diff --git a/policy-F14.patch b/policy-F14.patch index a644247..9f77722 100644 --- a/policy-F14.patch +++ b/policy-F14.patch @@ -2252,7 +2252,7 @@ index 00a19e3..46db5ff 100644 +/usr/libexec/gnome-system-monitor-mechanism -- gen_context(system_u:object_r:gnomesystemmm_exec_t,s0) + diff --git a/policy/modules/apps/gnome.if b/policy/modules/apps/gnome.if -index f5afe78..594dc0f 100644 +index f5afe78..91737d4 100644 --- a/policy/modules/apps/gnome.if +++ b/policy/modules/apps/gnome.if @@ -37,8 +37,7 @@ interface(`gnome_role',` @@ -2306,12 +2306,11 @@ index f5afe78..594dc0f 100644 +## Dontaudit search gnome homedir content (.config) +## +## - ## - ## Domain allowed access. - ## - ## - # --template(`gnome_read_gconf_config',` ++## ++## Domain allowed access. ++## ++## ++# +interface(`gnome_dontaudit_search_config',` + gen_require(` + attribute gnome_home_type; @@ -2545,11 +2544,12 @@ index f5afe78..594dc0f 100644 +## read gconf config files +## +## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## Domain allowed access. + ## + ## + # +-template(`gnome_read_gconf_config',` +interface(`gnome_read_gconf_config',` gen_require(` type gconf_etc_t; @@ -2587,7 +2587,7 @@ index f5afe78..594dc0f 100644 ## ## ## -@@ -84,37 +359,39 @@ template(`gnome_read_gconf_config',` +@@ -84,37 +359,40 @@ template(`gnome_read_gconf_config',` ## ## # @@ -2625,6 +2625,7 @@ index f5afe78..594dc0f 100644 - read_files_pattern($1, gconf_tmp_t, gconf_tmp_t) - allow $1 gconfd_t:unix_stream_socket connectto; ++ userdom_search_user_home_dirs($1) + allow $1 gconf_home_t:dir list_dir_perms; + allow $1 data_home_t:dir list_dir_perms; + read_files_pattern($1, gconf_home_t, gconf_home_t) @@ -2638,7 +2639,7 @@ index f5afe78..594dc0f 100644 ## ## ## -@@ -122,12 +399,13 @@ interface(`gnome_stream_connect_gconf',` +@@ -122,12 +400,13 @@ interface(`gnome_stream_connect_gconf',` ## ## # @@ -2655,7 +2656,7 @@ index f5afe78..594dc0f 100644 ') ######################################## -@@ -151,40 +429,173 @@ interface(`gnome_setattr_config_dirs',` +@@ -151,40 +430,173 @@ interface(`gnome_setattr_config_dirs',` ######################################## ## @@ -3700,7 +3701,7 @@ index 9a6d67d..47aa143 100644 ## mozilla over dbus. ## diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te -index cbf4bec..0a9a921 100644 +index cbf4bec..7243acc 100644 --- a/policy/modules/apps/mozilla.te +++ b/policy/modules/apps/mozilla.te @@ -25,6 +25,7 @@ files_config_file(mozilla_conf_t) @@ -3773,7 +3774,7 @@ index cbf4bec..0a9a921 100644 pulseaudio_exec(mozilla_t) pulseaudio_stream_connect(mozilla_t) pulseaudio_manage_home_files(mozilla_t) -@@ -266,3 +291,90 @@ optional_policy(` +@@ -266,3 +291,91 @@ optional_policy(` optional_policy(` thunderbird_domtrans(mozilla_t) ') @@ -3790,6 +3791,7 @@ index cbf4bec..0a9a921 100644 +allow mozilla_plugin_t self:unix_stream_socket { connectto create_stream_socket_perms }; + +read_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t) ++can_exec(mozilla_plugin_t, mozilla_home_t) + +manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) +manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) @@ -19080,7 +19082,7 @@ index 99a94de..6dbc203 100644 files_search_etc(gatekeeper_t) diff --git a/policy/modules/services/git.fc b/policy/modules/services/git.fc -index 54f0737..28b71f6 100644 +index 54f0737..2b552c5 100644 --- a/policy/modules/services/git.fc +++ b/policy/modules/services/git.fc @@ -1,3 +1,13 @@ @@ -19093,7 +19095,8 @@ index 54f0737..28b71f6 100644 +/usr/libexec/git-core/git-daemon -- gen_context(system_u:object_r:gitd_exec_t,s0) + /var/cache/cgit(/.*)? gen_context(system_u:object_r:httpd_git_rw_content_t,s0) - /var/lib/git(/.*)? gen_context(system_u:object_r:httpd_git_content_t,s0) +-/var/lib/git(/.*)? gen_context(system_u:object_r:httpd_git_content_t,s0) ++/var/lib/git(/.*)? gen_context(system_u:object_r:git_system_content_t,s0) /var/www/cgi-bin/cgit -- gen_context(system_u:object_r:httpd_git_script_exec_t,s0) +/var/www/git(/.*)? gen_context(system_u:object_r:httpd_git_content_t,s0) +/var/www/git/gitweb.cgi gen_context(system_u:object_r:httpd_git_script_exec_t,s0) @@ -20420,7 +20423,7 @@ index 9fab1dc..dc7dd01 100644 mta_send_mail(innd_t) diff --git a/policy/modules/services/jabber.fc b/policy/modules/services/jabber.fc -index 4c9acec..908eb91 100644 +index 4c9acec..deef4c7 100644 --- a/policy/modules/services/jabber.fc +++ b/policy/modules/services/jabber.fc @@ -2,5 +2,14 @@ @@ -20429,9 +20432,9 @@ index 4c9acec..908eb91 100644 +# for new version of jabberd +/usr/bin/router -- gen_context(system_u:object_r:jabberd_router_exec_t,s0) -+/usr/bin/sm -- gen_context(system_u:object_r:jabberd_exec_t,s0) -+/usr/bin/c2s -- gen_context(system_u:object_r:jabberd_exec_t,s0) ++/usr/bin/c2s -- gen_context(system_u:object_r:jabberd_router_exec_t,s0) +/usr/bin/s2s -- gen_context(system_u:object_r:jabberd_exec_t,s0) ++/usr/bin/sm -- gen_context(system_u:object_r:jabberd_exec_t,s0) + +/var/lib/jabberd(/.*)? gen_context(system_u:object_r:jabberd_var_lib_t,s0) + @@ -20561,7 +20564,7 @@ index 9878499..9167dc9 100644 domain_system_change_exemption($1) role_transition $2 jabberd_initrc_exec_t system_r; diff --git a/policy/modules/services/jabber.te b/policy/modules/services/jabber.te -index da2127e..5f8840f 100644 +index da2127e..e184dff 100644 --- a/policy/modules/services/jabber.te +++ b/policy/modules/services/jabber.te @@ -5,13 +5,19 @@ policy_module(jabber, 1.8.0) @@ -20585,7 +20588,7 @@ index da2127e..5f8840f 100644 type jabberd_log_t; logging_log_file(jabberd_log_t) -@@ -21,40 +27,78 @@ files_type(jabberd_var_lib_t) +@@ -21,74 +27,94 @@ files_type(jabberd_var_lib_t) type jabberd_var_run_t; files_pid_file(jabberd_var_run_t) @@ -20593,10 +20596,10 @@ index da2127e..5f8840f 100644 +permissive jabberd_router_t; +permissive jabberd_t; + -+####################################### ++###################################### # -# Local policy -+# Local policy for jabberd domains ++# Local policy for jabberd-router and c2s components # -allow jabberd_t self:capability dac_override; @@ -20605,6 +20608,95 @@ index da2127e..5f8840f 100644 -allow jabberd_t self:fifo_file read_fifo_file_perms; -allow jabberd_t self:tcp_socket create_stream_socket_perms; -allow jabberd_t self:udp_socket create_socket_perms; +- +-manage_files_pattern(jabberd_t, jabberd_var_lib_t, jabberd_var_lib_t) +-files_var_lib_filetrans(jabberd_t, jabberd_var_lib_t, file) +- +-manage_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t) +-logging_log_filetrans(jabberd_t, jabberd_log_t, { file dir }) +- +-manage_files_pattern(jabberd_t, jabberd_var_run_t, jabberd_var_run_t) +-files_pid_filetrans(jabberd_t, jabberd_var_run_t, file) +- +-kernel_read_kernel_sysctls(jabberd_t) +-kernel_list_proc(jabberd_t) +-kernel_read_proc_symlinks(jabberd_t) +- +-corenet_all_recvfrom_unlabeled(jabberd_t) +-corenet_all_recvfrom_netlabel(jabberd_t) +-corenet_tcp_sendrecv_generic_if(jabberd_t) +-corenet_udp_sendrecv_generic_if(jabberd_t) +-corenet_tcp_sendrecv_generic_node(jabberd_t) +-corenet_udp_sendrecv_generic_node(jabberd_t) +-corenet_tcp_sendrecv_all_ports(jabberd_t) +-corenet_udp_sendrecv_all_ports(jabberd_t) +-corenet_tcp_bind_generic_node(jabberd_t) +-corenet_tcp_bind_jabber_client_port(jabberd_t) +-corenet_tcp_bind_jabber_interserver_port(jabberd_t) +-corenet_sendrecv_jabber_client_server_packets(jabberd_t) +-corenet_sendrecv_jabber_interserver_server_packets(jabberd_t) ++allow jabberd_router_t self:netlink_route_socket r_netlink_socket_perms; ++ ++corenet_tcp_bind_jabber_client_port(jabberd_router_t) ++corenet_tcp_bind_jabber_router_port(jabberd_router_t) ++corenet_tcp_connect_jabber_router_port(jabberd_router_t) ++corenet_sendrecv_jabber_router_server_packets(jabberd_router_t) ++corenet_sendrecv_jabber_client_server_packets(jabberd_router_t) + +-dev_read_sysfs(jabberd_t) +-# For SSL +-dev_read_rand(jabberd_t) ++fs_getattr_all_fs(jabberd_router_t) + +-domain_use_interactive_fds(jabberd_t) ++miscfiles_read_certs(jabberd_router_t) + +-files_read_etc_files(jabberd_t) +-files_read_etc_runtime_files(jabberd_t) ++optional_policy(` ++ kerberos_use(jabberd_router_t) ++') + +-fs_getattr_all_fs(jabberd_t) +-fs_search_auto_mountpoints(jabberd_t) ++optional_policy(` ++ nis_use_ypbind(jabberd_router_t) ++') + +-logging_send_syslog_msg(jabberd_t) ++##################################### ++# ++# Local policy for other jabberd components ++# + +-miscfiles_read_localization(jabberd_t) ++kernel_read_system_state(jabberd_t) + +-sysnet_read_config(jabberd_t) ++corenet_tcp_bind_jabber_interserver_port(jabberd_t) ++corenet_tcp_connect_jabber_router_port(jabberd_t) + + userdom_dontaudit_use_unpriv_user_fds(jabberd_t) + userdom_dontaudit_search_user_home_dirs(jabberd_t) + + optional_policy(` +- nis_use_ypbind(jabberd_t) ++ seutil_sigchld_newrole(jabberd_t) + ') + + optional_policy(` +- seutil_sigchld_newrole(jabberd_t) ++ udev_read_db(jabberd_t) + ') + +-optional_policy(` +- udev_read_db(jabberd_t) +-') ++####################################### ++# ++# Local policy for jabberd domains ++# ++ +allow jabberd_domain self:process signal_perms; +allow jabberd_domain self:fifo_file read_fifo_file_perms; +allow jabberd_domain self:tcp_socket create_stream_socket_perms; @@ -20616,14 +20708,10 @@ index da2127e..5f8840f 100644 +# log and pid files are moved into /var/lib/jabberd in the newer version of jabberd +manage_files_pattern(jabberd_domain, jabberd_log_t, jabberd_log_t) +logging_log_filetrans(jabberd_domain, jabberd_log_t, { file dir }) - --manage_files_pattern(jabberd_t, jabberd_var_lib_t, jabberd_var_lib_t) --files_var_lib_filetrans(jabberd_t, jabberd_var_lib_t, file) ++ +manage_files_pattern(jabberd_domain, jabberd_var_run_t, jabberd_var_run_t) +files_pid_filetrans(jabberd_domain, jabberd_var_run_t, file) - --manage_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t) --logging_log_filetrans(jabberd_t, jabberd_log_t, { file dir }) ++ +corenet_all_recvfrom_unlabeled(jabberd_domain) +corenet_all_recvfrom_netlabel(jabberd_domain) +corenet_tcp_sendrecv_generic_if(jabberd_domain) @@ -20636,6 +20724,7 @@ index da2127e..5f8840f 100644 + +dev_read_urand(jabberd_domain) +dev_read_urand(jabberd_domain) ++dev_read_sysfs(jabberd_domain) + +files_read_etc_files(jabberd_domain) +files_read_etc_runtime_files(jabberd_domain) @@ -20645,68 +20734,6 @@ index da2127e..5f8840f 100644 +miscfiles_read_localization(jabberd_domain) + +sysnet_read_config(jabberd_domain) -+ -+###################################### -+# -+# Local policy for jabberd-router -+# - --manage_files_pattern(jabberd_t, jabberd_var_run_t, jabberd_var_run_t) --files_pid_filetrans(jabberd_t, jabberd_var_run_t, file) -+allow jabberd_router_t self:netlink_route_socket r_netlink_socket_perms; -+ -+corenet_tcp_bind_jabber_router_port(jabberd_router_t) -+corenet_sendrecv_jabber_router_server_packets(jabberd_router_t) -+ -+optional_policy(` -+ kerberos_use(jabberd_router_t) -+') -+ -+######################################## -+# -+# Local policy for jabberd -+# -+ -+allow jabberd_t self:capability dac_override; -+dontaudit jabberd_t self:capability sys_tty_config; - - kernel_read_kernel_sysctls(jabberd_t) --kernel_list_proc(jabberd_t) - kernel_read_proc_symlinks(jabberd_t) -+kernel_read_system_state(jabberd_t) - --corenet_all_recvfrom_unlabeled(jabberd_t) --corenet_all_recvfrom_netlabel(jabberd_t) --corenet_tcp_sendrecv_generic_if(jabberd_t) --corenet_udp_sendrecv_generic_if(jabberd_t) --corenet_tcp_sendrecv_generic_node(jabberd_t) --corenet_udp_sendrecv_generic_node(jabberd_t) --corenet_tcp_sendrecv_all_ports(jabberd_t) --corenet_udp_sendrecv_all_ports(jabberd_t) --corenet_tcp_bind_generic_node(jabberd_t) -+corenet_tcp_connect_jabber_router_port(jabberd_t) - corenet_tcp_bind_jabber_client_port(jabberd_t) - corenet_tcp_bind_jabber_interserver_port(jabberd_t) - corenet_sendrecv_jabber_client_server_packets(jabberd_t) -@@ -66,18 +110,9 @@ dev_read_rand(jabberd_t) - - domain_use_interactive_fds(jabberd_t) - --files_read_etc_files(jabberd_t) --files_read_etc_runtime_files(jabberd_t) -- - fs_getattr_all_fs(jabberd_t) - fs_search_auto_mountpoints(jabberd_t) - --logging_send_syslog_msg(jabberd_t) -- --miscfiles_read_localization(jabberd_t) -- --sysnet_read_config(jabberd_t) -- - userdom_dontaudit_use_unpriv_user_fds(jabberd_t) - userdom_dontaudit_search_user_home_dirs(jabberd_t) - diff --git a/policy/modules/services/kerberos.fc b/policy/modules/services/kerberos.fc index 3525d24..e5db539 100644 --- a/policy/modules/services/kerberos.fc @@ -28390,24 +28417,20 @@ index f04a595..3203212 100644 + read_files_pattern($1, razor_var_lib_t, razor_var_lib_t) +') diff --git a/policy/modules/services/razor.te b/policy/modules/services/razor.te -index 340a6c0..eaa8706 100644 +index 340a6c0..f24c52e 100644 --- a/policy/modules/services/razor.te +++ b/policy/modules/services/razor.te -@@ -5,6 +5,32 @@ policy_module(razor, 2.1.1) +@@ -5,118 +5,139 @@ policy_module(razor, 2.1.1) # Declarations # +-type razor_exec_t; +-corecmd_executable_file(razor_exec_t) +ifdef(`distro_redhat',` -+ + gen_require(` -+ type spamc_t; -+ type spamc_exec_t; -+ type spamd_log_t; -+ type spamd_spool_t; -+ type spamd_var_lib_t; -+ type spamd_etc_t; -+ type spamc_home_t; -+ type spamc_tmp_t; ++ type spamc_t, spamc_exec_t, spamd_log_t; ++ type spamd_spool_t, spamd_var_lib_t, spamd_etc_t; ++ type spamc_home_t, spamc_tmp_t; + ') + + typealias spamc_t alias razor_t; @@ -28420,37 +28443,232 @@ index 340a6c0..eaa8706 100644 + typealias spamc_home_t alias { auditadm_razor_home_t secadm_razor_home_t }; + typealias spamc_tmp_t alias { user_razor_tmp_t staff_razor_tmp_t sysadm_razor_tmp_t }; + typealias spamc_tmp_t alias { auditadm_razor_tmp_t secadm_razor_tmp_t }; -+ +',` ++ type razor_exec_t; ++ corecmd_executable_file(razor_exec_t) + - type razor_exec_t; - corecmd_executable_file(razor_exec_t) - -@@ -14,6 +40,7 @@ files_config_file(razor_etc_t) - type razor_home_t; - typealias razor_home_t alias { user_razor_home_t staff_razor_home_t sysadm_razor_home_t }; - typealias razor_home_t alias { auditadm_razor_home_t secadm_razor_home_t }; -+files_poly_member(razor_home_t) - userdom_user_home_content(razor_home_t) ++ type razor_etc_t; ++ files_config_file(razor_etc_t) ++ ++ type razor_home_t; ++ typealias razor_home_t alias { user_razor_home_t staff_razor_home_t sysadm_razor_home_t }; ++ typealias razor_home_t alias { auditadm_razor_home_t secadm_razor_home_t }; ++ userdom_user_home_content(razor_home_t) ++ ++ type razor_log_t; ++ logging_log_file(razor_log_t) ++ ++ type razor_tmp_t; ++ typealias razor_tmp_t alias { user_razor_tmp_t staff_razor_tmp_t sysadm_razor_tmp_t }; ++ typealias razor_tmp_t alias { auditadm_razor_tmp_t secadm_razor_tmp_t }; ++ files_tmp_file(razor_tmp_t) ++ ubac_constrained(razor_tmp_t) ++ ++ type razor_var_lib_t; ++ files_type(razor_var_lib_t) ++ ++ # these are here due to ordering issues: ++ razor_common_domain_template(razor) ++ typealias razor_t alias { user_razor_t staff_razor_t sysadm_razor_t }; ++ typealias razor_t alias { auditadm_razor_t secadm_razor_t }; ++ ubac_constrained(razor_t) ++ ++ razor_common_domain_template(system_razor) ++ role system_r types system_razor_t; ++ ++ ######################################## ++ # ++ # System razor local policy ++ # ++ ++ # this version of razor is invoked typically ++ # via the system spam filter ++ ++ allow system_razor_t self:tcp_socket create_socket_perms; ++ ++ manage_dirs_pattern(system_razor_t, razor_etc_t, razor_etc_t) ++ manage_files_pattern(system_razor_t, razor_etc_t, razor_etc_t) ++ manage_lnk_files_pattern(system_razor_t, razor_etc_t, razor_etc_t) ++ files_search_etc(system_razor_t) ++ ++ allow system_razor_t razor_log_t:file manage_file_perms; ++ logging_log_filetrans(system_razor_t, razor_log_t, file) ++ ++ manage_files_pattern(system_razor_t, razor_var_lib_t, razor_var_lib_t) ++ files_var_lib_filetrans(system_razor_t, razor_var_lib_t, file) ++ ++ corenet_all_recvfrom_unlabeled(system_razor_t) ++ corenet_all_recvfrom_netlabel(system_razor_t) ++ corenet_tcp_sendrecv_generic_if(system_razor_t) ++ corenet_raw_sendrecv_generic_if(system_razor_t) ++ corenet_tcp_sendrecv_generic_node(system_razor_t) ++ corenet_raw_sendrecv_generic_node(system_razor_t) ++ corenet_tcp_sendrecv_razor_port(system_razor_t) ++ corenet_tcp_connect_razor_port(system_razor_t) ++ corenet_sendrecv_razor_client_packets(system_razor_t) ++ ++ sysnet_read_config(system_razor_t) ++ ++ # cjp: this shouldn't be needed ++ userdom_use_unpriv_users_fds(system_razor_t) ++ ++ optional_policy(` ++ logging_send_syslog_msg(system_razor_t) ++ ') ++ ++ optional_policy(` ++ nscd_socket_use(system_razor_t) ++ ') ++ ++ ######################################## ++ # ++ # User razor local policy ++ # ++ ++ # Allow razor to be run by hand. Needed by any action other than ++ # invocation from a spam filter. ++ ++ allow razor_t self:unix_stream_socket create_stream_socket_perms; ++ ++ manage_dirs_pattern(razor_t, razor_home_t, razor_home_t) ++ manage_files_pattern(razor_t, razor_home_t, razor_home_t) ++ manage_lnk_files_pattern(razor_t, razor_home_t, razor_home_t) ++ userdom_user_home_dir_filetrans(razor_t, razor_home_t, dir) ++ ++ manage_dirs_pattern(razor_t, razor_tmp_t, razor_tmp_t) ++ manage_files_pattern(razor_t, razor_tmp_t, razor_tmp_t) ++ files_tmp_filetrans(razor_t, razor_tmp_t, { file dir }) ++ ++ auth_use_nsswitch(razor_t) ++ ++ logging_send_syslog_msg(razor_t) - type razor_log_t; -@@ -100,6 +127,8 @@ manage_dirs_pattern(razor_t, razor_tmp_t, razor_tmp_t) - manage_files_pattern(razor_t, razor_tmp_t, razor_tmp_t) - files_tmp_filetrans(razor_t, razor_tmp_t, { file dir }) +-type razor_etc_t; +-files_config_file(razor_etc_t) ++ userdom_search_user_home_dirs(razor_t) ++ userdom_use_user_terminals(razor_t) -+auth_use_nsswitch(razor_t) -+ - logging_send_syslog_msg(razor_t) +-type razor_home_t; +-typealias razor_home_t alias { user_razor_home_t staff_razor_home_t sysadm_razor_home_t }; +-typealias razor_home_t alias { auditadm_razor_home_t secadm_razor_home_t }; +-userdom_user_home_content(razor_home_t) ++ tunable_policy(`use_nfs_home_dirs',` ++ fs_manage_nfs_dirs(razor_t) ++ fs_manage_nfs_files(razor_t) ++ fs_manage_nfs_symlinks(razor_t) ++ ') - userdom_search_user_home_dirs(razor_t) -@@ -118,5 +147,7 @@ tunable_policy(`use_samba_home_dirs',` - ') +-type razor_log_t; +-logging_log_file(razor_log_t) ++ tunable_policy(`use_samba_home_dirs',` ++ fs_manage_cifs_dirs(razor_t) ++ fs_manage_cifs_files(razor_t) ++ fs_manage_cifs_symlinks(razor_t) ++ ') - optional_policy(` +-type razor_tmp_t; +-typealias razor_tmp_t alias { user_razor_tmp_t staff_razor_tmp_t sysadm_razor_tmp_t }; +-typealias razor_tmp_t alias { auditadm_razor_tmp_t secadm_razor_tmp_t }; +-files_tmp_file(razor_tmp_t) +-ubac_constrained(razor_tmp_t) +- +-type razor_var_lib_t; +-files_type(razor_var_lib_t) +- +-# these are here due to ordering issues: +-razor_common_domain_template(razor) +-typealias razor_t alias { user_razor_t staff_razor_t sysadm_razor_t }; +-typealias razor_t alias { auditadm_razor_t secadm_razor_t }; +-ubac_constrained(razor_t) +- +-razor_common_domain_template(system_razor) +-role system_r types system_razor_t; +- +-######################################## +-# +-# System razor local policy +-# +- +-# this version of razor is invoked typically +-# via the system spam filter +- +-allow system_razor_t self:tcp_socket create_socket_perms; +- +-manage_dirs_pattern(system_razor_t, razor_etc_t, razor_etc_t) +-manage_files_pattern(system_razor_t, razor_etc_t, razor_etc_t) +-manage_lnk_files_pattern(system_razor_t, razor_etc_t, razor_etc_t) +-files_search_etc(system_razor_t) +- +-allow system_razor_t razor_log_t:file manage_file_perms; +-logging_log_filetrans(system_razor_t, razor_log_t, file) +- +-manage_files_pattern(system_razor_t, razor_var_lib_t, razor_var_lib_t) +-files_var_lib_filetrans(system_razor_t, razor_var_lib_t, file) +- +-corenet_all_recvfrom_unlabeled(system_razor_t) +-corenet_all_recvfrom_netlabel(system_razor_t) +-corenet_tcp_sendrecv_generic_if(system_razor_t) +-corenet_raw_sendrecv_generic_if(system_razor_t) +-corenet_tcp_sendrecv_generic_node(system_razor_t) +-corenet_raw_sendrecv_generic_node(system_razor_t) +-corenet_tcp_sendrecv_razor_port(system_razor_t) +-corenet_tcp_connect_razor_port(system_razor_t) +-corenet_sendrecv_razor_client_packets(system_razor_t) +- +-sysnet_read_config(system_razor_t) +- +-# cjp: this shouldn't be needed +-userdom_use_unpriv_users_fds(system_razor_t) +- +-optional_policy(` +- logging_send_syslog_msg(system_razor_t) +-') +- +-optional_policy(` +- nscd_socket_use(system_razor_t) +-') +- +-######################################## +-# +-# User razor local policy +-# +- +-# Allow razor to be run by hand. Needed by any action other than +-# invocation from a spam filter. +- +-allow razor_t self:unix_stream_socket create_stream_socket_perms; +- +-manage_dirs_pattern(razor_t, razor_home_t, razor_home_t) +-manage_files_pattern(razor_t, razor_home_t, razor_home_t) +-manage_lnk_files_pattern(razor_t, razor_home_t, razor_home_t) +-userdom_user_home_dir_filetrans(razor_t, razor_home_t, dir) +- +-manage_dirs_pattern(razor_t, razor_tmp_t, razor_tmp_t) +-manage_files_pattern(razor_t, razor_tmp_t, razor_tmp_t) +-files_tmp_filetrans(razor_t, razor_tmp_t, { file dir }) +- +-logging_send_syslog_msg(razor_t) +- +-userdom_search_user_home_dirs(razor_t) +-userdom_use_user_terminals(razor_t) +- +-tunable_policy(`use_nfs_home_dirs',` +- fs_manage_nfs_dirs(razor_t) +- fs_manage_nfs_files(razor_t) +- fs_manage_nfs_symlinks(razor_t) +-') +- +-tunable_policy(`use_samba_home_dirs',` +- fs_manage_cifs_dirs(razor_t) +- fs_manage_cifs_files(razor_t) +- fs_manage_cifs_symlinks(razor_t) +-') +- +-optional_policy(` - nscd_socket_use(razor_t) -+ milter_manage_spamass_state(razor_t) -+') -+ ++ optional_policy(` ++ milter_manage_spamass_state(razor_t) ++ ') ') diff --git a/policy/modules/services/remotelogin.te b/policy/modules/services/remotelogin.te index 0a76027..cdd0542 100644 @@ -28569,11 +28787,25 @@ index 7dc38d1..9c2c963 100644 + admin_pattern($1, rgmanager_var_run_t) +') diff --git a/policy/modules/services/rgmanager.te b/policy/modules/services/rgmanager.te -index 00fa514..9ab1d80 100644 +index 00fa514..612e4e4 100644 --- a/policy/modules/services/rgmanager.te +++ b/policy/modules/services/rgmanager.te -@@ -17,6 +17,9 @@ type rgmanager_exec_t; - domain_type(rgmanager_t) +@@ -6,17 +6,19 @@ policy_module(rgmanager, 1.0.0) + # + + ## +-##

