diff --git a/policy-f20-base.patch b/policy-f20-base.patch index 5d6dbed..70354c1 100644 --- a/policy-f20-base.patch +++ b/policy-f20-base.patch @@ -43851,7 +43851,7 @@ index db75976..4ca3a28 100644 +/var/tmp/hsperfdata_root gen_context(system_u:object_r:user_tmp_t,s0) + diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if -index 3c5dba7..79030dd 100644 +index 3c5dba7..0eec4d9 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -30,9 +30,11 @@ template(`userdom_base_user_template',` @@ -45222,7 +45222,7 @@ index 3c5dba7..79030dd 100644 + ') + + optional_policy(` -+ games_rw_data($1_usertype) ++ games_manage_data_files($1_usertype) + ') + + optional_policy(` diff --git a/policy-f20-contrib.patch b/policy-f20-contrib.patch index a02ab88..c6010de 100644 --- a/policy-f20-contrib.patch +++ b/policy-f20-contrib.patch @@ -13042,7 +13042,7 @@ index c223f81..8b567c1 100644 - admin_pattern($1, { httpd_cobbler_content_t httpd_cobbler_content_ra_t httpd_cobbler_content_rw_t }) ') diff --git a/cobbler.te b/cobbler.te -index 2a71346..7755558 100644 +index 2a71346..3a38b11 100644 --- a/cobbler.te +++ b/cobbler.te @@ -81,6 +81,7 @@ manage_dirs_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t) @@ -13103,7 +13103,7 @@ index 2a71346..7755558 100644 ') optional_policy(` -@@ -179,12 +183,26 @@ optional_policy(` +@@ -179,12 +183,22 @@ optional_policy(` optional_policy(` dhcpd_domtrans(cobblerd_t) dhcpd_initrc_domtrans(cobblerd_t) @@ -13118,10 +13118,6 @@ index 2a71346..7755558 100644 +') + +optional_policy(` -+ gnome_dontaudit_search_config(cobblerd_t) -+') -+ -+optional_policy(` + libs_exec_ldconfig(cobblerd_t) +') + @@ -13130,7 +13126,7 @@ index 2a71346..7755558 100644 ') optional_policy(` -@@ -192,13 +210,13 @@ optional_policy(` +@@ -192,13 +206,13 @@ optional_policy(` ') optional_policy(` @@ -27846,6 +27842,34 @@ index e50f33c..de8e914 100644 - fs_read_nfs_files(sftpd_t) - fs_read_nfs_symlinks(ftpd_t) -') +diff --git a/games.if b/games.if +index e2a3e0d..50ebd40 100644 +--- a/games.if ++++ b/games.if +@@ -58,3 +58,23 @@ interface(`games_rw_data',` + files_search_var_lib($1) + rw_files_pattern($1, games_data_t, games_data_t) + ') ++ ++######################################## ++## ++## Manage games data files. ++## games data. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`games_manage_data_files',` ++ gen_require(` ++ type games_data_t; ++ ') ++ ++ files_search_var_lib($1) ++ manage_files_pattern($1, games_data_t, games_data_t) ++') diff --git a/games.te b/games.te index 572fb12..879c59a 100644 --- a/games.te @@ -95220,10 +95244,10 @@ index 0000000..6a1f575 +') diff --git a/swift.te b/swift.te new file mode 100644 -index 0000000..9ee77b2 +index 0000000..d3fe02a --- /dev/null +++ b/swift.te -@@ -0,0 +1,97 @@ +@@ -0,0 +1,119 @@ +policy_module(swift, 1.0.0) + +######################################## @@ -95231,6 +95255,15 @@ index 0000000..9ee77b2 +# Declarations +# + ++## ++##

++## Determine whether swift can ++## connect to all TCP ports ++##

++##
++gen_tunable(swift_can_network, false) ++ ++ +type swift_t; +type swift_exec_t; +init_daemon_domain(swift_t, swift_exec_t) @@ -95299,7 +95332,14 @@ index 0000000..9ee77b2 +kernel_read_system_state(swift_t) +kernel_read_network_state(swift_t) + ++# bug in swift ++corenet_tcp_bind_xserver_port(swift_t) ++corenet_tcp_bind_http_cache_port(swift_t) ++ ++corenet_tcp_connect_xserver_port(swift_t) ++ +corecmd_exec_shell(swift_t) ++corecmd_exec_bin(swift_t) + +dev_read_urand(swift_t) + @@ -95317,6 +95357,12 @@ index 0000000..9ee77b2 + +userdom_dontaudit_search_user_home_dirs(swift_t) + ++tunable_policy(`swift_can_network',` ++ corenet_sendrecv_all_client_packets(swift_t) ++ corenet_tcp_connect_all_ports(swift_t) ++ corenet_tcp_sendrecv_all_ports(swift_t) ++') ++ +optional_policy(` + rpm_exec(swift_t) + rpm_dontaudit_manage_db(swift_t) diff --git a/selinux-policy.spec b/selinux-policy.spec index f199f12..f9ab584 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.12.1 -Release: 168%{?dist} +Release: 169%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -579,6 +579,11 @@ SELinux Reference policy mls base module. %endif %changelog +* Tue Jun 17 2014 Lukas Vrabec 3.12.1-169 +- Allow unpriv users to manage games data files. Needed by nethack. +- add games_manage_data_files() interface +- Revert gnome_dontaudit_search_config in cobbler policy + * Thu Jun 12 2014 Lukas Vrabec 3.12.1-168 - Google chrome has a new directory in homedir - Allow nova domains to read passwd/utmp files