diff --git a/.cvsignore b/.cvsignore index c3738bc..b3878bf 100644 --- a/.cvsignore +++ b/.cvsignore @@ -122,3 +122,4 @@ serefpolicy-3.0.1.tgz serefpolicy-3.0.2.tgz serefpolicy-3.0.3.tgz serefpolicy-3.0.4.tgz +serefpolicy-3.0.5.tgz diff --git a/policy-20070703.patch b/policy-20070703.patch index 06a01f5..11a5f5f 100644 --- a/policy-20070703.patch +++ b/policy-20070703.patch @@ -1,83 +1,87 @@ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/guest_u_default_contexts serefpolicy-3.0.4/config/appconfig-strict-mls/guest_u_default_contexts ---- nsaserefpolicy/config/appconfig-strict-mls/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/config/appconfig-strict-mls/guest_u_default_contexts 2007-07-25 13:27:51.000000000 -0400 -@@ -0,0 +1,4 @@ -+system_r:local_login_t:s0 guest_r:guest_t:s0 -+system_r:remote_login_t:s0 guest_r:guest_t:s0 -+system_r:sshd_t:s0 guest_r:guest_t:s0 -+system_r:crond_t:s0 guest_r:guest_crond_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/staff_u_default_contexts serefpolicy-3.0.4/config/appconfig-strict-mls/staff_u_default_contexts ---- nsaserefpolicy/config/appconfig-strict-mls/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/config/appconfig-strict-mls/staff_u_default_contexts 2007-07-25 13:27:51.000000000 -0400 -@@ -0,0 +1,9 @@ -+system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 -+system_r:remote_login_t:s0 staff_r:staff_t:s0 -+system_r:sshd_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 -+system_r:crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 mailman_r:user_crond_t:s0 -+system_r:xdm_t:s0 staff_r:staff_t:s0 -+staff_r:staff_su_t:s0 staff_r:staff_t:s0 -+staff_r:staff_sudo_t:s0 staff_r:staff_t:s0 -+sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 -+sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/user_u_default_contexts serefpolicy-3.0.4/config/appconfig-strict-mls/user_u_default_contexts ---- nsaserefpolicy/config/appconfig-strict-mls/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/config/appconfig-strict-mls/user_u_default_contexts 2007-07-25 13:27:51.000000000 -0400 -@@ -0,0 +1,7 @@ -+system_r:local_login_t:s0 user_r:user_t:s0 -+system_r:remote_login_t:s0 user_r:user_t:s0 -+system_r:sshd_t:s0 user_r:user_t:s0 -+system_r:crond_t:s0 user_r:user_crond_t:s0 -+system_r:xdm_t:s0 user_r:user_t:s0 -+user_r:user_su_t:s0 user_r:user_t:s0 -+user_r:user_sudo_t:s0 user_r:user_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/default_type serefpolicy-3.0.4/config/appconfig-targeted-mcs/default_type ---- nsaserefpolicy/config/appconfig-targeted-mcs/default_type 2007-05-25 09:09:09.000000000 -0400 -+++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/default_type 2007-07-25 13:27:51.000000000 -0400 -@@ -1 +1,4 @@ - system_r:unconfined_t -+sysadm_r:sysadm_t -+staff_r:staff_t -+user_r:user_t -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/guest_u_default_contexts serefpolicy-3.0.4/config/appconfig-targeted-mcs/guest_u_default_contexts ---- nsaserefpolicy/config/appconfig-targeted-mcs/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/guest_u_default_contexts 2007-07-25 13:27:51.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_contexts serefpolicy-3.0.5/config/appconfig-mcs/default_contexts +--- nsaserefpolicy/config/appconfig-mcs/default_contexts 2007-08-02 08:17:32.000000000 -0400 ++++ serefpolicy-3.0.5/config/appconfig-mcs/default_contexts 2007-08-03 14:06:26.000000000 -0400 +@@ -1,15 +1,9 @@ +-system_r:crond_t:s0 user_r:user_crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 unconfined_r:unconfined_crond_t:s0 +-system_r:local_login_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0 +-system_r:remote_login_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 unconfined_r:unconfined_t:s0 +-system_r:sshd_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0 +-system_r:sulogin_t:s0 sysadm_r:sysadm_t:s0 +-system_r:xdm_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0 +- +-staff_r:staff_su_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +-staff_r:staff_sudo_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 +- +-sysadm_r:sysadm_su_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +-sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 +- +-user_r:user_su_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +-user_r:user_sudo_t:s0 sysadm_r:sysadm_t:s0 user_r:user_t:s0 ++system_r:crond_t:s0 system_r:unconfined_t:s0 ++system_r:initrc_t:s0 system_r:unconfined_t:s0 ++system_r:local_login_t:s0 system_r:unconfined_t:s0 ++system_r:remote_login_t:s0 system_r:unconfined_t:s0 ++system_r:rshd_t:s0 system_r:unconfined_t:s0 ++system_r:sshd_t:s0 system_r:unconfined_t:s0 ++system_r:sysadm_su_t:s0 system_r:unconfined_t:s0 ++system_r:unconfined_t:s0 system_r:unconfined_t:s0 ++system_r:xdm_t:s0 system_r:unconfined_t:s0 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_type serefpolicy-3.0.5/config/appconfig-mcs/default_type +--- nsaserefpolicy/config/appconfig-mcs/default_type 2007-08-02 08:17:32.000000000 -0400 ++++ serefpolicy-3.0.5/config/appconfig-mcs/default_type 2007-08-03 14:06:26.000000000 -0400 +@@ -1,4 +1,4 @@ ++system_r:unconfined_t + sysadm_r:sysadm_t + staff_r:staff_t +-unconfined_r:unconfined_t + user_r:user_t +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/failsafe_context serefpolicy-3.0.5/config/appconfig-mcs/failsafe_context +--- nsaserefpolicy/config/appconfig-mcs/failsafe_context 2007-08-02 08:17:32.000000000 -0400 ++++ serefpolicy-3.0.5/config/appconfig-mcs/failsafe_context 2007-08-03 14:06:26.000000000 -0400 +@@ -1 +1 @@ +-sysadm_r:sysadm_t:s0 ++system_r:unconfined_t:s0 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/guest_u_default_contexts serefpolicy-3.0.5/config/appconfig-mcs/guest_u_default_contexts +--- nsaserefpolicy/config/appconfig-mcs/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.5/config/appconfig-mcs/guest_u_default_contexts 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,4 @@ +system_r:local_login_t:s0 guest_r:guest_t:s0 +system_r:remote_login_t:s0 guest_r:guest_t:s0 +system_r:sshd_t:s0 guest_r:guest_t:s0 +system_r:crond_t:s0 guest_r:guest_crond_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/initrc_context serefpolicy-3.0.4/config/appconfig-targeted-mcs/initrc_context ---- nsaserefpolicy/config/appconfig-targeted-mcs/initrc_context 2007-05-25 09:09:09.000000000 -0400 -+++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/initrc_context 2007-07-25 13:27:51.000000000 -0400 -@@ -1 +1 @@ --user_u:system_r:initrc_t:s0 -+system_u:system_r:initrc_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/root_default_contexts serefpolicy-3.0.4/config/appconfig-targeted-mcs/root_default_contexts ---- nsaserefpolicy/config/appconfig-targeted-mcs/root_default_contexts 2007-05-25 09:09:09.000000000 -0400 -+++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/root_default_contexts 2007-07-25 13:27:51.000000000 -0400 -@@ -1,2 +1,10 @@ --system_r:unconfined_t:s0 system_r:unconfined_t:s0 --system_r:initrc_t:s0 system_r:unconfined_t:s0 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_default_contexts serefpolicy-3.0.5/config/appconfig-mcs/root_default_contexts +--- nsaserefpolicy/config/appconfig-mcs/root_default_contexts 2007-08-02 08:17:32.000000000 -0400 ++++ serefpolicy-3.0.5/config/appconfig-mcs/root_default_contexts 2007-08-03 14:06:26.000000000 -0400 +@@ -1,11 +1,10 @@ +-system_r:crond_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0 +-system_r:local_login_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +- +-staff_r:staff_su_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +-sysadm_r:sysadm_su_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +-user_r:user_su_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +- +system_r:local_login_t:s0 system_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +system_r:crond_t:s0 system_r:unconfined_t:s0 sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0 +staff_r:staff_su_t:s0 system_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +sysadm_r:sysadm_su_t:s0 system_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +user_r:user_su_t:s0 system_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 -+# -+# Uncomment if you want to automatically login as sysadm_r -+# + # + # Uncomment if you want to automatically login as sysadm_r + # +-#system_r:sshd_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +#system_r:sshd_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/seusers serefpolicy-3.0.4/config/appconfig-targeted-mcs/seusers ---- nsaserefpolicy/config/appconfig-targeted-mcs/seusers 2007-05-31 15:35:39.000000000 -0400 -+++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/seusers 2007-07-25 13:27:51.000000000 -0400 -@@ -1,2 +1,2 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/seusers serefpolicy-3.0.5/config/appconfig-mcs/seusers +--- nsaserefpolicy/config/appconfig-mcs/seusers 2007-08-02 08:17:32.000000000 -0400 ++++ serefpolicy-3.0.5/config/appconfig-mcs/seusers 2007-08-03 14:06:26.000000000 -0400 +@@ -1,3 +1,2 @@ +-system_u:system_u:s0-mcs_systemhigh root:root:s0-mcs_systemhigh -__default__:user_u:s0 +__default__:system_u:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/staff_u_default_contexts serefpolicy-3.0.4/config/appconfig-targeted-mcs/staff_u_default_contexts ---- nsaserefpolicy/config/appconfig-targeted-mcs/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/staff_u_default_contexts 2007-07-25 13:27:51.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts serefpolicy-3.0.5/config/appconfig-mcs/staff_u_default_contexts +--- nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.5/config/appconfig-mcs/staff_u_default_contexts 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,9 @@ +system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +system_r:remote_login_t:s0 staff_r:staff_t:s0 @@ -88,9 +92,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mc +staff_r:staff_sudo_t:s0 staff_r:staff_t:s0 +sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 +sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/user_u_default_contexts serefpolicy-3.0.4/config/appconfig-targeted-mcs/user_u_default_contexts ---- nsaserefpolicy/config/appconfig-targeted-mcs/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/config/appconfig-targeted-mcs/user_u_default_contexts 2007-07-25 13:27:51.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/userhelper_context serefpolicy-3.0.5/config/appconfig-mcs/userhelper_context +--- nsaserefpolicy/config/appconfig-mcs/userhelper_context 2007-08-02 08:17:32.000000000 -0400 ++++ serefpolicy-3.0.5/config/appconfig-mcs/userhelper_context 2007-08-03 14:06:26.000000000 -0400 +@@ -1 +1 @@ +-system_u:sysadm_r:sysadm_t:s0 ++system_u:system_r:unconfined_t:s0 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts serefpolicy-3.0.5/config/appconfig-mcs/user_u_default_contexts +--- nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.5/config/appconfig-mcs/user_u_default_contexts 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,7 @@ +system_r:local_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +system_r:remote_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 @@ -99,41 +109,154 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mc +system_r:xdm_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +user_r:user_su_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +user_r:user_sudo_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.0.4/Makefile ---- nsaserefpolicy/Makefile 2007-07-25 10:37:43.000000000 -0400 -+++ serefpolicy-3.0.4/Makefile 2007-07-25 13:27:51.000000000 -0400 -@@ -158,8 +158,18 @@ - headerdir = $(modpkgdir)/include - docsdir = $(prefix)/share/doc/$(PKGNAME) - -+# compile strict policy if requested. -+ifneq ($(findstring strict,$(TYPE)),) -+ M4PARAM += -D strict_policy -+endif -+ -+# compile targeted policy if requested. -+ifneq ($(findstring targeted,$(TYPE)),) -+ M4PARAM += -D targeted_policy -+endif -+ - # enable MLS if requested. --ifeq "$(TYPE)" "mls" -+ifneq ($(findstring -mls,$(TYPE)),) - M4PARAM += -D enable_mls - CHECKPOLICY += -M - CHECKMODULE += -M -@@ -167,7 +177,7 @@ - endif - - # enable MLS if MCS requested. --ifeq "$(TYPE)" "mcs" -+ifneq ($(findstring -mcs,$(TYPE)),) - M4PARAM += -D enable_mcs - CHECKPOLICY += -M - CHECKMODULE += -M -diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.0.4/man/man8/ftpd_selinux.8 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts serefpolicy-3.0.5/config/appconfig-mcs/xguest_u_default_contexts +--- nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.5/config/appconfig-mcs/xguest_u_default_contexts 2007-08-03 14:06:26.000000000 -0400 +@@ -0,0 +1,5 @@ ++system_r:local_login_t xguest_r:xguest_t:s0 ++system_r:remote_login_t xguest_r:xguest_t:s0 ++system_r:sshd_t xguest_r:xguest_t:s0 ++system_r:crond_t xguest_r:xguest_crond_t:s0 ++system_r:xdm_t xguest_r:xguest_t:s0 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default_contexts serefpolicy-3.0.5/config/appconfig-mls/default_contexts +--- nsaserefpolicy/config/appconfig-mls/default_contexts 2007-08-02 08:17:30.000000000 -0400 ++++ serefpolicy-3.0.5/config/appconfig-mls/default_contexts 2007-08-03 14:06:26.000000000 -0400 +@@ -1,15 +1,12 @@ +-system_r:crond_t:s0 user_r:user_crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 unconfined_r:unconfined_crond_t:s0 +-system_r:local_login_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0 +-system_r:remote_login_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 unconfined_r:unconfined_t:s0 +-system_r:sshd_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0 +-system_r:sulogin_t:s0 sysadm_r:sysadm_t:s0 +-system_r:xdm_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0 +- +-staff_r:staff_su_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +-staff_r:staff_sudo_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 +- +-sysadm_r:sysadm_su_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 ++system_r:sulogin_t:s0 sysadm_r:sysadm_t:s0 ++system_r:local_login_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 sysadm_r:sysadm_t:s0 ++system_r:remote_login_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 ++system_r:sshd_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 ++system_r:crond_t:s0 user_r:user_crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 mailman_r:user_crond_t:s0 ++system_r:xdm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 sysadm_r:sysadm_t:s0 ++staff_r:staff_su_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 sysadm_r:sysadm_t:s0 ++sysadm_r:sysadm_su_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 sysadm_r:sysadm_t:s0 ++user_r:user_su_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 sysadm_r:sysadm_t:s0 + sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 +- +-user_r:user_su_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +-user_r:user_sudo_t:s0 sysadm_r:sysadm_t:s0 user_r:user_t:s0 ++staff_r:staff_sudo_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 ++user_r:user_sudo_t:s0 sysadm_r:sysadm_t:s0 user_r:user_t:s0 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default_type serefpolicy-3.0.5/config/appconfig-mls/default_type +--- nsaserefpolicy/config/appconfig-mls/default_type 2007-08-02 08:17:30.000000000 -0400 ++++ serefpolicy-3.0.5/config/appconfig-mls/default_type 2007-08-03 14:06:26.000000000 -0400 +@@ -1,6 +1,5 @@ +-auditadm_r:auditadm_t +-secadm_r:secadm_t + sysadm_r:sysadm_t ++secadm_r:secadm_t + staff_r:staff_t +-unconfined_r:unconfined_t + user_r:user_t ++auditadm_r:auditadm_t +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/guest_u_default_contexts serefpolicy-3.0.5/config/appconfig-mls/guest_u_default_contexts +--- nsaserefpolicy/config/appconfig-mls/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.5/config/appconfig-mls/guest_u_default_contexts 2007-08-03 14:06:26.000000000 -0400 +@@ -0,0 +1,4 @@ ++system_r:local_login_t:s0 guest_r:guest_t:s0 ++system_r:remote_login_t:s0 guest_r:guest_t:s0 ++system_r:sshd_t:s0 guest_r:guest_t:s0 ++system_r:crond_t:s0 guest_r:guest_crond_t:s0 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/root_default_contexts serefpolicy-3.0.5/config/appconfig-mls/root_default_contexts +--- nsaserefpolicy/config/appconfig-mls/root_default_contexts 2007-08-02 08:17:30.000000000 -0400 ++++ serefpolicy-3.0.5/config/appconfig-mls/root_default_contexts 2007-08-03 14:06:26.000000000 -0400 +@@ -1,11 +1,9 @@ +-system_r:crond_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0 +-system_r:local_login_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +- +-staff_r:staff_su_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +-sysadm_r:sysadm_su_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +-user_r:user_su_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +- ++system_r:local_login_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 ++system_r:crond_t:s0 sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0 ++staff_r:staff_su_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 ++sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 ++user_r:user_su_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 + # + # Uncomment if you want to automatically login as sysadm_r + # +-#system_r:sshd_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 ++#system_r:sshd_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/staff_u_default_contexts serefpolicy-3.0.5/config/appconfig-mls/staff_u_default_contexts +--- nsaserefpolicy/config/appconfig-mls/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.5/config/appconfig-mls/staff_u_default_contexts 2007-08-03 14:06:26.000000000 -0400 +@@ -0,0 +1,9 @@ ++system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 ++system_r:remote_login_t:s0 staff_r:staff_t:s0 ++system_r:sshd_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 ++system_r:crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 mailman_r:user_crond_t:s0 ++system_r:xdm_t:s0 staff_r:staff_t:s0 ++staff_r:staff_su_t:s0 staff_r:staff_t:s0 ++staff_r:staff_sudo_t:s0 staff_r:staff_t:s0 ++sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 ++sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/user_u_default_contexts serefpolicy-3.0.5/config/appconfig-mls/user_u_default_contexts +--- nsaserefpolicy/config/appconfig-mls/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.5/config/appconfig-mls/user_u_default_contexts 2007-08-03 14:06:26.000000000 -0400 +@@ -0,0 +1,7 @@ ++system_r:local_login_t:s0 user_r:user_t:s0 ++system_r:remote_login_t:s0 user_r:user_t:s0 ++system_r:sshd_t:s0 user_r:user_t:s0 ++system_r:crond_t:s0 user_r:user_crond_t:s0 ++system_r:xdm_t:s0 user_r:user_t:s0 ++user_r:user_su_t:s0 user_r:user_t:s0 ++user_r:user_sudo_t:s0 user_r:user_t:s0 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/guest_u_default_contexts serefpolicy-3.0.5/config/appconfig-standard/guest_u_default_contexts +--- nsaserefpolicy/config/appconfig-standard/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.5/config/appconfig-standard/guest_u_default_contexts 2007-08-03 14:06:26.000000000 -0400 +@@ -0,0 +1,4 @@ ++system_r:local_login_t guest_r:guest_t ++system_r:remote_login_t guest_r:guest_t ++system_r:sshd_t guest_r:guest_t ++system_r:crond_t guest_r:guest_crond_t +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/staff_u_default_contexts serefpolicy-3.0.5/config/appconfig-standard/staff_u_default_contexts +--- nsaserefpolicy/config/appconfig-standard/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.5/config/appconfig-standard/staff_u_default_contexts 2007-08-03 14:06:26.000000000 -0400 +@@ -0,0 +1,9 @@ ++system_r:local_login_t staff_r:staff_t sysadm_r:sysadm_t ++system_r:remote_login_t staff_r:staff_t ++system_r:sshd_t staff_r:staff_t sysadm_r:sysadm_t ++system_r:crond_t staff_r:staff_crond_t sysadm_r:sysadm_crond_t system_r:system_crond_t mailman_r:user_crond_t ++system_r:xdm_t staff_r:staff_t ++staff_r:staff_su_t staff_r:staff_t ++staff_r:staff_sudo_t staff_r:staff_t ++sysadm_r:sysadm_su_t sysadm_r:sysadm_t ++sysadm_r:sysadm_sudo_t sysadm_r:sysadm_t +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/user_u_default_contexts serefpolicy-3.0.5/config/appconfig-standard/user_u_default_contexts +--- nsaserefpolicy/config/appconfig-standard/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.5/config/appconfig-standard/user_u_default_contexts 2007-08-03 14:06:26.000000000 -0400 +@@ -0,0 +1,7 @@ ++system_r:local_login_t system_r:unconfined_t user_r:user_t ++system_r:remote_login_t system_r:unconfined_t user_r:user_t ++system_r:sshd_t system_r:unconfined_t user_r:user_t ++system_r:crond_t system_r:unconfined_t user_r:user_crond_t ++system_r:xdm_t system_r:unconfined_t user_r:user_t ++user_r:user_su_t system_r:unconfined_t user_r:user_t ++user_r:user_sudo_t system_r:unconfined_t user_r:user_t +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/xguest_u_default_contexts serefpolicy-3.0.5/config/appconfig-standard/xguest_u_default_contexts +--- nsaserefpolicy/config/appconfig-standard/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.0.5/config/appconfig-standard/xguest_u_default_contexts 2007-08-03 14:06:26.000000000 -0400 +@@ -0,0 +1,5 @@ ++system_r:local_login_t xguest_r:xguest_t ++system_r:remote_login_t xguest_r:xguest_t ++system_r:sshd_t xguest_r:xguest_t ++system_r:crond_t xguest_r:xguest_crond_t ++system_r:xdm_t xguest_r:xguest_t +diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.0.5/man/man8/ftpd_selinux.8 --- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-05-25 09:09:10.000000000 -0400 -+++ serefpolicy-3.0.4/man/man8/ftpd_selinux.8 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/man/man8/ftpd_selinux.8 2007-08-03 14:06:26.000000000 -0400 @@ -12,7 +12,7 @@ .TP chcon -R -t public_content_t /var/ftp @@ -143,10 +266,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 sere .TP chcon -t public_content_rw_t /var/ftp/incoming .TP -Binary files nsaserefpolicy/myaudit.pp and serefpolicy-3.0.4/myaudit.pp differ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.0.4/policy/flask/access_vectors +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.0.5/policy/flask/access_vectors --- nsaserefpolicy/policy/flask/access_vectors 2007-07-25 10:37:36.000000000 -0400 -+++ serefpolicy-3.0.4/policy/flask/access_vectors 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/flask/access_vectors 2007-08-03 14:06:26.000000000 -0400 @@ -625,6 +625,8 @@ send recv @@ -156,9 +278,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors } class key -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.0.4/policy/global_tunables +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.0.5/policy/global_tunables --- nsaserefpolicy/policy/global_tunables 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.4/policy/global_tunables 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/global_tunables 2007-08-03 14:06:26.000000000 -0400 @@ -133,3 +133,10 @@ ## gen_tunable(write_untrusted_content,false) @@ -170,9 +292,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref +## +gen_tunable(allow_console_login,false) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.0.4/policy/mls +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.0.5/policy/mls --- nsaserefpolicy/policy/mls 2007-07-03 07:06:36.000000000 -0400 -+++ serefpolicy-3.0.4/policy/mls 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/mls 2007-08-03 14:06:26.000000000 -0400 @@ -89,12 +89,14 @@ mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton } (( l1 eq l2 ) or @@ -255,9 +377,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.0.4 ( t2 == unlabeled_t )); mlsconstrain association { polmatch } -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-3.0.4/policy/modules/admin/acct.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-3.0.5/policy/modules/admin/acct.te --- nsaserefpolicy/policy/modules/admin/acct.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/acct.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/acct.te 2007-08-03 14:06:26.000000000 -0400 @@ -9,6 +9,7 @@ type acct_t; type acct_exec_t; @@ -266,9 +388,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te type acct_data_t; logging_log_file(acct_data_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.0.4/policy/modules/admin/alsa.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.0.5/policy/modules/admin/alsa.fc --- nsaserefpolicy/policy/modules/admin/alsa.fc 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/alsa.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/alsa.fc 2007-08-03 14:06:26.000000000 -0400 @@ -1,4 +1,7 @@ /etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0) @@ -277,9 +399,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc /usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0) +/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.0.4/policy/modules/admin/alsa.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.0.5/policy/modules/admin/alsa.te --- nsaserefpolicy/policy/modules/admin/alsa.te 2007-07-25 10:37:43.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/alsa.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/alsa.te 2007-08-03 14:06:26.000000000 -0400 @@ -19,20 +19,24 @@ # Local policy # @@ -323,9 +445,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te + hal_write_log(alsa_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.0.4/policy/modules/admin/anaconda.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.0.5/policy/modules/admin/anaconda.te --- nsaserefpolicy/policy/modules/admin/anaconda.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/anaconda.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/anaconda.te 2007-08-03 14:06:26.000000000 -0400 @@ -31,16 +31,13 @@ modutils_domtrans_insmod(anaconda_t) @@ -344,9 +466,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anacond kudzu_domtrans(anaconda_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-3.0.4/policy/modules/admin/bootloader.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-3.0.5/policy/modules/admin/bootloader.te --- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-07-25 10:37:43.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/bootloader.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/bootloader.te 2007-08-03 14:06:26.000000000 -0400 @@ -180,6 +180,7 @@ optional_policy(` @@ -355,9 +477,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.0.4/policy/modules/admin/consoletype.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.0.5/policy/modules/admin/consoletype.te --- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-07-25 10:37:43.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/consoletype.te 2007-07-26 10:21:26.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/consoletype.te 2007-08-03 14:06:26.000000000 -0400 @@ -8,9 +8,11 @@ type consoletype_t; @@ -393,9 +515,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console logrotate_dontaudit_use_fds(consoletype_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.0.4/policy/modules/admin/kudzu.