diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index 7ba4bba..56656df 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -1616,7 +1616,7 @@ index c6ca761..0c86bfd 100644 ') diff --git a/policy/modules/admin/netutils.te b/policy/modules/admin/netutils.te -index 8128de8..0bb92ab 100644 +index 8128de8..b0a385b 100644 --- a/policy/modules/admin/netutils.te +++ b/policy/modules/admin/netutils.te @@ -7,10 +7,10 @@ policy_module(netutils, 1.11.2) @@ -1700,7 +1700,11 @@ index 8128de8..0bb92ab 100644 domain_use_interactive_fds(ping_t) -@@ -132,11 +137,9 @@ kernel_read_system_state(ping_t) +@@ -129,14 +134,13 @@ files_read_etc_files(ping_t) + files_dontaudit_search_var(ping_t) + + kernel_read_system_state(ping_t) ++kernel_read_network_state(ping_t) auth_use_nsswitch(ping_t) @@ -1714,7 +1718,7 @@ index 8128de8..0bb92ab 100644 ifdef(`hide_broken_symptoms',` init_dontaudit_use_fds(ping_t) -@@ -147,11 +150,25 @@ ifdef(`hide_broken_symptoms',` +@@ -147,11 +151,25 @@ ifdef(`hide_broken_symptoms',` ') ') @@ -1740,7 +1744,7 @@ index 8128de8..0bb92ab 100644 pcmcia_use_cardmgr_fds(ping_t) ') -@@ -159,6 +176,15 @@ optional_policy(` +@@ -159,6 +177,15 @@ optional_policy(` hotplug_use_fds(ping_t) ') @@ -1756,7 +1760,7 @@ index 8128de8..0bb92ab 100644 ######################################## # # Traceroute local policy -@@ -172,7 +198,6 @@ allow traceroute_t self:udp_socket create_socket_perms; +@@ -172,7 +199,6 @@ allow traceroute_t self:udp_socket create_socket_perms; kernel_read_system_state(traceroute_t) kernel_read_network_state(traceroute_t) @@ -1764,7 +1768,7 @@ index 8128de8..0bb92ab 100644 corenet_all_recvfrom_netlabel(traceroute_t) corenet_tcp_sendrecv_generic_if(traceroute_t) corenet_udp_sendrecv_generic_if(traceroute_t) -@@ -196,6 +221,7 @@ fs_dontaudit_getattr_xattr_fs(traceroute_t) +@@ -196,6 +222,7 @@ fs_dontaudit_getattr_xattr_fs(traceroute_t) domain_use_interactive_fds(traceroute_t) files_read_etc_files(traceroute_t) @@ -1772,7 +1776,7 @@ index 8128de8..0bb92ab 100644 files_dontaudit_search_var(traceroute_t) init_use_fds(traceroute_t) -@@ -204,11 +230,17 @@ auth_use_nsswitch(traceroute_t) +@@ -204,11 +231,17 @@ auth_use_nsswitch(traceroute_t) logging_send_syslog_msg(traceroute_t) @@ -3567,7 +3571,7 @@ index f9b25c1..9af1f7a 100644 +/usr/lib/udev/devices/ppp -c gen_context(system_u:object_r:ppp_device_t,s0) +/usr/lib/udev/devices/net/.* -c gen_context(system_u:object_r:tun_tap_device_t,s0) diff --git a/policy/modules/kernel/corenetwork.if.in b/policy/modules/kernel/corenetwork.if.in -index 07126bd..4aecd37 100644 +index 07126bd..d6ec4a8 100644 --- a/policy/modules/kernel/corenetwork.if.in +++ b/policy/modules/kernel/corenetwork.if.in @@ -55,6 +55,7 @@ interface(`corenet_reserved_port',` @@ -3636,10 +3640,29 @@ index 07126bd..4aecd37 100644 ## Bind TCP sockets to generic nodes. ## ## -@@ -855,6 +893,25 @@ interface(`corenet_udp_bind_generic_node',` +@@ -855,6 +893,44 @@ interface(`corenet_udp_bind_generic_node',` ######################################## ## ++## Dontaudit attempts to bind TCP sockets to generic nodes. ++## ++## ++## ++## Domain to not audit. ++## ++## ++## ++# ++interface(`corenet_dontaudit_tcp_bind_generic_node',` ++ gen_require(` ++ type node_t; ++ ') ++ ++ dontaudit $1 node_t:tcp_socket node_bind; ++') ++ ++######################################## ++## +## Dontaudit attempts to bind UDP sockets to generic nodes. +## +## @@ -3662,7 +3685,7 @@ index 07126bd..4aecd37 100644 ## Bind raw sockets to genric nodes. ## ## -@@ -928,6 +985,24 @@ interface(`corenet_inout_generic_node',` +@@ -928,6 +1004,24 @@ interface(`corenet_inout_generic_node',` ######################################## ## @@ -3687,7 +3710,7 @@ index 07126bd..4aecd37 100644 ## Send and receive TCP network traffic on all nodes. ## ## -@@ -1102,6 +1177,24 @@ interface(`corenet_raw_sendrecv_all_nodes',` +@@ -1102,6 +1196,24 @@ interface(`corenet_raw_sendrecv_all_nodes',` ######################################## ## @@ -3712,7 +3735,7 @@ index 07126bd..4aecd37 100644 ## Bind TCP sockets to all nodes. ## ## -@@ -1157,6 +1250,24 @@ interface(`corenet_raw_bind_all_nodes',` +@@ -1157,6 +1269,24 @@ interface(`corenet_raw_bind_all_nodes',` ######################################## ## @@ -3737,7 +3760,7 @@ index 07126bd..4aecd37 100644 ## Send and receive TCP network traffic on generic ports. ## ## -@@ -1167,10 +1278,30 @@ interface(`corenet_raw_bind_all_nodes',` +@@ -1167,10 +1297,30 @@ interface(`corenet_raw_bind_all_nodes',` # interface(`corenet_tcp_sendrecv_generic_port',` gen_require(` @@ -3770,7 +3793,7 @@ index 07126bd..4aecd37 100644 ') ######################################## -@@ -1185,10 +1316,10 @@ interface(`corenet_tcp_sendrecv_generic_port',` +@@ -1185,10 +1335,10 @@ interface(`corenet_tcp_sendrecv_generic_port',` # interface(`corenet_dontaudit_tcp_sendrecv_generic_port',` gen_require(` @@ -3783,7 +3806,7 @@ index 07126bd..4aecd37 100644 ') ######################################## -@@ -1203,10 +1334,10 @@ interface(`corenet_dontaudit_tcp_sendrecv_generic_port',` +@@ -1203,10 +1353,10 @@ interface(`corenet_dontaudit_tcp_sendrecv_generic_port',` # interface(`corenet_udp_send_generic_port',` gen_require(` @@ -3796,7 +3819,7 @@ index 07126bd..4aecd37 100644 ') ######################################## -@@ -1221,10 +1352,10 @@ interface(`corenet_udp_send_generic_port',` +@@ -1221,10 +1371,10 @@ interface(`corenet_udp_send_generic_port',` # interface(`corenet_udp_receive_generic_port',` gen_require(` @@ -3809,7 +3832,7 @@ index 07126bd..4aecd37 100644 ') ######################################## -@@ -1244,6 +1375,26 @@ interface(`corenet_udp_sendrecv_generic_port',` +@@ -1244,6 +1394,26 @@ interface(`corenet_udp_sendrecv_generic_port',` ######################################## ## @@ -3836,7 +3859,7 @@ index 07126bd..4aecd37 100644 ## Bind TCP sockets to generic ports. ## ## -@@ -1254,16 +1405,35 @@ interface(`corenet_udp_sendrecv_generic_port',` +@@ -1254,16 +1424,35 @@ interface(`corenet_udp_sendrecv_generic_port',` # interface(`corenet_tcp_bind_generic_port',` gen_require(` @@ -3874,7 +3897,7 @@ index 07126bd..4aecd37 100644 ## Do not audit bind TCP sockets to generic ports. ## ## -@@ -1274,10 +1444,10 @@ interface(`corenet_tcp_bind_generic_port',` +@@ -1274,10 +1463,10 @@ interface(`corenet_tcp_bind_generic_port',` # interface(`corenet_dontaudit_tcp_bind_generic_port',` gen_require(` @@ -3887,7 +3910,7 @@ index 07126bd..4aecd37 100644 ') ######################################## -@@ -1292,16 +1462,34 @@ interface(`corenet_dontaudit_tcp_bind_generic_port',` +@@ -1292,16 +1481,34 @@ interface(`corenet_dontaudit_tcp_bind_generic_port',` # interface(`corenet_udp_bind_generic_port',` gen_require(` @@ -3924,15 +3947,14 @@ index 07126bd..4aecd37 100644 ## Connect TCP sockets to generic ports. ## ## -@@ -1312,10 +1500,28 @@ interface(`corenet_udp_bind_generic_port',` +@@ -1312,10 +1519,28 @@ interface(`corenet_udp_bind_generic_port',` # interface(`corenet_tcp_connect_generic_port',` gen_require(` - type port_t; + type port_t, unreserved_port_t, ephemeral_port_t; - ') - -- allow $1 port_t:tcp_socket name_connect; ++ ') ++ + allow $1 { port_t unreserved_port_t ephemeral_port_t }:tcp_socket name_connect; +') + @@ -3949,13 +3971,14 @@ index 07126bd..4aecd37 100644 +interface(`corenet_dccp_sendrecv_all_ports',` + gen_require(` + attribute port_type; -+ ') -+ + ') + +- allow $1 port_t:tcp_socket name_connect; + allow $1 port_type:dccp_socket { send_msg recv_msg }; ') ######################################## -@@ -1439,6 +1645,25 @@ interface(`corenet_udp_sendrecv_all_ports',` +@@ -1439,6 +1664,25 @@ interface(`corenet_udp_sendrecv_all_ports',` ######################################## ## @@ -3981,7 +4004,7 @@ index 07126bd..4aecd37 100644 ## Bind TCP sockets to all ports. ## ## -@@ -1458,6 +1683,24 @@ interface(`corenet_tcp_bind_all_ports',` +@@ -1458,6 +1702,24 @@ interface(`corenet_tcp_bind_all_ports',` ######################################## ## @@ -4006,7 +4029,7 @@ index 07126bd..4aecd37 100644 ## Do not audit attepts to bind TCP sockets to any ports. ## ## -@@ -1513,6 +1756,24 @@ interface(`corenet_dontaudit_udp_bind_all_ports',` +@@ -1513,6 +1775,24 @@ interface(`corenet_dontaudit_udp_bind_all_ports',` ######################################## ## @@ -4031,7 +4054,7 @@ index 07126bd..4aecd37 100644 ## Connect TCP sockets to all ports. ## ## -@@ -1559,6 +1820,25 @@ interface(`corenet_tcp_connect_all_ports',` +@@ -1559,6 +1839,25 @@ interface(`corenet_tcp_connect_all_ports',` ######################################## ## @@ -4057,7 +4080,7 @@ index 07126bd..4aecd37 100644 ## Do not audit attempts to connect TCP sockets ## to all ports. ## -@@ -1578,6 +1858,24 @@ interface(`corenet_dontaudit_tcp_connect_all_ports',` +@@ -1578,6 +1877,24 @@ interface(`corenet_dontaudit_tcp_connect_all_ports',` ######################################## ## @@ -4082,7 +4105,7 @@ index 07126bd..4aecd37 100644 ## Send and receive TCP network traffic on generic reserved ports. ## ## -@@ -1647,6 +1945,25 @@ interface(`corenet_udp_sendrecv_reserved_port',` +@@ -1647,6 +1964,25 @@ interface(`corenet_udp_sendrecv_reserved_port',` ######################################## ## @@ -4108,7 +4131,7 @@ index 07126bd..4aecd37 100644 ## Bind TCP sockets to generic reserved ports. ## ## -@@ -1685,6 +2002,24 @@ interface(`corenet_udp_bind_reserved_port',` +@@ -1685,6 +2021,24 @@ interface(`corenet_udp_bind_reserved_port',` ######################################## ## @@ -4133,7 +4156,7 @@ index 07126bd..4aecd37 100644 ## Connect TCP sockets to generic reserved ports. ## ## -@@ -1703,6 +2038,24 @@ interface(`corenet_tcp_connect_reserved_port',` +@@ -1703,6 +2057,24 @@ interface(`corenet_tcp_connect_reserved_port',` ######################################## ## @@ -4158,7 +4181,7 @@ index 07126bd..4aecd37 100644 ## Send and receive TCP network traffic on all reserved ports. ## ## -@@ -1752,12 +2105,210 @@ interface(`corenet_udp_receive_all_reserved_ports',` +@@ -1752,12 +2124,210 @@ interface(`corenet_udp_receive_all_reserved_ports',` attribute reserved_port_type; ') @@ -4371,7 +4394,7 @@ index 07126bd..4aecd37 100644 ## ## ## -@@ -1765,14 +2316,17 @@ interface(`corenet_udp_receive_all_reserved_ports',` +@@ -1765,14 +2335,17 @@ interface(`corenet_udp_receive_all_reserved_ports',` ## ## # @@ -4393,7 +4416,7 @@ index 07126bd..4aecd37 100644 ## ## ## -@@ -1780,36 +2334,35 @@ interface(`corenet_udp_sendrecv_all_reserved_ports',` +@@ -1780,36 +2353,35 @@ interface(`corenet_udp_sendrecv_all_reserved_ports',` ## ## # @@ -4437,7 +4460,7 @@ index 07126bd..4aecd37 100644 ## ## ## -@@ -1817,36 +2370,35 @@ interface(`corenet_dontaudit_tcp_bind_all_reserved_ports',` +@@ -1817,36 +2389,35 @@ interface(`corenet_dontaudit_tcp_bind_all_reserved_ports',` ## ## # @@ -4488,7 +4511,7 @@ index 07126bd..4aecd37 100644 ## ## ## -@@ -1854,17 +2406,17 @@ interface(`corenet_dontaudit_udp_bind_all_reserved_ports',` +@@ -1854,17 +2425,17 @@ interface(`corenet_dontaudit_udp_bind_all_reserved_ports',` ## ## # @@ -4509,7 +4532,7 @@ index 07126bd..4aecd37 100644 ## ## ## -@@ -1872,67 +2424,68 @@ interface(`corenet_tcp_bind_all_unreserved_ports',` +@@ -1872,67 +2443,68 @@ interface(`corenet_tcp_bind_all_unreserved_ports',` ## ## # @@ -4596,7 +4619,7 @@ index 07126bd..4aecd37 100644 ') ######################################## -@@ -1955,6 +2508,25 @@ interface(`corenet_tcp_connect_all_rpc_ports',` +@@ -1955,6 +2527,25 @@ interface(`corenet_tcp_connect_all_rpc_ports',` ######################################## ## @@ -4622,7 +4645,7 @@ index 07126bd..4aecd37 100644 ## Do not audit attempts to connect TCP sockets ## all rpc ports. ## -@@ -1993,6 +2565,24 @@ interface(`corenet_rw_tun_tap_dev',` +@@ -1993,6 +2584,24 @@ interface(`corenet_rw_tun_tap_dev',` ######################################## ## @@ -4647,7 +4670,7 @@ index 07126bd..4aecd37 100644 ## Do not audit attempts to read or write the TUN/TAP ## virtual network device. ## -@@ -2049,6 +2639,25 @@ interface(`corenet_rw_ppp_dev',` +@@ -2049,6 +2658,25 @@ interface(`corenet_rw_ppp_dev',` ######################################## ## @@ -4673,7 +4696,7 @@ index 07126bd..4aecd37 100644 ## Bind TCP sockets to all RPC ports. ## ## -@@ -2068,6 +2677,24 @@ interface(`corenet_tcp_bind_all_rpc_ports',` +@@ -2068,6 +2696,24 @@ interface(`corenet_tcp_bind_all_rpc_ports',` ######################################## ## @@ -4698,7 +4721,7 @@ index 07126bd..4aecd37 100644 ## Do not audit attempts to bind TCP sockets to all RPC ports. ## ## -@@ -2194,6 +2821,25 @@ interface(`corenet_tcp_recv_netlabel',` +@@ -2194,6 +2840,25 @@ interface(`corenet_tcp_recv_netlabel',` ######################################## ## @@ -4724,7 +4747,7 @@ index 07126bd..4aecd37 100644 ## Receive TCP packets from a NetLabel connection. ## ## -@@ -2213,7 +2859,7 @@ interface(`corenet_tcp_recvfrom_netlabel',` +@@ -2213,7 +2878,7 @@ interface(`corenet_tcp_recvfrom_netlabel',` ######################################## ## @@ -4733,7 +4756,7 @@ index 07126bd..4aecd37 100644 ## ## ## -@@ -2221,10 +2867,15 @@ interface(`corenet_tcp_recvfrom_netlabel',` +@@ -2221,10 +2886,15 @@ interface(`corenet_tcp_recvfrom_netlabel',` ## ## # @@ -4751,7 +4774,7 @@ index 07126bd..4aecd37 100644 # XXX - at some point the oubound/send access check will be removed # but for right now we need to keep this in place so as not to break # older systems -@@ -2249,6 +2900,26 @@ interface(`corenet_dontaudit_tcp_recv_netlabel',` +@@ -2249,6 +2919,26 @@ interface(`corenet_dontaudit_tcp_recv_netlabel',` ######################################## ## @@ -4778,7 +4801,7 @@ index 07126bd..4aecd37 100644 ## Do not audit attempts to receive TCP packets from a NetLabel ## connection. ## -@@ -2269,6 +2940,27 @@ interface(`corenet_dontaudit_tcp_recvfrom_netlabel',` +@@ -2269,6 +2959,27 @@ interface(`corenet_dontaudit_tcp_recvfrom_netlabel',` ######################################## ## @@ -4806,7 +4829,7 @@ index 07126bd..4aecd37 100644 ## Do not audit attempts to receive TCP packets from an unlabeled ## connection. ## -@@ -2533,15 +3225,10 @@ interface(`corenet_dontaudit_raw_recvfrom_unlabeled',` +@@ -2533,15 +3244,10 @@ interface(`corenet_dontaudit_raw_recvfrom_unlabeled',` ## # interface(`corenet_all_recvfrom_unlabeled',` @@ -4826,7 +4849,7 @@ index 07126bd..4aecd37 100644 ') ######################################## -@@ -2567,11 +3254,34 @@ interface(`corenet_all_recvfrom_unlabeled',` +@@ -2567,11 +3273,34 @@ interface(`corenet_all_recvfrom_unlabeled',` # interface(`corenet_all_recvfrom_netlabel',` gen_require(` @@ -4864,7 +4887,7 @@ index 07126bd..4aecd37 100644 ') ######################################## -@@ -2585,6 +3295,7 @@ interface(`corenet_all_recvfrom_netlabel',` +@@ -2585,6 +3314,7 @@ interface(`corenet_all_recvfrom_netlabel',` ## # interface(`corenet_dontaudit_all_recvfrom_unlabeled',` @@ -4872,7 +4895,7 @@ index 07126bd..4aecd37 100644 kernel_dontaudit_tcp_recvfrom_unlabeled($1) kernel_dontaudit_udp_recvfrom_unlabeled($1) kernel_dontaudit_raw_recvfrom_unlabeled($1) -@@ -2613,7 +3324,35 @@ interface(`corenet_dontaudit_all_recvfrom_netlabel',` +@@ -2613,7 +3343,35 @@ interface(`corenet_dontaudit_all_recvfrom_netlabel',` ') dontaudit $1 netlabel_peer_t:peer recv; @@ -4909,7 +4932,7 @@ index 07126bd..4aecd37 100644 ') ######################################## -@@ -2727,6 +3466,7 @@ interface(`corenet_raw_recvfrom_labeled',` +@@ -2727,6 +3485,7 @@ interface(`corenet_raw_recvfrom_labeled',` ## # interface(`corenet_all_recvfrom_labeled',` @@ -4917,7 +4940,7 @@ index 07126bd..4aecd37 100644 corenet_tcp_recvfrom_labeled($1, $2) corenet_udp_recvfrom_labeled($1, $2) corenet_raw_recvfrom_labeled($1, $2) -@@ -3134,3 +3874,53 @@ interface(`corenet_unconfined',` +@@ -3134,3 +3893,53 @@ interface(`corenet_unconfined',` typeattribute $1 corenet_unconfined_type; ') @@ -5027,7 +5050,7 @@ index 8e0f9cd..b9f45b9 100644 define(`create_packet_interfaces',`` diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in -index 4edc40d..49513c7 100644 +index 4edc40d..f678b45 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -5,6 +5,7 @@ policy_module(corenetwork, 1.18.4) @@ -5200,7 +5223,8 @@ index 4edc40d..49513c7 100644 network_port(mail, tcp,2000,s0, tcp,3905,s0) network_port(matahari, tcp,49000,s0, udp,49000,s0) network_port(memcache, tcp,11211,s0, udp,11211,s0) - network_port(milter) # no defined portcon +-network_port(milter) # no defined portcon ++network_port(milter, tcp, 8891, s0) # no defined portcon network_port(mmcc, tcp,5050,s0, udp,5050,s0) +network_port(mongod, tcp,27017,s0) network_port(monopd, tcp,1234,s0) @@ -5332,7 +5356,16 @@ index 4edc40d..49513c7 100644 ######################################## # -@@ -342,9 +388,24 @@ typealias netif_t alias { lo_netif_t netif_lo_t }; +@@ -330,6 +376,8 @@ sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh) + + build_option(`enable_mls',` + network_interface(lo, lo, s0 - mls_systemhigh) ++allow netlabel_peer_t lo_netif_t:netif ingress; ++allow netlabel_peer_type lo_netif_t:netif egress; + ',` + typealias netif_t alias { lo_netif_t netif_lo_t }; + ') +@@ -342,9 +390,24 @@ typealias netif_t alias { lo_netif_t netif_lo_t }; allow corenet_unconfined_type node_type:node *; allow corenet_unconfined_type netif_type:netif *; allow corenet_unconfined_type packet_type:packet *; @@ -12180,7 +12213,7 @@ index 8416beb..60b2ce1 100644 + fs_tmpfs_filetrans($1, cgroup_t, lnk_file, "cpuacct") +') diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te -index 9e603f5..3c5f139 100644 +index 9e603f5..97dbeb4 100644 --- a/policy/modules/kernel/filesystem.te +++ b/policy/modules/kernel/filesystem.te @@ -33,6 +33,7 @@ fs_use_xattr jffs2 gen_context(system_u:object_r:fs_t,s0); @@ -12228,7 +12261,18 @@ index 9e603f5..3c5f139 100644 type ibmasmfs_t; fs_type(ibmasmfs_t) -@@ -145,11 +153,6 @@ fs_type(spufs_t) +@@ -125,6 +133,10 @@ type oprofilefs_t; + fs_type(oprofilefs_t) + genfscon oprofilefs / gen_context(system_u:object_r:oprofilefs_t,s0) + ++type pstorefs_t; ++fs_type(pstorefs_t) ++genfscon pstore / gen_context(system_u:object_r:pstorefs_t,s0) ++ + type ramfs_t; + fs_type(ramfs_t) + files_mountpoint(ramfs_t) +@@ -145,11 +157,6 @@ fs_type(spufs_t) genfscon spufs / gen_context(system_u:object_r:spufs_t,s0) files_mountpoint(spufs_t) @@ -12240,7 +12284,7 @@ index 9e603f5..3c5f139 100644 type sysv_t; fs_noxattr_type(sysv_t) files_mountpoint(sysv_t) -@@ -167,6 +170,8 @@ type vxfs_t; +@@ -167,6 +174,8 @@ type vxfs_t; fs_noxattr_type(vxfs_t) files_mountpoint(vxfs_t) genfscon vxfs / gen_context(system_u:object_r:vxfs_t,s0) @@ -12249,7 +12293,7 @@ index 9e603f5..3c5f139 100644 # # tmpfs_t is the type for tmpfs filesystems -@@ -176,6 +181,8 @@ fs_type(tmpfs_t) +@@ -176,6 +185,8 @@ fs_type(tmpfs_t) files_type(tmpfs_t) files_mountpoint(tmpfs_t) files_poly_parent(tmpfs_t) @@ -12258,7 +12302,7 @@ index 9e603f5..3c5f139 100644 # Use a transition SID based on the allocating task SID and the # filesystem SID to label inodes in the following filesystem types, -@@ -255,6 +262,8 @@ genfscon udf / gen_context(system_u:object_r:iso9660_t,s0) +@@ -255,6 +266,8 @@ genfscon udf / gen_context(system_u:object_r:iso9660_t,s0) type removable_t; allow removable_t noxattrfs:filesystem associate; fs_noxattr_type(removable_t) @@ -12267,7 +12311,7 @@ index 9e603f5..3c5f139 100644 files_mountpoint(removable_t) # -@@ -274,6 +283,7 @@ genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0) +@@ -274,6 +287,7 @@ genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0) genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0) genfscon panfs / gen_context(system_u:object_r:nfs_t,s0) genfscon gadgetfs / gen_context(system_u:object_r:nfs_t,s0) @@ -18912,7 +18956,7 @@ index 5fc0391..3540387 100644 + xserver_rw_xdm_pipes(ssh_agent_type) +') diff --git a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc -index d1f64a0..146340a 100644 +index d1f64a0..3be3d00 100644 --- a/policy/modules/services/xserver.fc +++ b/policy/modules/services/xserver.fc @@ -2,13 +2,35 @@ @@ -18951,10 +18995,11 @@ index d1f64a0..146340a 100644 # # /dev -@@ -22,13 +44,20 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) +@@ -22,13 +44,21 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) /etc/gdm(3)?/PreSession/.* -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/gdm(3)?/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) ++/etc/X11/xorg\.conf\.d(/.*)? gen_context(system_u:object_r:xserver_etc_t,s0) +/etc/[mg]dm(/.*)? gen_context(system_u:object_r:xdm_etc_t,s0) +/etc/[mg]dm/Init(/.*)? gen_context(system_u:object_r:xdm_unconfined_exec_t,s0) +/etc/[mg]dm/PostLogin(/.*)? gen_context(system_u:object_r:xdm_unconfined_exec_t,s0) @@ -18973,7 +19018,7 @@ index d1f64a0..146340a 100644 /etc/X11/[wx]dm/Xreset.* -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0) -@@ -46,26 +75,31 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) +@@ -46,26 +76,31 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) # /tmp # @@ -19011,7 +19056,7 @@ index d1f64a0..146340a 100644 /usr/lib/qt-.*/etc/settings(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) -@@ -92,25 +126,49 @@ ifndef(`distro_debian',` +@@ -92,25 +127,49 @@ ifndef(`distro_debian',` /var/lib/gdm(3)?(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0) /var/lib/lxdm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0) @@ -19067,7 +19112,7 @@ index d1f64a0..146340a 100644 +/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) + diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if -index 6bf0ecc..8a8ed32 100644 +index 6bf0ecc..1c8242d 100644 --- a/policy/modules/services/xserver.if +++ b/policy/modules/services/xserver.if @@ -19,9 +19,10 @@ @@ -19507,7 +19552,7 @@ index 6bf0ecc..8a8ed32 100644 ') ######################################## -@@ -765,11 +879,31 @@ interface(`xserver_manage_xdm_spool_files',` +@@ -765,11 +879,71 @@ interface(`xserver_manage_xdm_spool_files',` # interface(`xserver_stream_connect_xdm',` gen_require(` @@ -19538,10 +19583,50 @@ index 6bf0ecc..8a8ed32 100644 + + userdom_search_user_home_dirs($1) + allow $1 xdm_home_t:file read_file_perms; ++') ++ ++######################################## ++## ++## Read xserver configuration files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`xserver_read_config',` ++ gen_require(` ++ type xserver_etc_t; ++ ') ++ ++ files_search_etc($1) ++ read_files_pattern($1, xserver_etc_t, xserver_etc_t) ++ read_lnk_files_pattern($1, xserver_etc_t, xserver_etc_t) ++') ++ ++######################################## ++## ++## Manage xserver configuration files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`xserver_manage_config',` ++ gen_require(` ++ type xserver_etc_t; ++ ') ++ ++ files_search_etc($1) ++ manage_files_pattern($1, xserver_etc_t, xserver_etc_t) ++ manage_lnk_files_pattern($1, xserver_etc_t, xserver_etc_t) ') ######################################## -@@ -793,6 +927,25 @@ interface(`xserver_read_xdm_rw_config',` +@@ -793,6 +967,25 @@ interface(`xserver_read_xdm_rw_config',` ######################################## ## @@ -19567,7 +19652,7 @@ index 6bf0ecc..8a8ed32 100644 ## Set the attributes of XDM temporary directories. ## ## -@@ -806,7 +959,25 @@ interface(`xserver_setattr_xdm_tmp_dirs',` +@@ -806,7 +999,25 @@ interface(`xserver_setattr_xdm_tmp_dirs',` type xdm_tmp_t; ') @@ -19594,7 +19679,7 @@ index 6bf0ecc..8a8ed32 100644 ') ######################################## -@@ -846,7 +1017,26 @@ interface(`xserver_read_xdm_pid',` +@@ -846,7 +1057,26 @@ interface(`xserver_read_xdm_pid',` ') files_search_pids($1) @@ -19622,7 +19707,7 @@ index 6bf0ecc..8a8ed32 100644 ') ######################################## -@@ -869,6 +1059,24 @@ interface(`xserver_read_xdm_lib_files',` +@@ -869,6 +1099,24 @@ interface(`xserver_read_xdm_lib_files',` ######################################## ## @@ -19647,7 +19732,7 @@ index 6bf0ecc..8a8ed32 100644 ## Make an X session script an entrypoint for the specified domain. ## ## -@@ -938,7 +1146,26 @@ interface(`xserver_getattr_log',` +@@ -938,7 +1186,26 @@ interface(`xserver_getattr_log',` ') logging_search_logs($1) @@ -19675,7 +19760,7 @@ index 6bf0ecc..8a8ed32 100644 ') ######################################## -@@ -957,7 +1184,7 @@ interface(`xserver_dontaudit_write_log',` +@@ -957,7 +1224,7 @@ interface(`xserver_dontaudit_write_log',` type xserver_log_t; ') @@ -19684,7 +19769,7 @@ index 6bf0ecc..8a8ed32 100644 ') ######################################## -@@ -1004,6 +1231,45 @@ interface(`xserver_read_xkb_libs',` +@@ -1004,6 +1271,45 @@ interface(`xserver_read_xkb_libs',` ######################################## ## @@ -19730,7 +19815,7 @@ index 6bf0ecc..8a8ed32 100644 ## Read xdm temporary files. ## ## -@@ -1017,7 +1283,7 @@ interface(`xserver_read_xdm_tmp_files',` +@@ -1017,7 +1323,7 @@ interface(`xserver_read_xdm_tmp_files',` type xdm_tmp_t; ') @@ -19739,7 +19824,7 @@ index 6bf0ecc..8a8ed32 100644 read_files_pattern($1, xdm_tmp_t, xdm_tmp_t) ') -@@ -1079,6 +1345,42 @@ interface(`xserver_manage_xdm_tmp_files',` +@@ -1079,6 +1385,42 @@ interface(`xserver_manage_xdm_tmp_files',` ######################################## ## @@ -19782,7 +19867,7 @@ index 6bf0ecc..8a8ed32 100644 ## Do not audit attempts to get the attributes of ## xdm temporary named sockets. ## -@@ -1093,7 +1395,7 @@ interface(`xserver_dontaudit_getattr_xdm_tmp_sockets',` +@@ -1093,7 +1435,7 @@ interface(`xserver_dontaudit_getattr_xdm_tmp_sockets',` type xdm_tmp_t; ') @@ -19791,7 +19876,7 @@ index 6bf0ecc..8a8ed32 100644 ') ######################################## -@@ -1111,8 +1413,10 @@ interface(`xserver_domtrans',` +@@ -1111,8 +1453,10 @@ interface(`xserver_domtrans',` type xserver_t, xserver_exec_t; ') @@ -19803,7 +19888,7 @@ index 6bf0ecc..8a8ed32 100644 ') ######################################## -@@ -1226,6 +1530,26 @@ interface(`xserver_stream_connect',` +@@ -1226,6 +1570,26 @@ interface(`xserver_stream_connect',` files_search_tmp($1) stream_connect_pattern($1, xserver_tmp_t, xserver_tmp_t, xserver_t) @@ -19830,7 +19915,7 @@ index 6bf0ecc..8a8ed32 100644 ') ######################################## -@@ -1251,7 +1575,7 @@ interface(`xserver_read_tmp_files',` +@@ -1251,7 +1615,7 @@ interface(`xserver_read_tmp_files',` ## ## Interface to provide X object permissions on a given X server to ## an X client domain. Gives the domain permission to read the @@ -19839,7 +19924,7 @@ index 6bf0ecc..8a8ed32 100644 ## ## ## -@@ -1261,13 +1585,23 @@ interface(`xserver_read_tmp_files',` +@@ -1261,13 +1625,23 @@ interface(`xserver_read_tmp_files',` # interface(`xserver_manage_core_devices',` gen_require(` @@ -19864,7 +19949,7 @@ index 6bf0ecc..8a8ed32 100644 ') ######################################## -@@ -1284,10 +1618,577 @@ interface(`xserver_manage_core_devices',` +@@ -1284,10 +1658,577 @@ interface(`xserver_manage_core_devices',` # interface(`xserver_unconfined',` gen_require(` @@ -20445,7 +20530,7 @@ index 6bf0ecc..8a8ed32 100644 + files_search_tmp($1) +') diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te -index 2696452..7a3a6c0 100644 +index 2696452..8ac9130 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -26,27 +26,50 @@ gen_require(` @@ -20624,7 +20709,7 @@ index 2696452..7a3a6c0 100644 # type for /var/lib/xkb type xkb_var_lib_t; files_type(xkb_var_lib_t) -@@ -193,14 +249,9 @@ typealias xserver_t alias { auditadm_xserver_t secadm_xserver_t xdm_xserver_t }; +@@ -193,14 +249,12 @@ typealias xserver_t alias { auditadm_xserver_t secadm_xserver_t xdm_xserver_t }; init_system_domain(xserver_t, xserver_exec_t) ubac_constrained(xserver_t) @@ -20632,7 +20717,9 @@ index 2696452..7a3a6c0 100644 -typealias xserver_tmp_t alias { user_xserver_tmp_t staff_xserver_tmp_t sysadm_xserver_tmp_t }; -typealias xserver_tmp_t alias { auditadm_xserver_tmp_t secadm_xserver_tmp_t xdm_xserver_tmp_t }; -userdom_user_tmp_file(xserver_tmp_t) -- ++type xserver_etc_t; ++files_config_file(xserver_etc_t) + type xserver_tmpfs_t; -typealias xserver_tmpfs_t alias { user_xserver_tmpfs_t staff_xserver_tmpfs_t sysadm_xserver_tmpfs_t }; -typealias xserver_tmpfs_t alias { auditadm_xserver_tmpfs_t secadm_xserver_tmpfs_t xdm_xserver_tmpfs_t }; @@ -20641,7 +20728,7 @@ index 2696452..7a3a6c0 100644 userdom_user_tmpfs_file(xserver_tmpfs_t) type xsession_exec_t; -@@ -225,21 +276,33 @@ optional_policy(` +@@ -225,21 +279,33 @@ optional_policy(` # allow iceauth_t iceauth_home_t:file manage_file_perms; @@ -20684,7 +20771,7 @@ index 2696452..7a3a6c0 100644 ') ######################################## -@@ -247,48 +310,83 @@ tunable_policy(`use_samba_home_dirs',` +@@ -247,48 +313,83 @@ tunable_policy(`use_samba_home_dirs',` # Xauth local policy # @@ -20768,18 +20855,18 @@ index 2696452..7a3a6c0 100644 +ifdef(`hide_broken_symptoms',` + term_dontaudit_use_unallocated_ttys(xauth_t) + dev_dontaudit_rw_dri(xauth_t) -+') -+ -+optional_policy(` -+ nx_var_lib_filetrans(xauth_t, xauth_home_t, file) ') optional_policy(` ++ nx_var_lib_filetrans(xauth_t, xauth_home_t, file) ++') ++ ++optional_policy(` + ssh_use_ptys(xauth_t) ssh_sigchld(xauth_t) ssh_read_pipes(xauth_t) ssh_dontaudit_rw_tcp_sockets(xauth_t) -@@ -299,64 +397,106 @@ optional_policy(` +@@ -299,64 +400,106 @@ optional_policy(` # XDM Local policy # @@ -20896,7 +20983,7 @@ index 2696452..7a3a6c0 100644 # connect to xdm xserver over stream socket stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) -@@ -365,20 +505,27 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) +@@ -365,20 +508,27 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) @@ -20926,7 +21013,7 @@ index 2696452..7a3a6c0 100644 corenet_all_recvfrom_netlabel(xdm_t) corenet_tcp_sendrecv_generic_if(xdm_t) corenet_udp_sendrecv_generic_if(xdm_t) -@@ -388,38 +535,48 @@ corenet_tcp_sendrecv_all_ports(xdm_t) +@@ -388,38 +538,48 @@ corenet_tcp_sendrecv_all_ports(xdm_t) corenet_udp_sendrecv_all_ports(xdm_t) corenet_tcp_bind_generic_node(xdm_t) corenet_udp_bind_generic_node(xdm_t) @@ -20979,7 +21066,7 @@ index 2696452..7a3a6c0 100644 files_read_etc_files(xdm_t) files_read_var_files(xdm_t) -@@ -430,9 +587,27 @@ files_list_mnt(xdm_t) +@@ -430,9 +590,28 @@ files_list_mnt(xdm_t) files_read_usr_files(xdm_t) # Poweroff wants to create the /poweroff file when run from xdm files_create_boot_flag(xdm_t) @@ -21004,10 +21091,11 @@ index 2696452..7a3a6c0 100644 +fs_manage_cgroup_files(xdm_t) + +mls_socket_write_to_clearance(xdm_t) ++mls_trusted_object(xdm_t) storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t) -@@ -441,28 +616,40 @@ storage_dontaudit_raw_read_removable_device(xdm_t) +@@ -441,28 +620,40 @@ storage_dontaudit_raw_read_removable_device(xdm_t) storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t) @@ -21051,7 +21139,7 @@ index 2696452..7a3a6c0 100644 userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_create_all_users_keys(xdm_t) -@@ -471,24 +658,43 @@ userdom_read_user_home_content_files(xdm_t) +@@ -471,24 +662,43 @@ userdom_read_user_home_content_files(xdm_t) # Search /proc for any user domain processes. userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) @@ -21101,7 +21189,7 @@ index 2696452..7a3a6c0 100644 tunable_policy(`xdm_sysadm_login',` userdom_xsession_spec_domtrans_all_users(xdm_t) # FIXME: -@@ -502,11 +708,26 @@ tunable_policy(`xdm_sysadm_login',` +@@ -502,11 +712,26 @@ tunable_policy(`xdm_sysadm_login',` ') optional_policy(` @@ -21128,7 +21216,7 @@ index 2696452..7a3a6c0 100644 ') optional_policy(` -@@ -514,12 +735,72 @@ optional_policy(` +@@ -514,12 +739,72 @@ optional_policy(` ') optional_policy(` @@ -21201,7 +21289,7 @@ index 2696452..7a3a6c0 100644 hostname_exec(xdm_t) ') -@@ -537,28 +818,78 @@ optional_policy(` +@@ -537,28 +822,78 @@ optional_policy(` ') optional_policy(` @@ -21289,7 +21377,7 @@ index 2696452..7a3a6c0 100644 ') optional_policy(` -@@ -570,6 +901,14 @@ optional_policy(` +@@ -570,6 +905,14 @@ optional_policy(` ') optional_policy(` @@ -21304,7 +21392,7 @@ index 2696452..7a3a6c0 100644 xfs_stream_connect(xdm_t) ') -@@ -594,8 +933,11 @@ allow xserver_t input_xevent_t:x_event send; +@@ -594,8 +937,11 @@ allow xserver_t input_xevent_t:x_event send; # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack @@ -21317,7 +21405,7 @@ index 2696452..7a3a6c0 100644 allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow xserver_t self:fd use; allow xserver_t self:fifo_file rw_fifo_file_perms; -@@ -608,8 +950,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; +@@ -608,8 +954,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:udp_socket create_socket_perms; @@ -21333,7 +21421,18 @@ index 2696452..7a3a6c0 100644 manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) -@@ -628,12 +977,19 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) +@@ -617,6 +970,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) + + filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file) + ++allow xserver_t xserver_etc_t:dir list_dir_perms; ++read_files_pattern(xserver_t, xserver_etc_t, xserver_etc_t) ++read_lnk_files_pattern(xserver_t, xserver_etc_t, xserver_etc_t) ++ + manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) + manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) + manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) +@@ -628,12 +985,19 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) files_search_var_lib(xserver_t) @@ -21355,7 +21454,7 @@ index 2696452..7a3a6c0 100644 kernel_read_system_state(xserver_t) kernel_read_device_sysctls(xserver_t) -@@ -641,12 +997,12 @@ kernel_read_modprobe_sysctls(xserver_t) +@@ -641,12 +1005,12 @@ kernel_read_modprobe_sysctls(xserver_t) # Xorg wants to check if kernel is tainted kernel_read_kernel_sysctls(xserver_t) kernel_write_proc_files(xserver_t) @@ -21369,7 +21468,7 @@ index 2696452..7a3a6c0 100644 corenet_all_recvfrom_netlabel(xserver_t) corenet_tcp_sendrecv_generic_if(xserver_t) corenet_udp_sendrecv_generic_if(xserver_t) -@@ -667,23 +1023,27 @@ dev_rw_apm_bios(xserver_t) +@@ -667,23 +1031,27 @@ dev_rw_apm_bios(xserver_t) dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) @@ -21400,21 +21499,25 @@ index 2696452..7a3a6c0 100644 # brought on by rhgb files_search_mnt(xserver_t) -@@ -694,8 +1054,13 @@ fs_getattr_xattr_fs(xserver_t) +@@ -694,7 +1062,16 @@ fs_getattr_xattr_fs(xserver_t) fs_search_nfs(xserver_t) fs_search_auto_mountpoints(xserver_t) fs_search_ramfs(xserver_t) +- +fs_rw_tmpfs_files(xserver_t) - - mls_xwin_read_to_clearance(xserver_t) -+mls_process_write_to_clearance(xserver_t) ++ +mls_file_read_to_clearance(xserver_t) +mls_file_write_all_levels(xserver_t) +mls_file_upgrade(xserver_t) ++mls_process_write_to_clearance(xserver_t) ++mls_socket_read_to_clearance(xserver_t) ++mls_sysvipc_read_to_clearance(xserver_t) ++mls_sysvipc_write_to_clearance(xserver_t) ++mls_trusted_object(xserver_t) + mls_xwin_read_to_clearance(xserver_t) selinux_validate_context(xserver_t) - selinux_compute_access_vector(xserver_t) -@@ -708,20 +1073,18 @@ init_getpgid(xserver_t) +@@ -708,20 +1085,18 @@ init_getpgid(xserver_t) term_setattr_unallocated_ttys(xserver_t) term_use_unallocated_ttys(xserver_t) @@ -21438,7 +21541,7 @@ index 2696452..7a3a6c0 100644 userdom_search_user_home_dirs(xserver_t) userdom_use_user_ttys(xserver_t) -@@ -729,8 +1092,6 @@ userdom_setattr_user_ttys(xserver_t) +@@ -729,8 +1104,6 @@ userdom_setattr_user_ttys(xserver_t) userdom_read_user_tmp_files(xserver_t) userdom_rw_user_tmpfs_files(xserver_t) @@ -21447,7 +21550,7 @@ index 2696452..7a3a6c0 100644 ifndef(`distro_redhat',` allow xserver_t self:process { execmem execheap execstack }; domain_mmap_low_uncond(xserver_t) -@@ -775,16 +1136,44 @@ optional_policy(` +@@ -775,16 +1148,44 @@ optional_policy(` ') optional_policy(` @@ -21493,7 +21596,7 @@ index 2696452..7a3a6c0 100644 unconfined_domtrans(xserver_t) ') -@@ -793,6 +1182,10 @@ optional_policy(` +@@ -793,6 +1194,10 @@ optional_policy(` ') optional_policy(` @@ -21504,7 +21607,7 @@ index 2696452..7a3a6c0 100644 xfs_stream_connect(xserver_t) ') -@@ -808,10 +1201,10 @@ allow xserver_t xdm_t:shm rw_shm_perms; +@@ -808,10 +1213,10 @@ allow xserver_t xdm_t:shm rw_shm_perms; # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open # handle of a file inside the dir!!! @@ -21518,7 +21621,7 @@ index 2696452..7a3a6c0 100644 # Label pid and temporary files with