @@ -2585,7 +2711,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if s +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.fc serefpolicy-3.0.8/policy/modules/apps/awstats.fc --- nsaserefpolicy/policy/modules/apps/awstats.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/apps/awstats.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/awstats.fc 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,5 @@ +/usr/share/awstats/tools/.+\.pl -- gen_context(system_u:object_r:awstats_exec_t,s0) +/usr/share/awstats/wwwroot(/.*)? gen_context(system_u:object_r:httpd_awstats_content_t,s0) @@ -2594,7 +2720,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats. +/var/lib/awstats(/.*)? gen_context(system_u:object_r:awstats_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.if serefpolicy-3.0.8/policy/modules/apps/awstats.if --- nsaserefpolicy/policy/modules/apps/awstats.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/apps/awstats.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/awstats.if 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,42 @@ +## +## AWStats is a free powerful and featureful tool that generates advanced @@ -2640,7 +2766,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.te serefpolicy-3.0.8/policy/modules/apps/awstats.te --- nsaserefpolicy/policy/modules/apps/awstats.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/apps/awstats.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/awstats.te 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,77 @@ + +policy_module(awstats,1.0.0) @@ -2721,7 +2847,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats. +files_search_var_lib(httpd_awstats_script_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.0.8/policy/modules/apps/gnome.fc --- nsaserefpolicy/policy/modules/apps/gnome.fc 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/gnome.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/gnome.fc 2008-04-04 16:11:03.000000000 -0400 @@ -1,8 +1,7 @@ +HOME_DIR/.gnome2(/.*)? gen_context(system_u:object_r:ROLE_gnome_home_t,s0) HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:ROLE_gnome_home_t,s0) @@ -2734,7 +2860,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc /usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.0.8/policy/modules/apps/gnome.if --- nsaserefpolicy/policy/modules/apps/gnome.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/gnome.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/gnome.if 2008-04-04 16:11:03.000000000 -0400 @@ -33,6 +33,51 @@ ## # @@ -2922,7 +3048,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.0.8/policy/modules/apps/gnome.te --- nsaserefpolicy/policy/modules/apps/gnome.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/gnome.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/gnome.te 2008-04-04 16:11:03.000000000 -0400 @@ -8,8 +8,5 @@ attribute gnomedomain; @@ -2932,32 +3058,88 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te - type gconfd_exec_t; application_executable_file(gconfd_exec_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.0.8/policy/modules/apps/java.fc ---- nsaserefpolicy/policy/modules/apps/java.fc 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/java.fc 2007-12-02 21:15:34.000000000 -0500 -@@ -11,6 +11,7 @@ - # - /usr/(.*/)?bin/java.* -- gen_context(system_u:object_r:java_exec_t,s0) - /usr/lib(.*/)?bin/java[^/]* -- gen_context(system_u:object_r:java_exec_t,s0) -+/usr/lib/eclipse/eclipse -- gen_context(system_u:object_r:java_exec_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if serefpolicy-3.0.8/policy/modules/apps/gpg.if +--- nsaserefpolicy/policy/modules/apps/gpg.if 2007-10-22 13:21:41.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/gpg.if 2008-04-04 16:11:03.000000000 -0400 +@@ -80,6 +80,10 @@ + allow $1_gpg_t self:fifo_file rw_fifo_file_perms; + allow $1_gpg_t self:tcp_socket create_stream_socket_perms; + ++ # Thunderbird leaks descriptors ++ dontaudit $1_gpg_t $2:tcp_socket rw_socket_perms; ++ dontaudit $1_gpg_t $2:udp_socket rw_socket_perms; ++ + # transition from the gpg domain to the helper domain + domtrans_pattern($1_gpg_t,gpg_helper_exec_t,$1_gpg_helper_t) + +@@ -116,6 +120,8 @@ + files_read_usr_files($1_gpg_t) + files_dontaudit_search_var($1_gpg_t) + ++ auth_use_nsswitch($1_gpg_t) ++ + libs_use_shared_libs($1_gpg_t) + libs_use_ld_so($1_gpg_t) + +@@ -123,14 +129,8 @@ + + logging_send_syslog_msg($1_gpg_t) + +- sysnet_read_config($1_gpg_t) +- + userdom_use_user_terminals($1,$1_gpg_t) + +- optional_policy(` +- nis_use_ypbind($1_gpg_t) +- ') +- + ifdef(`TODO',` + # Read content to encrypt/decrypt/sign + read_content($1_gpg_t, $1) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.0.8/policy/modules/apps/gpg.te +--- nsaserefpolicy/policy/modules/apps/gpg.te 2007-10-22 13:21:41.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/gpg.te 2008-04-04 16:11:03.000000000 -0400 +@@ -19,3 +19,4 @@ + # type for the pinentry executable + type pinentry_exec_t; + application_executable_file(pinentry_exec_t) ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.0.8/policy/modules/apps/java.fc +--- nsaserefpolicy/policy/modules/apps/java.fc 2007-10-22 13:21:41.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/java.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -3,14 +3,15 @@ + # + /opt/(.*/)?bin/java[^/]* -- gen_context(system_u:object_r:java_exec_t,s0) + /opt/ibm/java2-ppc64-50/jre/(bin|javaws)(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0) +-/opt/local/matlab/bin/(.*/)?MATLAB. -- gen_context(system_u:object_r:java_exec_t,s0) +-/opt/matlab/bin/(.*/)?MATLAB. -- gen_context(system_u:object_r:java_exec_t,s0) ++/opt/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0) ++/opt/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0) + + # + # /usr + # + /usr/(.*/)?bin/java.* -- gen_context(system_u:object_r:java_exec_t,s0) + /usr/lib(.*/)?bin/java[^/]* -- gen_context(system_u:object_r:java_exec_t,s0) ++/usr/lib/eclipse/eclipse -- gen_context(system_u:object_r:java_exec_t,s0) /usr/bin/frysk -- gen_context(system_u:object_r:java_exec_t,s0) /usr/bin/gappletviewer -- gen_context(system_u:object_r:java_exec_t,s0) /usr/bin/gcj-dbtool -- gen_context(system_u:object_r:java_exec_t,s0) -@@ -20,5 +21,11 @@ +@@ -20,5 +21,9 @@ /usr/bin/grmic -- gen_context(system_u:object_r:java_exec_t,s0) /usr/bin/grmiregistry -- gen_context(system_u:object_r:java_exec_t,s0) /usr/bin/jv-convert -- gen_context(system_u:object_r:java_exec_t,s0) +-/usr/local/matlab/bin/(.*/)?MATLAB. -- gen_context(system_u:object_r:java_exec_t,s0) +-/usr/matlab/bin/(.*/)?MATLAB. -- gen_context(system_u:object_r:java_exec_t,s0) +/usr/bin/fastjar -- gen_context(system_u:object_r:java_exec_t,s0) - /usr/local/matlab/bin/(.*/)?MATLAB. -- gen_context(system_u:object_r:java_exec_t,s0) - /usr/matlab/bin/(.*/)?MATLAB. -- gen_context(system_u:object_r:java_exec_t,s0) -+ ++/usr/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0) ++/usr/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0) +/usr/lib/jvm/java(.*/)bin(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0) + -+/usr/lib(64)?/openoffice\.org/program/soffice\.bin -- gen_context(system_u:object_r:java_exec_t,s0) +/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.8/policy/modules/apps/java.if --- nsaserefpolicy/policy/modules/apps/java.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/java.if 2008-01-13 08:10:59.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/java.if 2008-04-04 16:11:03.000000000 -0400 @@ -32,7 +32,7 @@ ## ## @@ -2984,16 +3166,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if allow $1_javaplugin_t $2:unix_stream_socket connectto; allow $1_javaplugin_t $2:unix_stream_socket { read write }; userdom_write_user_tmp_sockets($1,$1_javaplugin_t) -@@ -81,8 +84,7 @@ +@@ -69,6 +72,7 @@ + manage_dirs_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t) + manage_files_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t) + files_tmp_filetrans($1_javaplugin_t,$1_javaplugin_tmp_t,{ file dir }) ++ allow $1_javaplugin_t $1_javaplugin_tmp_t:file execute; + + manage_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t) + manage_lnk_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t) +@@ -81,9 +85,7 @@ can_exec($1_javaplugin_t, java_exec_t) - # The user role is authorized for this domain. - domain_auto_trans($1_t, java_exec_t, $1_javaplugin_t) -+ domain_auto_trans($2, java_exec_t, $1_javaplugin_t) - allow $1_javaplugin_t $2:fd use; +- allow $1_javaplugin_t $2:fd use; ++ domtrans_pattern($2, java_exec_t, $1_javaplugin_t) # Unrestricted inheritance from the caller. allow $2 $1_javaplugin_t:process { noatsecure siginh rlimitinh }; + allow $1_javaplugin_t $2:process signull; @@ -94,7 +96,7 @@ kernel_read_system_state($1_javaplugin_t) @@ -3016,15 +3207,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if files_read_etc_files($1_javaplugin_t) files_read_usr_files($1_javaplugin_t) -@@ -122,6 +126,7 @@ +@@ -122,6 +126,9 @@ fs_getattr_xattr_fs($1_javaplugin_t) fs_dontaudit_rw_tmpfs_files($1_javaplugin_t) + fs_getattr_tmpfs($1_javaplugin_t) ++ ++ auth_use_nsswitch($1_javaplugin_t) libs_use_ld_so($1_javaplugin_t) libs_use_shared_libs($1_javaplugin_t) -@@ -134,6 +139,10 @@ +@@ -134,9 +141,13 @@ sysnet_read_config($1_javaplugin_t) @@ -3034,8 +3227,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if + userdom_read_user_tmpfs_files($1,$1_javaplugin_t) userdom_dontaudit_use_user_terminals($1,$1_javaplugin_t) userdom_dontaudit_setattr_user_home_content_files($1,$1_javaplugin_t) - userdom_dontaudit_exec_user_home_content_files($1,$1_javaplugin_t) -@@ -166,6 +175,62 @@ +- userdom_dontaudit_exec_user_home_content_files($1,$1_javaplugin_t) ++ userdom_exec_user_home_content_files($1,$1_javaplugin_t) + userdom_manage_user_home_content_dirs($1,$1_javaplugin_t) + userdom_manage_user_home_content_files($1,$1_javaplugin_t) + userdom_manage_user_home_content_symlinks($1,$1_javaplugin_t) +@@ -147,8 +158,6 @@ + tunable_policy(`allow_java_execstack',` + allow $1_javaplugin_t self:process execstack; + +- allow $1_javaplugin_t $1_javaplugin_tmp_t:file execute; +- + libs_legacy_use_shared_libs($1_javaplugin_t) + libs_legacy_use_ld_so($1_javaplugin_t) + +@@ -166,6 +175,63 @@ optional_policy(` xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t) ') @@ -3082,6 +3288,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if + domain_interactive_fd($1_java_t) + + userdom_unpriv_usertype($1, $1_java_t) ++ userdom_exec_user_home_content_files($1,$1_java_t) + + allow $1_java_t self:process { getsched sigkill execheap execmem execstack }; + @@ -3098,7 +3305,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if ') ######################################## -@@ -219,3 +284,66 @@ +@@ -219,3 +285,66 @@ corecmd_search_bin($1) domtrans_pattern($1, java_exec_t, java_t) ') @@ -3167,7 +3374,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.0.8/policy/modules/apps/java.te --- nsaserefpolicy/policy/modules/apps/java.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/java.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/java.te 2008-04-04 16:11:03.000000000 -0400 @@ -23,11 +23,23 @@ # @@ -3197,21 +3404,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.0.8/policy/modules/apps/loadkeys.te --- nsaserefpolicy/policy/modules/apps/loadkeys.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/loadkeys.te 2007-12-02 21:15:34.000000000 -0500 -@@ -41,6 +41,10 @@ ++++ serefpolicy-3.0.8/policy/modules/apps/loadkeys.te 2008-04-04 16:11:03.000000000 -0400 +@@ -41,6 +41,9 @@ miscfiles_read_localization(loadkeys_t) -+userdom_dontaudit_search_users_home_dirs(loadkeys_t) ++userdom_dontaudit_write_unpriv_user_home_content_files(loadkeys_t) ++userdom_dontaudit_list_user_home_dirs(user, loadkeys_t) + optional_policy(` nscd_dontaudit_search_pid(loadkeys_t) ') -+ -+userdom_dontaudit_write_unpriv_user_home_content_files(loadkeys_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.0.8/policy/modules/apps/mono.if --- nsaserefpolicy/policy/modules/apps/mono.if 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/mono.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/mono.if 2008-04-04 16:11:03.000000000 -0400 @@ -18,3 +18,105 @@ corecmd_search_bin($1) domtrans_pattern($1, mono_exec_t, mono_t) @@ -3320,7 +3526,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.0.8/policy/modules/apps/mono.te --- nsaserefpolicy/policy/modules/apps/mono.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/mono.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/mono.te 2008-04-04 16:11:03.000000000 -0400 @@ -15,7 +15,7 @@ # Local policy # @@ -3340,7 +3546,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.8/policy/modules/apps/mozilla.if --- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/mozilla.if 2008-01-13 07:54:35.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/mozilla.if 2008-05-13 09:40:42.560450000 -0400 @@ -36,6 +36,8 @@ gen_require(` type mozilla_conf_t, mozilla_exec_t; @@ -3373,7 +3579,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. allow $1_mozilla_t self:fifo_file rw_fifo_file_perms; allow $1_mozilla_t self:shm { unix_read unix_write read write destroy create }; allow $1_mozilla_t self:sem create_sem_perms; -@@ -71,6 +81,11 @@ +@@ -66,11 +76,15 @@ + allow $1_mozilla_t self:unix_stream_socket { listen accept }; + # Browse the web, connect to printer + allow $1_mozilla_t self:tcp_socket create_socket_perms; +- allow $1_mozilla_t self:netlink_route_socket r_netlink_socket_perms; + # for bash - old mozilla binary can_exec($1_mozilla_t, mozilla_exec_t) @@ -3385,7 +3596,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. # X access, Home files manage_dirs_pattern($1_mozilla_t,$1_mozilla_home_t,$1_mozilla_home_t) manage_files_pattern($1_mozilla_t,$1_mozilla_home_t,$1_mozilla_home_t) -@@ -96,15 +111,41 @@ +@@ -96,15 +110,41 @@ relabel_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t) relabel_lnk_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t) @@ -3423,7 +3634,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. + tunable_policy(`browser_write_$1_data',` + userdom_manage_user_home_content_dirs($1,$1_mozilla_t) + userdom_manage_user_home_content_files($1,$1_mozilla_t) -+ userdom_read_user_home_content_symlinks($1,$1_mozilla_t) ++ userdom_manage_user_home_content_symlinks($1,$1_mozilla_t) + userdom_manage_user_home_content_pipes($1,$1_mozilla_t) + userdom_user_home_dir_filetrans_user_home_content($1,$1_mozilla_t, { file dir }) + ', ` @@ -3434,7 +3645,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. # Unrestricted inheritance from the caller. allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh }; -@@ -112,11 +153,13 @@ +@@ -112,11 +152,13 @@ ps_process_pattern($2,$1_mozilla_t) allow $2 $1_mozilla_t:process signal_perms; @@ -3450,7 +3661,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. # Look for plugins corecmd_list_bin($1_mozilla_t) -@@ -165,10 +208,23 @@ +@@ -165,13 +207,28 @@ files_read_var_files($1_mozilla_t) files_read_var_symlinks($1_mozilla_t) files_dontaudit_getattr_boot_dirs($1_mozilla_t) @@ -3474,10 +3685,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. term_dontaudit_getattr_pty_dirs($1_mozilla_t) -@@ -184,12 +240,8 @@ - sysnet_dns_name_resolve($1_mozilla_t) - sysnet_read_config($1_mozilla_t) - ++ auth_use_nsswitch($1_mozilla_t) ++ + libs_use_ld_so($1_mozilla_t) + libs_use_shared_libs($1_mozilla_t) + +@@ -180,16 +237,8 @@ + miscfiles_read_fonts($1_mozilla_t) + miscfiles_read_localization($1_mozilla_t) + +- # Browse the web, connect to printer +- sysnet_dns_name_resolve($1_mozilla_t) +- sysnet_read_config($1_mozilla_t) +- - userdom_manage_user_home_content_dirs($1,$1_mozilla_t) - userdom_manage_user_home_content_files($1,$1_mozilla_t) - userdom_manage_user_home_content_symlinks($1,$1_mozilla_t) @@ -3489,7 +3709,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t) xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t) -@@ -211,131 +263,8 @@ +@@ -211,131 +260,8 @@ fs_manage_cifs_symlinks($1_mozilla_t) ') @@ -3623,11 +3843,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') optional_policy(` -@@ -350,21 +279,27 @@ +@@ -350,21 +276,31 @@ optional_policy(` cups_read_rw_config($1_mozilla_t) cups_dbus_chat($1_mozilla_t) + cups_stream_connect($1_mozilla_t) ++ ') ++ ++ optional_policy(` ++ hal_dbus_chat($1_mozilla_t) ') optional_policy(` @@ -3637,14 +3861,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. - dbus_send_user_bus($1,$1_mozilla_t) +# dbus_send_user_bus(xguest,xguest_mozilla_t) +# dbus_connectto_user_bus(xguest,xguest_mozilla_t) - ') - - optional_policy(` -+ gnome_exec_gconf($1_mozilla_t) -+ gnome_manage_user_gnome_config($1,$1_mozilla_t) + ') + + optional_policy(` ++ gnome_exec_gconf($1_mozilla_t) ++ gnome_manage_user_gnome_config($1,$1_mozilla_t) + ') + + optional_policy(` + gnome_domtrans_user_gconf($1,$1_mozilla_t) gnome_stream_connect_gconf_template($1,$1_mozilla_t) ') @@ -3655,7 +3879,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') optional_policy(` -@@ -384,25 +319,6 @@ +@@ -377,32 +313,9 @@ + ') + + optional_policy(` +- nscd_socket_use($1_mozilla_t) +- ') +- +- optional_policy(` thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t) ') @@ -3681,7 +3912,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') ######################################## -@@ -575,3 +491,27 @@ +@@ -575,3 +488,27 @@ allow $2 $1_mozilla_t:tcp_socket rw_socket_perms; ') @@ -3711,7 +3942,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.0.8/policy/modules/apps/mozilla.te --- nsaserefpolicy/policy/modules/apps/mozilla.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/mozilla.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/mozilla.te 2008-04-04 16:11:03.000000000 -0400 @@ -6,13 +6,6 @@ # Declarations # @@ -3726,9 +3957,250 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. type mozilla_conf_t; files_config_file(mozilla_conf_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.fc serefpolicy-3.0.8/policy/modules/apps/openoffice.fc +--- nsaserefpolicy/policy/modules/apps/openoffice.fc 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/openoffice.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -0,0 +1,3 @@ ++/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0) ++/usr/lib64/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0) ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.if serefpolicy-3.0.8/policy/modules/apps/openoffice.if +--- nsaserefpolicy/policy/modules/apps/openoffice.if 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/openoffice.if 2008-04-04 16:11:03.000000000 -0400 +@@ -0,0 +1,212 @@ ++## Openoffice ++ ++####################################### ++## ++## The per role template for the openoffice module. ++## ++## ++##

++## This template creates a derived domains which are used ++## for openoffice plugins that are executed by a browser. ++##

++##

++## This template is invoked automatically for each user, and ++## generally does not need to be invoked directly ++## by policy writers. ++##

++## ++## ++## ++## The prefix of the user domain (e.g., user ++## is the prefix for user_t). ++## ++## ++## ++## ++## The type of the user domain. ++## ++## ++## ++## ++## The role associated with the user domain. ++## ++## ++# ++template(`openoffice_plugin_per_role_template',` ++ gen_require(` ++ type openoffice_exec_t; ++ ') ++ ++ ######################################## ++ # ++ # Declarations ++ # ++ ++ type $1_openofficeplugin_t; ++ application_domain($1_openofficeplugin_t,openoffice_exec_t) ++ role $3 types $1_openofficeplugin_t; ++ ++ type $1_openofficeplugin_tmp_t; ++ files_tmp_file($1_openofficeplugin_tmp_t) ++ ++ type $1_openofficeplugin_tmpfs_t; ++ files_tmpfs_file($1_openofficeplugin_tmpfs_t) ++ ++ ######################################## ++ # ++ # Local policy ++ # ++ ++ allow $1_openofficeplugin_t self:process { execmem execstack signal_perms getsched ptrace setsched }; ++ allow $1_openofficeplugin_t self:fifo_file rw_fifo_file_perms; ++ allow $1_openofficeplugin_t self:tcp_socket create_stream_socket_perms; ++ allow $1_openofficeplugin_t self:udp_socket create_socket_perms; ++ ++ allow $1_openofficeplugin_t $1_t:process signull; ++ allow $1_openofficeplugin_t $1_t:unix_stream_socket connectto; ++ allow $1_t $1_openofficeplugin_t:unix_stream_socket connectto; ++ allow $1_openofficeplugin_t $2:unix_stream_socket connectto; ++ allow $1_openofficeplugin_t $2:tcp_socket { read write }; ++ ++ manage_dirs_pattern($1_openofficeplugin_t,$1_openofficeplugin_tmp_t,$1_openofficeplugin_tmp_t) ++ manage_files_pattern($1_openofficeplugin_t,$1_openofficeplugin_tmp_t,$1_openofficeplugin_tmp_t) ++ files_tmp_filetrans($1_openofficeplugin_t,$1_openofficeplugin_tmp_t,{ file dir }) ++ allow $1_openofficeplugin_t $1_openofficeplugin_tmp_t:file execute; ++ ++ manage_files_pattern($1_openofficeplugin_t,$1_openofficeplugin_tmpfs_t,$1_openofficeplugin_tmpfs_t) ++ manage_lnk_files_pattern($1_openofficeplugin_t,$1_openofficeplugin_tmpfs_t,$1_openofficeplugin_tmpfs_t) ++ manage_fifo_files_pattern($1_openofficeplugin_t,$1_openofficeplugin_tmpfs_t,$1_openofficeplugin_tmpfs_t) ++ manage_sock_files_pattern($1_openofficeplugin_t,$1_openofficeplugin_tmpfs_t,$1_openofficeplugin_tmpfs_t) ++ fs_tmpfs_filetrans($1_openofficeplugin_t,$1_openofficeplugin_tmpfs_t,{ file lnk_file sock_file fifo_file }) ++ ++ can_exec($1_openofficeplugin_t, openoffice_exec_t) ++ ++ domtrans_pattern($2, openoffice_exec_t, $1_openofficeplugin_t) ++ # Unrestricted inheritance from the caller. ++ allow $2 $1_openofficeplugin_t:process { noatsecure siginh rlimitinh }; ++ allow $1_openofficeplugin_t $2:process signull; ++ ++ kernel_read_all_sysctls($1_openofficeplugin_t) ++ kernel_search_vm_sysctl($1_openofficeplugin_t) ++ kernel_read_network_state($1_openofficeplugin_t) ++ kernel_read_system_state($1_openofficeplugin_t) ++ ++ # Search bin directory under openofficeplugin for openofficeplugin executable ++ corecmd_exec_bin($1_openofficeplugin_t) ++ ++ corenet_all_recvfrom_unlabeled($1_openofficeplugin_t) ++ corenet_all_recvfrom_netlabel($1_openofficeplugin_t) ++ corenet_tcp_sendrecv_generic_if($1_openofficeplugin_t) ++ corenet_udp_sendrecv_generic_if($1_openofficeplugin_t) ++ corenet_tcp_sendrecv_all_nodes($1_openofficeplugin_t) ++ corenet_udp_sendrecv_all_nodes($1_openofficeplugin_t) ++ corenet_tcp_sendrecv_all_ports($1_openofficeplugin_t) ++ corenet_udp_sendrecv_all_ports($1_openofficeplugin_t) ++ corenet_tcp_connect_all_ports($1_openofficeplugin_t) ++ corenet_sendrecv_all_client_packets($1_openofficeplugin_t) ++ ++ dev_list_sysfs($1_openofficeplugin_t) ++ dev_read_sound($1_openofficeplugin_t) ++ dev_write_sound($1_openofficeplugin_t) ++ dev_read_urand($1_openofficeplugin_t) ++ dev_read_rand($1_openofficeplugin_t) ++ dev_write_rand($1_openofficeplugin_t) ++ ++ files_read_etc_files($1_openofficeplugin_t) ++ files_read_usr_files($1_openofficeplugin_t) ++ files_search_home($1_openofficeplugin_t) ++ files_search_var_lib($1_openofficeplugin_t) ++ files_read_etc_runtime_files($1_openofficeplugin_t) ++ # Read global fonts and font config ++ files_read_etc_files($1_openofficeplugin_t) ++ ++ fs_getattr_xattr_fs($1_openofficeplugin_t) ++ fs_dontaudit_rw_tmpfs_files($1_openofficeplugin_t) ++ fs_getattr_tmpfs($1_openofficeplugin_t) ++ ++ auth_use_nsswitch($1_openofficeplugin_t) ++ ++ libs_use_ld_so($1_openofficeplugin_t) ++ libs_use_shared_libs($1_openofficeplugin_t) ++ ++ logging_send_syslog_msg($1_openofficeplugin_t) ++ ++ miscfiles_read_localization($1_openofficeplugin_t) ++ # Read global fonts and font config ++ miscfiles_read_fonts($1_openofficeplugin_t) ++ ++ userdom_manage_unpriv_users_home_content_files($1_openofficeplugin_t) ++ userdom_dontaudit_use_user_terminals($1,$1_openofficeplugin_t) ++ userdom_dontaudit_setattr_user_home_content_files($1,$1_openofficeplugin_t) ++ userdom_exec_user_home_content_files($1,$1_openofficeplugin_t) ++ userdom_manage_user_tmp_dirs($1,$1_openofficeplugin_t) ++ userdom_manage_user_tmp_files($1,$1_openofficeplugin_t) ++ userdom_manage_user_tmp_sockets($1,$1_openofficeplugin_t) ++ userdom_read_user_tmpfs_files($1,$1_openofficeplugin_t) ++ userdom_manage_user_home_content_dirs($1,$1_openofficeplugin_t) ++ userdom_manage_user_home_content_files($1,$1_openofficeplugin_t) ++ userdom_manage_user_home_content_symlinks($1,$1_openofficeplugin_t) ++ userdom_manage_user_home_content_pipes($1,$1_openofficeplugin_t) ++ userdom_manage_user_home_content_sockets($1,$1_openofficeplugin_t) ++ userdom_user_home_dir_filetrans_user_home_content($1,$1_openofficeplugin_t,{ file lnk_file sock_file fifo_file }) ++ ++ optional_policy(` ++ xserver_user_x_domain_template($1,$1_openofficeplugin,$1_openofficeplugin_t,$1_openofficeplugin_tmpfs_t) ++ ') ++ ++') ++ ++####################################### ++## ++## The per role template for the openoffice module. ++## ++## ++##

++## This template creates a derived domains which are used ++## for openoffice applications. ++##