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.0.5/policy/modules/admin/kudzu.te --- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/kudzu.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/kudzu.te 2007-08-03 14:06:26.000000000 -0400 @@ -21,8 +21,8 @@ # Local policy # @@ -432,9 +554,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t ifdef(`TODO',` allow kudzu_t modules_conf_t:file unlink; optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.0.4/policy/modules/admin/logrotate.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.0.5/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-07-25 10:37:43.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/logrotate.te 2007-07-28 10:42:11.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/logrotate.te 2007-08-03 14:06:26.000000000 -0400 @@ -75,11 +75,13 @@ mls_file_read_up(logrotate_t) mls_file_write_down(logrotate_t) @@ -481,9 +603,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota slrnpull_manage_spool(logrotate_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.0.4/policy/modules/admin/logwatch.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.0.5/policy/modules/admin/logwatch.te --- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-07-25 10:37:43.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/logwatch.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/logwatch.te 2007-08-03 14:06:26.000000000 -0400 @@ -29,7 +29,6 @@ allow logwatch_t self:process signal; allow logwatch_t self:fifo_file rw_file_perms; @@ -534,9 +656,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc samba_read_log(logwatch_t) + samba_read_share_files(logwatch_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.0.4/policy/modules/admin/netutils.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.0.5/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2007-07-25 10:37:43.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/netutils.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/netutils.te 2007-08-03 14:06:26.000000000 -0400 @@ -29,6 +29,7 @@ type traceroute_t; type traceroute_exec_t; @@ -545,9 +667,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil role system_r types traceroute_t; ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.if serefpolicy-3.0.4/policy/modules/admin/portage.if +@@ -113,6 +114,7 @@ + corenet_tcp_sendrecv_all_if(ping_t) + corenet_raw_sendrecv_all_if(ping_t) + corenet_raw_sendrecv_all_nodes(ping_t) ++corenet_raw_bind_all_nodes(ping_t) + corenet_tcp_sendrecv_all_nodes(ping_t) + corenet_tcp_sendrecv_all_ports(ping_t) + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.if serefpolicy-3.0.5/policy/modules/admin/portage.if --- nsaserefpolicy/policy/modules/admin/portage.if 2007-07-03 07:06:36.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/portage.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/portage.if 2007-08-03 14:06:26.000000000 -0400 @@ -324,6 +324,7 @@ seutil_domtrans_setfiles($1) # run semodule @@ -556,9 +686,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage portage_domtrans_gcc_config($1) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.0.4/policy/modules/admin/prelink.te ---- nsaserefpolicy/policy/modules/admin/prelink.te 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/prelink.te 2007-07-25 13:27:51.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.0.5/policy/modules/admin/prelink.te +--- nsaserefpolicy/policy/modules/admin/prelink.te 2007-08-02 08:17:29.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/prelink.te 2007-08-03 14:06:26.000000000 -0400 @@ -26,7 +26,7 @@ # Local policy # @@ -568,7 +698,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink allow prelink_t self:process { execheap execmem execstack signal }; allow prelink_t self:fifo_file rw_fifo_file_perms; -@@ -40,17 +40,17 @@ +@@ -40,7 +40,7 @@ read_lnk_files_pattern(prelink_t,prelink_log_t,prelink_log_t) logging_log_filetrans(prelink_t, prelink_log_t, file) @@ -577,9 +707,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink files_tmp_filetrans(prelink_t, prelink_tmp_t, file) fs_tmpfs_filetrans(prelink_t, prelink_tmp_t, file) -+ - # prelink misc objects that are not system - # libraries or entrypoints +@@ -49,8 +49,7 @@ allow prelink_t prelink_object:file { manage_file_perms execute relabelto relabelfrom }; kernel_read_system_state(prelink_t) @@ -589,7 +717,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink corecmd_manage_all_executables(prelink_t) corecmd_relabel_all_executables(prelink_t) -@@ -65,6 +65,8 @@ +@@ -65,6 +64,8 @@ files_read_etc_files(prelink_t) files_read_etc_runtime_files(prelink_t) files_dontaudit_read_all_symlinks(prelink_t) @@ -598,59 +726,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink fs_getattr_xattr_fs(prelink_t) -@@ -81,9 +83,17 @@ - libs_manage_lib_files(prelink_t) - libs_relabel_lib_files(prelink_t) - libs_delete_lib_symlinks(prelink_t) -+libs_legacy_use_shared_libs(prelink_t) +@@ -81,6 +82,11 @@ miscfiles_read_localization(prelink_t) -+ifdef(`targeted_policy',` -+ # prelink executables in the user homedir -+ userdom_manage_generic_user_home_content_files(prelink_t) -+ userdom_mmap_generic_user_home_content_files(prelink_t) -+ userdom_dontaudit_relabel_generic_user_home_content_files(prelink_t) -+') ++# prelink executables in the user homedir ++userdom_manage_unpriv_users_home_content_files(prelink_t) ++userdom_mmap_unpriv_user_home_content_files(prelink_t) ++userdom_dontaudit_relabel_unpriv_user_home_content_files(prelink_t) + optional_policy(` amanda_manage_lib(prelink_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.fc serefpolicy-3.0.4/policy/modules/admin/readahead.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.fc serefpolicy-3.0.5/policy/modules/admin/readahead.fc --- nsaserefpolicy/policy/modules/admin/readahead.fc 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/readahead.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/readahead.fc 2007-08-03 14:06:26.000000000 -0400 @@ -2,3 +2,4 @@ # /usr # /usr/sbin/readahead -- gen_context(system_u:object_r:readahead_exec_t,s0) +/etc/readahead.d(/.*)? gen_context(system_u:object_r:readahead_etc_rw_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.if serefpolicy-3.0.4/policy/modules/admin/readahead.if ---- nsaserefpolicy/policy/modules/admin/readahead.if 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/readahead.if 2007-07-25 13:27:51.000000000 -0400 -@@ -1 +1,20 @@ - ## Readahead, read files into page cache for improved performance -+ -+######################################## -+## -+## Transition to the readahead domain. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`readahead_domtrans',` -+ gen_require(` -+ type readahead_t, readahead_exec_t; -+ ') -+ -+ corecmd_search_bin($1) -+ domtrans_pattern($1,readahead_exec_t,readahead_t) -+') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.0.4/policy/modules/admin/readahead.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.0.5/policy/modules/admin/readahead.te --- nsaserefpolicy/policy/modules/admin/readahead.te 2007-07-25 10:37:43.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/readahead.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/readahead.te 2007-08-03 14:06:26.000000000 -0400 @@ -9,19 +9,24 @@ type readahead_t; type readahead_exec_t; @@ -687,17 +785,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe domain_use_interactive_fds(readahead_t) -@@ -77,3 +82,7 @@ +@@ -68,6 +73,7 @@ + libs_use_shared_libs(readahead_t) + + logging_send_syslog_msg(readahead_t) ++logging_dontaudit_search_audit_config(readahead_t) + + miscfiles_read_localization(readahead_t) + +@@ -75,5 +81,9 @@ + userdom_dontaudit_search_sysadm_home_dirs(readahead_t) + optional_policy(` - seutil_sigchld_newrole(readahead_t) - ') ++ cron_system_entry(readahead_t, readahead_exec_t) ++') + +optional_policy(` -+ logging_dontaudit_search_audit_config(readahead_t) -+') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.0.4/policy/modules/admin/rpm.fc + seutil_sigchld_newrole(readahead_t) + ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.0.5/policy/modules/admin/rpm.fc --- nsaserefpolicy/policy/modules/admin/rpm.fc 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/rpm.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/rpm.fc 2007-08-03 14:06:26.000000000 -0400 @@ -21,6 +21,9 @@ /usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -708,9 +816,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc ') /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.4/policy/modules/admin/rpm.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.5/policy/modules/admin/rpm.if --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/rpm.if 2007-07-31 14:04:42.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/rpm.if 2007-08-03 14:06:26.000000000 -0400 @@ -210,6 +210,24 @@ ######################################## @@ -852,9 +960,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if + + dontaudit $1 rpm_t:shm rw_shm_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.4/policy/modules/admin/rpm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.5/policy/modules/admin/rpm.te --- nsaserefpolicy/policy/modules/admin/rpm.te 2007-07-25 10:37:43.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/rpm.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/rpm.te 2007-08-03 14:06:26.000000000 -0400 @@ -9,6 +9,8 @@ type rpm_t; type rpm_exec_t; @@ -872,9 +980,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te userdom_use_all_users_fds(rpm_script_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.4/policy/modules/admin/sudo.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.5/policy/modules/admin/sudo.if --- nsaserefpolicy/policy/modules/admin/sudo.if 2007-07-25 10:37:43.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/sudo.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/sudo.if 2007-08-03 14:06:26.000000000 -0400 @@ -68,7 +68,6 @@ allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms; allow $1_sudo_t self:unix_dgram_socket sendto; @@ -921,9 +1029,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if nis_use_ypbind($1_sudo_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.4/policy/modules/admin/su.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.5/policy/modules/admin/su.if --- nsaserefpolicy/policy/modules/admin/su.if 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/su.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/su.if 2007-08-03 14:06:26.000000000 -0400 @@ -41,12 +41,11 @@ allow $2 $1_su_t:process signal; @@ -1016,38 +1124,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s ifdef(`TODO',` allow $1_su_t $1_home_t:file manage_file_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.if serefpolicy-3.0.4/policy/modules/admin/tmpreaper.if ---- nsaserefpolicy/policy/modules/admin/tmpreaper.if 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/tmpreaper.if 2007-07-25 13:27:51.000000000 -0400 -@@ -2,6 +2,25 @@ - - ######################################## - ## -+## Transition to the tmpreaper domain. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`tmpreaper_domtrans',` -+ gen_require(` -+ type tmpreaper_t, tmpreaper_exec_t; -+ ') -+ -+ corecmd_search_bin($1) -+ domtrans_pattern($1,tmpreaper_exec_t,tmpreaper_t) -+') -+ -+######################################## -+## - ## Execute tmpreaper in the caller domain. - ## - ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.0.4/policy/modules/admin/usermanage.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.0.5/policy/modules/admin/usermanage.if --- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/usermanage.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/usermanage.if 2007-08-03 14:06:26.000000000 -0400 @@ -278,5 +278,5 @@ type crack_db_t; ') @@ -1055,9 +1134,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman - allow $1 crack_db_t:file read_file_perms; + read_files_pattern($1,crack_db_t,crack_db_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.0.4/policy/modules/admin/usermanage.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.0.5/policy/modules/admin/usermanage.te --- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-07-25 10:37:43.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/usermanage.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/usermanage.te 2007-08-03 14:06:26.000000000 -0400 @@ -92,6 +92,7 @@ dev_read_urand(chfn_t) @@ -1199,18 +1278,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman rpm_rw_pipes(useradd_t) + rpm_dontaudit_rw_tmp_files(useradd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.0.4/policy/modules/admin/vbetool.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.0.5/policy/modules/admin/vbetool.te --- nsaserefpolicy/policy/modules/admin/vbetool.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/admin/vbetool.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/admin/vbetool.te 2007-08-03 14:06:26.000000000 -0400 @@ -32,4 +32,5 @@ optional_policy(` hal_rw_pid_files(vbetool_t) + hal_write_log(vbetool_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if serefpolicy-3.0.4/policy/modules/apps/ada.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if serefpolicy-3.0.5/policy/modules/apps/ada.if --- nsaserefpolicy/policy/modules/apps/ada.