+-## Allow rgmanager domain to connect to the network using TCP. +-##

++##

++## Allow rgmanager domain to connect to the network using TCP. ++##

+ ## + gen_tunable(rgmanager_can_network_connect, false) + + type rgmanager_t; + type rgmanager_exec_t; +-domain_type(rgmanager_t) init_daemon_domain(rgmanager_t, rgmanager_exec_t) +type rgmanager_initrc_exec_t; @@ -28582,7 +28814,16 @@ index 00fa514..9ab1d80 100644 type rgmanager_tmp_t; files_tmp_file(rgmanager_tmp_t) -@@ -55,11 +58,14 @@ fs_tmpfs_filetrans(rgmanager_t, rgmanager_tmpfs_t, { dir file }) +@@ -37,7 +39,7 @@ files_pid_file(rgmanager_var_run_t) + allow rgmanager_t self:capability { dac_override net_raw sys_resource sys_admin sys_nice ipc_lock }; + dontaudit rgmanager_t self:capability { sys_ptrace }; + allow rgmanager_t self:process { setsched signal }; +-dontaudit rgmanager_t self:process { ptrace }; ++dontaudit rgmanager_t self:process ptrace; + + allow rgmanager_t self:fifo_file rw_fifo_file_perms; + allow rgmanager_t self:unix_stream_socket { create_stream_socket_perms }; +@@ -55,11 +57,14 @@ fs_tmpfs_filetrans(rgmanager_t, rgmanager_tmpfs_t, { dir file }) manage_files_pattern(rgmanager_t, rgmanager_var_log_t, rgmanager_var_log_t) logging_log_filetrans(rgmanager_t, rgmanager_var_log_t, { file }) @@ -28598,7 +28839,7 @@ index 00fa514..9ab1d80 100644 kernel_read_system_state(rgmanager_t) kernel_rw_rpc_sysctls(rgmanager_t) kernel_search_debugfs(rgmanager_t) -@@ -78,14 +84,19 @@ domain_read_all_domains_state(rgmanager_t) +@@ -78,14 +83,19 @@ domain_read_all_domains_state(rgmanager_t) domain_getattr_all_domains(rgmanager_t) domain_dontaudit_ptrace_all_domains(rgmanager_t) @@ -28619,7 +28860,7 @@ index 00fa514..9ab1d80 100644 storage_getattr_fixed_disk_dev(rgmanager_t) term_getattr_pty_fs(rgmanager_t) -@@ -140,6 +151,11 @@ optional_policy(` +@@ -140,6 +150,11 @@ optional_policy(` ') optional_policy(` @@ -28822,10 +29063,20 @@ index de37806..229a3c7 100644 + read_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) +') diff --git a/policy/modules/services/rhcs.te b/policy/modules/services/rhcs.te -index 93c896a..1ebc84d 100644 +index 93c896a..8d40ec9 100644 --- a/policy/modules/services/rhcs.te +++ b/policy/modules/services/rhcs.te -@@ -13,6 +13,8 @@ policy_module(rhcs, 1.1.0) +@@ -6,13 +6,15 @@ policy_module(rhcs, 1.1.0) + # + + ## +-##

+-## Allow fenced domain to connect to the network using TCP. +-##

++##

++## Allow fenced domain to connect to the network using TCP. ++##

+ ## gen_tunable(fenced_can_network_connect, false) attribute cluster_domain; @@ -28881,7 +29132,7 @@ index 93c896a..1ebc84d 100644 +# needed by fence_scsi +optional_policy(` -+ corosync_exec(fenced_t) ++ corosync_exec(fenced_t) +') + optional_policy(` @@ -28890,7 +29141,15 @@ index 93c896a..1ebc84d 100644 ') optional_policy(` -@@ -139,10 +148,6 @@ storage_getattr_removable_dev(gfs_controld_t) +@@ -120,7 +129,6 @@ optional_policy(` + # + + allow gfs_controld_t self:capability { net_admin sys_resource }; +- + allow gfs_controld_t self:shm create_shm_perms; + allow gfs_controld_t self:netlink_kobject_uevent_socket create_socket_perms; + +@@ -139,10 +147,6 @@ storage_getattr_removable_dev(gfs_controld_t) init_rw_script_tmp_files(gfs_controld_t) optional_policy(` @@ -28901,16 +29160,25 @@ index 93c896a..1ebc84d 100644 lvm_exec(gfs_controld_t) dev_rw_lvm_control(gfs_controld_t) ') -@@ -168,7 +173,7 @@ init_rw_script_tmp_files(groupd_t) +@@ -154,7 +158,6 @@ optional_policy(` + + allow groupd_t self:capability { sys_nice sys_resource }; + allow groupd_t self:process setsched; +- + allow groupd_t self:shm create_shm_perms; + + dev_list_sysfs(groupd_t) +@@ -168,8 +171,7 @@ init_rw_script_tmp_files(groupd_t) # qdiskd local policy # -allow qdiskd_t self:capability ipc_lock; +- +allow qdiskd_t self:capability { ipc_lock sys_boot }; - allow qdiskd_t self:tcp_socket create_stream_socket_perms; allow qdiskd_t self:udp_socket create_socket_perms; -@@ -207,10 +212,6 @@ storage_raw_write_fixed_disk(qdiskd_t) + +@@ -207,10 +209,6 @@ storage_raw_write_fixed_disk(qdiskd_t) auth_use_nsswitch(qdiskd_t) optional_policy(` @@ -28921,7 +29189,16 @@ index 93c896a..1ebc84d 100644 netutils_domtrans_ping(qdiskd_t) ') -@@ -231,10 +232,17 @@ allow cluster_domain self:fifo_file rw_fifo_file_perms; +@@ -223,18 +221,24 @@ optional_policy(` + # rhcs domains common policy + # + +-allow cluster_domain self:capability { sys_nice }; ++allow cluster_domain self:capability sys_nice; + allow cluster_domain self:process setsched; +- + allow cluster_domain self:sem create_sem_perms; + allow cluster_domain self:fifo_file rw_fifo_file_perms; allow cluster_domain self:unix_stream_socket create_stream_socket_perms; allow cluster_domain self:unix_dgram_socket create_socket_perms; @@ -28950,6 +29227,19 @@ index 96efae7..793a29f 100644 + fs_search_tmpfs($1) allow $1 rhgb_tmpfs_t:file rw_file_perms; ') +diff --git a/policy/modules/services/rhgb.te b/policy/modules/services/rhgb.te +index 0f262a7..4d10897 100644 +--- a/policy/modules/services/rhgb.te ++++ b/policy/modules/services/rhgb.te +@@ -30,7 +30,7 @@ allow rhgb_t self:tcp_socket create_socket_perms; + allow rhgb_t self:udp_socket create_socket_perms; + allow rhgb_t self:netlink_route_socket r_netlink_socket_perms; + +-allow rhgb_t rhgb_devpts_t:chr_file { rw_chr_file_perms setattr }; ++allow rhgb_t rhgb_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms }; + term_create_pty(rhgb_t, rhgb_devpts_t) + + manage_dirs_pattern(rhgb_t, rhgb_tmpfs_t, rhgb_tmpfs_t) diff --git a/policy/modules/services/ricci.fc b/policy/modules/services/ricci.fc index 5b08327..ed5dc05 100644 --- a/policy/modules/services/ricci.fc @@ -29167,11 +29457,14 @@ index f7826f9..3128dd8 100644 + admin_pattern($1, ricci_var_run_t) +') diff --git a/policy/modules/services/ricci.te b/policy/modules/services/ricci.te -index 33e72e8..e2434cb 100644 +index 33e72e8..29e7311 100644 --- a/policy/modules/services/ricci.te +++ b/policy/modules/services/ricci.te -@@ -10,6 +10,9 @@ type ricci_exec_t; - domain_type(ricci_t) +@@ -7,9 +7,11 @@ policy_module(ricci, 1.7.0) + + type ricci_t; + type ricci_exec_t; +-domain_type(ricci_t) init_daemon_domain(ricci_t, ricci_exec_t) +type ricci_initrc_exec_t; @@ -29180,8 +29473,11 @@ index 33e72e8..e2434cb 100644 type ricci_tmp_t; files_tmp_file(ricci_tmp_t) -@@ -42,6 +45,9 @@ type ricci_modclusterd_exec_t; - domain_type(ricci_modclusterd_t) +@@ -39,9 +41,11 @@ files_pid_file(ricci_modcluster_var_run_t) + + type ricci_modclusterd_t; + type ricci_modclusterd_exec_t; +-domain_type(ricci_modclusterd_t) init_daemon_domain(ricci_modclusterd_t, ricci_modclusterd_exec_t) +type ricci_modclusterd_tmpfs_t; @@ -29190,7 +29486,16 @@ index 33e72e8..e2434cb 100644 type ricci_modlog_t; type ricci_modlog_exec_t; domain_type(ricci_modlog_t) -@@ -105,6 +111,7 @@ manage_sock_files_pattern(ricci_t, ricci_var_run_t, ricci_var_run_t) +@@ -95,7 +99,7 @@ manage_files_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t) + manage_sock_files_pattern(ricci_t, ricci_var_lib_t, ricci_var_lib_t) + files_var_lib_filetrans(ricci_t, ricci_var_lib_t, { file dir sock_file }) + +-allow ricci_t ricci_var_log_t:dir setattr; ++allow ricci_t ricci_var_log_t:dir setattr_dir_perms; + manage_files_pattern(ricci_t, ricci_var_log_t, ricci_var_log_t) + manage_sock_files_pattern(ricci_t, ricci_var_log_t, ricci_var_log_t) + logging_log_filetrans(ricci_t, ricci_var_log_t, { sock_file file dir }) +@@ -105,6 +109,7 @@ manage_sock_files_pattern(ricci_t, ricci_var_run_t, ricci_var_run_t) files_pid_filetrans(ricci_t, ricci_var_run_t, { file sock_file }) kernel_read_kernel_sysctls(ricci_t) @@ -29198,7 +29503,7 @@ index 33e72e8..e2434cb 100644 corecmd_exec_bin(ricci_t) -@@ -170,6 +177,10 @@ optional_policy(` +@@ -170,6 +175,10 @@ optional_policy(` ') optional_policy(` @@ -29209,7 +29514,7 @@ index 33e72e8..e2434cb 100644 unconfined_use_fds(ricci_t) ') -@@ -241,8 +252,7 @@ optional_policy(` +@@ -241,8 +250,7 @@ optional_policy(` ') optional_policy(` @@ -29219,7 +29524,7 @@ index 33e72e8..e2434cb 100644 ') ######################################## -@@ -261,6 +271,10 @@ allow ricci_modclusterd_t self:socket create_socket_perms; +@@ -261,6 +269,10 @@ allow ricci_modclusterd_t self:socket create_socket_perms; allow ricci_modclusterd_t ricci_modcluster_t:unix_stream_socket connectto; allow ricci_modclusterd_t ricci_modcluster_t:fifo_file rw_file_perms; @@ -29230,7 +29535,7 @@ index 33e72e8..e2434cb 100644 allow ricci_modclusterd_t ricci_modcluster_var_log_t:dir setattr; manage_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_log_t, ricci_modcluster_var_log_t) manage_sock_files_pattern(ricci_modclusterd_t, ricci_modcluster_var_log_t, ricci_modcluster_var_log_t) -@@ -272,6 +286,7 @@ files_pid_filetrans(ricci_modclusterd_t, ricci_modcluster_var_run_t, { file sock +@@ -272,6 +284,7 @@ files_pid_filetrans(ricci_modclusterd_t, ricci_modcluster_var_run_t, { file sock kernel_read_kernel_sysctls(ricci_modclusterd_t) kernel_read_system_state(ricci_modclusterd_t) @@ -29238,7 +29543,7 @@ index 33e72e8..e2434cb 100644 corecmd_exec_bin(ricci_modclusterd_t) -@@ -444,6 +459,12 @@ files_read_etc_runtime_files(ricci_modstorage_t) +@@ -444,6 +457,12 @@ files_read_etc_runtime_files(ricci_modstorage_t) files_read_usr_files(ricci_modstorage_t) files_read_kernel_modules(ricci_modstorage_t) @@ -29264,10 +29569,28 @@ index 2785337..c3c2775 100644 /usr/kerberos/sbin/klogind -- gen_context(system_u:object_r:rlogind_exec_t,s0) diff --git a/policy/modules/services/rlogin.te b/policy/modules/services/rlogin.te -index 779fa44..29a5d0d 100644 +index 779fa44..0155ca7 100644 --- a/policy/modules/services/rlogin.te +++ b/policy/modules/services/rlogin.te -@@ -43,7 +43,6 @@ can_exec(rlogind_t, rlogind_exec_t) +@@ -27,15 +27,14 @@ files_pid_file(rlogind_var_run_t) + # Local policy + # + +-allow rlogind_t self:capability { fsetid chown fowner sys_tty_config dac_override }; ++allow rlogind_t self:capability { fsetid chown fowner setuid setgid sys_tty_config dac_override }; + allow rlogind_t self:process signal_perms; + allow rlogind_t self:fifo_file rw_fifo_file_perms; + allow rlogind_t self:tcp_socket connected_stream_socket_perms; + # for identd; cjp: this should probably only be inetd_child rules? + allow rlogind_t self:netlink_tcpdiag_socket r_netlink_socket_perms; +-allow rlogind_t self:capability { setuid setgid }; + +-allow rlogind_t rlogind_devpts_t:chr_file { rw_chr_file_perms setattr }; ++allow rlogind_t rlogind_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms }; + term_create_pty(rlogind_t, rlogind_devpts_t) + + # for /usr/lib/telnetlogin +@@ -43,7 +42,6 @@ can_exec(rlogind_t, rlogind_exec_t) manage_dirs_pattern(rlogind_t, rlogind_tmp_t, rlogind_tmp_t) manage_files_pattern(rlogind_t, rlogind_tmp_t, rlogind_tmp_t) @@ -29275,7 +29598,7 @@ index 779fa44..29a5d0d 100644 manage_files_pattern(rlogind_t, rlogind_var_run_t, rlogind_var_run_t) files_pid_filetrans(rlogind_t, rlogind_var_run_t, file) -@@ -71,6 +70,7 @@ fs_search_auto_mountpoints(rlogind_t) +@@ -71,6 +69,7 @@ fs_search_auto_mountpoints(rlogind_t) auth_domtrans_chk_passwd(rlogind_t) auth_rw_login_records(rlogind_t) auth_use_nsswitch(rlogind_t) @@ -29283,7 +29606,7 @@ index 779fa44..29a5d0d 100644 files_read_etc_files(rlogind_t) files_read_etc_runtime_files(rlogind_t) -@@ -88,6 +88,9 @@ seutil_read_config(rlogind_t) +@@ -88,6 +87,9 @@ seutil_read_config(rlogind_t) userdom_setattr_user_ptys(rlogind_t) # cjp: this is egregious userdom_read_user_home_content_files(rlogind_t) @@ -29380,13 +29703,42 @@ index cda37bb..28e7576 100644 + allow $1 var_lib_nfs_t:file relabel_file_perms; ') diff --git a/policy/modules/services/rpc.te b/policy/modules/services/rpc.te -index 8e1ab72..9ae080e 100644 +index 8e1ab72..288e6cc 100644 --- a/policy/modules/services/rpc.te +++ b/policy/modules/services/rpc.te -@@ -63,8 +63,9 @@ allow rpcd_t self:process { getcap setcap }; +@@ -6,18 +6,18 @@ policy_module(rpc, 1.12.0) + # + + ## +-##

