diff --git a/permissivedomains.pp b/permissivedomains.pp index eac6aad..effa8e1 100644 Binary files a/permissivedomains.pp and b/permissivedomains.pp differ diff --git a/permissivedomains.te b/permissivedomains.te index d5d9fad..0f7a026 100644 --- a/permissivedomains.te +++ b/permissivedomains.te @@ -127,6 +127,13 @@ optional_policy(` optional_policy(` gen_require(` + type snapperd_t; + ') + permissive snapperd_t; +') + +optional_policy(` + gen_require(` type pcp_pmcd_t; type pcp_pmproxy_t; type pcp_pmwebd_t; diff --git a/policy-f20-contrib.patch b/policy-f20-contrib.patch index 28e925b..8e61db7 100644 --- a/policy-f20-contrib.patch +++ b/policy-f20-contrib.patch @@ -76871,7 +76871,7 @@ index 6dbc905..4b17c93 100644 - admin_pattern($1, rhsmcertd_lock_t) ') diff --git a/rhsmcertd.te b/rhsmcertd.te -index 1cedd70..0369e30 100644 +index 1cedd70..bfc90eb 100644 --- a/rhsmcertd.te +++ b/rhsmcertd.te @@ -30,14 +30,13 @@ files_pid_file(rhsmcertd_var_run_t) @@ -76892,7 +76892,7 @@ index 1cedd70..0369e30 100644 manage_files_pattern(rhsmcertd_t, rhsmcertd_lock_t, rhsmcertd_lock_t) files_lock_filetrans(rhsmcertd_t, rhsmcertd_lock_t, file) -@@ -52,21 +51,39 @@ files_pid_filetrans(rhsmcertd_t, rhsmcertd_var_run_t, { file dir }) +@@ -52,21 +51,40 @@ files_pid_filetrans(rhsmcertd_t, rhsmcertd_var_run_t, { file dir }) kernel_read_network_state(rhsmcertd_t) kernel_read_system_state(rhsmcertd_t) @@ -76935,6 +76935,7 @@ index 1cedd70..0369e30 100644 + +optional_policy(` rpm_read_db(rhsmcertd_t) ++ rpm_signull(rhsmcertd_t) ') diff --git a/ricci.if b/ricci.if index 2ab3ed1..23d579c 100644 @@ -81903,7 +81904,7 @@ index aee75af..a6bab06 100644 + allow $1 samba_unit_file_t:service all_service_perms; ') diff --git a/samba.te b/samba.te -index 57c034b..5410377 100644 +index 57c034b..ded3288 100644 --- a/samba.te +++ b/samba.te @@ -1,4 +1,4 @@ @@ -82076,7 +82077,14 @@ index 57c034b..5410377 100644 type smbd_t; type smbd_exec_t; -@@ -149,9 +132,10 @@ type smbd_var_run_t; +@@ -145,13 +128,17 @@ init_daemon_domain(smbd_t, smbd_exec_t) + type smbd_tmp_t; + files_tmp_file(smbd_tmp_t) + ++type smbd_tmpfs_t; ++files_tmpfs_file(smbd_tmpfs_t) ++ + type smbd_var_run_t; files_pid_file(smbd_var_run_t) type smbmount_t; @@ -82089,7 +82097,7 @@ index 57c034b..5410377 100644 type swat_t; type swat_exec_t; -@@ -170,27 +154,29 @@ type winbind_exec_t; +@@ -170,27 +157,29 @@ type winbind_exec_t; init_daemon_domain(winbind_t, winbind_exec_t) type winbind_helper_t; @@ -82127,7 +82135,7 @@ index 57c034b..5410377 100644 allow samba_net_t samba_etc_t:file read_file_perms; -@@ -206,17 +192,22 @@ manage_files_pattern(samba_net_t, samba_var_t, samba_var_t) +@@ -206,17 +195,22 @@ manage_files_pattern(samba_net_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(samba_net_t, samba_var_t, samba_var_t) files_var_filetrans(samba_net_t, samba_var_t, dir, "samba") @@ -82154,7 +82162,7 @@ index 57c034b..5410377 100644 dev_read_urand(samba_net_t) -@@ -229,15 +220,16 @@ auth_manage_cache(samba_net_t) +@@ -229,15 +223,16 @@ auth_manage_cache(samba_net_t) logging_send_syslog_msg(samba_net_t) @@ -82175,7 +82183,7 @@ index 57c034b..5410377 100644 ') optional_policy(` -@@ -245,44 +237,56 @@ optional_policy(` +@@ -245,44 +240,56 @@ optional_policy(` ') optional_policy(` @@ -82218,11 +82226,11 @@ index 57c034b..5410377 100644 -allow smbd_t { swat_t winbind_t smbcontrol_t nmbd_t }:process { signal signull }; +allow smbd_t nmbd_t:process { signal signull }; -+ -+allow smbd_t nmbd_var_run_t:file rw_file_perms; -+stream_connect_pattern(smbd_t, nmbd_var_run_t, nmbd_var_run_t, nmbd_t) -allow smbd_t samba_etc_t:file { rw_file_perms setattr_file_perms }; ++allow smbd_t nmbd_var_run_t:file rw_file_perms; ++stream_connect_pattern(smbd_t, nmbd_var_run_t, nmbd_var_run_t, nmbd_t) ++ +allow smbd_t samba_etc_t:file { rw_file_perms setattr }; manage_dirs_pattern(smbd_t, samba_log_t, samba_log_t) @@ -82244,7 +82252,7 @@ index 57c034b..5410377 100644 manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t) allow smbd_t samba_share_t:filesystem { getattr quotaget }; -@@ -292,6 +296,8 @@ manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t) +@@ -292,20 +299,26 @@ manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_sock_files_pattern(smbd_t, samba_var_t, samba_var_t) files_var_filetrans(smbd_t, samba_var_t, dir, "samba") @@ -82253,7 +82261,13 @@ index 57c034b..5410377 100644 manage_dirs_pattern(smbd_t, smbd_tmp_t, smbd_tmp_t) manage_files_pattern(smbd_t, smbd_tmp_t, smbd_tmp_t) files_tmp_filetrans(smbd_t, smbd_tmp_t, { file dir }) -@@ -301,11 +307,11 @@ manage_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t) + ++manage_dirs_pattern(smbd_t, smbd_tmpfs_t, smbd_tmpfs_t) ++manage_files_pattern(smbd_t, smbd_tmpfs_t, smbd_tmpfs_t) ++fs_tmpfs_filetrans(smbd_t, smbd_tmpfs_t, { file dir }) ++ + manage_dirs_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t) + manage_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t) manage_sock_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t) files_pid_filetrans(smbd_t, smbd_var_run_t, { dir file }) @@ -82269,7 +82283,7 @@ index 57c034b..5410377 100644 kernel_getattr_core_if(smbd_t) kernel_getattr_message_if(smbd_t) -@@ -315,43 +321,33 @@ kernel_read_kernel_sysctls(smbd_t) +@@ -315,43 +328,33 @@ kernel_read_kernel_sysctls(smbd_t) kernel_read_software_raid_state(smbd_t) kernel_read_system_state(smbd_t) @@ -82324,7 +82338,7 @@ index 57c034b..5410377 100644 fs_getattr_all_fs(smbd_t) fs_getattr_all_dirs(smbd_t) fs_get_xattr_fs_quotas(smbd_t) -@@ -360,44 +356,55 @@ fs_getattr_rpc_dirs(smbd_t) +@@ -360,44 +363,55 @@ fs_getattr_rpc_dirs(smbd_t) fs_list_inotifyfs(smbd_t) fs_get_all_fs_quotas(smbd_t) @@ -82391,7 +82405,7 @@ index 57c034b..5410377 100644 ') tunable_policy(`samba_domain_controller',` -@@ -413,20 +420,10 @@ tunable_policy(`samba_domain_controller',` +@@ -413,20 +427,10 @@ tunable_policy(`samba_domain_controller',` ') tunable_policy(`samba_enable_home_dirs',` @@ -82414,7 +82428,7 @@ index 57c034b..5410377 100644 tunable_policy(`samba_share_nfs',` fs_manage_nfs_dirs(smbd_t) fs_manage_nfs_files(smbd_t) -@@ -435,6 +432,7 @@ tunable_policy(`samba_share_nfs',` +@@ -435,6 +439,7 @@ tunable_policy(`samba_share_nfs',` fs_manage_nfs_named_sockets(smbd_t) ') @@ -82422,7 +82436,7 @@ index 57c034b..5410377 100644 tunable_policy(`samba_share_fusefs',` fs_manage_fusefs_dirs(smbd_t) fs_manage_fusefs_files(smbd_t) -@@ -442,17 +440,6 @@ tunable_policy(`samba_share_fusefs',` +@@ -442,17 +447,6 @@ tunable_policy(`samba_share_fusefs',` fs_search_fusefs(smbd_t) ') @@ -82440,7 +82454,7 @@ index 57c034b..5410377 100644 optional_policy(` ccs_read_config(smbd_t) ') -@@ -460,6 +447,7 @@ optional_policy(` +@@ -460,6 +454,7 @@ optional_policy(` optional_policy(` ctdbd_stream_connect(smbd_t) ctdbd_manage_lib_files(smbd_t) @@ -82448,7 +82462,7 @@ index 57c034b..5410377 100644 ') optional_policy(` -@@ -473,6 +461,11 @@ optional_policy(` +@@ -473,6 +468,11 @@ optional_policy(` ') optional_policy(` @@ -82460,7 +82474,7 @@ index 57c034b..5410377 100644 lpd_exec_lpr(smbd_t) ') -@@ -482,6 +475,10 @@ optional_policy(` +@@ -482,6 +482,10 @@ optional_policy(` ') optional_policy(` @@ -82471,7 +82485,7 @@ index 57c034b..5410377 100644 rpc_search_nfs_state_data(smbd_t) ') -@@ -493,9 +490,33 @@ optional_policy(` +@@ -493,9 +497,33 @@ optional_policy(` udev_read_db(smbd_t) ') @@ -82506,7 +82520,7 @@ index 57c034b..5410377 100644 # dontaudit nmbd_t self:capability sys_tty_config; -@@ -506,9 +527,11 @@ allow nmbd_t self:msg { send receive }; +@@ -506,9 +534,11 @@ allow nmbd_t self:msg { send receive }; allow nmbd_t self:msgq create_msgq_perms; allow nmbd_t self:sem create_sem_perms; allow nmbd_t self:shm create_shm_perms; @@ -82521,7 +82535,7 @@ index 57c034b..5410377 100644 manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t) manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t) -@@ -520,20 +543,15 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) +@@ -520,20 +550,15 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t) @@ -82545,7 +82559,7 @@ index 57c034b..5410377 100644 kernel_getattr_core_if(nmbd_t) kernel_getattr_message_if(nmbd_t) -@@ -542,52 +560,42 @@ kernel_read_network_state(nmbd_t) +@@ -542,52 +567,42 @@ kernel_read_network_state(nmbd_t) kernel_read_software_raid_state(nmbd_t) kernel_read_system_state(nmbd_t) @@ -82594,14 +82608,14 @@ index 57c034b..5410377 100644 - userdom_use_unpriv_users_fds(nmbd_t) -userdom_user_home_dir_filetrans_user_home_content(nmbd_t, { file dir }) -- ++userdom_dontaudit_search_user_home_dirs(nmbd_t) + -tunable_policy(`samba_export_all_ro',` - fs_read_noxattr_fs_files(nmbd_t) - files_list_non_auth_dirs(nmbd_t) - files_read_non_auth_files(nmbd_t) -') -+userdom_dontaudit_search_user_home_dirs(nmbd_t) - +- -tunable_policy(`samba_export_all_rw',` - fs_read_noxattr_fs_files(nmbd_t) - files_manage_non_auth_files(nmbd_t) @@ -82612,7 +82626,7 @@ index 57c034b..5410377 100644 ') optional_policy(` -@@ -600,19 +608,26 @@ optional_policy(` +@@ -600,19 +615,26 @@ optional_policy(` ######################################## # @@ -82632,11 +82646,11 @@ index 57c034b..5410377 100644 -read_files_pattern(smbcontrol_t, { nmbd_var_run_t smbd_var_run_t }, { nmbd_var_run_t smbd_var_run_t }) +allow smbcontrol_t nmbd_t:process { signal signull }; +read_files_pattern(smbcontrol_t, nmbd_var_run_t, nmbd_var_run_t) -+ + +allow smbcontrol_t smbd_t:process { signal signull }; +read_files_pattern(smbcontrol_t, smbd_var_run_t, smbd_var_run_t) +allow smbcontrol_t winbind_t:process { signal signull }; - ++ +files_search_var_lib(smbcontrol_t) samba_read_config(smbcontrol_t) -samba_rw_var_files(smbcontrol_t) @@ -82644,7 +82658,7 @@ index 57c034b..5410377 100644 samba_search_var(smbcontrol_t) samba_read_winbind_pid(smbcontrol_t) -@@ -620,16 +635,12 @@ domain_use_interactive_fds(smbcontrol_t) +@@ -620,16 +642,12 @@ domain_use_interactive_fds(smbcontrol_t) dev_read_urand(smbcontrol_t) @@ -82662,7 +82676,7 @@ index 57c034b..5410377 100644 optional_policy(` ctdbd_stream_connect(smbcontrol_t) -@@ -637,22 +648,23 @@ optional_policy(` +@@ -637,22 +655,23 @@ optional_policy(` ######################################## # @@ -82694,7 +82708,7 @@ index 57c034b..5410377 100644 allow smbmount_t samba_secrets_t:file manage_file_perms; -@@ -661,26 +673,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) +@@ -661,26 +680,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t) files_var_filetrans(smbmount_t, samba_var_t, dir, "samba") @@ -82730,7 +82744,7 @@ index 57c034b..5410377 100644 fs_getattr_cifs(smbmount_t) fs_mount_cifs(smbmount_t) -@@ -692,58 +700,77 @@ fs_read_cifs_files(smbmount_t) +@@ -692,58 +707,77 @@ fs_read_cifs_files(smbmount_t) storage_raw_read_fixed_disk(smbmount_t) storage_raw_write_fixed_disk(smbmount_t) @@ -82822,7 +82836,7 @@ index 57c034b..5410377 100644 manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t) manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t) -@@ -752,17 +779,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) +@@ -752,17 +786,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t) files_pid_filetrans(swat_t, swat_var_run_t, file) @@ -82846,7 +82860,7 @@ index 57c034b..5410377 100644 kernel_read_kernel_sysctls(swat_t) kernel_read_system_state(swat_t) -@@ -770,36 +793,25 @@ kernel_read_network_state(swat_t) +@@ -770,36 +800,25 @@ kernel_read_network_state(swat_t) corecmd_search_bin(swat_t) @@ -82889,7 +82903,7 @@ index 57c034b..5410377 100644 auth_domtrans_chk_passwd(swat_t) auth_use_nsswitch(swat_t) -@@ -811,10 +823,11 @@ logging_send_syslog_msg(swat_t) +@@ -811,10 +830,11 @@ logging_send_syslog_msg(swat_t) logging_send_audit_msgs(swat_t) logging_search_logs(swat_t) @@ -82903,7 +82917,7 @@ index 57c034b..5410377 100644 optional_policy(` cups_read_rw_config(swat_t) cups_stream_connect(swat_t) -@@ -834,16 +847,19 @@ optional_policy(` +@@ -834,16 +854,19 @@ optional_policy(` # allow winbind_t self:capability { dac_override ipc_lock setuid sys_nice }; @@ -82927,7 +82941,7 @@ index 57c034b..5410377 100644 allow winbind_t samba_etc_t:dir list_dir_perms; read_files_pattern(winbind_t, samba_etc_t, samba_etc_t) -@@ -853,9 +869,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) +@@ -853,9 +876,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file) manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t) @@ -82938,7 +82952,7 @@ index 57c034b..5410377 100644 manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t) manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t) -@@ -866,23 +880,21 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba") +@@ -866,23 +887,21 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba") rw_files_pattern(winbind_t, smbd_tmp_t, smbd_tmp_t) @@ -82968,7 +82982,7 @@ index 57c034b..5410377 100644 manage_sock_files_pattern(winbind_t, smbd_var_run_t, smbd_var_run_t) kernel_read_network_state(winbind_t) -@@ -891,13 +903,17 @@ kernel_read_system_state(winbind_t) +@@ -891,13 +910,17 @@ kernel_read_system_state(winbind_t) corecmd_exec_bin(winbind_t) @@ -82989,7 +83003,7 @@ index 57c034b..5410377 100644 