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/ada.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/ada.if 2007-08-03 14:06:26.000000000 -0400 @@ -18,3 +18,34 @@ corecmd_search_bin($1) domtrans_pattern($1, ada_exec_t, ada_t) @@ -1246,9 +1325,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if s + role $2 types ada_t; + allow ada_t $3:chr_file rw_term_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc serefpolicy-3.0.4/policy/modules/apps/games.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc serefpolicy-3.0.5/policy/modules/apps/games.fc --- nsaserefpolicy/policy/modules/apps/games.fc 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/games.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/games.fc 2007-08-03 14:06:26.000000000 -0400 @@ -1,22 +1,16 @@ # # /usr @@ -1275,9 +1354,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc /usr/bin/micq -- gen_context(system_u:object_r:games_exec_t,s0) /usr/bin/blackjack -- gen_context(system_u:object_r:games_exec_t,s0) /usr/bin/gataxx -- gen_context(system_u:object_r:games_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.0.4/policy/modules/apps/gnome.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.0.5/policy/modules/apps/gnome.fc --- nsaserefpolicy/policy/modules/apps/gnome.fc 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/gnome.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/gnome.fc 2007-08-03 14:06:26.000000000 -0400 @@ -1,8 +1,7 @@ +HOME_DIR/.gnome2(/.*)? gen_context(system_u:object_r:ROLE_gnome_home_t,s0) HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:ROLE_gnome_home_t,s0) @@ -1288,9 +1367,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc /tmp/gconfd-USER/.* -- gen_context(system_u:object_r:ROLE_gconf_tmp_t,s0) /usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.0.4/policy/modules/apps/gnome.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.0.5/policy/modules/apps/gnome.if --- nsaserefpolicy/policy/modules/apps/gnome.if 2007-07-25 10:37:37.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/gnome.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/gnome.if 2007-08-03 14:06:26.000000000 -0400 @@ -33,6 +33,51 @@ ## # @@ -1476,9 +1555,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if + can_exec($1, gconfd_exec_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.0.4/policy/modules/apps/gnome.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.0.5/policy/modules/apps/gnome.te --- nsaserefpolicy/policy/modules/apps/gnome.te 2007-07-25 10:37:37.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/gnome.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/gnome.te 2007-08-03 14:06:26.000000000 -0400 @@ -8,8 +8,5 @@ attribute gnomedomain; @@ -1488,9 +1567,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te - type gconfd_exec_t; application_executable_file(gconfd_exec_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.4/policy/modules/apps/java.if ---- nsaserefpolicy/policy/modules/apps/java.if 2007-07-25 10:37:37.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/java.if 2007-07-25 13:27:51.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.5/policy/modules/apps/java.if +--- nsaserefpolicy/policy/modules/apps/java.if 2007-08-02 08:17:26.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/java.if 2007-08-03 14:06:26.000000000 -0400 @@ -32,7 +32,7 @@ ## ## @@ -1510,7 +1589,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if allow $1_javaplugin_t $2:fd use; # Unrestricted inheritance from the caller. allow $2 $1_javaplugin_t:process { noatsecure siginh rlimitinh }; -@@ -167,6 +166,53 @@ +@@ -166,6 +165,53 @@ optional_policy(` xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t) ') @@ -1564,7 +1643,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if ') ######################################## -@@ -220,3 +266,66 @@ +@@ -219,3 +265,66 @@ corecmd_search_bin($1) domtrans_pattern($1, java_exec_t, java_t) ') @@ -1631,9 +1710,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if + role $2 types java_t; + allow java_t $3:chr_file rw_term_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.0.4/policy/modules/apps/java.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.0.5/policy/modules/apps/java.te --- nsaserefpolicy/policy/modules/apps/java.te 2007-07-25 10:37:37.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/java.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/java.te 2007-08-03 14:06:26.000000000 -0400 @@ -31,3 +31,7 @@ unconfined_domain_noaudit(java_t) unconfined_dbus_chat(java_t) @@ -1642,9 +1721,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te +optional_policy(` + xserver_xdm_rw_shm(java_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.0.4/policy/modules/apps/loadkeys.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.0.5/policy/modules/apps/loadkeys.te --- nsaserefpolicy/policy/modules/apps/loadkeys.te 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/loadkeys.te 2007-07-27 11:58:52.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/loadkeys.te 2007-08-03 14:06:26.000000000 -0400 @@ -30,7 +30,7 @@ files_read_etc_runtime_files(loadkeys_t) @@ -1663,9 +1742,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys + nscd_dontaudit_search_pid(loadkeys_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.0.4/policy/modules/apps/mono.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.0.5/policy/modules/apps/mono.if --- nsaserefpolicy/policy/modules/apps/mono.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/mono.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/mono.if 2007-08-03 14:06:26.000000000 -0400 @@ -18,3 +18,98 @@ corecmd_search_bin($1) domtrans_pattern($1, mono_exec_t, mono_t) @@ -1765,9 +1844,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if + xserver_xdm_rw_shm($1_mono_t) + ') +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.0.4/policy/modules/apps/mono.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.0.5/policy/modules/apps/mono.te --- nsaserefpolicy/policy/modules/apps/mono.te 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/mono.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/mono.te 2007-08-03 14:06:26.000000000 -0400 @@ -46,3 +46,7 @@ unconfined_dbus_chat(mono_t) unconfined_dbus_connect(mono_t) @@ -1776,9 +1855,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te +optional_policy(` + xserver_xdm_rw_shm(mono_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.4/policy/modules/apps/mozilla.if ---- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-07-25 10:37:37.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/mozilla.if 2007-07-25 13:27:51.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.5/policy/modules/apps/mozilla.if +--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-08-02 08:17:26.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/mozilla.if 2007-08-03 14:06:26.000000000 -0400 @@ -36,6 +36,8 @@ gen_require(` type mozilla_conf_t, mozilla_exec_t; @@ -1881,7 +1960,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. term_dontaudit_getattr_pty_dirs($1_mozilla_t) libs_use_ld_so($1_mozilla_t) -@@ -185,16 +227,14 @@ +@@ -184,16 +226,14 @@ sysnet_dns_name_resolve($1_mozilla_t) sysnet_read_config($1_mozilla_t) @@ -1902,7 +1981,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. tunable_policy(`allow_execmem',` allow $1_mozilla_t self:process { execmem execstack }; -@@ -212,131 +252,8 @@ +@@ -211,131 +251,8 @@ fs_manage_cifs_symlinks($1_mozilla_t) ') @@ -2036,7 +2115,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') optional_policy(` -@@ -351,21 +268,28 @@ +@@ -350,21 +267,28 @@ optional_policy(` cups_read_rw_config($1_mozilla_t) cups_dbus_chat($1_mozilla_t) @@ -2068,7 +2147,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') optional_policy(` -@@ -385,25 +309,6 @@ +@@ -384,25 +308,6 @@ thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t) ') @@ -2094,7 +2173,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') ######################################## -@@ -576,3 +481,27 @@ +@@ -575,3 +480,27 @@ allow $2 $1_mozilla_t:tcp_socket rw_socket_perms; ') @@ -2122,9 +2201,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. + + allow $2 $1_mozilla_t:unix_stream_socket connectto; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.0.4/policy/modules/apps/mozilla.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.0.5/policy/modules/apps/mozilla.te --- nsaserefpolicy/policy/modules/apps/mozilla.te 2007-07-25 10:37:37.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/mozilla.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/mozilla.te 2007-08-03 14:06:26.000000000 -0400 @@ -6,13 +6,6 @@ # Declarations # @@ -2139,9 +2218,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. type mozilla_conf_t; files_config_file(mozilla_conf_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.0.4/policy/modules/apps/slocate.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.0.5/policy/modules/apps/slocate.te --- nsaserefpolicy/policy/modules/apps/slocate.te 2007-07-25 10:37:37.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/slocate.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/slocate.te 2007-08-03 14:06:26.000000000 -0400 @@ -29,6 +29,8 @@ manage_dirs_pattern(locate_t,locate_var_lib_t,locate_var_lib_t) manage_files_pattern(locate_t,locate_var_lib_t,locate_var_lib_t) @@ -2151,9 +2230,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate. kernel_read_system_state(locate_t) kernel_dontaudit_search_sysctl(locate_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.0.4/policy/modules/apps/userhelper.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.0.5/policy/modules/apps/userhelper.if --- nsaserefpolicy/policy/modules/apps/userhelper.if 2007-07-25 10:37:37.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/userhelper.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/userhelper.if 2007-08-03 14:06:26.000000000 -0400 @@ -130,6 +130,7 @@ term_use_all_user_ptys($1_userhelper_t) @@ -2162,9 +2241,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp auth_manage_pam_pid($1_userhelper_t) auth_manage_var_auth($1_userhelper_t) auth_search_pam_console_data($1_userhelper_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/usernetctl.te serefpolicy-3.0.4/policy/modules/apps/usernetctl.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/usernetctl.te serefpolicy-3.0.5/policy/modules/apps/usernetctl.te --- nsaserefpolicy/policy/modules/apps/usernetctl.te 2007-07-25 10:37:37.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/usernetctl.te 2007-07-28 11:05:08.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/usernetctl.te 2007-08-03 14:06:26.000000000 -0400 @@ -6,14 +6,6 @@ # Declarations # @@ -2180,9 +2259,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/usernetc type usernetctl_t; type usernetctl_exec_t; application_domain(usernetctl_t,usernetctl_exec_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.4/policy/modules/apps/vmware.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.5/policy/modules/apps/vmware.fc --- nsaserefpolicy/policy/modules/apps/vmware.fc 2007-07-03 07:05:43.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/vmware.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/vmware.fc 2007-08-03 14:06:26.000000000 -0400 @@ -23,6 +23,7 @@ /usr/bin/vmware-smbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) /usr/bin/vmware-smbpasswd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) @@ -2191,9 +2270,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.f /usr/bin/vmware-wizard -- gen_context(system_u:object_r:vmware_exec_t,s0) /usr/bin/vmware -- gen_context(system_u:object_r:vmware_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.0.4/policy/modules/apps/vmware.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.0.5/policy/modules/apps/vmware.te --- nsaserefpolicy/policy/modules/apps/vmware.te 2007-07-25 10:37:37.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/vmware.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/vmware.te 2007-08-03 14:06:26.000000000 -0400 @@ -29,7 +29,7 @@ allow vmware_host_t self:capability { setuid net_raw }; @@ -2212,9 +2291,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.t corenet_tcp_connect_all_ports(vmware_host_t) corenet_sendrecv_all_client_packets(vmware_host_t) corenet_sendrecv_all_server_packets(vmware_host_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.4/policy/modules/apps/wine.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.5/policy/modules/apps/wine.if --- nsaserefpolicy/policy/modules/apps/wine.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/apps/wine.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/apps/wine.if 2007-08-03 14:06:26.000000000 -0400 @@ -18,3 +18,34 @@ corecmd_search_bin($1) domtrans_pattern($1, wine_exec_t, wine_t) @@ -2250,9 +2329,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if + role $2 types wine_t; + allow wine_t $3:chr_file rw_term_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.4/policy/modules/kernel/corecommands.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.5/policy/modules/kernel/corecommands.fc --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/corecommands.fc 2007-07-31 13:41:19.