+-## Allow gssd to read temp directory. For access to kerberos tgt. +-##

++##

++## Allow gssd to read temp directory. For access to kerberos tgt. ++##

+ ## + gen_tunable(allow_gssd_read_tmp, true) + + ## +-##

+-## Allow nfs servers to modify public files +-## used for public file transfer services. Files/Directories must be +-## labeled public_content_rw_t. +-##

++##

++## Allow nfs servers to modify public files ++## used for public file transfer services. Files/Directories must be ++## labeled public_content_rw_t. ++##

+ ## + gen_tunable(allow_nfsd_anon_write, false) + +@@ -62,9 +62,10 @@ allow rpcd_t self:capability { sys_admin chown dac_override setgid setuid }; + allow rpcd_t self:process { getcap setcap }; allow rpcd_t self:fifo_file rw_fifo_file_perms; - allow rpcd_t rpcd_var_run_t:dir setattr; +-allow rpcd_t rpcd_var_run_t:dir setattr; ++allow rpcd_t rpcd_var_run_t:dir setattr_dir_perms; +manage_dirs_pattern(rpcd_t, rpcd_var_run_t, rpcd_var_run_t) manage_files_pattern(rpcd_t, rpcd_var_run_t, rpcd_var_run_t) -files_pid_filetrans(rpcd_t, rpcd_var_run_t, file) @@ -29394,7 +29746,15 @@ index 8e1ab72..9ae080e 100644 # rpc.statd executes sm-notify can_exec(rpcd_t, rpcd_exec_t) -@@ -97,15 +98,26 @@ miscfiles_read_generic_certs(rpcd_t) +@@ -87,6 +88,7 @@ fs_read_rpc_files(rpcd_t) + fs_read_rpc_symlinks(rpcd_t) + fs_rw_rpc_sockets(rpcd_t) + fs_get_all_fs_quotas(rpcd_t) ++fs_set_xattr_fs_quotas(rpcd_t) + fs_getattr_all_fs(rpcd_t) + + storage_getattr_fixed_disk_dev(rpcd_t) +@@ -97,15 +99,26 @@ miscfiles_read_generic_certs(rpcd_t) seutil_dontaudit_search_config(rpcd_t) @@ -29421,7 +29781,7 @@ index 8e1ab72..9ae080e 100644 ######################################## # # NFSD local policy -@@ -120,6 +132,7 @@ allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir list_dir_perms; +@@ -120,6 +133,7 @@ allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir list_dir_perms; kernel_read_system_state(nfsd_t) kernel_read_network_state(nfsd_t) kernel_dontaudit_getattr_core_if(nfsd_t) @@ -29429,15 +29789,25 @@ index 8e1ab72..9ae080e 100644 corenet_tcp_bind_all_rpc_ports(nfsd_t) corenet_udp_bind_all_rpc_ports(nfsd_t) -@@ -160,6 +173,7 @@ tunable_policy(`nfs_export_all_rw',` - fs_read_noxattr_fs_files(nfsd_t) - auth_manage_all_files_except_shadow(nfsd_t) - ') +@@ -148,6 +162,8 @@ storage_raw_read_removable_device(nfsd_t) + # Read access to public_content_t and public_content_rw_t + miscfiles_read_public_files(nfsd_t) + +userdom_user_home_dir_filetrans_user_home_content(nfsd_t, { file dir }) ++ + # Write access to public_content_t and public_content_rw_t + tunable_policy(`allow_nfsd_anon_write',` + miscfiles_manage_public_files(nfsd_t) +@@ -181,7 +197,7 @@ tunable_policy(`nfs_export_all_ro',` - tunable_policy(`nfs_export_all_ro',` - dev_getattr_all_blk_files(nfsd_t) -@@ -218,6 +232,8 @@ tunable_policy(`allow_gssd_read_tmp',` + allow gssd_t self:capability { dac_override dac_read_search setuid sys_nice }; + allow gssd_t self:process { getsched setsched }; +-allow gssd_t self:fifo_file rw_file_perms; ++allow gssd_t self:fifo_file rw_fifo_file_perms; + + manage_dirs_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t) + manage_files_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t) +@@ -218,6 +234,8 @@ tunable_policy(`allow_gssd_read_tmp',` userdom_list_user_tmp(gssd_t) userdom_read_user_tmp_files(gssd_t) userdom_read_user_tmp_symlinks(gssd_t) @@ -30707,19 +31077,28 @@ index 275f9fb..bfdf197 100644 init_labeled_script_domtrans($1, snmpd_initrc_exec_t) diff --git a/policy/modules/services/snmp.te b/policy/modules/services/snmp.te -index 3d8d1b3..b5cd366 100644 +index 3d8d1b3..0927db4 100644 --- a/policy/modules/services/snmp.te +++ b/policy/modules/services/snmp.te -@@ -24,7 +24,7 @@ files_type(snmpd_var_lib_t) +@@ -4,6 +4,7 @@ policy_module(snmp, 1.11.0) + # + # Declarations + # ++ + type snmpd_t; + type snmpd_exec_t; + init_daemon_domain(snmpd_t, snmpd_exec_t) +@@ -24,7 +25,8 @@ files_type(snmpd_var_lib_t) # # Local policy # -allow snmpd_t self:capability { chown dac_override kill ipc_lock sys_ptrace net_admin sys_nice sys_tty_config }; ++ +allow snmpd_t self:capability { chown dac_override kill ipc_lock setgid setuid sys_ptrace net_admin sys_nice sys_tty_config }; dontaudit snmpd_t self:capability { sys_module sys_tty_config }; allow snmpd_t self:process { signal_perms getsched setsched }; allow snmpd_t self:fifo_file rw_fifo_file_perms; -@@ -43,8 +43,9 @@ files_usr_filetrans(snmpd_t, snmpd_var_lib_t, file) +@@ -43,8 +45,9 @@ files_usr_filetrans(snmpd_t, snmpd_var_lib_t, file) files_var_filetrans(snmpd_t, snmpd_var_lib_t, { file dir sock_file }) files_var_lib_filetrans(snmpd_t, snmpd_var_lib_t, file) @@ -30730,7 +31109,7 @@ index 3d8d1b3..b5cd366 100644 kernel_read_device_sysctls(snmpd_t) kernel_read_kernel_sysctls(snmpd_t) -@@ -97,6 +98,7 @@ fs_search_auto_mountpoints(snmpd_t) +@@ -97,6 +100,7 @@ fs_search_auto_mountpoints(snmpd_t) storage_dontaudit_read_fixed_disk(snmpd_t) storage_dontaudit_read_removable_device(snmpd_t) @@ -30738,6 +31117,15 @@ index 3d8d1b3..b5cd366 100644 auth_use_nsswitch(snmpd_t) auth_read_all_dirs_except_shadow(snmpd_t) +@@ -115,7 +119,7 @@ sysnet_read_config(snmpd_t) + userdom_dontaudit_use_unpriv_user_fds(snmpd_t) + userdom_dontaudit_search_user_home_dirs(snmpd_t) + +-ifdef(`distro_redhat', ` ++ifdef(`distro_redhat',` + optional_policy(` + rpm_read_db(snmpd_t) + rpm_dontaudit_manage_db(snmpd_t) diff --git a/policy/modules/services/snort.if b/policy/modules/services/snort.if index c117e8b..88ebedb 100644 --- a/policy/modules/services/snort.if @@ -30769,6 +31157,31 @@ index c117e8b..88ebedb 100644 - files_search_pids($1) + files_list_pids($1) ') +diff --git a/policy/modules/services/snort.te b/policy/modules/services/snort.te +index d7f4bd4..012723c 100644 +--- a/policy/modules/services/snort.te ++++ b/policy/modules/services/snort.te +@@ -32,17 +32,17 @@ files_pid_file(snort_var_run_t) + allow snort_t self:capability { setgid setuid net_admin net_raw dac_override }; + dontaudit snort_t self:capability sys_tty_config; + allow snort_t self:process signal_perms; +-allow snort_t self:netlink_route_socket { bind create getattr nlmsg_read read write }; ++allow snort_t self:netlink_route_socket create_netlink_socket_perms; + allow snort_t self:tcp_socket create_stream_socket_perms; + allow snort_t self:udp_socket create_socket_perms; + allow snort_t self:packet_socket create_socket_perms; + allow snort_t self:socket create_socket_perms; + # Snort IPS node. unverified. +-allow snort_t self:netlink_firewall_socket { bind create getattr }; ++allow snort_t self:netlink_firewall_socket create_socket_perms; + + allow snort_t snort_etc_t:dir list_dir_perms; + allow snort_t snort_etc_t:file read_file_perms; +-allow snort_t snort_etc_t:lnk_file { getattr read }; ++allow snort_t snort_etc_t:lnk_file read_lnk_file_perms; + + manage_files_pattern(snort_t, snort_log_t, snort_log_t) + create_dirs_pattern(snort_t, snort_log_t, snort_log_t) diff --git a/policy/modules/services/soundserver.if b/policy/modules/services/soundserver.if index 93fe7bf..4a15633 100644 --- a/policy/modules/services/soundserver.if @@ -30991,64 +31404,127 @@ index c954f31..7f57f22 100644 + admin_pattern($1, spamd_var_run_t) ') diff --git a/policy/modules/services/spamassassin.te b/policy/modules/services/spamassassin.te -index 9d40380..9ad4eff 100644 +index 9d40380..56e4c2e 100644 --- a/policy/modules/services/spamassassin.te +++ b/policy/modules/services/spamassassin.te -@@ -19,6 +19,35 @@ gen_tunable(spamassassin_can_network, false) +@@ -6,54 +6,93 @@ policy_module(spamassassin, 2.3.1) + # + + ## +-##