++## ++## ++## ++## The prefix of the user domain (e.g., user ++## is the prefix for user_t). ++## ++## ++## ++## ++## The type of the user domain. ++## ++## ++## ++## ++## The role associated with the user domain. ++## ++## ++# ++template(`openoffice_per_role_template',` ++ gen_require(` ++ type openoffice_exec_t; ++ ') ++ ++ type $1_openoffice_t; ++ domain_type($1_openoffice_t) ++ domain_entry_file($1_openoffice_t,openoffice_exec_t) ++ role $3 types $1_openoffice_t; ++ ++ domain_interactive_fd($1_openoffice_t) ++ ++ userdom_unpriv_usertype($1, $1_openoffice_t) ++ userdom_exec_user_home_content_files($1,$1_openoffice_t) ++ ++ allow $1_openoffice_t self:process { getsched sigkill execheap execmem execstack }; ++ ++ allow $2 $1_openoffice_t:process { getattr ptrace signal_perms noatsecure siginh rlimitinh }; ++ allow $1_openoffice_t $2:tcp_socket { read write }; ++ ++ domtrans_pattern($2, openoffice_exec_t, $1_openoffice_t) ++ ++ dev_read_urand($1_openoffice_t) ++ dev_read_rand($1_openoffice_t) ++ ++ fs_dontaudit_rw_tmpfs_files($1_openoffice_t) ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.te serefpolicy-3.0.8/policy/modules/apps/openoffice.te +--- nsaserefpolicy/policy/modules/apps/openoffice.te 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/openoffice.te 2008-04-04 16:11:03.000000000 -0400 +@@ -0,0 +1,14 @@ ++ ++policy_module(openoffice,1.0.0) ++ ++######################################## ++# ++# Declarations ++# ++ ++type openoffice_t; ++type openoffice_exec_t; ++application_domain(openoffice_t,openoffice_exec_t) ++ ++ ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.if serefpolicy-3.0.8/policy/modules/apps/slocate.if --- nsaserefpolicy/policy/modules/apps/slocate.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/slocate.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/slocate.if 2008-04-04 16:11:03.000000000 -0400 @@ -39,3 +39,4 @@ allow $1 locate_var_lib_t:dir list_dir_perms; files_search_var_lib($1) @@ -3736,7 +4208,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.0.8/policy/modules/apps/slocate.te --- nsaserefpolicy/policy/modules/apps/slocate.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/slocate.te 2008-01-03 10:02:40.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/slocate.te 2008-04-04 16:11:03.000000000 -0400 @@ -39,6 +39,7 @@ files_list_all(locate_t) @@ -3745,9 +4217,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate. files_getattr_all_sockets(locate_t) files_read_etc_runtime_files(locate_t) files_read_etc_files(locate_t) +@@ -46,6 +47,8 @@ + fs_getattr_all_fs(locate_t) + fs_getattr_all_files(locate_t) + fs_list_all(locate_t) ++fs_getattr_all_pipes(locate_t) ++fs_getattr_all_symlinks(locate_t) + + # getpwnam + auth_use_nsswitch(locate_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.0.8/policy/modules/apps/userhelper.if --- nsaserefpolicy/policy/modules/apps/userhelper.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/userhelper.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/userhelper.if 2008-04-04 16:11:03.000000000 -0400 @@ -130,6 +130,7 @@ term_use_all_user_ptys($1_userhelper_t) @@ -3758,7 +4239,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp auth_search_pam_console_data($1_userhelper_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.8/policy/modules/apps/vmware.fc --- nsaserefpolicy/policy/modules/apps/vmware.fc 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/vmware.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/vmware.fc 2008-04-04 16:11:03.000000000 -0400 @@ -21,19 +21,25 @@ /usr/bin/vmware-nmbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) /usr/bin/vmware-ping -- gen_context(system_u:object_r:vmware_host_exec_t,s0) @@ -3792,7 +4273,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.f +/var/log/vmware.* -- gen_context(system_u:object_r:vmware_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.if serefpolicy-3.0.8/policy/modules/apps/vmware.if --- nsaserefpolicy/policy/modules/apps/vmware.if 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/vmware.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/vmware.if 2008-04-04 16:11:03.000000000 -0400 @@ -202,3 +202,22 @@ allow $1 vmware_sys_conf_t:file append; @@ -3818,7 +4299,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.0.8/policy/modules/apps/vmware.te --- nsaserefpolicy/policy/modules/apps/vmware.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/vmware.te 2007-12-13 10:47:36.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/vmware.te 2008-04-04 16:11:03.000000000 -0400 @@ -22,17 +22,21 @@ type vmware_var_run_t; files_pid_file(vmware_var_run_t) @@ -3883,7 +4364,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.t + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.8/policy/modules/apps/wine.if --- nsaserefpolicy/policy/modules/apps/wine.if 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/wine.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/wine.if 2008-04-04 16:11:03.000000000 -0400 @@ -18,3 +18,84 @@ corecmd_search_bin($1) domtrans_pattern($1, wine_exec_t, wine_t) @@ -3971,7 +4452,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.0.8/policy/modules/apps/wine.te --- nsaserefpolicy/policy/modules/apps/wine.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/wine.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/apps/wine.te 2008-04-04 16:11:03.000000000 -0400 @@ -9,6 +9,7 @@ type wine_t; type wine_exec_t; @@ -3980,7 +4461,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te ######################################## # -@@ -20,7 +21,12 @@ +@@ -17,10 +18,16 @@ + + optional_policy(` + allow wine_t self:process { execstack execmem execheap }; ++ domain_mmap_low(wine_t) unconfined_domain_noaudit(wine_t) files_execmod_all_files(wine_t) @@ -3998,7 +4483,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc 2008-01-14 14:12:06.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc 2008-04-04 16:11:03.000000000 -0400 @@ -7,6 +7,7 @@ /bin/d?ash -- gen_context(system_u:object_r:shell_exec_t,s0) /bin/bash -- gen_context(system_u:object_r:shell_exec_t,s0) @@ -4035,20 +4520,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco # # /usr # -@@ -126,10 +132,10 @@ +@@ -126,10 +132,7 @@ /usr/lib(64)?/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:bin_t,s0) /usr/lib(64)?/apt/methods.+ -- gen_context(system_u:object_r:bin_t,s0) /usr/lib(64)?/courier(/.*)? gen_context(system_u:object_r:bin_t,s0) -/usr/lib(64)?/cups/backend(/.*)? gen_context(system_u:object_r:bin_t,s0) - /usr/lib(64)?/cups/cgi-bin/.* -- gen_context(system_u:object_r:bin_t,s0) +-/usr/lib(64)?/cups/cgi-bin/.* -- gen_context(system_u:object_r:bin_t,s0) -/usr/lib(64)?/cups/daemon(/.*)? gen_context(system_u:object_r:bin_t,s0) - /usr/lib(64)?/cups/filter(/.*)? gen_context(system_u:object_r:bin_t,s0) -+/usr/lib(64)?/cups/backend(/.*)? gen_context(system_u:object_r:bin_t,s0) -+/usr/lib(64)?/cups/daemon(/.*)? gen_context(system_u:object_r:bin_t,s0) +-/usr/lib(64)?/cups/filter(/.*)? gen_context(system_u:object_r:bin_t,s0) ++/usr/lib(64)?/cups(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib(64)?/cyrus-imapd/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib(64)?/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0) -@@ -163,9 +169,15 @@ +@@ -163,9 +166,16 @@ /usr/libexec/openssh/sftp-server -- gen_context(system_u:object_r:bin_t,s0) /usr/local/lib(64)?/ipsec/.* -- gen_context(system_u:object_r:bin_t,s0) @@ -4057,6 +4541,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco +/usr/local/Brother(/.*)?/lpd(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/local/Printer/[^/]*/cupswrapper(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/local/Printer/[^/]*/lpd(/.*)? gen_context(system_u:object_r:bin_t,s0) ++/usr/local/linuxprinter/filters(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/bin/scponly -- gen_context(system_u:object_r:shell_exec_t,s0) +/usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0) @@ -4065,7 +4550,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco /usr/share/apr-0/build/[^/]+\.sh -- gen_context(system_u:object_r:bin_t,s0) /usr/share/apr-0/build/libtool -- gen_context(system_u:object_r:bin_t,s0) -@@ -180,6 +192,7 @@ +@@ -180,6 +190,7 @@ /usr/share/turboprint/lib(/.*)? -- gen_context(system_u:object_r:bin_t,s0) /usr/X11R6/lib(64)?/X11/xkb/xkbcomp -- gen_context(system_u:object_r:bin_t,s0) @@ -4073,7 +4558,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco ifdef(`distro_gentoo', ` /usr/.*-.*-linux-gnu/gcc-bin/.*(/.*)? gen_context(system_u:object_r:bin_t,s0) -@@ -259,3 +272,23 @@ +@@ -188,6 +199,7 @@ + + ifdef(`distro_redhat', ` + /usr/lib/.*/program(/.*)? gen_context(system_u:object_r:bin_t,s0) ++/usr/lib64/.*/program(/.*)? gen_context(system_u:object_r:bin_t,s0) + /usr/lib/bluetooth(/.*)? -- gen_context(system_u:object_r:bin_t,s0) + /usr/lib/vmware-tools/sbin32(/.*)? gen_context(system_u:object_r:bin_t,s0) + /usr/lib64/bluetooth(/.*)? -- gen_context(system_u:object_r:bin_t,s0) +@@ -259,3 +271,23 @@ ifdef(`distro_suse',` /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) ') @@ -4099,7 +4592,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco +/usr/lib/nspluginwrapper/npconfig -- gen_context(system_u:object_r:bin_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.if.in serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.if.in 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in 2008-04-04 16:11:03.000000000 -0400 @@ -903,9 +903,11 @@ interface(`corenet_udp_bind_generic_port',` gen_require(` @@ -4112,7 +4605,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene ') ######################################## -@@ -1449,6 +1451,43 @@ +@@ -1386,10 +1388,11 @@ + # + interface(`corenet_tcp_bind_all_unreserved_ports',` + gen_require(` +- attribute port_type, reserved_port_type; ++ attribute port_type; ++ type hi_reserved_port_t, reserved_port_t; + ') + +- allow $1 { port_type -reserved_port_type }:tcp_socket name_bind; ++ allow $1 { port_type -hi_reserved_port_t -reserved_port_t }:tcp_socket name_bind; + ') + + ######################################## +@@ -1404,10 +1407,11 @@ + # + interface(`corenet_udp_bind_all_unreserved_ports',` + gen_require(` +- attribute port_type, reserved_port_type; ++ attribute port_type; ++ type hi_reserved_port_t, reserved_port_t; + ') + +- allow $1 { port_type -reserved_port_type }:udp_socket name_bind; ++ allow $1 { port_type -hi_reserved_port_t -reserved_port_t }:udp_socket name_bind; + ') + + ######################################## +@@ -1449,6 +1453,43 @@ ######################################## ## @@ -4158,7 +4679,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.0.8/policy/modules/kernel/corenetwork.te.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/corenetwork.te.in 2008-05-06 16:00:10.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/corenetwork.te.in 2008-04-22 15:54:37.000000000 -0400 @@ -55,6 +55,11 @@ type reserved_port_t, port_type, reserved_port_type; @@ -4171,15 +4692,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene # server_packet_t is the default type of IPv4 and IPv6 server packets. # type server_packet_t, packet_type, server_packet_type; -@@ -67,6 +72,7 @@ +@@ -67,8 +72,10 @@ network_port(amanda, udp,10080,s0, tcp,10080,s0, udp,10081,s0, tcp,10081,s0, tcp,10082,s0, tcp,10083,s0) network_port(amavisd_recv, tcp,10024,s0) network_port(amavisd_send, tcp,10025,s0) +network_port(aol, udp,5190,s0, tcp,5190,s0, udp,5191,s0, tcp,5191,s0, udp,5192,s0, tcp,5192,s0, udp,5193,s0, tcp,5193,s0) network_port(apcupsd, tcp,3551,s0, udp,3551,s0) network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0, udp,5060,s0) ++network_port(audit, tcp,60,s0) network_port(auth, tcp,113,s0) -@@ -93,10 +99,11 @@ + network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0) + type biff_port_t, port_type, reserved_port_type; dnl network_port(biff) # no defined portcon in current strict +@@ -93,27 +100,34 @@ network_port(http_cache, tcp,3128,s0, udp,3130,s0, tcp,8080,s0, tcp,8118,s0) # 8118 is for privoxy network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0, tcp,8009,s0, tcp,8443,s0) #8443 is mod_nss default port network_port(howl, tcp,5335,s0, udp,5353,s0) @@ -4193,7 +4717,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene network_port(innd, tcp,119,s0) network_port(ipp, tcp,631,s0, udp,631,s0) network_port(ircd, tcp,6667,s0) -@@ -108,12 +115,17 @@ + network_port(isakmp, udp,500,s0) + network_port(iscsi, tcp,3260,s0) ++network_port(isns, tcp,3205,s0, udp,3205,s0) + network_port(jabber_client, tcp,5222,s0, tcp,5223,s0) + network_port(jabber_interserver, tcp,5269,s0) + network_port(kerberos_admin, tcp,464,s0, udp,464,s0, tcp,749,s0) network_port(kerberos_master, tcp,4444,s0, udp,4444,s0) network_port(kerberos, tcp,88,s0, udp,88,s0, tcp,750,s0, udp,750,s0) network_port(ktalkd, udp,517,s0, udp,518,s0) @@ -4213,7 +4742,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene network_port(nessus, tcp,1241,s0) network_port(netsupport, tcp,5405,s0, udp,5405,s0) network_port(nmbd, udp,137,s0, udp,138,s0) -@@ -122,6 +134,7 @@ +@@ -122,10 +136,12 @@ network_port(openvpn, tcp,1194,s0, udp,1194,s0) network_port(pegasus_http, tcp,5988,s0) network_port(pegasus_https, tcp,5989,s0) @@ -4221,7 +4750,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene network_port(pop, tcp,106,s0, tcp,109,s0, tcp,110,s0, tcp,143,s0, tcp,220,s0, tcp,993,s0, tcp,995,s0, tcp,1109,s0) network_port(portmap, udp,111,s0, tcp,111,s0) network_port(postgresql, tcp,5432,s0) -@@ -141,12 +154,12 @@ + network_port(postgrey, tcp,60000,s0) ++network_port(prelude, tcp,4690,s0, udp,4690,s0) + network_port(printer, tcp,515,s0) + network_port(ptal, tcp,5703,s0) + network_port(pxe, udp,4011,s0) +@@ -137,16 +153,16 @@ + network_port(ricci_modcluster, tcp,16851,s0, udp,16851,s0) + network_port(rlogind, tcp,513,s0) + network_port(rndc, tcp,953,s0) +-network_port(router, udp,520,s0) ++network_port(router, udp,520,s0, udp,521,s0, tcp,521,s0) network_port(rsh, tcp,514,s0) network_port(rsync, tcp,873,s0, udp,873,s0) network_port(rwho, udp,513,s0) @@ -4236,10 +4775,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene type socks_port_t, port_type; dnl network_port(socks) # no defined portcon type stunnel_port_t, port_type; dnl network_port(stunnel) # no defined portcon in current strict network_port(squid, udp,3401,s0, tcp,3401,s0, udp,4827,s0, tcp,4827,s0) # snmp and htcp -@@ -160,13 +173,19 @@ +@@ -160,13 +176,20 @@ type utcpserver_port_t, port_type; dnl network_port(utcpserver) # no defined portcon network_port(uucpd, tcp,540,s0) network_port(vnc, tcp,5900,s0) ++network_port(whois, tcp,43,s0, udp,43,s0) +network_port(wccp, udp,2048,s0) +network_port(xdmcp, udp,177,s0, tcp,177,s0) network_port(xen, tcp,8002,s0) @@ -4259,19 +4799,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.0.8/policy/modules/kernel/devices.fc --- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/devices.fc 2007-12-31 08:18:10.000000000 -0500 -@@ -4,6 +4,7 @@ ++++ serefpolicy-3.0.8/policy/modules/kernel/devices.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -1,8 +1,9 @@ + /dev -d gen_context(system_u:object_r:device_t,s0) + /dev/.* gen_context(system_u:object_r:device_t,s0) +- ++/dev/3dfx -c gen_context(system_u:object_r:xserver_misc_device_t,s0) /dev/.*mouse.* -c gen_context(system_u:object_r:mouse_device_t,s0) - /dev/adsp.* -c gen_context(system_u:object_r:sound_device_t,s0) +/dev/admmidi.* -c gen_context(system_u:object_r:sound_device_t,s0) + /dev/adsp.* -c gen_context(system_u:object_r:sound_device_t,s0) /dev/(misc/)?agpgart -c gen_context(system_u:object_r:agp_device_t,s0) /dev/aload.* -c gen_context(system_u:object_r:sound_device_t,s0) - /dev/amidi.* -c gen_context(system_u:object_r:sound_device_t,s0) -@@ -14,22 +15,33 @@ +@@ -11,29 +12,45 @@ + /dev/apm_bios -c gen_context(system_u:object_r:apm_bios_t,s0) + /dev/atibm -c gen_context(system_u:object_r:mouse_device_t,s0) + /dev/audio.* -c gen_context(system_u:object_r:sound_device_t,s0) ++/dev/autofs.* -c gen_context(system_u:object_r:autofs_device_t,s0) /dev/beep -c gen_context(system_u:object_r:sound_device_t,s0) /dev/dmfm -c gen_context(system_u:object_r:sound_device_t,s0) ++/dev/dmmidi.* -c gen_context(system_u:object_r:sound_device_t,s0) /dev/dsp.* -c gen_context(system_u:object_r:sound_device_t,s0) ++/dev/gfx -c gen_context(system_u:object_r:xserver_misc_device_t,s0) ++/dev/graphics -c gen_context(system_u:object_r:xserver_misc_device_t,s0) +/dev/gtrsc.* -c gen_context(system_u:object_r:clock_device_t,s0) +/dev/pcfclock.* -c gen_context(system_u:object_r:clock_device_t,s0) /dev/efirtc -c gen_context(system_u:object_r:clock_device_t,s0) @@ -4283,8 +4833,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device +/dev/[0-9].* -c gen_context(system_u:object_r:usb_device_t,s0) /dev/fw.* -c gen_context(system_u:object_r:usb_device_t,s0) +/dev/hfmodem -c gen_context(system_u:object_r:sound_device_t,s0) -+/dev/hidraw.* -c gen_context(system_u:object_r:usb_device_t,s0) /dev/hiddev.* -c gen_context(system_u:object_r:usb_device_t,s0) ++/dev/hidraw.* -c gen_context(system_u:object_r:usb_device_t,s0) /dev/hpet -c gen_context(system_u:object_r:clock_device_t,s0) /dev/hw_random -c gen_context(system_u:object_r:random_device_t,s0) /dev/hwrng -c gen_context(system_u:object_r:random_device_t,s0) @@ -4293,52 +4843,51 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device +/dev/ipmi/[0-9]+ -c gen_context(system_u:object_r:ipmi_device_t,s0) /dev/irlpt[0-9]+ -c gen_context(system_u:object_r:printer_device_t,s0) +/dev/elographics/e2201 -c gen_context(system_u:object_r:mouse_device_t,s0) ++/dev/jbm -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/js.* -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/kmem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) -+/dev/mergemem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) /dev/kmsg -c gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh) -+/dev/kvm -c gen_context(system_u:object_r:kvm_device_t,mls_systemhigh) ++/dev/kvm -c gen_context(system_u:object_r:kvm_device_t,s0) +/dev/lircm -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/logibm -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/lp.* -c gen_context(system_u:object_r:printer_device_t,s0) /dev/mcelog -c gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh) -@@ -41,6 +53,11 @@ - /dev/mmetfgrab -c gen_context(system_u:object_r:scanner_device_t,s0) - /dev/mpu401.* -c gen_context(system_u:object_r:sound_device_t,s0) - /dev/null -c gen_context(system_u:object_r:null_device_t,s0) -+ -+/dev/opengl -c gen_context(system_u:object_r:xserver_misc_device_t,s0) -+/dev/gfx -c gen_context(system_u:object_r:xserver_misc_device_t,s0) -+/dev/3dfx -c gen_context(system_u:object_r:xserver_misc_device_t,s0) -+/dev/graphics -c gen_context(system_u:object_r:xserver_misc_device_t,s0) + /dev/mem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) ++/dev/mergemem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) + /dev/mice -c gen_context(system_u:object_r:mouse_device_t,s0) + /dev/microcode -c gen_context(system_u:object_r:cpu_device_t,s0) + /dev/midi.* -c gen_context(system_u:object_r:sound_device_t,s0) +@@ -44,6 +61,7 @@ /dev/nvidia.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0) /dev/nvram -c gen_context(system_u:object_r:nvram_device_t,mls_systemhigh) /dev/oldmem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) -@@ -49,6 +66,9 @@ ++/dev/opengl -c gen_context(system_u:object_r:xserver_misc_device_t,s0) + /dev/par.* -c gen_context(system_u:object_r:printer_device_t,s0) + /dev/patmgr[01] -c gen_context(system_u:object_r:sound_device_t,s0) /dev/pmu -c gen_context(system_u:object_r:power_device_t,s0) - /dev/port -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) - /dev/(misc/)?psaux -c gen_context(system_u:object_r:mouse_device_t,s0) -+/dev/dmmidi.* -c gen_context(system_u:object_r:sound_device_t,s0) -+/dev/inportbm -c gen_context(system_u:object_r:mouse_device_t,s0) -+/dev/jbm -c gen_context(system_u:object_r:mouse_device_t,s0) - /dev/rmidi.* -c gen_context(system_u:object_r:sound_device_t,s0) - /dev/radeon -c gen_context(system_u:object_r:dri_device_t,s0) - /dev/radio.* -c gen_context(system_u:object_r:v4l_device_t,s0) -@@ -65,9 +85,11 @@ +@@ -65,14 +83,14 @@ /dev/sonypi -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/tlk[0-3] -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/urandom -c gen_context(system_u:object_r:urandom_device_t,s0) +-/dev/usbmon[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0) +-/dev/usbdev.* -c gen_context(system_u:object_r:usb_device_t,s0) +-/dev/usb[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0) +/dev/ub[a-c] -c gen_context(system_u:object_r:usb_device_t,s0) - /dev/usbmon[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0) - /dev/usbdev.* -c gen_context(system_u:object_r:usb_device_t,s0) - /dev/usb[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0) -+/dev/usb/.+ -c gen_context(system_u:object_r:usb_device_t,s0) ++/dev/usb.+ -c gen_context(system_u:object_r:usb_device_t,s0) /dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0) ifdef(`distro_suse', ` /dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0) -@@ -95,11 +117,21 @@ + ') + /dev/vbi.* -c gen_context(system_u:object_r:v4l_device_t,s0) ++/dev/vboxadd.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0) + /dev/vmmon -c gen_context(system_u:object_r:vmware_device_t,s0) + /dev/vmnet.* -c gen_context(system_u:object_r:vmware_device_t,s0) + /dev/video.* -c gen_context(system_u:object_r:v4l_device_t,s0) +@@ -94,12 +112,23 @@ + /dev/dvb/.* -c gen_context(system_u:object_r:v4l_device_t,s0) ++/dev/inportbm -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/input/.*mouse.* -c gen_context(system_u:object_r:mouse_device_t,s0) +/dev/input/keyboard.* -c gen_context(system_u:object_r:event_device_t,s0) /dev/input/event.* -c gen_context(system_u:object_r:event_device_t,s0) @@ -4358,9 +4907,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device /dev/pts(/.*)? <> +@@ -113,14 +142,9 @@ + /dev/xen/blktap.* -c gen_context(system_u:object_r:xen_device_t,s0) + /dev/xen/evtchn -c gen_context(system_u:object_r:xen_device_t,s0) + +-/etc/udev/devices -d gen_context(system_u:object_r:device_t,s0) +- +-/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0) ++/etc/udev/devices -d gen_context(system_u:object_r:device_t,s0) + +-ifdef(`distro_debian',` +-# used by udev init script as temporary mount point +-/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0) +-') ++/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0) + + ifdef(`distro_gentoo',` + # used by init scripts to initally populate udev /dev diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.0.8/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/devices.if 2008-01-13 07:59:15.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/devices.if 2008-04-04 16:11:03.000000000 -0400 @@ -65,7 +65,7 @@ relabelfrom_dirs_pattern($1,device_t,device_node) @@ -4535,30 +5101,140 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device ## Get the attributes of miscellaneous devices. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.0.8/policy/modules/kernel/devices.te ---- nsaserefpolicy/policy/modules/kernel/devices.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/devices.te 2007-12-31 08:18:33.000000000 -0500 -@@ -66,12 +66,25 @@ - dev_node(framebuf_device_t) +@@ -3284,3 +3414,96 @@ - # -+# Type for /dev/ipmi/0 -+# -+type ipmi_device_t; -+dev_node(ipmi_device_t) + typeattribute $1 devices_unconfined_type; + ') + ++######################################## ++## ++## Get the attributes of the autofs device node. ++## ++## ++## ++## Domain allowed access. ++## ++## +# - # Type for /dev/kmsg - # - type kmsg_device_t; - dev_node(kmsg_device_t) - - # -+# kvm_device_t is the type of -+# /dev/kvm -+# -+type kvm_device_t; -+dev_node(kvm_device_t) ++interface(`dev_getattr_autofs_dev',` ++ gen_require(` ++ type device_t, autofs_device_t; ++ ') ++ ++ getattr_chr_files_pattern($1,device_t,autofs_device_t) ++') ++ ++######################################## ++## ++## Do not audit attempts to get the attributes of ++## the autofs device node. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`dev_dontaudit_getattr_autofs_dev',` ++ gen_require(` ++ type autofs_device_t; ++ ') ++ ++ dontaudit $1 autofs_device_t:chr_file getattr; ++') ++ ++######################################## ++## ++## Set the attributes of the autofs device node. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_setattr_autofs_dev',` ++ gen_require(` ++ type device_t, autofs_device_t; ++ ') ++ ++ setattr_chr_files_pattern($1,device_t,autofs_device_t) ++') ++ ++######################################## ++## ++## Do not audit attempts to set the attributes of ++## the autofs device node. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`dev_dontaudit_setattr_autofs_dev',` ++ gen_require(` ++ type autofs_device_t; ++ ') ++ ++ dontaudit $1 autofs_device_t:chr_file setattr; ++') ++ ++######################################## ++## ++## Read and write the autofs device. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_rw_autofs',` ++ gen_require(` ++ type device_t, autofs_device_t; ++ ') ++ ++ rw_chr_files_pattern($1,device_t,autofs_device_t) ++') ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.0.8/policy/modules/kernel/devices.te +--- nsaserefpolicy/policy/modules/kernel/devices.te 2007-10-22 13:21:42.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/devices.te 2008-04-04 16:11:03.000000000 -0400 +@@ -32,6 +32,12 @@ + type apm_bios_t; + dev_node(apm_bios_t) + ++# ++# Type for /dev/autofs ++# ++type autofs_device_t; ++dev_node(autofs_device_t) ++ + type cardmgr_dev_t; + dev_node(cardmgr_dev_t) + files_tmp_file(cardmgr_dev_t) +@@ -66,12 +72,25 @@ + dev_node(framebuf_device_t) + + # ++# Type for /dev/ipmi/0 ++# ++type ipmi_device_t; ++dev_node(ipmi_device_t) ++ ++# + # Type for /dev/kmsg + # + type kmsg_device_t; + dev_node(kmsg_device_t) + + # ++# kvm_device_t is the type of ++# /dev/kvm ++# ++type kvm_device_t; ++dev_node(kvm_device_t) + +# # Type for /dev/mapper/control @@ -4566,7 +5242,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device type lvm_control_t; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.8/policy/modules/kernel/domain.if --- nsaserefpolicy/policy/modules/kernel/domain.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/domain.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/domain.if 2008-04-04 16:11:03.000000000 -0400 @@ -45,6 +45,11 @@ # start with basic domain domain_base_type($1) @@ -4610,7 +5286,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.8/policy/modules/kernel/domain.te --- nsaserefpolicy/policy/modules/kernel/domain.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/domain.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/domain.te 2008-04-04 16:11:03.000000000 -0400 @@ -6,6 +6,22 @@ # Declarations # @@ -4648,7 +5324,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain # Use trusted objects in /dev dev_rw_null(domain) -@@ -134,3 +154,32 @@ +@@ -91,6 +111,9 @@ + + # list the root directory + files_list_root(domain) ++# Apps getattr on the current working directory when they start, this just ++# eliminates lots of bogus avc messages ++files_getattr_all_dirs(domain) + + tunable_policy(`global_ssp',` + # enable reading of urandom for all domains: +@@ -129,8 +152,46 @@ + + # For /proc/pid + allow unconfined_domain_type domain:dir r_dir_perms; +-allow unconfined_domain_type domain:file r_file_perms; ++allow unconfined_domain_type domain:file rw_file_perms; + allow unconfined_domain_type domain:lnk_file r_file_perms; # act on all domains keys allow unconfined_domain_type domain:key *; @@ -4677,13 +5369,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain +allow domain domain:fd use; +optional_policy(` + rpm_rw_pipes(domain) ++ rpm_dontaudit_use_script_fds(domain) ++ rpm_dontaudit_write_pid_files(domain) +') ++ +optional_policy(` + unconfined_dontaudit_rw_pipes(domain) ++ unconfined_sigchld(domain) ++') ++ ++optional_policy(` ++ rhgb_dontaudit_use_ptys(domain) +') ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.0.8/policy/modules/kernel/files.fc --- nsaserefpolicy/policy/modules/kernel/files.fc 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/files.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/files.fc 2008-04-04 16:11:03.000000000 -0400 @@ -209,7 +209,8 @@ /usr/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh) /usr/lost\+found/.* <> @@ -4696,7 +5397,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. /usr/src/kernels/.+/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.8/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/files.if 2008-01-16 08:57:05.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/files.if 2008-04-21 16:41:56.000000000 -0400 @@ -343,8 +343,7 @@ ######################################## @@ -4979,7 +5680,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## Read all tmp files. ## ## -@@ -3323,6 +3439,42 @@ +@@ -3323,6 +3439,60 @@ ######################################## ## @@ -5001,6 +5702,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. + +######################################## +## ++## dontaudit write of /usr files ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_dontaudit_write_usr_files',` ++ gen_require(` ++ type usr_t; ++ ') ++ ++ dontaudit $1 usr_t:file write; ++') ++ ++######################################## ++## +## Create, read, write, and delete files in the /usr directory. +## +## @@ -5022,7 +5741,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## Get the attributes of files in /usr. ## ## -@@ -3381,7 +3533,7 @@ +@@ -3381,7 +3551,7 @@ ######################################## ## @@ -5031,7 +5750,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## ## ## -@@ -3389,17 +3541,17 @@ +@@ -3389,17 +3559,17 @@ ## ## # @@ -5052,7 +5771,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## ## ## -@@ -3407,12 +3559,12 @@ +@@ -3407,12 +3577,12 @@ ## ## # @@ -5067,7 +5786,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4043,7 +4195,7 @@ +@@ -4043,7 +4213,7 @@ type var_t, var_lock_t; ') @@ -5076,7 +5795,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4285,6 +4437,25 @@ +@@ -4285,6 +4455,25 @@ ######################################## ## @@ -5102,7 +5821,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## Do not audit attempts to write to daemon runtime data files. ## ## -@@ -4560,6 +4731,8 @@ +@@ -4560,6 +4749,8 @@ # Need to give access to /selinux/member selinux_compute_member($1) @@ -5111,7 +5830,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # Need sys_admin capability for mounting allow $1 self:capability { chown fsetid sys_admin }; -@@ -4582,6 +4755,11 @@ +@@ -4582,6 +4773,11 @@ # Default type for mountpoints allow $1 poly_t:dir { create mounton }; fs_unmount_xattr_fs($1) @@ -5123,7 +5842,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4619,3 +4797,28 @@ +@@ -4619,3 +4815,28 @@ allow $1 { file_type -security_file_type }:dir manage_dir_perms; ') @@ -5154,7 +5873,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.0.8/policy/modules/kernel/files.te --- nsaserefpolicy/policy/modules/kernel/files.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/files.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/files.te 2008-04-04 16:11:03.000000000 -0400 @@ -1,5 +1,5 @@ -policy_module(files,1.6.1) @@ -5182,7 +5901,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.0.8/policy/modules/kernel/filesystem.if --- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.if 2008-01-13 07:57:42.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.if 2008-04-04 16:11:03.000000000 -0400 @@ -271,45 +271,6 @@ ######################################## @@ -5264,7 +5983,114 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ## ## ## -@@ -2139,6 +2119,7 @@ +@@ -1249,6 +1229,106 @@ + + ######################################## + ## ++## Create, read, write, and delete directories ++## on a FUSEFS filesystem. ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++# ++interface(`fs_manage_fusefs_dirs',` ++ gen_require(` ++ type fusefs_t; ++ ') ++ ++ allow $1 fusefs_t:dir manage_dir_perms; ++') ++ ++######################################## ++## ++## Do not audit attempts to create, read, ++## write, and delete directories ++## on a FUSEFS filesystem. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`fs_dontaudit_manage_fusefs_dirs',` ++ gen_require(` ++ type fusefs_t; ++ ') ++ ++ dontaudit $1 fusefs_t:dir manage_dir_perms; ++') ++ ++######################################## ++## ++## Create, read, write, and delete files ++## on a FUSEFS filesystem. ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++# ++interface(`fs_manage_fusefs_files',` ++ gen_require(` ++ type fusefs_t; ++ ') ++ ++ manage_files_pattern($1,fusefs_t,fusefs_t) ++') ++ ++######################################## ++## ++## Read symbolic links on a FUSEFS filesystem. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`fs_read_fusefs_symlinks',` ++ gen_require(` ++ type fusefs_t; ++ ') ++ ++ allow $1 fusefs_t:dir list_dir_perms; ++ read_lnk_files_pattern($1,fusefs_t,fusefs_t) ++') ++ ++ ++######################################## ++## ++## Do not audit attempts to create, ++## read, write, and delete files ++## on a FUSEFS filesystem. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`fs_dontaudit_manage_fusefs_files',` ++ gen_require(` ++ type fusefs_t; ++ ') ++ ++ dontaudit $1 fusefs_t:file manage_file_perms; ++') ++ ++######################################## ++## + ## Search inotifyfs filesystem. + ## + ## +@@ -2139,6 +2219,7 @@ rw_files_pattern($1,nfsd_fs_t,nfsd_fs_t) ') @@ -5272,7 +6098,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ######################################## ## ## Mount a RAM filesystem. -@@ -2214,6 +2195,24 @@ +@@ -2214,6 +2295,24 @@ ######################################## ## @@ -5297,7 +6123,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ## Search directories on a ramfs ## ## -@@ -2276,7 +2275,7 @@ +@@ -2276,7 +2375,7 @@ ## Domain allowed access. ## ## @@ -5306,7 +6132,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy interface(`fs_dontaudit_read_ramfs_files',` gen_require(` type ramfs_t; -@@ -3322,6 +3321,24 @@ +@@ -2885,6 +2984,7 @@ + type tmpfs_t; + ') + ++ dontaudit $1 tmpfs_t:dir rw_dir_perms; + dontaudit $1 tmpfs_t:file rw_file_perms; + ') + +@@ -3206,6 +3306,7 @@ + ') + + allow $1 filesystem_type:filesystem getattr; ++ files_getattr_all_file_type_fs($1) + ') + + ######################################## +@@ -3322,6 +3423,24 @@ ######################################## ## @@ -5331,7 +6173,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ## List all directories with a filesystem type. ## ## -@@ -3533,3 +3550,42 @@ +@@ -3533,3 +3652,62 @@ relabelfrom_blk_files_pattern($1,noxattrfs,noxattrfs) relabelfrom_chr_files_pattern($1,noxattrfs,noxattrfs) ') @@ -5374,9 +6216,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy + rw_files_pattern($1,anon_inodefs_t,anon_inodefs_t) +') + ++ ++######################################## ++## ++## Read and write files on hugetlbfs files ++## file systems. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`fs_rw_hugetlbfs_files',` ++ gen_require(` ++ type hugetlbfs_t; ++ ++ ') ++ ++ rw_files_pattern($1,hugetlbfs_t,hugetlbfs_t) ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.8/policy/modules/kernel/filesystem.te --- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.te 2008-04-04 16:11:03.000000000 -0400 @@ -21,6 +21,7 @@ # Use xattrs for the following filesystem types. @@ -5393,15 +6255,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy fs_use_xattr xfs gen_context(system_u:object_r:fs_t,s0); # Use the allocating task SID to label inodes in the following filesystem -@@ -80,6 +82,7 @@ +@@ -80,8 +82,10 @@ type fusefs_t; fs_noxattr_type(fusefs_t) allow fusefs_t self:filesystem associate; +allow fusefs_t fs_t:filesystem associate; genfscon fuse / gen_context(system_u:object_r:fusefs_t,s0) genfscon fuseblk / gen_context(system_u:object_r:fusefs_t,s0) ++genfscon fusectl / gen_context(system_u:object_r:fusefs_t,s0) -@@ -116,6 +119,7 @@ + type futexfs_t; + fs_type(futexfs_t) +@@ -116,6 +120,7 @@ type ramfs_t; fs_type(ramfs_t) @@ -5409,7 +6274,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy genfscon ramfs / gen_context(system_u:object_r:ramfs_t,s0) type romfs_t; -@@ -133,6 +137,16 @@ +@@ -133,6 +138,16 @@ genfscon spufs / gen_context(system_u:object_r:spufs_t,s0) files_mountpoint(spufs_t) @@ -5426,9 +6291,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy type vxfs_t; fs_noxattr_type(vxfs_t) files_mountpoint(vxfs_t) +@@ -222,6 +237,8 @@ + genfscon hfs / gen_context(system_u:object_r:nfs_t,s0) + genfscon hfsplus / gen_context(system_u:object_r:nfs_t,s0) + genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0) ++genfscon lustre / gen_context(system_u:object_r:nfs_t,s0) ++genfscon panfs / gen_context(system_u:object_r:nfs_t,s0) + + ######################################## + # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.8/policy/modules/kernel/kernel.if --- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/kernel.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/kernel.if 2008-04-04 16:11:03.000000000 -0400 @@ -352,6 +352,24 @@ ######################################## @@ -5534,8 +6408,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.0.8/policy/modules/kernel/kernel.te --- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/kernel.te 2008-01-11 15:14:27.000000000 -0500 -@@ -359,7 +359,7 @@ ++++ serefpolicy-3.0.8/policy/modules/kernel/kernel.te 2008-04-04 16:11:03.000000000 -0400 +@@ -255,6 +255,8 @@ + fs_rw_tmpfs_chr_files(kernel_t) + ') + ++userdom_generic_user_home_dir_filetrans_generic_user_home_content(kernel_t, { file dir }) ++ + tunable_policy(`read_default_t',` + files_list_default(kernel_t) + files_read_default_files(kernel_t) +@@ -359,7 +361,7 @@ allow kern_unconfined proc_type:{ dir file lnk_file } *; @@ -5546,7 +6429,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.0.8/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/selinux.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/selinux.if 2008-04-15 13:51:50.000000000 -0400 @@ -138,6 +138,7 @@ type security_t; ') @@ -5613,7 +6496,36 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu if(!secure_mode_policyload) { allow $1 security_t:security setbool; -@@ -463,3 +495,23 @@ +@@ -336,6 +368,28 @@ + + ######################################## + ## ++## dontaudit caller to validate security contexts. ++## ++## ++## ++## The process type permitted to validate contexts. ++## ++## ++## ++# ++interface(`selinux_dontaudit_validate_context',` ++ gen_require(` ++ type security_t; ++ ') ++ ++ dontaudit $1 security_t:dir list_dir_perms; ++ dontaudit $1 security_t:file { getattr read write }; ++ dontaudit $1 security_t:security check_context; ++') ++ ++ ++######################################## ++## + ## Allows caller to compute an access vector. + ## + ## +@@ -463,3 +517,23 @@ typeattribute $1 selinux_unconfined_type; ') @@ -5639,7 +6551,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.te serefpolicy-3.0.8/policy/modules/kernel/selinux.te --- nsaserefpolicy/policy/modules/kernel/selinux.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/selinux.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/selinux.te 2008-04-04 16:11:03.000000000 -0400 @@ -10,6 +10,7 @@ attribute can_setenforce; attribute can_setsecparam; @@ -5662,7 +6574,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.0.8/policy/modules/kernel/storage.fc --- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/storage.fc 2007-12-21 10:02:37.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/storage.fc 2008-04-04 16:11:03.000000000 -0400 @@ -6,18 +6,22 @@ /dev/n?pt[0-9]+ -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?tpqic[12].* -c gen_context(system_u:object_r:tape_device_t,s0) @@ -5713,7 +6625,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag /dev/i2o/hd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.0.8/policy/modules/kernel/storage.if --- nsaserefpolicy/policy/modules/kernel/storage.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/storage.if 2008-01-08 06:26:29.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/storage.if 2008-04-04 16:11:03.000000000 -0400 @@ -106,6 +106,26 @@ ######################################## @@ -5805,7 +6717,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.te serefpolicy-3.0.8/policy/modules/kernel/storage.te --- nsaserefpolicy/policy/modules/kernel/storage.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/storage.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/storage.te 2008-04-04 16:11:03.000000000 -0400 @@ -23,6 +23,12 @@ neverallow ~{ fixed_disk_raw_write storage_unconfined_type } fixed_disk_device_t:{ chr_file blk_file } { append write }; @@ -5821,7 +6733,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.0.8/policy/modules/kernel/terminal.fc --- nsaserefpolicy/policy/modules/kernel/terminal.fc 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/terminal.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/terminal.fc 2008-04-04 16:11:03.000000000 -0400 @@ -2,18 +2,27 @@ /dev/.*tty[^/]* -c gen_context(system_u:object_r:tty_device_t,s0) /dev/[pt]ty[a-ep-z][0-9a-f] -c gen_context(system_u:object_r:bsdpty_device_t,s0) @@ -5853,7 +6765,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.0.8/policy/modules/kernel/terminal.if --- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/terminal.if 2007-12-10 09:32:14.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/terminal.if 2008-04-04 16:11:03.000000000 -0400 @@ -525,11 +525,13 @@ interface(`term_use_generic_ptys',` gen_require(` @@ -5882,7 +6794,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.0.8/policy/modules/kernel/terminal.te --- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/terminal.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/kernel/terminal.te 2008-04-04 16:11:03.000000000 -0400 @@ -28,6 +28,7 @@ type devpts_t; files_mountpoint(devpts_t) @@ -5893,7 +6805,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.0.8/policy/modules/services/amavis.te --- nsaserefpolicy/policy/modules/services/amavis.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/amavis.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/amavis.te 2008-04-04 16:11:03.000000000 -0400 @@ -65,6 +65,7 @@ # Spool Files manage_dirs_pattern(amavis_t,amavis_spool_t,amavis_spool_t) @@ -5912,8 +6824,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav dev_read_rand(amavis_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.8/policy/modules/services/apache.fc --- nsaserefpolicy/policy/modules/services/apache.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/apache.fc 2007-12-02 21:15:34.000000000 -0500 -@@ -16,7 +16,6 @@ ++++ serefpolicy-3.0.8/policy/modules/services/apache.fc 2008-04-14 16:03:57.000000000 -0400 +@@ -6,6 +6,7 @@ + /etc/httpd -d gen_context(system_u:object_r:httpd_config_t,s0) + /etc/httpd/conf.* gen_context(system_u:object_r:httpd_config_t,s0) + /etc/httpd/logs gen_context(system_u:object_r:httpd_log_t,s0) ++/var/www(/.*)?/logs(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) + /etc/httpd/modules gen_context(system_u:object_r:httpd_modules_t,s0) + /etc/vhosts -- gen_context(system_u:object_r:httpd_config_t,s0) + +@@ -16,7 +17,6 @@ /usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0) /usr/lib/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) @@ -5921,7 +6841,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac /usr/lib(64)?/apache(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) /usr/lib(64)?/apache2/modules(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) /usr/lib(64)?/apache(2)?/suexec(2)? -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0) -@@ -71,5 +70,16 @@ +@@ -33,6 +33,7 @@ + /usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0) + ') + ++/usr/share/drupal(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) + /usr/share/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) + /usr/share/openca/htdocs(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) + /usr/share/selinux-policy[^/]*/html(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) +@@ -48,6 +49,7 @@ + + /var/lib/cacti/rra(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) + /var/lib/dav(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) ++/var/lib/drupal(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t,s0) + /var/lib/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) + /var/lib/httpd(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) + /var/lib/php/session(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0) +@@ -71,5 +73,16 @@ /var/www(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /var/www/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) @@ -5940,7 +6876,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +/etc/rc\.d/init\.d/httpd -- gen_context(system_u:object_r:httpd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.0.8/policy/modules/services/apache.if --- nsaserefpolicy/policy/modules/services/apache.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/apache.if 2007-12-31 07:17:25.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/apache.if 2008-04-10 13:08:35.000000000 -0400 @@ -18,10 +18,6 @@ attribute httpd_script_exec_type; type httpd_t, httpd_suexec_t, httpd_log_t; @@ -5988,7 +6924,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac # Allow the web server to run scripts and serve pages tunable_policy(`httpd_builtin_scripting',` manage_dirs_pattern(httpd_t,httpd_$1_script_rw_t,httpd_$1_script_rw_t) -@@ -177,48 +169,6 @@ +@@ -150,9 +142,11 @@ + + # privileged users run the script: + domtrans_pattern(httpd_exec_scripts, httpd_$1_script_exec_t, httpd_$1_script_t) ++ allow httpd_exec_scripts httpd_$1_script_exec_t:file read_file_perms; + + # apache runs the script: + domtrans_pattern(httpd_t, httpd_$1_script_exec_t, httpd_$1_script_t) ++ allow httpd_t httpd_$1_script_exec_t:file read_file_perms; + + allow httpd_t httpd_$1_script_t:process { signal sigkill sigstop }; + allow httpd_t httpd_$1_script_exec_t:dir list_dir_perms; +@@ -177,48 +171,6 @@ miscfiles_read_localization(httpd_$1_script_t) ') @@ -6037,7 +6985,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac optional_policy(` tunable_policy(`httpd_enable_cgi && allow_ypbind',` nis_use_ypbind_uncond(httpd_$1_script_t) -@@ -265,12 +215,19 @@ +@@ -265,12 +217,19 @@ template(`apache_per_role_template', ` gen_require(` attribute httpdcontent, httpd_script_domains; @@ -6059,7 +7007,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac typeattribute httpd_$1_script_t httpd_script_domains; userdom_user_home_content($1,httpd_$1_content_t) -@@ -324,6 +281,7 @@ +@@ -324,6 +283,7 @@ userdom_search_user_home_dirs($1,httpd_t) userdom_search_user_home_dirs($1,httpd_suexec_t) userdom_search_user_home_dirs($1,httpd_$1_script_t) @@ -6067,7 +7015,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ') -@@ -345,12 +303,11 @@ +@@ -345,12 +305,11 @@ # template(`apache_read_user_scripts',` gen_require(` @@ -6084,7 +7032,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -371,12 +328,12 @@ +@@ -371,12 +330,12 @@ # template(`apache_read_user_content',` gen_require(` @@ -6101,7 +7049,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -754,6 +711,7 @@ +@@ -754,6 +713,7 @@ ') allow $1 httpd_modules_t:dir list_dir_perms; @@ -6109,7 +7057,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -838,6 +796,10 @@ +@@ -838,6 +798,10 @@ type httpd_sys_script_t; ') @@ -6120,7 +7068,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_cgi && httpd_unified',` domtrans_pattern($1, httpdcontent, httpd_sys_script_t) ') -@@ -925,7 +887,7 @@ +@@ -925,7 +889,7 @@ type httpd_squirrelmail_t; ') @@ -6129,7 +7077,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -1005,6 +967,31 @@ +@@ -1005,6 +969,31 @@ ######################################## ## @@ -6161,7 +7109,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ## Search system script state directory. ## ## -@@ -1056,3 +1043,138 @@ +@@ -1056,3 +1045,138 @@ allow httpd_t $1:process signal; ') @@ -6302,7 +7250,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.8/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/apache.te 2008-05-07 14:23:12.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/apache.te 2008-04-04 16:12:24.000000000 -0400 @@ -1,5 +1,5 @@ -policy_module(apache,1.7.1) @@ -6475,7 +7423,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac libs_use_ld_so(httpd_t) libs_use_shared_libs(httpd_t) -@@ -344,12 +383,8 @@ +@@ -344,29 +383,52 @@ seutil_dontaudit_search_config(httpd_t) @@ -6488,7 +7436,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`allow_httpd_anon_write',` miscfiles_manage_public_files(httpd_t) ') -@@ -358,8 +393,16 @@ + +-ifdef(`TODO', ` # # We need optionals to be able to be within booleans to make this work # @@ -6500,12 +7449,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +gen_tunable(allow_httpd_mod_auth_pam,false) + tunable_policy(`allow_httpd_mod_auth_pam',` - auth_domtrans_chk_passwd(httpd_t) -+ auth_domtrans_upd_passwd(httpd_t) +- auth_domtrans_chk_passwd(httpd_t) ++ auth_domtrans_chkpwd(httpd_t) ') ++ ++## ++##

++## Allow Apache to use mod_auth_pam ++##

++## ++gen_tunable(allow_httpd_mod_auth_ntlm_winbind,false) ++optional_policy(` ++ tunable_policy(`allow_httpd_mod_auth_pam',` ++ samba_domtrans_winbind_helper(httpd_t) ++ ') ') -@@ -367,6 +410,16 @@ + tunable_policy(`httpd_can_network_connect',` corenet_tcp_connect_all_ports(httpd_t) ') @@ -6522,7 +7482,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_can_network_connect_db',` # allow httpd to connect to mysql/posgresql corenet_tcp_connect_postgresql_port(httpd_t) -@@ -387,6 +440,10 @@ +@@ -387,6 +449,10 @@ corenet_sendrecv_http_cache_client_packets(httpd_t) ') @@ -6533,7 +7493,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',` domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t) -@@ -404,11 +461,21 @@ +@@ -404,11 +470,21 @@ fs_read_nfs_symlinks(httpd_t) ') @@ -6555,7 +7515,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_ssi_exec',` corecmd_shell_domtrans(httpd_t,httpd_sys_script_t) allow httpd_sys_script_t httpd_t:fd use; -@@ -430,6 +497,12 @@ +@@ -430,6 +506,12 @@ ') optional_policy(` @@ -6568,7 +7528,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac calamaris_read_www_files(httpd_t) ') -@@ -442,8 +515,14 @@ +@@ -442,8 +524,14 @@ ') optional_policy(` @@ -6584,7 +7544,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') optional_policy(` -@@ -457,11 +536,11 @@ +@@ -457,11 +545,11 @@ optional_policy(` mysql_stream_connect(httpd_t) mysql_rw_db_sockets(httpd_t) @@ -6597,7 +7557,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') optional_policy(` -@@ -481,6 +560,7 @@ +@@ -481,6 +569,7 @@ ') optional_policy(` @@ -6605,7 +7565,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac snmp_dontaudit_read_snmp_var_lib_files(httpd_t) snmp_dontaudit_write_snmp_var_lib_files(httpd_t) ') -@@ -516,6 +596,13 @@ +@@ -516,6 +605,13 @@ userdom_use_sysadm_terms(httpd_helper_t) ') @@ -6619,7 +7579,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ######################################## # # Apache PHP script local policy -@@ -553,6 +640,7 @@ +@@ -553,6 +649,7 @@ optional_policy(` mysql_stream_connect(httpd_php_t) @@ -6627,7 +7587,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') optional_policy(` -@@ -567,7 +655,6 @@ +@@ -567,7 +664,6 @@ allow httpd_suexec_t self:capability { setuid setgid }; allow httpd_suexec_t self:process signal_perms; allow httpd_suexec_t self:unix_stream_socket create_stream_socket_perms; @@ -6635,7 +7595,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac domtrans_pattern(httpd_t, httpd_suexec_exec_t, httpd_suexec_t) -@@ -581,6 +668,10 @@ +@@ -581,6 +677,10 @@ manage_files_pattern(httpd_suexec_t,httpd_suexec_tmp_t,httpd_suexec_tmp_t) files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir }) @@ -6646,7 +7606,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac kernel_read_kernel_sysctls(httpd_suexec_t) kernel_list_proc(httpd_suexec_t) kernel_read_proc_symlinks(httpd_suexec_t) -@@ -590,8 +681,7 @@ +@@ -590,8 +690,7 @@ fs_search_auto_mountpoints(httpd_suexec_t) # for shell scripts @@ -6656,7 +7616,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac files_read_etc_files(httpd_suexec_t) files_read_usr_files(httpd_suexec_t) -@@ -620,8 +710,6 @@ +@@ -620,8 +719,6 @@ corenet_udp_sendrecv_all_ports(httpd_suexec_t) corenet_tcp_connect_all_ports(httpd_suexec_t) corenet_sendrecv_all_client_packets(httpd_suexec_t) @@ -6665,7 +7625,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') tunable_policy(`httpd_enable_cgi && httpd_unified',` -@@ -634,6 +722,12 @@ +@@ -634,6 +731,12 @@ fs_exec_nfs_files(httpd_suexec_t) ') @@ -6678,7 +7638,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_suexec_t) fs_read_cifs_symlinks(httpd_suexec_t) -@@ -651,18 +745,6 @@ +@@ -651,18 +754,6 @@ dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write }; ') @@ -6697,7 +7657,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ######################################## # # Apache system script local policy -@@ -672,7 +754,8 @@ +@@ -672,7 +763,8 @@ dontaudit httpd_sys_script_t httpd_config_t:dir search; @@ -6707,11 +7667,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms; read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t) -@@ -686,15 +769,62 @@ +@@ -686,15 +778,63 @@ # Should we add a boolean? apache_domtrans_rotatelogs(httpd_sys_script_t) +sysnet_read_config(httpd_sys_script_t) ++sysnet_use_ldap(httpd_bugzilla_script_t) + ifdef(`distro_redhat',` allow httpd_sys_script_t httpd_log_t:file { getattr append }; @@ -6771,7 +7732,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_sys_script_t) fs_read_cifs_symlinks(httpd_sys_script_t) -@@ -707,6 +837,7 @@ +@@ -707,6 +847,7 @@ optional_policy(` mysql_stream_connect(httpd_sys_script_t) mysql_rw_db_sockets(httpd_sys_script_t) @@ -6779,7 +7740,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -728,3 +859,58 @@ +@@ -728,3 +869,46 @@ logging_search_logs(httpd_rotatelogs_t) miscfiles_read_localization(httpd_rotatelogs_t) @@ -6826,21 +7787,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +optional_policy(` + postgresql_stream_connect(httpd_bugzilla_script_t) +') -+ -+## -+##