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/corecommands.fc 2007-08-03 14:06:26.000000000 -0400 @@ -36,6 +36,11 @@ /etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0) /etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0) @@ -2293,9 +2372,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco /usr/share/system-config-rootpassword/system-config-rootpassword -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-samba/system-config-samba\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-securitylevel/system-config-securitylevel\.py -- gen_context(system_u:object_r:bin_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.0.4/policy/modules/kernel/corenetwork.te.in +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.0.5/policy/modules/kernel/corenetwork.te.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/corenetwork.te.in 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/corenetwork.te.in 2007-08-03 14:06:26.000000000 -0400 @@ -55,6 +55,11 @@ type reserved_port_t, port_type, reserved_port_type; @@ -2354,9 +2433,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene portcon tcp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0) portcon udp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.0.4/policy/modules/kernel/devices.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.0.5/policy/modules/kernel/devices.fc --- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/devices.fc 2007-08-01 10:54:59.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/devices.fc 2007-08-03 14:06:26.000000000 -0400 @@ -12,6 +12,7 @@ /dev/atibm -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/audio.* -c gen_context(system_u:object_r:sound_device_t,s0) @@ -2400,9 +2479,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device +/etc/udev/devices -d gen_context(system_u:object_r:device_t,s0) +/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.0.4/policy/modules/kernel/devices.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.0.5/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/devices.if 2007-08-01 10:56:52.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/devices.if 2007-08-03 14:06:26.000000000 -0400 @@ -2803,6 +2803,24 @@ ######################################## @@ -2428,9 +2507,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device ## Do not audit attempts to get the attributes ## of a directory in the usb filesystem. ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.4/policy/modules/kernel/domain.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.5/policy/modules/kernel/domain.if --- nsaserefpolicy/policy/modules/kernel/domain.if 2007-06-19 16:23:34.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/domain.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/domain.if 2007-08-03 14:06:26.000000000 -0400 @@ -45,6 +45,11 @@ # start with basic domain domain_base_type($1) @@ -2472,9 +2551,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain + + allow $1 domain:association { sendto recvfrom }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.4/policy/modules/kernel/domain.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.5/policy/modules/kernel/domain.te --- nsaserefpolicy/policy/modules/kernel/domain.te 2007-07-25 10:37:36.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/domain.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/domain.te 2007-08-03 14:06:26.000000000 -0400 @@ -6,6 +6,29 @@ # Declarations # @@ -2531,9 +2610,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain + ipsec_labeled(domain) + ') +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.4/policy/modules/kernel/files.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.5/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/files.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/files.if 2007-08-03 14:06:26.000000000 -0400 @@ -343,8 +343,7 @@ ######################################## @@ -2713,20 +2792,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. + allow $1 root_t:dir rw_dir_perms; + allow $1 root_t:file { create getattr write }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.0.4/policy/modules/kernel/files.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.0.5/policy/modules/kernel/files.te --- nsaserefpolicy/policy/modules/kernel/files.te 2007-07-25 10:37:36.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/files.te 2007-07-31 13:52:33.000000000 -0400 -@@ -55,6 +55,7 @@ ++++ serefpolicy-3.0.5/policy/modules/kernel/files.te 2007-08-03 14:06:26.000000000 -0400 +@@ -55,6 +55,8 @@ # compatibility aliases for removed types: typealias etc_t alias automount_etc_t; typealias etc_t alias snmpd_etc_t; +typealias etc_t alias gconf_etc_t; ++typealias etc_t alias soundd_etc_t; # # etc_runtime_t is the type of various -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.0.4/policy/modules/kernel/filesystem.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.0.5/policy/modules/kernel/filesystem.if --- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/filesystem.if 2007-07-31 16:40:44.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/filesystem.if 2007-08-03 14:06:26.000000000 -0400 @@ -1192,6 +1192,24 @@ ######################################## @@ -2804,9 +2884,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy + rw_files_pattern($1,anon_inodefs_t,anon_inodefs_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.4/policy/modules/kernel/filesystem.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.5/policy/modules/kernel/filesystem.te --- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-07-25 10:37:36.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/filesystem.te 2007-07-31 16:40:53.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/filesystem.te 2007-08-03 14:06:26.000000000 -0400 @@ -43,6 +43,12 @@ # # Non-persistent/pseudo filesystems @@ -2828,9 +2908,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy # Use a transition SID based on the allocating task SID and the # filesystem SID to label inodes in the following filesystem types, -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.4/policy/modules/kernel/kernel.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.5/policy/modules/kernel/kernel.if --- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/kernel.if 2007-08-01 13:05:42.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/kernel.if 2007-08-03 14:06:26.000000000 -0400 @@ -108,6 +108,24 @@ ######################################## @@ -2884,9 +2964,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ## Do not audit attempts to list unlabeled directories. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.0.4/policy/modules/kernel/kernel.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.0.5/policy/modules/kernel/kernel.te --- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-07-25 10:37:36.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/kernel.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/kernel.te 2007-08-03 14:06:26.000000000 -0400 @@ -26,9 +26,6 @@ role staff_r; role user_r; @@ -2905,9 +2985,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-3.0.4/policy/modules/kernel/mls.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-3.0.5/policy/modules/kernel/mls.if --- nsaserefpolicy/policy/modules/kernel/mls.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/mls.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/mls.if 2007-08-03 14:06:26.000000000 -0400 @@ -154,6 +154,26 @@ ######################################## ## @@ -2935,9 +3015,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if ## for writing to sockets at any level. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-3.0.4/policy/modules/kernel/mls.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-3.0.5/policy/modules/kernel/mls.te --- nsaserefpolicy/policy/modules/kernel/mls.te 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/mls.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/mls.te 2007-08-03 14:06:26.000000000 -0400 @@ -18,6 +18,7 @@ attribute mlsnetreadtoclr; attribute mlsnetwrite; @@ -2955,62 +3035,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te attribute mlstrustedobject; attribute privrangetrans; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.0.4/policy/modules/kernel/selinux.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.0.5/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/selinux.if 2007-07-25 13:27:51.000000000 -0400 -@@ -32,20 +32,21 @@ - - ######################################## - ## --## Get the attributes of the selinuxfs filesystem -+## Do not audit attempts to get the -+## attributes of the selinuxfs directory. - ## - ## - ## --## Domain allowed access. -+## Domain to not audit. - ## - ## - # --interface(`selinux_getattr_fs',` -+interface(`selinux_dontaudit_getattr_dir',` - gen_require(` - type security_t; - ') - -- allow $1 security_t:filesystem getattr; -+ dontaudit $1 security_t:dir getattr; - ') - - ######################################## -@@ -69,8 +70,8 @@ - - ######################################## - ## --## Do not audit attempts to get the --## attributes of the selinuxfs directory. -+## Allow domain to get the -+## attributes of the selinuxfs filesystem - ## - ## - ## -@@ -78,12 +79,12 @@ - ## - ## - # --interface(`selinux_dontaudit_getattr_dir',` -+interface(`selinux_getattr_fs',` - gen_require(` - type security_t; - ') - -- dontaudit $1 security_t:dir getattr; -+ allow $1 security_t:filesystem getattr; - ') - - ######################################## -@@ -138,6 +139,7 @@ ++++ serefpolicy-3.0.5/policy/modules/kernel/selinux.if 2007-08-03 14:06:26.000000000 -0400 +@@ -138,6 +138,7 @@ type security_t; ') @@ -3018,7 +3046,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu dontaudit $1 security_t:dir search_dir_perms; dontaudit $1 security_t:file { getattr read }; ') -@@ -159,6 +161,7 @@ +@@ -159,6 +160,7 @@ type security_t; ') @@ -3026,9 +3054,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu allow $1 security_t:dir list_dir_perms; allow $1 security_t:file { getattr read }; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.0.4/policy/modules/kernel/storage.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.0.5/policy/modules/kernel/storage.fc --- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/storage.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/storage.fc 2007-08-03 14:06:26.000000000 -0400 @@ -23,6 +23,7 @@ /dev/loop.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/lvm -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) @@ -3037,9 +3065,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag /dev/mmcblk.* -b gen_context(system_u:object_r:removable_device_t,s0) /dev/nb[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.0.4/policy/modules/kernel/storage.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.0.5/policy/modules/kernel/storage.if --- nsaserefpolicy/policy/modules/kernel/storage.if 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/storage.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/storage.if 2007-08-03 14:06:26.000000000 -0400 @@ -100,6 +100,7 @@ dev_list_all_dev_nodes($1) @@ -3056,9 +3084,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag typeattribute $1 fixed_disk_raw_write; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.0.4/policy/modules/kernel/terminal.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.0.5/policy/modules/kernel/terminal.fc --- nsaserefpolicy/policy/modules/kernel/terminal.fc 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/terminal.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/terminal.fc 2007-08-03 14:06:26.000000000 -0400 @@ -8,6 +8,7 @@ /dev/dcbri[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0) /dev/hvc.* -c gen_context(system_u:object_r:tty_device_t,s0) @@ -3067,9 +3095,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin /dev/ircomm[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0) /dev/ip2[^/]* -c gen_context(system_u:object_r:tty_device_t,s0) /dev/isdn.* -c gen_context(system_u:object_r:tty_device_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.0.4/policy/modules/kernel/terminal.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.0.5/policy/modules/kernel/terminal.te --- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-07-25 10:37:36.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/kernel/terminal.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/kernel/terminal.te 2007-08-03 14:06:26.000000000 -0400 @@ -28,9 +28,15 @@ type devpts_t; files_mountpoint(devpts_t) @@ -3097,9 +3125,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin # # usbtty_device_t is the type of /dev/usr/tty* # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.0.4/policy/modules/services/amavis.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.0.5/policy/modules/services/amavis.te --- nsaserefpolicy/policy/modules/services/amavis.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/amavis.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/amavis.te 2007-08-03 14:06:26.000000000 -0400 @@ -166,6 +166,7 @@ optional_policy(` @@ -3108,9 +3136,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.4/policy/modules/services/apache.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.5/policy/modules/services/apache.fc --- nsaserefpolicy/policy/modules/services/apache.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/apache.fc 2007-07-26 14:42:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/apache.fc 2007-08-03 14:06:26.000000000 -0400 @@ -16,7 +16,6 @@ /usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0) @@ -3134,9 +3162,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +#viewvc file context +/var/spool/viewvc(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t, s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.0.4/policy/modules/services/apache.