+-## Allow user spamassassin clients to use the network. +-##

++##

++## Allow user spamassassin clients to use the network. ++##

+ ## + gen_tunable(spamassassin_can_network, false) + + ## +-##

+-## Allow spamd to read/write user home directories. +-##

++##

++## Allow spamd to read/write user home directories. ++##

## gen_tunable(spamd_enable_home_dirs, true) +-type spamassassin_t; +-type spamassassin_exec_t; +-typealias spamassassin_t alias { user_spamassassin_t staff_spamassassin_t sysadm_spamassassin_t }; +-typealias spamassassin_t alias { auditadm_spamassassin_t secadm_spamassassin_t }; +-application_domain(spamassassin_t, spamassassin_exec_t) +-ubac_constrained(spamassassin_t) +- +-type spamassassin_home_t; +-typealias spamassassin_home_t alias { user_spamassassin_home_t staff_spamassassin_home_t sysadm_spamassassin_home_t }; +-typealias spamassassin_home_t alias { auditadm_spamassassin_home_t secadm_spamassassin_home_t }; +-userdom_user_home_content(spamassassin_home_t) +- +-type spamassassin_tmp_t; +-typealias spamassassin_tmp_t alias { user_spamassassin_tmp_t staff_spamassassin_tmp_t sysadm_spamassassin_tmp_t }; +-typealias spamassassin_tmp_t alias { auditadm_spamassassin_tmp_t secadm_spamassassin_tmp_t }; +-files_tmp_file(spamassassin_tmp_t) +-ubac_constrained(spamassassin_tmp_t) +- +-type spamc_t; +-type spamc_exec_t; +-typealias spamc_t alias { user_spamc_t staff_spamc_t sysadm_spamc_t }; +-typealias spamc_t alias { auditadm_spamc_t secadm_spamc_t }; +-application_domain(spamc_t, spamc_exec_t) +-ubac_constrained(spamc_t) +- +-type spamc_tmp_t; +-typealias spamc_tmp_t alias { user_spamc_tmp_t staff_spamc_tmp_t sysadm_spamc_tmp_t }; +-typealias spamc_tmp_t alias { auditadm_spamc_tmp_t secadm_spamc_tmp_t }; +-files_tmp_file(spamc_tmp_t) +-ubac_constrained(spamc_tmp_t) +ifdef(`distro_redhat',` -+# spamassassin client executable -+type spamc_t; -+type spamc_exec_t; -+application_domain(spamc_t, spamc_exec_t) -+role system_r types spamc_t; -+ -+type spamd_etc_t; -+files_config_file(spamd_etc_t) -+ -+typealias spamc_exec_t alias spamassassin_exec_t; -+typealias spamc_t alias spamassassin_t; -+ -+type spamc_home_t; -+userdom_user_home_content(spamc_home_t) -+typealias spamc_home_t alias { spamassassin_home_t user_spamassassin_home_t staff_spamassassin_home_t sysadm_spamassassin_home_t }; -+typealias spamc_home_t alias { auditadm_spamassassin_home_t secadm_spamassassin_home_t }; -+typealias spamc_home_t alias { user_spamc_home_t staff_spamc_home_t sysadm_spamc_home_t }; -+typealias spamc_home_t alias { auditadm_spamc_home_t secadm_spamc_home_t }; -+ -+type spamc_tmp_t; -+files_tmp_file(spamc_tmp_t) -+typealias spamc_tmp_t alias spamassassin_tmp_t; -+typealias spamc_tmp_t alias { user_spamassassin_tmp_t staff_spamassassin_tmp_t sysadm_spamassassin_tmp_t }; -+typealias spamc_tmp_t alias { auditadm_spamassassin_tmp_t secadm_spamassassin_tmp_t }; -+ -+typealias spamc_tmp_t alias { user_spamc_tmp_t staff_spamc_tmp_t sysadm_spamc_tmp_t }; -+typealias spamc_tmp_t alias { auditadm_spamc_tmp_t secadm_spamc_tmp_t }; -+', ` - type spamassassin_t; - type spamassassin_exec_t; - typealias spamassassin_t alias { user_spamassassin_t staff_spamassassin_t sysadm_spamassassin_t }; -@@ -30,6 +59,7 @@ type spamassassin_home_t; - typealias spamassassin_home_t alias { user_spamassassin_home_t staff_spamassassin_home_t sysadm_spamassassin_home_t }; - typealias spamassassin_home_t alias { auditadm_spamassassin_home_t secadm_spamassassin_home_t }; - userdom_user_home_content(spamassassin_home_t) -+files_poly_member(spamassassin_home_t) - - type spamassassin_tmp_t; - typealias spamassassin_tmp_t alias { user_spamassassin_tmp_t staff_spamassassin_tmp_t sysadm_spamassassin_tmp_t }; -@@ -49,10 +79,21 @@ typealias spamc_tmp_t alias { user_spamc_tmp_t staff_spamc_tmp_t sysadm_spamc_tm - typealias spamc_tmp_t alias { auditadm_spamc_tmp_t secadm_spamc_tmp_t }; - files_tmp_file(spamc_tmp_t) - ubac_constrained(spamc_tmp_t) ++ # spamassassin client executable ++ type spamc_t; ++ type spamc_exec_t; ++ application_domain(spamc_t, spamc_exec_t) ++ role system_r types spamc_t; ++ ++ type spamd_etc_t; ++ files_config_file(spamd_etc_t) ++ ++ typealias spamc_exec_t alias spamassassin_exec_t; ++ typealias spamc_t alias spamassassin_t; ++ ++ type spamc_home_t; ++ userdom_user_home_content(spamc_home_t) ++ typealias spamc_home_t alias { spamassassin_home_t user_spamassassin_home_t staff_spamassassin_home_t sysadm_spamassassin_home_t }; ++ typealias spamc_home_t alias { auditadm_spamassassin_home_t secadm_spamassassin_home_t }; ++ typealias spamc_home_t alias { user_spamc_home_t staff_spamc_home_t sysadm_spamc_home_t }; ++ typealias spamc_home_t alias { auditadm_spamc_home_t secadm_spamc_home_t }; ++ ++ type spamc_tmp_t; ++ files_tmp_file(spamc_tmp_t) ++ typealias spamc_tmp_t alias spamassassin_tmp_t; ++ typealias spamc_tmp_t alias { user_spamassassin_tmp_t staff_spamassassin_tmp_t sysadm_spamassassin_tmp_t }; ++ typealias spamc_tmp_t alias { auditadm_spamassassin_tmp_t secadm_spamassassin_tmp_t }; ++ ++ typealias spamc_tmp_t alias { user_spamc_tmp_t staff_spamc_tmp_t sysadm_spamc_tmp_t }; ++ typealias spamc_tmp_t alias { auditadm_spamc_tmp_t secadm_spamc_tmp_t }; ++',` ++ type spamassassin_t; ++ type spamassassin_exec_t; ++ typealias spamassassin_t alias { user_spamassassin_t staff_spamassassin_t sysadm_spamassassin_t }; ++ typealias spamassassin_t alias { auditadm_spamassassin_t secadm_spamassassin_t }; ++ application_domain(spamassassin_t, spamassassin_exec_t) ++ ubac_constrained(spamassassin_t) ++ ++ type spamassassin_home_t; ++ typealias spamassassin_home_t alias { user_spamassassin_home_t staff_spamassassin_home_t sysadm_spamassassin_home_t }; ++ typealias spamassassin_home_t alias { auditadm_spamassassin_home_t secadm_spamassassin_home_t }; ++ userdom_user_home_content(spamassassin_home_t) ++ ++ type spamassassin_tmp_t; ++ typealias spamassassin_tmp_t alias { user_spamassassin_tmp_t staff_spamassassin_tmp_t sysadm_spamassassin_tmp_t }; ++ typealias spamassassin_tmp_t alias { auditadm_spamassassin_tmp_t secadm_spamassassin_tmp_t }; ++ files_tmp_file(spamassassin_tmp_t) ++ ubac_constrained(spamassassin_tmp_t) ++ ++ type spamc_t; ++ type spamc_exec_t; ++ typealias spamc_t alias { user_spamc_t staff_spamc_t sysadm_spamc_t }; ++ typealias spamc_t alias { auditadm_spamc_t secadm_spamc_t }; ++ application_domain(spamc_t, spamc_exec_t) ++ ubac_constrained(spamc_t) ++ ++ type spamc_tmp_t; ++ typealias spamc_tmp_t alias { user_spamc_tmp_t staff_spamc_tmp_t sysadm_spamc_tmp_t }; ++ typealias spamc_tmp_t alias { auditadm_spamc_tmp_t secadm_spamc_tmp_t }; ++ files_tmp_file(spamc_tmp_t) ++ ubac_constrained(spamc_tmp_t) +') type spamd_t; type spamd_exec_t; init_daemon_domain(spamd_t, spamd_exec_t) -+can_exec(spamd_t, spamd_exec_t) -+ + +type spamd_compiled_t; +files_type(spamd_compiled_t) + @@ -31057,10 +31533,11 @@ index 9d40380..9ad4eff 100644 + +type spamd_log_t; +logging_log_file(spamd_log_t) - ++ type spamd_spool_t; files_type(spamd_spool_t) -@@ -108,6 +149,7 @@ kernel_read_kernel_sysctls(spamassassin_t) + +@@ -108,6 +147,7 @@ kernel_read_kernel_sysctls(spamassassin_t) dev_read_urand(spamassassin_t) fs_search_auto_mountpoints(spamassassin_t) @@ -31068,7 +31545,7 @@ index 9d40380..9ad4eff 100644 # this should probably be removed corecmd_list_bin(spamassassin_t) -@@ -148,6 +190,9 @@ tunable_policy(`spamassassin_can_network',` +@@ -148,6 +188,9 @@ tunable_policy(`spamassassin_can_network',` corenet_udp_sendrecv_all_ports(spamassassin_t) corenet_tcp_connect_all_ports(spamassassin_t) corenet_sendrecv_all_client_packets(spamassassin_t) @@ -31078,7 +31555,7 @@ index 9d40380..9ad4eff 100644 sysnet_read_config(spamassassin_t) ') -@@ -184,6 +229,8 @@ optional_policy(` +@@ -184,6 +227,8 @@ optional_policy(` optional_policy(` mta_read_config(spamassassin_t) sendmail_stub(spamassassin_t) @@ -31087,18 +31564,12 @@ index 9d40380..9ad4eff 100644 ') ######################################## -@@ -205,16 +252,33 @@ allow spamc_t self:unix_dgram_socket sendto; - allow spamc_t self:unix_stream_socket connectto; +@@ -206,15 +251,30 @@ allow spamc_t self:unix_stream_socket connectto; allow spamc_t self:tcp_socket create_stream_socket_perms; allow spamc_t self:udp_socket create_socket_perms; -+corenet_all_recvfrom_unlabeled(spamc_t) -+corenet_all_recvfrom_netlabel(spamc_t) -+corenet_tcp_sendrecv_generic_if(spamc_t) -+corenet_tcp_sendrecv_generic_node(spamc_t) -+corenet_tcp_connect_spamd_port(spamc_t) -+ -+can_exec(spamc_t, spamc_exec_t) ++can_exec(spamc_t, spamc_exec_t) ++ manage_dirs_pattern(spamc_t, spamc_tmp_t, spamc_tmp_t) manage_files_pattern(spamc_t, spamc_tmp_t, spamc_tmp_t) files_tmp_filetrans(spamc_t, spamc_tmp_t, { file dir }) @@ -31111,6 +31582,9 @@ index 9d40380..9ad4eff 100644 +userdom_user_home_dir_filetrans(spamc_t, spamc_home_t, { dir file lnk_file sock_file fifo_file }) +userdom_append_user_home_content_files(spamc_t) + ++list_dirs_pattern(spamc_t, spamd_var_lib_t, spamd_var_lib_t) ++read_files_pattern(spamc_t, spamd_var_lib_t, spamd_var_lib_t) ++ # Allow connecting to a local spamd allow spamc_t spamd_t:unix_stream_socket connectto; allow spamc_t spamd_tmp_t:sock_file rw_sock_file_perms; @@ -31121,13 +31595,19 @@ index 9d40380..9ad4eff 100644 corenet_all_recvfrom_unlabeled(spamc_t) corenet_all_recvfrom_netlabel(spamc_t) -@@ -244,9 +308,16 @@ files_read_usr_files(spamc_t) +@@ -226,6 +286,7 @@ corenet_tcp_sendrecv_all_ports(spamc_t) + corenet_udp_sendrecv_all_ports(spamc_t) + corenet_tcp_connect_all_ports(spamc_t) + corenet_sendrecv_all_client_packets(spamc_t) ++corenet_tcp_connect_spamd_port(spamc_t) + + fs_search_auto_mountpoints(spamc_t) + +@@ -244,9 +305,14 @@ files_read_usr_files(spamc_t) files_dontaudit_search_var(spamc_t) # cjp: this may be removable: files_list_home(spamc_t) +files_list_var_lib(spamc_t) -+list_dirs_pattern(spamc_t, spamd_var_lib_t, spamd_var_lib_t) -+read_files_pattern(spamc_t, spamd_var_lib_t, spamd_var_lib_t) + +fs_search_auto_mountpoints(spamc_t) @@ -31138,7 +31618,7 @@ index 9d40380..9ad4eff 100644 miscfiles_read_localization(spamc_t) # cjp: this should probably be removed: -@@ -254,27 +325,40 @@ seutil_read_config(spamc_t) +@@ -254,27 +320,40 @@ seutil_read_config(spamc_t) sysnet_read_config(spamc_t) @@ -31185,7 +31665,7 @@ index 9d40380..9ad4eff 100644 ') ######################################## -@@ -286,7 +370,7 @@ optional_policy(` +@@ -286,7 +365,7 @@ optional_policy(` # setuids to the user running spamc. Comment this if you are not # using this ability. @@ -31194,7 +31674,7 @@ index 9d40380..9ad4eff 100644 dontaudit spamd_t self:capability sys_tty_config; allow spamd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow spamd_t self:fd use; -@@ -302,10 +386,17 @@ allow spamd_t self:unix_dgram_socket sendto; +@@ -302,10 +381,17 @@ allow spamd_t self:unix_dgram_socket sendto; allow spamd_t self:unix_stream_socket connectto; allow spamd_t self:tcp_socket create_stream_socket_perms; allow spamd_t self:udp_socket create_socket_perms; @@ -31213,7 +31693,7 @@ index 9d40380..9ad4eff 100644 files_spool_filetrans(spamd_t, spamd_spool_t, { file dir }) manage_dirs_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t) -@@ -314,11 +405,13 @@ files_tmp_filetrans(spamd_t, spamd_tmp_t, { file dir }) +@@ -314,11 +400,15 @@ files_tmp_filetrans(spamd_t, spamd_tmp_t, { file dir }) # var/lib files for spamd allow spamd_t spamd_var_lib_t:dir list_dir_perms; @@ -31226,10 +31706,12 @@ index 9d40380..9ad4eff 100644 -files_pid_filetrans(spamd_t, spamd_var_run_t, { dir file }) +manage_sock_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t) +files_pid_filetrans(spamd_t, spamd_var_run_t, { file dir }) ++ ++can_exec(spamd_t, spamd_exec_t) kernel_read_all_sysctls(spamd_t) kernel_read_system_state(spamd_t) -@@ -367,22 +460,27 @@ files_read_var_lib_files(spamd_t) +@@ -367,22 +457,27 @@ files_read_var_lib_files(spamd_t) init_dontaudit_rw_utmp(spamd_t) @@ -31261,7 +31743,7 @@ index 9d40380..9ad4eff 100644 fs_manage_cifs_files(spamd_t) ') -@@ -399,7 +497,9 @@ optional_policy(` +@@ -399,7 +494,9 @@ optional_policy(` ') optional_policy(` @@ -31271,7 +31753,16 @@ index 9d40380..9ad4eff 100644 dcc_stream_connect_dccifd(spamd_t) ') -@@ -416,10 +516,6 @@ optional_policy(` +@@ -408,25 +505,17 @@ optional_policy(` + ') + + optional_policy(` +- corenet_tcp_connect_mysqld_port(spamd_t) +- corenet_sendrecv_mysqld_client_packets(spamd_t) +- ++ mysql_tcp_connect(spamd_t) + mysql_search_db(spamd_t) + mysql_stream_connect(spamd_t) ') optional_policy(` @@ -31282,7 +31773,15 @@ index 9d40380..9ad4eff 100644 postfix_read_config(spamd_t) ') -@@ -437,6 +533,10 @@ optional_policy(` + optional_policy(` +- corenet_tcp_connect_postgresql_port(spamd_t) +- corenet_sendrecv_postgresql_client_packets(spamd_t) +- ++ postgresql_tcp_connect(spamd_t) + postgresql_stream_connect(spamd_t) + ') + +@@ -437,6 +526,10 @@ optional_policy(` optional_policy(` razor_domtrans(spamd_t) @@ -31324,6 +31823,35 @@ index d2496bd..1d0c078 100644 ') allow $1 squid_t:process { ptrace signal_perms }; +diff --git a/policy/modules/services/squid.te b/policy/modules/services/squid.te +index 4b2230e..744b172 100644 +--- a/policy/modules/services/squid.te ++++ b/policy/modules/services/squid.te +@@ -6,17 +6,17 @@ policy_module(squid, 1.10.0) + # + + ## +-##

+-## Allow squid to connect to all ports, not just +-## HTTP, FTP, and Gopher ports. +-##

++##

++## Allow squid to connect to all ports, not just ++## HTTP, FTP, and Gopher ports. ++##

+ ## + gen_tunable(squid_connect_any, false) + + ## +-##

+-## Allow squid to run as a transparent proxy (TPROXY) +-##

++##

++## Allow squid to run as a transparent proxy (TPROXY) ++##

+ ## + gen_tunable(squid_use_tproxy, false) + diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc index 078bcd7..dd706b0 100644 --- a/policy/modules/services/ssh.fc @@ -31636,24 +32164,50 @@ index 22adaca..784c363 100644 + allow $1 sshd_t:process signull; +') diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te -index 2dad3c8..68c3057 100644 +index 2dad3c8..c7efe5d 100644 --- a/policy/modules/services/ssh.te +++ b/policy/modules/services/ssh.te -@@ -19,6 +19,13 @@ gen_tunable(allow_ssh_keysign, false) +@@ -6,26 +6,32 @@ policy_module(ssh, 2.2.0) + # + + ## +-##

