diff --git a/policy-20070501.patch b/policy-20070501.patch index f35a5ab..ae136a9 100644 --- a/policy-20070501.patch +++ b/policy-20070501.patch @@ -2198,7 +2198,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. /usr/src/kernels/.+/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.6.4/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2007-05-07 14:51:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/files.if 2007-08-27 09:57:21.000000000 -0400 ++++ serefpolicy-2.6.4/policy/modules/kernel/files.if 2007-09-11 14:40:52.000000000 -0400 @@ -343,8 +343,7 @@ ######################################## @@ -2301,7 +2301,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -3310,6 +3346,43 @@ +@@ -3112,6 +3148,24 @@ + + ######################################## + ## ++## Manage temporary directories in /tmp. ++## ++## ++## ++## The type of the process performing this action. ++## ++## ++# ++interface(`files_manage_generic_tmp_dirs',` ++ gen_require(` ++ type tmp_t; ++ ') ++ ++ manage_dirs_pattern($1,tmp_t,tmp_t) ++') ++ ++######################################## ++## + ## Manage temporary files and directories in /tmp. + ## + ## +@@ -3310,6 +3364,43 @@ ######################################## ## @@ -2345,7 +2370,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## Get the attributes of files in /usr. ## ## -@@ -3386,6 +3459,24 @@ +@@ -3386,6 +3477,24 @@ ######################################## ## @@ -2370,7 +2395,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## Read symbolic links in /usr. ## ## -@@ -3432,6 +3523,24 @@ +@@ -3432,6 +3541,24 @@ ######################################## ## @@ -2395,7 +2420,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## Do not audit attempts to search /usr/src. ## ## -@@ -3637,7 +3746,7 @@ +@@ -3637,7 +3764,7 @@ type var_t; ') @@ -2404,7 +2429,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -3993,7 +4102,7 @@ +@@ -3993,7 +4120,7 @@ type var_lock_t; ') @@ -2413,7 +2438,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4012,7 +4121,7 @@ +@@ -4012,7 +4139,7 @@ type var_t, var_lock_t; ') @@ -2422,7 +2447,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4181,7 +4290,7 @@ +@@ -4181,7 +4308,7 @@ type var_run_t; ') @@ -2431,7 +2456,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4529,6 +4638,8 @@ +@@ -4529,6 +4656,8 @@ # Need to give access to /selinux/member selinux_compute_member($1) @@ -2440,7 +2465,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # Need sys_admin capability for mounting allow $1 self:capability { chown fsetid sys_admin }; -@@ -4551,6 +4662,8 @@ +@@ -4551,6 +4680,8 @@ # Default type for mountpoints allow $1 poly_t:dir { create mounton }; fs_unmount_xattr_fs($1) @@ -2449,7 +2474,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4588,3 +4701,28 @@ +@@ -4588,3 +4719,28 @@ allow $1 { file_type -security_file_type }:dir manage_dir_perms; ')