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.0.5/policy/modules/services/apache.if --- nsaserefpolicy/policy/modules/services/apache.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/apache.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/apache.if 2007-08-03 14:06:26.000000000 -0400 @@ -18,10 +18,6 @@ attribute httpd_script_exec_type; type httpd_t, httpd_suexec_t, httpd_log_t; @@ -3433,9 +3461,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + + dontaudit $1 httpd_bugzilla_script_t:unix_stream_socket { read write }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.4/policy/modules/services/apache.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.5/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/apache.te 2007-07-31 16:48:18.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/apache.te 2007-08-03 14:06:26.000000000 -0400 @@ -30,6 +30,13 @@ ## @@ -3827,7 +3855,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac # httpd_rotatelogs local policy # -@@ -728,3 +893,26 @@ +@@ -728,3 +893,27 @@ logging_search_logs(httpd_rotatelogs_t) miscfiles_read_localization(httpd_rotatelogs_t) @@ -3850,18 +3878,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + +optional_policy(` + dbus_system_bus_client_template(httpd,httpd_t) ++ dbus_send_system_bus(httpd_t) + tunable_policy(`allow_httpd_dbus_avahi',` + avahi_dbus_chat(httpd_t) + ') +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-3.0.4/policy/modules/services/apcupsd.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-3.0.5/policy/modules/services/apcupsd.fc --- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/apcupsd.fc 2007-07-30 11:44:31.000000000 -0400 -@@ -1,9 +1,11 @@ --ifdef(`distro_debian',` --/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0) --') -- ++++ serefpolicy-3.0.5/policy/modules/services/apcupsd.fc 2007-08-03 14:06:26.000000000 -0400 +@@ -5,5 +5,11 @@ /usr/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0) /var/log/apcupsd\.events.* -- gen_context(system_u:object_r:apcupsd_log_t,s0) @@ -3873,9 +3898,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +/var/www/apcupsd/upsfstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) +/var/www/apcupsd/upsimage.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) +/var/www/apcupsd/upsstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.0.4/policy/modules/services/apcupsd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.0.5/policy/modules/services/apcupsd.if --- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/apcupsd.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/apcupsd.if 2007-08-03 14:06:26.000000000 -0400 @@ -79,3 +79,25 @@ allow $1 apcupsd_log_t:dir list_dir_perms; allow $1 apcupsd_log_t:file { getattr append }; @@ -3902,9 +3927,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu + allow httpd_apcupsd_cgi_script_t $1:fifo_file rw_file_perms; + allow httpd_apcupsd_cgi_script_t $1:process sigchld; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.4/policy/modules/services/apcupsd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.5/policy/modules/services/apcupsd.te --- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/apcupsd.te 2007-07-31 14:08:18.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/apcupsd.te 2007-08-03 14:06:26.000000000 -0400 @@ -16,6 +16,9 @@ type apcupsd_log_t; logging_log_file(apcupsd_log_t) @@ -4005,9 +4030,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +corenet_udp_sendrecv_all_nodes(httpd_apcupsd_cgi_script_t) +corenet_udp_sendrecv_all_ports(httpd_apcupsd_cgi_script_t) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.4/policy/modules/services/audioentropy.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.5/policy/modules/services/audioentropy.te --- nsaserefpolicy/policy/modules/services/audioentropy.te 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/audioentropy.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/audioentropy.te 2007-08-03 14:06:26.000000000 -0400 @@ -18,7 +18,7 @@ # Local policy # @@ -4026,9 +4051,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audi dev_read_sound(entropyd_t) fs_getattr_all_fs(entropyd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.4/policy/modules/services/automount.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.5/policy/modules/services/automount.te --- nsaserefpolicy/policy/modules/services/automount.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/automount.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/automount.te 2007-08-03 14:06:26.000000000 -0400 @@ -69,6 +69,7 @@ files_mounton_all_mountpoints(automount_t) files_mount_all_file_type_fs(automount_t) @@ -4056,9 +4081,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto bind_search_cache(automount_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.0.4/policy/modules/services/avahi.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.0.5/policy/modules/services/avahi.te --- nsaserefpolicy/policy/modules/services/avahi.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/avahi.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/avahi.te 2007-08-03 14:06:26.000000000 -0400 @@ -57,6 +57,7 @@ fs_getattr_all_fs(avahi_t) @@ -4067,9 +4092,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah domain_use_interactive_fds(avahi_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.4/policy/modules/services/bind.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.5/policy/modules/services/bind.fc --- nsaserefpolicy/policy/modules/services/bind.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/bind.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/bind.fc 2007-08-03 14:06:26.000000000 -0400 @@ -45,4 +45,6 @@ /var/named/chroot/var/named/slaves(/.*)? gen_context(system_u:object_r:named_cache_t,s0) /var/named/chroot/var/named/data(/.*)? gen_context(system_u:object_r:named_cache_t,s0) @@ -4077,9 +4102,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind +/var/named/dynamic(/.*)? gen_context(system_u:object_r:named_cache_t,s0) +/var/named/chroot/var/named/dynamic(/.*)? gen_context(system_u:object_r:named_cache_t,s0) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.4/policy/modules/services/bind.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.5/policy/modules/services/bind.te --- nsaserefpolicy/policy/modules/services/bind.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/bind.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/bind.te 2007-08-03 14:06:26.000000000 -0400 @@ -119,6 +119,11 @@ corenet_sendrecv_dns_client_packets(named_t) corenet_sendrecv_rndc_server_packets(named_t) @@ -4100,10 +4125,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind corenet_sendrecv_rndc_client_packets(ndc_t) fs_getattr_xattr_fs(ndc_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.0.4/policy/modules/services/bluetooth.te ---- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/bluetooth.te 2007-07-25 13:27:51.000000000 -0400 -@@ -134,6 +134,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.0.5/policy/modules/services/bluetooth.te +--- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-08-02 08:17:27.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/bluetooth.te 2007-08-03 14:06:26.000000000 -0400 +@@ -128,6 +128,7 @@ dbus_system_bus_client_template(bluetooth,bluetooth_t) dbus_connect_system_bus(bluetooth_t) dbus_send_system_bus(bluetooth_t) @@ -4111,60 +4136,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue ') optional_policy(` -@@ -196,26 +197,26 @@ - - sysnet_read_config(bluetooth_helper_t) - --ifdef(`targeted_policy',` -- files_rw_generic_tmp_sockets(bluetooth_helper_t) -- files_manage_generic_tmp_files(bluetooth_helper_t) -+files_rw_generic_tmp_sockets(bluetooth_helper_t) -+files_manage_generic_tmp_files(bluetooth_helper_t) - -- fs_rw_tmpfs_files(bluetooth_helper_t) -+fs_rw_tmpfs_files(bluetooth_helper_t) - -- unconfined_stream_connect(bluetooth_helper_t) -+userdom_manage_generic_user_home_content_files(bluetooth_helper_t) - -- userdom_manage_generic_user_home_content_files(bluetooth_helper_t) -+optional_policy(` -+ unconfined_stream_connect(bluetooth_helper_t) -+') - -- optional_policy(` -- corenet_tcp_connect_xserver_port(bluetooth_helper_t) -- #Bugzilla https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=205956 -- xserver_read_xdm_tmp_files(bluetooth_helper_t) -- xserver_stream_connect_xdm(bluetooth_helper_t) -- xserver_use_xdm_fds(bluetooth_helper_t) -- xserver_rw_xdm_pipes(bluetooth_helper_t) -- # when started via startx -- xserver_stream_connect_xdm_xserver(bluetooth_helper_t) -- ') -+optional_policy(` -+ corenet_tcp_connect_xserver_port(bluetooth_helper_t) -+ #Bugzilla https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=205956 -+ xserver_read_xdm_tmp_files(bluetooth_helper_t) -+ xserver_stream_connect_xdm(bluetooth_helper_t) -+ xserver_use_xdm_fds(bluetooth_helper_t) -+ xserver_rw_xdm_pipes(bluetooth_helper_t) -+ # when started via startx -+ xserver_stream_connect_xdm_xserver(bluetooth_helper_t) - ') - - optional_policy(` -@@ -232,3 +233,7 @@ - optional_policy(` - ppp_domtrans(bluetooth_t) - ') -+ -+optional_policy(` -+ xserver_stream_connect_xdm(bluetooth_helper_t) -+') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.fc serefpolicy-3.0.4/policy/modules/services/clamav.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.fc serefpolicy-3.0.5/policy/modules/services/clamav.fc --- nsaserefpolicy/policy/modules/services/clamav.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/clamav.fc 2007-08-01 11:30:09.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/clamav.fc 2007-08-03 14:06:26.000000000 -0400 @@ -9,6 +9,8 @@ /var/run/amavis(d)?/clamd\.pid -- gen_context(system_u:object_r:clamd_var_run_t,s0) @@ -4174,9 +4148,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam /var/lib/clamav(/.*)? gen_context(system_u:object_r:clamd_var_lib_t,s0) /var/log/clamav -d gen_context(system_u:object_r:clamd_var_log_t,s0) /var/log/clamav/clamav.* -- gen_context(system_u:object_r:clamd_var_log_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.4/policy/modules/services/clamav.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.5/policy/modules/services/clamav.te --- nsaserefpolicy/policy/modules/services/clamav.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/clamav.te 2007-08-01 11:29:41.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/clamav.te 2007-08-03 14:06:26.000000000 -0400 @@ -74,17 +74,19 @@ manage_files_pattern(clamd_t,clamd_var_lib_t,clamd_var_lib_t) @@ -4222,9 +4196,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam +optional_policy(` + mailscanner_manage_spool(clamscan_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.4/policy/modules/services/consolekit.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.5/policy/modules/services/consolekit.te --- nsaserefpolicy/policy/modules/services/consolekit.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/consolekit.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/consolekit.te 2007-08-03 14:06:26.000000000 -0400 @@ -10,7 +10,6 @@ type consolekit_exec_t; init_daemon_domain(consolekit_t, consolekit_exec_t) @@ -4283,9 +4257,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons + unconfined_ptrace(consolekit_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.4/policy/modules/services/courier.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.5/policy/modules/services/courier.te --- nsaserefpolicy/policy/modules/services/courier.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/courier.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/courier.te 2007-08-03 14:06:26.000000000 -0400 @@ -58,6 +58,7 @@ files_getattr_tmp_dirs(courier_authdaemon_t) @@ -4294,9 +4268,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cour libs_read_lib_files(courier_authdaemon_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.4/policy/modules/services/cron.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.5/policy/modules/services/cron.fc --- nsaserefpolicy/policy/modules/services/cron.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/cron.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/cron.fc 2007-08-03 14:06:26.000000000 -0400 @@ -17,6 +17,8 @@ /var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0) /var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) @@ -4311,9 +4285,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron /var/spool/fcron/systab -- gen_context(system_u:object_r:system_cron_spool_t,s0) /var/spool/fcron/new\.systab -- gen_context(system_u:object_r:system_cron_spool_t,s0) +/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.4/policy/modules/services/cron.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.5/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/cron.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/cron.if 2007-08-03 14:06:26.000000000 -0400 @@ -35,6 +35,7 @@ # template(`cron_per_role_template',` @@ -4461,9 +4435,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ## Read, and write cron daemon TCP sockets. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.4/policy/modules/services/cron.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.5/policy/modules/services/cron.te --- nsaserefpolicy/policy/modules/services/cron.