+-## allow host key based authentication +-##

++##

++## allow host key based authentication ++##

+ ## + gen_tunable(allow_ssh_keysign, false) + + ## +-##

+-## Allow ssh logins as sysadm_r:sysadm_t +-##

++##

++## Allow ssh logins as sysadm_r:sysadm_t ++##

## gen_tunable(ssh_sysadm_login, false) +## -+##

-+## allow sshd to forward port connections -+##

++##

++## allow sshd to forward port connections ++##

+## +gen_tunable(sshd_forward_ports, false) + attribute ssh_server; attribute ssh_agent_type; -@@ -33,13 +40,12 @@ corecmd_executable_file(sshd_exec_t) + type ssh_keygen_t; + type ssh_keygen_exec_t; + init_system_domain(ssh_keygen_t, ssh_keygen_exec_t) +-role system_r types ssh_keygen_t; + + type sshd_exec_t; + corecmd_executable_file(sshd_exec_t) +@@ -33,17 +39,12 @@ corecmd_executable_file(sshd_exec_t) ssh_server_template(sshd) init_daemon_domain(sshd_t, sshd_exec_t) @@ -31667,10 +32221,28 @@ index 2dad3c8..68c3057 100644 -files_tmp_file(sshd_tmp_t) -files_poly_parent(sshd_tmp_t) - - ifdef(`enable_mcs',` - init_ranged_daemon_domain(sshd_t, sshd_exec_t, s0 - mcs_systemhigh) - ') -@@ -99,11 +105,6 @@ allow ssh_t self:tcp_socket create_stream_socket_perms; +-ifdef(`enable_mcs',` +- init_ranged_daemon_domain(sshd_t, sshd_exec_t, s0 - mcs_systemhigh) +-') +- + type ssh_t; + type ssh_exec_t; + typealias ssh_t alias { user_ssh_t staff_ssh_t sysadm_ssh_t }; +@@ -76,9 +77,12 @@ ubac_constrained(ssh_tmpfs_t) + type ssh_home_t; + typealias ssh_home_t alias { home_ssh_t user_ssh_home_t user_home_ssh_t staff_home_ssh_t sysadm_home_ssh_t }; + typealias ssh_home_t alias { auditadm_home_ssh_t secadm_home_ssh_t }; +-files_type(ssh_home_t) + userdom_user_home_content(ssh_home_t) + ++ifdef(`enable_mcs',` ++ init_ranged_daemon_domain(sshd_t, sshd_exec_t, s0 - mcs_systemhigh) ++') ++ + ############################## + # + # SSH client local policy +@@ -99,11 +103,6 @@ allow ssh_t self:tcp_socket create_stream_socket_perms; # Read the ssh key file. allow ssh_t sshd_key_t:file read_file_perms; @@ -31682,7 +32254,7 @@ index 2dad3c8..68c3057 100644 manage_files_pattern(ssh_t, ssh_tmpfs_t, ssh_tmpfs_t) manage_lnk_files_pattern(ssh_t, ssh_tmpfs_t, ssh_tmpfs_t) manage_fifo_files_pattern(ssh_t, ssh_tmpfs_t, ssh_tmpfs_t) -@@ -113,6 +114,7 @@ fs_tmpfs_filetrans(ssh_t, ssh_tmpfs_t, { dir file lnk_file sock_file fifo_file } +@@ -113,6 +112,7 @@ fs_tmpfs_filetrans(ssh_t, ssh_tmpfs_t, { dir file lnk_file sock_file fifo_file } manage_dirs_pattern(ssh_t, ssh_home_t, ssh_home_t) manage_sock_files_pattern(ssh_t, ssh_home_t, ssh_home_t) userdom_user_home_dir_filetrans(ssh_t, ssh_home_t, { dir sock_file }) @@ -31690,7 +32262,7 @@ index 2dad3c8..68c3057 100644 # Allow the ssh program to communicate with ssh-agent. stream_connect_pattern(ssh_t, ssh_agent_tmp_t, ssh_agent_tmp_t, ssh_agent_type) -@@ -124,9 +126,10 @@ manage_files_pattern(ssh_t, ssh_home_t, ssh_home_t) +@@ -124,9 +124,10 @@ manage_files_pattern(ssh_t, ssh_home_t, ssh_home_t) read_lnk_files_pattern(ssh_t, ssh_home_t, ssh_home_t) # ssh servers can read the user keys and config @@ -31704,7 +32276,7 @@ index 2dad3c8..68c3057 100644 kernel_read_kernel_sysctls(ssh_t) kernel_read_system_state(ssh_t) -@@ -138,6 +141,8 @@ corenet_tcp_sendrecv_generic_node(ssh_t) +@@ -138,6 +139,8 @@ corenet_tcp_sendrecv_generic_node(ssh_t) corenet_tcp_sendrecv_all_ports(ssh_t) corenet_tcp_connect_ssh_port(ssh_t) corenet_sendrecv_ssh_client_packets(ssh_t) @@ -31713,7 +32285,7 @@ index 2dad3c8..68c3057 100644 dev_read_urand(ssh_t) -@@ -169,8 +174,10 @@ userdom_dontaudit_list_user_home_dirs(ssh_t) +@@ -169,14 +172,13 @@ userdom_dontaudit_list_user_home_dirs(ssh_t) userdom_search_user_home_dirs(ssh_t) # Write to the user domain tty. userdom_use_user_terminals(ssh_t) @@ -31724,8 +32296,15 @@ index 2dad3c8..68c3057 100644 +userdom_read_user_home_content_symlinks(ssh_t) tunable_policy(`allow_ssh_keysign',` - domain_auto_trans(ssh_t, ssh_keysign_exec_t, ssh_keysign_t) -@@ -200,6 +207,54 @@ optional_policy(` +- domain_auto_trans(ssh_t, ssh_keysign_exec_t, ssh_keysign_t) +- allow ssh_keysign_t ssh_t:fd use; +- allow ssh_keysign_t ssh_t:process sigchld; +- allow ssh_keysign_t ssh_t:fifo_file rw_file_perms; ++ domtrans_pattern(ssh_t, ssh_keysign_exec_t, ssh_keysign_t) + ') + + tunable_policy(`use_nfs_home_dirs',` +@@ -200,6 +202,53 @@ optional_policy(` xserver_domtrans_xauth(ssh_t) ') @@ -31739,7 +32318,6 @@ index 2dad3c8..68c3057 100644 + +dontaudit ssh_keygen_t self:capability sys_tty_config; +allow ssh_keygen_t self:process { sigchld sigkill sigstop signull signal }; -+ +allow ssh_keygen_t self:unix_stream_socket create_stream_socket_perms; + +allow ssh_keygen_t sshd_key_t:file manage_file_perms; @@ -31780,10 +32358,20 @@ index 2dad3c8..68c3057 100644 ############################## # # ssh_keysign_t local policy -@@ -233,44 +288,65 @@ optional_policy(` +@@ -209,7 +258,7 @@ tunable_policy(`allow_ssh_keysign',` + allow ssh_keysign_t self:capability { setgid setuid }; + allow ssh_keysign_t self:unix_stream_socket create_socket_perms; + +- allow ssh_keysign_t sshd_key_t:file { getattr read }; ++ allow ssh_keysign_t sshd_key_t:file read_file_perms; + + dev_read_urand(ssh_keysign_t) + +@@ -232,33 +281,39 @@ optional_policy(` + # so a tunnel can point to another ssh tunnel allow sshd_t self:netlink_route_socket r_netlink_socket_perms; allow sshd_t self:key { search link write }; - +- -manage_dirs_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t) -manage_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t) -manage_sock_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t) @@ -31803,15 +32391,17 @@ index 2dad3c8..68c3057 100644 corenet_tcp_bind_xserver_port(sshd_t) corenet_sendrecv_xserver_server_packets(sshd_t) -+tunable_policy(`sshd_forward_ports', ` -+ corenet_tcp_bind_all_unreserved_ports(sshd_t) -+ corenet_tcp_connect_all_ports(sshd_t) -+') -+ +userdom_read_user_home_content_files(sshd_t) +userdom_read_user_home_content_symlinks(sshd_t) +userdom_search_admin_dir(sshd_t) +userdom_manage_tmp_role(system_r, sshd_t) ++userdom_spec_domtrans_unpriv_users(sshd_t) ++userdom_signal_unpriv_users(sshd_t) ++ ++tunable_policy(`sshd_forward_ports',` ++ corenet_tcp_bind_all_unreserved_ports(sshd_t) ++ corenet_tcp_connect_all_ports(sshd_t) ++') + tunable_policy(`ssh_sysadm_login',` # Relabel and access ptys created by sshd @@ -31825,11 +32415,8 @@ index 2dad3c8..68c3057 100644 - userdom_signal_unpriv_users(sshd_t) ') -+userdom_spec_domtrans_unpriv_users(sshd_t) -+userdom_signal_unpriv_users(sshd_t) -+ optional_policy(` - daemontools_service_domain(sshd_t, sshd_exec_t) +@@ -266,11 +321,24 @@ optional_policy(` ') optional_policy(` @@ -31855,7 +32442,7 @@ index 2dad3c8..68c3057 100644 ') optional_policy(` -@@ -284,6 +360,11 @@ optional_policy(` +@@ -284,6 +352,11 @@ optional_policy(` ') optional_policy(` @@ -31867,7 +32454,61 @@ index 2dad3c8..68c3057 100644 unconfined_shell_domtrans(sshd_t) ') -@@ -353,10 +434,6 @@ logging_send_syslog_msg(ssh_keygen_t) +@@ -292,26 +365,26 @@ optional_policy(` + ') + + ifdef(`TODO',` +-tunable_policy(`ssh_sysadm_login',` +- # Relabel and access ptys created by sshd +- # ioctl is necessary for logout() processing for utmp entry and for w to +- # display the tty. +- # some versions of sshd on the new SE Linux require setattr +- allow sshd_t ptyfile:chr_file relabelto; +- +- optional_policy(` +- domain_trans(sshd_t, xauth_exec_t, userdomain) +- ') +-',` +- optional_policy(` +- domain_trans(sshd_t, xauth_exec_t, unpriv_userdomain) ++ tunable_policy(`ssh_sysadm_login',` ++ # Relabel and access ptys created by sshd ++ # ioctl is necessary for logout() processing for utmp entry and for w to ++ # display the tty. ++ # some versions of sshd on the new SE Linux require setattr ++ allow sshd_t ptyfile:chr_file relabelto; ++ ++ optional_policy(` ++ domain_trans(sshd_t, xauth_exec_t, userdomain) ++ ') ++ ',` ++ optional_policy(` ++ domain_trans(sshd_t, xauth_exec_t, unpriv_userdomain) ++ ') ++ # Relabel and access ptys created by sshd ++ # ioctl is necessary for logout() processing for utmp entry and for w to ++ # display the tty. ++ # some versions of sshd on the new SE Linux require setattr ++ allow sshd_t userpty_type:chr_file { relabelto rw_inherited_chr_file_perms setattr_chr_file_perms }; + ') +- # Relabel and access ptys created by sshd +- # ioctl is necessary for logout() processing for utmp entry and for w to +- # display the tty. +- # some versions of sshd on the new SE Linux require setattr +- allow sshd_t userpty_type:chr_file { relabelto read write getattr ioctl setattr }; +-') + ') dnl endif TODO + + ######################################## +@@ -324,7 +397,6 @@ tunable_policy(`ssh_sysadm_login',` + + dontaudit ssh_keygen_t self:capability sys_tty_config; + allow ssh_keygen_t self:process { sigchld sigkill sigstop signull signal }; +- + allow ssh_keygen_t self:unix_stream_socket create_stream_socket_perms; + + allow ssh_keygen_t sshd_key_t:file manage_file_perms; +@@ -353,10 +425,6 @@ logging_send_syslog_msg(ssh_keygen_t) userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t) optional_policy(` @@ -31936,22 +32577,33 @@ index 941380a..6dbfc01 100644 # Allow sssd_t to restart the apache service sssd_initrc_domtrans($1) diff --git a/policy/modules/services/sssd.te b/policy/modules/services/sssd.te -index 8ffa257..07d6748 100644 +index 8ffa257..7113802 100644 --- a/policy/modules/services/sssd.te +++ b/policy/modules/services/sssd.te -@@ -28,9 +28,10 @@ files_pid_file(sssd_var_run_t) +@@ -28,9 +28,11 @@ files_pid_file(sssd_var_run_t) # # sssd local policy # -allow sssd_t self:capability { dac_read_search dac_override kill sys_nice setgid setuid }; ++ +allow sssd_t self:capability { chown dac_read_search dac_override kill sys_nice setgid setuid }; allow sssd_t self:process { setfscreate setsched sigkill signal getsched }; - allow sssd_t self:fifo_file rw_file_perms; +-allow sssd_t self:fifo_file rw_file_perms; ++allow sssd_t self:fifo_file rw_fifo_file_perms; +allow sssd_t self:key manage_key_perms; allow sssd_t self:unix_stream_socket { create_stream_socket_perms connectto }; manage_dirs_pattern(sssd_t, sssd_public_t, sssd_public_t) -@@ -48,6 +49,7 @@ manage_dirs_pattern(sssd_t, sssd_var_run_t, sssd_var_run_t) +@@ -39,7 +41,7 @@ manage_files_pattern(sssd_t, sssd_public_t, sssd_public_t) + manage_dirs_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t) + manage_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t) + manage_sock_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t) +-files_var_lib_filetrans(sssd_t, sssd_var_lib_t, { file dir } ) ++files_var_lib_filetrans(sssd_t, sssd_var_lib_t, { file dir }) + + manage_files_pattern(sssd_t, sssd_var_log_t, sssd_var_log_t) + logging_log_filetrans(sssd_t, sssd_var_log_t, file) +@@ -48,6 +50,7 @@ manage_dirs_pattern(sssd_t, sssd_var_run_t, sssd_var_run_t) manage_files_pattern(sssd_t, sssd_var_run_t, sssd_var_run_t) files_pid_filetrans(sssd_t, sssd_var_run_t, { file dir }) @@ -31959,7 +32611,7 @@ index 8ffa257..07d6748 100644 kernel_read_system_state(sssd_t) corecmd_exec_bin(sssd_t) -@@ -80,6 +82,8 @@ logging_send_audit_msgs(sssd_t) +@@ -80,6 +83,8 @@ logging_send_audit_msgs(sssd_t) miscfiles_read_localization(sssd_t) @@ -31980,11 +32632,78 @@ index 6073656..eaf49b2 100644 + domtrans_pattern(stunnel_t, $2, $1) allow $1 stunnel_t:tcp_socket rw_socket_perms; ') +diff --git a/policy/modules/services/stunnel.te b/policy/modules/services/stunnel.te +index 7ecb27b..296e5ba 100644 +--- a/policy/modules/services/stunnel.te ++++ b/policy/modules/services/stunnel.te +@@ -6,17 +6,7 @@ policy_module(stunnel, 1.9.1) + # + + type stunnel_t; +-domain_type(stunnel_t) +-role system_r types stunnel_t; +- + type stunnel_exec_t; +-domain_entry_file(stunnel_t, stunnel_exec_t) +- +-ifdef(`distro_gentoo',` +- init_daemon_domain(stunnel_t, stunnel_exec_t) +-',` +- inetd_tcp_service_domain(stunnel_t, stunnel_exec_t) +-') + + type stunnel_etc_t; + files_config_file(stunnel_etc_t) +@@ -27,6 +17,12 @@ files_tmp_file(stunnel_tmp_t) + type stunnel_var_run_t; + files_pid_file(stunnel_var_run_t) + ++ifdef(`distro_gentoo',` ++ init_daemon_domain(stunnel_t, stunnel_exec_t) ++',` ++ inetd_tcp_service_domain(stunnel_t, stunnel_exec_t) ++') ++ + ######################################## + # + # Local policy +@@ -40,7 +36,7 @@ allow stunnel_t self:udp_socket create_socket_perms; + + allow stunnel_t stunnel_etc_t:dir list_dir_perms; + allow stunnel_t stunnel_etc_t:file read_file_perms; +-allow stunnel_t stunnel_etc_t:lnk_file { getattr read }; ++allow stunnel_t stunnel_etc_t:lnk_file read_lnk_file_perms; + + manage_dirs_pattern(stunnel_t, stunnel_tmp_t, stunnel_tmp_t) + manage_files_pattern(stunnel_t, stunnel_tmp_t, stunnel_tmp_t) +@@ -77,7 +73,7 @@ miscfiles_read_localization(stunnel_t) + + sysnet_read_config(stunnel_t) + +-ifdef(`distro_gentoo', ` ++ifdef(`distro_gentoo',` + dontaudit stunnel_t self:capability sys_tty_config; + allow stunnel_t self:udp_socket create_socket_perms; + +@@ -120,4 +116,5 @@ ifdef(`distro_gentoo', ` + gen_require(` + type stunnel_port_t; + ') ++ + allow stunnel_t stunnel_port_t:tcp_socket name_bind; diff --git a/policy/modules/services/sysstat.te b/policy/modules/services/sysstat.te -index 52f0d6c..111b041 100644 +index 52f0d6c..3645a22 100644 --- a/policy/modules/services/sysstat.te +++ b/policy/modules/services/sysstat.te -@@ -18,8 +18,7 @@ logging_log_file(sysstat_log_t) +@@ -8,7 +8,6 @@ policy_module(sysstat, 1.6.0) + type sysstat_t; + type sysstat_exec_t; + init_system_domain(sysstat_t, sysstat_exec_t) +-role system_r types sysstat_t; + + type sysstat_log_t; + logging_log_file(sysstat_log_t) +@@ -18,8 +17,7 @@ logging_log_file(sysstat_log_t) # Local policy # @@ -31994,7 +32713,7 @@ index 52f0d6c..111b041 100644 allow sysstat_t self:fifo_file rw_fifo_file_perms; can_exec(sysstat_t, sysstat_exec_t) -@@ -68,3 +67,8 @@ optional_policy(` +@@ -68,3 +66,7 @@ optional_policy(` optional_policy(` logging_send_syslog_msg(sysstat_t) ') @@ -32002,12 +32721,47 @@ index 52f0d6c..111b041 100644 +optional_policy(` + nscd_socket_use(sysstat_t) +') -+ +diff --git a/policy/modules/services/tcpd.te b/policy/modules/services/tcpd.te +index 7038b55..4e84f23 100644 +--- a/policy/modules/services/tcpd.te ++++ b/policy/modules/services/tcpd.te +@@ -7,7 +7,6 @@ policy_module(tcpd, 1.4.0) + type tcpd_t; + type tcpd_exec_t; + inetd_tcp_service_domain(tcpd_t, tcpd_exec_t) +-role system_r types tcpd_t; + + type tcpd_tmp_t; + files_tmp_file(tcpd_tmp_t) diff --git a/policy/modules/services/telnet.te b/policy/modules/services/telnet.te -index f40e67b..a0eeea9 100644 +index f40e67b..34c4c57 100644 --- a/policy/modules/services/telnet.te +++ b/policy/modules/services/telnet.te -@@ -38,7 +38,6 @@ term_create_pty(telnetd_t, telnetd_devpts_t) +@@ -8,7 +8,6 @@ policy_module(telnet, 1.10.0) + type telnetd_t; + type telnetd_exec_t; + inetd_service_domain(telnetd_t, telnetd_exec_t) +-role system_r types telnetd_t; + + type telnetd_devpts_t; #, userpty_type; + term_login_pty(telnetd_devpts_t) +@@ -24,21 +23,19 @@ files_pid_file(telnetd_var_run_t) + # Local policy + # + +-allow telnetd_t self:capability { fsetid chown fowner sys_tty_config dac_override }; ++allow telnetd_t self:capability { fsetid chown fowner setuid setgid sys_tty_config dac_override }; + allow telnetd_t self:process signal_perms; + allow telnetd_t self:fifo_file rw_fifo_file_perms; + allow telnetd_t self:tcp_socket connected_stream_socket_perms; + allow telnetd_t self:udp_socket create_socket_perms; + # for identd; cjp: this should probably only be inetd_child rules? + allow telnetd_t self:netlink_tcpdiag_socket r_netlink_socket_perms; +-allow telnetd_t self:capability { setuid setgid }; + +-allow telnetd_t telnetd_devpts_t:chr_file { rw_chr_file_perms setattr }; ++allow telnetd_t telnetd_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms }; + term_create_pty(telnetd_t, telnetd_devpts_t) manage_dirs_pattern(telnetd_t, telnetd_tmp_t, telnetd_tmp_t) manage_files_pattern(telnetd_t, telnetd_tmp_t, telnetd_tmp_t) @@ -32015,15 +32769,39 @@ index f40e67b..a0eeea9 100644 manage_files_pattern(telnetd_t, telnetd_var_run_t, telnetd_var_run_t) files_pid_filetrans(telnetd_t, telnetd_var_run_t, file) -@@ -85,6 +84,8 @@ remotelogin_domtrans(telnetd_t) +@@ -70,8 +67,6 @@ corecmd_search_bin(telnetd_t) + files_read_usr_files(telnetd_t) + files_read_etc_files(telnetd_t) + files_read_etc_runtime_files(telnetd_t) +-# for identd; cjp: this should probably only be inetd_child rules? +-files_search_home(telnetd_t) + + init_rw_utmp(telnetd_t) + +@@ -85,11 +80,8 @@ remotelogin_domtrans(telnetd_t) userdom_search_user_home_dirs(telnetd_t) userdom_setattr_user_ptys(telnetd_t) +- +-optional_policy(` +- kerberos_keytab_template(telnetd, telnetd_t) +- kerberos_manage_host_rcache(telnetd_t) +-') +userdom_manage_user_tmp_files(telnetd_t) +userdom_tmp_filetrans_user_tmp(telnetd_t, file) - optional_policy(` - kerberos_keytab_template(telnetd, telnetd_t) + tunable_policy(`use_nfs_home_dirs',` + fs_search_nfs(telnetd_t) +@@ -98,3 +90,9 @@ tunable_policy(`use_nfs_home_dirs',` + tunable_policy(`use_samba_home_dirs',` + fs_search_cifs(telnetd_t) + ') ++ ++optional_policy(` ++ kerberos_keytab_template(telnetd, telnetd_t) ++ kerberos_manage_host_rcache(telnetd_t) ++') ++ diff --git a/policy/modules/services/tftp.if b/policy/modules/services/tftp.if index 38bb312..1427b54 100644 --- a/policy/modules/services/tftp.if @@ -32105,9 +32883,42 @@ index 38bb312..1427b54 100644 admin_pattern($1, tftpdir_t) diff --git a/policy/modules/services/tftp.te b/policy/modules/services/tftp.te -index d50c10d..66bfd1c 100644 +index d50c10d..97ce79e 100644 --- a/policy/modules/services/tftp.te +++ b/policy/modules/services/tftp.te +@@ -6,10 +6,10 @@ policy_module(tftp, 1.12.0) + # + + ## +-##

+-## Allow tftp to modify public files +-## used for public file transfer services. +-##

++##

++## Allow tftp to modify public files ++## used for public file transfer services. ++##

+ ## + gen_tunable(tftp_anon_write, false) + +@@ -32,15 +32,15 @@ files_type(tftpdir_rw_t) + # + + allow tftpd_t self:capability { setgid setuid sys_chroot }; ++dontaudit tftpd_t self:capability sys_tty_config; + allow tftpd_t self:tcp_socket create_stream_socket_perms; + allow tftpd_t self:udp_socket create_socket_perms; + allow tftpd_t self:unix_dgram_socket create_socket_perms; + allow tftpd_t self:unix_stream_socket create_stream_socket_perms; +-dontaudit tftpd_t self:capability sys_tty_config; + + allow tftpd_t tftpdir_t:dir list_dir_perms; + allow tftpd_t tftpdir_t:file read_file_perms; +-allow tftpd_t tftpdir_t:lnk_file { getattr read }; ++allow tftpd_t tftpdir_t:lnk_file read_lnk_file_perms; + + manage_dirs_pattern(tftpd_t, tftpdir_rw_t, tftpdir_rw_t) + manage_files_pattern(tftpd_t, tftpdir_rw_t, tftpdir_rw_t) @@ -94,6 +94,10 @@ tunable_policy(`tftp_anon_write',` ') @@ -32169,9 +32980,18 @@ index b113b41..c2ed23a 100644 + allow $1 tgtd_t:sem create_sem_perms; ') diff --git a/policy/modules/services/tgtd.te b/policy/modules/services/tgtd.te -index aa0cc45..678ab90 100644 +index aa0cc45..44dfdc8 100644 --- a/policy/modules/services/tgtd.te +++ b/policy/modules/services/tgtd.te +@@ -29,7 +29,7 @@ files_type(tgtd_var_lib_t) + allow tgtd_t self:capability sys_resource; + allow tgtd_t self:process { setrlimit signal }; + allow tgtd_t self:fifo_file rw_fifo_file_perms; +-allow tgtd_t self:netlink_route_socket { create_socket_perms nlmsg_read }; ++allow tgtd_t self:netlink_route_socket create_netlink_socket_perms; + allow tgtd_t self:shm create_shm_perms; + allow tgtd_t self:sem create_sem_perms; + allow tgtd_t self:tcp_socket create_stream_socket_perms; @@ -57,10 +57,18 @@ corenet_tcp_bind_generic_node(tgtd_t) corenet_tcp_bind_iscsi_port(tgtd_t) corenet_sendrecv_iscsi_server_packets(tgtd_t) @@ -32205,19 +33025,33 @@ index 904f13e..464347f 100644 init_labeled_script_domtrans($1, tor_initrc_exec_t) diff --git a/policy/modules/services/tor.te b/policy/modules/services/tor.te -index 9fa94e4..0a0074c 100644 +index 9fa94e4..7f0d9a9 100644 --- a/policy/modules/services/tor.te +++ b/policy/modules/services/tor.te -@@ -42,6 +42,8 @@ files_pid_file(tor_var_run_t) +@@ -6,10 +6,10 @@ policy_module(tor, 1.7.0) + # + + ## +-##