-+## Allow Apache to use mod_auth_ntlm_winbind -+##

-+## -+gen_tunable(allow_httpd_mod_auth_ntlm_winbind,false) -+optional_policy(` -+ tunable_policy(`allow_httpd_mod_auth_pam',` -+ samba_domtrans_winbind_helper(httpd_t) -+ ') -+') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.0.8/policy/modules/services/apcupsd.if --- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/apcupsd.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/apcupsd.if 2008-04-04 16:11:03.000000000 -0400 @@ -90,10 +90,29 @@ ## ## @@ -6874,7 +7823,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.8/policy/modules/services/apcupsd.te --- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/apcupsd.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/apcupsd.te 2008-04-04 16:11:03.000000000 -0400 @@ -86,6 +86,11 @@ miscfiles_read_localization(apcupsd_t) @@ -6887,9 +7836,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu optional_policy(` hostname_exec(apcupsd_t) ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apm.te serefpolicy-3.0.8/policy/modules/services/apm.te +--- nsaserefpolicy/policy/modules/services/apm.te 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/apm.te 2008-04-04 16:11:03.000000000 -0400 +@@ -190,6 +190,10 @@ + dbus_stub(apmd_t) + + optional_policy(` ++ consolekit_dbus_chat(apmd_t) ++ ') ++ ++ optional_policy(` + networkmanager_dbus_chat(apmd_t) + ') + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.te serefpolicy-3.0.8/policy/modules/services/asterisk.te --- nsaserefpolicy/policy/modules/services/asterisk.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/asterisk.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/asterisk.te 2008-04-04 16:11:03.000000000 -0400 @@ -98,6 +98,7 @@ # for VOIP voice channels. corenet_tcp_bind_generic_port(asterisk_t) @@ -6900,7 +7863,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aste dev_read_sysfs(asterisk_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.8/policy/modules/services/audioentropy.te --- nsaserefpolicy/policy/modules/services/audioentropy.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/audioentropy.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/audioentropy.te 2008-04-04 16:11:03.000000000 -0400 @@ -18,7 +18,7 @@ # Local policy # @@ -6921,7 +7884,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audi fs_getattr_all_fs(entropyd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.fc serefpolicy-3.0.8/policy/modules/services/automount.fc --- nsaserefpolicy/policy/modules/services/automount.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/automount.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/automount.fc 2008-04-04 16:11:03.000000000 -0400 @@ -12,4 +12,6 @@ # /var # @@ -6932,8 +7895,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.if serefpolicy-3.0.8/policy/modules/services/automount.if --- nsaserefpolicy/policy/modules/services/automount.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/automount.if 2007-12-02 21:15:34.000000000 -0500 -@@ -74,3 +74,21 @@ ++++ serefpolicy-3.0.8/policy/modules/services/automount.if 2008-04-04 16:11:03.000000000 -0400 +@@ -74,3 +74,39 @@ dontaudit $1 automount_tmp_t:dir getattr; ') @@ -6955,9 +7918,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto + + dontaudit $1 automount_t:fd use; +') ++######################################## ++## ++## Do not audit attempts to write automount daemon unnamed pipes. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`automount_dontaudit_write_pipes',` ++ gen_require(` ++ type automount_t; ++ ') ++ ++ dontaudit $1 automount_t:fifo_file write; ++') ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.8/policy/modules/services/automount.te --- nsaserefpolicy/policy/modules/services/automount.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/automount.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/automount.te 2008-04-04 16:11:03.000000000 -0400 @@ -52,7 +52,8 @@ files_root_filetrans(automount_t,automount_tmp_t,dir) @@ -6976,15 +7957,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto fs_mount_all_fs(automount_t) fs_unmount_all_fs(automount_t) -@@ -99,6 +101,7 @@ +@@ -99,7 +101,9 @@ dev_read_sysfs(automount_t) # for SSP +dev_read_rand(automount_t) dev_read_urand(automount_t) ++dev_rw_autofs(automount_t) domain_use_interactive_fds(automount_t) -@@ -125,6 +128,8 @@ + domain_dontaudit_read_all_domains_state(automount_t) +@@ -125,8 +129,12 @@ fs_mount_autofs(automount_t) fs_manage_autofs_symlinks(automount_t) @@ -6992,8 +7975,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto + term_dontaudit_getattr_pty_dirs(automount_t) ++auth_use_nsswitch(automount_t) ++ libs_use_ld_so(automount_t) -@@ -147,10 +152,6 @@ + libs_use_shared_libs(automount_t) + +@@ -147,10 +155,6 @@ userdom_dontaudit_search_sysadm_home_dirs(automount_t) optional_policy(` @@ -7004,12 +7991,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto bind_search_cache(automount_t) ') -@@ -173,6 +174,11 @@ +@@ -173,6 +177,11 @@ ') optional_policy(` + samba_read_config(automount_t) -+ samba_read_var_files(automount_t) ++ samba_manage_var_files(automount_t) +') + +optional_policy(` @@ -7018,7 +8005,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.0.8/policy/modules/services/avahi.te --- nsaserefpolicy/policy/modules/services/avahi.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/avahi.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/avahi.te 2008-04-04 16:11:03.000000000 -0400 @@ -85,6 +85,7 @@ dbus_connect_system_bus(avahi_t) dbus_send_system_bus(avahi_t) @@ -7029,7 +8016,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.8/policy/modules/services/bind.fc --- nsaserefpolicy/policy/modules/services/bind.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/bind.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/bind.fc 2008-04-04 16:11:03.000000000 -0400 @@ -45,4 +45,7 @@ /var/named/chroot/var/named/slaves(/.*)? gen_context(system_u:object_r:named_cache_t,s0) /var/named/chroot/var/named/data(/.*)? gen_context(system_u:object_r:named_cache_t,s0) @@ -7040,7 +8027,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind +/var/named/chroot/var/log/named.* -- gen_context(system_u:object_r:named_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.8/policy/modules/services/bind.te --- nsaserefpolicy/policy/modules/services/bind.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/bind.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/bind.te 2008-04-04 16:11:03.000000000 -0400 @@ -66,7 +66,6 @@ allow named_t self:unix_dgram_socket create_socket_perms; allow named_t self:tcp_socket create_stream_socket_perms; @@ -7049,16 +8036,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind allow named_t dnssec_t:file { getattr read }; -@@ -92,6 +91,8 @@ - manage_sock_files_pattern(named_t,named_var_run_t,named_var_run_t) - files_pid_filetrans(named_t,named_var_run_t,{ file sock_file }) +@@ -101,6 +100,8 @@ + kernel_read_system_state(named_t) + kernel_read_network_state(named_t) -+auth_use_nsswitch(named_t) ++corecmd_search_bin(named_t) + - # read zone files - allow named_t named_zone_t:dir list_dir_perms; - read_files_pattern(named_t,named_zone_t,named_zone_t) -@@ -119,6 +120,7 @@ + corenet_all_recvfrom_unlabeled(named_t) + corenet_all_recvfrom_netlabel(named_t) + corenet_tcp_sendrecv_all_if(named_t) +@@ -119,15 +120,11 @@ corenet_sendrecv_dns_client_packets(named_t) corenet_sendrecv_rndc_server_packets(named_t) corenet_sendrecv_rndc_client_packets(named_t) @@ -7066,7 +8053,48 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind dev_read_sysfs(named_t) dev_read_rand(named_t) -@@ -175,6 +177,10 @@ + +-fs_getattr_all_fs(named_t) +-fs_search_auto_mountpoints(named_t) +- +-corecmd_search_bin(named_t) +- + dev_read_urand(named_t) + + domain_use_interactive_fds(named_t) +@@ -135,6 +132,11 @@ + files_read_etc_files(named_t) + files_read_etc_runtime_files(named_t) + ++fs_getattr_all_fs(named_t) ++fs_search_auto_mountpoints(named_t) ++ ++auth_use_nsswitch(named_t) ++ + libs_use_ld_so(named_t) + libs_use_shared_libs(named_t) + +@@ -155,19 +157,12 @@ + ') + + optional_policy(` +- gen_require(` +- class dbus send_msg; +- ') +- +- allow named_t self:dbus send_msg; +- + init_dbus_chat_script(named_t) + + sysnet_dbus_chat_dhcpc(named_t) + + dbus_system_bus_client_template(named,named_t) + dbus_connect_system_bus(named_t) +- dbus_send_system_bus(named_t) + + optional_policy(` + networkmanager_dbus_chat(named_t) +@@ -175,6 +170,10 @@ ') optional_policy(` @@ -7077,7 +8105,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind # this seems like fds that arent being # closed. these should probably be # dontaudits instead. -@@ -184,14 +190,6 @@ +@@ -184,14 +183,6 @@ ') optional_policy(` @@ -7092,24 +8120,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind seutil_sigchld_newrole(named_t) ') -@@ -232,6 +230,7 @@ +@@ -232,15 +223,16 @@ corenet_tcp_sendrecv_all_nodes(ndc_t) corenet_tcp_sendrecv_all_ports(ndc_t) corenet_tcp_connect_rndc_port(ndc_t) +corenet_tcp_bind_all_nodes(ndc_t) corenet_sendrecv_rndc_client_packets(ndc_t) - fs_getattr_xattr_fs(ndc_t) +-fs_getattr_xattr_fs(ndc_t) +- + domain_use_interactive_fds(ndc_t) + + files_read_etc_files(ndc_t) + files_search_pids(ndc_t) + ++fs_getattr_xattr_fs(ndc_t) ++ + init_use_fds(ndc_t) + init_use_script_ptys(ndc_t) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.fc serefpolicy-3.0.8/policy/modules/services/bitlbee.fc --- nsaserefpolicy/policy/modules/services/bitlbee.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/bitlbee.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/bitlbee.fc 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,3 @@ +/usr/sbin/bitlbee -- gen_context(system_u:object_r:bitlbee_exec_t,s0) +/etc/bitlbee(/.*)? gen_context(system_u:object_r:bitlbee_conf_t,s0) +/var/lib/bitlbee(/.*)? gen_context(system_u:object_r:bitlbee_var_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.if serefpolicy-3.0.8/policy/modules/services/bitlbee.if --- nsaserefpolicy/policy/modules/services/bitlbee.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/bitlbee.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/bitlbee.if 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,22 @@ +## Bitlbee service + @@ -7135,8 +8174,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitl + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.te serefpolicy-3.0.8/policy/modules/services/bitlbee.te --- nsaserefpolicy/policy/modules/services/bitlbee.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/bitlbee.te 2007-12-18 09:56:09.000000000 -0500 -@@ -0,0 +1,73 @@ ++++ serefpolicy-3.0.8/policy/modules/services/bitlbee.te 2008-04-04 16:11:03.000000000 -0400 +@@ -0,0 +1,77 @@ + +policy_module(bitlbee, 1.0.0) + @@ -7192,6 +8231,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitl +# and to MSNP (MSN Messenger) servers: +corenet_tcp_connect_msnp_port(bitlbee_t) +corenet_tcp_sendrecv_msnp_port(bitlbee_t) ++corenet_tcp_connect_http_port(bitlbee_t) ++corenet_tcp_sendrecv_http_port(bitlbee_t) + +dev_read_rand(bitlbee_t) +dev_read_urand(bitlbee_t) @@ -7204,6 +8245,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitl +libs_legacy_use_shared_libs(bitlbee_t) +libs_use_ld_so(bitlbee_t) + ++miscfiles_read_localization(bitlbee_t) ++ +sysnet_dns_name_resolve(bitlbee_t) + +optional_policy(` @@ -7212,7 +8255,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitl +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.fc serefpolicy-3.0.8/policy/modules/services/bluetooth.fc --- nsaserefpolicy/policy/modules/services/bluetooth.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/bluetooth.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/bluetooth.fc 2008-04-04 16:11:03.000000000 -0400 @@ -22,3 +22,4 @@ # /var/lib/bluetooth(/.*)? gen_context(system_u:object_r:bluetooth_var_lib_t,s0) @@ -7220,8 +8263,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue +/var/run/bluetoothd_address gen_context(system_u:object_r:bluetooth_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.0.8/policy/modules/services/bluetooth.te --- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/bluetooth.te 2007-12-02 21:15:34.000000000 -0500 -@@ -44,7 +44,7 @@ ++++ serefpolicy-3.0.8/policy/modules/services/bluetooth.te 2008-04-04 16:11:03.000000000 -0400 +@@ -37,14 +37,14 @@ + # Bluetooth services local policy + # + +-allow bluetooth_t self:capability { net_bind_service net_admin net_raw sys_tty_config ipc_lock }; ++allow bluetooth_t self:capability { dac_override net_bind_service net_admin net_raw sys_tty_config ipc_lock }; + dontaudit bluetooth_t self:capability sys_tty_config; + allow bluetooth_t self:process { getsched signal_perms }; + allow bluetooth_t self:fifo_file rw_fifo_file_perms; allow bluetooth_t self:shm create_shm_perms; allow bluetooth_t self:socket create_stream_socket_perms; allow bluetooth_t self:unix_dgram_socket create_socket_perms; @@ -7230,10 +8281,37 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue allow bluetooth_t self:tcp_socket create_stream_socket_perms; allow bluetooth_t self:udp_socket create_socket_perms; -@@ -128,6 +128,8 @@ - dbus_system_bus_client_template(bluetooth,bluetooth_t) - dbus_connect_system_bus(bluetooth_t) - dbus_send_system_bus(bluetooth_t) +@@ -110,6 +110,8 @@ + files_read_etc_runtime_files(bluetooth_t) + files_read_usr_files(bluetooth_t) + ++auth_use_nsswitch(bluetooth_t) ++ + libs_use_ld_so(bluetooth_t) + libs_use_shared_libs(bluetooth_t) + +@@ -118,20 +120,20 @@ + miscfiles_read_localization(bluetooth_t) + miscfiles_read_fonts(bluetooth_t) + +-sysnet_read_config(bluetooth_t) +- + userdom_dontaudit_use_unpriv_user_fds(bluetooth_t) + userdom_dontaudit_use_sysadm_ptys(bluetooth_t) + userdom_dontaudit_search_sysadm_home_dirs(bluetooth_t) + + optional_policy(` +- dbus_system_bus_client_template(bluetooth,bluetooth_t) +- dbus_connect_system_bus(bluetooth_t) +- dbus_send_system_bus(bluetooth_t) ++ cups_dbus_chat(bluetooth_t) + ') + + optional_policy(` +- nis_use_ypbind(bluetooth_t) ++ dbus_system_bus_client_template(bluetooth,bluetooth_t) ++ dbus_connect_system_bus(bluetooth_t) ++ dbus_send_system_bus(bluetooth_t) + allow bluetooth_t self:dbus send_msg; + dbus_system_domain(bluetooth_t,bluetooth_exec_t) ') @@ -7241,7 +8319,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.fc serefpolicy-3.0.8/policy/modules/services/clamav.fc --- nsaserefpolicy/policy/modules/services/clamav.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/clamav.fc 2007-12-31 09:05:48.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/clamav.fc 2008-04-04 16:11:03.000000000 -0400 @@ -5,16 +5,18 @@ /usr/bin/freshclam -- gen_context(system_u:object_r:freshclam_exec_t,s0) @@ -7263,9 +8341,63 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam +/var/log/clamd.* gen_context(system_u:object_r:clamd_var_log_t,s0) /var/spool/amavisd/clamd\.sock -s gen_context(system_u:object_r:clamd_var_run_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.if serefpolicy-3.0.8/policy/modules/services/clamav.if +--- nsaserefpolicy/policy/modules/services/clamav.if 2007-10-22 13:21:36.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/clamav.if 2008-04-04 16:11:03.000000000 -0400 +@@ -38,6 +38,27 @@ + + ######################################## + ## ++## Allow the specified domain to append ++## to clamav log files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`clamav_append_log',` ++ gen_require(` ++ type clamav_log_t; ++ ') ++ ++ logging_search_logs($1) ++ allow $1 clamav_log_t:dir list_dir_perms; ++ append_files_pattern($1,clamav_log_t,clamav_log_t) ++') ++ ++######################################## ++## + ## Read clamav configuration files. + ## + ## +@@ -91,3 +112,22 @@ + + domtrans_pattern($1,clamscan_exec_t,clamscan_t) + ') ++ ++######################################## ++## ++## Execute clamscan without a transition. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`clamav_exec_clamscan',` ++ gen_require(` ++ type clamscan_exec_t; ++ ') ++ ++ can_exec($1,clamscan_exec_t) ++ ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.8/policy/modules/services/clamav.te --- nsaserefpolicy/policy/modules/services/clamav.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/clamav.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/clamav.te 2008-04-04 16:11:03.000000000 -0400 @@ -1,5 +1,5 @@ -policy_module(clamav,1.4.1) @@ -7273,24 +8405,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam ######################################## # -@@ -87,6 +87,7 @@ +@@ -87,6 +87,9 @@ kernel_dontaudit_list_proc(clamd_t) kernel_read_sysctl(clamd_t) kernel_read_kernel_sysctls(clamd_t) +kernel_read_system_state(clamd_t) ++ ++corecmd_exec_shell(clamd_t) corenet_all_recvfrom_unlabeled(clamd_t) corenet_all_recvfrom_netlabel(clamd_t) -@@ -120,6 +121,8 @@ +@@ -120,6 +123,9 @@ cron_use_system_job_fds(clamd_t) cron_rw_pipes(clamd_t) +mta_read_config(clamd_t) ++mta_send_mail(clamd_t) + optional_policy(` amavis_read_lib_files(clamd_t) amavis_read_spool_files(clamd_t) -@@ -127,6 +130,10 @@ +@@ -127,6 +133,10 @@ amavis_create_pid_files(clamd_t) ') @@ -7301,7 +8436,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam ######################################## # # Freshclam local policy -@@ -233,3 +240,7 @@ +@@ -233,3 +243,7 @@ optional_policy(` apache_read_sys_content(clamscan_t) ') @@ -7311,7 +8446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/comsat.te serefpolicy-3.0.8/policy/modules/services/comsat.te --- nsaserefpolicy/policy/modules/services/comsat.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/comsat.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/comsat.te 2008-04-04 16:11:03.000000000 -0400 @@ -60,6 +60,8 @@ init_read_utmp(comsat_t) init_dontaudit_write_utmp(comsat_t) @@ -7343,7 +8478,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/coms -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.if serefpolicy-3.0.8/policy/modules/services/consolekit.if --- nsaserefpolicy/policy/modules/services/consolekit.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/consolekit.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/consolekit.if 2008-04-04 16:11:03.000000000 -0400 @@ -38,3 +38,24 @@ allow $1 consolekit_t:dbus send_msg; allow consolekit_t $1:dbus send_msg; @@ -7371,7 +8506,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.8/policy/modules/services/consolekit.te --- nsaserefpolicy/policy/modules/services/consolekit.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/consolekit.te 2008-01-16 16:21:21.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/consolekit.te 2008-04-04 16:11:03.000000000 -0400 @@ -10,7 +10,6 @@ type consolekit_exec_t; init_daemon_domain(consolekit_t, consolekit_exec_t) @@ -7435,13 +8570,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons +') + +optional_policy(` -+ userdom_read_user_tmp_files(consolekit_t) ++ userdom_read_user_tmp_files(user,consolekit_t) ') + + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.8/policy/modules/services/courier.te --- nsaserefpolicy/policy/modules/services/courier.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/courier.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/courier.te 2008-04-04 16:11:03.000000000 -0400 @@ -58,6 +58,7 @@ files_getattr_tmp_dirs(courier_authdaemon_t) @@ -7452,7 +8587,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cour diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cpucontrol.te serefpolicy-3.0.8/policy/modules/services/cpucontrol.te --- nsaserefpolicy/policy/modules/services/cpucontrol.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cpucontrol.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/cpucontrol.te 2008-04-04 16:11:03.000000000 -0400 @@ -63,6 +63,10 @@ ') @@ -7466,7 +8601,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cpuc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.8/policy/modules/services/cron.fc --- nsaserefpolicy/policy/modules/services/cron.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cron.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/cron.fc 2008-04-04 16:11:03.000000000 -0400 @@ -17,6 +17,8 @@ /var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0) /var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) @@ -7483,7 +8618,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron +/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.8/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cron.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/cron.if 2008-04-04 16:11:03.000000000 -0400 @@ -35,6 +35,7 @@ # template(`cron_per_role_template',` @@ -7641,8 +8776,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.8/policy/modules/services/cron.te --- nsaserefpolicy/policy/modules/services/cron.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cron.te 2007-12-27 07:19:45.000000000 -0500 -@@ -50,6 +50,7 @@ ++++ serefpolicy-3.0.8/policy/modules/services/cron.te 2008-04-04 16:11:03.000000000 -0400 +@@ -12,14 +12,6 @@ + + ## + ##

+-## Allow system cron jobs to relabel filesystem +-## for restoring file contexts. +-##