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/cron.te 2007-08-01 13:12:46.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/cron.te 2007-08-03 14:06:26.000000000 -0400 @@ -50,6 +50,7 @@ type crond_tmp_t; @@ -4651,50 +4625,34 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron mrtg_append_create_logs(system_crond_t) ') -@@ -414,6 +471,10 @@ +@@ -424,8 +481,7 @@ ') optional_policy(` -+ readahead_domtrans(system_crond_t) -+') -+ -+optional_policy(` - samba_read_config(system_crond_t) - samba_read_log(system_crond_t) - #samba_read_secrets(system_crond_t) -@@ -424,6 +485,10 @@ +- # cjp: why? +- squid_domtrans(system_crond_t) ++ spamassassin_manage_lib_files(system_crond_t) ') optional_policy(` -+ spamassassin_manage_lib_files(system_crond_t) -+') -+ -+optional_policy(` - # cjp: why? - squid_domtrans(system_crond_t) - ') -@@ -433,9 +498,17 @@ +@@ -433,9 +489,13 @@ ') optional_policy(` - unconfined_domain(system_crond_t) -+ tmpreaper_domtrans(system_crond_t) -+') - -+optional_policy(` + unconfined_dbus_send(crond_t) + unconfined_shell_domtrans(crond_t) +') -+ + +optional_policy(` userdom_priveleged_home_dir_manager(system_crond_t) + unconfined_domain(system_crond_t) ') ifdef(`TODO',` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.4/policy/modules/services/cups.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.5/policy/modules/services/cups.fc --- nsaserefpolicy/policy/modules/services/cups.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/cups.fc 2007-07-31 13:36:05.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/cups.fc 2007-08-03 14:06:26.000000000 -0400 @@ -8,6 +8,7 @@ /etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -4717,9 +4675,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups /var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) +/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.4/policy/modules/services/cups.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.5/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/cups.te 2007-07-31 16:41:22.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/cups.te 2007-08-03 14:06:26.000000000 -0400 @@ -81,12 +81,11 @@ # /usr/lib/cups/backend/serial needs sys_admin(?!) allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config }; @@ -4897,9 +4855,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups optional_policy(` seutil_sigchld_newrole(hplip_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.4/policy/modules/services/cvs.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.5/policy/modules/services/cvs.te --- nsaserefpolicy/policy/modules/services/cvs.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/cvs.te 2007-07-25 14:08:45.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/cvs.te 2007-08-03 14:06:26.000000000 -0400 @@ -16,6 +16,7 @@ type cvs_t; type cvs_exec_t; @@ -4924,9 +4882,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs. miscfiles_read_localization(cvs_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.0.4/policy/modules/services/dbus.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.0.5/policy/modules/services/dbus.fc --- nsaserefpolicy/policy/modules/services/dbus.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/dbus.fc 2007-07-26 15:13:25.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/dbus.fc 2007-08-03 14:06:26.000000000 -0400 @@ -5,6 +5,8 @@ /bin/dbus-daemon -- gen_context(system_u:object_r:system_dbusd_exec_t,s0) /var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0) @@ -4936,9 +4894,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ifdef(`distro_redhat',` /var/named/chroot/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.4/policy/modules/services/dbus.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.5/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/dbus.if 2007-07-26 15:16:07.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/dbus.if 2007-08-03 14:06:26.000000000 -0400 @@ -50,6 +50,12 @@ ## # @@ -5066,9 +5024,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus +') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.0.4/policy/modules/services/dbus.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.0.5/policy/modules/services/dbus.te --- nsaserefpolicy/policy/modules/services/dbus.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/dbus.te 2007-07-26 15:12:13.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/dbus.te 2007-08-03 14:06:26.000000000 -0400 @@ -23,6 +23,9 @@ type system_dbusd_var_run_t; files_pid_file(system_dbusd_var_run_t) @@ -5088,9 +5046,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus manage_files_pattern(system_dbusd_t,system_dbusd_var_run_t,system_dbusd_var_run_t) manage_sock_files_pattern(system_dbusd_t,system_dbusd_var_run_t,system_dbusd_var_run_t) files_pid_filetrans(system_dbusd_t,system_dbusd_var_run_t,file) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.0.4/policy/modules/services/dhcp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.0.5/policy/modules/services/dhcp.te --- nsaserefpolicy/policy/modules/services/dhcp.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/dhcp.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/dhcp.te 2007-08-03 14:06:26.000000000 -0400 @@ -114,6 +114,8 @@ dbus_system_bus_client_template(dhcpd,dhcpd_t) dbus_connect_system_bus(dhcpd_t) @@ -5100,9 +5058,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.4/policy/modules/services/dovecot.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.5/policy/modules/services/dovecot.fc --- nsaserefpolicy/policy/modules/services/dovecot.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/dovecot.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/dovecot.fc 2007-08-03 14:06:26.000000000 -0400 @@ -17,16 +17,19 @@ ifdef(`distro_debian', ` @@ -5123,9 +5081,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove /var/lib/dovecot(/.*)? gen_context(system_u:object_r:dovecot_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.4/policy/modules/services/dovecot.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.5/policy/modules/services/dovecot.if --- nsaserefpolicy/policy/modules/services/dovecot.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/dovecot.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/dovecot.if 2007-08-03 14:06:26.000000000 -0400 @@ -18,3 +18,43 @@ manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t) manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t) @@ -5170,9 +5128,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + domtrans_pattern($1,dovecot_deliver_exec_t,dovecot_deliver_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.4/policy/modules/services/dovecot.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.5/policy/modules/services/dovecot.te --- nsaserefpolicy/policy/modules/services/dovecot.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/dovecot.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/dovecot.te 2007-08-03 14:06:26.000000000 -0400 @@ -15,6 +15,12 @@ domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t) role system_r types dovecot_auth_t; @@ -5312,9 +5270,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove +optional_policy(` + mta_manage_spool(dovecot_deliver_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.4/policy/modules/services/ftp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.5/policy/modules/services/ftp.te --- nsaserefpolicy/policy/modules/services/ftp.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/ftp.te 2007-07-25 16:26:05.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/ftp.te 2007-08-03 14:06:26.000000000 -0400 @@ -88,6 +88,7 @@ allow ftpd_t self:unix_stream_socket create_stream_socket_perms; allow ftpd_t self:tcp_socket create_stream_socket_perms; @@ -5356,10 +5314,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. ') tunable_policy(`ftp_home_dir && use_nfs_home_dirs',` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.4/policy/modules/services/hal.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.5/policy/modules/services/hal.fc --- nsaserefpolicy/policy/modules/services/hal.fc 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/hal.fc 2007-07-25 13:27:51.000000000 -0400 -@@ -8,9 +8,14 @@ ++++ serefpolicy-3.0.5/policy/modules/services/hal.fc 2007-08-03 14:45:56.000000000 -0400 +@@ -8,9 +8,15 @@ /usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) /usr/sbin/hald -- gen_context(system_u:object_r:hald_exec_t,s0) @@ -5368,15 +5326,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. /var/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0) /var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0) ++/var/lib/PolicyKit(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0) /var/run/haldaemon.pid -- gen_context(system_u:object_r:hald_var_run_t,s0) +/var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0) + +/var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.0.4/policy/modules/services/hal.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.0.5/policy/modules/services/hal.if --- nsaserefpolicy/policy/modules/services/hal.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/hal.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/hal.if 2007-08-03 14:06:26.000000000 -0400 @@ -208,3 +208,98 @@ files_search_pids($1) allow $1 hald_var_run_t:file rw_file_perms; @@ -5476,9 +5435,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. + allow $1 hald_t:process ptrace; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.4/policy/modules/services/hal.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.5/policy/modules/services/hal.te --- nsaserefpolicy/policy/modules/services/hal.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/hal.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/hal.te 2007-08-03 14:48:58.000000000 -0400 @@ -22,6 +22,12 @@ type hald_log_t; files_type(hald_log_t) @@ -5553,7 +5512,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. ') optional_policy(` -@@ -296,7 +314,10 @@ +@@ -283,6 +301,7 @@ + # + + allow hald_acl_t self:capability { dac_override fowner }; ++allow hald_acl_t self:process signal; + allow hald_acl_t self:fifo_file read_fifo_file_perms; + + domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t) +@@ -296,7 +315,10 @@ corecmd_exec_bin(hald_acl_t) dev_getattr_all_chr_files(hald_acl_t) @@ -5564,7 +5531,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. dev_setattr_sound_dev(hald_acl_t) dev_setattr_generic_usb_dev(hald_acl_t) dev_setattr_usbfs_files(hald_acl_t) -@@ -358,3 +379,25 @@ +@@ -358,3 +380,25 @@ libs_use_shared_libs(hald_sonypic_t) miscfiles_read_localization(hald_sonypic_t) @@ -5590,9 +5557,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. +miscfiles_read_localization(hald_keymap_t) + +dev_rw_input_dev(hald_keymap_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.4/policy/modules/services/inetd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.5/policy/modules/services/inetd.te --- nsaserefpolicy/policy/modules/services/inetd.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/inetd.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/inetd.te 2007-08-03 14:06:26.000000000 -0400 @@ -80,16 +80,21 @@ corenet_udp_bind_comsat_port(inetd_t) corenet_tcp_bind_dbskkd_port(inetd_t) @@ -5662,9 +5629,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet unconfined_domain(inetd_child_t) + inetd_service_domain(inetd_child_t,bin_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.4/policy/modules/services/kerberos.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.5/policy/modules/services/kerberos.te --- nsaserefpolicy/policy/modules/services/kerberos.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/kerberos.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/kerberos.te 2007-08-03 14:06:26.000000000 -0400 @@ -91,6 +91,7 @@ kernel_read_kernel_sysctls(kadmind_t) kernel_list_proc(kadmind_t) @@ -5699,9 +5666,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t) userdom_dontaudit_search_sysadm_home_dirs(krb5kdc_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.4/policy/modules/services/lpd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.5/policy/modules/services/lpd.if --- nsaserefpolicy/policy/modules/services/lpd.if 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/lpd.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/lpd.if 2007-08-03 14:06:26.000000000 -0400 @@ -394,3 +394,22 @@ domtrans_pattern($2, lpr_exec_t, $1_lpr_t) @@ -5725,9 +5692,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd. + + can_exec($1,lpr_exec_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.4/policy/modules/services/mailman.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.5/policy/modules/services/mailman.te --- nsaserefpolicy/policy/modules/services/mailman.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/mailman.te 2007-07-25 14:09:02.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/mailman.te 2007-08-03 14:06:26.000000000 -0400 @@ -96,6 +96,7 @@ kernel_read_proc_symlinks(mailman_queue_t) @@ -5736,15 +5703,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail files_dontaudit_search_pids(mailman_queue_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.4/policy/modules/services/mailscanner.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.5/policy/modules/services/mailscanner.fc --- nsaserefpolicy/policy/modules/services/mailscanner.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/services/mailscanner.