+-## Allow tor daemon to bind +-## tcp sockets to all unreserved ports. +-##

++##

++## Allow tor daemon to bind ++## tcp sockets to all unreserved ports. ++##

+ ## + gen_tunable(tor_bind_all_unreserved_ports, false) + +@@ -42,6 +42,7 @@ files_pid_file(tor_var_run_t) # allow tor_t self:capability { setgid setuid sys_tty_config }; +allow tor_t self:process signal; -+ allow tor_t self:fifo_file rw_fifo_file_perms; allow tor_t self:unix_stream_socket create_stream_socket_perms; allow tor_t self:netlink_route_socket r_netlink_socket_perms; -@@ -67,9 +69,10 @@ manage_sock_files_pattern(tor_t, tor_var_log_t, tor_var_log_t) +@@ -67,9 +68,10 @@ manage_sock_files_pattern(tor_t, tor_var_log_t, tor_var_log_t) logging_log_filetrans(tor_t, tor_var_log_t, { sock_file file dir }) # pid file @@ -32229,7 +33063,7 @@ index 9fa94e4..0a0074c 100644 kernel_read_system_state(tor_t) -@@ -88,6 +91,7 @@ corenet_tcp_connect_all_ports(tor_t) +@@ -88,6 +90,7 @@ corenet_tcp_connect_all_ports(tor_t) corenet_sendrecv_all_client_packets(tor_t) # ... especially including port 80 and other privileged ports corenet_tcp_connect_all_reserved_ports(tor_t) @@ -32237,7 +33071,7 @@ index 9fa94e4..0a0074c 100644 # tor uses crypto and needs random dev_read_urand(tor_t) -@@ -100,6 +104,8 @@ files_read_usr_files(tor_t) +@@ -100,9 +103,11 @@ files_read_usr_files(tor_t) auth_use_nsswitch(tor_t) @@ -32245,7 +33079,11 @@ index 9fa94e4..0a0074c 100644 + miscfiles_read_localization(tor_t) - tunable_policy(`tor_bind_all_unreserved_ports', ` +-tunable_policy(`tor_bind_all_unreserved_ports', ` ++tunable_policy(`tor_bind_all_unreserved_ports',` + corenet_tcp_bind_all_unreserved_ports(tor_t) + ') + diff --git a/policy/modules/services/tuned.if b/policy/modules/services/tuned.if index 54b8605..752697f 100644 --- a/policy/modules/services/tuned.if @@ -32327,18 +33165,30 @@ index c1feba4..1f6f55b 100644 + domtrans_pattern(ucspitcp_t, $2, $1) ') diff --git a/policy/modules/services/ucspitcp.te b/policy/modules/services/ucspitcp.te -index a0794bf..dd23a9c 100644 +index a0794bf..37c056b 100644 --- a/policy/modules/services/ucspitcp.te +++ b/policy/modules/services/ucspitcp.te -@@ -91,3 +91,8 @@ optional_policy(` +@@ -8,12 +8,10 @@ policy_module(ucspitcp, 1.3.0) + type rblsmtpd_t; + type rblsmtpd_exec_t; + init_system_domain(rblsmtpd_t, rblsmtpd_exec_t) +-role system_r types rblsmtpd_t; + + type ucspitcp_t; + type ucspitcp_exec_t; + init_system_domain(ucspitcp_t, ucspitcp_exec_t) +-role system_r types ucspitcp_t; + + ######################################## + # +@@ -89,5 +87,7 @@ sysnet_read_config(ucspitcp_t) + + optional_policy(` daemontools_service_domain(ucspitcp_t, ucspitcp_exec_t) ++ daemontools_sigchld_run(ucspitcp_t) daemontools_read_svc(ucspitcp_t) ') + -+optional_policy(` -+ daemontools_sigchld_run(ucspitcp_t) -+') -+ diff --git a/policy/modules/services/ulogd.if b/policy/modules/services/ulogd.if index b078bf7..fd72fe8 100644 --- a/policy/modules/services/ulogd.if @@ -32394,7 +33244,7 @@ index b078bf7..fd72fe8 100644 admin_pattern($1, ulogd_modules_t) ') diff --git a/policy/modules/services/ulogd.te b/policy/modules/services/ulogd.te -index eeaa641..eb4d8d5 100644 +index eeaa641..ef97cb3 100644 --- a/policy/modules/services/ulogd.te +++ b/policy/modules/services/ulogd.te @@ -31,6 +31,9 @@ logging_log_file(ulogd_var_log_t) @@ -32407,7 +33257,7 @@ index eeaa641..eb4d8d5 100644 # config files read_files_pattern(ulogd_t, ulogd_etc_t, ulogd_etc_t) -@@ -43,6 +46,18 @@ mmap_files_pattern(ulogd_t, ulogd_modules_t, ulogd_modules_t) +@@ -43,6 +46,19 @@ mmap_files_pattern(ulogd_t, ulogd_modules_t, ulogd_modules_t) manage_files_pattern(ulogd_t, ulogd_var_log_t, ulogd_var_log_t) logging_log_filetrans(ulogd_t, ulogd_var_log_t, file) @@ -32420,13 +33270,27 @@ index eeaa641..eb4d8d5 100644 +sysnet_dns_name_resolve(ulogd_t) + +optional_policy(` -+ mysql_stream_connect(ulogd_t) ++ mysql_stream_connect(ulogd_t) ++ mysql_tcp_connect(ulogd_t) +') + +optional_policy(` -+ postgresql_stream_connect(ulogd_t) ++ postgresql_stream_connect(ulogd_t) + postgresql_tcp_connect(ulogd_t) +') +diff --git a/policy/modules/services/uptime.te b/policy/modules/services/uptime.te +index c2cf97e..037a1e8 100644 +--- a/policy/modules/services/uptime.te ++++ b/policy/modules/services/uptime.te +@@ -25,7 +25,7 @@ files_pid_file(uptimed_var_run_t) + + dontaudit uptimed_t self:capability sys_tty_config; + allow uptimed_t self:process signal_perms; +-allow uptimed_t self:fifo_file write_file_perms; ++allow uptimed_t self:fifo_file write_fifo_file_perms; + + allow uptimed_t uptimed_etc_t:file read_file_perms; + files_search_etc(uptimed_t) diff --git a/policy/modules/services/usbmuxd.fc b/policy/modules/services/usbmuxd.fc index fa54aee..40b8b8d 100644 --- a/policy/modules/services/usbmuxd.fc @@ -32492,10 +33356,18 @@ index a4fbe31..a717e2d 100644 logging_list_logs($1) diff --git a/policy/modules/services/uucp.te b/policy/modules/services/uucp.te -index b775aaf..ec1562b 100644 +index b775aaf..1e40c2a 100644 --- a/policy/modules/services/uucp.te +++ b/policy/modules/services/uucp.te -@@ -83,6 +83,7 @@ corenet_tcp_sendrecv_generic_node(uucpd_t) +@@ -7,7 +7,6 @@ policy_module(uucp, 1.11.0) + type uucpd_t; + type uucpd_exec_t; + inetd_tcp_service_domain(uucpd_t, uucpd_exec_t) +-role system_r types uucpd_t; + + type uucpd_lock_t; + files_lock_file(uucpd_lock_t) +@@ -83,6 +82,7 @@ corenet_tcp_sendrecv_generic_node(uucpd_t) corenet_udp_sendrecv_generic_node(uucpd_t) corenet_tcp_sendrecv_all_ports(uucpd_t) corenet_udp_sendrecv_all_ports(uucpd_t) @@ -32503,7 +33375,7 @@ index b775aaf..ec1562b 100644 dev_read_urand(uucpd_t) -@@ -113,6 +114,10 @@ optional_policy(` +@@ -113,13 +113,17 @@ optional_policy(` kerberos_use(uucpd_t) ') @@ -32514,6 +33386,14 @@ index b775aaf..ec1562b 100644 ######################################## # # UUX Local policy + # + + allow uux_t self:capability { setuid setgid }; +-allow uux_t self:fifo_file write_file_perms; ++allow uux_t self:fifo_file write_fifo_file_perms; + + uucp_append_log(uux_t) + uucp_manage_spool(uux_t) diff --git a/policy/modules/services/varnishd.if b/policy/modules/services/varnishd.if index b4d90ac..fe5ce10 100644 --- a/policy/modules/services/varnishd.if @@ -32611,9 +33491,24 @@ index b4d90ac..fe5ce10 100644 - ') diff --git a/policy/modules/services/varnishd.te b/policy/modules/services/varnishd.te -index 1cc80e8..95c6dc3 100644 +index 1cc80e8..c6bf70e 100644 --- a/policy/modules/services/varnishd.te +++ b/policy/modules/services/varnishd.te +@@ -6,10 +6,10 @@ policy_module(varnishd, 1.1.0) + # + + ## +-##

+-## Allow varnishd to connect to all ports, +-## not just HTTP. +-##

++##

++## Allow varnishd to connect to all ports, ++## not just HTTP. ++##

+ ## + gen_tunable(varnishd_connect_any, false) + @@ -50,7 +50,8 @@ files_type(varnishlog_log_t) # varnishd local policy # @@ -32624,6 +33519,24 @@ index 1cc80e8..95c6dc3 100644 allow varnishd_t self:process signal; allow varnishd_t self:fifo_file rw_fifo_file_perms; allow varnishd_t self:tcp_socket create_stream_socket_perms; +@@ -69,7 +70,7 @@ manage_files_pattern(varnishd_t, varnishd_var_lib_t, varnishd_var_lib_t) + files_var_lib_filetrans(varnishd_t, varnishd_var_lib_t, { dir file }) + + manage_files_pattern(varnishd_t, varnishd_var_run_t, varnishd_var_run_t) +-files_pid_filetrans(varnishd_t, varnishd_var_run_t, { file }) ++files_pid_filetrans(varnishd_t, varnishd_var_run_t, file) + + kernel_read_system_state(varnishd_t) + +@@ -107,7 +108,7 @@ tunable_policy(`varnishd_connect_any',` + # + + manage_files_pattern(varnishlog_t, varnishlog_var_run_t, varnishlog_var_run_t) +-files_pid_filetrans(varnishlog_t, varnishlog_var_run_t, { file }) ++files_pid_filetrans(varnishlog_t, varnishlog_var_run_t, file) + + manage_dirs_pattern(varnishlog_t, varnishlog_log_t, varnishlog_log_t) + manage_files_pattern(varnishlog_t, varnishlog_log_t, varnishlog_log_t) diff --git a/policy/modules/services/vhostmd.if b/policy/modules/services/vhostmd.if index 1f872b5..da605ba 100644 --- a/policy/modules/services/vhostmd.if @@ -32693,9 +33606,18 @@ index 1f872b5..da605ba 100644 - ') diff --git a/policy/modules/services/vhostmd.te b/policy/modules/services/vhostmd.te -index 32a3c13..f56f51f 100644 +index 32a3c13..7baeb6f 100644 --- a/policy/modules/services/vhostmd.te +++ b/policy/modules/services/vhostmd.te +@@ -25,7 +25,7 @@ files_pid_file(vhostmd_var_run_t) + + allow vhostmd_t self:capability { dac_override ipc_lock setuid setgid }; + allow vhostmd_t self:process { setsched getsched }; +-allow vhostmd_t self:fifo_file rw_file_perms; ++allow vhostmd_t self:fifo_file rw_fifo_file_perms; + + manage_dirs_pattern(vhostmd_t, vhostmd_tmpfs_t, vhostmd_tmpfs_t) + manage_files_pattern(vhostmd_t, vhostmd_tmpfs_t, vhostmd_tmpfs_t) @@ -44,6 +44,8 @@ corecmd_exec_shell(vhostmd_t) corenet_tcp_connect_soundd_port(vhostmd_t) @@ -33013,32 +33935,82 @@ index 7c5d8d8..dbdc0e0 100644 + dontaudit $1 virtd_t:fifo_file write_fifo_file_perms; +') diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te -index 3eca020..8dac607 100644 +index 3eca020..62e349a 100644 --- a/policy/modules/services/virt.te +++ b/policy/modules/services/virt.te -@@ -4,6 +4,7 @@ policy_module(virt, 1.4.0) - # +@@ -5,57 +5,66 @@ policy_module(virt, 1.4.0) # Declarations # + +attribute virsh_transition_domain; ++ + ## +-##

+-## Allow virt to use serial/parallell communication ports +-##

++##

++## Allow virt to use serial/parallell communication ports ++##

+ ## + gen_tunable(virt_use_comm, false) ## - ##

-@@ -42,6 +43,13 @@ gen_tunable(virt_use_sysfs, false) +-##

+-## Allow virt to read fuse files +-##

++##

++## Allow virt to read fuse files ++##

+ ## + gen_tunable(virt_use_fusefs, false) ## - ##

-+## Allow virtual machine to interact with the xserver -+##

+-##

+-## Allow virt to manage nfs files +-##

++##

++## Allow virt to manage nfs files ++##

+ ## + gen_tunable(virt_use_nfs, false) + + ## +-##

+-## Allow virt to manage cifs files +-##

++##

++## Allow virt to manage cifs files ++##

+ ## + gen_tunable(virt_use_samba, false) + + ## +-##

+-## Allow virt to manage device configuration, (pci) +-##

++##

++## Allow virt to manage device configuration, (pci) ++##

+ ## + gen_tunable(virt_use_sysfs, false) + + ## +-##

+-## Allow virt to use usb devices +-##

++##

++## Allow virtual machine to interact with the xserver ++##

+## +gen_tunable(virt_use_xserver, false) + +## -+##

- ## Allow virt to use usb devices - ##

++##

++## Allow virt to use usb devices ++##

## -@@ -50,12 +58,12 @@ gen_tunable(virt_use_usb, true) + gen_tunable(virt_use_usb, true) + virt_domain_template(svirt) role system_r types svirt_t; @@ -33054,7 +34026,7 @@ index 3eca020..8dac607 100644 type virt_etc_t; files_config_file(virt_etc_t) -@@ -65,20 +73,25 @@ files_type(virt_etc_rw_t) +@@ -65,20 +74,25 @@ files_type(virt_etc_rw_t) # virt Image files type virt_image_t; # customizable virt_image(virt_image_t) @@ -33081,7 +34053,7 @@ index 3eca020..8dac607 100644 type virtd_t; type virtd_exec_t; -@@ -89,6 +102,11 @@ domain_subj_id_change_exemption(virtd_t) +@@ -89,6 +103,11 @@ domain_subj_id_change_exemption(virtd_t) type virtd_initrc_exec_t; init_script_file(virtd_initrc_exec_t) @@ -33093,7 +34065,7 @@ index 3eca020..8dac607 100644 ifdef(`enable_mcs',` init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mcs_systemhigh) ') -@@ -104,15 +122,12 @@ ifdef(`enable_mls',` +@@ -104,15 +123,12 @@ ifdef(`enable_mls',` allow svirt_t self:udp_socket create_socket_perms; @@ -33110,7 +34082,7 @@ index 3eca020..8dac607 100644 fs_hugetlbfs_filetrans(svirt_t, svirt_image_t, file) list_dirs_pattern(svirt_t, virt_content_t, virt_content_t) -@@ -147,11 +162,15 @@ tunable_policy(`virt_use_fusefs',` +@@ -147,11 +163,15 @@ tunable_policy(`virt_use_fusefs',` tunable_policy(`virt_use_nfs',` fs_manage_nfs_dirs(svirt_t) fs_manage_nfs_files(svirt_t) @@ -33126,7 +34098,7 @@ index 3eca020..8dac607 100644 ') tunable_policy(`virt_use_sysfs',` -@@ -160,11 +179,22 @@ tunable_policy(`virt_use_sysfs',` +@@ -160,11 +180,22 @@ tunable_policy(`virt_use_sysfs',` tunable_policy(`virt_use_usb',` dev_rw_usbfs(svirt_t) @@ -33149,13 +34121,13 @@ index 3eca020..8dac607 100644 xen_rw_image_files(svirt_t) ') -@@ -174,22 +204,29 @@ optional_policy(` +@@ -174,22 +205,28 @@ optional_policy(` # allow virtd_t self:capability { chown dac_override fowner ipc_lock kill mknod net_admin net_raw setpcap setuid setgid sys_admin sys_nice sys_ptrace }; -allow virtd_t self:process { getcap getsched setcap sigkill signal signull execmem setexec setfscreate setsched }; +- +allow virtd_t self:process { getcap getsched setcap sigkill signal signull execmem setexec setfscreate setsockcreate setsched }; - allow virtd_t self:fifo_file rw_fifo_file_perms; allow virtd_t self:unix_stream_socket create_stream_socket_perms; allow virtd_t self:tcp_socket create_stream_socket_perms; @@ -33291,7 +34263,14 @@ index 3eca020..8dac607 100644 ') optional_policy(` -@@ -402,6 +479,19 @@ allow virt_domain self:unix_stream_socket create_stream_socket_perms; +@@ -396,12 +473,25 @@ optional_policy(` + + allow virt_domain self:capability { dac_read_search dac_override kill }; + allow virt_domain self:process { execmem execstack signal getsched signull }; +-allow virt_domain self:fifo_file rw_file_perms; ++allow virt_domain self:fifo_file rw_fifo_file_perms; + allow virt_domain self:shm create_shm_perms; + allow virt_domain self:unix_stream_socket create_stream_socket_perms; allow virt_domain self:unix_dgram_socket { create_socket_perms sendto }; allow virt_domain self:tcp_socket create_stream_socket_perms; @@ -33344,7 +34323,7 @@ index 3eca020..8dac607 100644 term_use_all_terms(virt_domain) term_getattr_pty_fs(virt_domain) -@@ -457,8 +555,121 @@ optional_policy(` +@@ -457,8 +555,117 @@ optional_policy(` ') optional_policy(` @@ -33364,15 +34343,12 @@ index 3eca020..8dac607 100644 +# +type virsh_t; +type virsh_exec_t; -+domain_type(virsh_t) +init_system_domain(virsh_t, virsh_exec_t) +typealias virsh_t alias xm_t; +typealias virsh_exec_t alias xm_exec_t; + +allow virsh_t self:capability { dac_override ipc_lock sys_tty_config }; +allow virsh_t self:process { getcap getsched setcap signal }; -+ -+# internal communication is often done using fifo and unix sockets. +allow virsh_t self:fifo_file rw_fifo_file_perms; +allow virsh_t self:unix_stream_socket { create_stream_socket_perms connectto }; +allow virsh_t self:tcp_socket create_stream_socket_perms; @@ -33440,7 +34416,7 @@ index 3eca020..8dac607 100644 + +optional_policy(` + vhostmd_rw_tmpfs_files(virsh_t) -+ vhostmd_stream_connect(virsh_t) ++ vhostmd_stream_connect(virsh_t) + vhostmd_dontaudit_rw_stream_connect(virsh_t) +') + @@ -33465,7 +34441,6 @@ index 3eca020..8dac607 100644 + + userdom_search_admin_dir(virsh_ssh_t) +') -+ diff --git a/policy/modules/services/vnstatd.fc b/policy/modules/services/vnstatd.fc new file mode 100644 index 0000000..7667c31 @@ -33480,7 +34455,7 @@ index 0000000..7667c31 +/var/lib/vnstat(/.*)? gen_context(system_u:object_r:vnstatd_var_lib_t,s0) diff --git a/policy/modules/services/vnstatd.if b/policy/modules/services/vnstatd.if new file mode 100644 -index 0000000..14f8906 +index 0000000..b9104b7 --- /dev/null +++ b/policy/modules/services/vnstatd.if @@ -0,0 +1,144 @@ @@ -33492,7 +34467,7 @@ index 0000000..14f8906 +## +## +## -+## Domain allowed access. ++## Domain allowed to transition. +## +## +# @@ -33510,7 +34485,7 @@ index 0000000..14f8906 +## +## +## -+## Domain allowed access. ++## Domain allowed to transition. +## +## +# @@ -33630,11 +34605,11 @@ index 0000000..14f8906 +') diff --git a/policy/modules/services/vnstatd.te b/policy/modules/services/vnstatd.te new file mode 100644 -index 0000000..db526e6 +index 0000000..8ec07ff --- /dev/null +++ b/policy/modules/services/vnstatd.te -@@ -0,0 +1,69 @@ -+policy_module(vnstatd,1.0.0) +@@ -0,0 +1,65 @@ ++policy_module(vnstatd, 1.0.0) + +######################################## +# @@ -33660,13 +34635,12 @@ index 0000000..db526e6 +# vnstatd local policy +# +allow vnstatd_t self:process { fork signal }; -+ +allow vnstatd_t self:fifo_file rw_fifo_file_perms; +allow vnstatd_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(vnstatd_t, vnstatd_var_lib_t, vnstatd_var_lib_t) +manage_files_pattern(vnstatd_t, vnstatd_var_lib_t, vnstatd_var_lib_t) -+files_var_lib_filetrans(vnstatd_t, vnstatd_var_lib_t, { dir file } ) ++files_var_lib_filetrans(vnstatd_t, vnstatd_var_lib_t, { dir file }) + +domain_use_interactive_fds(vnstatd_t) + @@ -33680,14 +34654,13 @@ index 0000000..db526e6 +# +# vnstat local policy +# -+allow vnstat_t self:process { signal }; -+ ++allow vnstat_t self:process signal; +allow vnstat_t self:fifo_file rw_fifo_file_perms; +allow vnstat_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(vnstat_t, vnstatd_var_lib_t, vnstatd_var_lib_t) +manage_files_pattern(vnstat_t, vnstatd_var_lib_t, vnstatd_var_lib_t) -+files_var_lib_filetrans(vnstat_t, vnstatd_var_lib_t, { dir file } ) ++files_var_lib_filetrans(vnstat_t, vnstatd_var_lib_t, { dir file }) + +kernel_read_network_state(vnstat_t) +kernel_read_system_state(vnstat_t) @@ -33701,8 +34674,6 @@ index 0000000..db526e6 +logging_send_syslog_msg(vnstat_t) + +miscfiles_read_localization(vnstat_t) -+ -+ diff --git a/policy/modules/services/w3c.te b/policy/modules/services/w3c.te index 1174ad8..f4c4c1b 100644 --- a/policy/modules/services/w3c.te @@ -34762,52 +35733,80 @@ index da2601a..ef2a773 100644 + manage_files_pattern($1, user_fonts_config_t, user_fonts_config_t) +') diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te -index e226da4..29d5384 100644 +index e226da4..c80794b 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te -@@ -35,6 +35,13 @@ gen_tunable(allow_write_xshm, false) +@@ -26,27 +26,43 @@ gen_require(` + # ## - ##