corenet_tcp_connect_smbd_port(winbind_t) corenet_tcp_connect_epmap_port(winbind_t) corenet_tcp_connect_all_unreserved_ports(winbind_t) -@@ -905,10 +921,6 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) +@@ -905,10 +928,6 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) dev_read_sysfs(winbind_t) dev_read_urand(winbind_t) @@ -83000,7 +83014,7 @@ index 57c034b..5410377 100644 fs_getattr_all_fs(winbind_t) fs_search_auto_mountpoints(winbind_t) -@@ -917,26 +929,39 @@ auth_domtrans_chk_passwd(winbind_t) +@@ -917,26 +936,39 @@ auth_domtrans_chk_passwd(winbind_t) auth_use_nsswitch(winbind_t) auth_manage_cache(winbind_t) @@ -83042,7 +83056,7 @@ index 57c034b..5410377 100644 ') optional_policy(` -@@ -952,31 +977,29 @@ optional_policy(` +@@ -952,31 +984,29 @@ optional_policy(` # Winbind helper local policy # @@ -83080,7 +83094,7 @@ index 57c034b..5410377 100644 optional_policy(` apache_append_log(winbind_helper_t) -@@ -990,25 +1013,38 @@ optional_policy(` +@@ -990,25 +1020,38 @@ optional_policy(` ######################################## # @@ -87979,10 +87993,10 @@ index 0000000..94105ee +') diff --git a/snapper.te b/snapper.te new file mode 100644 -index 0000000..9530409 +index 0000000..3df20a6 --- /dev/null +++ b/snapper.te -@@ -0,0 +1,34 @@ +@@ -0,0 +1,56 @@ +policy_module(snapper, 1.0.0) + +######################################## @@ -87994,6 +88008,12 @@ index 0000000..9530409 +type snapperd_exec_t; +init_daemon_domain(snapperd_t, snapperd_exec_t) + ++type snapperd_log_t; ++logging_log_file(snapperd_log_t) ++ ++type snapperd_data_t; ++files_type(snapperd_data_t) ++ +######################################## +# +# snapperd local policy @@ -88002,12 +88022,27 @@ index 0000000..9530409 +allow snapperd_t self:fifo_file rw_fifo_file_perms; +allow snapperd_t self:unix_stream_socket create_stream_socket_perms; + ++manage_files_pattern(snapperd_t, snapperd_log_t, snapperd_log_t) ++logging_log_filetrans(snapperd_t, snapperd_log_t, file) ++ ++manage_files_pattern(snapperd_t, snapperd_data_t, snapperd_data_t) ++manage_dirs_pattern(snapperd_t, snapperd_data_t, snapperd_data_t) ++manage_lnk_files_pattern(snapperd_t, snapperd_data_t, snapperd_data_t) ++ ++domain_read_all_domains_state(snapperd_t) ++ ++corecmd_exec_shell(snapperd_t) ++corecmd_exec_bin(snapperd_t) ++ ++files_read_all_files(snapperd_t) ++files_list_all(snapperd_t) ++ ++fs_getattr_all_fs(snapperd_t) ++ +storage_raw_read_fixed_disk(snapperd_t) + +auth_use_nsswitch(snapperd_t) + -+miscfiles_read_localization(snapperd_t) -+ +optional_policy(` + dbus_system_domain(snapperd_t, snapperd_exec_t) + dbus_system_bus_client(snapperd_t) @@ -88017,6 +88052,7 @@ index 0000000..9530409 +optional_policy(` + mount_domtrans(snapperd_t) +') ++ diff --git a/snmp.fc b/snmp.fc index c73fa24..50d80f4 100644 --- a/snmp.fc diff --git a/selinux-policy.spec b/selinux-policy.spec index 2a7e95f..6246a43 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.12.1 -Release: 121%{?dist} +Release: 122%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -579,6 +579,9 @@ SELinux Reference policy mls base module. %endif %changelog +* Tue Jan 28 2014 Miroslav Grepl 3.12.1-122 +- Update snapper policy + * Mon Jan 27 2014 Miroslav Grepl 3.12.1-121 - Allow gdm to create /var/gdm with correct labeling - Allow domains to append rkhunterl lib files. #1057982