diff --git a/policy-20070703.patch b/policy-20070703.patch index 5b9a1dc..1a6b623 100644 --- a/policy-20070703.patch +++ b/policy-20070703.patch @@ -1481,16 +1481,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.0.8/policy/modules/admin/kudzu.te --- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/kudzu.te 2007-10-30 16:10:13.000000000 -0400 -@@ -9,6 +9,7 @@ - type kudzu_t; - type kudzu_exec_t; - init_system_domain(kudzu_t,kudzu_exec_t) -+domain_trusted_type(kudzu_t) - - type kudzu_tmp_t; - files_tmp_file(kudzu_tmp_t) -@@ -21,8 +22,8 @@ ++++ serefpolicy-3.0.8/policy/modules/admin/kudzu.te 2007-10-30 19:54:56.000000000 -0400 +@@ -21,8 +21,8 @@ # Local policy # @@ -1501,7 +1493,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t allow kudzu_t self:process { signal_perms execmem }; allow kudzu_t self:fifo_file rw_fifo_file_perms; allow kudzu_t self:unix_stream_socket { connectto create_stream_socket_perms }; -@@ -68,6 +69,7 @@ +@@ -68,6 +68,7 @@ modutils_read_module_deps(kudzu_t) modutils_read_module_config(kudzu_t) modutils_rename_module_config(kudzu_t) @@ -1509,7 +1501,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t storage_read_scsi_generic(kudzu_t) storage_read_tape(kudzu_t) -@@ -103,6 +105,8 @@ +@@ -103,6 +104,8 @@ init_use_fds(kudzu_t) init_use_script_ptys(kudzu_t) init_stream_connect_script(kudzu_t) @@ -1518,7 +1510,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t # kudzu will telinit to make init re-read # the inittab after configuring serial consoles init_telinit(kudzu_t) -@@ -134,20 +138,15 @@ +@@ -134,20 +137,15 @@ ') optional_policy(` @@ -1542,6 +1534,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t ') ifdef(`TODO',` +@@ -162,6 +160,9 @@ + allow kudzu_t rhgb_t:unix_stream_socket connectto; + ') + optional_policy(` ++ unconfined_domain(kudzu_t) ++') ++optional_policy(` + role system_r types sysadm_userhelper_t; + domain_auto_trans(kudzu_t, userhelper_exec_t, sysadm_userhelper_t) + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.0.8/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-10-22 13:21:42.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/admin/logrotate.te 2007-10-29 23:59:29.000000000 -0400 @@ -3708,45 +3710,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.8/policy/modules/kernel/domain.if --- nsaserefpolicy/policy/modules/kernel/domain.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/domain.if 2007-10-30 19:46:37.000000000 -0400 -@@ -33,6 +33,36 @@ - - ######################################## - ## -+## Make the specified type usable as a trusted computer base domain. -+## -+## -+##

-+## Make the specified type usable as a trusted computer base domain. -+##

-+##

-+## This is primarily used for system runtime processes -+##

-+## -+## -+## -+## Type to be used as a basic domain type. -+## -+## -+# -+interface(`domain_trusted_type',` -+ gen_require(` -+ attribute tcbdomain; -+ ') -+ -+ domain_type($1) -+ -+ optional_policy(` -+ unconfined_domain($1) -+ ') -+') -+ -+######################################## -+## - ## Make the specified type usable as a domain. - ## - ## -@@ -45,6 +75,11 @@ ++++ serefpolicy-3.0.8/policy/modules/kernel/domain.if 2007-10-30 19:48:13.000000000 -0400 +@@ -45,6 +45,11 @@ # start with basic domain domain_base_type($1) @@ -3758,7 +3723,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain # send init a sigchld and signull optional_policy(` init_sigchld($1) -@@ -59,6 +94,7 @@ +@@ -59,6 +64,7 @@ ') optional_policy(` @@ -3766,7 +3731,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain selinux_dontaudit_read_fs($1) ') -@@ -1271,3 +1307,20 @@ +@@ -1271,3 +1277,20 @@ typeattribute $1 mmap_low_domain_type; ') @@ -4587,16 +4552,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.0.8/policy/modules/kernel/kernel.te --- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/kernel.te 2007-10-30 16:05:02.000000000 -0400 -@@ -239,6 +239,7 @@ - - domain_signal_all_domains(kernel_t) - domain_search_all_domains_state(kernel_t) -+domain_trusted_type(kernel_t) - - files_list_root(kernel_t) - files_list_etc(kernel_t) -@@ -278,6 +279,7 @@ ++++ serefpolicy-3.0.8/policy/modules/kernel/kernel.te 2007-10-30 19:49:01.000000000 -0400 +@@ -278,6 +278,7 @@ optional_policy(` logging_send_syslog_msg(kernel_t) @@ -4604,17 +4561,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ') optional_policy(` -@@ -335,10 +337,6 @@ - seutil_read_bin_policy(kernel_t) - ') - --optional_policy(` -- unconfined_domain(kernel_t) --') -- - ######################################## - # - # Unlabeled process local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.0.8/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-10-22 13:21:42.