-+## Allows XServer to execute writable memory -+##

+-##

+-## Allows clients to write to the X server shared +-## memory segments. +-##

++##

++## Allows clients to write to the X server shared ++## memory segments. ++##

+ ## + gen_tunable(allow_write_xshm, false) + + ## +-##

+-## Allow xdm logins as sysadm +-##

++##

++## Allows XServer to execute writable memory ++##

+## +gen_tunable(allow_xserver_execmem, false) + +## -+##

- ## Allow xdm logins as sysadm - ##

++##

++## Allow xdm logins as sysadm ++##

## -@@ -47,6 +54,16 @@ gen_tunable(xdm_sysadm_login, false) + gen_tunable(xdm_sysadm_login, false) + + ## +-##

+-## Support X userspace object manager +-##

++##

++## Support X userspace object manager ++##

## gen_tunable(xserver_object_manager, false) +## -+##

-+## Allow regular users direct dri device access -+##

++##

++## Allow regular users direct dri device access ++##

+## +gen_tunable(user_direct_dri, false) + +attribute xdmhomewriter; +attribute x_userdomain; -+ attribute x_domain; # X Events -@@ -109,21 +126,26 @@ xserver_common_x_domain_template(remote,remote_t) +@@ -104,26 +120,30 @@ typealias user_input_xevent_t alias { auditadm_input_xevent_t secadm_input_xeven + + type remote_t; + xserver_object_types_template(remote) +-xserver_common_x_domain_template(remote,remote_t) ++xserver_common_x_domain_template(remote, remote_t) + type user_fonts_t; typealias user_fonts_t alias { staff_fonts_t sysadm_fonts_t }; typealias user_fonts_t alias { auditadm_fonts_t secadm_fonts_t }; -+typealias user_fonts_t alias { xguest_fonts_t unconfined_fonts_t user_fonts_home_t }; ++typealias user_fonts_t alias { xguest_fonts_t unconfined_fonts_t user_fonts_home_t }; userdom_user_home_content(user_fonts_t) type user_fonts_cache_t; typealias user_fonts_cache_t alias { staff_fonts_cache_t sysadm_fonts_cache_t }; typealias user_fonts_cache_t alias { auditadm_fonts_cache_t secadm_fonts_cache_t }; +typealias user_fonts_cache_t alias { xguest_fonts_cache_t unconfined_fonts_cache_t }; -+; userdom_user_home_content(user_fonts_cache_t) type user_fonts_config_t; @@ -34823,12 +35822,11 @@ index e226da4..29d5384 100644 typealias iceauth_t alias { auditadm_iceauth_t secadm_iceauth_t }; application_domain(iceauth_t, iceauth_exec_t) ubac_constrained(iceauth_t) -@@ -131,22 +153,28 @@ ubac_constrained(iceauth_t) +@@ -131,22 +151,26 @@ ubac_constrained(iceauth_t) type iceauth_home_t; typealias iceauth_home_t alias { user_iceauth_home_t staff_iceauth_home_t sysadm_iceauth_home_t }; typealias iceauth_home_t alias { auditadm_iceauth_home_t secadm_iceauth_home_t }; -+typealias iceauth_home_t alias { xguest_iceauth_home_t }; -+files_poly_member(iceauth_home_t) ++typealias iceauth_home_t alias { xguest_iceauth_home_t }; userdom_user_home_content(iceauth_home_t) type xauth_t; @@ -34843,7 +35841,6 @@ index e226da4..29d5384 100644 typealias xauth_home_t alias { user_xauth_home_t staff_xauth_home_t sysadm_xauth_home_t }; typealias xauth_home_t alias { auditadm_xauth_home_t secadm_xauth_home_t }; +typealias xauth_home_t alias { xguest_xauth_home_t unconfined_xauth_home_t }; -+files_poly_member(xauth_home_t) userdom_user_home_content(xauth_home_t) type xauth_tmp_t; @@ -34852,7 +35849,7 @@ index e226da4..29d5384 100644 typealias xauth_tmp_t alias { auditadm_xauth_tmp_t secadm_xauth_tmp_t }; files_tmp_file(xauth_tmp_t) ubac_constrained(xauth_tmp_t) -@@ -161,15 +189,21 @@ type xdm_t; +@@ -161,15 +185,21 @@ type xdm_t; type xdm_exec_t; auth_login_pgm_domain(xdm_t) init_domain(xdm_t, xdm_exec_t) @@ -34876,7 +35873,7 @@ index e226da4..29d5384 100644 type xdm_var_lib_t; files_type(xdm_var_lib_t) -@@ -177,13 +211,27 @@ files_type(xdm_var_lib_t) +@@ -177,13 +207,27 @@ files_type(xdm_var_lib_t) type xdm_var_run_t; files_pid_file(xdm_var_run_t) @@ -34905,7 +35902,7 @@ index e226da4..29d5384 100644 # type for /var/lib/xkb type xkb_var_lib_t; files_type(xkb_var_lib_t) -@@ -196,15 +244,9 @@ typealias xserver_t alias { auditadm_xserver_t secadm_xserver_t xdm_xserver_t }; +@@ -196,15 +240,9 @@ typealias xserver_t alias { auditadm_xserver_t secadm_xserver_t xdm_xserver_t }; init_system_domain(xserver_t, xserver_exec_t) ubac_constrained(xserver_t) @@ -34923,7 +35920,7 @@ index e226da4..29d5384 100644 files_tmpfs_file(xserver_tmpfs_t) ubac_constrained(xserver_tmpfs_t) -@@ -234,9 +276,13 @@ userdom_user_home_dir_filetrans(iceauth_t, iceauth_home_t, file) +@@ -234,9 +272,13 @@ userdom_user_home_dir_filetrans(iceauth_t, iceauth_home_t, file) allow xdm_t iceauth_home_t:file read_file_perms; @@ -34937,17 +35934,17 @@ index e226da4..29d5384 100644 tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files(iceauth_t) -@@ -246,50 +292,105 @@ tunable_policy(`use_samba_home_dirs',` +@@ -246,50 +288,105 @@ tunable_policy(`use_samba_home_dirs',` fs_manage_cifs_files(iceauth_t) ') -+ifdef(`hide_broken_symptoms', ` ++ifdef(`hide_broken_symptoms',` + dev_dontaudit_read_urand(iceauth_t) + dev_dontaudit_rw_dri(iceauth_t) + dev_dontaudit_rw_generic_dev_nodes(iceauth_t) + fs_dontaudit_list_inotifyfs(iceauth_t) + fs_dontaudit_rw_anon_inodefs_files(iceauth_t) -+ term_dontaudit_use_unallocated_ttys(iceauth_t) ++ term_dontaudit_use_unallocated_ttys(iceauth_t) + + userdom_dontaudit_read_user_home_content_files(iceauth_t) + userdom_dontaudit_write_user_home_content_files(iceauth_t) @@ -35015,18 +36012,18 @@ index e226da4..29d5384 100644 userdom_use_user_terminals(xauth_t) userdom_read_user_tmp_files(xauth_t) +userdom_read_all_users_state(xauth_t) -+ -+ifdef(`hide_broken_symptoms', ` -+ fs_dontaudit_rw_anon_inodefs_files(xauth_t) -+ fs_dontaudit_list_inotifyfs(xauth_t) -+ userdom_manage_user_home_content_files(xauth_t) -+ userdom_manage_user_tmp_files(xauth_t) -+ dev_dontaudit_rw_generic_dev_nodes(xauth_t) -+ miscfiles_read_fonts(xauth_t) -+') xserver_rw_xdm_tmp_files(xauth_t) ++ifdef(`hide_broken_symptoms',` ++ fs_dontaudit_rw_anon_inodefs_files(xauth_t) ++ fs_dontaudit_list_inotifyfs(xauth_t) ++ userdom_manage_user_home_content_files(xauth_t) ++ userdom_manage_user_tmp_files(xauth_t) ++ dev_dontaudit_rw_generic_dev_nodes(xauth_t) ++ miscfiles_read_fonts(xauth_t) ++') ++ tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files(xauth_t) + fs_read_nfs_symlinks(xauth_t) @@ -35036,8 +36033,8 @@ index e226da4..29d5384 100644 fs_manage_cifs_files(xauth_t) ') -+ifdef(`hide_broken_symptoms', ` -+ term_dontaudit_use_unallocated_ttys(xauth_t) ++ifdef(`hide_broken_symptoms',` ++ term_dontaudit_use_unallocated_ttys(xauth_t) + dev_dontaudit_rw_dri(xauth_t) +') + @@ -35048,15 +36045,14 @@ index e226da4..29d5384 100644 optional_policy(` ssh_sigchld(xauth_t) ssh_read_pipes(xauth_t) -@@ -301,20 +402,33 @@ optional_policy(` +@@ -301,20 +398,32 @@ optional_policy(` # XDM Local policy # -allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service }; -allow xdm_t self:process { setexec setpgid getsched setsched setrlimit signal_perms setkeycreate }; +allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service sys_ptrace }; -+allow xdm_t self:process { setexec setpgid getsched setsched setrlimit signal_perms setkeycreate ptrace }; -+allow xdm_t self:process { getattr getcap setcap }; ++allow xdm_t self:process { setexec setpgid getattr getcap setcap getsched setsched setrlimit signal_perms setkeycreate ptrace }; allow xdm_t self:fifo_file rw_fifo_file_perms; allow xdm_t self:shm create_shm_perms; allow xdm_t self:sem create_sem_perms; @@ -35070,9 +36066,10 @@ index e226da4..29d5384 100644 allow xdm_t self:appletalk_socket create_socket_perms; allow xdm_t self:key { search link write }; +-allow xdm_t xconsole_device_t:fifo_file { getattr setattr }; +allow xdm_t xauth_home_t:file manage_file_perms; + - allow xdm_t xconsole_device_t:fifo_file { getattr setattr }; ++allow xdm_t xconsole_device_t:fifo_file { getattr_fifo_file_perms setattr_fifo_file_perms }; +manage_dirs_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t) +manage_files_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t) + @@ -35085,7 +36082,7 @@ index e226da4..29d5384 100644 # Allow gdm to run gdm-binary can_exec(xdm_t, xdm_exec_t) -@@ -322,32 +436,55 @@ can_exec(xdm_t, xdm_exec_t) +@@ -322,43 +431,69 @@ can_exec(xdm_t, xdm_exec_t) allow xdm_t xdm_lock_t:file manage_file_perms; files_lock_filetrans(xdm_t, xdm_lock_t, file) @@ -35110,7 +36107,8 @@ index e226da4..29d5384 100644 manage_fifo_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t) manage_sock_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t) -fs_tmpfs_filetrans(xdm_t, xdm_tmpfs_t,{ dir file lnk_file sock_file fifo_file }) -+ + +-manage_dirs_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t) +fs_getattr_all_fs(xdm_t) +fs_list_inotifyfs(xdm_t) +fs_read_noxattr_fs_files(xdm_t) @@ -35124,8 +36122,8 @@ index e226da4..29d5384 100644 +manage_dirs_pattern(xdm_t, xdm_spool_t, xdm_spool_t) +manage_files_pattern(xdm_t, xdm_spool_t, xdm_spool_t) +files_spool_filetrans(xdm_t, xdm_spool_t, { file dir }) - - manage_dirs_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t) ++ ++manage_dirs_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t) manage_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t) -files_var_lib_filetrans(xdm_t, xdm_var_lib_t, file) +manage_lnk_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t) @@ -35146,7 +36144,8 @@ index e226da4..29d5384 100644 allow xdm_t xserver_t:unix_stream_socket connectto; allow xdm_t xserver_tmp_t:sock_file rw_sock_file_perms; -@@ -355,10 +492,13 @@ allow xdm_t xserver_tmp_t:dir { setattr list_dir_perms }; +-allow xdm_t xserver_tmp_t:dir { setattr list_dir_perms }; ++allow xdm_t xserver_tmp_t:dir { setattr_dir_perms list_dir_perms }; # transition to the xdm xserver domtrans_pattern(xdm_t, xserver_exec_t, xserver_t) @@ -35160,7 +36159,7 @@ index e226da4..29d5384 100644 # connect to xdm xserver over stream socket stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) -@@ -367,15 +507,22 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) +@@ -367,15 +502,22 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) @@ -35184,7 +36183,7 @@ index e226da4..29d5384 100644 corecmd_exec_shell(xdm_t) corecmd_exec_bin(xdm_t) -@@ -390,18 +537,22 @@ corenet_tcp_sendrecv_all_ports(xdm_t) +@@ -390,18 +532,22 @@ corenet_tcp_sendrecv_all_ports(xdm_t) corenet_udp_sendrecv_all_ports(xdm_t) corenet_tcp_bind_generic_node(xdm_t) corenet_udp_bind_generic_node(xdm_t) @@ -35208,7 +36207,7 @@ index e226da4..29d5384 100644 dev_setattr_apm_bios_dev(xdm_t) dev_rw_dri(xdm_t) dev_rw_agp(xdm_t) -@@ -410,18 +561,23 @@ dev_setattr_xserver_misc_dev(xdm_t) +@@ -410,18 +556,23 @@ dev_setattr_xserver_misc_dev(xdm_t) dev_getattr_misc_dev(xdm_t) dev_setattr_misc_dev(xdm_t) dev_dontaudit_rw_misc(xdm_t) @@ -35235,7 +36234,7 @@ index e226da4..29d5384 100644 files_read_etc_files(xdm_t) files_read_var_files(xdm_t) -@@ -432,9 +588,17 @@ files_list_mnt(xdm_t) +@@ -432,9 +583,17 @@ files_list_mnt(xdm_t) files_read_usr_files(xdm_t) # Poweroff wants to create the /poweroff file when run from xdm files_create_boot_flag(xdm_t) @@ -35253,7 +36252,7 @@ index e226da4..29d5384 100644 storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t) -@@ -443,28 +607,36 @@ storage_dontaudit_raw_read_removable_device(xdm_t) +@@ -443,28 +602,36 @@ storage_dontaudit_raw_read_removable_device(xdm_t) storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t) @@ -35292,7 +36291,7 @@ index e226da4..29d5384 100644 userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_create_all_users_keys(xdm_t) -@@ -473,6 +645,13 @@ userdom_read_user_home_content_files(xdm_t) +@@ -473,10 +640,25 @@ userdom_read_user_home_content_files(xdm_t) # Search /proc for any user domain processes. userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) @@ -35306,7 +36305,19 @@ index e226da4..29d5384 100644 xserver_rw_session(xdm_t, xdm_tmpfs_t) xserver_unconfined(xdm_t) -@@ -504,11 +683,17 @@ tunable_policy(`xdm_sysadm_login',` + ++ifndef(`distro_redhat',` ++ allow xdm_t self:process { execheap execmem }; ++') ++ ++ifdef(`distro_rhel4',` ++ allow xdm_t self:process { execheap execmem }; ++') ++ + tunable_policy(`use_nfs_home_dirs',` + fs_manage_nfs_dirs(xdm_t) + fs_manage_nfs_files(xdm_t) +@@ -504,11 +686,17 @@ tunable_policy(`xdm_sysadm_login',` ') optional_policy(` @@ -35324,7 +36335,7 @@ index e226da4..29d5384 100644 ') optional_policy(` -@@ -516,12 +701,51 @@ optional_policy(` +@@ -516,12 +704,49 @@ optional_policy(` ') optional_policy(` @@ -35355,10 +36366,8 @@ index e226da4..29d5384 100644 + optional_policy(` + networkmanager_dbus_chat(xdm_t) + ') -+ +') + -+ +optional_policy(` # Talk to the console mouse server. gpm_stream_connect(xdm_t) @@ -35376,11 +36385,11 @@ index e226da4..29d5384 100644 hostname_exec(xdm_t) ') -@@ -539,20 +763,64 @@ optional_policy(` +@@ -539,28 +764,63 @@ optional_policy(` ') optional_policy(` -+ policykit_dbus_chat(xdm_t) ++ policykit_dbus_chat(xdm_t) + policykit_domtrans_auth(xdm_t) + policykit_read_lib(xdm_t) + policykit_read_reload(xdm_t) @@ -35423,35 +36432,33 @@ index e226da4..29d5384 100644 ') optional_policy(` +- udev_read_db(xdm_t) + ssh_signull(xdm_t) -+') -+ -+optional_policy(` -+ shutdown_domtrans(xdm_t) -+') -+ -+optional_policy(` - udev_read_db(xdm_t) ') optional_policy(` - unconfined_domain(xdm_t) - unconfined_domtrans(xdm_t) -+ unconfined_shell_domtrans(xdm_t) -+ unconfined_signal(xdm_t) ++ shutdown_domtrans(xdm_t) +') - ifndef(`distro_redhat',` - allow xdm_t self:process { execheap execmem }; -@@ -561,7 +829,6 @@ optional_policy(` - ifdef(`distro_rhel4',` - allow xdm_t self:process { execheap execmem }; - ') --') +- ifndef(`distro_redhat',` +- allow xdm_t self:process { execheap execmem }; +- ') ++optional_policy(` ++ udev_read_db(xdm_t) ++') + +- ifdef(`distro_rhel4',` +- allow xdm_t self:process { execheap execmem }; +- ') ++optional_policy(` ++ unconfined_shell_domtrans(xdm_t) ++ unconfined_signal(xdm_t) + ') optional_policy(` - userhelper_dontaudit_search_config(xdm_t) -@@ -572,6 +839,10 @@ optional_policy(` +@@ -572,6 +832,10 @@ optional_policy(` ') optional_policy(` @@ -35462,7 +36469,7 @@ index e226da4..29d5384 100644 xfs_stream_connect(xdm_t) ') -@@ -596,7 +867,7 @@ allow xserver_t input_xevent_t:x_event send; +@@ -596,7 +860,7 @@ allow xserver_t input_xevent_t:x_event send; # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack @@ -35471,17 +36478,13 @@ index e226da4..29d5384 100644 dontaudit xserver_t self:capability chown; allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow xserver_t self:fd use; -@@ -610,6 +881,18 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; +@@ -610,6 +874,14 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:udp_socket create_socket_perms; +allow xserver_t self:netlink_selinux_socket create_socket_perms; +allow xserver_t self:netlink_kobject_uevent_socket create_socket_perms; + -+# Device rules -+allow x_domain xserver_t:x_device { read getattr use setattr setfocus grab bell }; -+allow x_domain xserver_t:x_screen getattr; -+ +allow xserver_t { input_xevent_t input_xevent_type }:x_event send; + +domtrans_pattern(xserver_t, xauth_exec_t, xauth_t) @@ -35490,17 +36493,17 @@ index e226da4..29d5384 100644 manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) -@@ -629,12 +912,19 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) +@@ -629,12 +901,19 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) files_search_var_lib(xserver_t) -domtrans_pattern(xserver_t, xauth_exec_t, xauth_t) -allow xserver_t xauth_home_t:file read_file_perms; -+manage_dirs_pattern(xserver_t, xserver_var_lib_t, xserver_var_lib_t) ++manage_dirs_pattern(xserver_t, xserver_var_lib_t, xserver_var_lib_t) +manage_files_pattern(xserver_t, xserver_var_lib_t, xserver_var_lib_t) +files_var_lib_filetrans(xserver_t, xserver_var_lib_t, dir) + -+manage_dirs_pattern(xserver_t, xserver_var_run_t, xserver_var_run_t) ++manage_dirs_pattern(xserver_t, xserver_var_run_t, xserver_var_run_t) +manage_files_pattern(xserver_t, xserver_var_run_t, xserver_var_run_t) +manage_sock_files_pattern(xserver_t, xdm_var_run_t, xdm_var_run_t) +files_pid_filetrans(xserver_t, xserver_var_run_t, { file dir }) @@ -35512,7 +36515,7 @@ index e226da4..29d5384 100644 kernel_read_system_state(xserver_t) kernel_read_device_sysctls(xserver_t) -@@ -642,6 +932,7 @@ kernel_read_modprobe_sysctls(xserver_t) +@@ -642,6 +921,7 @@ kernel_read_modprobe_sysctls(xserver_t) # Xorg wants to check if kernel is tainted kernel_read_kernel_sysctls(xserver_t) kernel_write_proc_files(xserver_t) @@ -35520,7 +36523,7 @@ index e226da4..29d5384 100644 # Run helper programs in xserver_t. corecmd_exec_bin(xserver_t) -@@ -668,7 +959,6 @@ dev_rw_apm_bios(xserver_t) +@@ -668,7 +948,6 @@ dev_rw_apm_bios(xserver_t) dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) @@ -35528,7 +36531,7 @@ index e226da4..29d5384 100644 dev_create_generic_dirs(xserver_t) dev_setattr_generic_dirs(xserver_t) # raw memory access is needed if not using the frame buffer -@@ -678,8 +968,13 @@ dev_wx_raw_memory(xserver_t) +@@ -678,8 +957,13 @@ dev_wx_raw_memory(xserver_t) dev_rw_xserver_misc(xserver_t) # read events - the synaptics touchpad driver reads raw events dev_rw_input_dev(xserver_t) @@ -35542,7 +36545,7 @@ index e226da4..29d5384 100644 files_read_etc_files(xserver_t) files_read_etc_runtime_files(xserver_t) files_read_usr_files(xserver_t) -@@ -693,8 +988,13 @@ fs_getattr_xattr_fs(xserver_t) +@@ -693,8 +977,13 @@ fs_getattr_xattr_fs(xserver_t) fs_search_nfs(xserver_t) fs_search_auto_mountpoints(xserver_t) fs_search_ramfs(xserver_t) @@ -35556,7 +36559,7 @@ index e226da4..29d5384 100644 selinux_validate_context(xserver_t) selinux_compute_access_vector(xserver_t) -@@ -716,11 +1016,14 @@ logging_send_audit_msgs(xserver_t) +@@ -716,11 +1005,14 @@ logging_send_audit_msgs(xserver_t) miscfiles_read_localization(xserver_t) miscfiles_read_fonts(xserver_t) @@ -35571,7 +36574,7 @@ index e226da4..29d5384 100644 userdom_search_user_home_dirs(xserver_t) userdom_use_user_ttys(xserver_t) -@@ -773,12 +1076,28 @@ optional_policy(` +@@ -773,12 +1065,28 @@ optional_policy(` ') optional_policy(` @@ -35601,7 +36604,7 @@ index e226da4..29d5384 100644 unconfined_domtrans(xserver_t) ') -@@ -787,6 +1106,10 @@ optional_policy(` +@@ -787,6 +1095,10 @@ optional_policy(` ') optional_policy(` @@ -35612,34 +36615,40 @@ index e226da4..29d5384 100644 xfs_stream_connect(xserver_t) ') -@@ -802,10 +1125,10 @@ allow xserver_t xdm_t:shm rw_shm_perms; +@@ -802,10 +1114,10 @@ allow xserver_t xdm_t:shm rw_shm_perms; # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open # handle of a file inside the dir!!! -allow xserver_t xdm_var_lib_t:file { getattr read }; +-dontaudit xserver_t xdm_var_lib_t:dir search; +allow xserver_t xdm_var_lib_t:file read_file_perms; - dontaudit xserver_t xdm_var_lib_t:dir search; ++dontaudit xserver_t xdm_var_lib_t:dir search_dir_perms; -allow xserver_t xdm_var_run_t:file read_file_perms; +read_files_pattern(xserver_t, xdm_var_run_t, xdm_var_run_t) # Label pid and temporary files with derived types. manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) -@@ -826,6 +1149,13 @@ init_use_fds(xserver_t) +@@ -813,7 +1125,7 @@ manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) + manage_sock_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) + + # Run xkbcomp. +-allow xserver_t xkb_var_lib_t:lnk_file read; ++allow xserver_t xkb_var_lib_t:lnk_file read_lnk_file_perms; + can_exec(xserver_t, xkb_var_lib_t) + + # VNC v4 module in X server +@@ -826,6 +1138,9 @@ init_use_fds(xserver_t) # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_user_home_content_files(xserver_t) +userdom_read_all_users_state(xserver_t) + +xserver_use_user_fonts(xserver_t) -+ -+optional_policy(` -+ userhelper_search_config(xserver_t) -+') tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(xserver_t) -@@ -841,11 +1171,14 @@ tunable_policy(`use_samba_home_dirs',` +@@ -841,11 +1156,14 @@ tunable_policy(`use_samba_home_dirs',` optional_policy(` dbus_system_bus_client(xserver_t) @@ -35656,20 +36665,77 @@ index e226da4..29d5384 100644 ') optional_policy(` -@@ -991,3 +1324,33 @@ allow xserver_unconfined_type { x_domain xserver_t }:x_keyboard *; - allow xserver_unconfined_type xextension_type:x_extension *; - allow xserver_unconfined_type { x_domain xserver_t }:x_resource *; - allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *; -+ +@@ -853,6 +1171,10 @@ optional_policy(` + rhgb_rw_tmpfs_files(xserver_t) + ') + +optional_policy(` -+ unconfined_rw_shm(xserver_t) -+ unconfined_execmem_rw_shm(xserver_t) -+ -+ # xserver signals unconfined user on startx -+ unconfined_signal(xserver_t) -+ unconfined_getpgid(xserver_t) ++ userhelper_search_config(xserver_t) +') + + ######################################## + # + # Rules common to all X window domains +@@ -896,7 +1218,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy + allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show }; + # operations allowed on my windows + allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; +-allow x_domain self:x_drawable { blend }; ++allow x_domain self:x_drawable blend; + # operations allowed on all windows + allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child }; + +@@ -950,11 +1272,31 @@ allow x_domain self:x_resource { read write }; + # can mess with the screensaver + allow x_domain xserver_t:x_screen { getattr saver_getattr }; + ++# Device rules ++allow x_domain xserver_t:x_device { read getattr use setattr setfocus grab bell }; ++allow x_domain xserver_t:x_screen getattr; ++ + ######################################## + # + # Rules for unconfined access to this module + # + ++allow xserver_unconfined_type xserver_t:x_server *; ++allow xserver_unconfined_type xdrawable_type:x_drawable *; ++allow xserver_unconfined_type xserver_t:x_screen *; ++allow xserver_unconfined_type x_domain:x_gc *; ++allow xserver_unconfined_type xcolormap_type:x_colormap *; ++allow xserver_unconfined_type xproperty_type:x_property *; ++allow xserver_unconfined_type xselection_type:x_selection *; ++allow xserver_unconfined_type x_domain:x_cursor *; ++allow xserver_unconfined_type x_domain:x_client *; ++allow xserver_unconfined_type { x_domain xserver_t }:x_device *; ++allow xserver_unconfined_type { x_domain xserver_t }:x_pointer *; ++allow xserver_unconfined_type { x_domain xserver_t }:x_keyboard *; ++allow xserver_unconfined_type xextension_type:x_extension *; ++allow xserver_unconfined_type { x_domain xserver_t }:x_resource *; ++allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *; ++ + tunable_policy(`! xserver_object_manager',` + # should be xserver_unconfined(x_domain), + # but typeattribute doesnt work in conditionals +@@ -976,18 +1318,32 @@ tunable_policy(`! xserver_object_manager',` + allow x_domain xevent_type:{ x_event x_synthetic_event } *; + ') + +-allow xserver_unconfined_type xserver_t:x_server *; +-allow xserver_unconfined_type xdrawable_type:x_drawable *; +-allow xserver_unconfined_type xserver_t:x_screen *; +-allow xserver_unconfined_type x_domain:x_gc *; +-allow xserver_unconfined_type xcolormap_type:x_colormap *; +-allow xserver_unconfined_type xproperty_type:x_property *; +-allow xserver_unconfined_type xselection_type:x_selection *; +-allow xserver_unconfined_type x_domain:x_cursor *; +-allow xserver_unconfined_type x_domain:x_client *; +-allow xserver_unconfined_type { x_domain xserver_t }:x_device *; +-allow xserver_unconfined_type { x_domain xserver_t }:x_pointer *; +-allow xserver_unconfined_type { x_domain xserver_t }:x_keyboard *; +-allow xserver_unconfined_type xextension_type:x_extension *; +-allow xserver_unconfined_type { x_domain xserver_t }:x_resource *; +-allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *; +tunable_policy(`allow_xserver_execmem',` + allow xserver_t self:process { execheap execmem execstack }; +') @@ -35690,6 +36756,15 @@ index e226da4..29d5384 100644 +tunable_policy(`use_samba_home_dirs',` + fs_append_cifs_files(xdmhomewriter) +') ++ ++optional_policy(` ++ unconfined_rw_shm(xserver_t) ++ unconfined_execmem_rw_shm(xserver_t) ++ ++ # xserver signals unconfined user on startx ++ unconfined_signal(xserver_t) ++ unconfined_getpgid(xserver_t) ++') diff --git a/policy/modules/services/zabbix.if b/policy/modules/services/zabbix.if index d77e631..4776863 100644 --- a/policy/modules/services/zabbix.if @@ -35718,6 +36793,24 @@ index d77e631..4776863 100644 ## # interface(`zabbix_append_log',` +diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te +index b8dd21a..20d7cde 100644 +--- a/policy/modules/services/zabbix.te ++++ b/policy/modules/services/zabbix.te +@@ -26,11 +26,11 @@ files_pid_file(zabbix_var_run_t) + # + + allow zabbix_t self:capability { setuid setgid }; +-allow zabbix_t self:fifo_file rw_file_perms; ++allow zabbix_t self:fifo_file rw_fifo_file_perms; + allow zabbix_t self:unix_stream_socket create_stream_socket_perms; + + # log files +-allow zabbix_t zabbix_log_t:dir setattr; ++allow zabbix_t zabbix_log_t:dir setattr_dir_perms; + manage_files_pattern(zabbix_t, zabbix_log_t, zabbix_log_t) + logging_log_filetrans(zabbix_t, zabbix_log_t, file) + diff --git a/policy/modules/services/zarafa.fc b/policy/modules/services/zarafa.fc new file mode 100644 index 0000000..56cb5af @@ -35861,10 +36954,10 @@ index 0000000..4f2dde8 +') diff --git a/policy/modules/services/zarafa.te b/policy/modules/services/zarafa.te new file mode 100644 -index 0000000..3509088 +index 0000000..3ce4d86 --- /dev/null +++ b/policy/modules/services/zarafa.te -@@ -0,0 +1,133 @@ +@@ -0,0 +1,132 @@ +policy_module(zarafa, 1.0.0) + +######################################## @@ -35914,7 +37007,7 @@ index 0000000..3509088 +# zarafa_server local policy +# + -+allow zarafa_server_t self:capability { chown kill net_bind_service}; ++allow zarafa_server_t self:capability { chown kill net_bind_service }; +allow zarafa_server_t self:process { setrlimit signal }; + +corenet_tcp_bind_zarafa_port(zarafa_server_t) @@ -35940,7 +37033,7 @@ index 0000000..3509088 +# + +allow zarafa_spooler_t self:capability { chown kill }; -+allow zarafa_spooler_t self:process { signal }; ++allow zarafa_spooler_t self:process signal; + +corenet_tcp_connect_smtp_port(zarafa_spooler_t) + @@ -35977,7 +37070,6 @@ index 0000000..3509088 + +# bad permission on /etc/zarafa +allow zarafa_domain self:capability { dac_override setgid setuid }; -+ +allow zarafa_domain self:fifo_file rw_fifo_file_perms; +allow zarafa_domain self:tcp_socket create_stream_socket_perms; +allow zarafa_domain self:unix_stream_socket create_stream_socket_perms; @@ -36022,6 +37114,34 @@ index 6b87605..347f754 100644 ') allow $1 zebra_t:process { ptrace signal_perms }; +diff --git a/policy/modules/services/zebra.te b/policy/modules/services/zebra.te +index c349adc..f0b1201 100644 +--- a/policy/modules/services/zebra.te ++++ b/policy/modules/services/zebra.te +@@ -6,11 +6,10 @@ policy_module(zebra, 1.11.1) + # + + ## +-##

+-## Allow zebra daemon to write it configuration files +-##

++##

++## Allow zebra daemon to write it configuration files ++##

+ ## +-# + gen_tunable(allow_zebra_write_config, false) + + type zebra_t; +@@ -52,7 +51,7 @@ allow zebra_t zebra_conf_t:dir list_dir_perms; + read_files_pattern(zebra_t, zebra_conf_t, zebra_conf_t) + read_lnk_files_pattern(zebra_t, zebra_conf_t, zebra_conf_t) + +-allow zebra_t zebra_log_t:dir setattr; ++allow zebra_t zebra_log_t:dir setattr_dir_perms; + manage_files_pattern(zebra_t, zebra_log_t, zebra_log_t) + manage_sock_files_pattern(zebra_t, zebra_log_t, zebra_log_t) + logging_log_filetrans(zebra_t, zebra_log_t, { sock_file file dir }) diff --git a/policy/modules/services/zosremote.if b/policy/modules/services/zosremote.if index 702e768..13f0eef 100644 --- a/policy/modules/services/zosremote.if @@ -36046,6 +37166,19 @@ index 702e768..13f0eef 100644 # interface(`zosremote_run',` gen_require(` +diff --git a/policy/modules/services/zosremote.te b/policy/modules/services/zosremote.te +index f9a06d2..3d407c6 100644 +--- a/policy/modules/services/zosremote.te ++++ b/policy/modules/services/zosremote.te +@@ -16,7 +16,7 @@ logging_dispatcher_domain(zos_remote_t, zos_remote_exec_t) + # + + allow zos_remote_t self:process signal; +-allow zos_remote_t self:fifo_file rw_file_perms; ++allow zos_remote_t self:fifo_file rw_fifo_file_perms; + allow zos_remote_t self:unix_stream_socket create_stream_socket_perms; + + files_read_etc_files(zos_remote_t) diff --git a/policy/modules/system/application.if b/policy/modules/system/application.if index ac50333..108595b 100644 --- a/policy/modules/system/application.if @@ -37123,7 +38256,7 @@ index f6aafe7..666a58f 100644 + allow $1 init_t:unix_stream_socket rw_stream_socket_perms; +') diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te -index 698c11e..d7abdd1 100644 +index 698c11e..00283ba 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -16,6 +16,27 @@ gen_require(` @@ -37460,7 +38593,7 @@ index 698c11e..d7abdd1 100644 miscfiles_read_localization(initrc_t) # slapd needs to read cert files from its initscript -miscfiles_read_generic_certs(initrc_t) -+miscfiles_manage_cert_files(initrc_t) ++miscfiles_manage_generic_cert_files(initrc_t) modutils_read_module_config(initrc_t) modutils_domtrans_insmod(initrc_t) diff --git a/selinux-policy.spec b/selinux-policy.spec index 80e32c1..24032e1 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -20,7 +20,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.9.5 -Release: 4%{?dist} +Release: 5%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -469,6 +469,11 @@ exit 0 %endif %changelog +* Fri Sep 24 2010 Dan Walsh 3.9.5-5 +- Pull in cleanups from dgrift +- Allow mozilla_plugin_t to execute mozilla_home_t +- Allow rpc.quota to do quotamod + * Thu Sep 23 2010 Dan Walsh 3.9.5-4 - Cleanup policy via dgrift - Allow dovecot_deliver to append to inherited log files