+-## +-gen_tunable(cron_can_relabel,false) +- +-## +-##

+ ## Enable extra rules in the cron domain + ## to support fcron. + ##

+@@ -50,6 +42,7 @@ type crond_tmp_t; files_tmp_file(crond_tmp_t) @@ -7650,7 +8800,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron type crond_var_run_t; files_pid_file(crond_var_run_t) -@@ -71,6 +72,12 @@ +@@ -71,6 +64,12 @@ type system_crond_tmp_t; files_tmp_file(system_crond_tmp_t) @@ -7663,7 +8813,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ifdef(`enable_mcs',` init_ranged_daemon_domain(crond_t,crond_exec_t,s0 - mcs_systemhigh) ') -@@ -80,7 +87,7 @@ +@@ -80,7 +79,7 @@ # Cron Local policy # @@ -7672,7 +8822,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron dontaudit crond_t self:capability { sys_resource sys_tty_config }; allow crond_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow crond_t self:process { setexec setfscreate }; -@@ -99,18 +106,20 @@ +@@ -99,18 +98,20 @@ allow crond_t crond_var_run_t:file manage_file_perms; files_pid_filetrans(crond_t,crond_var_run_t,file) @@ -7697,7 +8847,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron dev_read_sysfs(crond_t) selinux_get_fs_mount(crond_t) -@@ -127,6 +136,8 @@ +@@ -127,6 +128,8 @@ # need auth_chkpwd to check for locked accounts. auth_domtrans_chk_passwd(crond_t) @@ -7706,7 +8856,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron corecmd_exec_shell(crond_t) corecmd_list_bin(crond_t) -@@ -142,11 +153,14 @@ +@@ -142,11 +145,14 @@ files_search_default(crond_t) init_rw_utmp(crond_t) @@ -7721,7 +8871,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron seutil_read_config(crond_t) seutil_read_default_contexts(crond_t) -@@ -160,6 +174,16 @@ +@@ -160,6 +166,16 @@ mta_send_mail(crond_t) @@ -7738,7 +8888,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ifdef(`distro_debian',` optional_policy(` # Debian logcheck has the home dir set to its cache -@@ -180,29 +204,34 @@ +@@ -180,29 +196,34 @@ locallogin_link_keys(crond_t) ') @@ -7781,7 +8931,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') optional_policy(` -@@ -239,7 +268,6 @@ +@@ -239,7 +260,6 @@ allow system_crond_t cron_var_lib_t:file manage_file_perms; files_var_lib_filetrans(system_crond_t,cron_var_lib_t,file) @@ -7789,7 +8939,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # The entrypoint interface is not used as this is not # a regular entrypoint. Since crontab files are # not directly executed, crond must ensure that -@@ -249,6 +277,8 @@ +@@ -249,6 +269,8 @@ # for this purpose. allow system_crond_t system_cron_spool_t:file entrypoint; @@ -7798,7 +8948,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # Permit a transition from the crond_t domain to this domain. # The transition is requested explicitly by the modified crond # via setexeccon. There is no way to set up an automatic -@@ -270,9 +300,16 @@ +@@ -270,9 +292,16 @@ filetrans_pattern(system_crond_t,crond_tmp_t,system_crond_tmp_t,{ file lnk_file }) files_tmp_filetrans(system_crond_t,system_crond_tmp_t,file) @@ -7816,7 +8966,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron kernel_read_kernel_sysctls(system_crond_t) kernel_read_system_state(system_crond_t) -@@ -326,7 +363,7 @@ +@@ -326,7 +355,7 @@ init_read_utmp(system_crond_t) init_dontaudit_rw_utmp(system_crond_t) # prelink tells init to restart it self, we either need to allow or dontaudit @@ -7825,7 +8975,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron libs_use_ld_so(system_crond_t) libs_use_shared_libs(system_crond_t) -@@ -334,6 +371,7 @@ +@@ -334,6 +363,7 @@ libs_exec_ld_so(system_crond_t) logging_read_generic_logs(system_crond_t) @@ -7833,7 +8983,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron logging_send_syslog_msg(system_crond_t) miscfiles_read_localization(system_crond_t) -@@ -384,6 +422,14 @@ +@@ -349,18 +379,6 @@ + ') + ') + +-tunable_policy(`cron_can_relabel',` +- seutil_domtrans_setfiles(system_crond_t) +-',` +- selinux_get_fs_mount(system_crond_t) +- selinux_validate_context(system_crond_t) +- selinux_compute_access_vector(system_crond_t) +- selinux_compute_create_context(system_crond_t) +- selinux_compute_relabel_context(system_crond_t) +- selinux_compute_user_contexts(system_crond_t) +- seutil_read_file_contexts(system_crond_t) +-') +- + optional_policy(` + # Needed for certwatch + apache_exec_modules(system_crond_t) +@@ -384,6 +402,14 @@ ') optional_policy(` @@ -7848,7 +9017,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron mrtg_append_create_logs(system_crond_t) ') -@@ -424,8 +470,7 @@ +@@ -424,8 +450,7 @@ ') optional_policy(` @@ -7858,7 +9027,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') optional_policy(` -@@ -433,15 +478,12 @@ +@@ -433,15 +458,12 @@ ') optional_policy(` @@ -7882,8 +9051,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron -') dnl end TODO diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.8/policy/modules/services/cups.fc --- nsaserefpolicy/policy/modules/services/cups.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cups.fc 2007-12-02 21:15:34.000000000 -0500 -@@ -8,17 +8,15 @@ ++++ serefpolicy-3.0.8/policy/modules/services/cups.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -8,24 +8,28 @@ /etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/printers\.conf.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -7900,10 +9069,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups -/usr/lib(64)?/cups/backend/.* -- gen_context(system_u:object_r:cupsd_exec_t,s0) -/usr/lib(64)?/cups/daemon/.* -- gen_context(system_u:object_r:cupsd_exec_t,s0) - /usr/lib(64)?/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0) +-/usr/lib(64)?/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0) ++/usr/lib/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0) ++/usr/lib64/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0) /usr/libexec/hal_lpadmin -- gen_context(system_u:object_r:cupsd_config_exec_t,s0) -@@ -26,6 +24,11 @@ + /usr/sbin/cupsd -- gen_context(system_u:object_r:cupsd_exec_t,s0) /usr/sbin/hal_lpadmin -- gen_context(system_u:object_r:cupsd_config_exec_t,s0) /usr/sbin/hpiod -- gen_context(system_u:object_r:hplip_exec_t,s0) @@ -7915,7 +9086,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups /usr/sbin/printconf-backend -- gen_context(system_u:object_r:cupsd_config_exec_t,s0) /usr/sbin/ptal-printd -- gen_context(system_u:object_r:ptal_exec_t,s0) /usr/sbin/ptal-mlcd -- gen_context(system_u:object_r:ptal_exec_t,s0) -@@ -33,7 +36,7 @@ +@@ -33,7 +37,7 @@ /usr/share/cups(/.*)? gen_context(system_u:object_r:cupsd_etc_t,s0) /usr/share/foomatic/db/oldprinterids -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -7924,16 +9095,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups /var/cache/alchemist/printconf.* gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /var/cache/foomatic(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) -@@ -51,4 +54,5 @@ +@@ -51,4 +55,7 @@ /var/run/ptal-printd(/.*)? gen_context(system_u:object_r:ptal_var_run_t,s0) /var/run/ptal-mlcd(/.*)? gen_context(system_u:object_r:ptal_var_run_t,s0) -/var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) +/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) +/usr/local/Printer/[^/]*/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) ++ ++/usr/local/linuxprinter/ppd(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.if serefpolicy-3.0.8/policy/modules/services/cups.if --- nsaserefpolicy/policy/modules/services/cups.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cups.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/cups.if 2008-04-04 16:11:03.000000000 -0400 @@ -247,3 +247,4 @@ files_search_pids($1) stream_connect_pattern($1,ptal_var_run_t,ptal_var_run_t,ptal_t) @@ -7941,7 +9114,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.8/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cups.te 2008-01-10 16:16:09.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/cups.te 2008-04-04 16:11:03.000000000 -0400 @@ -48,9 +48,8 @@ type hplip_t; type hplip_exec_t; @@ -8128,7 +9301,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups fs_getattr_all_fs(cupsd_config_t) fs_search_auto_mountpoints(cupsd_config_t) -@@ -377,6 +404,14 @@ +@@ -356,6 +383,7 @@ + logging_send_syslog_msg(cupsd_config_t) + + miscfiles_read_localization(cupsd_config_t) ++miscfiles_read_hwdata(cupsd_config_t) + + seutil_dontaudit_search_config(cupsd_config_t) + +@@ -377,6 +405,14 @@ ') optional_policy(` @@ -8143,7 +9324,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups cron_system_entry(cupsd_config_t, cupsd_config_exec_t) ') -@@ -393,6 +428,7 @@ +@@ -393,6 +429,7 @@ optional_policy(` hal_domtrans(cupsd_config_t) hal_read_tmp_files(cupsd_config_t) @@ -8151,7 +9332,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups ') optional_policy(` -@@ -482,6 +518,8 @@ +@@ -482,6 +519,8 @@ files_read_etc_files(cupsd_lpd_t) @@ -8160,7 +9341,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups libs_use_ld_so(cupsd_lpd_t) libs_use_shared_libs(cupsd_lpd_t) -@@ -489,22 +527,12 @@ +@@ -489,22 +528,12 @@ miscfiles_read_localization(cupsd_lpd_t) @@ -8183,7 +9364,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups ######################################## # # HPLIP local policy -@@ -522,14 +550,12 @@ +@@ -522,14 +551,12 @@ allow hplip_t self:udp_socket create_socket_perms; allow hplip_t self:rawip_socket create_socket_perms; @@ -8202,7 +9383,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t) files_pid_filetrans(hplip_t,hplip_var_run_t,file) -@@ -560,7 +586,7 @@ +@@ -560,7 +587,7 @@ dev_read_urand(hplip_t) dev_read_rand(hplip_t) dev_rw_generic_usb_dev(hplip_t) @@ -8211,7 +9392,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups fs_getattr_all_fs(hplip_t) fs_search_auto_mountpoints(hplip_t) -@@ -587,7 +613,7 @@ +@@ -587,7 +614,7 @@ userdom_dontaudit_search_sysadm_home_dirs(hplip_t) userdom_dontaudit_search_all_users_home_content(hplip_t) @@ -8220,7 +9401,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups optional_policy(` seutil_sigchld_newrole(hplip_t) -@@ -668,3 +694,15 @@ +@@ -668,3 +695,15 @@ optional_policy(` udev_read_db(ptal_t) ') @@ -8238,7 +9419,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.8/policy/modules/services/cvs.te --- nsaserefpolicy/policy/modules/services/cvs.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cvs.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/cvs.te 2008-04-04 16:11:03.000000000 -0400 @@ -16,6 +16,7 @@ type cvs_t; type cvs_exec_t; @@ -8265,7 +9446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-3.0.8/policy/modules/services/cyrus.te --- nsaserefpolicy/policy/modules/services/cyrus.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cyrus.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/cyrus.te 2008-04-04 16:11:03.000000000 -0400 @@ -1,5 +1,5 @@ -policy_module(cyrus,1.4.0) @@ -8307,7 +9488,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbskk.te serefpolicy-3.0.8/policy/modules/services/dbskk.te --- nsaserefpolicy/policy/modules/services/dbskk.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dbskk.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/dbskk.te 2008-04-04 16:11:03.000000000 -0400 @@ -63,6 +63,8 @@ files_read_etc_files(dbskkd_t) @@ -8332,19 +9513,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbsk -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.0.8/policy/modules/services/dbus.fc --- nsaserefpolicy/policy/modules/services/dbus.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dbus.fc 2007-12-02 21:15:34.000000000 -0500 -@@ -5,6 +5,8 @@ ++++ serefpolicy-3.0.8/policy/modules/services/dbus.fc 2008-04-28 17:02:45.000000000 -0400 +@@ -3,6 +3,12 @@ + # Sorting does not work correctly if I combine these next two roles + /usr/bin/dbus-daemon(-1)? -- gen_context(system_u:object_r:system_dbusd_exec_t,s0) /bin/dbus-daemon -- gen_context(system_u:object_r:system_dbusd_exec_t,s0) ++ ++/lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:system_dbusd_exec_t,s0) ++/lib64/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:system_dbusd_exec_t,s0) ++ ++/var/lib/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_lib_t,s0) ++ /var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0) -+/var/lib/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_lib_t,s0) -+ ifdef(`distro_redhat',` - /var/named/chroot/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0) - ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.8/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dbus.if 2008-01-14 14:18:38.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/dbus.if 2008-04-04 16:11:03.000000000 -0400 @@ -50,6 +50,12 @@ ## # @@ -8397,7 +9582,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus libs_use_ld_so($1_dbusd_t) libs_use_shared_libs($1_dbusd_t) -@@ -193,6 +214,7 @@ +@@ -193,18 +214,24 @@ gen_require(` type system_dbusd_t, system_dbusd_t; type system_dbusd_var_run_t; @@ -8405,12 +9590,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus class dbus send_msg; ') -@@ -201,10 +223,19 @@ - - # SE-DBus specific permissions - allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg; +- type $1_dbusd_system_t; +- type_change $2 system_dbusd_t:dbus $1_dbusd_system_t; + allow $2 { system_dbusd_t $2 }:dbus send_msg; -+ ++ allow system_dbusd_t $2:dbus send_msg; + +- # SE-DBus specific permissions +- allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg; + read_files_pattern($2,system_dbusd_var_lib_t,system_dbusd_var_lib_t) + files_search_var_lib($2) @@ -8425,7 +9611,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ') ####################################### -@@ -236,14 +267,16 @@ +@@ -236,14 +263,16 @@ class dbus send_msg; ') @@ -8445,7 +9631,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ') ######################################## -@@ -271,6 +304,60 @@ +@@ -271,6 +300,60 @@ allow $2 $1_dbusd_t:dbus send_msg; ') @@ -8506,7 +9692,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ######################################## ## ## Read dbus configuration. -@@ -286,6 +373,7 @@ +@@ -286,6 +369,7 @@ type dbusd_etc_t; ') @@ -8514,7 +9700,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus allow $1 dbusd_etc_t:file read_file_perms; ') -@@ -346,3 +434,55 @@ +@@ -346,3 +430,57 @@ allow $1 system_dbusd_t:dbus *; ') @@ -8568,22 +9754,49 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus + + domtrans_pattern(system_dbusd_t,$2,$1) + ++ dbus_system_bus_client_template($1,$1) ++ dbus_connect_system_bus($1) +') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.0.8/policy/modules/services/dbus.te --- nsaserefpolicy/policy/modules/services/dbus.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dbus.te 2007-12-02 21:15:34.000000000 -0500 -@@ -23,6 +23,9 @@ ++++ serefpolicy-3.0.8/policy/modules/services/dbus.te 2008-04-28 17:17:54.000000000 -0400 +@@ -20,9 +20,25 @@ + type system_dbusd_tmp_t; + files_tmp_file(system_dbusd_tmp_t) + ++type system_dbusd_var_lib_t; ++files_type(system_dbusd_var_lib_t) ++ type system_dbusd_var_run_t; files_pid_file(system_dbusd_var_run_t) -+type system_dbusd_var_lib_t; -+files_pid_file(system_dbusd_var_lib_t) ++ifdef(`enable_mcs',` ++ init_ranged_daemon_domain(system_dbusd_t,system_dbusd_exec_t,s0 - mcs_systemhigh) ++') ++ ++ifdef(`enable_mls',` ++ init_ranged_daemon_domain(system_dbusd_t,system_dbusd_exec_t,s0 - mls_systemhigh) ++ mls_fd_use_all_levels(system_dbusd_t) ++ mls_rangetrans_target(system_dbusd_t) ++ mls_file_read_all_levels(system_dbusd_t) ++ mls_socket_write_all_levels(system_dbusd_t) ++') ++ + ############################## # # Local policy -@@ -48,6 +51,8 @@ +@@ -32,7 +48,7 @@ + # cjp: dac_override should probably go in a distro_debian + allow system_dbusd_t self:capability { dac_override setgid setpcap setuid }; + dontaudit system_dbusd_t self:capability sys_tty_config; +-allow system_dbusd_t self:process { getattr signal_perms setcap }; ++allow system_dbusd_t self:process { getattr signal_perms setpgid getcap setcap }; + allow system_dbusd_t self:fifo_file { read write }; + allow system_dbusd_t self:dbus { send_msg acquire_svc }; + allow system_dbusd_t self:unix_stream_socket { connectto create_stream_socket_perms connectto }; +@@ -48,6 +64,8 @@ manage_files_pattern(system_dbusd_t,system_dbusd_tmp_t,system_dbusd_tmp_t) files_tmp_filetrans(system_dbusd_t, system_dbusd_tmp_t, { file dir }) @@ -8592,7 +9805,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus manage_files_pattern(system_dbusd_t,system_dbusd_var_run_t,system_dbusd_var_run_t) manage_sock_files_pattern(system_dbusd_t,system_dbusd_var_run_t,system_dbusd_var_run_t) files_pid_filetrans(system_dbusd_t,system_dbusd_var_run_t,file) -@@ -116,9 +121,18 @@ +@@ -60,6 +78,8 @@ + + fs_getattr_all_fs(system_dbusd_t) + fs_search_auto_mountpoints(system_dbusd_t) ++fs_list_inotifyfs(system_dbusd_t) ++fs_dontaudit_list_nfs(system_dbusd_t) + + selinux_get_fs_mount(system_dbusd_t) + selinux_validate_context(system_dbusd_t) +@@ -86,6 +106,8 @@ + + init_use_fds(system_dbusd_t) + init_use_script_ptys(system_dbusd_t) ++init_dbus_chat_script(system_dbusd_t) ++init_bin_domtrans_spec(system_dbusd_t) + + libs_use_ld_so(system_dbusd_t) + libs_use_shared_libs(system_dbusd_t) +@@ -116,9 +138,18 @@ ') optional_policy(` @@ -8613,7 +9844,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.if serefpolicy-3.0.8/policy/modules/services/dcc.if --- nsaserefpolicy/policy/modules/services/dcc.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dcc.if 2007-12-13 15:57:40.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/dcc.if 2008-04-04 16:11:03.000000000 -0400 @@ -72,6 +72,24 @@ ######################################## @@ -8641,7 +9872,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.te serefpolicy-3.0.8/policy/modules/services/dcc.te --- nsaserefpolicy/policy/modules/services/dcc.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dcc.te 2008-01-04 09:46:21.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/dcc.te 2008-04-04 16:11:03.000000000 -0400 @@ -124,7 +124,7 @@ # dcc procmail interface local policy # @@ -8651,7 +9882,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc. allow dcc_client_t self:unix_dgram_socket create_socket_perms; allow dcc_client_t self:udp_socket create_socket_perms; -@@ -148,6 +148,10 @@ +@@ -141,6 +141,7 @@ + + corenet_all_recvfrom_unlabeled(dcc_client_t) + corenet_all_recvfrom_netlabel(dcc_client_t) ++corenet_udp_bind_all_nodes(dcc_client_t) + corenet_udp_sendrecv_generic_if(dcc_client_t) + corenet_udp_sendrecv_all_nodes(dcc_client_t) + corenet_udp_sendrecv_all_ports(dcc_client_t) +@@ -148,6 +149,10 @@ files_read_etc_files(dcc_client_t) files_read_etc_runtime_files(dcc_client_t) @@ -8662,9 +9901,51 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc. libs_use_ld_so(dcc_client_t) libs_use_shared_libs(dcc_client_t) +@@ -155,11 +160,8 @@ + + miscfiles_read_localization(dcc_client_t) + +-sysnet_read_config(dcc_client_t) +-sysnet_dns_name_resolve(dcc_client_t) +- + optional_policy(` +- nscd_socket_use(dcc_client_t) ++ spamassassin_read_spamd_tmp_files(dcc_client_t) + ') + + ######################################## +@@ -335,6 +337,8 @@ + fs_getattr_all_fs(dccifd_t) + fs_search_auto_mountpoints(dccifd_t) + ++auth_use_nsswitch(dcc_client_t) ++ + libs_use_ld_so(dccifd_t) + libs_use_shared_libs(dccifd_t) + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.0.8/policy/modules/services/dhcp.te +--- nsaserefpolicy/policy/modules/services/dhcp.te 2007-10-22 13:21:36.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dhcp.te 2008-04-10 11:28:45.000000000 -0400 +@@ -24,7 +24,7 @@ + # Local policy + # + +-allow dhcpd_t self:capability net_raw; ++allow dhcpd_t self:capability { sys_resource net_raw }; + dontaudit dhcpd_t self:capability { net_admin sys_tty_config }; + allow dhcpd_t self:process signal_perms; + allow dhcpd_t self:fifo_file { read write getattr }; +@@ -51,6 +51,7 @@ + + kernel_read_system_state(dhcpd_t) + kernel_read_kernel_sysctls(dhcpd_t) ++kernel_read_network_state(dhcpd_t) + + corenet_all_recvfrom_unlabeled(dhcpd_t) + corenet_all_recvfrom_netlabel(dhcpd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dictd.fc serefpolicy-3.0.8/policy/modules/services/dictd.fc --- nsaserefpolicy/policy/modules/services/dictd.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dictd.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/dictd.fc 2008-04-04 16:11:03.000000000 -0400 @@ -4,3 +4,4 @@ /usr/sbin/dictd -- gen_context(system_u:object_r:dictd_exec_t,s0) @@ -8672,7 +9953,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dict +/var/run/dictd\.pid -- gen_context(system_u:object_r:dictd_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dictd.te serefpolicy-3.0.8/policy/modules/services/dictd.te --- nsaserefpolicy/policy/modules/services/dictd.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dictd.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/dictd.te 2008-04-04 16:11:03.000000000 -0400 @@ -16,6 +16,9 @@ type dictd_var_lib_t alias var_lib_dictd_t; files_type(dictd_var_lib_t) @@ -8693,10 +9974,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dict kernel_read_system_state(dictd_t) kernel_read_kernel_sysctls(dictd_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.fc serefpolicy-3.0.8/policy/modules/services/dnsmasq.fc +--- nsaserefpolicy/policy/modules/services/dnsmasq.fc 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dnsmasq.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -1,4 +1,5 @@ + /usr/sbin/dnsmasq -- gen_context(system_u:object_r:dnsmasq_exec_t,s0) + + /var/lib/misc/dnsmasq\.leases -- gen_context(system_u:object_r:dnsmasq_lease_t,s0) ++/var/lib/dnsmasq(/.*)? gen_context(system_u:object_r:dnsmasq_lease_t,s0) + /var/run/dnsmasq\.pid -- gen_context(system_u:object_r:dnsmasq_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.0.8/policy/modules/services/dnsmasq.te --- nsaserefpolicy/policy/modules/services/dnsmasq.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dnsmasq.te 2007-12-02 21:15:34.000000000 -0500 -@@ -94,3 +94,7 @@ ++++ serefpolicy-3.0.8/policy/modules/services/dnsmasq.te 2008-04-04 16:11:03.000000000 -0400 +@@ -16,6 +16,9 @@ + type dnsmasq_var_run_t; + files_pid_file(dnsmasq_var_run_t) + ++type dnsmasq_script_exec_t; ++init_script_type(dnsmasq_script_exec_t) ++ + ######################################## + # + # Local policy +@@ -32,7 +35,7 @@ + allow dnsmasq_t self:rawip_socket create_socket_perms; + + # dhcp leases +-allow dnsmasq_t dnsmasq_lease_t:file manage_file_perms; ++manage_files_pattern(dnsmasq_t, dnsmasq_lease_t, dnsmasq_lease_t) + files_var_lib_filetrans(dnsmasq_t,dnsmasq_lease_t,file) + + manage_files_pattern(dnsmasq_t,dnsmasq_var_run_t,dnsmasq_var_run_t) +@@ -94,3 +97,7 @@ optional_policy(` udev_read_db(dnsmasq_t) ') @@ -8706,7 +10015,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsm +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.8/policy/modules/services/dovecot.fc --- nsaserefpolicy/policy/modules/services/dovecot.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dovecot.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/dovecot.fc 2008-04-04 16:11:03.000000000 -0400 @@ -17,19 +17,24 @@ ifdef(`distro_debian', ` @@ -8734,7 +10043,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.8/policy/modules/services/dovecot.if --- nsaserefpolicy/policy/modules/services/dovecot.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dovecot.if 2007-12-06 11:01:54.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/dovecot.if 2008-04-04 16:11:03.000000000 -0400 @@ -18,3 +18,43 @@ manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t) manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t) @@ -8781,7 +10090,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.8/policy/modules/services/dovecot.te --- nsaserefpolicy/policy/modules/services/dovecot.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dovecot.te 2007-12-06 20:33:21.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/dovecot.te 2008-04-04 16:11:03.000000000 -0400 @@ -15,6 +15,12 @@ domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t) role system_r types dovecot_auth_t; @@ -8907,7 +10216,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove files_read_usr_symlinks(dovecot_auth_t) files_search_tmp(dovecot_auth_t) files_read_var_lib_files(dovecot_t) -@@ -185,12 +198,54 @@ +@@ -185,12 +198,57 @@ seutil_dontaudit_search_config(dovecot_auth_t) @@ -8930,7 +10239,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove +optional_policy(` + postfix_manage_pivate_sockets(dovecot_auth_t) + postfix_search_spool(dovecot_auth_t) - ') ++') + +# for gssapi (kerberos) +userdom_list_unpriv_users_tmp(dovecot_auth_t) @@ -8949,11 +10258,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove +kernel_read_all_sysctls(dovecot_deliver_t) +kernel_read_system_state(dovecot_deliver_t) + -+dovecot_auth_stream_connect(dovecot_deliver_t) -+ +files_read_etc_files(dovecot_deliver_t) +files_read_etc_runtime_files(dovecot_deliver_t) + ++auth_use_nsswitch(dovecot_deliver_t) ++ +libs_use_ld_so(dovecot_deliver_t) +libs_use_shared_libs(dovecot_deliver_t) + @@ -8961,13 +10270,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + +miscfiles_read_localization(dovecot_deliver_t) + ++dovecot_auth_stream_connect(dovecot_deliver_t) ++ ++userdom_priveleged_home_dir_manager(dovecot_deliver_t) ++ +optional_policy(` + mta_manage_spool(dovecot_deliver_t) -+') -+ + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.fc serefpolicy-3.0.8/policy/modules/services/exim.fc --- nsaserefpolicy/policy/modules/services/exim.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/exim.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/exim.fc 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,5 @@ + +/usr/sbin/exim -- gen_context(system_u:object_r:exim_exec_t,s0) @@ -8976,7 +10288,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim +/var/spool/exim(/.*)? gen_context(system_u:object_r:exim_spool_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.if serefpolicy-3.0.8/policy/modules/services/exim.if --- nsaserefpolicy/policy/modules/services/exim.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/exim.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/exim.if 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,177 @@ +## Exim mail transfer agent + @@ -9157,7 +10469,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.0.8/policy/modules/services/exim.te --- nsaserefpolicy/policy/modules/services/exim.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/exim.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/exim.te 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,214 @@ + +policy_module(exim,1.0.0) @@ -9375,16 +10687,89 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.fc serefpolicy-3.0.8/policy/modules/services/fail2ban.fc --- nsaserefpolicy/policy/modules/services/fail2ban.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/fail2ban.fc 2008-01-08 13:31:58.000000000 -0500 -@@ -1,3 +1,4 @@ -+/usr/bin/fail2ban-server -- gen_context(system_u:object_r:fail2ban_exec_t,s0) ++++ serefpolicy-3.0.8/policy/modules/services/fail2ban.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -1,3 +1,5 @@ /usr/bin/fail2ban -- gen_context(system_u:object_r:fail2ban_exec_t,s0) - /var/log/fail2ban.log -- gen_context(system_u:object_r:fail2ban_log_t,s0) - /var/run/fail2ban.pid -- gen_context(system_u:object_r:fail2ban_var_run_t,s0) +-/var/log/fail2ban.log -- gen_context(system_u:object_r:fail2ban_log_t,s0) +-/var/run/fail2ban.pid -- gen_context(system_u:object_r:fail2ban_var_run_t,s0) ++/usr/bin/fail2ban-server -- gen_context(system_u:object_r:fail2ban_exec_t,s0) ++/var/log/fail2ban\.log -- gen_context(system_u:object_r:fail2ban_log_t,s0) ++/var/run/fail2ban\.pid -- gen_context(system_u:object_r:fail2ban_var_run_t,s0) ++/var/run/fail2ban\.sock -s gen_context(system_u:object_r:fail2ban_var_run_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.te serefpolicy-3.0.8/policy/modules/services/fail2ban.te +--- nsaserefpolicy/policy/modules/services/fail2ban.te 2007-10-22 13:21:36.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/fail2ban.te 2008-04-21 16:05:47.000000000 -0400 +@@ -1,5 +1,5 @@ + +-policy_module(fail2ban,1.0.0) ++policy_module(fail2ban,1.1.0) + + ######################################## + # +@@ -25,7 +25,7 @@ + + allow fail2ban_t self:process signal; + allow fail2ban_t self:fifo_file rw_fifo_file_perms; +-allow fail2ban_t self:unix_stream_socket create_stream_socket_perms; ++allow fail2ban_t self:unix_stream_socket { connectto create_stream_socket_perms }; + + # log files + allow fail2ban_t fail2ban_log_t:dir setattr; +@@ -33,8 +33,9 @@ + logging_log_filetrans(fail2ban_t,fail2ban_log_t,file) + + # pid file ++manage_sock_files_pattern(fail2ban_t,fail2ban_var_run_t,fail2ban_var_run_t) + manage_files_pattern(fail2ban_t,fail2ban_var_run_t,fail2ban_var_run_t) +-files_pid_filetrans(fail2ban_t,fail2ban_var_run_t, file) ++files_pid_filetrans(fail2ban_t,fail2ban_var_run_t, { file sock_file }) + + kernel_read_system_state(fail2ban_t) + +@@ -46,15 +47,26 @@ + domain_use_interactive_fds(fail2ban_t) + + files_read_etc_files(fail2ban_t) ++files_read_etc_runtime_files(fail2ban_t) + files_read_usr_files(fail2ban_t) ++files_list_var(fail2ban_t) ++files_search_var_lib(fail2ban_t) ++ ++fs_list_inotifyfs(fail2ban_t) ++fs_getattr_all_fs(fail2ban_t) ++ ++auth_use_nsswitch(fail2ban_t) ++corenet_tcp_connect_whois_port(fail2ban_t) + + libs_use_ld_so(fail2ban_t) + libs_use_shared_libs(fail2ban_t) + +-logging_read_generic_logs(fail2ban_t) ++logging_read_all_logs(fail2ban_t) + + miscfiles_read_localization(fail2ban_t) + ++mta_send_mail(fail2ban_t) ++ + optional_policy(` + apache_read_log(fail2ban_t) + ') +@@ -64,5 +76,11 @@ + ') + + optional_policy(` ++ gamin_domtrans(fail2ban_t) ++ gamin_stream_connect(fail2ban_t) ++') ++ ++optional_policy(` + iptables_domtrans(fail2ban_t) + ') ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetchmail.te serefpolicy-3.0.8/policy/modules/services/fetchmail.te --- nsaserefpolicy/policy/modules/services/fetchmail.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/fetchmail.te 2007-12-02 21:15:34.000000000 -0500 -@@ -86,6 +86,10 @@ ++++ serefpolicy-3.0.8/policy/modules/services/fetchmail.te 2008-04-06 06:17:08.000000000 -0400 +@@ -86,6 +86,14 @@ userdom_dontaudit_search_sysadm_home_dirs(fetchmail_t) optional_policy(` @@ -9392,12 +10777,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetc +') + +optional_policy(` ++ sendmail_manage_log(fetchmail_t) ++') ++ ++optional_policy(` seutil_sigchld_newrole(fetchmail_t) ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.if serefpolicy-3.0.8/policy/modules/services/ftp.if --- nsaserefpolicy/policy/modules/services/ftp.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ftp.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ftp.if 2008-04-04 16:11:03.000000000 -0400 @@ -28,11 +28,13 @@ type ftpd_t; ') @@ -9419,7 +10808,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.8/policy/modules/services/ftp.te --- nsaserefpolicy/policy/modules/services/ftp.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ftp.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ftp.te 2008-04-04 16:11:03.000000000 -0400 @@ -88,6 +88,7 @@ allow ftpd_t self:unix_stream_socket create_stream_socket_perms; allow ftpd_t self:tcp_socket create_stream_socket_perms; @@ -9489,36 +10878,127 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.8/policy/modules/services/hal.fc ---- nsaserefpolicy/policy/modules/services/hal.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/hal.fc 2007-12-02 21:15:34.000000000 -0500 -@@ -8,14 +8,18 @@ - /usr/libexec/hal-hotplug-map -- gen_context(system_u:object_r:hald_exec_t,s0) - /usr/libexec/hal-system-sonypic -- gen_context(system_u:object_r:hald_sonypic_exec_t,s0) - /usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) -+/usr/libexec/hald-addon-macbook-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) - - /usr/sbin/hald -- gen_context(system_u:object_r:hald_exec_t,s0) - - /var/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0) - -+/var/lib/PolicyKit(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0) - /var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0) - - /var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0) -+/var/log/pm(/.*)? gen_context(system_u:object_r:hald_log_t,s0) - -+/var/run/pm(/.*)? gen_context(system_u:object_r:hald_var_run_t,s0) - /var/run/haldaemon.pid -- gen_context(system_u:object_r:hald_var_run_t,s0) --/var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0) -+/var/run/vbe.* -- gen_context(system_u:object_r:hald_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.8/policy/modules/services/hal.te ---- nsaserefpolicy/policy/modules/services/hal.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/hal.te 2007-12-02 21:15:34.000000000 -0500 -@@ -49,6 +49,9 @@ - type hald_var_lib_t; - files_type(hald_var_lib_t) - +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.fc serefpolicy-3.0.8/policy/modules/services/gamin.fc +--- nsaserefpolicy/policy/modules/services/gamin.fc 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/gamin.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -0,0 +1,2 @@ ++ ++/usr/libexec/gam_server -- gen_context(system_u:object_r:gamin_exec_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.if serefpolicy-3.0.8/policy/modules/services/gamin.if +--- nsaserefpolicy/policy/modules/services/gamin.if 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/gamin.if 2008-04-04 16:11:03.000000000 -0400 +@@ -0,0 +1,39 @@ ++ ++## policy for gamin ++ ++######################################## ++## ++## Execute a domain transition to run gamin. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`gamin_domtrans',` ++ gen_require(` ++ type gamin_t; ++ type gamin_exec_t; ++ ') ++ ++ domtrans_pattern($1,gamin_exec_t,gamin_t) ++') ++ ++######################################## ++## ++## Connect to gamin over an unix stream socket. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`gamin_stream_connect',` ++ gen_require(` ++ type gamin_t; ++ ') ++ ++ allow $1 gamin_t:unix_stream_socket connectto; ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.te serefpolicy-3.0.8/policy/modules/services/gamin.te +--- nsaserefpolicy/policy/modules/services/gamin.te 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/gamin.te 2008-04-04 16:11:03.000000000 -0400 +@@ -0,0 +1,38 @@ ++policy_module(gamin,1.0.0) ++ ++######################################## ++# ++# Declarations ++# ++ ++type gamin_t; ++type gamin_exec_t; ++init_daemon_domain(gamin_t, gamin_exec_t) ++ ++######################################## ++# ++# gamin local policy ++# ++ ++# Init script handling ++domain_use_interactive_fds(gamin_t) ++ ++# internal communication is often done using fifo and unix sockets. ++allow gamin_t self:fifo_file rw_file_perms; ++allow gamin_t self:unix_stream_socket create_stream_socket_perms; ++ ++files_read_etc_files(gamin_t) ++files_read_etc_runtime_files(gamin_t) ++files_list_all(gamin_t) ++files_getattr_all_files(gamin_t) ++ ++fs_list_inotifyfs(gamin_t) ++domain_read_all_domains_state(gamin_t) ++ ++libs_use_ld_so(gamin_t) ++libs_use_shared_libs(gamin_t) ++ ++miscfiles_read_localization(gamin_t) ++ ++role unconfined_r types gamin_t; ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.8/policy/modules/services/hal.fc +--- nsaserefpolicy/policy/modules/services/hal.fc 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/hal.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -8,14 +8,18 @@ + /usr/libexec/hal-hotplug-map -- gen_context(system_u:object_r:hald_exec_t,s0) + /usr/libexec/hal-system-sonypic -- gen_context(system_u:object_r:hald_sonypic_exec_t,s0) + /usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) ++/usr/libexec/hald-addon-macbook-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) + + /usr/sbin/hald -- gen_context(system_u:object_r:hald_exec_t,s0) + + /var/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0) + ++/var/lib/PolicyKit(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0) + /var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0) + + /var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0) ++/var/log/pm(/.*)? gen_context(system_u:object_r:hald_log_t,s0) + ++/var/run/pm(/.*)? gen_context(system_u:object_r:hald_var_run_t,s0) + /var/run/haldaemon.pid -- gen_context(system_u:object_r:hald_var_run_t,s0) +-/var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0) ++/var/run/vbe.* -- gen_context(system_u:object_r:hald_var_run_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.8/policy/modules/services/hal.te +--- nsaserefpolicy/policy/modules/services/hal.te 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/hal.te 2008-04-04 16:11:03.000000000 -0400 +@@ -49,6 +49,9 @@ + type hald_var_lib_t; + files_type(hald_var_lib_t) + +typealias hald_log_t alias pmtools_log_t; +typealias hald_var_run_t alias pmtools_var_run_t; + @@ -9542,7 +11022,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. auth_read_pam_console_data(hald_t) -@@ -155,6 +159,8 @@ +@@ -145,6 +149,7 @@ + fs_list_inotifyfs(hald_t) + fs_list_auto_mountpoints(hald_t) + files_getattr_all_mountpoints(hald_t) ++fstools_getattr_swap_files(hald_t) + + mls_file_read_all_levels(hald_t) + +@@ -155,6 +160,8 @@ selinux_compute_relabel_context(hald_t) selinux_compute_user_contexts(hald_t) @@ -9551,7 +11039,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. storage_raw_read_removable_device(hald_t) storage_raw_write_removable_device(hald_t) storage_raw_read_fixed_disk(hald_t) -@@ -280,6 +286,10 @@ +@@ -280,6 +287,10 @@ ') optional_policy(` @@ -9562,7 +11050,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. updfstab_domtrans(hald_t) ') -@@ -293,6 +303,7 @@ +@@ -293,6 +304,7 @@ # allow hald_acl_t self:capability { dac_override fowner }; @@ -9570,7 +11058,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. allow hald_acl_t self:fifo_file read_fifo_file_perms; domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t) -@@ -340,10 +351,14 @@ +@@ -306,6 +318,7 @@ + corecmd_exec_bin(hald_acl_t) + + dev_getattr_all_chr_files(hald_acl_t) ++dev_setattr_all_chr_files(hald_acl_t) + dev_getattr_generic_usb_dev(hald_acl_t) + dev_getattr_video_dev(hald_acl_t) + dev_setattr_video_dev(hald_acl_t) +@@ -340,10 +353,14 @@ manage_files_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t) files_search_var_lib(hald_mac_t) @@ -9585,9 +11081,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. libs_use_ld_so(hald_mac_t) libs_use_shared_libs(hald_mac_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.if serefpolicy-3.0.8/policy/modules/services/inetd.if +--- nsaserefpolicy/policy/modules/services/inetd.if 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/inetd.if 2008-04-04 16:11:03.000000000 -0400 +@@ -115,6 +115,10 @@ + + allow $1 inetd_t:tcp_socket rw_stream_socket_perms; + allow $1 inetd_t:udp_socket rw_socket_perms; ++ ++ optional_policy(` ++ stunnel_service_domain($1,$2) ++ ') + ') + + ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.8/policy/modules/services/inetd.te --- nsaserefpolicy/policy/modules/services/inetd.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/inetd.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/inetd.te 2008-04-04 16:11:03.000000000 -0400 @@ -30,6 +30,10 @@ type inetd_child_var_run_t; files_pid_file(inetd_child_var_run_t) @@ -9703,9 +11213,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet unconfined_domain(inetd_child_t) + inetd_service_domain(inetd_child_t,bin_t) ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inn.if serefpolicy-3.0.8/policy/modules/services/inn.if +--- nsaserefpolicy/policy/modules/services/inn.if 2007-10-22 13:21:36.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/inn.if 2008-05-13 11:43:47.632772000 -0400 +@@ -54,8 +54,7 @@ + ') + + logging_rw_generic_log_dirs($1) +- allow $1 innd_log_t:dir search; +- allow $1 innd_log_t:file manage_file_perms; ++ manage_files_pattern($1, innd_log_t,innd_log_t) + ') + + ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.fc serefpolicy-3.0.8/policy/modules/services/kerberos.fc --- nsaserefpolicy/policy/modules/services/kerberos.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/kerberos.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/kerberos.fc 2008-04-04 16:11:03.000000000 -0400 @@ -16,3 +16,4 @@ /var/log/krb5kdc\.log gen_context(system_u:object_r:krb5kdc_log_t,s0) @@ -9713,14 +11236,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb +/var/tmp/host_0 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-3.0.8/policy/modules/services/kerberos.if --- nsaserefpolicy/policy/modules/services/kerberos.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/kerberos.if 2007-12-02 21:15:34.000000000 -0500 -@@ -42,11 +42,17 @@ ++++ serefpolicy-3.0.8/policy/modules/services/kerberos.if 2008-04-15 15:34:14.000000000 -0400 +@@ -42,11 +42,18 @@ dontaudit $1 krb5_conf_t:file write; dontaudit $1 krb5kdc_conf_t:dir list_dir_perms; dontaudit $1 krb5kdc_conf_t:file rw_file_perms; + + #kerberos libraries are attempting to set the correct file context + dontaudit $1 self:process setfscreate; ++ selinux_dontaudit_validate_context($1) + seutil_dontaudit_read_file_contexts($1) tunable_policy(`allow_kerberos',` @@ -9732,7 +11256,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb corenet_all_recvfrom_unlabeled($1) corenet_all_recvfrom_netlabel($1) corenet_tcp_sendrecv_all_if($1) -@@ -61,9 +67,6 @@ +@@ -61,9 +68,6 @@ corenet_tcp_connect_ocsp_port($1) corenet_sendrecv_kerberos_client_packets($1) corenet_sendrecv_ocsp_client_packets($1) @@ -9742,10 +11266,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb ') optional_policy(` -@@ -172,3 +175,51 @@ - allow $1 krb5kdc_conf_t:file read_file_perms; +@@ -169,6 +173,53 @@ + ') - ') + files_search_etc($1) +- allow $1 krb5kdc_conf_t:file read_file_perms; ++ read_files_pattern($1, krb5kdc_conf_t, krb5kdc_conf_t) ++') + +######################################## +## @@ -9773,7 +11300,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb + # creates files as system_u no matter what the selinux user + domain_obj_id_change_exemption($1) +') -+ + +######################################## +## +## Connect to krb524 service @@ -9793,10 +11320,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb + corenet_udp_sendrecv_kerberos_master_port($1) + corenet_udp_bind_all_nodes($1) + ') -+') + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.8/policy/modules/services/kerberos.te --- nsaserefpolicy/policy/modules/services/kerberos.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/kerberos.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/kerberos.te 2008-04-15 15:35:49.000000000 -0400 @@ -54,6 +54,9 @@ type krb5kdc_var_run_t; files_pid_file(krb5kdc_var_run_t) @@ -9824,7 +11351,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb corenet_all_recvfrom_unlabeled(kadmind_t) corenet_all_recvfrom_netlabel(kadmind_t) -@@ -118,6 +122,9 @@ +@@ -115,9 +119,15 @@ + fs_getattr_all_fs(kadmind_t) + fs_search_auto_mountpoints(kadmind_t) + ++selinux_validate_context(kadmind_t) ++seutil_read_file_contexts(kadmind_t) ++ domain_use_interactive_fds(kadmind_t) files_read_etc_files(kadmind_t) @@ -9834,7 +11367,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb libs_use_ld_so(kadmind_t) libs_use_shared_libs(kadmind_t) -@@ -127,6 +134,7 @@ +@@ -127,6 +137,7 @@ miscfiles_read_localization(kadmind_t) sysnet_read_config(kadmind_t) @@ -9842,7 +11375,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb userdom_dontaudit_use_unpriv_user_fds(kadmind_t) userdom_dontaudit_search_sysadm_home_dirs(kadmind_t) -@@ -137,6 +145,7 @@ +@@ -137,6 +148,7 @@ optional_policy(` seutil_sigchld_newrole(kadmind_t) @@ -9850,7 +11383,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb ') optional_policy(` -@@ -151,7 +160,7 @@ +@@ -151,7 +163,7 @@ # Use capabilities. Surplus capabilities may be allowed. allow krb5kdc_t self:capability { setuid setgid net_admin chown fowner dac_override sys_nice }; dontaudit krb5kdc_t self:capability sys_tty_config; @@ -9859,7 +11392,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb allow krb5kdc_t self:netlink_route_socket r_netlink_socket_perms; allow krb5kdc_t self:tcp_socket create_stream_socket_perms; allow krb5kdc_t self:udp_socket create_socket_perms; -@@ -223,6 +232,7 @@ +@@ -215,6 +227,9 @@ + files_read_usr_symlinks(krb5kdc_t) + files_read_var_files(krb5kdc_t) + ++selinux_validate_context(krb5kdc_t) ++seutil_read_file_contexts(krb5kdc_t) ++ + libs_use_ld_so(krb5kdc_t) + libs_use_shared_libs(krb5kdc_t) + +@@ -223,6 +238,7 @@ miscfiles_read_localization(krb5kdc_t) sysnet_read_config(krb5kdc_t) @@ -9867,7 +11410,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t) userdom_dontaudit_search_sysadm_home_dirs(krb5kdc_t) -@@ -233,6 +243,7 @@ +@@ -233,6 +249,7 @@ optional_policy(` seutil_sigchld_newrole(krb5kdc_t) @@ -9877,7 +11420,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ktalk.te serefpolicy-3.0.8/policy/modules/services/ktalk.te --- nsaserefpolicy/policy/modules/services/ktalk.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ktalk.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ktalk.te 2008-04-04 16:11:03.000000000 -0400 @@ -49,6 +49,8 @@ manage_files_pattern(ktalkd_t,ktalkd_var_run_t,ktalkd_var_run_t) files_pid_filetrans(ktalkd_t,ktalkd_var_run_t,file) @@ -9903,7 +11446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ktal +term_search_ptys(ktalkd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.te serefpolicy-3.0.8/policy/modules/services/ldap.te --- nsaserefpolicy/policy/modules/services/ldap.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ldap.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ldap.te 2008-04-04 16:11:03.000000000 -0400 @@ -42,7 +42,6 @@ dontaudit slapd_t self:capability sys_tty_config; allow slapd_t self:process setsched; @@ -9943,15 +11486,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.fc serefpolicy-3.0.8/policy/modules/services/lpd.fc --- nsaserefpolicy/policy/modules/services/lpd.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/lpd.fc 2007-12-02 21:15:34.000000000 -0500 -@@ -29,3 +29,4 @@ ++++ serefpolicy-3.0.8/policy/modules/services/lpd.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -22,6 +22,8 @@ + /usr/sbin/lpinfo -- gen_context(system_u:object_r:lpr_exec_t,s0) + /usr/sbin/lpmove -- gen_context(system_u:object_r:lpr_exec_t,s0) + ++/usr/local/linuxprinter/bin/l?lpr -- gen_context(system_u:object_r:lpr_exec_t,s0) ++ + /usr/share/printconf/.* -- gen_context(system_u:object_r:printconf_t,s0) + + # +@@ -29,3 +31,5 @@ # /var/spool/lpd(/.*)? gen_context(system_u:object_r:print_spool_t,s0) /var/run/lprng(/.*)? gen_context(system_u:object_r:lpd_var_run_t,s0) +/var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) ++/var/spool/cups-pdf(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.8/policy/modules/services/lpd.if --- nsaserefpolicy/policy/modules/services/lpd.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/lpd.if 2007-12-31 06:38:31.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/lpd.if 2008-04-04 16:11:03.000000000 -0400 @@ -303,6 +303,25 @@ ######################################## @@ -10013,9 +11566,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd. + + can_exec($1,lpr_exec_t) +') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.fc serefpolicy-3.0.8/policy/modules/services/mailman.fc +--- nsaserefpolicy/policy/modules/services/mailman.fc 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/mailman.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -31,3 +31,4 @@ + /var/lock/mailman(/.*)? gen_context(system_u:object_r:mailman_lock_t,s0) + /var/spool/mailman(/.*)? gen_context(system_u:object_r:mailman_data_t,s0) + ') ++/usr/lib/mailman/mail/mailman -- gen_context(system_u:object_r:mailman_mail_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-3.0.8/policy/modules/services/mailman.if --- nsaserefpolicy/policy/modules/services/mailman.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mailman.if 2007-12-31 14:17:27.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/mailman.if 2008-04-04 16:11:03.000000000 -0400 @@ -256,6 +256,25 @@ ####################################### @@ -10044,7 +11605,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.8/policy/modules/services/mailman.te --- nsaserefpolicy/policy/modules/services/mailman.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mailman.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/mailman.te 2008-04-15 14:13:47.000000000 -0400 @@ -55,6 +55,8 @@ apache_use_fds(mailman_cgi_t) apache_dontaudit_append_log(mailman_cgi_t) @@ -10054,22 +11615,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail optional_policy(` nscd_socket_use(mailman_cgi_t) -@@ -67,6 +69,14 @@ +@@ -67,6 +69,17 @@ # allow mailman_mail_t self:unix_dgram_socket create_socket_perms; ++allow mailman_mail_t self:process signal; +allow mailman_mail_t initrc_t:process signal; +allow mailman_mail_t self:capability { setuid setgid }; + +mta_dontaudit_rw_delivery_tcp_sockets(mailman_mail_t) ++mta_dontaudit_rw_queue(mailman_mail_t) + +auth_use_nsswitch(mailman_mail_t) + +files_search_spool(mailman_mail_t) ++fs_rw_anon_inodefs_files(mailman_mail_t) mta_dontaudit_rw_delivery_tcp_sockets(mailman_mail_t) -@@ -96,6 +106,7 @@ +@@ -96,6 +109,7 @@ kernel_read_proc_symlinks(mailman_queue_t) auth_domtrans_chk_passwd(mailman_queue_t) @@ -10079,13 +11643,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.8/policy/modules/services/mailscanner.fc --- nsaserefpolicy/policy/modules/services/mailscanner.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/mailscanner.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/mailscanner.fc 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,2 @@ +/var/spool/MailScanner(/.*)? gen_context(system_u:object_r:mailscanner_spool_t,s0) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.8/policy/modules/services/mailscanner.if --- nsaserefpolicy/policy/modules/services/mailscanner.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/mailscanner.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/mailscanner.if 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,59 @@ +## Anti-Virus and Anti-Spam Filter + @@ -10148,16 +11712,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.8/policy/modules/services/mailscanner.te --- nsaserefpolicy/policy/modules/services/mailscanner.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/mailscanner.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/mailscanner.te 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,5 @@ + +policy_module(mailscanner,1.0.0) + +type mailscanner_spool_t; +files_type(mailscanner_spool_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.0.8/policy/modules/services/mta.fc +--- nsaserefpolicy/policy/modules/services/mta.fc 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/mta.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -11,6 +11,7 @@ + /usr/lib(64)?/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) + + /usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) ++/bin/mail -- gen_context(system_u:object_r:sendmail_exec_t,s0) + /usr/sbin/sendmail\.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0) + /usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.8/policy/modules/services/mta.if --- nsaserefpolicy/policy/modules/services/mta.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mta.if 2008-01-11 14:43:52.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/mta.if 2008-04-04 16:11:03.000000000 -0400 @@ -87,6 +87,8 @@ # It wants to check for nscd files_dontaudit_search_pids($1_mail_t) @@ -10198,6 +11773,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. ') ####################################### +@@ -210,9 +207,9 @@ + userdom_user_home_dir_filetrans_user_home_content($1,$1_mail_t,file) + # for reading .forward - maybe we need a new type for it? + # also for delivering mail to maildir +- userdom_manage_user_home_content_dirs($1,mailserver_delivery) +- userdom_manage_user_home_content_files($1,mailserver_delivery) +- userdom_manage_user_home_content_symlinks($1,mailserver_delivery) ++ userdom_manage_all_users_home_content_dirs(mailserver_delivery) ++ userdom_manage_all_users_home_content_files(mailserver_delivery) ++ userdom_manage_all_users_home_content_symlinks(mailserver_delivery) + userdom_manage_user_home_content_pipes($1,mailserver_delivery) + userdom_manage_user_home_content_sockets($1,mailserver_delivery) + userdom_user_home_dir_filetrans_user_home_content($1,mailserver_delivery,{ dir file lnk_file fifo_file sock_file }) @@ -228,6 +225,11 @@ fs_manage_cifs_symlinks($1_mail_t) ') @@ -10354,7 +11942,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.8/policy/modules/services/mta.te --- nsaserefpolicy/policy/modules/services/mta.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mta.te 2008-01-16 06:23:56.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/mta.te 2008-04-04 16:11:03.000000000 -0400 @@ -1,11 +1,13 @@ -policy_module(mta,1.7.1) @@ -10378,8 +11966,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. mta_base_mail_template(system) role system_r types system_mail_t; -@@ -40,27 +43,40 @@ - allow system_mail_t self:capability { dac_override }; +@@ -37,30 +40,45 @@ + # + + # newalias required this, not sure if it is needed in 'if' file +-allow system_mail_t self:capability { dac_override }; ++allow system_mail_t self:capability { dac_override fowner }; read_files_pattern(system_mail_t,etc_mail_t,etc_mail_t) +read_files_pattern(system_mail_t,mailcontent_type,mailcontent_type) @@ -10387,6 +11979,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. kernel_read_system_state(system_mail_t) kernel_read_network_state(system_mail_t) ++logging_append_all_logs(system_mail_t) ++ +dev_read_sysfs(system_mail_t) dev_read_rand(system_mail_t) dev_read_urand(system_mail_t) @@ -10419,7 +12013,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. ') optional_policy(` -@@ -73,6 +89,7 @@ +@@ -73,6 +91,7 @@ optional_policy(` cron_read_system_job_tmp_files(system_mail_t) @@ -10427,7 +12021,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. cron_dontaudit_write_pipes(system_mail_t) ') -@@ -81,6 +98,11 @@ +@@ -81,6 +100,11 @@ ') optional_policy(` @@ -10439,11 +12033,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. logrotate_read_tmp_files(system_mail_t) ') -@@ -136,11 +158,33 @@ +@@ -136,11 +160,38 @@ ') optional_policy(` -+ clamav_stream_connect(sendmail_t) ++ clamav_stream_connect(system_mail_t) ++ clamav_append_log(system_mail_t) ++') ++ ++optional_policy(` ++ fail2ban_append_log(system_mail_t) +') + +optional_policy(` @@ -10457,7 +12056,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. -# should break this up among sections: +init_stream_connect_script(mailserver_delivery) +init_rw_script_stream_sockets(mailserver_delivery) -+ + +tunable_policy(`use_samba_home_dirs',` + fs_manage_cifs_dirs(mailserver_delivery) + fs_manage_cifs_files(mailserver_delivery) @@ -10469,19 +12068,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. + fs_manage_nfs_files(mailserver_delivery) + fs_manage_nfs_symlinks(mailserver_delivery) +') - ++ +# should break this up among sections: optional_policy(` # why is mail delivered to a directory of type arpwatch_data_t? arpwatch_search_data(mailserver_delivery) -@@ -154,3 +198,4 @@ +@@ -154,3 +205,4 @@ cron_read_system_job_tmp_files(mta_user_agent) ') ') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.fc serefpolicy-3.0.8/policy/modules/services/munin.fc --- nsaserefpolicy/policy/modules/services/munin.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/munin.fc 2008-01-16 16:07:35.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/munin.fc 2008-04-04 16:11:03.000000000 -0400 @@ -6,6 +6,7 @@ /usr/share/munin/plugins/.* -- gen_context(system_u:object_r:munin_exec_t,s0) @@ -10494,7 +12093,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni +/var/www/html/munin/cgi(/.*)? gen_context(system_u:object_r:httpd_munin_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.if serefpolicy-3.0.8/policy/modules/services/munin.if --- nsaserefpolicy/policy/modules/services/munin.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/munin.if 2008-01-16 16:07:44.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/munin.if 2008-04-04 16:11:03.000000000 -0400 @@ -61,3 +61,22 @@ allow $1 munin_var_lib_t:dir search_dir_perms; files_search_var_lib($1) @@ -10520,7 +12119,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.te serefpolicy-3.0.8/policy/modules/services/munin.te --- nsaserefpolicy/policy/modules/services/munin.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/munin.te 2008-01-16 16:07:27.