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/kernel/selinux.if 2007-10-29 23:59:29.000000000 -0400 @@ -7989,16 +7935,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. /var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.8/policy/modules/services/hal.te --- nsaserefpolicy/policy/modules/services/hal.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/hal.te 2007-10-30 16:09:07.000000000 -0400 -@@ -9,6 +9,7 @@ - type hald_t; - type hald_exec_t; - init_daemon_domain(hald_t,hald_exec_t) -+domain_trusted_type(hald_t) - - type hald_acl_t; - type hald_acl_exec_t; -@@ -49,6 +50,9 @@ ++++ serefpolicy-3.0.8/policy/modules/services/hal.te 2007-10-30 19:54:25.000000000 -0400 +@@ -49,6 +49,9 @@ type hald_var_lib_t; files_type(hald_var_lib_t) @@ -8008,7 +7946,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. ######################################## # # Local policy -@@ -70,7 +74,7 @@ +@@ -70,7 +73,7 @@ manage_files_pattern(hald_t,hald_cache_t,hald_cache_t) # log files for hald @@ -8017,7 +7955,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. logging_log_filetrans(hald_t,hald_log_t,file) manage_dirs_pattern(hald_t,hald_tmp_t,hald_tmp_t) -@@ -93,6 +97,7 @@ +@@ -93,6 +96,7 @@ kernel_rw_irq_sysctls(hald_t) kernel_rw_vm_sysctls(hald_t) kernel_write_proc_files(hald_t) @@ -8025,7 +7963,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. auth_read_pam_console_data(hald_t) -@@ -155,6 +160,8 @@ +@@ -155,6 +159,8 @@ selinux_compute_relabel_context(hald_t) selinux_compute_user_contexts(hald_t) @@ -8034,7 +7972,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. storage_raw_read_removable_device(hald_t) storage_raw_write_removable_device(hald_t) storage_raw_read_fixed_disk(hald_t) -@@ -293,6 +300,7 @@ +@@ -280,6 +286,10 @@ + ') + + optional_policy(` ++ unconfined_domain(hald_t) ++') ++ ++optional_policy(` + updfstab_domtrans(hald_t) + ') + +@@ -293,6 +303,7 @@ # allow hald_acl_t self:capability { dac_override fowner }; @@ -8042,7 +7991,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. allow hald_acl_t self:fifo_file read_fifo_file_perms; domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t) -@@ -340,10 +348,14 @@ +@@ -340,10 +351,14 @@ manage_files_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t) files_search_var_lib(hald_mac_t) @@ -10400,7 +10349,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.8/policy/modules/services/rpc.if --- nsaserefpolicy/policy/modules/services/rpc.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rpc.if 2007-10-29 23:59:29.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/rpc.if 2007-10-30 19:57:15.000000000 -0400 @@ -89,8 +89,11 @@ # bind to arbitary unused ports corenet_tcp_bind_generic_port($1_t) @@ -10414,31 +10363,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. fs_rw_rpc_named_pipes($1_t) fs_search_auto_mountpoints($1_t) -@@ -214,6 +217,24 @@ - - ######################################## - ## -+## Execute domain in nfsd domain. -+## -+## -+## -+## The type of the process performing this action. -+## -+## -+# -+interface(`rpc_domtrans_rpcd',` -+ gen_require(` -+ type rpcd_t, rpcd_exec_t; -+ ') -+ -+ domtrans_pattern($1,rpcd_exec_t,rpcd_t) -+') -+ -+######################################## -+## - ## Read NFS exported content. - ## - ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.8/policy/modules/services/rpc.te --- nsaserefpolicy/policy/modules/services/rpc.te 2007-10-22 13:21:39.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/services/rpc.te 2007-10-29 23:59:29.000000000 -0400 @@ -12787,7 +12711,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.8/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2007-10-29 23:59:29.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2007-10-30 20:09:22.000000000 -0400 @@ -26,7 +26,8 @@ type $1_chkpwd_t, can_read_shadow_passwords; application_domain($1_chkpwd_t,chkpwd_exec_t) @@ -13723,7 +13647,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.8/policy/modules/system/init.te --- nsaserefpolicy/policy/modules/system/init.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/init.te 2007-10-30 16:06:31.