derived types. manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) -@@ -819,7 +1212,7 @@ manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) +@@ -819,7 +1224,7 @@ manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) manage_sock_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) # Run xkbcomp. @@ -21527,7 +21630,7 @@ index 2696452..7a3a6c0 100644 can_exec(xserver_t, xkb_var_lib_t) # VNC v4 module in X server -@@ -832,26 +1225,21 @@ init_use_fds(xserver_t) +@@ -832,26 +1237,21 @@ init_use_fds(xserver_t) # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_user_home_content_files(xserver_t) @@ -21562,7 +21665,7 @@ index 2696452..7a3a6c0 100644 ') optional_policy(` -@@ -902,7 +1290,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy +@@ -902,7 +1302,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show }; # operations allowed on my windows allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; @@ -21571,7 +21674,7 @@ index 2696452..7a3a6c0 100644 # operations allowed on all windows allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child }; -@@ -956,11 +1344,31 @@ allow x_domain self:x_resource { read write }; +@@ -956,11 +1356,31 @@ allow x_domain self:x_resource { read write }; # can mess with the screensaver allow x_domain xserver_t:x_screen { getattr saver_getattr }; @@ -21603,7 +21706,7 @@ index 2696452..7a3a6c0 100644 tunable_policy(`! xserver_object_manager',` # should be xserver_unconfined(x_domain), # but typeattribute doesnt work in conditionals -@@ -982,18 +1390,40 @@ tunable_policy(`! xserver_object_manager',` +@@ -982,18 +1402,40 @@ tunable_policy(`! xserver_object_manager',` allow x_domain xevent_type:{ x_event x_synthetic_event } *; ') @@ -22640,7 +22743,7 @@ index 3efd5b6..792df83 100644 +') + diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te -index 104037e..a8a2a2d 100644 +index 104037e..28dbe0b 100644 --- a/policy/modules/system/authlogin.te +++ b/policy/modules/system/authlogin.te @@ -5,6 +5,19 @@ policy_module(authlogin, 2.4.2) @@ -22937,15 +23040,16 @@ index 104037e..a8a2a2d 100644 optional_policy(` kerberos_use(nsswitch_domain) ') -@@ -456,6 +493,7 @@ optional_policy(` +@@ -456,6 +493,8 @@ optional_policy(` optional_policy(` sssd_stream_connect(nsswitch_domain) + sssd_read_public_files(nsswitch_domain) ++ sssd_read_lib_files(nsswitch_domain) ') optional_policy(` -@@ -463,3 +501,132 @@ optional_policy(` +@@ -463,3 +502,132 @@ optional_policy(` samba_read_var_files(nsswitch_domain) samba_dontaudit_write_var_files(nsswitch_domain) ') @@ -33390,10 +33494,10 @@ index 0000000..fc080a1 +') diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te new file mode 100644 -index 0000000..90e063a +index 0000000..3932b82 --- /dev/null +++ b/policy/modules/system/systemd.te -@@ -0,0 +1,632 @@ +@@ -0,0 +1,636 @@ +policy_module(systemd, 1.0.0) + +####################################### @@ -33988,6 +34092,10 @@ index 0000000..90e063a + policykit_read_reload(systemd_timedated_t) +') + ++optional_policy(` ++ xserver_manage_config(systemd_timedated_t) ++') ++ +######################################## +# +# systemd_sysctl domains local policy diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index 59ef21b..c1a9cc7 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -3020,7 +3020,7 @@ index 550a69e..e714059 100644 +/var/run/dirsrv/admin-serv.* gen_context(system_u:object_r:httpd_var_run_t,s0) +/opt/dirsrv/var/run/dirsrv/dsgw/cookies(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0) diff --git a/apache.if b/apache.if -index 83e899c..7b2ad39 100644 +index 83e899c..e3bed6a 100644 --- a/apache.if +++ b/apache.if @@ -1,9 +1,9 @@ @@ -4204,7 +4204,7 @@ index 83e899c..7b2ad39 100644 admin_pattern($1, httpd_log_t) admin_pattern($1, httpd_modules_t) -@@ -1218,9 +1393,106 @@ interface(`apache_admin',` +@@ -1218,9 +1393,129 @@ interface(`apache_admin',` admin_pattern($1, httpd_var_run_t) files_pid_filetrans($1, httpd_var_run_t, file) @@ -4292,6 +4292,29 @@ index 83e899c..7b2ad39 100644 + +######################################## +## ++## Execute a httpd_exec_t in the specified domain. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++## ++## ++## The type of the new process. ++## ++## ++# ++interface(`apache_exec_domtrans',` ++ gen_require(` ++ type httpd_exec_t; ++ ') ++ ++ domtrans_pattern($1, httpd_exec_t, $2) ++') ++ ++######################################## ++## +## Transition to apache home content +## +## @@ -8311,7 +8334,7 @@ index c723a0a..3e8a553 100644 + allow $1 bluetooth_unit_file_t:service all_service_perms; ') diff --git a/bluetooth.te b/bluetooth.te -index 6f09d24..88b8feb 100644 +index 6f09d24..9c48d18 100644 --- a/bluetooth.te +++ b/bluetooth.te @@ -49,6 +49,9 @@ files_type(bluetooth_var_lib_t) @@ -8367,15 +8390,20 @@ index 6f09d24..88b8feb 100644 miscfiles_read_fonts(bluetooth_t) miscfiles_read_hwdata(bluetooth_t) -@@ -132,6 +143,7 @@ userdom_dontaudit_search_user_home_dirs(bluetooth_t) +@@ -130,8 +141,12 @@ userdom_dontaudit_use_unpriv_user_fds(bluetooth_t) + userdom_dontaudit_use_user_terminals(bluetooth_t) + userdom_dontaudit_search_user_home_dirs(bluetooth_t) ++# machine-info ++systemd_hostnamed_read_config(bluetooth_t) ++ optional_policy(` dbus_system_bus_client(bluetooth_t) + dbus_connect_system_bus(bluetooth_t) optional_policy(` cups_dbus_chat(bluetooth_t) -@@ -199,7 +211,6 @@ dev_read_urand(bluetooth_helper_t) +@@ -199,7 +214,6 @@ dev_read_urand(bluetooth_helper_t) domain_read_all_domains_state(bluetooth_helper_t) files_read_etc_runtime_files(bluetooth_helper_t) @@ -8626,7 +8654,7 @@ index 02fefaa..fbcef10 100644 + ') ') diff --git a/boinc.te b/boinc.te -index 7c92aa1..1dc00c7 100644 +index 7c92aa1..4d8b6ae 100644 --- a/boinc.te +++ b/boinc.te @@ -1,11 +1,13 @@ @@ -8645,7 +8673,7 @@ index 7c92aa1..1dc00c7 100644 type boinc_exec_t; init_daemon_domain(boinc_t, boinc_exec_t) -@@ -21,31 +23,65 @@ files_tmpfs_file(boinc_tmpfs_t) +@@ -21,31 +23,66 @@ files_tmpfs_file(boinc_tmpfs_t) type boinc_var_lib_t; files_type(boinc_var_lib_t) @@ -8675,6 +8703,7 @@ index 7c92aa1..1dc00c7 100644 +# + +allow boinc_domain self:fifo_file rw_fifo_file_perms; ++allow boinc_domain self:process signal; +allow boinc_domain self:sem create_sem_perms; +allow boinc_domain self:process execmem; + @@ -8720,7 +8749,7 @@ index 7c92aa1..1dc00c7 100644 manage_dirs_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t) manage_files_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t) -@@ -54,74 +90,45 @@ files_tmp_filetrans(boinc_t, boinc_tmp_t, { dir file }) +@@ -54,74 +91,45 @@ files_tmp_filetrans(boinc_t, boinc_tmp_t, { dir file }) manage_files_pattern(boinc_t, boinc_tmpfs_t, boinc_tmpfs_t) fs_tmpfs_filetrans(boinc_t, boinc_tmpfs_t, file) @@ -8814,7 +8843,7 @@ index 7c92aa1..1dc00c7 100644 term_getattr_all_ptys(boinc_t) term_getattr_unallocated_ttys(boinc_t) -@@ -130,55 +137,61 @@ init_read_utmp(boinc_t) +@@ -130,55 +138,61 @@ init_read_utmp(boinc_t) logging_send_syslog_msg(boinc_t) @@ -15958,7 +15987,7 @@ index 06da9a0..ca832e1 100644 + ps_process_pattern($1, cupsd_t) ') diff --git a/cups.te b/cups.te -index 9f34c2e..c8d914e 100644 +index 9f34c2e..45fe9a0 100644 --- a/cups.te +++ b/cups.te @@ -5,19 +5,24 @@ policy_module(cups, 1.15.9) @@ -16199,15 +16228,16 @@ index 9f34c2e..c8d914e 100644 mls_fd_use_all_levels(cupsd_t) mls_file_downgrade(cupsd_t) -@@ -235,6 +266,7 @@ mls_socket_write_all_levels(cupsd_t) +@@ -235,6 +266,8 @@ mls_socket_write_all_levels(cupsd_t) term_search_ptys(cupsd_t) term_use_unallocated_ttys(cupsd_t) +term_use_ptmx(cupsd_t) ++term_use_usb_ttys(cupsd_t) selinux_compute_access_vector(cupsd_t) selinux_validate_context(cupsd_t) -@@ -247,21 +279,20 @@ auth_dontaudit_read_pam_pid(cupsd_t) +@@ -247,21 +280,20 @@ auth_dontaudit_read_pam_pid(cupsd_t) auth_rw_faillog(cupsd_t) auth_use_nsswitch(cupsd_t) @@ -16233,7 +16263,7 @@ index 9f34c2e..c8d914e 100644 userdom_dontaudit_search_user_home_content(cupsd_t) optional_policy(` -@@ -275,6 +306,8 @@ optional_policy(` +@@ -275,6 +307,8 @@ optional_policy(` optional_policy(` dbus_system_bus_client(cupsd_t) @@ -16242,7 +16272,7 @@ index 9f34c2e..c8d914e 100644 userdom_dbus_send_all_users(cupsd_t) optional_policy(` -@@ -285,8 +318,10 @@ optional_policy(` +@@ -285,8 +319,10 @@ optional_policy(` hal_dbus_chat(cupsd_t) ') @@ -16253,7 +16283,7 @@ index 9f34c2e..c8d914e 100644 ') ') -@@ -299,8 +334,8 @@ optional_policy(` +@@ -299,8 +335,8 @@ optional_policy(` ') optional_policy(` @@ -16263,7 +16293,7 @@ index 9f34c2e..c8d914e 100644 ') optional_policy(` -@@ -309,7 +344,6 @@ optional_policy(` +@@ -309,7 +345,6 @@ optional_policy(` optional_policy(` lpd_exec_lpr(cupsd_t) @@ -16271,7 +16301,7 @@ index 9f34c2e..c8d914e 100644 lpd_read_config(cupsd_t) lpd_relabel_spool(cupsd_t) ') -@@ -337,7 +371,7 @@ optional_policy(` +@@ -337,7 +372,7 @@ optional_policy(` ') optional_policy(` @@ -16280,7 +16310,7 @@ index 9f34c2e..c8d914e 100644 ') ######################################## -@@ -345,11 +379,9 @@ optional_policy(` +@@ -345,11 +380,9 @@ optional_policy(` # Configuration daemon local policy # @@ -16294,7 +16324,7 @@ index 9f34c2e..c8d914e 100644 allow cupsd_config_t cupsd_t:process signal; ps_process_pattern(cupsd_config_t, cupsd_t) -@@ -375,18 +407,15 @@ manage_dirs_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run +@@ -375,18 +408,15 @@ manage_dirs_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run manage_files_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t) files_pid_filetrans(cupsd_config_t, cupsd_config_var_run_t, { dir file }) @@ -16314,7 +16344,7 @@ index 9f34c2e..c8d914e 100644 corenet_all_recvfrom_netlabel(cupsd_config_t) corenet_tcp_sendrecv_generic_if(cupsd_config_t) corenet_tcp_sendrecv_generic_node(cupsd_config_t) -@@ -395,20 +424,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t) +@@ -395,20 +425,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t) corenet_sendrecv_all_client_packets(cupsd_config_t) corenet_tcp_connect_all_ports(cupsd_config_t) @@ -16335,7 +16365,7 @@ index 9f34c2e..c8d914e 100644 fs_search_auto_mountpoints(cupsd_config_t) domain_use_interactive_fds(cupsd_config_t) -@@ -420,11 +441,6 @@ auth_use_nsswitch(cupsd_config_t) +@@ -420,11 +442,6 @@ auth_use_nsswitch(cupsd_config_t) logging_send_syslog_msg(cupsd_config_t) @@ -16347,7 +16377,7 @@ index 9f34c2e..c8d914e 100644 userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t) userdom_dontaudit_search_user_home_dirs(cupsd_config_t) userdom_read_all_users_state(cupsd_config_t) -@@ -452,9 +468,12 @@ optional_policy(` +@@ -452,9 +469,12 @@ optional_policy(` ') optional_policy(` @@ -16361,7 +16391,7 @@ index 9f34c2e..c8d914e 100644 ') optional_policy(` -@@ -490,10 +509,6 @@ optional_policy(` +@@ -490,10 +510,6 @@ optional_policy(` # Lpd local policy # @@ -16372,7 +16402,7 @@ index 9f34c2e..c8d914e 100644 allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms; allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms; -@@ -511,31 +526,22 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t) +@@ -511,31 +527,22 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t) kernel_read_kernel_sysctls(cupsd_lpd_t) kernel_read_system_state(cupsd_lpd_t) @@ -16405,7 +16435,7 @@ index 9f34c2e..c8d914e 100644 optional_policy(` inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t) ') -@@ -546,7 +552,6 @@ optional_policy(` +@@ -546,7 +553,6 @@ optional_policy(` # allow cups_pdf_t self:capability { chown fowner fsetid setuid setgid dac_override }; @@ -16413,7 +16443,7 @@ index 9f34c2e..c8d914e 100644 allow cups_pdf_t self:unix_stream_socket create_stream_socket_perms; append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t) -@@ -562,17 +567,8 @@ fs_search_auto_mountpoints(cups_pdf_t) +@@ -562,17 +568,8 @@ fs_search_auto_mountpoints(cups_pdf_t) kernel_read_system_state(cups_pdf_t) @@ -16431,7 +16461,7 @@ index 9f34c2e..c8d914e 100644 userdom_manage_user_home_content_dirs(cups_pdf_t) userdom_manage_user_home_content_files(cups_pdf_t) userdom_home_filetrans_user_home_dir(cups_pdf_t) -@@ -582,128 +578,12 @@ tunable_policy(`use_nfs_home_dirs',` +@@ -582,128 +579,12 @@ tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files(cups_pdf_t) ') @@ -16562,7 +16592,7 @@ index 9f34c2e..c8d914e 100644 ######################################## # -@@ -731,7 +611,6 @@ kernel_read_kernel_sysctls(ptal_t) +@@ -731,7 +612,6 @@ kernel_read_kernel_sysctls(ptal_t) kernel_list_proc(ptal_t) kernel_read_proc_symlinks(ptal_t) @@ -16570,7 +16600,7 @@ index 9f34c2e..c8d914e 100644 corenet_all_recvfrom_netlabel(ptal_t) corenet_tcp_sendrecv_generic_if(ptal_t) corenet_tcp_sendrecv_generic_node(ptal_t) -@@ -741,13 +620,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t) +@@ -741,13 +621,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t) corenet_tcp_bind_ptal_port(ptal_t) corenet_tcp_sendrecv_ptal_port(ptal_t) @@ -16584,7 +16614,7 @@ index 9f34c2e..c8d914e 100644 files_read_etc_runtime_files(ptal_t) fs_getattr_all_fs(ptal_t) -@@ -755,8 +632,6 @@ fs_search_auto_mountpoints(ptal_t) +@@ -755,8 +633,6 @@ fs_search_auto_mountpoints(ptal_t) logging_send_syslog_msg(ptal_t) @@ -17630,7 +17660,7 @@ index afcf3a2..0730306 100644 + dontaudit system_bus_type $1:dbus send_msg; ') diff --git a/dbus.te b/dbus.te -index 2c2e7e1..4a56f17 100644 +index 2c2e7e1..5e0bf2f 100644 --- a/dbus.te +++ b/dbus.te @@ -1,20 +1,18 @@ @@ -17668,16 +17698,17 @@ index 2c2e7e1..4a56f17 100644 type session_dbusd_tmp_t; typealias session_dbusd_tmp_t alias { user_dbusd_tmp_t staff_dbusd_tmp_t sysadm_dbusd_tmp_t }; typealias session_dbusd_tmp_t alias { auditadm_dbusd_tmp_t secadm_dbusd_tmp_t }; -@@ -41,7 +36,7 @@ files_type(system_dbusd_var_lib_t) +@@ -41,7 +36,8 @@ files_type(system_dbusd_var_lib_t) type system_dbusd_var_run_t; files_pid_file(system_dbusd_var_run_t) -init_daemon_run_dir(system_dbusd_var_run_t, "dbus") +init_sock_file(system_dbusd_var_run_t) ++mls_trusted_object(system_dbusd_var_run_t) ifdef(`enable_mcs',` init_ranged_system_domain(system_dbusd_t, dbusd_exec_t, s0 - mcs_systemhigh) -@@ -51,59 +46,56 @@ ifdef(`enable_mls',` +@@ -51,59 +47,57 @@ ifdef(`enable_mls',` init_ranged_system_domain(system_dbusd_t, dbusd_exec_t, s0 - mls_systemhigh) ') @@ -17749,10 +17780,11 @@ index 2c2e7e1..4a56f17 100644 +storage_rw_inherited_fixed_disk_dev(system_dbusd_t) +storage_rw_inherited_removable_device(system_dbusd_t) + ++mls_trusted_object(system_dbusd_t) mls_fd_use_all_levels(system_dbusd_t) mls_rangetrans_target(system_dbusd_t) mls_file_read_all_levels(system_dbusd_t) -@@ -123,66 +115,155 @@ term_dontaudit_use_console(system_dbusd_t) +@@ -123,66 +117,155 @@ term_dontaudit_use_console(system_dbusd_t) auth_use_nsswitch(system_dbusd_t) auth_read_pam_console_data(system_dbusd_t) @@ -17922,7 +17954,7 @@ index 2c2e7e1..4a56f17 100644 kernel_read_kernel_sysctls(session_bus_type) corecmd_list_bin(session_bus_type) -@@ -191,23 +272,18 @@ corecmd_read_bin_files(session_bus_type) +@@ -191,23 +274,18 @@ corecmd_read_bin_files(session_bus_type) corecmd_read_bin_pipes(session_bus_type) corecmd_read_bin_sockets(session_bus_type) @@ -17947,7 +17979,7 @@ index 2c2e7e1..4a56f17 100644 files_dontaudit_search_var(session_bus_type) fs_getattr_romfs(session_bus_type) -@@ -215,7 +291,6 @@ fs_getattr_xattr_fs(session_bus_type) +@@ -215,7 +293,6 @@ fs_getattr_xattr_fs(session_bus_type) fs_list_inotifyfs(session_bus_type) fs_dontaudit_list_nfs(session_bus_type) @@ -17955,7 +17987,7 @@ index 2c2e7e1..4a56f17 100644 selinux_validate_context(session_bus_type) selinux_compute_access_vector(session_bus_type) selinux_compute_create_context(session_bus_type) -@@ -225,18 +300,36 @@ selinux_compute_user_contexts(session_bus_type) +@@ -225,18 +302,36 @@ selinux_compute_user_contexts(session_bus_type) auth_read_pam_console_data(session_bus_type) logging_send_audit_msgs(session_bus_type) @@ -17997,7 +18029,7 @@ index 2c2e7e1..4a56f17 100644 ') ######################################## -@@ -244,5 +337,6 @@ optional_policy(` +@@ -244,5 +339,6 @@ optional_policy(` # Unconfined access to this module # @@ -21587,6 +21619,17 @@ index a0da189..d8bc9d5 100644 userdom_dontaudit_use_unpriv_user_fds(entropyd_t) userdom_dontaudit_search_user_home_dirs(entropyd_t) +diff --git a/evolution.fc b/evolution.fc +index 597f305..8520653 100644 +--- a/evolution.fc ++++ b/evolution.fc +@@ -1,5 +1,6 @@ + HOME_DIR/\.camel_certs(/.*)? gen_context(system_u:object_r:evolution_home_t,s0) + HOME_DIR/\.evolution(/.*)? gen_context(system_u:object_r:evolution_home_t,s0) ++HOME_DIR/\.cache/evolution(/.*)? gen_context(system_u:object_r:evolution_home_t,s0) + + /tmp/\.exchange-USER(/.*)? gen_context(system_u:object_r:evolution_exchange_tmp_t,s0) + diff --git a/evolution.te b/evolution.te index 94fb625..3742ee1 100644 --- a/evolution.te @@ -22464,7 +22507,7 @@ index 5cf6ac6..839999e 100644 + allow $1 firewalld_unit_file_t:service all_service_perms; ') diff --git a/firewalld.te b/firewalld.te -index c8014f8..1072fcb 100644 +index c8014f8..02de884 100644 --- a/firewalld.te +++ b/firewalld.te @@ -21,11 +21,20 @@ logging_log_file(firewalld_var_log_t) @@ -22533,6 +22576,17 @@ index c8014f8..1072fcb 100644 optional_policy(` dbus_system_domain(firewalld_t, firewalld_exec_t) +@@ -85,6 +100,10 @@ optional_policy(` + ') + + optional_policy(` ++ gnome_read_generic_data_home_dirs(firewalld_t) ++') ++ ++optional_policy(` + iptables_domtrans(firewalld_t) + ') + diff --git a/firewallgui.if b/firewallgui.if index e6866d1..941f4ef 100644 --- a/firewallgui.if @@ -24200,10 +24254,10 @@ index fd02acc..0000000 - -miscfiles_read_localization(glusterd_t) diff --git a/gnome.fc b/gnome.fc -index e39de43..52e5a3a 100644 +index e39de43..5818f74 100644 --- a/gnome.fc +++ b/gnome.fc -@@ -1,15 +1,57 @@ +@@ -1,15 +1,58 @@ -HOME_DIR/\.gconf(/.*)? gen_context(system_u:object_r:gconf_home_t,s0) -HOME_DIR/\.gconfd(/.*)? gen_context(system_u:object_r:gconf_home_t,s0) -HOME_DIR/\.gnome(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) @@ -24211,6 +24265,7 @@ index e39de43..52e5a3a 100644 -HOME_DIR/\.gnome2/keyrings(/.*)? gen_context(system_u:object_r:gnome_keyring_home_t,s0) -HOME_DIR/\.gnome2_private(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) +HOME_DIR/\.cache(/.*)? gen_context(system_u:object_r:cache_home_t,s0) ++HOME_DIR/\.cache/dconf(/.*)? gen_context(system_u:object_r:config_home_t,s0) +HOME_DIR/\.color/icc(/.*)? gen_context(system_u:object_r:icc_data_home_t,s0) +HOME_DIR/\.dbus(/.*)? gen_context(system_u:object_r:dbus_home_t,s0) +HOME_DIR/\.config(/.*)? gen_context(system_u:object_r:config_home_t,s0) @@ -24271,7 +24326,7 @@ index e39de43..52e5a3a 100644 +/usr/libexec/gnome-system-monitor-mechanism -- gen_context(system_u:object_r:gnomesystemmm_exec_t,s0) +/usr/libexec/kde(3|4)/ksysguardprocesslist_helper -- gen_context(system_u:object_r:gnomesystemmm_exec_t,s0) diff --git a/gnome.if b/gnome.if -index d03fd43..0a785a3 100644 +index d03fd43..b000017 100644 --- a/gnome.if +++ b/gnome.if @@ -1,123 +1,154 @@ @@ -25360,7 +25415,7 @@ index d03fd43..0a785a3 100644 ## ## ## -@@ -704,12 +812,773 @@ interface(`gnome_stream_connect_gkeyringd',` +@@ -704,12 +812,774 @@ interface(`gnome_stream_connect_gkeyringd',` ## ## # @@ -26054,6 +26109,7 @@ index d03fd43..0a785a3 100644 + filetrans_pattern($1, data_home_t, icc_data_home_t, dir, "icc") + filetrans_pattern($1, cache_home_t, cache_home_t, dir, "fontconfig") + userdom_user_tmp_filetrans($1, config_home_t, dir, "dconf") ++ gnome_cache_filetrans($1, config_home_t, dir, "dconf") + gnome_filetrans_gstreamer_home_content($1) +') + @@ -35899,10 +35955,10 @@ index 4462c0e..84944d1 100644 userdom_dontaudit_use_unpriv_user_fds(monopd_t) diff --git a/mozilla.fc b/mozilla.fc -index 6ffaba2..379066c 100644 +index 6ffaba2..18e3a70 100644 --- a/mozilla.fc +++ b/mozilla.fc -@@ -1,38 +1,61 @@ +@@ -1,38 +1,63 @@ -HOME_DIR/\.galeon(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) -HOME_DIR/\.mozilla(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) -HOME_DIR/\.mozilla/plugins(/.*)? gen_context(system_u:object_r:mozilla_plugin_home_t,s0) @@ -35925,7 +35981,9 @@ index 6ffaba2..379066c 100644 +HOME_DIR/\.galeon(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.java(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.mozilla(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) ++HOME_DIR/\.cache\mozilla(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.thunderbird(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) ++HOME_DIR/POkemon.*(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.netscape(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) +HOME_DIR/\.adobe(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0) @@ -35999,7 +36057,7 @@ index 6ffaba2..379066c 100644 +/usr/lib/nspluginwrapper/plugin-config -- gen_context(system_u:object_r:mozilla_plugin_config_exec_t,s0) +') diff --git a/mozilla.if b/mozilla.if -index 6194b80..97b8462 100644 +index 6194b80..648d041 100644 --- a/mozilla.if +++ b/mozilla.if @@ -1,146 +1,75 @@ @@ -36620,7 +36678,7 @@ index 6194b80..97b8462 100644 ## ## ## -@@ -530,45 +430,48 @@ interface(`mozilla_plugin_delete_tmpfs_files',` +@@ -530,45 +430,50 @@ interface(`mozilla_plugin_delete_tmpfs_files',` ## ## # @@ -36690,11 +36748,13 @@ index 6194b80..97b8462 100644 + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".ICAClient") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, "zimbrauserdata") + userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, ".lyx") ++ #userdom_user_home_dir_filetrans($1, mozilla_home_t, dir, "POkemon Advanced Adventure") + userdom_user_home_dir_filetrans($1, mozilla_home_t, file, ".gnashpluginrc") ++ gnome_cache_filetrans($1, mozilla_home_t, dir, "mozilla") ') + diff --git a/mozilla.te b/mozilla.te -index 6a306ee..7131f6f 100644 +index 6a306ee..4c1c064 100644 --- a/mozilla.te +++ b/mozilla.te @@ -1,4 +1,4 @@ @@ -36953,10 +37013,10 @@ index 6a306ee..7131f6f 100644 -userdom_manage_user_home_content_dirs(mozilla_t) -userdom_manage_user_home_content_files(mozilla_t) -userdom_user_home_dir_filetrans_user_home_content(mozilla_t, { dir file }) +- +-userdom_write_user_tmp_sockets(mozilla_t) +userdom_use_inherited_user_ptys(mozilla_t) --userdom_write_user_tmp_sockets(mozilla_t) -- -mozilla_run_plugin(mozilla_t, mozilla_roles) -mozilla_run_plugin_config(mozilla_t, mozilla_roles) +#mozilla_run_plugin(mozilla_t, mozilla_roles) @@ -37434,25 +37494,21 @@ index 6a306ee..7131f6f 100644 ') optional_policy(` -@@ -523,36 +481,43 @@ optional_policy(` +@@ -523,36 +481,47 @@ optional_policy(` ') optional_policy(` - automount_dontaudit_getattr_tmp_dirs(mozilla_plugin_t) -+ dbus_system_bus_client(mozilla_plugin_t) -+ dbus_session_bus_client(mozilla_plugin_t) -+ dbus_connect_session_bus(mozilla_plugin_t) -+ dbus_read_lib_files(mozilla_plugin_t) ++ apache_list_modules(mozilla_plugin_t) ') optional_policy(` - dbus_all_session_bus_client(mozilla_plugin_t) - dbus_connect_all_session_bus(mozilla_plugin_t) -- dbus_system_bus_client(mozilla_plugin_t) -+ gnome_manage_config(mozilla_plugin_t) -+ gnome_read_usr_config(mozilla_plugin_t) -+ gnome_filetrans_home_content(mozilla_plugin_t) -+ gnome_exec_gstreamer_home_files(mozilla_plugin_t) + dbus_system_bus_client(mozilla_plugin_t) ++ dbus_session_bus_client(mozilla_plugin_t) ++ dbus_connect_session_bus(mozilla_plugin_t) ++ dbus_read_lib_files(mozilla_plugin_t) ') optional_policy(` @@ -37460,6 +37516,13 @@ index 6a306ee..7131f6f 100644 - gnome_home_filetrans_gnome_home(mozilla_plugin_t, dir, ".gnome") - gnome_home_filetrans_gnome_home(mozilla_plugin_t, dir, ".gnome2") - gnome_home_filetrans_gnome_home(mozilla_plugin_t, dir, ".gnome2_private") ++ gnome_manage_config(mozilla_plugin_t) ++ gnome_read_usr_config(mozilla_plugin_t) ++ gnome_filetrans_home_content(mozilla_plugin_t) ++ gnome_exec_gstreamer_home_files(mozilla_plugin_t) ++') ++ ++optional_policy(` + gpm_dontaudit_getattr_gpmctl(mozilla_plugin_t) ') @@ -37492,7 +37555,7 @@ index 6a306ee..7131f6f 100644 ') optional_policy(` -@@ -560,7 +525,7 @@ optional_policy(` +@@ -560,7 +529,7 @@ optional_policy(` ') optional_policy(` @@ -37501,7 +37564,7 @@ index 6a306ee..7131f6f 100644 ') optional_policy(` -@@ -568,108 +533,108 @@ optional_policy(` +@@ -568,108 +537,108 @@ optional_policy(` ') optional_policy(` @@ -48094,10 +48157,10 @@ index 0000000..407386d +') diff --git a/openshift.te b/openshift.te new file mode 100644 -index 0000000..d859b72 +index 0000000..45e60e5 --- /dev/null +++ b/openshift.te -@@ -0,0 +1,481 @@ +@@ -0,0 +1,526 @@ +policy_module(openshift,1.0.0) + +gen_require(` @@ -48438,12 +48501,57 @@ index 0000000..d859b72 + +allow openshift_user_domain openshift_domain:process ptrace; + ++mta_signal_user_agent(openshift_user_domain) ++ +optional_policy(` + ssh_rw_tcp_sockets(openshift_user_domain) +') + +############################################################################ +# ++# Rules specific to openshift_net_domains ++# ++allow openshift_net_domain openshift_port_t:tcp_socket { name_connect name_bind }; ++allow openshift_net_domain openshift_port_t:udp_socket name_bind; ++ ++corenet_tcp_connect_mssql_port(openshift_net_domain) ++corenet_tcp_connect_mysqld_port(openshift_net_domain) ++corenet_tcp_connect_postgresql_port(openshift_net_domain) ++corenet_tcp_connect_git_port(openshift_net_domain) ++corenet_tcp_connect_oracle_port(openshift_net_domain) ++corenet_tcp_connect_flash_port(openshift_net_domain) ++corenet_tcp_connect_http_port(openshift_net_domain) ++corenet_tcp_connect_ftp_port(openshift_net_domain) ++#/* These ports are the ephemeral ports needed for ftp */ ++corenet_tcp_connect_virt_migration_port(openshift_net_domain) ++corenet_tcp_connect_ssh_port(openshift_net_domain) ++corenet_tcp_connect_jacorb_port(openshift_net_domain) ++corenet_tcp_connect_jboss_management_port(openshift_net_domain) ++corenet_tcp_connect_jboss_debug_port(openshift_net_domain) ++corenet_tcp_connect_jboss_messaging_port(openshift_net_domain) ++corenet_tcp_connect_memcache_port(openshift_net_domain) ++corenet_tcp_connect_http_cache_port(openshift_net_domain) ++corenet_tcp_connect_amqp_port(openshift_net_domain) ++corenet_tcp_connect_generic_port(openshift_net_domain) ++corenet_tcp_connect_mongod_port(openshift_net_domain) ++corenet_tcp_connect_munin_port(openshift_net_domain) ++corenet_tcp_connect_pop_port(openshift_net_domain) ++corenet_tcp_connect_pulseaudio_port(openshift_net_domain) ++corenet_tcp_connect_smtp_port(openshift_net_domain) ++corenet_tcp_connect_whois_port(openshift_net_domain) ++corenet_udp_bind_generic_port(openshift_net_domain) ++corenet_tcp_bind_http_cache_port(openshift_domain) ++corenet_tcp_bind_jacorb_port(openshift_net_domain) ++corenet_tcp_bind_jboss_management_port(openshift_net_domain) ++corenet_tcp_bind_jboss_messaging_port(openshift_net_domain) ++corenet_tcp_bind_jboss_debug_port(openshift_net_domain) ++corenet_tcp_bind_mongod_port(openshift_net_domain) ++corenet_tcp_bind_mysqld_port(openshift_domain) ++corenet_tcp_bind_pulseaudio_port(openshift_net_domain) ++corenet_tcp_bind_postgresql_port(openshift_net_domain) ++ ++############################################################################ ++# +# Rules specific to openshift and openshift_app_t +# +kernel_read_vm_sysctls(openshift_t) @@ -63845,7 +63953,7 @@ index 47de2d6..1f5dbf8 100644 +/var/log/cluster/corosync\.log.* -- gen_context(system_u:object_r:cluster_var_log_t,s0) +/var/log/cluster/rgmanager\.log.* -- gen_context(system_u:object_r:cluster_var_log_t,s0) diff --git a/rhcs.if b/rhcs.if -index 56bc01f..27c4de4 100644 +index 56bc01f..cbca7aa 100644 --- a/rhcs.if +++ b/rhcs.if @@ -1,19 +1,19 @@ @@ -63874,27 +63982,19 @@ index 56bc01f..27c4de4 100644 ') ############################## -@@ -28,7 +28,7 @@ template(`rhcs_domain_template',` - type $1_tmpfs_t, cluster_tmpfs; - files_tmpfs_file($1_tmpfs_t) - -- type $1_var_log_t, cluster_log; -+ type $1_var_log_t; - logging_log_file($1_var_log_t) - - type $1_var_run_t, cluster_pid; -@@ -44,9 +44,7 @@ template(`rhcs_domain_template',` +@@ -43,11 +43,6 @@ template(`rhcs_domain_template',` + manage_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t) fs_tmpfs_filetrans($1_t, $1_tmpfs_t, { dir file }) - manage_dirs_pattern($1_t, $1_var_log_t, $1_var_log_t) +- manage_dirs_pattern($1_t, $1_var_log_t, $1_var_log_t) - append_files_pattern($1_t, $1_var_log_t, $1_var_log_t) - create_files_pattern($1_t, $1_var_log_t, $1_var_log_t) - setattr_files_pattern($1_t, $1_var_log_t, $1_var_log_t) -+ manage_files_pattern($1_t, $1_var_log_t, $1_var_log_t) - manage_sock_files_pattern($1_t, $1_var_log_t, $1_var_log_t) +- manage_sock_files_pattern($1_t, $1_var_log_t, $1_var_log_t) logging_log_filetrans($1_t, $1_var_log_t, { dir file sock_file }) -@@ -56,20 +54,19 @@ template(`rhcs_domain_template',` + manage_dirs_pattern($1_t, $1_var_run_t, $1_var_run_t) +@@ -56,20 +51,19 @@ template(`rhcs_domain_template',` manage_sock_files_pattern($1_t, $1_var_run_t, $1_var_run_t) files_pid_filetrans($1_t, $1_var_run_t, { dir file fifo_file }) @@ -63921,7 +64021,7 @@ index 56bc01f..27c4de4 100644 ## # interface(`rhcs_domtrans_dlm_controld',` -@@ -83,27 +80,8 @@ interface(`rhcs_domtrans_dlm_controld',` +@@ -83,27 +77,8 @@ interface(`rhcs_domtrans_dlm_controld',` ##################################### ## @@ -63951,7 +64051,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -122,7 +100,7 @@ interface(`rhcs_stream_connect_dlm_controld',` +@@ -122,7 +97,7 @@ interface(`rhcs_stream_connect_dlm_controld',` ##################################### ## @@ -63960,7 +64060,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -160,9 +138,27 @@ interface(`rhcs_domtrans_fenced',` +@@ -160,9 +135,27 @@ interface(`rhcs_domtrans_fenced',` domtrans_pattern($1, fenced_exec_t, fenced_t) ') @@ -63989,7 +64089,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -181,10 +177,9 @@ interface(`rhcs_rw_fenced_semaphores',` +@@ -181,10 +174,9 @@ interface(`rhcs_rw_fenced_semaphores',` manage_files_pattern($1, fenced_tmpfs_t, fenced_tmpfs_t) ') @@ -64002,7 +64102,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -192,19 +187,18 @@ interface(`rhcs_rw_fenced_semaphores',` +@@ -192,19 +184,18 @@ interface(`rhcs_rw_fenced_semaphores',` ## ## # @@ -64026,7 +64126,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -223,8 +217,7 @@ interface(`rhcs_stream_connect_fenced',` +@@ -223,8 +214,7 @@ interface(`rhcs_stream_connect_fenced',` ##################################### ## @@ -64036,7 +64136,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -243,7 +236,7 @@ interface(`rhcs_domtrans_gfs_controld',` +@@ -243,7 +233,7 @@ interface(`rhcs_domtrans_gfs_controld',` #################################### ## @@ -64045,7 +64145,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -264,7 +257,7 @@ interface(`rhcs_rw_gfs_controld_semaphores',` +@@ -264,7 +254,7 @@ interface(`rhcs_rw_gfs_controld_semaphores',` ######################################## ## @@ -64054,7 +64154,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -285,8 +278,7 @@ interface(`rhcs_rw_gfs_controld_shm',` +@@ -285,8 +275,7 @@ interface(`rhcs_rw_gfs_controld_shm',` ##################################### ## @@ -64064,7 +64164,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -324,8 +316,8 @@ interface(`rhcs_domtrans_groupd',` +@@ -324,8 +313,8 @@ interface(`rhcs_domtrans_groupd',` ##################################### ## @@ -64075,7 +64175,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -342,10 +334,9 @@ interface(`rhcs_stream_connect_groupd',` +@@ -342,10 +331,9 @@ interface(`rhcs_stream_connect_groupd',` stream_connect_pattern($1, groupd_var_run_t, groupd_var_run_t, groupd_t) ') @@ -64088,7 +64188,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -353,21 +344,20 @@ interface(`rhcs_stream_connect_groupd',` +@@ -353,21 +341,20 @@ interface(`rhcs_stream_connect_groupd',` ## ## # @@ -64116,7 +64216,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -375,17 +365,20 @@ interface(`rhcs_rw_cluster_shm',` +@@ -375,17 +362,20 @@ interface(`rhcs_rw_cluster_shm',` ## ## # @@ -64142,7 +64242,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -393,20 +386,20 @@ interface(`rhcs_rw_cluster_semaphores',` +@@ -393,20 +383,20 @@ interface(`rhcs_rw_cluster_semaphores',` ## ## # @@ -64169,7 +64269,7 @@ index 56bc01f..27c4de4 100644 ## ## ## -@@ -414,15 +407,32 @@ interface(`rhcs_rw_groupd_semaphores',` +@@ -414,15 +404,32 @@ interface(`rhcs_rw_groupd_semaphores',` ## ## # @@ -64207,7 +64307,7 @@ index 56bc01f..27c4de4 100644 ') ###################################### -@@ -446,52 +456,322 @@ interface(`rhcs_domtrans_qdiskd',` +@@ -446,52 +453,322 @@ interface(`rhcs_domtrans_qdiskd',` ######################################## ## @@ -64559,7 +64659,7 @@ index 56bc01f..27c4de4 100644 + allow $1 cluster_unit_file_t:service all_service_perms; ') diff --git a/rhcs.te b/rhcs.te -index 2c2de9a..a1461c9 100644 +index 2c2de9a..bbe8875 100644 --- a/rhcs.te +++ b/rhcs.te @@ -20,6 +20,27 @@ gen_tunable(fenced_can_network_connect, false) @@ -64590,7 +64690,7 @@ index 2c2de9a..a1461c9 100644 attribute cluster_domain; attribute cluster_log; attribute cluster_pid; -@@ -50,28 +71,259 @@ rhcs_domain_template(qdiskd) +@@ -50,28 +71,263 @@ rhcs_domain_template(qdiskd) type qdiskd_var_lib_t; files_type(qdiskd_var_lib_t) @@ -64634,11 +64734,18 @@ index 2c2de9a..a1461c9 100644 allow cluster_domain self:unix_dgram_socket create_socket_perms; -logging_send_syslog_msg(cluster_domain) -+optional_policy(` -+ ccs_stream_connect(cluster_domain) -+') -+ -+optional_policy(` +- +-miscfiles_read_localization(cluster_domain) ++manage_dirs_pattern(cluster_domain, cluster_log, cluster_log) ++manage_files_pattern(cluster_domain, cluster_log, cluster_log) ++manage_sock_files_pattern(cluster_domain, cluster_log, cluster_log) + + optional_policy(` + ccs_stream_connect(cluster_domain) + ') + + optional_policy(` +- corosync_stream_connect(cluster_domain) + dbus_system_bus_client(cluster_domain) +') + @@ -64646,8 +64753,7 @@ index 2c2de9a..a1461c9 100644 +# +# cluster domain local policy +# - --miscfiles_read_localization(cluster_domain) ++ +allow cluster_t self:capability { dac_override fowner setuid setgid sys_nice sys_admin sys_resource ipc_lock ipc_owner }; +# for hearbeat +allow cluster_t self:capability { net_raw chown }; @@ -64741,14 +64847,12 @@ index 2c2de9a..a1461c9 100644 + files_manage_isid_type_dirs(cluster_t) + fs_manage_tmpfs_files(cluster_t) +') - - optional_policy(` -- ccs_stream_connect(cluster_domain) ++ ++optional_policy(` + ccs_read_config(cluster_t) - ') - - optional_policy(` -- corosync_stream_connect(cluster_domain) ++') ++ ++optional_policy(` + cmirrord_rw_shm(cluster_t) +') + @@ -64855,7 +64959,7 @@ index 2c2de9a..a1461c9 100644 ') ##################################### -@@ -98,6 +350,12 @@ fs_manage_configfs_dirs(dlm_controld_t) +@@ -98,6 +354,12 @@ fs_manage_configfs_dirs(dlm_controld_t) init_rw_script_tmp_files(dlm_controld_t) @@ -64868,7 +64972,7 @@ index 2c2de9a..a1461c9 100644 ####################################### # # fenced local policy -@@ -105,9 +363,13 @@ init_rw_script_tmp_files(dlm_controld_t) +@@ -105,9 +367,13 @@ init_rw_script_tmp_files(dlm_controld_t) allow fenced_t self:capability { sys_rawio sys_resource }; allow fenced_t self:process { getsched signal_perms }; @@ -64883,7 +64987,7 @@ index 2c2de9a..a1461c9 100644 manage_files_pattern(fenced_t, fenced_lock_t, fenced_lock_t) files_lock_filetrans(fenced_t, fenced_lock_t, file) -@@ -118,9 +380,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir }) +@@ -118,9 +384,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir }) stream_connect_pattern(fenced_t, groupd_var_run_t, groupd_var_run_t, groupd_t) @@ -64894,7 +64998,7 @@ index 2c2de9a..a1461c9 100644 corecmd_exec_bin(fenced_t) corecmd_exec_shell(fenced_t) -@@ -148,9 +409,7 @@ corenet_tcp_sendrecv_http_port(fenced_t) +@@ -148,9 +413,7 @@ corenet_tcp_sendrecv_http_port(fenced_t) dev_read_sysfs(fenced_t) dev_read_urand(fenced_t) @@ -64905,7 +65009,7 @@ index 2c2de9a..a1461c9 100644 storage_raw_read_fixed_disk(fenced_t) storage_raw_write_fixed_disk(fenced_t) -@@ -160,7 +419,7 @@ term_getattr_pty_fs(fenced_t) +@@ -160,7 +423,7 @@ term_getattr_pty_fs(fenced_t) term_use_generic_ptys(fenced_t) term_use_ptmx(fenced_t) @@ -64914,7 +65018,7 @@ index 2c2de9a..a1461c9 100644 tunable_policy(`fenced_can_network_connect',` corenet_sendrecv_all_client_packets(fenced_t) -@@ -190,10 +449,6 @@ optional_policy(` +@@ -190,10 +453,6 @@ optional_policy(` ') optional_policy(` @@ -64925,7 +65029,7 @@ index 2c2de9a..a1461c9 100644 lvm_domtrans(fenced_t) lvm_read_config(fenced_t) ') -@@ -203,6 +458,13 @@ optional_policy(` +@@ -203,6 +462,13 @@ optional_policy(` snmp_manage_var_lib_dirs(fenced_t) ') @@ -64939,7 +65043,7 @@ index 2c2de9a..a1461c9 100644 ####################################### # # foghorn local policy -@@ -223,7 +485,8 @@ corenet_tcp_sendrecv_agentx_port(foghorn_t) +@@ -223,7 +489,8 @@ corenet_tcp_sendrecv_agentx_port(foghorn_t) dev_read_urand(foghorn_t) @@ -64949,7 +65053,7 @@ index 2c2de9a..a1461c9 100644 optional_policy(` dbus_connect_system_bus(foghorn_t) -@@ -257,6 +520,8 @@ storage_getattr_removable_dev(gfs_controld_t) +@@ -257,6 +524,8 @@ storage_getattr_removable_dev(gfs_controld_t) init_rw_script_tmp_files(gfs_controld_t) @@ -64958,7 +65062,7 @@ index 2c2de9a..a1461c9 100644 optional_policy(` lvm_exec(gfs_controld_t) dev_rw_lvm_control(gfs_controld_t) -@@ -275,10 +540,10 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) +@@ -275,10 +544,10 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) dev_list_sysfs(groupd_t) @@ -64971,7 +65075,7 @@ index 2c2de9a..a1461c9 100644 ###################################### # # qdiskd local policy -@@ -321,6 +586,8 @@ storage_raw_write_fixed_disk(qdiskd_t) +@@ -321,6 +590,8 @@ storage_raw_write_fixed_disk(qdiskd_t) auth_use_nsswitch(qdiskd_t) @@ -74296,7 +74400,7 @@ index 3a9a70b..039b0c8 100644 logging_list_logs($1) admin_pattern($1, setroubleshoot_var_log_t) diff --git a/setroubleshoot.te b/setroubleshoot.te -index 49b12ae..c6f3302 100644 +index 49b12ae..a89828e 100644 --- a/setroubleshoot.te +++ b/setroubleshoot.te @@ -1,4 +1,4 @@ @@ -74393,11 +74497,12 @@ index 49b12ae..c6f3302 100644 files_list_all(setroubleshootd_t) files_getattr_all_files(setroubleshootd_t) files_getattr_all_pipes(setroubleshootd_t) -@@ -108,26 +113,23 @@ init_dontaudit_write_utmp(setroubleshootd_t) +@@ -107,27 +112,24 @@ init_read_utmp(setroubleshootd_t) + init_dontaudit_write_utmp(setroubleshootd_t) libs_exec_ld_so(setroubleshootd_t) ++libs_exec_ldconfig(setroubleshootd_t) -+ locallogin_dontaudit_use_fds(setroubleshootd_t) logging_send_audit_msgs(setroubleshootd_t) @@ -80960,10 +81065,10 @@ index 0000000..601aea3 +/usr/lib/tumbler[^/]*/tumblerd -- gen_context(system_u:object_r:thumb_exec_t,s0) diff --git a/thumb.if b/thumb.if new file mode 100644 -index 0000000..eb30b4c +index 0000000..bfcd2c7 --- /dev/null +++ b/thumb.if -@@ -0,0 +1,125 @@ +@@ -0,0 +1,126 @@ + +## policy for thumb + @@ -81088,6 +81193,7 @@ index 0000000..eb30b4c + + userdom_user_home_dir_filetrans($1, thumb_home_t, dir, ".thumbnails") + userdom_user_home_dir_filetrans($1, thumb_home_t, file, "missfont.log") ++ gnome_cache_filetrans($1, thumb_home_t, dir, "thumbnails") +') diff --git a/thumb.te b/thumb.te new file mode 100644 @@ -83820,7 +83926,7 @@ index c30da4c..014e40c 100644 +/var/run/qemu-ga\.pid -- gen_context(system_u:object_r:virt_qemu_ga_var_run_t,s0) +/var/log/qemu-ga\.log -- gen_context(system_u:object_r:virt_qemu_ga_log_t,s0) diff --git a/virt.if b/virt.if -index 9dec06c..175e66a 100644 +index 9dec06c..b991ec7 100644 --- a/virt.if +++ b/virt.if @@ -1,120 +1,51 @@ @@ -84798,7 +84904,7 @@ index 9dec06c..175e66a 100644 ## ## ## -@@ -860,115 +603,244 @@ interface(`virt_read_lib_files',` +@@ -860,115 +603,245 @@ interface(`virt_read_lib_files',` ## ## # @@ -84935,6 +85041,7 @@ index 9dec06c..175e66a 100644 files_search_pids($1) - filetrans_pattern($1, virt_var_run_t, $2, $3, $4) + stream_connect_pattern($1, svirt_lxc_file_t, svirt_lxc_file_t, svirt_lxc_domain) ++ ps_process_pattern(svirt_lxc_domain, $1) ') + @@ -85080,7 +85187,7 @@ index 9dec06c..175e66a 100644 ## ## ## -@@ -976,18 +848,17 @@ interface(`virt_manage_log',` +@@ -976,18 +849,17 @@ interface(`virt_manage_log',` ## ## # @@ -85103,7 +85210,7 @@ index 9dec06c..175e66a 100644 ## ## ## -@@ -995,36 +866,17 @@ interface(`virt_search_images',` +@@ -995,36 +867,17 @@ interface(`virt_search_images',` ## ## # @@ -85144,7 +85251,7 @@ index 9dec06c..175e66a 100644 ## ## ## -@@ -1032,58 +884,57 @@ interface(`virt_read_images',` +@@ -1032,58 +885,57 @@ interface(`virt_read_images',` ## ## # @@ -85224,7 +85331,7 @@ index 9dec06c..175e66a 100644 ## ## ## -@@ -1091,95 +942,131 @@ interface(`virt_manage_virt_cache',` +@@ -1091,95 +943,132 @@ interface(`virt_manage_virt_cache',` ## ## # @@ -85412,13 +85519,14 @@ index 9dec06c..175e66a 100644 - admin_pattern($1, virt_lock_t) + allow $1 svirt_lxc_domain:process transition; + role $2 types svirt_lxc_domain; ++ allow $1 svirt_lxc_domain:unix_dgram_socket sendto; - dev_list_all_dev_nodes($1) - allow $1 virt_ptynode:chr_file rw_term_perms; + allow svirt_lxc_domain $1:process sigchld; ') diff --git a/virt.te b/virt.te -index 1f22fba..d5e8852 100644 +index 1f22fba..7b17f67 100644 --- a/virt.te +++ b/virt.te @@ -1,94 +1,98 @@ @@ -85714,9 +85822,7 @@ index 1f22fba..d5e8852 100644 -append_files_pattern(virt_domain, virt_var_lib_t, virt_var_lib_t) - -kernel_read_system_state(virt_domain) -+# it was a part of auth_use_nsswitch -+allow svirt_t self:netlink_route_socket r_netlink_socket_perms; - +- -fs_getattr_xattr_fs(virt_domain) - -corecmd_exec_bin(virt_domain) @@ -85834,17 +85940,15 @@ index 1f22fba..d5e8852 100644 - fs_manage_dos_dirs(virt_domain) - fs_manage_dos_files(virt_domain) -') -- ++# it was a part of auth_use_nsswitch ++allow svirt_t self:netlink_route_socket r_netlink_socket_perms; + -optional_policy(` - tunable_policy(`virt_use_xserver',` - xserver_read_xdm_pid(virt_domain) - xserver_stream_connect(virt_domain) - ') -') -- --optional_policy(` -- dbus_read_lib_files(virt_domain) --') +corenet_udp_sendrecv_generic_if(svirt_t) +corenet_udp_sendrecv_generic_node(svirt_t) +corenet_udp_sendrecv_all_ports(svirt_t) @@ -85854,20 +85958,24 @@ index 1f22fba..d5e8852 100644 +corenet_tcp_connect_all_ports(svirt_t) -optional_policy(` -- nscd_use(virt_domain) +- dbus_read_lib_files(virt_domain) -') +miscfiles_read_generic_certs(svirt_t) optional_policy(` -- samba_domtrans_smbd(virt_domain) +- nscd_use(virt_domain) + xen_rw_image_files(svirt_t) ') optional_policy(` -- xen_rw_image_files(virt_domain) +- samba_domtrans_smbd(virt_domain) + nscd_use(svirt_t) ') +-optional_policy(` +- xen_rw_image_files(virt_domain) +-') +- -######################################## +####################################### # @@ -86039,16 +86147,16 @@ index 1f22fba..d5e8852 100644 -manage_dirs_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t) -manage_files_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t) -filetrans_pattern(virtd_t, virt_var_run_t, virtd_lxc_var_run_t, dir, "lxc") +- +-stream_connect_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t, virtd_lxc_t) +-stream_connect_pattern(virtd_t, svirt_var_run_t, svirt_var_run_t, virt_domain) +- +-can_exec(virtd_t, virt_tmp_t) +manage_dirs_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +manage_files_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +filetrans_pattern(virtd_t, virt_var_run_t, virt_lxc_var_run_t, dir, "lxc") +stream_connect_pattern(virtd_t, virt_lxc_var_run_t, virt_lxc_var_run_t, virtd_lxc_t) --stream_connect_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t, virtd_lxc_t) --stream_connect_pattern(virtd_t, svirt_var_run_t, svirt_var_run_t, virt_domain) -- --can_exec(virtd_t, virt_tmp_t) -- -kernel_read_crypto_sysctls(virtd_t) kernel_read_system_state(virtd_t) kernel_read_network_state(virtd_t) @@ -86140,13 +86248,13 @@ index 1f22fba..d5e8852 100644 +sysnet_read_config(virtd_t) -userdom_read_all_users_state(virtd_t) -+systemd_dbus_chat_logind(virtd_t) -+systemd_write_inhibit_pipes(virtd_t) - +- -ifdef(`hide_broken_symptoms',` - dontaudit virtd_t self:capability { sys_module sys_ptrace }; -') -- ++systemd_dbus_chat_logind(virtd_t) ++systemd_write_inhibit_pipes(virtd_t) + -tunable_policy(`virt_use_fusefs',` - fs_manage_fusefs_dirs(virtd_t) - fs_manage_fusefs_files(virtd_t) @@ -86177,13 +86285,15 @@ index 1f22fba..d5e8852 100644 fs_manage_cifs_files(virtd_t) fs_read_cifs_symlinks(virtd_t) ') -@@ -649,104 +475,323 @@ optional_policy(` - optional_policy(` - dbus_system_bus_client(virtd_t) +@@ -646,107 +472,327 @@ optional_policy(` + consoletype_exec(virtd_t) + ') -- optional_policy(` -- avahi_dbus_chat(virtd_t) -- ') +-optional_policy(` +- dbus_system_bus_client(virtd_t) ++optional_policy(` ++ dbus_system_bus_client(virtd_t) ++ + optional_policy(` + avahi_dbus_chat(virtd_t) + ') @@ -86363,6 +86473,7 @@ index 1f22fba..d5e8852 100644 + +dev_list_sysfs(virt_domain) +dev_getattr_fs(virt_domain) ++dev_dontaudit_getattr_all(virt_domain) +dev_read_generic_symlinks(virt_domain) +dev_read_rand(virt_domain) +dev_read_sound(virt_domain) @@ -86374,7 +86485,10 @@ index 1f22fba..d5e8852 100644 +dev_rw_inherited_vhost(virt_domain) + +domain_use_interactive_fds(virt_domain) -+ + +- optional_policy(` +- avahi_dbus_chat(virtd_t) +- ') +files_read_mnt_symlinks(virt_domain) +files_read_var_files(virt_domain) +files_search_all(virt_domain) @@ -86539,7 +86653,7 @@ index 1f22fba..d5e8852 100644 -allow virsh_t self:capability { setpcap dac_override ipc_lock sys_nice sys_tty_config }; -allow virsh_t self:process { getcap getsched setsched setcap signal }; -+allow virsh_t self:capability { setpcap dac_override ipc_lock sys_chroot sys_nice sys_tty_config }; ++allow virsh_t self:capability { setpcap dac_override ipc_lock sys_admin sys_chroot sys_nice sys_tty_config }; +allow virsh_t self:process { getcap getsched setsched setcap setexec signal }; allow virsh_t self:fifo_file rw_fifo_file_perms; -allow virsh_t self:unix_stream_socket { accept connectto listen }; @@ -86557,7 +86671,7 @@ index 1f22fba..d5e8852 100644 manage_files_pattern(virsh_t, virt_image_type, virt_image_type) manage_blk_files_pattern(virsh_t, virt_image_type, virt_image_type) -@@ -758,23 +803,15 @@ manage_chr_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) +@@ -758,23 +804,15 @@ manage_chr_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) manage_lnk_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) manage_sock_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) manage_fifo_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) @@ -86568,14 +86682,14 @@ index 1f22fba..d5e8852 100644 -filetrans_pattern(virsh_t, virt_var_run_t, virtd_lxc_var_run_t, dir, "lxc") - -dontaudit virsh_t virt_var_lib_t:file read_file_perms; -- --allow virsh_t svirt_lxc_domain:process transition; -- --can_exec(virsh_t, virsh_exec_t) +manage_dirs_pattern(virsh_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +manage_files_pattern(virsh_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +virt_filetrans_named_content(virsh_t) +-allow virsh_t svirt_lxc_domain:process transition; +- +-can_exec(virsh_t, virsh_exec_t) +- -virt_domtrans(virsh_t) -virt_manage_images(virsh_t) -virt_manage_config(virsh_t) @@ -86587,7 +86701,7 @@ index 1f22fba..d5e8852 100644 kernel_read_system_state(virsh_t) kernel_read_network_state(virsh_t) kernel_read_kernel_sysctls(virsh_t) -@@ -785,25 +822,18 @@ kernel_write_xen_state(virsh_t) +@@ -785,25 +823,18 @@ kernel_write_xen_state(virsh_t) corecmd_exec_bin(virsh_t) corecmd_exec_shell(virsh_t) @@ -86614,12 +86728,13 @@ index 1f22fba..d5e8852 100644 fs_getattr_all_fs(virsh_t) fs_manage_xenfs_dirs(virsh_t) -@@ -812,24 +842,21 @@ fs_search_auto_mountpoints(virsh_t) +@@ -812,24 +843,22 @@ fs_search_auto_mountpoints(virsh_t) storage_raw_read_fixed_disk(virsh_t) -term_use_all_terms(virsh_t) +term_use_all_inherited_terms(virsh_t) ++term_dontaudit_use_generic_ptys(virsh_t) + +userdom_search_admin_dir(virsh_t) +userdom_read_home_certs(virsh_t) @@ -86645,7 +86760,7 @@ index 1f22fba..d5e8852 100644 tunable_policy(`virt_use_nfs',` fs_manage_nfs_dirs(virsh_t) fs_manage_nfs_files(virsh_t) -@@ -847,6 +874,10 @@ optional_policy(` +@@ -847,6 +876,10 @@ optional_policy(` ') optional_policy(` @@ -86656,7 +86771,7 @@ index 1f22fba..d5e8852 100644 rpm_exec(virsh_t) ') -@@ -854,7 +885,7 @@ optional_policy(` +@@ -854,7 +887,7 @@ optional_policy(` xen_manage_image_dirs(virsh_t) xen_append_log(virsh_t) xen_domtrans(virsh_t) @@ -86665,7 +86780,7 @@ index 1f22fba..d5e8852 100644 xen_stream_connect(virsh_t) xen_stream_connect_xenstore(virsh_t) ') -@@ -879,34 +910,44 @@ optional_policy(` +@@ -879,34 +912,44 @@ optional_policy(` kernel_read_xen_state(virsh_ssh_t) kernel_write_xen_state(virsh_ssh_t) @@ -86719,7 +86834,7 @@ index 1f22fba..d5e8852 100644 manage_dirs_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) manage_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) -@@ -916,12 +957,15 @@ manage_sock_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) +@@ -916,12 +959,15 @@ manage_sock_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) manage_fifo_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) allow virtd_lxc_t svirt_lxc_file_t:dir_file_class_set { relabelto relabelfrom }; allow virtd_lxc_t svirt_lxc_file_t:filesystem { relabelto relabelfrom }; @@ -86735,7 +86850,7 @@ index 1f22fba..d5e8852 100644 corecmd_exec_bin(virtd_lxc_t) corecmd_exec_shell(virtd_lxc_t) -@@ -933,10 +977,8 @@ dev_read_urand(virtd_lxc_t) +@@ -933,10 +979,8 @@ dev_read_urand(virtd_lxc_t) domain_use_interactive_fds(virtd_lxc_t) @@ -86746,7 +86861,7 @@ index 1f22fba..d5e8852 100644 files_relabel_rootfs(virtd_lxc_t) files_mounton_non_security(virtd_lxc_t) files_mount_all_file_type_fs(virtd_lxc_t) -@@ -944,6 +986,7 @@ files_unmount_all_file_type_fs(virtd_lxc_t) +@@ -944,6 +988,7 @@ files_unmount_all_file_type_fs(virtd_lxc_t) files_list_isid_type_dirs(virtd_lxc_t) files_root_filetrans(virtd_lxc_t, svirt_lxc_file_t, dir_file_class_set) @@ -86754,7 +86869,7 @@ index 1f22fba..d5e8852 100644 fs_getattr_all_fs(virtd_lxc_t) fs_manage_tmpfs_dirs(virtd_lxc_t) fs_manage_tmpfs_chr_files(virtd_lxc_t) -@@ -955,15 +998,11 @@ fs_rw_cgroup_files(virtd_lxc_t) +@@ -955,15 +1000,11 @@ fs_rw_cgroup_files(virtd_lxc_t) fs_unmount_all_fs(virtd_lxc_t) fs_relabelfrom_tmpfs(virtd_lxc_t) @@ -86773,7 +86888,7 @@ index 1f22fba..d5e8852 100644 term_use_generic_ptys(virtd_lxc_t) term_use_ptmx(virtd_lxc_t) -@@ -973,20 +1012,44 @@ auth_use_nsswitch(virtd_lxc_t) +@@ -973,20 +1014,35 @@ auth_use_nsswitch(virtd_lxc_t) logging_send_syslog_msg(virtd_lxc_t) @@ -86809,22 +86924,14 @@ index 1f22fba..d5e8852 100644 -# Common virt lxc domain local policy +# virt_lxc_domain local policy # -+allow svirt_lxc_domain self:capability { kill setuid setgid dac_override sys_boot ipc_lock }; -+ -+allow virtd_t svirt_lxc_domain:unix_stream_socket { create_stream_socket_perms connectto }; -+allow virtd_t svirt_lxc_domain:process { signal_perms getattr }; -+allow virtd_lxc_t svirt_lxc_domain:process { getattr getsched setsched transition signal signull sigkill }; -+allow svirt_lxc_domain virtd_lxc_t:process sigchld; -+allow svirt_lxc_domain virtd_lxc_t:fd use; -+allow svirt_lxc_domain virt_lxc_var_run_t:dir list_dir_perms; -+allow svirt_lxc_domain virt_lxc_var_run_t:file read_file_perms; -+allow svirt_lxc_domain virtd_lxc_t:unix_stream_socket { connectto rw_socket_perms }; - +- -allow svirt_lxc_domain self:capability { kill setuid setgid dac_override sys_boot }; ++allow svirt_lxc_domain self:capability { kill setuid setgid dac_override sys_boot ipc_lock }; ++allow svirt_lxc_domain self:key manage_key_perms; allow svirt_lxc_domain self:process { execstack execmem getattr signal_perms getsched setsched setcap setpgid }; allow svirt_lxc_domain self:fifo_file manage_file_perms; allow svirt_lxc_domain self:sem create_sem_perms; -@@ -995,19 +1058,6 @@ allow svirt_lxc_domain self:msgq create_msgq_perms; +@@ -995,18 +1051,16 @@ allow svirt_lxc_domain self:msgq create_msgq_perms; allow svirt_lxc_domain self:unix_stream_socket { create_stream_socket_perms connectto }; allow svirt_lxc_domain self:unix_dgram_socket { sendto create_socket_perms }; @@ -86833,18 +86940,25 @@ index 1f22fba..d5e8852 100644 -allow svirt_lxc_domain virtd_lxc_t:process sigchld; - -allow svirt_lxc_domain virtd_lxc_t:unix_stream_socket { connectto rw_socket_perms }; -- + -allow svirt_lxc_domain virsh_t:fd use; -allow svirt_lxc_domain virsh_t:fifo_file rw_fifo_file_perms; -allow svirt_lxc_domain virsh_t:process sigchld; -- ++allow virtd_t svirt_lxc_domain:unix_stream_socket { create_stream_socket_perms connectto }; ++allow virtd_t svirt_lxc_domain:process { signal_perms getattr }; ++allow virtd_lxc_t svirt_lxc_domain:process { getattr getsched setsched setrlimit transition signal_perms }; + -allow svirt_lxc_domain virtd_lxc_var_run_t:dir list_dir_perms; -allow svirt_lxc_domain virtd_lxc_var_run_t:file read_file_perms; -- ++allow svirt_lxc_domain virtd_lxc_t:process sigchld; ++allow svirt_lxc_domain virtd_lxc_t:fd use; ++allow svirt_lxc_domain virt_lxc_var_run_t:dir list_dir_perms; ++allow svirt_lxc_domain virt_lxc_var_run_t:file read_file_perms; ++allow svirt_lxc_domain virtd_lxc_t:unix_stream_socket { connectto rw_socket_perms }; + manage_dirs_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) manage_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) - manage_lnk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) -@@ -1015,17 +1065,14 @@ manage_sock_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +@@ -1015,17 +1069,14 @@ manage_sock_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) manage_fifo_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) rw_chr_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) rw_blk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) @@ -86863,7 +86977,7 @@ index 1f22fba..d5e8852 100644 kernel_dontaudit_search_kernel_sysctl(svirt_lxc_domain) corecmd_exec_all_executables(svirt_lxc_domain) -@@ -1037,21 +1084,20 @@ files_dontaudit_getattr_all_pipes(svirt_lxc_domain) +@@ -1037,21 +1088,20 @@ files_dontaudit_getattr_all_pipes(svirt_lxc_domain) files_dontaudit_getattr_all_sockets(svirt_lxc_domain) files_dontaudit_list_all_mountpoints(svirt_lxc_domain) files_dontaudit_write_etc_runtime_files(svirt_lxc_domain) @@ -86890,15 +87004,15 @@ index 1f22fba..d5e8852 100644 auth_dontaudit_read_login_records(svirt_lxc_domain) auth_dontaudit_write_login_records(svirt_lxc_domain) auth_search_pam_console_data(svirt_lxc_domain) -@@ -1063,96 +1109,91 @@ init_dontaudit_write_utmp(svirt_lxc_domain) +@@ -1063,96 +1113,90 @@ init_dontaudit_write_utmp(svirt_lxc_domain) libs_dontaudit_setattr_lib_files(svirt_lxc_domain) -miscfiles_read_localization(svirt_lxc_domain) miscfiles_dontaudit_setattr_fonts_cache_dirs(svirt_lxc_domain) miscfiles_read_fonts(svirt_lxc_domain) - --mta_dontaudit_read_spool_symlinks(svirt_lxc_domain) ++miscfiles_read_hwdata(svirt_lxc_domain) ++ +systemd_read_unit_files(svirt_lxc_domain) + +userdom_use_inherited_user_terminals(svirt_lxc_domain) @@ -86911,7 +87025,8 @@ index 1f22fba..d5e8852 100644 +optional_policy(` + mta_dontaudit_read_spool_symlinks(svirt_lxc_domain) +') -+ + +-mta_dontaudit_read_spool_symlinks(svirt_lxc_domain) +optional_policy(` + ssh_use_ptys(svirt_lxc_net_t) +') @@ -86935,11 +87050,10 @@ index 1f22fba..d5e8852 100644 -allow svirt_lxc_net_t self:capability { chown dac_read_search dac_override fowner fsetid net_raw net_admin sys_admin sys_nice sys_ptrace sys_resource setpcap }; +allow svirt_lxc_net_t self:capability { chown dac_read_search dac_override fowner fsetid net_raw net_admin net_bind_service sys_admin sys_nice sys_ptrace sys_resource setpcap }; dontaudit svirt_lxc_net_t self:capability2 block_suspend; -+allow svirt_lxc_net_t self:netlink_socket create_socket_perms; - allow svirt_lxc_net_t self:process setrlimit; +-allow svirt_lxc_net_t self:process setrlimit; -allow svirt_lxc_net_t self:tcp_socket { accept listen }; -allow svirt_lxc_net_t self:netlink_route_socket nlmsg_write; -+ ++allow svirt_lxc_net_t self:netlink_socket create_socket_perms; +allow svirt_lxc_net_t self:udp_socket create_socket_perms; +allow svirt_lxc_net_t self:tcp_socket create_stream_socket_perms; +allow svirt_lxc_net_t self:netlink_route_socket create_netlink_socket_perms; @@ -87026,7 +87140,7 @@ index 1f22fba..d5e8852 100644 allow virt_qmf_t self:tcp_socket create_stream_socket_perms; allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms; -@@ -1165,12 +1206,12 @@ dev_read_sysfs(virt_qmf_t) +@@ -1165,12 +1209,12 @@ dev_read_sysfs(virt_qmf_t) dev_read_rand(virt_qmf_t) dev_read_urand(virt_qmf_t) @@ -87041,7 +87155,7 @@ index 1f22fba..d5e8852 100644 sysnet_read_config(virt_qmf_t) optional_policy(` -@@ -1183,9 +1224,8 @@ optional_policy(` +@@ -1183,9 +1227,8 @@ optional_policy(` ######################################## # @@ -87052,7 +87166,7 @@ index 1f22fba..d5e8852 100644 allow virt_bridgehelper_t self:process { setcap getcap }; allow virt_bridgehelper_t self:capability { setpcap setgid setuid net_admin }; allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms; -@@ -1198,5 +1238,70 @@ kernel_read_network_state(virt_bridgehelper_t) +@@ -1198,5 +1241,70 @@ kernel_read_network_state(virt_bridgehelper_t) corenet_rw_tun_tap_dev(virt_bridgehelper_t) @@ -89272,7 +89386,7 @@ index 0cea2cd..7668014 100644 userdom_dontaudit_use_unpriv_user_fds(xfs_t) diff --git a/xguest.te b/xguest.te -index 2882821..521232e 100644 +index 2882821..6618596 100644 --- a/xguest.te +++ b/xguest.te @@ -1,4 +1,4 @@ @@ -89346,7 +89460,7 @@ index 2882821..521232e 100644 storage_raw_read_removable_device(xguest_t) storage_raw_write_removable_device(xguest_t) ',` -@@ -54,9 +54,21 @@ ifndef(`enable_mls',` +@@ -54,9 +54,22 @@ ifndef(`enable_mls',` ') optional_policy(` @@ -89355,6 +89469,7 @@ index 2882821..521232e 100644 +') + +kernel_dontaudit_request_load_module(xguest_t) ++kernel_read_software_raid_state(xguest_t) + +tunable_policy(`selinuxuser_execstack',` + allow xguest_t self:process execstack; @@ -89369,7 +89484,7 @@ index 2882821..521232e 100644 files_dontaudit_getattr_boot_dirs(xguest_t) files_search_mnt(xguest_t) -@@ -65,10 +77,9 @@ optional_policy(` +@@ -65,10 +78,9 @@ optional_policy(` fs_manage_noxattr_fs_dirs(xguest_t) fs_getattr_noxattr_fs(xguest_t) fs_read_noxattr_fs_symlinks(xguest_t) @@ -89381,7 +89496,7 @@ index 2882821..521232e 100644 ') ') -@@ -84,12 +95,17 @@ optional_policy(` +@@ -84,12 +96,17 @@ optional_policy(` ') ') @@ -89401,7 +89516,7 @@ index 2882821..521232e 100644 ') optional_policy(` -@@ -97,75 +113,82 @@ optional_policy(` +@@ -97,75 +114,82 @@ optional_policy(` ') optional_policy(` diff --git a/selinux-policy.spec b/selinux-policy.spec index 126dfb1..0755c7e 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.12.1 -Release: 20%{?dist} +Release: 21%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -526,6 +526,31 @@ SELinux Reference policy mls base module. %endif %changelog +* Wed Mar 13 2013 Miroslav Grepl 3.12.1-21 +- Fix log transition rule for cluster domains +- Start to group all cluster log together +- Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update +- cups uses usbtty_device_t devices +- These fixes were all required to build a MLS virtual Machine with single level desktops +- Allow domains to transiton using httpd_exec_t +- Allow svirt domains to manage kernel key rings +- Allow setroubleshoot to execute ldconfig +- Allow firewalld to read generate gnome data +- Allow bluetooth to read machine-info +- Allow boinc domain to send signal to itself +- Fix gnome_filetrans_home_content() interface +- Allow mozilla_plugins to list apache modules, for use with gxine +- Fix labels for POkemon in the users homedir +- Allow xguest to read mdstat +- Dontaudit virt_domains getattr on /dev/* +- These fixes were all required to build a MLS virtual Machine with single level desktops +- Need to back port this to RHEL6 for openshift +- Add tcp/8891 as milter port +- Allow nsswitch domains to read sssd_var_lib_t files +- Allow ping to read network state. +- Fix typo +- Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them + * Fri Mar 8 2013 Miroslav Grepl 3.12.1-20 - Adopt swift changes from lhh@redhat.com - Add rhcs_manage_cluster_pid_files() interface