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/munin.te 2008-04-06 05:34:05.000000000 -0400 @@ -1,5 +1,5 @@ -policy_module(munin,1.3.0) @@ -10533,7 +12132,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni # -allow munin_t self:capability { setgid setuid }; -+allow munin_t self:capability { dac_override setgid setuid }; ++allow munin_t self:capability { chown dac_override setgid setuid sys_rawio }; dontaudit munin_t self:capability sys_tty_config; allow munin_t self:process { getsched setsched signal_perms }; allow munin_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -10557,23 +12156,82 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni manage_dirs_pattern(munin_t,munin_tmp_t,munin_tmp_t) manage_files_pattern(munin_t,munin_tmp_t,munin_tmp_t) -@@ -73,6 +77,7 @@ +@@ -61,9 +65,11 @@ + files_pid_filetrans(munin_t,munin_var_run_t,file) + + kernel_read_system_state(munin_t) +-kernel_read_kernel_sysctls(munin_t) ++kernel_read_network_state(munin_t) ++kernel_read_all_sysctls(munin_t) + + corecmd_exec_bin(munin_t) ++corecmd_exec_shell(munin_t) + + corenet_all_recvfrom_unlabeled(munin_t) + corenet_all_recvfrom_netlabel(munin_t) +@@ -73,27 +79,37 @@ corenet_udp_sendrecv_all_nodes(munin_t) corenet_tcp_sendrecv_all_ports(munin_t) corenet_udp_sendrecv_all_ports(munin_t) ++corenet_tcp_bind_munin_port(munin_t) +corenet_tcp_connect_munin_port(munin_t) ++corenet_tcp_connect_http_port(munin_t) ++corenet_tcp_bind_all_nodes(munin_t) dev_read_sysfs(munin_t) dev_read_urand(munin_t) -@@ -91,6 +96,7 @@ + + domain_use_interactive_fds(munin_t) ++domain_dontaudit_read_all_domains_state(munin_t) + + files_read_etc_files(munin_t) + files_read_etc_runtime_files(munin_t) + files_read_usr_files(munin_t) ++files_list_spool(munin_t) + + fs_getattr_all_fs(munin_t) + fs_search_auto_mountpoints(munin_t) + ++auth_use_nsswitch(munin_t) ++ + libs_use_ld_so(munin_t) + libs_use_shared_libs(munin_t) logging_send_syslog_msg(munin_t) +miscfiles_read_fonts(munin_t) miscfiles_read_localization(munin_t) - sysnet_read_config(munin_t) -@@ -118,3 +124,9 @@ +-sysnet_read_config(munin_t) ++sysnet_exec_ifconfig(munin_t) ++netutils_domtrans_ping(munin_t) + + userdom_dontaudit_use_unpriv_user_fds(munin_t) + userdom_dontaudit_search_sysadm_home_dirs(munin_t) +@@ -108,7 +124,21 @@ + ') + + optional_policy(` +- nis_use_ypbind(munin_t) ++ fstools_domtrans(munin_t) ++') ++ ++optional_policy(` ++ mta_read_config(munin_t) ++ mta_send_mail(munin_t) ++') ++ ++optional_policy(` ++ mysql_read_config(munin_t) ++ mysql_stream_connect(munin_t) ++') ++ ++optional_policy(` ++ sendmail_read_log(munin_t) + ') + + optional_policy(` +@@ -118,3 +148,9 @@ optional_policy(` udev_read_db(munin_t) ') @@ -10585,7 +12243,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni +manage_files_pattern(munin_t, httpd_munin_content_t, httpd_munin_content_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.fc serefpolicy-3.0.8/policy/modules/services/mysql.fc --- nsaserefpolicy/policy/modules/services/mysql.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mysql.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/mysql.fc 2008-04-04 16:11:03.000000000 -0400 @@ -22,3 +22,5 @@ /var/log/mysql.* -- gen_context(system_u:object_r:mysqld_log_t,s0) @@ -10594,7 +12252,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq +/etc/rc\.d/init\.d/mysqld -- gen_context(system_u:object_r:mysqld_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.if serefpolicy-3.0.8/policy/modules/services/mysql.if --- nsaserefpolicy/policy/modules/services/mysql.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mysql.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/mysql.if 2008-04-04 16:11:03.000000000 -0400 @@ -157,3 +157,79 @@ logging_search_logs($1) allow $1 mysqld_log_t:file { write append setattr ioctl }; @@ -10677,7 +12335,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.0.8/policy/modules/services/mysql.te --- nsaserefpolicy/policy/modules/services/mysql.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mysql.te 2007-12-31 16:46:03.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/mysql.te 2008-04-04 16:11:03.000000000 -0400 @@ -25,6 +25,9 @@ type mysqld_tmp_t; files_tmp_file(mysqld_tmp_t) @@ -10698,9 +12356,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq allow mysqld_t self:unix_stream_socket create_stream_socket_perms; allow mysqld_t self:tcp_socket create_stream_socket_perms; allow mysqld_t self:udp_socket create_socket_perms; +@@ -79,6 +83,7 @@ + + fs_getattr_all_fs(mysqld_t) + fs_search_auto_mountpoints(mysqld_t) ++fs_rw_hugetlbfs_files(mysqld_t) + + domain_use_interactive_fds(mysqld_t) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.0.8/policy/modules/services/nagios.fc --- nsaserefpolicy/policy/modules/services/nagios.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nagios.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/nagios.fc 2008-04-04 16:11:03.000000000 -0400 @@ -4,13 +4,15 @@ /usr/bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0) /usr/bin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0) @@ -10708,7 +12374,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi -/usr/lib(64)?/cgi-bin/netsaint/.+ -- gen_context(system_u:object_r:nagios_cgi_exec_t,s0) -/usr/lib(64)?/nagios/cgi/.+ -- gen_context(system_u:object_r:nagios_cgi_exec_t,s0) +/usr/lib(64)?/cgi-bin/netsaint(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) -+/usr/lib(64)?/nagios/cgi(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) ++/usr/lib(64)?/nagios/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) /var/log/nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) /var/log/netsaint(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) @@ -10722,7 +12388,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi +/usr/lib(64)?/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.0.8/policy/modules/services/nagios.if --- nsaserefpolicy/policy/modules/services/nagios.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nagios.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/nagios.if 2008-04-04 16:11:03.000000000 -0400 @@ -44,25 +44,6 @@ ######################################## @@ -10751,7 +12417,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.0.8/policy/modules/services/nagios.te --- nsaserefpolicy/policy/modules/services/nagios.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nagios.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/nagios.te 2008-04-04 16:11:03.000000000 -0400 @@ -10,10 +10,6 @@ type nagios_exec_t; init_daemon_domain(nagios_t,nagios_exec_t) @@ -10857,48 +12523,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.0.8/policy/modules/services/networkmanager.fc --- nsaserefpolicy/policy/modules/services/networkmanager.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/networkmanager.fc 2008-01-14 09:31:26.000000000 -0500 -@@ -1,7 +1,9 @@ ++++ serefpolicy-3.0.8/policy/modules/services/networkmanager.fc 2008-04-28 17:01:36.000000000 -0400 +@@ -1,7 +1,11 @@ /usr/s?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) /usr/s?bin/wpa_supplicant -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) +/usr/sbin/NetworkManagerDispatcher -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) ++/usr/sbin/nm-system-settings -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) /var/run/NetworkManager\.pid -- gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/wpa_supplicant-global -s gen_context(system_u:object_r:NetworkManager_var_run_t,s0) -+/var/log/wpa_supplicant.log.* -- gen_context(system_u:object_r:NetworkManager_log_t,s0) ++/var/log/wpa_supplicant\.log.* -- gen_context(system_u:object_r:NetworkManager_log_t,s0) ++/etc/NetworkManager/dispatcher.d(/.*) gen_context(system_u:object_r:NetworkManager_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.0.8/policy/modules/services/networkmanager.if --- nsaserefpolicy/policy/modules/services/networkmanager.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/networkmanager.if 2007-12-31 08:56:04.000000000 -0500 -@@ -97,3 +97,42 @@ ++++ serefpolicy-3.0.8/policy/modules/services/networkmanager.if 2008-04-04 16:11:03.000000000 -0400 +@@ -97,3 +97,21 @@ allow $1 NetworkManager_t:dbus send_msg; allow NetworkManager_t $1:dbus send_msg; ') + +######################################## +## -+## dontaudit send and receive messages from -+## NetworkManager over dbus. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`networkmanager_dontaudit_dbus_chat',` -+ gen_require(` -+ type NetworkManager_t; -+ class dbus send_msg; -+ ') -+ -+ dontaudit $1 NetworkManager_t:dbus send_msg; -+ dontaudit NetworkManager_t $1:dbus send_msg; -+') -+ -+######################################## -+## +## Send a generic signal to NetworkManager +## +## @@ -10916,27 +12563,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.8/policy/modules/services/networkmanager.te --- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/networkmanager.te 2008-01-16 08:25:11.000000000 -0500 -@@ -13,6 +13,9 @@ ++++ serefpolicy-3.0.8/policy/modules/services/networkmanager.te 2008-04-28 17:02:03.000000000 -0400 +@@ -1,5 +1,5 @@ + +-policy_module(networkmanager,1.7.1) ++policy_module(networkmanager,1.9.0) + + ######################################## + # +@@ -13,6 +13,13 @@ type NetworkManager_var_run_t; files_pid_file(NetworkManager_var_run_t) +type NetworkManager_log_t; +logging_log_file(NetworkManager_log_t) + ++type NetworkManager_script_exec_t; ++init_script_type(NetworkManager_script_exec_t) ++init_script_domtrans_spec(NetworkManager_t,httpd_script_exec_t) ++ ######################################## # # Local policy -@@ -20,7 +23,7 @@ +@@ -20,9 +27,9 @@ # networkmanager will ptrace itself if gdb is installed # and it receives a unexpected signal (rh bug #204161) -allow NetworkManager_t self:capability { kill setgid setuid sys_nice dac_override net_admin net_raw net_bind_service ipc_lock }; -+allow NetworkManager_t self:capability { chown fsetid kill setgid setuid sys_nice dac_override net_admin net_raw net_bind_service ipc_lock }; ++allow NetworkManager_t self:capability { chown fsetid kill setgid setuid sys_nice dac_override net_admin net_raw ipc_lock }; dontaudit NetworkManager_t self:capability { sys_tty_config sys_ptrace }; - allow NetworkManager_t self:process { ptrace setcap setpgid getsched signal_perms }; +-allow NetworkManager_t self:process { ptrace setcap setpgid getsched signal_perms }; ++allow NetworkManager_t self:process { ptrace getcap setcap setpgid getsched signal_perms }; allow NetworkManager_t self:fifo_file rw_fifo_file_perms; -@@ -38,6 +41,9 @@ + allow NetworkManager_t self:unix_dgram_socket { sendto create_socket_perms }; + allow NetworkManager_t self:unix_stream_socket create_stream_socket_perms; +@@ -38,10 +45,14 @@ manage_sock_files_pattern(NetworkManager_t,NetworkManager_var_run_t,NetworkManager_var_run_t) files_pid_filetrans(NetworkManager_t,NetworkManager_var_run_t, { dir file sock_file }) @@ -10946,16 +12607,40 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw kernel_read_system_state(NetworkManager_t) kernel_read_network_state(NetworkManager_t) kernel_read_kernel_sysctls(NetworkManager_t) -@@ -82,6 +88,8 @@ - files_read_etc_files(NetworkManager_t) - files_read_etc_runtime_files(NetworkManager_t) + kernel_load_module(NetworkManager_t) ++kernel_read_debugfs(NetworkManager_t) + + corenet_all_recvfrom_unlabeled(NetworkManager_t) + corenet_all_recvfrom_netlabel(NetworkManager_t) +@@ -67,6 +78,7 @@ + + fs_getattr_all_fs(NetworkManager_t) + fs_search_auto_mountpoints(NetworkManager_t) ++fs_list_inotifyfs(NetworkManager_t) + + mls_file_read_all_levels(NetworkManager_t) + +@@ -84,8 +96,11 @@ files_read_usr_files(NetworkManager_t) -+files_read_all_pids(NetworkManager_t) -+files_unlink_generic_pids(NetworkManager_t) init_read_utmp(NetworkManager_t) ++init_dontaudit_write_utmp(NetworkManager_t) init_domtrans_script(NetworkManager_t) -@@ -129,15 +137,13 @@ + ++auth_use_nsswitch(NetworkManager_t) ++ + libs_use_ld_so(NetworkManager_t) + libs_use_shared_libs(NetworkManager_t) + +@@ -113,6 +128,7 @@ + userdom_dontaudit_use_unpriv_users_ttys(NetworkManager_t) + # Read gnome-keyring + userdom_read_unpriv_users_home_content_files(NetworkManager_t) ++userdom_unpriv_users_stream_connect(NetworkManager_t) + + optional_policy(` + bind_domtrans(NetworkManager_t) +@@ -129,28 +145,21 @@ ') optional_policy(` @@ -10963,26 +12648,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw - class dbus send_msg; - ') - - allow NetworkManager_t self:dbus send_msg; - - dbus_system_bus_client_template(NetworkManager,NetworkManager_t) - dbus_connect_system_bus(NetworkManager_t) - dbus_send_system_bus(NetworkManager_t) -+ dbus_dontaudit_rw_system_selinux_socket(NetworkManager_t) +- allow NetworkManager_t self:dbus send_msg; +- +- dbus_system_bus_client_template(NetworkManager,NetworkManager_t) +- dbus_connect_system_bus(NetworkManager_t) +- dbus_send_system_bus(NetworkManager_t) + dbus_system_domain(NetworkManager_t,NetworkManager_exec_t) ') optional_policy(` -@@ -151,6 +157,8 @@ +- howl_signal(NetworkManager_t) ++ hal_write_log(NetworkManager_t) + ') + + optional_policy(` +- nis_use_ypbind(NetworkManager_t) ++ howl_signal(NetworkManager_t) + ') + optional_policy(` - nscd_socket_use(NetworkManager_t) +- nscd_socket_use(NetworkManager_t) nscd_signal(NetworkManager_t) + nscd_script_domtrans(NetworkManager_t) + nscd_domtrans(NetworkManager_t) ') optional_policy(` -@@ -162,6 +170,7 @@ +@@ -162,19 +171,20 @@ ppp_domtrans(NetworkManager_t) ppp_read_pid_files(NetworkManager_t) ppp_signal(NetworkManager_t) @@ -10990,20 +12682,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw ') optional_policy(` -@@ -173,8 +182,10 @@ +- seutil_sigchld_newrole(NetworkManager_t) ++ # Dispatcher starting and stoping ntp ++ ntp_script_domtrans(NetworkManager_t) + ') + + optional_policy(` +- udev_read_db(NetworkManager_t) ++ seutil_sigchld_newrole(NetworkManager_t) ') optional_policy(` -+ unconfined_rw_pipes(NetworkManager_t) - # Read gnome-keyring - unconfined_read_home_content_files(NetworkManager_t) -+ unconfined_use_terminals(NetworkManager_t) +- # Read gnome-keyring +- unconfined_read_home_content_files(NetworkManager_t) ++ udev_read_db(NetworkManager_t) ') optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.8/policy/modules/services/nis.fc --- nsaserefpolicy/policy/modules/services/nis.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nis.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/nis.fc 2008-04-04 16:11:03.000000000 -0400 @@ -4,6 +4,7 @@ /sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0) @@ -11014,7 +12712,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. /usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.8/policy/modules/services/nis.if --- nsaserefpolicy/policy/modules/services/nis.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nis.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/nis.if 2008-04-04 16:11:03.000000000 -0400 @@ -49,8 +49,8 @@ corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) @@ -11056,7 +12754,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.8/policy/modules/services/nis.te --- nsaserefpolicy/policy/modules/services/nis.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nis.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/nis.te 2008-04-04 16:11:03.000000000 -0400 @@ -113,6 +113,18 @@ userdom_dontaudit_use_unpriv_user_fds(ypbind_t) userdom_dontaudit_search_sysadm_home_dirs(ypbind_t) @@ -11115,7 +12813,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_tcp_connect_all_ports(ypxfr_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.fc serefpolicy-3.0.8/policy/modules/services/nscd.fc --- nsaserefpolicy/policy/modules/services/nscd.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nscd.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/nscd.fc 2008-04-04 16:11:03.000000000 -0400 @@ -9,3 +9,6 @@ /var/run/\.nscd_socket -s gen_context(system_u:object_r:nscd_var_run_t,s0) @@ -11125,7 +12823,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.0.8/policy/modules/services/nscd.if --- nsaserefpolicy/policy/modules/services/nscd.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nscd.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/nscd.if 2008-04-04 16:11:03.000000000 -0400 @@ -70,14 +70,15 @@ interface(`nscd_socket_use',` gen_require(` @@ -11169,7 +12867,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.8/policy/modules/services/nscd.te --- nsaserefpolicy/policy/modules/services/nscd.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nscd.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/nscd.te 2008-04-04 16:11:03.000000000 -0400 @@ -23,19 +23,22 @@ type nscd_log_t; logging_log_file(nscd_log_t) @@ -11237,7 +12935,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.0.8/policy/modules/services/ntp.fc --- nsaserefpolicy/policy/modules/services/ntp.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ntp.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ntp.fc 2008-04-04 16:11:03.000000000 -0400 @@ -17,3 +17,8 @@ /var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0) @@ -11249,7 +12947,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. +/etc/rc\.d/init\.d/ntpd -- gen_context(system_u:object_r:ntpd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.if serefpolicy-3.0.8/policy/modules/services/ntp.if --- nsaserefpolicy/policy/modules/services/ntp.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ntp.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ntp.if 2008-04-04 16:11:03.000000000 -0400 @@ -53,3 +53,59 @@ corecmd_search_bin($1) domtrans_pattern($1,ntpdate_exec_t,ntpd_t) @@ -11312,7 +13010,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.8/policy/modules/services/ntp.te --- nsaserefpolicy/policy/modules/services/ntp.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ntp.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ntp.te 2008-04-04 16:11:03.000000000 -0400 @@ -25,6 +25,12 @@ type ntpdate_exec_t; init_system_domain(ntpd_t,ntpdate_exec_t) @@ -11373,9 +13071,123 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. logrotate_exec(ntpd_t) ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.fc serefpolicy-3.0.8/policy/modules/services/nx.fc +--- nsaserefpolicy/policy/modules/services/nx.fc 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/nx.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -1,3 +1,5 @@ ++ ++/usr/libexec/nx/nxserver -- gen_context(system_u:object_r:nx_server_exec_t,s0) + /opt/NX/bin/nxserver -- gen_context(system_u:object_r:nx_server_exec_t,s0) + + /opt/NX/home/nx/\.ssh(/.*)? gen_context(system_u:object_r:nx_server_home_ssh_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.fc serefpolicy-3.0.8/policy/modules/services/oddjob.fc +--- nsaserefpolicy/policy/modules/services/oddjob.fc 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/oddjob.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -1,5 +1,5 @@ +-/usr/lib/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0) ++/usr/lib(64)?/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0) + + /usr/sbin/oddjobd -- gen_context(system_u:object_r:oddjob_exec_t,s0) + +-/var/run/oddjobd.pid gen_context(system_u:object_r:oddjob_var_run_t,s0) ++/var/run/oddjobd\.pid gen_context(system_u:object_r:oddjob_var_run_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.if serefpolicy-3.0.8/policy/modules/services/oddjob.if +--- nsaserefpolicy/policy/modules/services/oddjob.if 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/oddjob.if 2008-04-04 16:11:03.000000000 -0400 +@@ -44,6 +44,7 @@ + ') + + domtrans_pattern(oddjob_t, $2, $1) ++ domain_user_exemption_target($1) + ') + + ######################################## +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-3.0.8/policy/modules/services/oddjob.te +--- nsaserefpolicy/policy/modules/services/oddjob.te 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/oddjob.te 2008-04-04 16:11:03.000000000 -0400 +@@ -1,5 +1,5 @@ + +-policy_module(oddjob,1.3.0) ++policy_module(oddjob,1.4.0) + + ######################################## + # +@@ -10,14 +10,20 @@ + type oddjob_exec_t; + domain_type(oddjob_t) + init_daemon_domain(oddjob_t, oddjob_exec_t) ++domain_obj_id_change_exemption(oddjob_t) + domain_subj_id_change_exemption(oddjob_t) + + type oddjob_mkhomedir_t; + type oddjob_mkhomedir_exec_t; + domain_type(oddjob_mkhomedir_t) +-init_daemon_domain(oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t) ++domain_obj_id_change_exemption(oddjob_mkhomedir_t) ++init_system_domain(oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t) + oddjob_system_entry(oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t) + ++ifdef(`enable_mcs',` ++ init_ranged_daemon_domain(oddjob_t,oddjob_exec_t,s0 - mcs_systemhigh) ++') ++ + # pid files + type oddjob_var_run_t; + files_pid_file(oddjob_var_run_t) +@@ -56,7 +62,6 @@ + + optional_policy(` + dbus_system_bus_client_template(oddjob,oddjob_t) +- dbus_send_system_bus(oddjob_t) + dbus_connect_system_bus(oddjob_t) + ') + +@@ -69,20 +74,38 @@ + # oddjob_mkhomedir local policy + # + ++allow oddjob_mkhomedir_t self:capability { chown fowner fsetid dac_override }; ++allow oddjob_mkhomedir_t self:process setfscreate; + allow oddjob_mkhomedir_t self:fifo_file { read write }; + allow oddjob_mkhomedir_t self:unix_stream_socket create_stream_socket_perms; + + files_read_etc_files(oddjob_mkhomedir_t) + ++kernel_read_system_state(oddjob_mkhomedir_t) ++ ++auth_use_nsswitch(oddjob_mkhomedir_t) ++ + libs_use_ld_so(oddjob_mkhomedir_t) + libs_use_shared_libs(oddjob_mkhomedir_t) + ++logging_send_syslog_msg(oddjob_mkhomedir_t) ++ + miscfiles_read_localization(oddjob_mkhomedir_t) + ++selinux_get_fs_mount(oddjob_mkhomedir_t) ++selinux_validate_context(oddjob_mkhomedir_t) ++selinux_compute_access_vector(oddjob_mkhomedir_t) ++selinux_compute_create_context(oddjob_mkhomedir_t) ++selinux_compute_relabel_context(oddjob_mkhomedir_t) ++selinux_compute_user_contexts(oddjob_mkhomedir_t) ++ ++seutil_read_config(oddjob_mkhomedir_t) ++seutil_read_file_contexts(oddjob_mkhomedir_t) ++seutil_read_default_contexts(oddjob_mkhomedir_t) ++ + # Add/remove user home directories ++userdom_manage_unpriv_users_home_content_dirs(oddjob_mkhomedir_t) + userdom_home_filetrans_generic_user_home_dir(oddjob_mkhomedir_t) +-userdom_manage_generic_user_home_content_dirs(oddjob_mkhomedir_t) +-userdom_manage_generic_user_home_content_files(oddjob_mkhomedir_t) +-userdom_manage_generic_user_home_dirs(oddjob_mkhomedir_t) +-userdom_manage_staff_home_dirs(oddjob_mkhomedir_t) ++userdom_manage_all_users_home_content_dirs(oddjob_mkhomedir_t) ++userdom_manage_all_users_home_content_files(oddjob_mkhomedir_t) + userdom_generic_user_home_dir_filetrans_generic_user_home_content(oddjob_mkhomedir_t,notdevfile_class_set) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-3.0.8/policy/modules/services/openct.te --- nsaserefpolicy/policy/modules/services/openct.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/openct.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/openct.te 2008-04-04 16:11:03.000000000 -0400 @@ -22,6 +22,7 @@ allow openct_t self:process signal_perms; @@ -11386,7 +13198,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open kernel_read_kernel_sysctls(openct_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.fc serefpolicy-3.0.8/policy/modules/services/openvpn.fc --- nsaserefpolicy/policy/modules/services/openvpn.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/openvpn.fc 2007-12-04 11:28:30.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/openvpn.fc 2008-04-04 16:11:03.000000000 -0400 @@ -11,5 +11,5 @@ # # /var @@ -11396,7 +13208,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open /var/run/openvpn(/.*)? gen_context(system_u:object_r:openvpn_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.8/policy/modules/services/openvpn.te --- nsaserefpolicy/policy/modules/services/openvpn.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/openvpn.te 2008-01-08 12:10:23.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/openvpn.te 2008-04-04 16:11:03.000000000 -0400 @@ -35,7 +35,7 @@ # openvpn local policy # @@ -11440,7 +13252,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-3.0.8/policy/modules/services/pcscd.te --- nsaserefpolicy/policy/modules/services/pcscd.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/pcscd.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/pcscd.te 2008-04-04 16:11:03.000000000 -0400 @@ -45,6 +45,7 @@ files_read_etc_files(pcscd_t) files_read_etc_runtime_files(pcscd_t) @@ -11451,7 +13263,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcsc libs_use_ld_so(pcscd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.8/policy/modules/services/pegasus.if --- nsaserefpolicy/policy/modules/services/pegasus.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/pegasus.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/pegasus.if 2008-04-04 16:11:03.000000000 -0400 @@ -1 +1,19 @@ ## The Open Group Pegasus CIM/WBEM Server. + @@ -11474,7 +13286,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.8/policy/modules/services/pegasus.te --- nsaserefpolicy/policy/modules/services/pegasus.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/pegasus.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/pegasus.te 2008-04-04 16:11:03.000000000 -0400 @@ -42,6 +42,7 @@ allow pegasus_t pegasus_conf_t:file { read_file_perms link unlink }; allow pegasus_t pegasus_conf_t:lnk_file read_lnk_file_perms; @@ -11524,7 +13336,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portmap.te serefpolicy-3.0.8/policy/modules/services/portmap.te --- nsaserefpolicy/policy/modules/services/portmap.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/portmap.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/portmap.te 2008-04-04 16:11:03.000000000 -0400 @@ -63,6 +63,7 @@ # portmap binds to arbitary ports corenet_tcp_bind_generic_port(portmap_t) @@ -11535,7 +13347,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port corenet_dontaudit_tcp_bind_all_reserved_ports(portmap_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.8/policy/modules/services/portslave.te --- nsaserefpolicy/policy/modules/services/portslave.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/portslave.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/portslave.te 2008-04-04 16:11:03.000000000 -0400 @@ -85,6 +85,7 @@ auth_rw_login_records(portslave_t) @@ -11546,7 +13358,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.8/policy/modules/services/postfix.fc --- nsaserefpolicy/policy/modules/services/postfix.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postfix.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/postfix.fc 2008-04-04 16:11:03.000000000 -0400 @@ -14,6 +14,7 @@ /usr/libexec/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0) /usr/libexec/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0) @@ -11565,7 +13377,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post /usr/sbin/postkick -- gen_context(system_u:object_r:postfix_master_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.8/policy/modules/services/postfix.if --- nsaserefpolicy/policy/modules/services/postfix.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postfix.if 2007-12-06 11:05:10.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/postfix.if 2008-04-04 16:11:03.000000000 -0400 @@ -41,6 +41,8 @@ allow postfix_$1_t self:unix_stream_socket connectto; @@ -11604,7 +13416,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ') ######################################## -@@ -269,6 +269,42 @@ +@@ -211,9 +211,8 @@ + type postfix_etc_t; + ') + +- allow $1 postfix_etc_t:dir { getattr read search }; +- allow $1 postfix_etc_t:file { read getattr }; +- allow $1 postfix_etc_t:lnk_file { getattr read }; ++ read_files_pattern($1, postfix_etc_t, postfix_etc_t) ++ read_lnk_files_pattern($1, postfix_etc_t, postfix_etc_t) + files_search_etc($1) + ') + +@@ -269,6 +268,42 @@ ######################################## ## @@ -11647,7 +13471,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ## Do not audit attempts to use ## postfix master process file ## file descriptors. -@@ -434,6 +470,25 @@ +@@ -434,6 +469,25 @@ ######################################## ## @@ -11673,7 +13497,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ## Execute postfix user mail programs ## in their respective domains. ## -@@ -450,3 +505,41 @@ +@@ -450,3 +504,61 @@ typeattribute $1 postfix_user_domtrans; ') @@ -11715,9 +13539,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post + allow $1 postfix_private_t:dir list_dir_perms; + manage_sock_files_pattern($1,postfix_private_t,postfix_private_t) +') ++ ++ ++######################################## ++## ++## Manage postfix mail spool files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`postfix_manage_spool_files',` ++ gen_require(` ++ type postfix_spool_t; ++ ') ++ ++ files_search_spool($1) ++ manage_files_pattern($1,postfix_spool_t, postfix_spool_t) ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.8/policy/modules/services/postfix.te --- nsaserefpolicy/policy/modules/services/postfix.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postfix.te 2007-12-31 14:17:40.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/postfix.te 2008-04-23 15:05:45.000000000 -0400 @@ -6,6 +6,14 @@ # Declarations # @@ -11738,7 +13582,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post mta_mailserver_delivery(postfix_local_t) +tunable_policy(`allow_postfix_local_write_mail_spool', ` -+ mta_rw_spool(postfix_local_t) ++ mta_manage_spool(postfix_local_t) +') + type postfix_local_tmp_t; @@ -11800,16 +13644,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ') ########################################################### -@@ -263,6 +288,8 @@ +@@ -238,6 +263,10 @@ - files_read_etc_files(postfix_local_t) + corecmd_exec_bin(postfix_cleanup_t) -+logging_dontaudit_search_logs(postfix_local_t) ++optional_policy(` ++ mailman_read_data_files(postfix_cleanup_t) ++') + - mta_read_aliases(postfix_local_t) + ######################################## + # + # Postfix local local policy +@@ -263,6 +292,8 @@ + + files_read_etc_files(postfix_local_t) + ++logging_dontaudit_search_logs(postfix_local_t) ++ + mta_read_aliases(postfix_local_t) mta_delete_spool(postfix_local_t) # For reading spamassasin -@@ -275,6 +302,8 @@ +@@ -270,11 +301,14 @@ + + optional_policy(` + clamav_search_lib(postfix_local_t) ++ clamav_exec_clamscan(postfix_local_t) + ') + optional_policy(` # for postalias mailman_manage_data_files(postfix_local_t) @@ -11818,7 +13679,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ') optional_policy(` -@@ -327,6 +356,8 @@ +@@ -327,6 +361,8 @@ files_read_etc_runtime_files(postfix_map_t) files_dontaudit_search_var(postfix_map_t) @@ -11827,7 +13688,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post libs_use_ld_so(postfix_map_t) libs_use_shared_libs(postfix_map_t) -@@ -334,10 +365,6 @@ +@@ -334,10 +370,6 @@ miscfiles_read_localization(postfix_map_t) @@ -11838,7 +13699,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post tunable_policy(`read_default_t',` files_list_default(postfix_map_t) files_read_default_files(postfix_map_t) -@@ -350,10 +377,6 @@ +@@ -350,10 +382,6 @@ locallogin_dontaudit_use_fds(postfix_map_t) ') @@ -11849,7 +13710,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ######################################## # # Postfix pickup local policy -@@ -377,7 +400,7 @@ +@@ -377,7 +405,7 @@ # Postfix pipe local policy # @@ -11858,7 +13719,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post write_sock_files_pattern(postfix_pipe_t,postfix_private_t,postfix_private_t) -@@ -386,6 +409,10 @@ +@@ -386,6 +414,10 @@ rw_files_pattern(postfix_pipe_t,postfix_spool_t,postfix_spool_t) optional_policy(` @@ -11869,7 +13730,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post procmail_domtrans(postfix_pipe_t) ') -@@ -394,6 +421,10 @@ +@@ -394,6 +426,10 @@ ') optional_policy(` @@ -11880,7 +13741,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post uucp_domtrans_uux(postfix_pipe_t) ') -@@ -418,14 +449,17 @@ +@@ -418,14 +454,17 @@ term_dontaudit_use_all_user_ptys(postfix_postdrop_t) term_dontaudit_use_all_user_ttys(postfix_postdrop_t) @@ -11900,7 +13761,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post optional_policy(` ppp_use_fds(postfix_postqueue_t) ppp_sigchld(postfix_postqueue_t) -@@ -454,8 +488,6 @@ +@@ -454,8 +493,6 @@ init_sigchld_script(postfix_postqueue_t) init_use_script_fds(postfix_postqueue_t) @@ -11909,7 +13770,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ######################################## # # Postfix qmgr local policy -@@ -498,15 +530,11 @@ +@@ -498,15 +535,11 @@ term_use_all_user_ptys(postfix_showq_t) term_use_all_user_ttys(postfix_showq_t) @@ -11925,7 +13786,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post # connect to master process stream_connect_pattern(postfix_smtp_t,{ postfix_private_t postfix_public_t },{ postfix_private_t postfix_public_t },postfix_master_t) -@@ -514,6 +542,8 @@ +@@ -514,6 +547,8 @@ allow postfix_smtp_t postfix_spool_t:file rw_file_perms; @@ -11934,7 +13795,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post optional_policy(` cyrus_stream_connect(postfix_smtp_t) ') -@@ -538,9 +568,45 @@ +@@ -538,9 +573,45 @@ mta_read_aliases(postfix_smtpd_t) optional_policy(` @@ -11966,7 +13827,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +files_tmp_filetrans(postfix_virtual_t, postfix_virtual_tmp_t, { file dir }) + +# connect to master process -+stream_connect_pattern(postfix_virtual_t,postfix_public_t,postfix_public_t,postfix_master_t) ++stream_connect_pattern(postfix_virtual_t,{ postfix_private_t postfix_public_t },{ postfix_private_t postfix_public_t },postfix_master_t) + +allow postfix_virtual_t postfix_spool_t:file rw_file_perms; + @@ -11982,7 +13843,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +mta_manage_spool(postfix_virtual_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.fc serefpolicy-3.0.8/policy/modules/services/postgresql.fc --- nsaserefpolicy/policy/modules/services/postgresql.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postgresql.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/postgresql.fc 2008-04-04 16:11:03.000000000 -0400 @@ -38,3 +38,5 @@ ') @@ -11991,7 +13852,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +/etc/rc\.d/init\.d/postgresql -- gen_context(system_u:object_r:postgresql_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.0.8/policy/modules/services/postgresql.if --- nsaserefpolicy/policy/modules/services/postgresql.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postgresql.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/postgresql.if 2008-04-04 16:11:03.000000000 -0400 @@ -113,3 +113,77 @@ # Some versions of postgresql put the sock file in /tmp allow $1 postgresql_tmp_t:sock_file write; @@ -12072,7 +13933,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.0.8/policy/modules/services/postgresql.te --- nsaserefpolicy/policy/modules/services/postgresql.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postgresql.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/postgresql.te 2008-04-04 16:11:03.000000000 -0400 @@ -27,6 +27,9 @@ type postgresql_var_run_t; files_pid_file(postgresql_var_run_t) @@ -12091,7 +13952,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post manage_dirs_pattern(postgresql_t,postgresql_db_t,postgresql_db_t) manage_files_pattern(postgresql_t,postgresql_db_t,postgresql_db_t) -@@ -118,6 +120,8 @@ +@@ -101,6 +103,7 @@ + + fs_getattr_all_fs(postgresql_t) + fs_search_auto_mountpoints(postgresql_t) ++fs_rw_hugetlbfs_files(postgresql_t) + + term_use_controlling_term(postgresql_t) + +@@ -118,6 +121,8 @@ init_read_utmp(postgresql_t) @@ -12100,7 +13969,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post libs_use_ld_so(postgresql_t) libs_use_shared_libs(postgresql_t) -@@ -127,9 +131,6 @@ +@@ -127,9 +132,6 @@ seutil_dontaudit_search_config(postgresql_t) @@ -12110,7 +13979,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post userdom_dontaudit_search_sysadm_home_dirs(postgresql_t) userdom_dontaudit_use_sysadm_ttys(postgresql_t) userdom_dontaudit_use_unpriv_user_fds(postgresql_t) -@@ -158,10 +159,6 @@ +@@ -158,10 +160,6 @@ ') optional_policy(` @@ -12121,10 +13990,45 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post seutil_sigchld_newrole(postgresql_t) ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgrey.fc serefpolicy-3.0.8/policy/modules/services/postgrey.fc +--- nsaserefpolicy/policy/modules/services/postgrey.fc 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/postgrey.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -7,3 +7,5 @@ + + /var/run/postgrey(/.*)? gen_context(system_u:object_r:postgrey_var_run_t,s0) + /var/run/postgrey\.pid -- gen_context(system_u:object_r:postgrey_var_run_t,s0) ++ ++/var/spool/postfix/postgrey(/.*)? gen_context(system_u:object_r:postgrey_spool_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgrey.if serefpolicy-3.0.8/policy/modules/services/postgrey.if +--- nsaserefpolicy/policy/modules/services/postgrey.if 2007-10-22 13:21:36.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/postgrey.if 2008-04-14 10:39:57.000000000 -0400 +@@ -12,10 +12,11 @@ + # + interface(`postgrey_stream_connect',` + gen_require(` +- type postgrey_var_run_t, postgrey_t; ++ type postgrey_var_run_t, postgrey_t, postgrey_spool_t; + ') + + allow $1 postgrey_t:unix_stream_socket connectto; + allow $1 postgrey_var_run_t:sock_file write; ++ allow $1 postgrey_spool_t:sock_file write; + files_search_pids($1) + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgrey.te serefpolicy-3.0.8/policy/modules/services/postgrey.te --- nsaserefpolicy/policy/modules/services/postgrey.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postgrey.te 2008-01-08 16:14:31.000000000 -0500 -@@ -24,7 +24,7 @@ ++++ serefpolicy-3.0.8/policy/modules/services/postgrey.te 2008-04-14 10:40:08.000000000 -0400 +@@ -13,6 +13,9 @@ + type postgrey_etc_t; + files_config_file(postgrey_etc_t) + ++type postgrey_spool_t; ++files_type(postgrey_spool_t) ++ + type postgrey_var_lib_t; + files_type(postgrey_var_lib_t) + +@@ -24,15 +27,21 @@ # Local policy # @@ -12133,7 +14037,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post dontaudit postgrey_t self:capability sys_tty_config; allow postgrey_t self:process signal_perms; allow postgrey_t self:tcp_socket create_stream_socket_perms; -@@ -68,6 +68,8 @@ ++allow postgrey_t self:fifo_file create_fifo_file_perms; + + allow postgrey_t postgrey_etc_t:dir list_dir_perms; + read_files_pattern(postgrey_t,postgrey_etc_t,postgrey_etc_t) + read_lnk_files_pattern(postgrey_t,postgrey_etc_t,postgrey_etc_t) + ++manage_dirs_pattern(postgrey_t,postgrey_spool_t,postgrey_spool_t) ++manage_files_pattern(postgrey_t,postgrey_spool_t,postgrey_spool_t) ++manage_fifo_files_pattern(postgrey_t,postgrey_spool_t,postgrey_spool_t) ++manage_sock_files_pattern(postgrey_t,postgrey_spool_t,postgrey_spool_t) ++ + manage_files_pattern(postgrey_t,postgrey_var_lib_t,postgrey_var_lib_t) + files_var_lib_filetrans(postgrey_t,postgrey_var_lib_t,file) + +@@ -68,6 +77,8 @@ fs_getattr_all_fs(postgrey_t) fs_search_auto_mountpoints(postgrey_t) @@ -12142,7 +14060,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post libs_use_ld_so(postgrey_t) libs_use_shared_libs(postgrey_t) -@@ -75,13 +77,12 @@ +@@ -75,13 +86,12 @@ miscfiles_read_localization(postgrey_t) @@ -12154,13 +14072,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post optional_policy(` - nis_use_ypbind(postgrey_t) + postfix_read_config(postgrey_t) -+ postfix_read_spool_files(postgrey_t) ++ postfix_manage_spool_files(postgrey_t) ') optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.fc serefpolicy-3.0.8/policy/modules/services/ppp.fc --- nsaserefpolicy/policy/modules/services/ppp.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ppp.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ppp.fc 2008-04-04 16:11:03.000000000 -0400 @@ -25,7 +25,7 @@ # # /var @@ -12172,7 +14090,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. # Fix pptp sockets diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.if serefpolicy-3.0.8/policy/modules/services/ppp.if --- nsaserefpolicy/policy/modules/services/ppp.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ppp.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ppp.if 2008-04-04 16:11:03.000000000 -0400 @@ -159,6 +159,25 @@ ######################################## @@ -12201,7 +14119,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.0.8/policy/modules/services/ppp.te --- nsaserefpolicy/policy/modules/services/ppp.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ppp.te 2007-12-31 17:29:52.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ppp.te 2008-04-04 16:11:03.000000000 -0400 @@ -197,11 +197,7 @@ ') @@ -12215,10 +14133,364 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. ') optional_policy(` +@@ -221,6 +217,7 @@ + # PPTP Local policy + # + ++allow pptp_t self:process signal; + dontaudit pptp_t self:capability sys_tty_config; + allow pptp_t self:capability net_raw; + allow pptp_t self:fifo_file { read write }; +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.fc serefpolicy-3.0.8/policy/modules/services/prelude.fc +--- nsaserefpolicy/policy/modules/services/prelude.fc 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/prelude.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -0,0 +1,13 @@ ++ ++/sbin/audisp-prelude -- gen_context(system_u:object_r:audisp_prelude_exec_t,s0) ++ ++/usr/bin/prelude-manager -- gen_context(system_u:object_r:prelude_exec_t,s0) ++ ++/etc/rc.d/init.d/prelude-manager -- gen_context(system_u:object_r:prelude_script_exec_t,s0) ++ ++/var/lib/prelude-lml(/.*)? gen_context(system_u:object_r:prelude_var_lib_t,s0) ++ ++/var/run/prelude-manager(/.*)? gen_context(system_u:object_r:prelude_var_run_t,s0) ++/var/spool/prelude-manager(/.*)? gen_context(system_u:object_r:prelude_spool_t,s0) ++/var/spool/prelude(/.*)? gen_context(system_u:object_r:prelude_spool_t,s0) ++/usr/share/prewikka/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_prewikka_script_exec_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.if serefpolicy-3.0.8/policy/modules/services/prelude.if +--- nsaserefpolicy/policy/modules/services/prelude.if 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/prelude.if 2008-04-04 16:11:03.000000000 -0400 +@@ -0,0 +1,128 @@ ++ ++## policy for prelude ++ ++######################################## ++## ++## Execute a domain transition to run prelude. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`prelude_domtrans',` ++ gen_require(` ++ type prelude_t; ++ type prelude_exec_t; ++ ') ++ ++ domtrans_pattern($1,prelude_exec_t,prelude_t) ++') ++ ++ ++######################################## ++## ++## Execute prelude server in the prelude domain. ++## ++## ++## ++## The type of the process performing this action. ++## ++## ++# ++interface(`prelude_script_domtrans',` ++ gen_require(` ++ type prelude_script_exec_t; ++ ') ++ ++ init_script_domtrans_spec($1,prelude_script_exec_t) ++') ++ ++######################################## ++## ++## All of the rules required to administrate ++## an prelude environment ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++## ++## The role to be allowed to manage the syslog domain. ++## ++## ++## ++## ++## The type of the user terminal. ++## ++## ++## ++# ++interface(`prelude_admin',` ++ gen_require(` ++ type prelude_t; ++ type prelude_spool_t; ++ type prelude_var_run_t; ++ type prelude_var_lib_t; ++ type prelude_script_exec_t; ++ type audisp_prelude_t; ++ type audisp_prelude_var_run_t; ++ ') ++ ++ allow $1 prelude_t:process { ptrace signal_perms getattr }; ++ read_files_pattern($1, prelude_t, prelude_t) ++ ++ allow $1 audisp_prelude_t:process { ptrace signal_perms getattr }; ++ read_files_pattern($1, audisp_prelude_t, audisp_prelude_t) ++ ++ # Allow prelude_t to restart the apache service ++ prelude_script_domtrans($1) ++ domain_system_change_exemption($1) ++ role_transition $2 prelude_script_exec_t system_r; ++ allow $2 system_r; ++ ++ manage_all_pattern($1, prelude_spool_t) ++ manage_all_pattern($1, prelude_var_lib_t) ++ manage_all_pattern($1, prelude_var_run_t) ++ manage_all_pattern($1, audisp_prelude_var_run_t) ++') ++ ++######################################## ++## ++## Execute a domain transition to run audisp_prelude. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`audisp_prelude_domtrans',` ++ gen_require(` ++ type audisp_prelude_t; ++ type audisp_prelude_exec_t; ++ ') ++ ++ domtrans_pattern($1,audisp_prelude_exec_t,audisp_prelude_t) ++') ++ ++######################################## ++## ++## Signal the audisp_prelude domain. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`audisp_prelude_signal',` ++ gen_require(` ++ type audisp_prelude_t; ++ ') ++ ++ allow $1 audisp_prelude_t:process signal; ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.0.8/policy/modules/services/prelude.te +--- nsaserefpolicy/policy/modules/services/prelude.te 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/prelude.te 2008-04-04 16:11:03.000000000 -0400 +@@ -0,0 +1,162 @@ ++policy_module(prelude,1.0.0) ++ ++######################################## ++# ++# Declarations ++# ++ ++type prelude_t; ++type prelude_exec_t; ++domain_type(prelude_t) ++init_daemon_domain(prelude_t, prelude_exec_t) ++ ++type prelude_spool_t; ++files_type(prelude_spool_t) ++ ++type prelude_var_run_t; ++files_pid_file(prelude_var_run_t) ++ ++type prelude_var_lib_t; ++files_type(prelude_var_lib_t) ++ ++type prelude_script_exec_t; ++init_script_type(prelude_script_exec_t) ++ ++type audisp_prelude_t; ++type audisp_prelude_exec_t; ++domain_type(audisp_prelude_t) ++init_daemon_domain(audisp_prelude_t, audisp_prelude_exec_t) ++ ++type audisp_prelude_var_run_t; ++files_pid_file(audisp_prelude_var_run_t) ++ ++######################################## ++# ++# prelude local policy ++# ++ ++# Init script handling ++domain_use_interactive_fds(prelude_t) ++ ++allow prelude_t self:capability sys_tty_config; ++ ++# internal communication is often done using fifo and unix sockets. ++allow prelude_t self:fifo_file rw_file_perms; ++allow prelude_t self:unix_stream_socket create_stream_socket_perms; ++ ++allow prelude_t self:netlink_route_socket r_netlink_socket_perms; ++allow prelude_t self:tcp_socket create_stream_socket_perms; ++ ++dev_read_rand(prelude_t) ++dev_read_urand(prelude_t) ++ ++manage_files_pattern(prelude_t, prelude_var_run_t, prelude_var_run_t) ++manage_sock_files_pattern(prelude_t, prelude_var_run_t, prelude_var_run_t) ++files_pid_filetrans(prelude_t, prelude_var_run_t, file) ++ ++files_read_etc_files(prelude_t) ++files_read_usr_files(prelude_t) ++ ++files_search_var_lib(prelude_t) ++manage_dirs_pattern(prelude_t,prelude_var_lib_t,prelude_var_lib_t) ++manage_files_pattern(prelude_t,prelude_var_lib_t,prelude_var_lib_t) ++ ++files_search_spool(prelude_t) ++manage_dirs_pattern(prelude_t,prelude_spool_t,prelude_spool_t) ++manage_files_pattern(prelude_t,prelude_spool_t,prelude_spool_t) ++ ++auth_use_nsswitch(prelude_t) ++ ++libs_use_ld_so(prelude_t) ++libs_use_shared_libs(prelude_t) ++ ++logging_send_audit_msgs(prelude_t) ++logging_send_syslog_msg(prelude_t) ++ ++miscfiles_read_localization(prelude_t) ++ ++corenet_all_recvfrom_unlabeled(prelude_t) ++corenet_all_recvfrom_netlabel(prelude_t) ++corenet_tcp_sendrecv_all_if(prelude_t) ++corenet_tcp_sendrecv_all_nodes(prelude_t) ++corenet_tcp_bind_all_nodes(prelude_t) ++corenet_tcp_bind_prelude_port(prelude_t) ++corenet_tcp_connect_prelude_port(prelude_t) ++ ++corecmd_search_bin(prelude_t) ++ ++optional_policy(` ++ mysql_search_db(prelude_t) ++ mysql_stream_connect(prelude_t) ++') ++ ++optional_policy(` ++ postgresql_stream_connect(prelude_t) ++') ++ ++######################################## ++# ++# audisp_prelude local policy ++# ++ ++# Init script handling ++domain_use_interactive_fds(audisp_prelude_t) ++ ++# internal communication is often done using fifo and unix sockets. ++allow audisp_prelude_t self:fifo_file rw_file_perms; ++allow audisp_prelude_t self:unix_stream_socket create_stream_socket_perms; ++allow audisp_prelude_t self:netlink_route_socket r_netlink_socket_perms; ++allow audisp_prelude_t self:tcp_socket create_socket_perms; ++ ++manage_sock_files_pattern(audisp_prelude_t, audisp_prelude_var_run_t, audisp_prelude_var_run_t) ++files_pid_filetrans(audisp_prelude_t, audisp_prelude_var_run_t, sock_file) ++ ++dev_read_rand(audisp_prelude_t) ++dev_read_urand(audisp_prelude_t) ++ ++files_read_etc_files(audisp_prelude_t) ++ ++libs_use_ld_so(audisp_prelude_t) ++libs_use_shared_libs(audisp_prelude_t) ++ ++logging_send_syslog_msg(audisp_prelude_t) ++ ++miscfiles_read_localization(audisp_prelude_t) ++ ++corecmd_search_bin(audisp_prelude_t) ++allow audisp_prelude_t self:unix_dgram_socket create_socket_perms; ++ ++logging_audisp_system_domain(audisp_prelude_t, audisp_prelude_exec_t) ++ ++files_search_spool(audisp_prelude_t) ++manage_dirs_pattern(audisp_prelude_t,prelude_spool_t,prelude_spool_t) ++manage_files_pattern(audisp_prelude_t,prelude_spool_t,prelude_spool_t) ++ ++corenet_all_recvfrom_unlabeled(audisp_prelude_t) ++corenet_all_recvfrom_netlabel(audisp_prelude_t) ++corenet_tcp_sendrecv_all_if(audisp_prelude_t) ++corenet_tcp_sendrecv_all_nodes(audisp_prelude_t) ++corenet_tcp_bind_all_nodes(audisp_prelude_t) ++corenet_tcp_connect_prelude_port(audisp_prelude_t) ++ ++allow audisp_prelude_t audisp_t:unix_stream_socket rw_socket_perms; ++ ++######################################## ++# ++# prewikka_cgi Declarations ++# ++ ++optional_policy(` ++ apache_content_template(prewikka) ++ files_read_etc_files(httpd_prewikka_script_t) ++ ++ optional_policy(` ++ mysql_search_db(httpd_prewikka_script_t) ++ mysql_stream_connect(httpd_prewikka_script_t) ++ ') ++ ++ optional_policy(` ++ postgresql_stream_connect(httpd_prewikka_script_t) ++ ') ++') ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/privoxy.fc serefpolicy-3.0.8/policy/modules/services/privoxy.fc +--- nsaserefpolicy/policy/modules/services/privoxy.fc 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/privoxy.fc 2008-04-08 08:26:27.000000000 -0400 +@@ -1,6 +1,8 @@ + + /etc/privoxy/user\.action -- gen_context(system_u:object_r:privoxy_etc_rw_t,s0) + ++/etc/privoxy/default\.action -- gen_context(system_u:object_r:privoxy_etc_rw_t,s0) ++ + /usr/sbin/privoxy -- gen_context(system_u:object_r:privoxy_exec_t,s0) + + /var/log/privoxy(/.*)? gen_context(system_u:object_r:privoxy_log_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/privoxy.te serefpolicy-3.0.8/policy/modules/services/privoxy.te +--- nsaserefpolicy/policy/modules/services/privoxy.te 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/privoxy.te 2008-04-09 08:36:50.000000000 -0400 +@@ -51,6 +51,7 @@ + corenet_tcp_connect_http_cache_port(privoxy_t) + corenet_tcp_connect_ftp_port(privoxy_t) + corenet_tcp_connect_tor_port(privoxy_t) ++corenet_tcp_connect_pgpkeyserver_port(privoxy_t) + corenet_sendrecv_http_cache_client_packets(privoxy_t) + corenet_sendrecv_http_cache_server_packets(privoxy_t) + corenet_sendrecv_http_client_packets(privoxy_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.fc serefpolicy-3.0.8/policy/modules/services/procmail.fc +--- nsaserefpolicy/policy/modules/services/procmail.fc 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/procmail.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -1,2 +1,4 @@ + + /usr/bin/procmail -- gen_context(system_u:object_r:procmail_exec_t,s0) ++/var/log/procmail\.log.* -- gen_context(system_u:object_r:procmail_log_t,s0) ++/var/log/procmail(/.*)? gen_context(system_u:object_r:procmail_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.if serefpolicy-3.0.8/policy/modules/services/procmail.if --- nsaserefpolicy/policy/modules/services/procmail.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/procmail.if 2007-12-31 15:18:54.000000000 -0500 -@@ -39,3 +39,22 @@ ++++ serefpolicy-3.0.8/policy/modules/services/procmail.if 2008-04-04 16:11:03.000000000 -0400 +@@ -39,3 +39,41 @@ corecmd_search_bin($1) can_exec($1,procmail_exec_t) ') @@ -12241,10 +14513,50 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc + files_search_tmp($1) + allow $1 procmail_tmp_t:file read_file_perms; +') ++ ++######################################## ++## ++## Read/write procmail tmp files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`procmail_rw_tmp_files',` ++ gen_require(` ++ type procmail_tmp_t; ++ ') ++ ++ files_search_tmp($1) ++ rw_files_pattern($1, procmail_tmp_t, procmail_tmp_t) ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.8/policy/modules/services/procmail.te --- nsaserefpolicy/policy/modules/services/procmail.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/procmail.te 2008-01-17 08:59:43.000000000 -0500 -@@ -30,6 +30,8 @@ ++++ serefpolicy-3.0.8/policy/modules/services/procmail.te 2008-04-04 16:11:03.000000000 -0400 +@@ -14,6 +14,10 @@ + type procmail_tmp_t; + files_tmp_file(procmail_tmp_t) + ++# log files ++type procmail_log_t; ++logging_log_file(procmail_log_t) ++ + ######################################## + # + # Local policy +@@ -27,9 +31,18 @@ + allow procmail_t self:tcp_socket create_stream_socket_perms; + allow procmail_t self:udp_socket create_socket_perms; + ++# Write log to /var/log/procmail.log or /var/log/procmail/.* ++allow procmail_t procmail_log_t:dir setattr; ++create_files_pattern(procmail_t,procmail_log_t,procmail_log_t) ++append_files_pattern(procmail_t,procmail_log_t,procmail_log_t) ++read_lnk_files_pattern(procmail_t,procmail_log_t,procmail_log_t) ++logging_log_filetrans(procmail_t,procmail_log_t, { file dir }) ++ allow procmail_t procmail_tmp_t:file manage_file_perms; files_tmp_filetrans(procmail_t, procmail_tmp_t, file) @@ -12253,7 +14565,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc kernel_read_system_state(procmail_t) kernel_read_kernel_sysctls(procmail_t) -@@ -50,6 +52,7 @@ +@@ -50,11 +63,13 @@ fs_getattr_xattr_fs(procmail_t) fs_search_auto_mountpoints(procmail_t) @@ -12261,7 +14573,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc auth_use_nsswitch(procmail_t) -@@ -65,6 +68,9 @@ + corecmd_exec_bin(procmail_t) + corecmd_exec_shell(procmail_t) ++corecmd_read_bin_symlinks(procmail_t) + + files_read_etc_files(procmail_t) + files_read_etc_runtime_files(procmail_t) +@@ -65,6 +80,9 @@ libs_use_ld_so(procmail_t) libs_use_shared_libs(procmail_t) @@ -12271,7 +14589,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc miscfiles_read_localization(procmail_t) # only works until we define a different type for maildir -@@ -97,21 +103,25 @@ +@@ -97,26 +115,31 @@ ') optional_policy(` @@ -12299,7 +14617,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc ') optional_policy(` -@@ -125,7 +135,13 @@ + mta_read_config(procmail_t) + sendmail_domtrans(procmail_t) ++ sendmail_signal(procmail_t) + sendmail_rw_tcp_sockets(procmail_t) + sendmail_rw_unix_stream_sockets(procmail_t) + ') +@@ -125,7 +148,12 @@ corenet_udp_bind_generic_port(procmail_t) corenet_dontaudit_udp_bind_all_ports(procmail_t) @@ -12307,15 +14631,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc spamassassin_exec(procmail_t) spamassassin_exec_client(procmail_t) spamassassin_read_lib_files(procmail_t) -+ -+') + ') + +optional_policy(` + mailscanner_read_spool(procmail_t) - ') ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.8/policy/modules/services/pyzor.if --- nsaserefpolicy/policy/modules/services/pyzor.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/pyzor.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/pyzor.if 2008-04-04 16:11:03.000000000 -0400 @@ -25,16 +25,16 @@ # template(`pyzor_per_role_template',` @@ -12340,7 +14663,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.0.8/policy/modules/services/pyzor.te --- nsaserefpolicy/policy/modules/services/pyzor.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/pyzor.te 2007-12-31 15:18:29.