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/init.te 2007-10-30 19:53:21.000000000 -0400 @@ -10,6 +10,20 @@ # Declarations # @@ -13745,7 +13669,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t # used for direct running of init scripts # by admin domains attribute direct_run_init; -@@ -19,12 +33,14 @@ +@@ -19,12 +33,13 @@ # Mark process types as daemons attribute daemon; @@ -13757,11 +13681,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t type init_t; type init_exec_t; -domain_type(init_t) -+domain_trusted_type(init_t) domain_entry_file(init_t,init_exec_t) kernel_domtrans_to(init_t,init_exec_t) role system_r types init_t; -@@ -45,7 +61,7 @@ +@@ -45,7 +60,7 @@ mls_trusted_object(initctl_t) type initrc_t; @@ -13770,7 +13693,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t domain_type(initrc_t) domain_entry_file(initrc_t,initrc_exec_t) role system_r types initrc_t; -@@ -73,7 +89,7 @@ +@@ -73,7 +88,7 @@ # # Use capabilities. old rule: @@ -13779,7 +13702,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t # is ~sys_module really needed? observed: # sys_boot # sys_tty_config -@@ -171,13 +187,13 @@ +@@ -171,13 +186,14 @@ nscd_socket_use(init_t) ') @@ -13794,6 +13717,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t userdom_shell_domtrans_sysadm(init_t) +',` + optional_policy(` ++ unconfined_domain(init_t) + unconfined_shell_domtrans(init_t) + ') ') @@ -13808,7 +13732,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t dontaudit initrc_t self:capability sys_module; # sysctl is triggering this allow initrc_t self:passwd rootok; -@@ -201,10 +217,9 @@ +@@ -196,15 +212,13 @@ + allow initrc_t self:tcp_socket create_stream_socket_perms; + allow initrc_t self:udp_socket create_socket_perms; + allow initrc_t self:fifo_file rw_file_perms; +-allow initrc_t self:netlink_route_socket r_netlink_socket_perms; + allow initrc_t initrc_devpts_t:chr_file rw_term_perms; term_create_pty(initrc_t,initrc_devpts_t) @@ -13821,7 +13750,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t manage_dirs_pattern(initrc_t,initrc_state_t,initrc_state_t) manage_files_pattern(initrc_t,initrc_state_t,initrc_state_t) -@@ -283,7 +298,6 @@ +@@ -233,6 +247,8 @@ + # for lsof which is used by alsa shutdown: + kernel_dontaudit_getattr_message_if(initrc_t) + ++auth_use_nsswitch(initrc_t) ++ + files_read_kernel_symbol_table(initrc_t) + + corenet_all_recvfrom_unlabeled(initrc_t) +@@ -283,7 +299,6 @@ mls_process_read_up(initrc_t) mls_process_write_down(initrc_t) mls_rangetrans_source(initrc_t) @@ -13829,7 +13767,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t selinux_get_enforce_mode(initrc_t) -@@ -497,6 +511,47 @@ +@@ -365,8 +380,6 @@ + + seutil_read_config(initrc_t) + +-sysnet_read_config(initrc_t) +- + userdom_read_all_users_home_content_files(initrc_t) + # Allow access to the sysadm TTYs. Note that this will give access to the + # TTYs to any process in the initrc_t domain. Therefore, daemons and such +@@ -497,6 +510,47 @@ ') optional_policy(` @@ -13877,7 +13824,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t amavis_search_lib(initrc_t) amavis_setattr_pid_files(initrc_t) ') -@@ -632,12 +687,6 @@ +@@ -632,12 +686,6 @@ mta_read_config(initrc_t) mta_dontaudit_read_spool_symlinks(initrc_t) ') @@ -13890,7 +13837,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t optional_policy(` ifdef(`distro_redhat',` -@@ -703,6 +752,9 @@ +@@ -649,15 +697,10 @@ + ') + + optional_policy(` +- nis_use_ypbind(initrc_t) + nis_list_var_yp(initrc_t) + ') + + optional_policy(` +- nscd_socket_use(initrc_t) +-') +- +-optional_policy(` + openvpn_read_config(initrc_t) + ') + +@@ -703,6 +746,9 @@ # why is this needed: rpm_manage_db(initrc_t) @@ -13900,7 +13863,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -750,6 +802,10 @@ +@@ -750,6 +796,10 @@ ') optional_policy(` @@ -16077,16 +16040,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet xen_append_log(ifconfig_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.8/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/udev.te 2007-10-30 16:53:56.000000000 -0400 -@@ -13,6 +13,7 @@ - domain_obj_id_change_exemption(udev_t) - domain_entry_file(udev_t,udev_helper_exec_t) - domain_interactive_fd(udev_t) -+domain_trusted_type(udev_t) - init_daemon_domain(udev_t,udev_exec_t) - - type udev_etc_t alias etc_udev_t; -@@ -132,6 +133,7 @@ ++++ serefpolicy-3.0.8/policy/modules/system/udev.te 2007-10-30 19:53:35.000000000 -0400 +@@ -132,6 +132,7 @@ init_read_utmp(udev_t) init_dontaudit_write_utmp(udev_t) @@ -16094,7 +16049,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t libs_use_ld_so(udev_t) libs_use_shared_libs(udev_t) -@@ -184,6 +186,12 @@ +@@ -184,6 +185,12 @@ ') optional_policy(` @@ -16107,7 +16062,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t brctl_domtrans(udev_t) ') -@@ -220,6 +228,10 @@ +@@ -220,6 +227,10 @@ ') optional_policy(` @@ -16118,6 +16073,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t kernel_write_xen_state(udev_t) kernel_read_xen_state(udev_t) xen_manage_log(udev_t) +@@ -227,5 +238,9 @@ + ') + + optional_policy(` ++ unconfined_domain(udev_t) ++') ++ ++optional_policy(` + xserver_read_xdm_pid(udev_t) + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.0.8/policy/modules/system/unconfined.fc --- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-10-22 13:21:39.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/unconfined.fc 2007-10-29 23:59:29.000000000 -0400