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/pyzor.te 2008-04-04 16:11:03.000000000 -0400 @@ -68,6 +68,8 @@ miscfiles_read_localization(pyzor_t) @@ -12364,9 +14687,169 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo ') ######################################## +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/q serefpolicy-3.0.8/policy/modules/services/q +--- nsaserefpolicy/policy/modules/services/q 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/q 2008-04-04 16:11:03.000000000 -0400 +@@ -0,0 +1,156 @@ ++seinfo(1) seinfo(1) ++ ++ ++ ++NNAAMMEE ++ seinfo - SELinux policy query tool ++ ++SSYYNNOOPPSSIISS ++ sseeiinnffoo [OPTIONS] [EXPRESSION] [POLICY ...] ++ ++DDEESSCCRRIIPPTTIIOONN ++ sseeiinnffoo allows the user to query the components of a SELinux policy. ++ ++PPOOLLIICCYY ++ sseeiinnffoo supports loading a SELinux policy in one of four formats. ++ ++ source A single text file containing policy source for versions 12 ++ through 21. This file is usually named policy.conf. ++ ++ binary A single file containing a monolithic kernel binary policy for ++ versions 15 through 21. This file is usually named by version - ++ for example, policy.20. ++ ++ modular ++ A list of policy packages each containing a loadable policy mod- ++ ule. The first module listed must be a base module. ++ ++ policy list ++ A single text file containing all the information needed to load ++ a policy, usually exported by SETools graphical utilities. ++ ++ If no policy file is provided, sseeiinnffoo will search for the system ++ default policy: checking first for a source policy, next for a binary ++ policy matching the running kernel’s preferred version, and finally for ++ the highest version that can be found. If no policy can be found, ++ sseeiinnffoo will print an error message and exit. ++ ++EEXXPPRREESSSSIIOONNSS ++ One or more of the following component types can be queried. Each ++ option may only be specified once. If an option is provided multiple ++ times, the last instance will be used. Some components support the -x ++ flag to print expanded information about that component; if a particu- ++ lar component specified does not support expanded information, the flag ++ will be ignored for that component (see -x below). If no expressions ++ are provided, policy statistics will be printed (see --stats below). ++ ++ -c[NAME], --class[=NAME] ++ Print a list of object classes or, if NAME is provided, print ++ the object class NAME. With -x, print a list of permissions for ++ each displayed object class. ++ ++ --sensitivity[=NAME] ++ Print a list of sensitivities or, if NAME is provided, print the ++ sensitivity NAME. With -x, print the corresponding level state- ++ ment for each displayed sensitivity. ++ ++ --category[=NAME] ++ Print a list of categories or, if NAME is provided, print the ++ category NAME. With -x, print a list of sensitivities with ++ which each displayed category may be associated. ++ ++ -t[NAME], --type[=NAME] ++ Print a list of types (not including aliases or attributes) or, ++ if NAME is provided, print the type NAME. With -x, print a list ++ of attributes which include each displayed type. ++ ++ -a[NAME], --attribute[=NAME] ++ Print a list of type attributes or, if NAME is provided, print ++ the attribute NAME. With -x, print a list of types assigned to ++ each displayed attribute. ++ ++ -r[NAME], --role[=NAME] ++ Print a list of roles or, if NAME is provided, print the role ++ NAME. With -x, print a list of types assigned to each displayed ++ role. ++ ++ -u[NAME], --user[=NAME] ++ Print a list of users or, if NAME is provided, print the user ++ NAME. With -x, print a list of roles assigned to each displayed ++ user. ++ ++ -b[NAME], --bool[=NAME] ++ Print a list of conditional booleans or, if NAME is provided, ++ print the boolean NAME. With -x, print the default state of ++ each displayed conditional boolean. ++ ++ --initialsid[=NAME] ++ Print a list of initial SIDs or, if NAME is provided, print the ++ initial SID NAME. With -x, print the context assigned to each ++ displayed SID. ++ ++ --fs_use[=TYPE] ++ Print a list of fs_use statements or, if TYPE is provided, print ++ the statement for filesystem TYPE. There is no expanded infor- ++ mation for this component. ++ ++ --genfscon[=TYPE] ++ Print a list of genfscon statements or, if TYPE is provided, ++ print the statement for the filesystem TYPE. There is no ++ expanded information for this component. ++ ++ --netifcon[=NAME] ++ Print a list of netif contexts or, if NAME is provided, print ++ the statement for interface NAME. There is no expanded informa- ++ tion for this component. ++ ++ --nodecon[=ADDR] ++ Print a list of node contexts or, if ADDR is provided, print the ++ statement for the node with address ADDR. There is no expanded ++ information for this component. ++ ++ --portcon[=PORT] ++ Print a list of port contexts or, if PORT is provided, print the ++ statement for port PORT. There is no expanded information for ++ this component. ++ ++ --protocol=PROTO ++ Print only portcon statements for the protocol PROTO. This ++ option is ignored if portcon statements are not printed or if no ++ statement exists for the requested port. ++ ++ --all Print all components. ++ ++OOPPTTIIOONNSS ++ -x, --expand ++ Print additional details for each component matching the expres- ++ sion. These details include the types assigned to an attribute ++ or role and the permissions for an object class. This option is ++ not available for all component types; see the description of ++ each component for the details this option will provide. ++ ++ --stats ++ Print policy statistics including policy type and version infor- ++ mation and counts of all components and rules. ++ ++ -h, --help ++ Print help information and exit. ++ ++ -V, --version ++ Print version information and exit. ++ ++AAUUTTHHOORR ++ This manual page was written by Jeremy A. Mowery . ++ ++CCOOPPYYRRIIGGHHTT ++ Copyright(C) 2003-2007 Tresys Technology, LLC ++ ++BBUUGGSS ++ Please report bugs via an email to setools-bugs@tresys.com. ++ ++SSEEEE AALLSSOO ++ sesearch(1), apol(1) ++ ++ ++ ++ seinfo(1) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.fc serefpolicy-3.0.8/policy/modules/services/radius.fc --- nsaserefpolicy/policy/modules/services/radius.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/radius.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/radius.fc 2008-04-04 16:11:03.000000000 -0400 @@ -18,3 +18,4 @@ /var/run/radiusd(/.*)? gen_context(system_u:object_r:radiusd_var_run_t,s0) @@ -12374,7 +14857,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi +/var/lib/radiousd(/.*)? gen_context(system_u:object_r:radiusd_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.8/policy/modules/services/radius.te --- nsaserefpolicy/policy/modules/services/radius.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/radius.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/radius.te 2008-04-04 16:11:03.000000000 -0400 @@ -19,6 +19,9 @@ type radiusd_log_t; logging_log_file(radiusd_log_t) @@ -12410,9 +14893,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi corecmd_exec_bin(radiusd_t) corecmd_exec_shell(radiusd_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radvd.te serefpolicy-3.0.8/policy/modules/services/radvd.te +--- nsaserefpolicy/policy/modules/services/radvd.te 2007-10-22 13:21:36.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/radvd.te 2008-04-04 17:59:24.000000000 -0400 +@@ -27,6 +27,7 @@ + allow radvd_t self:rawip_socket create_socket_perms; + allow radvd_t self:tcp_socket create_stream_socket_perms; + allow radvd_t self:udp_socket create_socket_perms; ++allow radvd_t self:fifo_file rw_file_perms; + + allow radvd_t radvd_etc_t:file read_file_perms; + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.if serefpolicy-3.0.8/policy/modules/services/razor.if --- nsaserefpolicy/policy/modules/services/razor.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/razor.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/razor.if 2008-04-04 16:11:03.000000000 -0400 @@ -218,3 +218,41 @@ domtrans_pattern($1, razor_exec_t, razor_t) @@ -12453,11 +14947,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razo + files_search_home($2) + allow $2 $1_home_dir_t:dir search_dir_perms; + manage_files_pattern($2,$1_razor_home_t,$1_razor_home_t) ++ read_lnk_files_pattern($2,$1_razor_home_t,$1_razor_home_t) +') -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remotelogin.if serefpolicy-3.0.8/policy/modules/services/remotelogin.if --- nsaserefpolicy/policy/modules/services/remotelogin.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/remotelogin.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/remotelogin.if 2008-04-04 16:11:03.000000000 -0400 @@ -18,3 +18,20 @@ auth_domtrans_login_program($1,remote_login_t) ') @@ -12481,7 +14975,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remo +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remotelogin.te serefpolicy-3.0.8/policy/modules/services/remotelogin.te --- nsaserefpolicy/policy/modules/services/remotelogin.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/remotelogin.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/remotelogin.te 2008-04-04 16:11:03.000000000 -0400 @@ -85,6 +85,7 @@ miscfiles_read_localization(remote_login_t) @@ -12492,7 +14986,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remo # Only permit unprivileged user domains to be entered via rlogin, diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.8/policy/modules/services/rhgb.te --- nsaserefpolicy/policy/modules/services/rhgb.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rhgb.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/rhgb.te 2008-04-04 16:11:03.000000000 -0400 @@ -59,6 +59,7 @@ corenet_sendrecv_all_client_packets(rhgb_t) @@ -12543,7 +15037,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb consoletype_exec(rhgb_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.8/policy/modules/services/ricci.te --- nsaserefpolicy/policy/modules/services/ricci.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ricci.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ricci.te 2008-04-04 16:11:03.000000000 -0400 @@ -138,6 +138,7 @@ files_create_boot_flag(ricci_t) @@ -12592,7 +15086,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.8/policy/modules/services/rlogin.te --- nsaserefpolicy/policy/modules/services/rlogin.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rlogin.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/rlogin.te 2008-04-04 16:11:03.000000000 -0400 @@ -36,6 +36,8 @@ allow rlogind_t rlogind_devpts_t:chr_file { rw_chr_file_perms setattr }; term_create_pty(rlogind_t,rlogind_devpts_t) @@ -12640,35 +15134,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog -allow rlogind_t userpty_type:chr_file setattr; + kerberos_manage_host_rcache(rlogind_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.8/policy/modules/services/rpcbind.te ---- nsaserefpolicy/policy/modules/services/rpcbind.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rpcbind.te 2007-12-13 08:21:32.000000000 -0500 -@@ -21,11 +21,13 @@ - # rpcbind local policy - # - --allow rpcbind_t self:capability setuid; -+allow rpcbind_t self:capability { dac_override setuid sys_tty_config }; - allow rpcbind_t self:fifo_file rw_file_perms; - allow rpcbind_t self:unix_stream_socket create_stream_socket_perms; - allow rpcbind_t self:netlink_route_socket r_netlink_socket_perms; - allow rpcbind_t self:udp_socket create_socket_perms; -+# BROKEN ... -+dontaudit rpcbind_t self:udp_socket listen; - allow rpcbind_t self:tcp_socket create_stream_socket_perms; - - manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t) -@@ -37,6 +39,7 @@ - manage_sock_files_pattern(rpcbind_t,rpcbind_var_lib_t,rpcbind_var_lib_t) - files_var_lib_filetrans(rpcbind_t,rpcbind_var_lib_t, { file dir sock_file }) - -+kernel_read_system_state(rpcbind_t) - kernel_read_network_state(rpcbind_t) - - corenet_all_recvfrom_unlabeled(rpcbind_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.8/policy/modules/services/rpc.if --- nsaserefpolicy/policy/modules/services/rpc.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rpc.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/rpc.if 2008-04-04 16:11:03.000000000 -0400 @@ -89,8 +89,11 @@ # bind to arbitary unused ports corenet_tcp_bind_generic_port($1_t) @@ -12709,7 +15177,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.8/policy/modules/services/rpc.te --- nsaserefpolicy/policy/modules/services/rpc.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rpc.te 2008-01-08 06:23:55.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/rpc.te 2008-04-17 13:41:16.000000000 -0400 @@ -59,10 +59,14 @@ manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t) files_pid_filetrans(rpcd_t,rpcd_var_run_t,file) @@ -12726,7 +15194,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. fs_list_rpc(rpcd_t) fs_read_rpc_files(rpcd_t) -@@ -73,12 +77,21 @@ +@@ -73,12 +77,22 @@ # cjp: this should really have its own type files_manage_mounttab(rpcd_t) @@ -12745,16 +15213,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. +# automount -> mount -> rpcd +optional_policy(` + automount_dontaudit_use_fds(rpcd_t) ++ automount_dontaudit_write_pipes(rpcd_t) ') ######################################## -@@ -91,9 +104,15 @@ +@@ -91,9 +105,15 @@ allow nfsd_t exports_t:file { getattr read }; allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir list_dir_perms; +dev_dontaudit_getattr_all_blk_files(nfsd_t) +dev_dontaudit_getattr_all_chr_files(nfsd_t) -+dev_read_lvm_control(nfsd_t) ++dev_rw_lvm_control(nfsd_t) +storage_dontaudit_raw_read_fixed_disk(nfsd_t) + # for /proc/fs/nfs/exports - should we have a new type? @@ -12764,7 +15233,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. corenet_tcp_bind_all_rpc_ports(nfsd_t) corenet_udp_bind_all_rpc_ports(nfsd_t) -@@ -123,6 +142,7 @@ +@@ -102,6 +122,7 @@ + fs_search_nfsd_fs(nfsd_t) + fs_getattr_all_fs(nfsd_t) + fs_rw_nfsd_fs(nfsd_t) ++fs_search_all(nfsd_t) + + term_use_controlling_term(nfsd_t) + +@@ -123,6 +144,7 @@ tunable_policy(`nfs_export_all_rw',` fs_read_noxattr_fs_files(nfsd_t) auth_manage_all_files_except_shadow(nfsd_t) @@ -12772,7 +15249,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. ') tunable_policy(`nfs_export_all_ro',` -@@ -143,6 +163,9 @@ +@@ -143,6 +165,9 @@ manage_files_pattern(gssd_t,gssd_tmp_t,gssd_tmp_t) files_tmp_filetrans(gssd_t, gssd_tmp_t, { file dir }) @@ -12782,7 +15259,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. kernel_read_network_state(gssd_t) kernel_read_network_state_symlinks(gssd_t) kernel_search_network_sysctl(gssd_t) -@@ -158,6 +181,9 @@ +@@ -158,6 +183,9 @@ miscfiles_read_certs(gssd_t) @@ -12792,9 +15269,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. tunable_policy(`allow_gssd_read_tmp',` userdom_list_unpriv_users_tmp(gssd_t) userdom_read_unpriv_users_tmp_files(gssd_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.8/policy/modules/services/rpcbind.te +--- nsaserefpolicy/policy/modules/services/rpcbind.te 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/rpcbind.te 2008-04-04 16:11:03.000000000 -0400 +@@ -21,11 +21,13 @@ + # rpcbind local policy + # + +-allow rpcbind_t self:capability setuid; ++allow rpcbind_t self:capability { dac_override setuid sys_tty_config }; + allow rpcbind_t self:fifo_file rw_file_perms; + allow rpcbind_t self:unix_stream_socket create_stream_socket_perms; + allow rpcbind_t self:netlink_route_socket r_netlink_socket_perms; + allow rpcbind_t self:udp_socket create_socket_perms; ++# BROKEN ... ++dontaudit rpcbind_t self:udp_socket listen; + allow rpcbind_t self:tcp_socket create_stream_socket_perms; + + manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t) +@@ -37,6 +39,7 @@ + manage_sock_files_pattern(rpcbind_t,rpcbind_var_lib_t,rpcbind_var_lib_t) + files_var_lib_filetrans(rpcbind_t,rpcbind_var_lib_t, { file dir sock_file }) + ++kernel_read_system_state(rpcbind_t) + kernel_read_network_state(rpcbind_t) + + corenet_all_recvfrom_unlabeled(rpcbind_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.8/policy/modules/services/rshd.te --- nsaserefpolicy/policy/modules/services/rshd.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rshd.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/rshd.te 2008-04-04 16:11:03.000000000 -0400 @@ -16,10 +16,11 @@ # # Local policy @@ -12883,7 +15386,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.fc serefpolicy-3.0.8/policy/modules/services/rsync.fc --- nsaserefpolicy/policy/modules/services/rsync.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rsync.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/rsync.fc 2008-04-04 16:11:03.000000000 -0400 @@ -1,2 +1,4 @@ /usr/bin/rsync -- gen_context(system_u:object_r:rsync_exec_t,s0) @@ -12891,7 +15394,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn +/var/log/rsync.log -- gen_context(system_u:object_r:rsync_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.8/policy/modules/services/rsync.te --- nsaserefpolicy/policy/modules/services/rsync.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rsync.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/rsync.te 2008-04-04 16:11:03.000000000 -0400 @@ -8,6 +8,13 @@ ## @@ -12988,7 +15491,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.8/policy/modules/services/samba.fc --- nsaserefpolicy/policy/modules/services/samba.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/samba.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/samba.fc 2008-04-04 16:11:03.000000000 -0400 @@ -15,6 +15,7 @@ /usr/bin/ntlm_auth -- gen_context(system_u:object_r:winbind_helper_exec_t,s0) /usr/bin/smbmount -- gen_context(system_u:object_r:smbmount_exec_t,s0) @@ -13003,13 +15506,90 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +/var/lib/samba/scripts(/.*)? gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0) + - /var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0) - - /var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.8/policy/modules/services/samba.if ---- nsaserefpolicy/policy/modules/services/samba.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/samba.if 2008-05-07 14:20:59.000000000 -0400 -@@ -332,6 +332,25 @@ + /var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0) + + /var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.8/policy/modules/services/samba.if +--- nsaserefpolicy/policy/modules/services/samba.if 2007-10-22 13:21:36.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/samba.if 2008-04-21 13:18:16.000000000 -0400 +@@ -33,8 +33,8 @@ + ') + + tunable_policy(`samba_enable_home_dirs',` +- userdom_manage_user_home_content_dirs($1,smbd_t) +- userdom_manage_user_home_content_files($1,smbd_t) ++ userdom_manage_unpriv_users_home_content_dirs(smbd_t) ++ userdom_manage_unpriv_users_home_content_files(smbd_t) + userdom_manage_user_home_content_symlinks($1,smbd_t) + userdom_manage_user_home_content_sockets($1,smbd_t) + userdom_manage_user_home_content_pipes($1,smbd_t) +@@ -63,6 +63,25 @@ + + ######################################## + ## ++## Execute samba net in the samba_unconfined_net domain. ++## ++## ++## ++## The type of the process performing this action. ++## ++## ++# ++interface(`samba_domtrans_unconfined_net',` ++ gen_require(` ++ type samba_unconfined_net_t, samba_net_exec_t; ++ ') ++ ++ corecmd_search_bin($1) ++ domtrans_pattern($1,samba_net_exec_t,samba_unconfined_net_t) ++') ++ ++######################################## ++## + ## Execute samba net in the samba_net domain, and + ## allow the specified role the samba_net domain. + ## +@@ -93,6 +112,39 @@ + allow samba_net_t $3:chr_file rw_term_perms; + ') + ++ ++######################################## ++## ++## Execute samba net in the samba_unconfined_net domain, and ++## allow the specified role the samba_unconfined_net domain. ++## ++## ++## ++## The type of the process performing this action. ++## ++## ++## ++## ++## The role to be allowed the samba_unconfined_net domain. ++## ++## ++## ++## ++## The type of the terminal allow the samba_unconfined_net domain to use. ++## ++## ++## ++# ++interface(`samba_run_unconfined_net',` ++ gen_require(` ++ type samba_unconfined_net_t; ++ ') ++ ++ samba_domtrans_unconfined_net($1) ++ role $2 types samba_unconfined_net_t; ++ allow samba_unconfined_net_t $3:chr_file rw_term_perms; ++') ++ + ######################################## + ## + ## Execute smbmount in the smbmount domain. +@@ -332,6 +384,25 @@ ######################################## ## @@ -13035,7 +15615,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ## Allow the specified domain to ## read and write samba /var files. ## -@@ -349,6 +368,7 @@ +@@ -349,6 +420,7 @@ files_search_var($1) files_search_var_lib($1) manage_files_pattern($1,samba_var_t,samba_var_t) @@ -13043,7 +15623,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') ######################################## -@@ -421,6 +441,7 @@ +@@ -421,6 +493,7 @@ ') domtrans_pattern($1,winbind_helper_exec_t,winbind_helper_t) @@ -13051,7 +15631,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') ######################################## -@@ -493,3 +514,103 @@ +@@ -493,3 +566,103 @@ allow $1 samba_var_t:dir search_dir_perms; stream_connect_pattern($1,winbind_var_run_t,winbind_var_run_t,winbind_t) ') @@ -13157,7 +15737,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.8/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/samba.te 2008-05-07 14:17:56.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/samba.te 2008-04-06 07:25:44.000000000 -0400 @@ -137,6 +137,11 @@ type winbind_var_run_t; files_pid_file(winbind_var_run_t) @@ -13187,7 +15767,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_read_proc_symlinks(samba_net_t) corenet_all_recvfrom_unlabeled(samba_net_t) -@@ -190,8 +196,7 @@ +@@ -190,19 +196,15 @@ miscfiles_read_localization(samba_net_t) @@ -13196,8 +15776,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +samba_read_var_files(samba_net_t) userdom_dontaudit_search_sysadm_home_dirs(samba_net_t) ++userdom_list_all_users_home_dirs(samba_net_t) -@@ -199,10 +204,6 @@ + optional_policy(` kerberos_use(samba_net_t) ') @@ -13208,7 +15789,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ######################################## # # smbd Local policy -@@ -217,19 +218,16 @@ +@@ -217,19 +219,16 @@ allow smbd_t self:msgq create_msgq_perms; allow smbd_t self:sem create_sem_perms; allow smbd_t self:shm create_shm_perms; @@ -13231,7 +15812,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow smbd_t samba_net_tmp_t:file getattr; -@@ -239,6 +237,7 @@ +@@ -239,6 +238,7 @@ manage_dirs_pattern(smbd_t,samba_share_t,samba_share_t) manage_files_pattern(smbd_t,samba_share_t,samba_share_t) manage_lnk_files_pattern(smbd_t,samba_share_t,samba_share_t) @@ -13239,7 +15820,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb manage_dirs_pattern(smbd_t,samba_var_t,samba_var_t) manage_files_pattern(smbd_t,samba_var_t,samba_var_t) -@@ -256,7 +255,7 @@ +@@ -256,7 +256,7 @@ manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t) files_pid_filetrans(smbd_t,smbd_var_run_t,file) @@ -13248,7 +15829,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_getattr_core_if(smbd_t) kernel_getattr_message_if(smbd_t) -@@ -292,12 +291,13 @@ +@@ -292,12 +292,13 @@ fs_getattr_all_fs(smbd_t) fs_get_xattr_fs_quotas(smbd_t) @@ -13264,7 +15845,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb domain_use_interactive_fds(smbd_t) domain_dontaudit_list_all_domains_state(smbd_t) -@@ -321,8 +321,6 @@ +@@ -321,12 +322,12 @@ miscfiles_read_localization(smbd_t) miscfiles_read_public_files(smbd_t) @@ -13273,7 +15854,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb userdom_dontaudit_search_sysadm_home_dirs(smbd_t) userdom_dontaudit_use_unpriv_user_fds(smbd_t) userdom_use_unpriv_users_fds(smbd_t) -@@ -347,6 +345,17 @@ + ++term_use_ptmx(smbd_t) ++ + ifdef(`hide_broken_symptoms', ` + files_dontaudit_getattr_default_dirs(smbd_t) + files_dontaudit_getattr_boot_dirs(smbd_t) +@@ -347,6 +348,17 @@ tunable_policy(`samba_share_nfs',` fs_manage_nfs_dirs(smbd_t) fs_manage_nfs_files(smbd_t) @@ -13291,7 +15878,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') optional_policy(` -@@ -398,7 +407,7 @@ +@@ -398,7 +410,7 @@ allow nmbd_t self:msgq create_msgq_perms; allow nmbd_t self:sem create_sem_perms; allow nmbd_t self:shm create_shm_perms; @@ -13300,7 +15887,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow nmbd_t self:tcp_socket create_stream_socket_perms; allow nmbd_t self:udp_socket create_socket_perms; allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto }; -@@ -410,8 +419,7 @@ +@@ -410,8 +422,7 @@ read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t) manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t) @@ -13310,7 +15897,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb read_files_pattern(nmbd_t,samba_log_t,samba_log_t) create_files_pattern(nmbd_t,samba_log_t,samba_log_t) -@@ -421,6 +429,8 @@ +@@ -421,6 +432,8 @@ allow nmbd_t smbd_var_run_t:dir rw_dir_perms; @@ -13319,7 +15906,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_getattr_core_if(nmbd_t) kernel_getattr_message_if(nmbd_t) kernel_read_kernel_sysctls(nmbd_t) -@@ -446,6 +456,7 @@ +@@ -446,6 +459,7 @@ dev_getattr_mtrr_dev(nmbd_t) fs_getattr_all_fs(nmbd_t) @@ -13327,7 +15914,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb fs_search_auto_mountpoints(nmbd_t) domain_use_interactive_fds(nmbd_t) -@@ -462,17 +473,11 @@ +@@ -462,17 +476,11 @@ miscfiles_read_localization(nmbd_t) @@ -13345,7 +15932,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb seutil_sigchld_newrole(nmbd_t) ') -@@ -506,6 +511,8 @@ +@@ -506,6 +514,8 @@ manage_lnk_files_pattern(smbmount_t,samba_var_t,samba_var_t) files_list_var_lib(smbmount_t) @@ -13354,7 +15941,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_read_system_state(smbmount_t) corenet_all_recvfrom_unlabeled(smbmount_t) -@@ -533,6 +540,7 @@ +@@ -533,6 +543,7 @@ storage_raw_write_fixed_disk(smbmount_t) term_list_ptys(smbmount_t) @@ -13362,7 +15949,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb corecmd_list_bin(smbmount_t) -@@ -553,16 +561,11 @@ +@@ -553,16 +564,11 @@ logging_search_logs(smbmount_t) @@ -13381,7 +15968,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') ######################################## -@@ -570,24 +573,28 @@ +@@ -570,24 +576,28 @@ # SWAT Local policy # @@ -13418,7 +16005,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow swat_t smbd_var_run_t:file read; manage_dirs_pattern(swat_t,swat_tmp_t,swat_tmp_t) -@@ -597,7 +604,11 @@ +@@ -597,7 +607,11 @@ manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t) files_pid_filetrans(swat_t,swat_var_run_t,file) @@ -13431,7 +16018,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_read_kernel_sysctls(swat_t) kernel_read_system_state(swat_t) -@@ -622,23 +633,24 @@ +@@ -622,23 +636,24 @@ dev_read_urand(swat_t) @@ -13458,7 +16045,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb optional_policy(` cups_read_rw_config(swat_t) cups_stream_connect(swat_t) -@@ -652,13 +664,16 @@ +@@ -652,13 +667,16 @@ kerberos_use(swat_t) ') @@ -13481,7 +16068,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ######################################## # -@@ -672,7 +687,6 @@ +@@ -672,7 +690,6 @@ allow winbind_t self:fifo_file { read write }; allow winbind_t self:unix_dgram_socket create_socket_perms; allow winbind_t self:unix_stream_socket create_stream_socket_perms; @@ -13489,7 +16076,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow winbind_t self:tcp_socket create_stream_socket_perms; allow winbind_t self:udp_socket create_socket_perms; -@@ -709,6 +723,8 @@ +@@ -709,6 +726,8 @@ manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t) files_pid_filetrans(winbind_t,winbind_var_run_t,file) @@ -13498,7 +16085,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_read_kernel_sysctls(winbind_t) kernel_list_proc(winbind_t) kernel_read_proc_symlinks(winbind_t) -@@ -733,7 +749,9 @@ +@@ -733,7 +752,9 @@ fs_getattr_all_fs(winbind_t) fs_search_auto_mountpoints(winbind_t) @@ -13508,7 +16095,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb domain_use_interactive_fds(winbind_t) -@@ -746,9 +764,6 @@ +@@ -746,9 +767,6 @@ miscfiles_read_localization(winbind_t) @@ -13518,7 +16105,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb userdom_dontaudit_use_unpriv_user_fds(winbind_t) userdom_dontaudit_search_sysadm_home_dirs(winbind_t) userdom_priveleged_home_dir_manager(winbind_t) -@@ -758,10 +773,6 @@ +@@ -758,10 +776,6 @@ ') optional_policy(` @@ -13529,7 +16116,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb seutil_sigchld_newrole(winbind_t) ') -@@ -784,6 +795,8 @@ +@@ -784,6 +798,8 @@ allow winbind_helper_t samba_var_t:dir search; files_list_var_lib(winbind_helper_t) @@ -13538,7 +16125,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb stream_connect_pattern(winbind_helper_t,winbind_var_run_t,winbind_var_run_t,winbind_t) term_list_ptys(winbind_helper_t) -@@ -798,12 +811,13 @@ +@@ -798,12 +814,13 @@ miscfiles_read_localization(winbind_helper_t) optional_policy(` @@ -13553,7 +16140,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') ######################################## -@@ -828,3 +842,38 @@ +@@ -812,6 +829,13 @@ + # + + optional_policy(` ++ type samba_unconfined_net_t; ++ domain_type(samba_unconfined_net_t) ++ unconfined_domain(samba_unconfined_net_t) ++ role system_r types samba_unconfined_net_t; ++ manage_files_pattern(samba_unconfined_net_t,samba_etc_t,samba_secrets_t) ++ filetrans_pattern(samba_unconfined_net_t,samba_etc_t,samba_secrets_t,file) ++ + type samba_unconfined_script_t; + type samba_unconfined_script_exec_t; + domain_type(samba_unconfined_script_t) +@@ -828,3 +852,37 @@ domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t) ') ') @@ -13591,10 +16192,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +allow winbind_t smbcontrol_t:process signal; + +allow smbcontrol_t nmbd_var_run_t:file { read lock }; -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.8/policy/modules/services/sasl.te --- nsaserefpolicy/policy/modules/services/sasl.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/sasl.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/sasl.te 2008-04-04 16:11:03.000000000 -0400 @@ -1,5 +1,5 @@ -policy_module(sasl,1.6.0) @@ -13623,7 +16223,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.8/policy/modules/services/sendmail.if --- nsaserefpolicy/policy/modules/services/sendmail.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/sendmail.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/sendmail.if 2008-04-04 16:11:03.000000000 -0400 @@ -149,3 +149,85 @@ logging_log_filetrans($1,sendmail_log_t,file) @@ -13712,7 +16312,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.0.8/policy/modules/services/sendmail.te --- nsaserefpolicy/policy/modules/services/sendmail.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/sendmail.te 2008-01-14 11:54:37.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/sendmail.te 2008-04-04 16:11:03.000000000 -0400 @@ -20,19 +20,22 @@ mta_mailserver_delivery(sendmail_t) mta_mailserver_sender(sendmail_t) @@ -13729,7 +16329,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send -allow sendmail_t self:capability { setuid setgid net_bind_service sys_nice chown sys_tty_config }; -allow sendmail_t self:process signal; +allow sendmail_t self:capability { dac_override setuid setgid net_bind_service sys_nice chown sys_tty_config }; -+allow sendmail_t self:process { signal signull }; ++allow sendmail_t self:process { setrlimit signal signull }; allow sendmail_t self:fifo_file rw_fifo_file_perms; allow sendmail_t self:unix_stream_socket create_stream_socket_perms; allow sendmail_t self:unix_dgram_socket create_socket_perms; @@ -13749,7 +16349,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send corenet_all_recvfrom_unlabeled(sendmail_t) corenet_all_recvfrom_netlabel(sendmail_t) -@@ -66,10 +72,13 @@ +@@ -66,14 +72,18 @@ fs_getattr_all_fs(sendmail_t) fs_search_auto_mountpoints(sendmail_t) @@ -13763,7 +16363,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send domain_use_interactive_fds(sendmail_t) -@@ -94,30 +103,34 @@ + files_read_etc_files(sendmail_t) ++files_read_usr_files(sendmail_t) + files_search_spool(sendmail_t) + # for piping mail to a command + files_read_etc_runtime_files(sendmail_t) +@@ -83,6 +93,7 @@ + # sendmail wants to read /var/run/utmp if the controlling tty is /dev/console + init_read_utmp(sendmail_t) + init_dontaudit_write_utmp(sendmail_t) ++init_rw_script_tmp_files(sendmail_t) + + libs_use_ld_so(sendmail_t) + libs_use_shared_libs(sendmail_t) +@@ -90,34 +101,39 @@ + libs_read_lib_files(sendmail_t) + + logging_send_syslog_msg(sendmail_t) ++logging_dontaudit_write_generic_logs(sendmail_t) + miscfiles_read_certs(sendmail_t) miscfiles_read_localization(sendmail_t) @@ -13804,15 +16422,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send ') optional_policy(` -@@ -131,28 +144,33 @@ - ') +@@ -128,6 +144,11 @@ optional_policy(` -+ rhgb_use_ptys(sendmail_t) + procmail_domtrans(sendmail_t) ++ procmail_rw_tmp_files(sendmail_t) +') + +optional_policy(` - seutil_sigchld_newrole(sendmail_t) ++ rhgb_use_ptys(sendmail_t) + ') + + optional_policy(` +@@ -135,24 +156,25 @@ ') optional_policy(` @@ -13856,8 +16478,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send -') dnl end TODO diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.8/policy/modules/services/setroubleshoot.te --- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/setroubleshoot.te 2008-01-08 06:17:14.000000000 -0500 -@@ -27,8 +27,8 @@ ++++ serefpolicy-3.0.8/policy/modules/services/setroubleshoot.te 2008-04-04 16:11:03.000000000 -0400 +@@ -1,5 +1,5 @@ + +-policy_module(setroubleshoot,1.4.1) ++policy_module(setroubleshoot,1.6.0) + + ######################################## + # +@@ -22,13 +22,16 @@ + type setroubleshoot_var_run_t; + files_pid_file(setroubleshoot_var_run_t) + ++type setroubleshoot_script_exec_t; ++init_script_type(setroubleshoot_script_exec_t) ++ + ######################################## + # # setroubleshootd local policy # @@ -13868,16 +16505,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr allow setroubleshootd_t self:fifo_file rw_fifo_file_perms; allow setroubleshootd_t self:tcp_socket create_stream_socket_perms; allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto }; -@@ -53,6 +53,8 @@ +@@ -52,7 +55,9 @@ + kernel_read_kernel_sysctls(setroubleshootd_t) kernel_read_system_state(setroubleshootd_t) - kernel_read_network_state(setroubleshootd_t) +kernel_read_net_sysctls(setroubleshootd_t) + kernel_read_network_state(setroubleshootd_t) +kernel_dontaudit_list_all_proc(setroubleshootd_t) corecmd_exec_bin(setroubleshootd_t) corecmd_exec_shell(setroubleshootd_t) -@@ -67,13 +69,18 @@ +@@ -67,16 +72,24 @@ corenet_sendrecv_smtp_client_packets(setroubleshootd_t) dev_read_urand(setroubleshootd_t) @@ -13897,21 +16535,53 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr fs_getattr_all_dirs(setroubleshootd_t) fs_getattr_all_files(setroubleshootd_t) -@@ -111,3 +118,11 @@ - rpm_dontaudit_manage_db(setroubleshootd_t) - rpm_use_script_fds(setroubleshootd_t) - ') -+ -+optional_policy(` ++fs_read_fusefs_symlinks(setroubleshootd_t) ++fs_dontaudit_read_nfs_files(setroubleshootd_t) ++fs_dontaudit_read_cifs_files(setroubleshootd_t) + + selinux_get_enforce_mode(setroubleshootd_t) + selinux_validate_context(setroubleshootd_t) +@@ -96,17 +109,23 @@ + + locallogin_dontaudit_use_fds(setroubleshootd_t) + ++logging_send_audit_msgs(setroubleshootd_t) + logging_send_syslog_msg(setroubleshootd_t) +-logging_stream_connect_auditd(setroubleshootd_t) ++logging_stream_connect_audisp(setroubleshootd_t) + + seutil_read_config(setroubleshootd_t) + seutil_read_file_contexts(setroubleshootd_t) +- +-sysnet_read_config(setroubleshootd_t) ++seutil_read_bin_policy(setroubleshootd_t) + + userdom_dontaudit_read_sysadm_home_content_files(setroubleshootd_t) + + optional_policy(` + dbus_system_bus_client_template(setroubleshootd, setroubleshootd_t) -+ dbus_send_system_bus(setroubleshootd_t) + dbus_connect_system_bus(setroubleshootd_t) + dbus_system_domain(setroubleshootd_t,setroubleshootd_exec_t) +') + ++optional_policy(` + rpm_read_db(setroubleshootd_t) + rpm_dontaudit_manage_db(setroubleshootd_t) + rpm_use_script_fds(setroubleshootd_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.0.8/policy/modules/services/smartmon.te +--- nsaserefpolicy/policy/modules/services/smartmon.te 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/smartmon.te 2008-04-04 16:11:03.000000000 -0400 +@@ -49,6 +49,7 @@ + corenet_udp_sendrecv_all_ports(fsdaemon_t) + + dev_read_sysfs(fsdaemon_t) ++dev_read_urand(fsdaemon_t) + + domain_use_interactive_fds(fsdaemon_t) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.0.8/policy/modules/services/snmp.te --- nsaserefpolicy/policy/modules/services/snmp.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/snmp.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/snmp.te 2008-04-04 16:11:03.000000000 -0400 @@ -81,8 +81,7 @@ files_read_usr_files(snmpd_t) files_read_etc_runtime_files(snmpd_t) @@ -13924,7 +16594,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp fs_getattr_all_fs(snmpd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.fc serefpolicy-3.0.8/policy/modules/services/soundserver.fc --- nsaserefpolicy/policy/modules/services/soundserver.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/soundserver.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/soundserver.fc 2008-04-04 16:11:03.000000000 -0400 @@ -1,10 +1,16 @@ -/etc/nas(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) -/etc/yiff(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) @@ -13950,7 +16620,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun +/usr/bin/nasd -- gen_context(system_u:object_r:soundd_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.if serefpolicy-3.0.8/policy/modules/services/soundserver.if --- nsaserefpolicy/policy/modules/services/soundserver.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/soundserver.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/soundserver.if 2008-04-04 16:11:03.000000000 -0400 @@ -13,3 +13,64 @@ interface(`soundserver_tcp_connect',` refpolicywarn(`$0($*) has been deprecated.') @@ -14018,7 +16688,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.te serefpolicy-3.0.8/policy/modules/services/soundserver.te --- nsaserefpolicy/policy/modules/services/soundserver.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/soundserver.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/soundserver.te 2008-04-04 16:11:03.000000000 -0400 @@ -10,9 +10,6 @@ type soundd_exec_t; init_daemon_domain(soundd_t,soundd_exec_t) @@ -14084,7 +16754,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.0.8/policy/modules/services/spamassassin.fc --- nsaserefpolicy/policy/modules/services/spamassassin.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/spamassassin.fc 2008-01-14 11:58:07.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/spamassassin.fc 2008-04-04 16:11:03.000000000 -0400 @@ -11,6 +11,7 @@ /var/run/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) @@ -14095,7 +16765,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam /var/spool/spamd(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.0.8/policy/modules/services/spamassassin.if --- nsaserefpolicy/policy/modules/services/spamassassin.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/spamassassin.if 2008-01-04 09:49:16.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/spamassassin.if 2008-04-04 16:11:03.000000000 -0400 @@ -286,6 +286,12 @@ userdom_manage_user_home_content_symlinks($1,spamd_t) ') @@ -14117,7 +16787,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam read_files_pattern($1,spamd_var_lib_t,spamd_var_lib_t) ') -@@ -531,3 +538,89 @@ +@@ -531,3 +538,90 @@ dontaudit $1 spamd_tmp_t:sock_file getattr; ') @@ -14205,11 +16875,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam + ') + + manage_files_pattern($1, user_spamassassin_home_t, user_spamassassin_home_t) ++ razor_manage_user_home_files(user,$1) +') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.0.8/policy/modules/services/spamassassin.te --- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/spamassassin.te 2007-12-27 11:47:32.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/spamassassin.te 2008-04-04 16:11:03.000000000 -0400 +@@ -53,7 +53,7 @@ + # setuids to the user running spamc. Comment this if you are not + # using this ability. + +-allow spamd_t self:capability { setuid setgid dac_override sys_tty_config }; ++allow spamd_t self:capability { kill setuid setgid dac_override sys_tty_config }; + dontaudit spamd_t self:capability sys_tty_config; + allow spamd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; + allow spamd_t self:fd use; @@ -81,11 +81,12 @@ # var/lib files for spamd @@ -14279,7 +16959,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.8/policy/modules/services/squid.fc --- nsaserefpolicy/policy/modules/services/squid.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/squid.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/squid.fc 2008-04-04 16:11:03.000000000 -0400 @@ -12,3 +12,5 @@ /var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0) @@ -14288,7 +16968,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-3.0.8/policy/modules/services/squid.if --- nsaserefpolicy/policy/modules/services/squid.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/squid.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/squid.if 2008-04-04 16:11:03.000000000 -0400 @@ -131,3 +131,22 @@ interface(`squid_use',` refpolicywarn(`$0($*) has been deprecated.') @@ -14314,7 +16994,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.8/policy/modules/services/squid.te --- nsaserefpolicy/policy/modules/services/squid.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/squid.te 2007-12-13 08:37:13.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/squid.te 2008-04-04 16:11:03.000000000 -0400 @@ -36,7 +36,7 @@ # Local policy # @@ -14324,16 +17004,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi dontaudit squid_t self:capability sys_tty_config; allow squid_t self:process ~{ ptrace setcurrent setexec setfscreate execmem execstack execheap }; allow squid_t self:fifo_file rw_fifo_file_perms; -@@ -53,6 +53,8 @@ +@@ -53,6 +53,9 @@ allow squid_t self:tcp_socket create_stream_socket_perms; allow squid_t self:udp_socket create_socket_perms; +auth_use_nsswitch(squid_t) ++auth_domtrans_chkpwd(squid_t) + # Grant permissions to create, access, and delete cache files. manage_dirs_pattern(squid_t,squid_cache_t,squid_cache_t) manage_files_pattern(squid_t,squid_cache_t,squid_cache_t) -@@ -92,10 +94,12 @@ +@@ -85,6 +88,7 @@ + corenet_udp_sendrecv_all_ports(squid_t) + corenet_tcp_bind_all_nodes(squid_t) + corenet_udp_bind_all_nodes(squid_t) ++corenet_tcp_bind_http_port(squid_t) + corenet_tcp_bind_http_cache_port(squid_t) + corenet_udp_bind_http_cache_port(squid_t) + corenet_tcp_bind_ftp_port(squid_t) +@@ -92,10 +96,12 @@ corenet_udp_bind_gopher_port(squid_t) corenet_tcp_bind_squid_port(squid_t) corenet_udp_bind_squid_port(squid_t) @@ -14346,7 +17035,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi corenet_sendrecv_http_client_packets(squid_t) corenet_sendrecv_ftp_client_packets(squid_t) corenet_sendrecv_gopher_client_packets(squid_t) -@@ -109,6 +113,8 @@ +@@ -109,6 +115,8 @@ fs_getattr_all_fs(squid_t) fs_search_auto_mountpoints(squid_t) @@ -14355,7 +17044,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi selinux_dontaudit_getattr_dir(squid_t) -@@ -137,9 +143,6 @@ +@@ -137,9 +145,6 @@ miscfiles_read_certs(squid_t) miscfiles_read_localization(squid_t) @@ -14365,7 +17054,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi userdom_use_unpriv_users_fds(squid_t) userdom_dontaudit_use_unpriv_user_fds(squid_t) userdom_dontaudit_search_sysadm_home_dirs(squid_t) -@@ -149,19 +152,7 @@ +@@ -149,19 +154,7 @@ ') optional_policy(` @@ -14386,7 +17075,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi ') optional_policy(` -@@ -176,7 +167,12 @@ +@@ -176,7 +169,12 @@ udev_read_db(squid_t) ') @@ -14399,13 +17088,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi + corenet_tcp_connect_http_cache_port(httpd_squid_script_t) + squid_read_config(httpd_squid_script_t) + allow httpd_squid_script_t self:tcp_socket create_socket_perms; -+ sysnet_read_config(httpd_squid_script_t) ++ sysnet_dns_name_resolve(httpd_squid_script_t) + corenet_all_recvfrom_unlabeled(httpd_squid_script_t) + corenet_all_recvfrom_netlabel(httpd_squid_script_t) +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.8/policy/modules/services/ssh.if --- nsaserefpolicy/policy/modules/services/ssh.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ssh.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ssh.if 2008-04-04 16:11:03.000000000 -0400 @@ -202,6 +202,7 @@ # template(`ssh_per_role_template',` @@ -14556,7 +17245,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.8/policy/modules/services/ssh.te --- nsaserefpolicy/policy/modules/services/ssh.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ssh.te 2007-12-12 16:38:01.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ssh.te 2008-04-04 16:11:03.000000000 -0400 @@ -24,7 +24,7 @@ # Type for the ssh-agent executable. @@ -14566,18 +17255,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. # ssh client executable. type ssh_exec_t; -@@ -80,6 +80,10 @@ +@@ -80,6 +80,12 @@ corenet_tcp_bind_xserver_port(sshd_t) corenet_sendrecv_xserver_server_packets(sshd_t) +userdom_read_all_users_home_dirs_symlinks(sshd_t) +userdom_read_all_users_home_content_files(sshd_t) +userdom_read_all_users_home_dirs_symlinks(sshd_t) ++userdom_read_unpriv_users_home_content_files(sshd_t) ++ + tunable_policy(`ssh_sysadm_login',` # Relabel and access ptys created by sshd # ioctl is necessary for logout() processing for utmp entry and for w to -@@ -100,6 +104,11 @@ +@@ -100,6 +106,11 @@ userdom_use_unpriv_users_ptys(sshd_t) ') @@ -14589,7 +17280,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. optional_policy(` daemontools_service_domain(sshd_t, sshd_exec_t) ') -@@ -119,7 +128,13 @@ +@@ -119,7 +130,13 @@ ') optional_policy(` @@ -14604,7 +17295,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. ') ifdef(`TODO',` -@@ -231,9 +246,15 @@ +@@ -231,9 +248,15 @@ ') optional_policy(` @@ -14620,9 +17311,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. ') + + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stunnel.if serefpolicy-3.0.8/policy/modules/services/stunnel.if +--- nsaserefpolicy/policy/modules/services/stunnel.if 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/stunnel.if 2008-04-04 16:11:03.000000000 -0400 +@@ -1 +1,25 @@ + ## SSL Tunneling Proxy ++ ++######################################## ++## ++## Define the specified domain as a stunnel inetd service. ++## ++## ++## ++## The type associated with the stunnel inetd service process. ++## ++## ++## ++## ++## The type associated with the process program. ++## ++## ++# ++interface(`stunnel_service_domain',` ++ gen_require(` ++ type stunnel_t; ++ ') ++ ++ domtrans_pattern(stunnel_t,$2,$1) ++ allow $1 stunnel_t:tcp_socket rw_socket_perms; ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stunnel.te serefpolicy-3.0.8/policy/modules/services/stunnel.te --- nsaserefpolicy/policy/modules/services/stunnel.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/stunnel.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/stunnel.te 2008-04-04 16:11:03.000000000 -0400 @@ -38,7 +38,6 @@ allow stunnel_t self:fifo_file rw_fifo_file_perms; allow stunnel_t self:tcp_socket create_stream_socket_perms; @@ -14666,7 +17386,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stun # hack since this port has no interfaces since it doesnt diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tcpd.if serefpolicy-3.0.8/policy/modules/services/tcpd.if --- nsaserefpolicy/policy/modules/services/tcpd.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/tcpd.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/tcpd.if 2008-04-04 16:11:03.000000000 -0400 @@ -15,5 +15,31 @@ type tcpd_t, tcpd_exec_t; ') @@ -14702,7 +17422,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tcpd ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/telnet.te serefpolicy-3.0.8/policy/modules/services/telnet.te --- nsaserefpolicy/policy/modules/services/telnet.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/telnet.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/telnet.te 2008-04-04 16:11:03.000000000 -0400 @@ -32,12 +32,13 @@ allow telnetd_t self:udp_socket create_socket_perms; # for identd; cjp: this should probably only be inetd_child rules? @@ -14771,7 +17491,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/teln -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.fc serefpolicy-3.0.8/policy/modules/services/tftp.fc --- nsaserefpolicy/policy/modules/services/tftp.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/tftp.fc 2008-01-14 12:49:42.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/tftp.fc 2008-04-04 16:11:03.000000000 -0400 @@ -4,3 +4,4 @@ /tftpboot -d gen_context(system_u:object_r:tftpdir_t,s0) @@ -14779,7 +17499,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp +/var/lib/tftpboot(/.*)? gen_context(system_u:object_r:tftpdir_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-3.0.8/policy/modules/services/tftp.te --- nsaserefpolicy/policy/modules/services/tftp.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/tftp.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/tftp.te 2008-04-04 16:11:03.000000000 -0400 @@ -16,6 +16,17 @@ type tftpdir_t; files_type(tftpdir_t) @@ -14798,14 +17518,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp ######################################## # # Local policy -@@ -26,12 +37,17 @@ - allow tftpd_t self:udp_socket create_socket_perms; - allow tftpd_t self:unix_dgram_socket create_socket_perms; - allow tftpd_t self:unix_stream_socket create_stream_socket_perms; -+allow tftpd_t self:netlink_route_socket r_netlink_socket_perms; - dontaudit tftpd_t self:capability sys_tty_config; - - allow tftpd_t tftpdir_t:dir { getattr read search }; +@@ -32,6 +43,10 @@ allow tftpd_t tftpdir_t:file { read getattr }; allow tftpd_t tftpdir_t:lnk_file { getattr read }; @@ -14816,20 +17529,45 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp manage_files_pattern(tftpd_t,tftpd_var_run_t,tftpd_var_run_t) files_pid_filetrans(tftpd_t,tftpd_var_run_t,file) -@@ -72,6 +88,10 @@ +@@ -64,6 +79,8 @@ + files_read_var_symlinks(tftpd_t) + files_search_var(tftpd_t) + ++auth_use_nsswitch(tftpd_t) ++ + libs_use_ld_so(tftpd_t) + libs_use_shared_libs(tftpd_t) + +@@ -72,8 +89,9 @@ miscfiles_read_localization(tftpd_t) miscfiles_read_public_files(tftpd_t) +-sysnet_read_config(tftpd_t) +-sysnet_use_ldap(tftpd_t) +tunable_policy(`allow_tftp_anon_write',` + miscfiles_manage_public_files(tftpd_t) +') -+ - sysnet_read_config(tftpd_t) - sysnet_use_ldap(tftpd_t) + + userdom_dontaudit_use_unpriv_user_fds(tftpd_t) + userdom_dontaudit_use_sysadm_ttys(tftpd_t) +@@ -84,14 +102,6 @@ + ') + + optional_policy(` +- nis_use_ypbind(tftpd_t) +-') +- +-optional_policy(` +- nscd_socket_use(tftpd_t) +-') +- +-optional_policy(` + seutil_sigchld_newrole(tftpd_t) + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucspitcp.if serefpolicy-3.0.8/policy/modules/services/ucspitcp.if --- nsaserefpolicy/policy/modules/services/ucspitcp.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ucspitcp.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ucspitcp.if 2008-04-04 16:11:03.000000000 -0400 @@ -20,7 +20,7 @@ ## ## @@ -14841,7 +17579,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucsp role system_r; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucspitcp.te serefpolicy-3.0.8/policy/modules/services/ucspitcp.te --- nsaserefpolicy/policy/modules/services/ucspitcp.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ucspitcp.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/ucspitcp.te 2008-04-04 16:11:03.000000000 -0400 @@ -35,6 +35,7 @@ corenet_udp_sendrecv_all_ports(rblsmtpd_t) corenet_tcp_bind_all_nodes(rblsmtpd_t) @@ -14860,7 +17598,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucsp corenet_sendrecv_ftp_server_packets(ucspitcp_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp.te serefpolicy-3.0.8/policy/modules/services/uucp.te --- nsaserefpolicy/policy/modules/services/uucp.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/uucp.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/uucp.te 2008-04-04 16:11:03.000000000 -0400 @@ -88,6 +88,8 @@ files_search_home(uucpd_t) files_search_spool(uucpd_t) @@ -14891,9 +17629,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp ######################################## # # UUX Local policy +@@ -124,6 +116,8 @@ + + files_read_etc_files(uux_t) + ++fs_rw_anon_inodefs_files(uux_t) ++ + libs_use_ld_so(uux_t) + libs_use_shared_libs(uux_t) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.8/policy/modules/services/uwimap.te --- nsaserefpolicy/policy/modules/services/uwimap.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/uwimap.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/uwimap.te 2008-04-04 16:11:03.000000000 -0400 @@ -64,6 +64,7 @@ fs_search_auto_mountpoints(imapd_t) @@ -14904,18 +17651,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwim libs_use_shared_libs(imapd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.8/policy/modules/services/w3c.fc --- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/w3c.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/w3c.fc 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,2 @@ +/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0) +/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.8/policy/modules/services/w3c.if --- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/w3c.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/w3c.if 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1 @@ +## W3C diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.8/policy/modules/services/w3c.te --- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/w3c.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/w3c.te 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,14 @@ +policy_module(w3c,1.2.1) + @@ -14933,7 +17680,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c. +miscfiles_read_certs(httpd_w3c_validator_script_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xfs.te serefpolicy-3.0.8/policy/modules/services/xfs.te --- nsaserefpolicy/policy/modules/services/xfs.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/xfs.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/xfs.te 2008-04-04 16:11:03.000000000 -0400 @@ -26,6 +26,7 @@ allow xfs_t self:process { signal_perms setpgid }; allow xfs_t self:unix_stream_socket create_stream_socket_perms; @@ -14960,7 +17707,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xfs. dev_read_sysfs(xfs_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.8/policy/modules/services/xserver.fc --- nsaserefpolicy/policy/modules/services/xserver.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/xserver.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/xserver.fc 2008-04-04 16:11:03.000000000 -0400 @@ -32,11 +32,6 @@ /etc/X11/wdm/Xstartup.* -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/Xsession[^/]* -- gen_context(system_u:object_r:xsession_exec_t,s0) @@ -14996,7 +17743,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser /var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.8/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/xserver.if 2007-12-31 07:34:12.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/xserver.if 2008-04-04 16:11:03.000000000 -0400 @@ -116,16 +116,19 @@ dev_rw_agp($1_xserver_t) dev_rw_framebuffer($1_xserver_t) @@ -15433,7 +18180,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.8/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/xserver.te 2007-12-12 16:40:57.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/services/xserver.te 2008-04-14 14:44:39.000000000 -0400 @@ -16,6 +16,13 @@ ## @@ -15468,11 +18215,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # Type for the executable used to start the X server, e.g. Xwrapper. type xserver_exec_t; corecmd_executable_file(xserver_exec_t) -@@ -96,7 +109,7 @@ +@@ -95,8 +108,8 @@ + # XDM Local policy # - allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service }; +-allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service }; -allow xdm_t self:process { setexec setpgid getsched setsched setrlimit signal_perms setkeycreate }; ++allow xdm_t self:capability { setgid setuid sys_ptrace sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service }; +allow xdm_t self:process { setexec setpgid getsched ptrace setsched setrlimit signal_perms setkeycreate }; allow xdm_t self:fifo_file rw_fifo_file_perms; allow xdm_t self:shm create_shm_perms; @@ -15496,7 +18245,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser manage_dirs_pattern(xdm_t,xdm_var_lib_t,xdm_var_lib_t) manage_files_pattern(xdm_t,xdm_var_lib_t,xdm_var_lib_t) - files_var_lib_filetrans(xdm_t,xdm_var_lib_t,file) +-files_var_lib_filetrans(xdm_t,xdm_var_lib_t,file) ++files_var_lib_filetrans(xdm_t,xdm_var_lib_t,{ file dir }) +# Read machine-id +files_read_var_lib_files(xdm_t) @@ -15715,9 +18465,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser -# -allow pam_t xdm_t:fifo_file { getattr ioctl write }; -') dnl end TODO +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zebra.te serefpolicy-3.0.8/policy/modules/services/zebra.te +--- nsaserefpolicy/policy/modules/services/zebra.te 2007-10-22 13:21:36.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/zebra.te 2008-04-04 16:11:03.000000000 -0400 +@@ -115,8 +115,7 @@ + userdom_dontaudit_search_sysadm_home_dirs(zebra_t) + + tunable_policy(`allow_zebra_write_config',` +- allow zebra_t zebra_conf_t:dir write; +- allow zebra_t zebra_conf_t:file write; ++ manage_files_pattern(zebra_t, zebra_conf_t, zebra_conf_t) + ') + + optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.8/policy/modules/system/application.if --- nsaserefpolicy/policy/modules/system/application.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/application.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/application.if 2008-04-04 16:11:03.000000000 -0400 @@ -63,6 +63,26 @@ ######################################## @@ -15747,17 +18510,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.8/policy/modules/system/authlogin.fc --- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/authlogin.fc 2007-12-02 21:15:34.000000000 -0500 -@@ -14,6 +14,7 @@ ++++ serefpolicy-3.0.8/policy/modules/system/authlogin.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -13,7 +13,9 @@ + /sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0) /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0) /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) ++/usr/sbin/validate -- gen_context(system_u:object_r:chkpwd_exec_t,s0) /sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0) +/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0) ifdef(`distro_suse', ` /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) ') -@@ -40,3 +41,6 @@ +@@ -38,5 +40,9 @@ + /var/log/wtmp.* -- gen_context(system_u:object_r:wtmp_t,s0) + /var/run/console(/.*)? gen_context(system_u:object_r:pam_var_console_t,s0) ++/var/run/pam_mount(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0) /var/run/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0) +/var/run/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0) @@ -15765,7 +18533,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.8/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2008-01-15 13:51:25.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2008-04-04 16:11:03.000000000 -0400 @@ -26,7 +26,8 @@ type $1_chkpwd_t, can_read_shadow_passwords; application_domain($1_chkpwd_t,chkpwd_exec_t) @@ -15848,7 +18616,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo selinux_get_fs_mount($1) selinux_validate_context($1) selinux_compute_access_vector($1) -@@ -196,20 +223,48 @@ +@@ -196,20 +223,58 @@ mls_fd_share_all_levels($1) auth_domtrans_chk_passwd($1) @@ -15879,6 +18647,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + userdom_unpriv_users_stream_connect($1) + + optional_policy(` ++ dbus_system_bus_client_template(notused, $1) ++ optional_policy(` ++ oddjob_dbus_chat($1) ++ oddjob_domtrans_mkhomedir($1) ++ ') ++ ') ++ ++ optional_policy(` ++ corecmd_exec_bin($1) ++ storage_getattr_fixed_disk_dev($1) + mount_domtrans($1) + ') + @@ -15898,7 +18676,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo tunable_policy(`allow_polyinstantiation',` files_polyinstantiate_all($1) ') -@@ -309,9 +364,6 @@ +@@ -309,9 +374,6 @@ type system_chkpwd_t, chkpwd_exec_t, shadow_t; ') @@ -15908,7 +18686,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo corecmd_search_bin($1) domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t) -@@ -329,6 +381,8 @@ +@@ -329,6 +391,8 @@ optional_policy(` kerberos_use($1) @@ -15917,10 +18695,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') optional_policy(` -@@ -347,6 +401,37 @@ +@@ -347,6 +411,58 @@ ######################################## ## ++## Run unix_chkpwd to check a password. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`auth_domtrans_chkpwd',` ++ gen_require(` ++ type system_chkpwd_t, chkpwd_exec_t, shadow_t; ++ ') ++ ++ corecmd_search_bin($1) ++ domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t) ++ dontaudit $1 shadow_t:file { getattr read }; ++ auth_domtrans_upd_passwd($1) ++') ++ ++######################################## ++## +## Execute chkpwd programs in the chkpwd domain. +## +## @@ -15955,7 +18754,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ## Get the attributes of the shadow passwords file. ## ## -@@ -695,6 +780,24 @@ +@@ -695,6 +811,24 @@ ######################################## ## @@ -15980,7 +18779,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ## Execute pam programs in the PAM domain. ## ## -@@ -1318,16 +1421,14 @@ +@@ -1318,16 +1452,14 @@ ## # interface(`auth_use_nsswitch',` @@ -16000,7 +18799,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo miscfiles_read_certs($1) sysnet_dns_name_resolve($1) -@@ -1347,6 +1448,8 @@ +@@ -1347,6 +1479,8 @@ optional_policy(` samba_stream_connect_winbind($1) @@ -16009,7 +18808,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') ') -@@ -1381,3 +1484,181 @@ +@@ -1381,3 +1515,181 @@ typeattribute $1 can_write_shadow_passwords; typeattribute $1 can_relabelto_shadow_passwords; ') @@ -16193,7 +18992,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.8/policy/modules/system/authlogin.te --- nsaserefpolicy/policy/modules/system/authlogin.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/authlogin.te 2008-05-07 14:03:16.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/authlogin.te 2008-05-13 11:39:04.617949000 -0400 @@ -9,6 +9,13 @@ attribute can_read_shadow_passwords; attribute can_write_shadow_passwords; @@ -16229,7 +19028,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ######################################## # # PAM local policy -@@ -94,10 +108,14 @@ +@@ -94,36 +108,38 @@ allow pam_t pam_tmp_t:file manage_file_perms; files_tmp_filetrans(pam_t, pam_tmp_t, { file dir }) @@ -16244,15 +19043,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo term_use_all_user_ttys(pam_t) term_use_all_user_ptys(pam_t) -@@ -111,19 +129,16 @@ +-init_dontaudit_rw_utmp(pam_t) ++init_read_utmp(pam_t) ++init_dontaudit_write_utmp(pam_t) + + files_read_etc_files(pam_t) +- + libs_use_ld_so(pam_t) + libs_use_shared_libs(pam_t) + logging_send_syslog_msg(pam_t) userdom_use_unpriv_users_fds(pam_t) +userdom_write_unpriv_users_tmp_files(pam_t) -+userdom_dontaudit_read_unpriv_users_home_content_files(pam_t) +userdom_unlink_unpriv_users_tmp_files(pam_t) ++userdom_dontaudit_read_unpriv_users_home_content_files(pam_t) ++userdom_dontaudit_write_user_home_content_files(user, pam_t) +userdom_append_unpriv_users_home_content_files(pam_t) -+userdom_dontaudit_write_unpriv_user_home_content_files(pam_t) ++userdom_dontaudit_read_user_tmp_files(pam_t) optional_policy(` locallogin_use_fds(pam_t) @@ -16269,7 +19077,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ######################################## # # PAM console local policy -@@ -149,6 +164,8 @@ +@@ -149,6 +165,8 @@ dev_setattr_apm_bios_dev(pam_console_t) dev_getattr_dri_dev(pam_console_t) dev_setattr_dri_dev(pam_console_t) @@ -16278,7 +19086,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo dev_getattr_framebuffer_dev(pam_console_t) dev_setattr_framebuffer_dev(pam_console_t) dev_getattr_generic_usb_dev(pam_console_t) -@@ -159,6 +176,8 @@ +@@ -159,6 +177,8 @@ dev_setattr_mouse_dev(pam_console_t) dev_getattr_power_mgmt_dev(pam_console_t) dev_setattr_power_mgmt_dev(pam_console_t) @@ -16287,7 +19095,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo dev_getattr_scanner_dev(pam_console_t) dev_setattr_scanner_dev(pam_console_t) dev_getattr_sound_dev(pam_console_t) -@@ -200,6 +219,7 @@ +@@ -168,6 +188,8 @@ + dev_getattr_xserver_misc_dev(pam_console_t) + dev_setattr_xserver_misc_dev(pam_console_t) + dev_read_urand(pam_console_t) ++dev_getattr_all_chr_files(pam_console_t) ++dev_setattr_all_chr_files(pam_console_t) + + mls_file_read_all_levels(pam_console_t) + mls_file_write_all_levels(pam_console_t) +@@ -200,6 +222,7 @@ fs_list_auto_mountpoints(pam_console_t) fs_list_noxattr_fs(pam_console_t) @@ -16295,7 +19112,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo init_use_fds(pam_console_t) init_use_script_ptys(pam_console_t) -@@ -236,7 +256,7 @@ +@@ -236,7 +259,7 @@ optional_policy(` xserver_read_xdm_pid(pam_console_t) @@ -16304,7 +19121,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') ######################################## -@@ -256,6 +276,7 @@ +@@ -256,6 +279,7 @@ userdom_dontaudit_use_unpriv_users_ttys(system_chkpwd_t) userdom_dontaudit_use_unpriv_users_ptys(system_chkpwd_t) userdom_dontaudit_use_sysadm_terms(system_chkpwd_t) @@ -16312,7 +19129,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ######################################## # -@@ -302,3 +323,28 @@ +@@ -302,3 +326,31 @@ xserver_use_xdm_fds(utempter_t) xserver_rw_xdm_pipes(utempter_t) ') @@ -16336,14 +19153,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +auth_use_nsswitch(updpwd_t) + +term_dontaudit_use_console(updpwd_t) ++term_dontaudit_use_all_user_ptys(updpwd_t) ++term_dontaudit_use_all_user_ttys(updpwd_t) +term_dontaudit_use_unallocated_ttys(updpwd_t) ++term_dontaudit_use_generic_ptys(updpwd_t) + +files_manage_etc_files(updpwd_t) +kernel_read_system_state(updpwd_t) +logging_send_syslog_msg(updpwd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.8/policy/modules/system/fstools.fc --- nsaserefpolicy/policy/modules/system/fstools.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/fstools.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/fstools.fc 2008-04-04 16:11:03.000000000 -0400 @@ -20,7 +20,6 @@ /sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0) @@ -16354,7 +19174,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.8/policy/modules/system/fstools.te --- nsaserefpolicy/policy/modules/system/fstools.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/fstools.te 2007-12-20 16:21:38.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/fstools.te 2008-04-04 16:11:03.000000000 -0400 @@ -109,8 +109,7 @@ term_use_console(fsadm_t) @@ -16389,7 +19209,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.8/policy/modules/system/fusermount.fc --- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/system/fusermount.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/fusermount.fc 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,7 @@ +# fusermount executable will have: +# label: system_u:object_r:fusermount_exec_t @@ -16400,7 +19220,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm +/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.8/policy/modules/system/fusermount.if --- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/system/fusermount.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/fusermount.if 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,41 @@ +## policy for fusermount + @@ -16446,7 +19266,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm \ No newline at end of file diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.8/policy/modules/system/fusermount.te --- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/system/fusermount.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/fusermount.te 2008-04-04 16:11:03.000000000 -0400 @@ -0,0 +1,45 @@ +policy_module(fusermount,1.0.0) + @@ -16493,9 +19313,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + + + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.fc serefpolicy-3.0.8/policy/modules/system/getty.fc +--- nsaserefpolicy/policy/modules/system/getty.fc 2007-10-22 13:21:40.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/getty.fc 2008-05-13 11:24:02.635908000 -0400 +@@ -8,5 +8,5 @@ + + /var/run/mgetty\.pid.* -- gen_context(system_u:object_r:getty_var_run_t,s0) + +-/var/spool/fax -- gen_context(system_u:object_r:getty_var_run_t,s0) +-/var/spool/voice -- gen_context(system_u:object_r:getty_var_run_t,s0) ++/var/spool/fax(/.*)? gen_context(system_u:object_r:getty_var_run_t,s0) ++/var/spool/voice(/.*)? gen_context(system_u:object_r:getty_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.8/policy/modules/system/getty.te --- nsaserefpolicy/policy/modules/system/getty.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/getty.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/getty.te 2008-04-04 16:11:03.000000000 -0400 @@ -33,7 +33,8 @@ # @@ -16508,7 +19339,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty. allow getty_t self:fifo_file rw_fifo_file_perms; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.8/policy/modules/system/hostname.te --- nsaserefpolicy/policy/modules/system/hostname.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/hostname.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/hostname.te 2008-04-04 16:11:03.000000000 -0400 @@ -8,7 +8,9 @@ type hostname_t; @@ -16534,7 +19365,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplug.te serefpolicy-3.0.8/policy/modules/system/hotplug.te --- nsaserefpolicy/policy/modules/system/hotplug.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/hotplug.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/hotplug.te 2008-04-04 16:11:03.000000000 -0400 @@ -179,6 +179,7 @@ sysnet_read_dhcpc_pid(hotplug_t) sysnet_rw_dhcp_config(hotplug_t) @@ -16556,7 +19387,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplu diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.8/policy/modules/system/init.if --- nsaserefpolicy/policy/modules/system/init.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/init.if 2007-12-27 07:18:07.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/init.if 2008-04-04 16:11:03.000000000 -0400 @@ -211,6 +211,21 @@ kernel_dontaudit_use_fds($1) ') @@ -16794,7 +19625,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.8/policy/modules/system/init.te --- nsaserefpolicy/policy/modules/system/init.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/init.te 2008-01-15 09:56:24.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/init.te 2008-04-04 16:11:03.000000000 -0400 @@ -10,6 +10,20 @@ # Declarations # @@ -17024,7 +19855,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -749,6 +803,12 @@ +@@ -738,6 +792,7 @@ + + optional_policy(` + unconfined_domain(initrc_t) ++ unconfined_domain(init_t) + + ifdef(`distro_redhat',` + # system-config-services causes avc messages that should be dontaudited +@@ -749,6 +804,12 @@ ') ') @@ -17039,7 +19878,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t vmware_append_system_config(initrc_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.fc serefpolicy-3.0.8/policy/modules/system/ipsec.fc --- nsaserefpolicy/policy/modules/system/ipsec.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/ipsec.fc 2007-12-05 08:56:38.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/ipsec.fc 2008-04-04 16:11:03.000000000 -0400 @@ -32,3 +32,4 @@ /var/racoon(/.*)? gen_context(system_u:object_r:ipsec_var_run_t,s0) @@ -17047,7 +19886,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. +/var/run/racoon.pid -- gen_context(system_u:object_r:ipsec_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.8/policy/modules/system/ipsec.te --- nsaserefpolicy/policy/modules/system/ipsec.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/ipsec.te 2007-12-06 09:02:10.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/ipsec.te 2008-04-04 16:11:03.000000000 -0400 @@ -55,11 +55,11 @@ allow ipsec_t self:capability { net_admin dac_override dac_read_search }; @@ -17158,8 +19997,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.8/policy/modules/system/iptables.te --- nsaserefpolicy/policy/modules/system/iptables.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/iptables.te 2007-12-02 21:15:34.000000000 -0500 -@@ -64,6 +64,7 @@ ++++ serefpolicy-3.0.8/policy/modules/system/iptables.te 2008-05-13 11:33:34.065230000 -0400 +@@ -64,13 +64,14 @@ init_use_script_ptys(iptables_t) # to allow rules to be saved on reboot: init_rw_script_tmp_files(iptables_t) @@ -17167,6 +20006,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl libs_use_ld_so(iptables_t) libs_use_shared_libs(iptables_t) + + logging_send_syslog_msg(iptables_t) + # system-config-network appends to /var/log +-#logging_append_system_logs(iptables_t) ++logging_append_system_logs(iptables_t) + + miscfiles_read_localization(iptables_t) + @@ -102,6 +103,10 @@ ') @@ -17180,8 +20027,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.0.8/policy/modules/system/iscsi.te --- nsaserefpolicy/policy/modules/system/iscsi.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/iscsi.te 2007-12-02 21:15:34.000000000 -0500 -@@ -68,6 +68,8 @@ ++++ serefpolicy-3.0.8/policy/modules/system/iscsi.te 2008-04-28 10:29:24.000000000 -0400 +@@ -29,7 +29,7 @@ + # + + allow iscsid_t self:capability { dac_override ipc_lock net_admin sys_nice sys_resource }; +-allow iscsid_t self:process setsched; ++allow iscsid_t self:process { setrlimit setsched signal }; + allow iscsid_t self:fifo_file { read write }; + allow iscsid_t self:unix_stream_socket { create_stream_socket_perms connectto }; + allow iscsid_t self:unix_dgram_socket create_socket_perms; +@@ -61,6 +61,7 @@ + corenet_tcp_sendrecv_all_ports(iscsid_t) + corenet_tcp_connect_http_port(iscsid_t) + corenet_tcp_connect_iscsi_port(iscsid_t) ++corenet_tcp_connect_isns_port(iscsid_t) + + dev_rw_sysfs(iscsid_t) + +@@ -68,6 +69,8 @@ files_read_etc_files(iscsid_t) @@ -17192,7 +20056,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.8/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/libraries.fc 2008-01-16 15:53:47.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/libraries.fc 2008-04-04 16:11:03.000000000 -0400 @@ -65,11 +65,15 @@ /opt/(.*/)?java/.+\.jar -- gen_context(system_u:object_r:lib_t,s0) /opt/(.*/)?jre.*/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -17270,7 +20134,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar /usr/lib(64)?/python2.4/site-packages/M2Crypto/__m2crypto.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) # vmware -@@ -284,3 +299,15 @@ +@@ -284,3 +299,18 @@ /var/spool/postfix/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0) /var/spool/postfix/usr(/.*)? gen_context(system_u:object_r:lib_t,s0) /var/spool/postfix/lib(64)?/ld.*\.so.* -- gen_context(system_u:object_r:ld_so_t,s0) @@ -17286,9 +20150,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar +/usr/lib/libswscale\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib64/libswscale\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib(64)?/libavdevice\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) ++/usr/lib(64)?/libmythavcodec-[^/]+\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) ++/usr/lib/.*/program(/.*)?\.so gen_context(system_u:object_r:lib_t,s0) ++/usr/lib64/.*/program(/.*)?\.so gen_context(system_u:object_r:lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.8/policy/modules/system/libraries.te --- nsaserefpolicy/policy/modules/system/libraries.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/libraries.te 2007-12-10 16:27:26.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/libraries.te 2008-04-04 17:42:00.000000000 -0400 @@ -23,6 +23,9 @@ init_system_domain(ldconfig_t,ldconfig_exec_t) role system_r types ldconfig_t; @@ -17333,22 +20200,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar ifdef(`hide_broken_symptoms',` optional_policy(` -@@ -96,4 +105,12 @@ +@@ -96,4 +105,13 @@ # and executes ldconfig on it. If you dont allow this kernel installs # blow up. rpm_manage_script_tmp_files(ldconfig_t) + # smart package manager needs the following for the same reason + rpm_rw_tmp_files(ldconfig_t) -+') + ') + +optional_policy(` + # run mkinitrd as unconfined user + unconfined_manage_tmp_files(ldconfig_t) + unconfined_domain(ldconfig_t) - ') ++') ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.8/policy/modules/system/locallogin.te --- nsaserefpolicy/policy/modules/system/locallogin.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/locallogin.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/locallogin.te 2008-04-04 16:11:03.000000000 -0400 @@ -97,6 +97,12 @@ term_setattr_all_user_ttys(local_login_t) term_setattr_unallocated_ttys(local_login_t) @@ -17408,8 +20276,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall # Sulogin local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.8/policy/modules/system/logging.fc --- nsaserefpolicy/policy/modules/system/logging.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/logging.fc 2008-05-07 14:09:23.000000000 -0400 -@@ -1,12 +1,15 @@ ++++ serefpolicy-3.0.8/policy/modules/system/logging.fc 2008-04-17 11:18:18.000000000 -0400 +@@ -1,12 +1,17 @@ - /dev/log -s gen_context(system_u:object_r:devlog_t,s0) @@ -17417,39 +20285,54 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin +/etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh) ++/sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0) ++/sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0) /sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0) /sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0) -+/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0) /sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0) /sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) ++/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0) +/sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) /sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) /sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0) -@@ -32,7 +35,10 @@ +@@ -26,12 +31,22 @@ + + /var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh) + /var/log/.* gen_context(system_u:object_r:var_log_t,s0) ++/var/log/messages[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) ++/var/log/secure[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) ++/var/log/cron[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) ++/var/log/maillog[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) ++/var/log/spooler[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) + /var/log/audit(/.*)? gen_context(system_u:object_r:auditd_log_t,mls_systemhigh) ++/var/log/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_run_t,s0) + + ifndef(`distro_gentoo',` /var/log/audit\.log -- gen_context(system_u:object_r:auditd_log_t,mls_systemhigh) ') ++ifdef(`distro_redhat',` +/var/named/chroot/var/log -d gen_context(system_u:object_r:var_log_t,s0) ++') + /var/run/audit_events -s gen_context(system_u:object_r:auditd_var_run_t,s0) -+/var/run/audispd_events -s gen_context(system_u:object_r:auditd_var_run_t,s0) /var/run/auditd\.pid -- gen_context(system_u:object_r:auditd_var_run_t,s0) /var/run/auditd_sock -s gen_context(system_u:object_r:auditd_var_run_t,s0) - /var/run/klogd\.pid -- gen_context(system_u:object_r:klogd_var_run_t,s0) -@@ -43,3 +49,9 @@ +@@ -43,3 +58,10 @@ /var/spool/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0) /var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) + -+/var/log/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_run_t,s0) -+/var/lib/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_lib_t,s0) -+ +/etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_script_exec_t,s0) +/etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_script_exec_t,s0) ++ ++ ++/var/run/audispd_events -s gen_context(system_u:object_r:audisp_var_run_t,s0) ++/var/cfengine/outputs(/.*)? gen_context(system_u:object_r:var_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.8/policy/modules/system/logging.if --- nsaserefpolicy/policy/modules/system/logging.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/logging.if 2008-01-17 08:59:06.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/logging.if 2008-04-10 10:49:01.000000000 -0400 @@ -34,6 +34,51 @@ # interface(`logging_send_audit_msgs',` @@ -17502,7 +20385,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin allow $1 self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; ') -@@ -219,6 +264,25 @@ +@@ -168,12 +213,7 @@ + ## + # + interface(`logging_stream_connect_auditd',` +- gen_require(` +- type auditd_t, auditd_var_run_t; +- ') +- +- files_search_pids($1) +- stream_connect_pattern($1,auditd_var_run_t,auditd_var_run_t,auditd_t) ++ logging_stream_connect_audisp($1) + ') + + ######################################## +@@ -219,6 +259,25 @@ ######################################## ## @@ -17528,7 +20425,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin ## Execute syslogd in the syslog domain. ## ## -@@ -465,12 +529,11 @@ +@@ -465,12 +524,11 @@ interface(`logging_read_all_logs',` gen_require(` attribute logfile; @@ -17543,7 +20440,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin ') ######################################## -@@ -514,6 +577,8 @@ +@@ -514,6 +572,8 @@ files_search_var($1) manage_files_pattern($1,logfile,logfile) read_lnk_files_pattern($1,logfile,logfile) @@ -17552,7 +20449,34 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin ') ######################################## -@@ -597,3 +662,183 @@ +@@ -539,6 +599,26 @@ + + ######################################## + ## ++## Dontaudit Write generic log files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`logging_dontaudit_write_generic_logs',` ++ gen_require(` ++ type var_log_t; ++ ') ++ ++ files_search_var($1) ++ dontaudit $1 var_log_t:file write; ++') ++ ++ ++######################################## ++## + ## Write generic log files. + ## + ## +@@ -597,3 +677,273 @@ files_search_var($1) manage_files_pattern($1,var_log_t,var_log_t) ') @@ -17695,54 +20619,144 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin +## +## +# -+interface(`logging_admin',` -+ logging_admin_audit($1, $2, $3) -+ logging_admin_syslog($1, $2, $3) ++interface(`logging_admin',` ++ logging_admin_audit($1, $2, $3) ++ logging_admin_syslog($1, $2, $3) ++') ++ ++######################################## ++## ++## Execute syslog server in the syslogd domain. ++## ++## ++## ++## The type of the process performing this action. ++## ++## ++# ++interface(`logging_syslog_script_domtrans',` ++ gen_require(` ++ type syslogd_script_exec_t; ++ ') ++ ++ init_script_domtrans_spec($1,syslogd_script_exec_t) ++') ++ ++######################################## ++## ++## Execute audit server in the auditd domain. ++## ++## ++## ++## The type of the process performing this action. ++## ++## ++# ++interface(`logging_audit_script_domtrans',` ++ gen_require(` ++ type auditd_script_exec_t; ++ ') ++ ++ init_script_domtrans_spec($1,auditd_script_exec_t) ++') ++ ++######################################## ++## ++## Execute a domain transition to run audisp. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`logging_domtrans_audisp',` ++ gen_require(` ++ type audisp_t; ++ type audisp_exec_t; ++ ') ++ ++ domtrans_pattern($1,audisp_exec_t,audisp_t) ++') ++ ++######################################## ++## ++## Signal the audisp domain. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`logging_audisp_signal',` ++ gen_require(` ++ type audisp_t; ++ ') ++ ++ allow $1 audisp_t:process signal; +') + +######################################## +## -+## Execute syslog server in the syslogd domain. ++## Create a domain for processes ++## which can be started by the system audisp +## +## +## -+## The type of the process performing this action. ++## Type to be used as a domain. ++## ++## ++## ++## ++## Type of the program to be used as an entry point to this domain. +## +## +# -+interface(`logging_syslog_script_domtrans',` ++interface(`logging_audisp_system_domain',` + gen_require(` -+ type syslogd_script_exec_t; ++ type audisp_t; ++ role system_r; + ') + -+ init_script_domtrans_spec($1,syslogd_script_exec_t) ++ domain_type($1) ++ domain_entry_file($1,$2) ++ ++ role system_r types $1; ++ ++ domtrans_pattern(audisp_t,$2,$1) ++ ++ allow audisp_t $2:file getattr; ++ allow $1 audisp_t:unix_stream_socket rw_socket_perms; +') + +######################################## +## -+## Execute audit server in the auditd domain. ++## Connect to auditdstored over an unix stream socket. +## +## +## -+## The type of the process performing this action. ++## Domain allowed access. +## +## +# -+interface(`logging_audit_script_domtrans',` ++interface(`logging_stream_connect_audisp',` + gen_require(` -+ type auditd_script_exec_t; ++ type audisp_t, audisp_var_run_t; ++ type auditd_t, auditd_var_run_t; + ') + -+ init_script_domtrans_spec($1,auditd_script_exec_t) ++ files_search_pids($1) ++ stream_connect_pattern($1,audisp_var_run_t,audisp_var_run_t,audisp_t) ++ stream_connect_pattern($1,auditd_var_run_t,auditd_var_run_t,auditd_t) +') -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.8/policy/modules/system/logging.te --- nsaserefpolicy/policy/modules/system/logging.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/logging.te 2007-12-25 07:00:48.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/logging.te 2008-04-17 11:18:03.000000000 -0400 @@ -1,5 +1,5 @@ -policy_module(logging,1.7.3) -+policy_module(logging,1.8.2) ++policy_module(logging,1.9.0) ######################################## # @@ -17766,7 +20780,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin type syslogd_var_run_t; files_pid_file(syslogd_var_run_t) -@@ -55,23 +61,30 @@ +@@ -55,23 +61,42 @@ logging_log_file(var_log_t) files_mountpoint(var_log_t) @@ -17780,6 +20794,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin init_ranged_daemon_domain(auditd_t,auditd_exec_t,mls_systemhigh) ') ++type audisp_t; ++type audisp_exec_t; ++init_system_domain(audisp_t, audisp_exec_t) ++ ++type audisp_var_run_t; ++files_pid_file(audisp_var_run_t) ++ ++type audisp_remote_t; ++type audisp_remote_exec_t; ++domain_type(audisp_remote_t) ++domain_entry_file(audisp_remote_t, audisp_remote_exec_t) ++ ######################################## # -# Auditd local policy @@ -17800,7 +20826,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin files_read_etc_files(auditctl_t) kernel_read_kernel_sysctls(auditctl_t) -@@ -91,6 +104,7 @@ +@@ -91,6 +116,7 @@ locallogin_dontaudit_use_fds(auditctl_t) @@ -17808,7 +20834,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin logging_send_syslog_msg(auditctl_t) ######################################## -@@ -98,16 +112,15 @@ +@@ -98,16 +124,15 @@ # Auditd local policy # @@ -17827,7 +20853,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin manage_files_pattern(auditd_t,auditd_log_t,auditd_log_t) manage_lnk_files_pattern(auditd_t,auditd_log_t,auditd_log_t) -@@ -141,6 +154,7 @@ +@@ -141,6 +166,7 @@ init_telinit(auditd_t) @@ -17835,18 +20861,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin logging_send_syslog_msg(auditd_t) libs_use_ld_so(auditd_t) -@@ -157,6 +171,10 @@ +@@ -153,9 +179,21 @@ + + seutil_dontaudit_read_config(auditd_t) + ++sysnet_dns_name_resolve(auditd_t) ++ + userdom_dontaudit_use_unpriv_user_fds(auditd_t) userdom_dontaudit_search_sysadm_home_dirs(auditd_t) - optional_policy(` -+ mta_send_mail(auditd_t) ++ifdef(`distro_ubuntu',` ++ optional_policy(` ++ unconfined_domain(auditd_t) ++ ') +') + +optional_policy(` ++ mta_send_mail(auditd_t) ++') ++ + optional_policy(` seutil_sigchld_newrole(auditd_t) ') - -@@ -194,6 +212,7 @@ +@@ -194,6 +232,7 @@ fs_getattr_all_fs(klogd_t) fs_search_auto_mountpoints(klogd_t) @@ -17854,7 +20891,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin domain_use_interactive_fds(klogd_t) -@@ -241,12 +260,16 @@ +@@ -212,6 +251,12 @@ + + userdom_dontaudit_search_sysadm_home_dirs(klogd_t) + ++ifdef(`distro_ubuntu',` ++ optional_policy(` ++ unconfined_domain(klogd_t) ++ ') ++') ++ + optional_policy(` + udev_read_db(klogd_t) + ') +@@ -241,12 +286,16 @@ allow syslogd_t self:udp_socket create_socket_perms; allow syslogd_t self:tcp_socket create_stream_socket_perms; @@ -17871,7 +20921,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin # Allow access for syslog-ng allow syslogd_t var_log_t:dir { create setattr }; -@@ -255,6 +278,9 @@ +@@ -255,6 +304,9 @@ manage_files_pattern(syslogd_t,syslogd_tmp_t,syslogd_tmp_t) files_tmp_filetrans(syslogd_t,syslogd_tmp_t,{ dir file }) @@ -17881,17 +20931,109 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin allow syslogd_t syslogd_var_run_t:file manage_file_perms; files_pid_filetrans(syslogd_t,syslogd_var_run_t,file) -@@ -312,6 +338,7 @@ +@@ -300,6 +352,7 @@ + # Allow users to define additional syslog ports to connect to + corenet_tcp_bind_syslogd_port(syslogd_t) + corenet_tcp_connect_syslogd_port(syslogd_t) ++corenet_tcp_connect_mysqld_port(syslogd_t) + + # syslog-ng can send or receive logs + corenet_sendrecv_syslogd_client_packets(syslogd_t) +@@ -312,6 +365,8 @@ domain_use_interactive_fds(syslogd_t) files_read_etc_files(syslogd_t) ++files_read_usr_files(syslogd_t) +files_read_var_files(syslogd_t) files_read_etc_runtime_files(syslogd_t) # /initrd is not umounted before minilog starts files_dontaudit_search_isid_type_dirs(syslogd_t) +@@ -341,6 +396,12 @@ + files_var_lib_filetrans(syslogd_t,devlog_t,sock_file) + ') + ++ifdef(`distro_ubuntu',` ++ optional_policy(` ++ unconfined_domain(syslogd_t) ++ ') ++') ++ + optional_policy(` + inn_manage_log(syslogd_t) + ') +@@ -365,3 +426,69 @@ + # log to the xconsole + xserver_rw_console(syslogd_t) + ') ++ ++######################################## ++# ++# audisp local policy ++# ++ ++# Init script handling ++domain_use_interactive_fds(audisp_t) ++ ++## internal communication is often done using fifo and unix sockets. ++allow audisp_t self:fifo_file rw_file_perms; ++allow audisp_t self:unix_stream_socket create_stream_socket_perms; ++allow audisp_t self:unix_dgram_socket create_socket_perms; ++allow audisp_t auditd_t:unix_stream_socket rw_file_perms; ++ ++manage_sock_files_pattern(audisp_t, audisp_var_run_t, audisp_var_run_t) ++files_pid_filetrans(audisp_t, audisp_var_run_t, sock_file) ++ ++files_read_etc_files(audisp_t) ++ ++libs_use_ld_so(audisp_t) ++libs_use_shared_libs(audisp_t) ++ ++logging_send_syslog_msg(audisp_t) ++ ++miscfiles_read_localization(audisp_t) ++ ++corecmd_search_bin(audisp_t) ++ ++sysnet_dns_name_resolve(audisp_t) ++ ++logging_domtrans_audisp(auditd_t) ++logging_audisp_signal(auditd_t) ++ ++#gen_require(` ++# type zos_remote_exec_t, zos_remote_t; ++#') ++ ++#logging_audisp_system_domain(zos_remote_t, zos_remote_exec_t) ++ ++######################################## ++# ++# audisp_remote local policy ++# ++ ++logging_audisp_system_domain(audisp_remote_t, audisp_remote_exec_t) ++ ++allow audisp_remote_t self:tcp_socket create_socket_perms; ++ ++corenet_all_recvfrom_unlabeled(audisp_remote_t) ++corenet_all_recvfrom_netlabel(audisp_remote_t) ++corenet_tcp_sendrecv_all_if(audisp_remote_t) ++corenet_tcp_sendrecv_all_nodes(audisp_remote_t) ++corenet_tcp_connect_audit_port(audisp_remote_t) ++ ++files_read_etc_files(audisp_remote_t) ++ ++libs_use_ld_so(audisp_remote_t) ++libs_use_shared_libs(audisp_remote_t) ++ ++logging_send_syslog_msg(audisp_remote_t) ++logging_audisp_system_domain(audisp_remote_t, audisp_remote_exec_t) ++ ++miscfiles_read_localization(audisp_remote_t) ++ ++sysnet_dns_name_resolve(audisp_remote_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.8/policy/modules/system/lvm.fc --- nsaserefpolicy/policy/modules/system/lvm.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/lvm.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/lvm.fc 2008-04-04 16:11:03.000000000 -0400 @@ -15,6 +15,7 @@ # /etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0) @@ -17900,9 +21042,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc /etc/lvm/archive(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0) /etc/lvm/backup(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0) /etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0) +@@ -96,3 +97,4 @@ + /var/lock/lvm(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0) + /var/run/multipathd.sock -s gen_context(system_u:object_r:lvm_var_run_t,s0) + /var/lib/multipath(/.*)? gen_context(system_u:object_r:lvm_var_lib_t,s0) ++/var/run/dmevent.* gen_context(system_u:object_r:lvm_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.8/policy/modules/system/lvm.te --- nsaserefpolicy/policy/modules/system/lvm.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/lvm.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/lvm.te 2008-04-08 14:25:54.000000000 -0400 @@ -44,9 +44,9 @@ # Cluster LVM daemon local policy # @@ -17972,18 +21119,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te userdom_dontaudit_use_unpriv_user_fds(clvmd_t) userdom_dontaudit_search_sysadm_home_dirs(clvmd_t) -@@ -131,10 +144,6 @@ +@@ -131,12 +144,12 @@ ') optional_policy(` - nis_use_ypbind(clvmd_t) --') -- --optional_policy(` - ricci_dontaudit_rw_modcluster_pipes(clvmd_t) - ricci_dontaudit_use_modcluster_fds(clvmd_t) ++ ricci_dontaudit_rw_modcluster_pipes(clvmd_t) ++ ricci_dontaudit_use_modcluster_fds(clvmd_t) + ') + + optional_policy(` +- ricci_dontaudit_rw_modcluster_pipes(clvmd_t) +- ricci_dontaudit_use_modcluster_fds(clvmd_t) ++ unconfined_domain(clvmd_t) ') -@@ -150,7 +159,8 @@ + + optional_policy(` +@@ -150,17 +163,19 @@ # DAC overrides and mknod for modifying /dev entries (vgmknodes) # rawio needed for dmraid @@ -17993,7 +21145,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te dontaudit lvm_t self:capability sys_tty_config; allow lvm_t self:process { sigchld sigkill sigstop signull signal }; # LVM will complain a lot if it cannot set its priority. -@@ -160,7 +170,8 @@ + allow lvm_t self:process setsched; + allow lvm_t self:file rw_file_perms; +-allow lvm_t self:fifo_file rw_file_perms; ++allow lvm_t self:fifo_file manage_fifo_file_perms; allow lvm_t self:unix_dgram_socket create_socket_perms; allow lvm_t self:netlink_kobject_uevent_socket create_socket_perms; @@ -18003,7 +21158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te manage_dirs_pattern(lvm_t,lvm_tmp_t,lvm_tmp_t) manage_files_pattern(lvm_t,lvm_tmp_t,lvm_tmp_t) -@@ -208,7 +219,6 @@ +@@ -208,7 +223,6 @@ selinux_compute_user_contexts(lvm_t) dev_create_generic_chr_files(lvm_t) @@ -18011,7 +21166,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te dev_read_rand(lvm_t) dev_read_urand(lvm_t) dev_rw_lvm_control(lvm_t) -@@ -228,6 +238,8 @@ +@@ -228,6 +242,8 @@ dev_dontaudit_getattr_generic_blk_files(lvm_t) dev_dontaudit_getattr_generic_pipes(lvm_t) dev_create_generic_dirs(lvm_t) @@ -18020,7 +21175,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te fs_getattr_xattr_fs(lvm_t) fs_search_auto_mountpoints(lvm_t) -@@ -246,6 +258,7 @@ +@@ -246,6 +262,7 @@ storage_dev_filetrans_fixed_disk(lvm_t) # Access raw devices and old /dev/lvm (c 109,0). Is this needed? storage_manage_fixed_disk(lvm_t) @@ -18028,7 +21183,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te term_getattr_all_user_ttys(lvm_t) term_list_ptys(lvm_t) -@@ -254,10 +267,12 @@ +@@ -254,10 +271,12 @@ domain_use_interactive_fds(lvm_t) @@ -18041,7 +21196,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te init_use_fds(lvm_t) init_dontaudit_getattr_initctl(lvm_t) -@@ -275,6 +290,8 @@ +@@ -275,6 +294,8 @@ seutil_search_default_contexts(lvm_t) seutil_sigchld_newrole(lvm_t) @@ -18050,7 +21205,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te ifdef(`distro_redhat',` # this is from the initrd: files_rw_isid_type_dirs(lvm_t) -@@ -293,5 +310,18 @@ +@@ -293,5 +314,18 @@ ') optional_policy(` @@ -18069,9 +21224,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te + xen_append_log(lvm_t) + xen_dontaudit_rw_unix_stream_sockets(lvm_t) +') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.0.8/policy/modules/system/miscfiles.fc +--- nsaserefpolicy/policy/modules/system/miscfiles.fc 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/miscfiles.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -80,3 +80,6 @@ + /var/empty/sshd/etc/localtime -- gen_context(system_u:object_r:locale_t,s0) + /var/spool/postfix/etc/localtime -- gen_context(system_u:object_r:locale_t,s0) + ') ++ ++/usr/games(/.*)?/fonts(/.*)? gen_context(system_u:object_r:fonts_t,s0) ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.0.8/policy/modules/system/miscfiles.if --- nsaserefpolicy/policy/modules/system/miscfiles.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/miscfiles.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/miscfiles.if 2008-04-21 16:59:26.000000000 -0400 @@ -57,6 +57,26 @@ ## ## @@ -18108,9 +21273,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi delete_dirs_pattern($1,man_t,man_t) delete_files_pattern($1,man_t,man_t) delete_lnk_files_pattern($1,man_t,man_t) +@@ -467,3 +489,23 @@ + manage_lnk_files_pattern($1,locale_t,locale_t) + ') + ++######################################## ++## ++## dontaudit_attempts to write locale files ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++# ++interface(`miscfiles_dontaudit_write_locale',` ++ gen_require(` ++ type locale_t; ++ ') ++ ++ dontaudit $1 locale_t:dir write; ++ dontaudit $1 locale_t:file write; ++') ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.if serefpolicy-3.0.8/policy/modules/system/modutils.if --- nsaserefpolicy/policy/modules/system/modutils.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/modutils.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/modutils.if 2008-04-04 16:11:03.000000000 -0400 @@ -66,6 +66,25 @@ ######################################## @@ -18139,7 +21328,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.8/policy/modules/system/modutils.te --- nsaserefpolicy/policy/modules/system/modutils.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/modutils.te 2008-01-03 10:41:36.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/modutils.te 2008-04-08 14:23:01.000000000 -0400 @@ -42,7 +42,7 @@ # insmod local policy # @@ -18255,15 +21444,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti ################################# diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.8/policy/modules/system/mount.fc --- nsaserefpolicy/policy/modules/system/mount.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/mount.fc 2007-12-02 21:15:34.000000000 -0500 -@@ -1,4 +1,2 @@ ++++ serefpolicy-3.0.8/policy/modules/system/mount.fc 2008-04-04 16:11:03.000000000 -0400 +@@ -1,4 +1,4 @@ /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) - -/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) ++/sbin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) ++/sbin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.8/policy/modules/system/mount.te --- nsaserefpolicy/policy/modules/system/mount.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/mount.te 2008-01-16 10:54:29.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/mount.te 2008-04-04 16:11:04.000000000 -0400 @@ -8,6 +8,13 @@ ## @@ -18337,7 +21528,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. fs_getattr_xattr_fs(mount_t) fs_getattr_cifs(mount_t) -@@ -101,6 +113,8 @@ +@@ -71,6 +83,7 @@ + fs_remount_all_fs(mount_t) + fs_relabelfrom_all_fs(mount_t) + fs_list_auto_mountpoints(mount_t) ++fs_manage_tmpfs_dirs(mount_t) + fs_rw_tmpfs_chr_files(mount_t) + fs_read_tmpfs_symlinks(mount_t) + +@@ -101,6 +114,8 @@ init_use_fds(mount_t) init_use_script_ptys(mount_t) init_dontaudit_getattr_initctl(mount_t) @@ -18346,7 +21545,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. libs_use_ld_so(mount_t) libs_use_shared_libs(mount_t) -@@ -118,6 +132,7 @@ +@@ -118,6 +133,7 @@ seutil_read_config(mount_t) userdom_use_all_users_fds(mount_t) @@ -18354,7 +21553,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ifdef(`distro_redhat',` optional_policy(` -@@ -127,10 +142,15 @@ +@@ -127,10 +143,15 @@ ') ') @@ -18371,7 +21570,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ') optional_policy(` -@@ -159,13 +179,9 @@ +@@ -159,13 +180,9 @@ fs_search_rpc(mount_t) @@ -18386,7 +21585,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ') optional_policy(` -@@ -180,17 +196,18 @@ +@@ -180,17 +197,18 @@ ') ') @@ -18409,7 +21608,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ') ######################################## -@@ -201,4 +218,29 @@ +@@ -201,4 +219,29 @@ optional_policy(` files_etc_filetrans_etc_runtime(unconfined_mount_t,file) unconfined_domain(unconfined_mount_t) @@ -18441,7 +21640,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.8/policy/modules/system/raid.te --- nsaserefpolicy/policy/modules/system/raid.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/raid.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/raid.te 2008-04-04 16:11:04.000000000 -0400 @@ -19,7 +19,7 @@ # Local policy # @@ -18472,7 +21671,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.8/policy/modules/system/selinuxutil.fc --- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.fc 2008-04-04 16:11:04.000000000 -0400 @@ -38,7 +38,7 @@ /usr/sbin/restorecond -- gen_context(system_u:object_r:restorecond_exec_t,s0) /usr/sbin/run_init -- gen_context(system_u:object_r:run_init_exec_t,s0) @@ -18484,7 +21683,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.8/policy/modules/system/selinuxutil.if --- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.if 2008-04-04 17:18:58.000000000 -0400 @@ -585,7 +585,7 @@ type selinux_config_t; ') @@ -18693,7 +21892,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu + type semanage_tmp_t; + type policy_config_t; + ') -+ allow $1 self:capability { dac_override audit_write }; ++ allow $1 self:capability { dac_override audit_write sys_resource }; + allow $1 self:process signal; + allow $1 self:unix_stream_socket create_stream_socket_perms; + allow $1 self:unix_dgram_socket create_socket_perms; @@ -18760,7 +21959,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.8/policy/modules/system/selinuxutil.te --- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.te 2008-05-02 14:54:27.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.te 2008-04-28 10:25:32.000000000 -0400 @@ -76,7 +76,6 @@ type restorecond_exec_t; init_daemon_domain(restorecond_t,restorecond_exec_t) @@ -18930,17 +22129,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu -kernel_read_kernel_sysctls(semanage_t) - -corecmd_exec_bin(semanage_t) +- +-dev_read_urand(semanage_t) +init_dontaudit_use_fds(setsebool_t) --dev_read_urand(semanage_t) +-domain_use_interactive_fds(semanage_t) +# Bug in semanage +seutil_domtrans_setfiles(setsebool_t) +seutil_manage_file_contexts(setsebool_t) +seutil_manage_default_contexts(setsebool_t) +seutil_manage_selinux_config(setsebool_t) --domain_use_interactive_fds(semanage_t) -- -files_read_etc_files(semanage_t) -files_read_etc_runtime_files(semanage_t) -files_read_usr_files(semanage_t) @@ -19006,7 +22205,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # cjp: need a more general way to handle this: ifdef(`enable_mls',` # read secadm tmp files -@@ -516,11 +499,19 @@ +@@ -516,11 +499,20 @@ allow setfiles_t self:capability { dac_override dac_read_search fowner }; dontaudit setfiles_t self:capability sys_tty_config; allow setfiles_t self:fifo_file rw_file_perms; @@ -19022,11 +22221,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu + +files_list_isid_type_dirs(setfiles_t) +files_read_isid_type_files(setfiles_t) ++files_dontaudit_read_all_symlinks(setfiles_t) + kernel_read_system_state(setfiles_t) kernel_relabelfrom_unlabeled_dirs(setfiles_t) kernel_relabelfrom_unlabeled_files(setfiles_t) -@@ -537,6 +528,7 @@ +@@ -537,6 +529,7 @@ fs_getattr_xattr_fs(setfiles_t) fs_list_all(setfiles_t) @@ -19034,7 +22234,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu fs_search_auto_mountpoints(setfiles_t) fs_relabelfrom_noxattr_fs(setfiles_t) -@@ -552,9 +544,7 @@ +@@ -552,9 +545,7 @@ selinux_compute_relabel_context(setfiles_t) selinux_compute_user_contexts(setfiles_t) @@ -19045,11 +22245,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # this is to satisfy the assertion: auth_relabelto_shadow(setfiles_t) -@@ -590,8 +580,16 @@ +@@ -590,8 +581,20 @@ fs_relabel_tmpfs_chr_file(setfiles_t) ') +optional_policy(` ++ cron_system_entry(setfiles_t, setfiles_exec_t) ++') ++ ++optional_policy(` + rpm_dontaudit_rw_pipes(setfiles_t) +') + @@ -19064,7 +22268,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.fc serefpolicy-3.0.8/policy/modules/system/sysnetwork.fc --- nsaserefpolicy/policy/modules/system/sysnetwork.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.fc 2008-04-04 16:11:04.000000000 -0400 @@ -52,8 +52,7 @@ /var/lib/dhcpcd(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0) /var/lib/dhclient(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0) @@ -19077,7 +22281,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet /var/lib/dhcpc(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.8/policy/modules/system/sysnetwork.if --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.if 2008-01-16 08:56:54.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.if 2008-04-04 16:11:04.000000000 -0400 @@ -145,6 +145,25 @@ ######################################## @@ -19150,7 +22354,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.8/policy/modules/system/sysnetwork.te --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.te 2008-04-04 16:11:04.000000000 -0400 @@ -45,7 +45,7 @@ dontaudit dhcpc_t self:capability sys_tty_config; # for access("/etc/bashrc", X_OK) on Red Hat @@ -19244,16 +22448,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet # Create UDP sockets, necessary when called from dhcpc allow ifconfig_t self:udp_socket create_socket_perms; -@@ -270,6 +283,8 @@ +@@ -269,7 +282,10 @@ + kernel_read_system_state(ifconfig_t) kernel_read_network_state(ifconfig_t) kernel_search_network_sysctl(ifconfig_t) ++kernel_search_debugfs(ifconfig_t) kernel_rw_net_sysctls(ifconfig_t) +# This should be put inside a boolean, but can not because of attributes +kernel_load_module(ifconfig_t) corenet_rw_tun_tap_dev(ifconfig_t) -@@ -280,8 +295,11 @@ +@@ -280,8 +296,11 @@ fs_getattr_xattr_fs(ifconfig_t) fs_search_auto_mountpoints(ifconfig_t) @@ -19265,7 +22471,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet domain_use_interactive_fds(ifconfig_t) -@@ -327,6 +345,14 @@ +@@ -327,6 +346,14 @@ ') optional_policy(` @@ -19280,9 +22486,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet kernel_read_xen_state(ifconfig_t) kernel_write_xen_state(ifconfig_t) xen_append_log(ifconfig_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.if serefpolicy-3.0.8/policy/modules/system/udev.if +--- nsaserefpolicy/policy/modules/system/udev.if 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/udev.if 2008-04-28 10:54:36.000000000 -0400 +@@ -106,11 +106,11 @@ + # + interface(`udev_read_db',` + gen_require(` +- type udev_tdb_t; ++ type udev_tbl_t; + ') + + dev_list_all_dev_nodes($1) +- allow $1 udev_tdb_t:file read_file_perms; ++ read_files_pattern($1, udev_tbl_t, udev_tbl_t) + ') + + ######################################## +@@ -125,9 +125,9 @@ + # + interface(`udev_rw_db',` + gen_require(` +- type udev_tdb_t; ++ type udev_tbl_t; + ') + + dev_list_all_dev_nodes($1) +- allow $1 udev_tdb_t:file rw_file_perms; ++ allow $1 udev_tbl_t:file rw_file_perms; + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.8/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/udev.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/udev.te 2008-04-04 16:11:04.000000000 -0400 @@ -132,6 +132,7 @@ init_read_utmp(udev_t) @@ -19327,18 +22562,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.0.8/policy/modules/system/unconfined.fc --- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/unconfined.fc 2007-12-10 14:53:06.000000000 -0500 -@@ -10,3 +10,7 @@ - /usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) ++++ serefpolicy-3.0.8/policy/modules/system/unconfined.fc 2008-04-04 16:11:04.000000000 -0400 +@@ -7,6 +7,8 @@ + /usr/bin/vncserver -- gen_context(system_u:object_r:unconfined_exec_t,s0) + /usr/lib/ia32el/ia32x_loader -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) +-/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) +- /usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) +/usr/bin/rhythmbox -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) +/usr/bin/sbcl -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) -+/usr/bin/mock -- gen_context(system_u:object_r:unconfined_notrans_exec_t,s0) ++/usr/sbin/mock -- gen_context(system_u:object_r:unconfined_notrans_exec_t,s0) +/usr/sbin/sysreport -- gen_context(system_u:object_r:unconfined_notrans_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.8/policy/modules/system/unconfined.if --- nsaserefpolicy/policy/modules/system/unconfined.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/unconfined.if 2008-01-16 16:20:55.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/unconfined.if 2008-04-04 16:11:04.000000000 -0400 @@ -12,14 +12,13 @@ # interface(`unconfined_domain_noaudit',` @@ -19654,7 +22892,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.8/policy/modules/system/unconfined.te --- nsaserefpolicy/policy/modules/system/unconfined.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/unconfined.te 2007-12-10 14:39:10.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/unconfined.te 2008-04-24 16:58:39.000000000 -0400 @@ -5,36 +5,57 @@ # # Declarations @@ -19804,14 +23042,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf optional_policy(` - modutils_run_update_mods(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) +-') +- +-optional_policy(` +- mono_domtrans(unconfined_t) + mono_run(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) ') - optional_policy(` -- mono_domtrans(unconfined_t) --') -- --optional_policy(` - mta_per_role_template(unconfined,unconfined_t,unconfined_r) + modutils_run_update_mods(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) ') @@ -19844,7 +23082,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf optional_policy(` samba_per_role_template(unconfined) - samba_run_net(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) +- samba_run_net(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) ++ samba_run_unconfined_net(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) samba_run_winbind_helper(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) + samba_run_smbcontrol(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) ') @@ -19861,9 +23100,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf optional_policy(` - wine_domtrans(unconfined_t) + wine_run(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) -+') -+ -+optional_policy(` + ') + + optional_policy(` +- xserver_domtrans_xdm_xserver(unconfined_t) + mozilla_per_role_template(unconfined, unconfined_t, unconfined_r) + unconfined_domain(unconfined_mozilla_t) + allow unconfined_mozilla_t self:process { execstack execmem }; @@ -19871,41 +23111,48 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + +optional_policy(` + kismet_run(unconfined_t, unconfined_r, { unconfined_tty_device_t unconfined_devpts_t }) - ') - - optional_policy(` -- xserver_domtrans_xdm_xserver(unconfined_t) ++') ++ ++optional_policy(` + xserver_run_xdm_xserver(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) + xserver_xdm_rw_shm(unconfined_t) ') ######################################## -@@ -219,14 +236,38 @@ +@@ -219,14 +236,42 @@ allow unconfined_execmem_t self:process { execstack execmem }; unconfined_domain_noaudit(unconfined_execmem_t) +allow unconfined_execmem_t unconfined_t:process transition; optional_policy(` - dbus_stub(unconfined_execmem_t) +- dbus_stub(unconfined_execmem_t) ++ gen_require(` ++ type unconfined_dbusd_t; ++ ') ++ unconfined_domain(unconfined_dbusd_t) ++') ++optional_policy(` init_dbus_chat_script(unconfined_execmem_t) ++ dbus_system_bus_client_template(unconfined_execmem, unconfined_execmem_t) unconfined_dbus_chat(unconfined_execmem_t) -+ dbus_connect_system_bus(unconfined_execmem_t) + unconfined_dbus_connect(unconfined_execmem_t) -+ -+ optional_policy(` -+ avahi_dbus_chat(unconfined_execmem_t) -+ ') ++') - optional_policy(` - hal_dbus_chat(unconfined_execmem_t) - ') +- optional_policy(` +- hal_dbus_chat(unconfined_execmem_t) +- ') ++optional_policy(` ++ avahi_dbus_chat(unconfined_execmem_t) ++') + -+ optional_policy(` -+ xserver_xdm_rw_shm(unconfined_execmem_t) ++optional_policy(` ++ hal_dbus_chat(unconfined_execmem_t) ++') + -+ ') ++optional_policy(` ++ xserver_xdm_rw_shm(unconfined_execmem_t) ') + +corecmd_exec_all_executables(unconfined_t) @@ -19921,7 +23168,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.0.8/policy/modules/system/userdomain.fc --- nsaserefpolicy/policy/modules/system/userdomain.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/userdomain.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/userdomain.fc 2008-04-04 16:11:04.000000000 -0400 @@ -1,4 +1,4 @@ HOME_DIR -d gen_context(system_u:object_r:ROLE_home_dir_t,s0-mls_systemhigh) +HOME_DIR -l gen_context(system_u:object_r:ROLE_home_dir_t,s0-mls_systemhigh) @@ -19930,7 +23177,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo /tmp/gconfd-USER -d gen_context(system_u:object_r:ROLE_tmp_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.8/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/userdomain.if 2008-05-07 14:03:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/userdomain.if 2008-05-13 11:36:47.155727000 -0400 @@ -29,8 +29,9 @@ ') @@ -20936,7 +24183,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo read_files_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t) ') -@@ -2066,7 +2193,7 @@ +@@ -2034,6 +2161,10 @@ + ') + + dontaudit $2 $1_home_t:file write; ++ fs_dontaudit_list_nfs($2) ++ fs_dontaudit_rw_nfs_files($2) ++ fs_dontaudit_list_cifs($2) ++ fs_dontaudit_rw_cifs_files($2) + ') + + ######################################## +@@ -2066,7 +2197,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -20945,7 +24203,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo read_lnk_files_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t) ') -@@ -2100,7 +2227,7 @@ +@@ -2100,7 +2231,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -20954,7 +24212,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo exec_files_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t) ') -@@ -2169,7 +2296,7 @@ +@@ -2169,7 +2300,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -20963,7 +24221,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $2 $1_home_dir_t:dir search_dir_perms; manage_files_pattern($2,$1_home_t,$1_home_t) ') -@@ -2241,7 +2368,7 @@ +@@ -2241,7 +2372,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -20972,7 +24230,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $2 $1_home_dir_t:dir search_dir_perms; manage_lnk_files_pattern($2,$1_home_t,$1_home_t) ') -@@ -2278,7 +2405,7 @@ +@@ -2278,7 +2409,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -20981,7 +24239,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $2 $1_home_dir_t:dir search_dir_perms; manage_fifo_files_pattern($2,$1_home_t,$1_home_t) ') -@@ -2315,7 +2442,7 @@ +@@ -2315,7 +2446,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -20990,7 +24248,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $2 $1_home_dir_t:dir search_dir_perms; manage_sock_files_pattern($2,$1_home_t,$1_home_t) ') -@@ -2365,7 +2492,7 @@ +@@ -2365,7 +2496,7 @@ type $1_home_dir_t; ') @@ -20999,7 +24257,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo filetrans_pattern($2,$1_home_dir_t,$3,$4) ') -@@ -2414,7 +2541,7 @@ +@@ -2414,7 +2545,7 @@ type $1_home_t; ') @@ -21008,7 +24266,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo filetrans_pattern($2,$1_home_t,$3,$4) ') -@@ -2458,7 +2585,7 @@ +@@ -2458,7 +2589,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -21017,7 +24275,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo filetrans_pattern($2,$1_home_dir_t,$1_home_t,$3) ') -@@ -2994,6 +3121,25 @@ +@@ -2994,6 +3125,25 @@ ######################################## ## @@ -21043,7 +24301,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ## Create objects in a user temporary directory ## with an automatic type transition to ## a specified private type. -@@ -3078,7 +3224,7 @@ +@@ -3078,7 +3228,7 @@ # template(`userdom_tmp_filetrans_user_tmp',` gen_require(` @@ -21052,7 +24310,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') files_tmp_filetrans($2,$1_tmp_t,$3) -@@ -3086,11 +3232,11 @@ +@@ -3086,11 +3236,11 @@ ######################################## ## @@ -21066,7 +24324,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ##

##

## This is a templated interface, and should only -@@ -3122,6 +3268,42 @@ +@@ -3122,6 +3272,42 @@ ######################################## ##

@@ -21109,7 +24367,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ## List users untrusted directories. ## ## -@@ -4089,7 +4271,7 @@ +@@ -4089,7 +4275,7 @@ type staff_home_dir_t; ') @@ -21118,7 +24376,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 staff_home_dir_t:dir search_dir_perms; ') -@@ -4128,7 +4310,7 @@ +@@ -4128,7 +4314,7 @@ type staff_home_dir_t; ') @@ -21127,7 +24385,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 staff_home_dir_t:dir manage_dir_perms; ') -@@ -4147,7 +4329,7 @@ +@@ -4147,7 +4333,7 @@ type staff_home_dir_t; ') @@ -21136,7 +24394,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 staff_home_dir_t:dir relabelto; ') -@@ -4185,7 +4367,7 @@ +@@ -4185,7 +4371,7 @@ type staff_home_dir_t, staff_home_t; ') @@ -21145,7 +24403,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 { staff_home_dir_t staff_home_t }:dir list_dir_perms; read_files_pattern($1,{ staff_home_dir_t staff_home_t },staff_home_t) read_lnk_files_pattern($1,{ staff_home_dir_t staff_home_t },staff_home_t) -@@ -4410,6 +4592,7 @@ +@@ -4410,6 +4596,7 @@ ') dontaudit $1 sysadm_home_dir_t:dir getattr; @@ -21153,7 +24411,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4444,9 +4627,11 @@ +@@ -4444,9 +4631,11 @@ interface(`userdom_dontaudit_search_sysadm_home_dirs',` gen_require(` type sysadm_home_dir_t; @@ -21165,7 +24423,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4570,10 +4755,11 @@ +@@ -4570,10 +4759,11 @@ type sysadm_home_dir_t, sysadm_home_t; ') @@ -21178,7 +24436,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4609,11 +4795,29 @@ +@@ -4609,11 +4799,29 @@ # interface(`userdom_search_all_users_home_dirs',` gen_require(` @@ -21209,7 +24467,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4633,6 +4837,14 @@ +@@ -4633,6 +4841,14 @@ files_list_home($1) allow $1 home_dir_type:dir list_dir_perms; @@ -21224,7 +24482,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4895,7 +5107,7 @@ +@@ -4895,7 +5111,7 @@ type user_home_dir_t, user_home_t; ') @@ -21233,7 +24491,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo filetrans_pattern($1,user_home_dir_t,user_home_t,$2) ') -@@ -4933,7 +5145,7 @@ +@@ -4933,7 +5149,7 @@ type user_home_dir_t; ') @@ -21242,7 +24500,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 user_home_dir_t:dir manage_dir_perms; ') -@@ -4954,7 +5166,7 @@ +@@ -4954,7 +5170,7 @@ type user_home_t; ') @@ -21251,7 +24509,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_dirs_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') -@@ -4973,7 +5185,7 @@ +@@ -4973,7 +5189,7 @@ type staff_home_dir_t; ') @@ -21260,7 +24518,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 user_home_dir_t:dir relabelto; ') -@@ -4992,7 +5204,7 @@ +@@ -4992,7 +5208,7 @@ type user_home_t, user_home_dir_t; ') @@ -21269,7 +24527,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 user_home_t:dir list_dir_perms; read_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') -@@ -5013,7 +5225,7 @@ +@@ -5013,7 +5229,7 @@ type user_home_t; ') @@ -21278,7 +24536,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 user_home_t:file execute; ') -@@ -5033,7 +5245,7 @@ +@@ -5033,7 +5249,7 @@ type user_home_dir_t, user_home_t; ') @@ -21287,7 +24545,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') -@@ -5072,7 +5284,7 @@ +@@ -5072,7 +5288,7 @@ type user_home_t; ') @@ -21296,7 +24554,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_lnk_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') -@@ -5092,7 +5304,7 @@ +@@ -5092,7 +5308,7 @@ type user_home_t; ') @@ -21305,7 +24563,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_fifo_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') -@@ -5112,7 +5324,7 @@ +@@ -5112,7 +5328,7 @@ type user_home_t; ') @@ -21314,7 +24572,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_sock_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') -@@ -5131,7 +5343,7 @@ +@@ -5131,7 +5347,7 @@ attribute user_home_dir_type; ') @@ -21323,7 +24581,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 user_home_dir_type:dir search_dir_perms; ') -@@ -5151,7 +5363,7 @@ +@@ -5151,7 +5367,7 @@ attribute user_home_dir_type, user_home_type; ') @@ -21332,7 +24590,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 user_home_type:dir list_dir_perms; read_files_pattern($1,{ user_home_dir_type user_home_type },user_home_type) read_lnk_files_pattern($1,{ user_home_dir_type user_home_type },user_home_type) -@@ -5173,7 +5385,7 @@ +@@ -5173,7 +5389,7 @@ attribute user_home_dir_type, user_home_type; ') @@ -21341,7 +24599,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_dirs_pattern($1,{ user_home_dir_type user_home_type },user_home_type) ') -@@ -5193,7 +5405,7 @@ +@@ -5193,7 +5409,7 @@ attribute user_home_dir_type, user_home_type; ') @@ -21350,7 +24608,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_files_pattern($1,{ user_home_dir_type user_home_type },user_home_type) ') -@@ -5323,7 +5535,7 @@ +@@ -5323,7 +5539,7 @@ attribute user_tmpfile; ') @@ -21359,7 +24617,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5346,6 +5558,25 @@ +@@ -5346,6 +5562,25 @@ ######################################## ## @@ -21385,7 +24643,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ## Write all unprivileged users files in /tmp ## ## -@@ -5529,6 +5760,24 @@ +@@ -5529,6 +5764,24 @@ ######################################## ## @@ -21410,7 +24668,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ## Send a dbus message to all user domains. ## ## -@@ -5559,3 +5808,419 @@ +@@ -5559,3 +5812,420 @@ interface(`userdom_unconfined',` refpolicywarn(`$0($*) has been deprecated.') ') @@ -21830,9 +25088,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + typeattribute $2 userdomain; +') + ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.8/policy/modules/system/userdomain.te --- nsaserefpolicy/policy/modules/system/userdomain.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/userdomain.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/userdomain.te 2008-04-04 16:30:31.000000000 -0400 @@ -24,13 +24,6 @@ ## @@ -21952,7 +25211,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ', ` userdom_security_admin_template(sysadm_t,sysadm_r,admin_terminal) ') -@@ -494,3 +497,15 @@ +@@ -494,3 +497,30 @@ optional_policy(` yam_run(sysadm_t,sysadm_r,admin_terminal) ') @@ -21968,14 +25227,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + netutils_run_traceroute_cond(staff_t,staff_r,{ staff_tty_device_t staff_devpts_t }) +') + ++tunable_policy(`use_nfs_home_dirs',` ++ manage_dirs_pattern(privhome, nfs_t, nfs_t) ++ manage_files_pattern(privhome, nfs_t, nfs_t) ++ manage_lnk_files_pattern(privhome, nfs_t, nfs_t) ++ manage_sock_files_pattern(privhome, nfs_t, nfs_t) ++ manage_fifo_files_pattern(privhome, nfs_t, nfs_t) ++') ++ ++tunable_policy(`use_samba_home_dirs',` ++ manage_dirs_pattern(privhome, cifs_t, cifs_t) ++ manage_files_pattern(privhome, cifs_t, cifs_t) ++ manage_lnk_files_pattern(privhome, cifs_t, cifs_t) ++ manage_sock_files_pattern(privhome, cifs_t, cifs_t) ++ manage_fifo_files_pattern(privhome, cifs_t, cifs_t) ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.fc serefpolicy-3.0.8/policy/modules/system/virt.fc --- nsaserefpolicy/policy/modules/system/virt.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/system/virt.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/virt.fc 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1 @@ +/var/lib/libvirt(/.*)? gen_context(system_u:object_r:virt_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.0.8/policy/modules/system/virt.if --- nsaserefpolicy/policy/modules/system/virt.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/system/virt.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/virt.if 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1,78 @@ +## Virtualization + @@ -22057,14 +25331,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.0.8/policy/modules/system/virt.te --- nsaserefpolicy/policy/modules/system/virt.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/system/virt.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/virt.te 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1,3 @@ +# var/lib files +type virt_var_lib_t; +files_type(virt_var_lib_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.8/policy/modules/system/xen.if --- nsaserefpolicy/policy/modules/system/xen.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/xen.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/xen.if 2008-04-04 16:11:04.000000000 -0400 @@ -191,3 +191,24 @@ domtrans_pattern($1,xm_exec_t,xm_t) @@ -22092,7 +25366,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.8/policy/modules/system/xen.te --- nsaserefpolicy/policy/modules/system/xen.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/xen.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/system/xen.te 2008-04-04 16:11:04.000000000 -0400 @@ -45,9 +45,7 @@ type xenstored_t; @@ -22268,17 +25542,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.8/policy/modules/users/guest.fc --- nsaserefpolicy/policy/modules/users/guest.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/guest.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/users/guest.fc 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1 @@ +# No guest file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.8/policy/modules/users/guest.if --- nsaserefpolicy/policy/modules/users/guest.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/guest.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/users/guest.if 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1 @@ +## Policy for guest user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.8/policy/modules/users/guest.te --- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/guest.te 2007-12-22 07:19:20.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/users/guest.te 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1,12 @@ +policy_module(guest,1.0.1) +userdom_restricted_user_template(guest) @@ -22294,17 +25568,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.t +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.8/policy/modules/users/logadm.fc --- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/logadm.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/users/logadm.fc 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1 @@ +# No logadm file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.8/policy/modules/users/logadm.if --- nsaserefpolicy/policy/modules/users/logadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/logadm.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/users/logadm.if 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1 @@ +## Policy for logadm user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.8/policy/modules/users/logadm.te --- nsaserefpolicy/policy/modules/users/logadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/logadm.te 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/users/logadm.te 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1,11 @@ +policy_module(logadm,1.0.0) + @@ -22319,22 +25593,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm. +logging_admin(logadm_t, logadm_r, { logadm_tty_device_t logadm_devpts_t }) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.8/policy/modules/users/metadata.xml --- nsaserefpolicy/policy/modules/users/metadata.xml 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/metadata.xml 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/users/metadata.xml 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1 @@ +Policy modules for users diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.8/policy/modules/users/webadm.fc --- nsaserefpolicy/policy/modules/users/webadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/webadm.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/users/webadm.fc 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1 @@ +# No webadm file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.8/policy/modules/users/webadm.if --- nsaserefpolicy/policy/modules/users/webadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/webadm.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/users/webadm.if 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1 @@ +## Policy for webadm user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.8/policy/modules/users/webadm.te --- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/webadm.te 2007-12-07 15:47:51.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/users/webadm.te 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1,42 @@ +policy_module(webadm,1.0.0) + @@ -22380,18 +25654,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm. +allow webadm_t gadmin_t:dir getattr; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.fc serefpolicy-3.0.8/policy/modules/users/xguest.fc --- nsaserefpolicy/policy/modules/users/xguest.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/xguest.fc 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/users/xguest.fc 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1 @@ +# No xguest file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.if serefpolicy-3.0.8/policy/modules/users/xguest.if --- nsaserefpolicy/policy/modules/users/xguest.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/xguest.if 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/modules/users/xguest.if 2008-04-04 16:11:04.000000000 -0400 @@ -0,0 +1 @@ +## Policy for xguest user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.te serefpolicy-3.0.8/policy/modules/users/xguest.te --- nsaserefpolicy/policy/modules/users/xguest.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/xguest.te 2008-01-13 08:40:30.000000000 -0500 -@@ -0,0 +1,57 @@ ++++ serefpolicy-3.0.8/policy/modules/users/xguest.te 2008-04-04 16:11:04.000000000 -0400 +@@ -0,0 +1,62 @@ +policy_module(xguest,1.0.1) + +## @@ -22421,6 +25695,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest. + mozilla_per_role_template(xguest, xguest_t, xguest_r) +') + ++optional_policy(` ++ openoffice_per_role_template(xguest, xguest_usertype, xguest_r) ++') ++ ++ +# Allow mounting of file systems +optional_policy(` + tunable_policy(`xguest_mount_media',` @@ -22451,7 +25730,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.8/policy/support/obj_perm_sets.spt --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/policy/support/obj_perm_sets.spt 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/support/obj_perm_sets.spt 2008-04-04 16:11:04.000000000 -0400 @@ -216,7 +216,7 @@ define(`getattr_file_perms',`{ getattr }') define(`setattr_file_perms',`{ setattr }') @@ -22480,7 +25759,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.8/policy/users --- nsaserefpolicy/policy/users 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/policy/users 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/policy/users 2008-04-04 16:11:04.000000000 -0400 @@ -16,7 +16,7 @@ # and a user process should never be assigned the system user # identity. @@ -22515,61 +25794,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0 - gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) -') +gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.8/Rules.modular ---- nsaserefpolicy/Rules.modular 2007-10-22 13:21:44.000000000 -0400 -+++ serefpolicy-3.0.8/Rules.modular 2007-12-02 21:15:34.000000000 -0500 -@@ -96,6 +96,9 @@ - @test -d $(builddir) || mkdir -p $(builddir) - $(verbose) $(SEMOD_PKG) -o $@ -m $(base_mod) -f $(base_fc) -u $(users_extra) -s $(tmpdir)/seusers - -+ifneq "$(UNK_PERMS)" "" -+$(base_mod): CHECKMODULE += -U $(UNK_PERMS) -+endif - $(base_mod): $(base_conf) - @echo "Compiling $(NAME) base module" - $(verbose) $(CHECKMODULE) $^ -o $@ -@@ -144,6 +147,7 @@ - - $(tmpdir)/rolemap.conf: M4PARAM += -D self_contained_policy - $(tmpdir)/rolemap.conf: $(rolemap) -+ $(verbose) echo "" > $@ - $(call parse-rolemap,base,$@) - - $(tmpdir)/all_te_files.conf: M4PARAM += -D self_contained_policy -diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.monolithic serefpolicy-3.0.8/Rules.monolithic ---- nsaserefpolicy/Rules.monolithic 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/Rules.monolithic 2007-12-02 21:15:34.000000000 -0500 -@@ -63,6 +63,9 @@ - # - # Build a binary policy locally - # -+ifneq "$(UNK_PERMS)" "" -+$(polver): CHECKPOLICY += -U $(UNK_PERMS) -+endif - $(polver): $(policy_conf) - @echo "Compiling $(NAME) $(polver)" - ifneq ($(pv),$(kv)) -@@ -76,6 +79,9 @@ - # - # Install a binary policy - # -+ifneq "$(UNK_PERMS)" "" -+$(loadpath): CHECKPOLICY += -U $(UNK_PERMS) -+endif - $(loadpath): $(policy_conf) - @mkdir -p $(policypath) - @echo "Compiling and installing $(NAME) $(loadpath)" -@@ -127,6 +133,7 @@ - @echo "divert" >> $@ - - $(tmpdir)/rolemap.conf: $(rolemap) -+ $(verbose) echo "" > $@ - $(call parse-rolemap,base,$@) - - $(tmpdir)/all_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf $(all_te_files) $(tmpdir)/rolemap.conf diff --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.0.8/support/Makefile.devel --- nsaserefpolicy/support/Makefile.devel 2007-10-22 13:21:44.000000000 -0400 -+++ serefpolicy-3.0.8/support/Makefile.devel 2007-12-02 21:15:34.000000000 -0500 ++++ serefpolicy-3.0.8/support/Makefile.devel 2008-04-04 16:11:04.000000000 -0400 @@ -31,10 +31,10 @@ genxml := $(PYTHON) $(HEADERDIR)/support/segenxml.py diff --git a/selinux-policy.spec b/selinux-policy.spec index 121956f..cc55659 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -17,7 +17,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.0.8 -Release: 102%{?dist} +Release: 103%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -381,7 +381,11 @@ exit 0 %endif %changelog -* Wed May 7 2008 Dan Walsh 3.0.8-102 +* Tue May 13 2008 Dan Walsh 3.0.8-103 +-Fix labeling on /var/spool/fax and /var/spool/voice + +* Mon May 7 2008 Dan Walsh 3.0.8-102 +- Allow pam_console to setattr on cpu_device_t - Dontaudit pam_t writing homedir * Thu Apr 17 2008 Dan Walsh 3.0.8-101