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/mailscanner.fc 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,2 @@ +/var/spool/MailScanner(/.*)? gen_context(system_u:object_r:mailscanner_spool_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.4/policy/modules/services/mailscanner.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.5/policy/modules/services/mailscanner.if --- nsaserefpolicy/policy/modules/services/mailscanner.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/services/mailscanner.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/mailscanner.if 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,59 @@ +## Anti-Virus and Anti-Spam Filter + @@ -5805,18 +5772,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail + files_search_spool($1) + manage_files_pattern($1,mailscanner_spool_t,mailscanner_spool_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.4/policy/modules/services/mailscanner.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.5/policy/modules/services/mailscanner.te --- nsaserefpolicy/policy/modules/services/mailscanner.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/services/mailscanner.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/mailscanner.te 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,5 @@ + +policy_module(mailscanner,1.0.0) + +type mailscanner_spool_t; +files_type(mailscanner_spool_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.4/policy/modules/services/mta.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.5/policy/modules/services/mta.if --- nsaserefpolicy/policy/modules/services/mta.if 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/mta.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/mta.if 2007-08-03 14:06:26.000000000 -0400 @@ -392,6 +392,7 @@ allow $1 mail_spool_t:dir list_dir_perms; create_files_pattern($1,mail_spool_t,mail_spool_t) @@ -5825,9 +5792,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. create_lnk_files_pattern($1,mail_spool_t,mail_spool_t) read_lnk_files_pattern($1,mail_spool_t,mail_spool_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.4/policy/modules/services/mta.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.5/policy/modules/services/mta.te --- nsaserefpolicy/policy/modules/services/mta.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/mta.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/mta.te 2007-08-03 14:06:26.000000000 -0400 @@ -52,15 +52,44 @@ userdom_use_sysadm_terms(system_mail_t) userdom_dontaudit_search_sysadm_home_dirs(system_mail_t) @@ -5881,9 +5848,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. cron_dontaudit_write_pipes(system_mail_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.0.4/policy/modules/services/networkmanager.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.0.5/policy/modules/services/nagios.fc +--- nsaserefpolicy/policy/modules/services/nagios.fc 2007-05-29 14:10:57.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/nagios.fc 2007-08-03 14:06:26.000000000 -0400 +@@ -4,8 +4,8 @@ + /usr/bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0) + /usr/bin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0) + +-/usr/lib(64)?/cgi-bin/netsaint/.+ -- gen_context(system_u:object_r:nagios_cgi_exec_t,s0) +-/usr/lib(64)?/nagios/cgi/.+ -- gen_context(system_u:object_r:nagios_cgi_exec_t,s0) ++/usr/lib(64)?/cgi-bin/netsaint(/.*)? gen_context(system_u:object_r:nagios_cgi_exec_t,s0) ++/usr/lib(64)?/nagios/cgi(/.*)? gen_context(system_u:object_r:nagios_cgi_exec_t,s0) + + /var/log/nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) + /var/log/netsaint(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.0.5/policy/modules/services/networkmanager.fc --- nsaserefpolicy/policy/modules/services/networkmanager.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/networkmanager.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/networkmanager.fc 2007-08-03 14:06:26.000000000 -0400 @@ -1,5 +1,6 @@ /usr/(s)?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) @@ -5891,9 +5872,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw /var/run/NetworkManager\.pid -- gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.4/policy/modules/services/networkmanager.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.5/policy/modules/services/networkmanager.te --- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/networkmanager.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/networkmanager.te 2007-08-03 14:06:26.000000000 -0400 @@ -41,6 +41,8 @@ kernel_read_kernel_sysctls(NetworkManager_t) kernel_load_module(NetworkManager_t) @@ -5931,9 +5912,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw # Read gnome-keyring unconfined_read_home_content_files(NetworkManager_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.4/policy/modules/services/nis.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.5/policy/modules/services/nis.fc --- nsaserefpolicy/policy/modules/services/nis.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/nis.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/nis.fc 2007-08-03 14:06:26.000000000 -0400 @@ -4,6 +4,7 @@ /sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0) @@ -5942,9 +5923,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. /usr/sbin/rpc\.yppasswdd -- gen_context(system_u:object_r:yppasswdd_exec_t,s0) /usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.4/policy/modules/services/nis.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.5/policy/modules/services/nis.if --- nsaserefpolicy/policy/modules/services/nis.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/nis.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/nis.if 2007-08-03 14:06:26.000000000 -0400 @@ -49,8 +49,8 @@ corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) @@ -5956,9 +5937,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_dontaudit_tcp_bind_all_ports($1) corenet_dontaudit_udp_bind_all_ports($1) corenet_tcp_connect_portmap_port($1) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.4/policy/modules/services/nis.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.5/policy/modules/services/nis.te --- nsaserefpolicy/policy/modules/services/nis.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/nis.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/nis.te 2007-08-03 14:06:26.000000000 -0400 @@ -113,6 +113,14 @@ userdom_dontaudit_use_unpriv_user_fds(ypbind_t) userdom_dontaudit_search_sysadm_home_dirs(ypbind_t) @@ -6011,9 +5992,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t) corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t) corenet_tcp_connect_all_ports(ypxfr_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.4/policy/modules/services/nscd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.5/policy/modules/services/nscd.te --- nsaserefpolicy/policy/modules/services/nscd.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/nscd.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/nscd.te 2007-08-03 14:06:26.000000000 -0400 @@ -28,14 +28,14 @@ # Local policy # @@ -6062,9 +6043,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd + samba_read_config(nscd_t) + samba_read_var_files(nscd_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.0.4/policy/modules/services/ntp.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.0.5/policy/modules/services/ntp.fc --- nsaserefpolicy/policy/modules/services/ntp.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/ntp.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/ntp.fc 2007-08-03 14:06:26.000000000 -0400 @@ -17,3 +17,7 @@ /var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0) @@ -6073,9 +6054,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. +/etc/ntp/crypto(/.*)? gen_context(system_u:object_r:ntpd_key_t,s0) +/etc/ntp/keys -- gen_context(system_u:object_r:ntpd_key_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.4/policy/modules/services/ntp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.5/policy/modules/services/ntp.te --- nsaserefpolicy/policy/modules/services/ntp.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/ntp.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/ntp.te 2007-08-03 14:06:26.000000000 -0400 @@ -25,6 +25,9 @@ type ntpdate_exec_t; init_system_domain(ntpd_t,ntpdate_exec_t) @@ -6136,9 +6117,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. udev_read_db(ntpd_t) ') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-3.0.4/policy/modules/services/openvpn.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-3.0.5/policy/modules/services/openvpn.if --- nsaserefpolicy/policy/modules/services/openvpn.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/openvpn.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/openvpn.if 2007-08-03 14:06:26.000000000 -0400 @@ -22,3 +22,71 @@ read_files_pattern($1,openvpn_etc_t,openvpn_etc_t) read_lnk_files_pattern($1,openvpn_etc_t,openvpn_etc_t) @@ -6211,9 +6192,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open + + allow $1 openvpn_t:process signal; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.4/policy/modules/services/openvpn.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.5/policy/modules/services/openvpn.te --- nsaserefpolicy/policy/modules/services/openvpn.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/openvpn.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/openvpn.te 2007-08-03 14:06:26.000000000 -0400 @@ -6,6 +6,13 @@ # Declarations # @@ -6290,9 +6271,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open + unconfined_use_terminals(openvpn_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.4/policy/modules/services/pegasus.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.5/policy/modules/services/pegasus.if --- nsaserefpolicy/policy/modules/services/pegasus.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/pegasus.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/pegasus.if 2007-08-03 14:06:26.000000000 -0400 @@ -1 +1,19 @@ ## The Open Group Pegasus CIM/WBEM Server. + @@ -6313,9 +6294,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega + + domtrans_pattern($1,pegasus_exec_t,pegasus_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.4/policy/modules/services/pegasus.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.5/policy/modules/services/pegasus.te --- nsaserefpolicy/policy/modules/services/pegasus.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/pegasus.te 2007-07-25 14:09:06.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/pegasus.te 2007-08-03 14:06:26.000000000 -0400 @@ -95,13 +95,13 @@ auth_use_nsswitch(pegasus_t) @@ -6355,9 +6336,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega rpm_exec(pegasus_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.4/policy/modules/services/portslave.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.5/policy/modules/services/portslave.te --- nsaserefpolicy/policy/modules/services/portslave.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/portslave.te 2007-07-25 14:09:10.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/portslave.te 2007-08-03 14:06:26.000000000 -0400 @@ -85,6 +85,7 @@ auth_rw_login_records(portslave_t) @@ -6366,9 +6347,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port init_rw_utmp(portslave_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.4/policy/modules/services/postfix.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.5/policy/modules/services/postfix.fc --- nsaserefpolicy/policy/modules/services/postfix.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/postfix.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/postfix.fc 2007-08-03 14:06:26.000000000 -0400 @@ -14,6 +14,7 @@ /usr/libexec/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0) /usr/libexec/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0) @@ -6377,9 +6358,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ', ` /usr/lib/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0) /usr/lib/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.4/policy/modules/services/postfix.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.5/policy/modules/services/postfix.if --- nsaserefpolicy/policy/modules/services/postfix.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/postfix.if 2007-07-31 15:40:47.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/postfix.if 2007-08-03 14:06:26.000000000 -0400 @@ -41,6 +41,8 @@ allow postfix_$1_t self:unix_stream_socket connectto; @@ -6501,9 +6482,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post + allow $1 postfix_private_t:dir list_dir_perms; + create_sock_files_pattern($1,postfix_private_t,postfix_private_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.4/policy/modules/services/postfix.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.5/policy/modules/services/postfix.te --- nsaserefpolicy/policy/modules/services/postfix.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/postfix.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/postfix.te 2007-08-03 14:06:26.000000000 -0400 @@ -83,6 +83,12 @@ type postfix_var_run_t; files_pid_file(postfix_var_run_t) @@ -6643,9 +6624,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +# For reading spamassasin +mta_read_config(postfix_virtual_t) +mta_manage_spool(postfix_virtual_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.4/policy/modules/services/procmail.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.5/policy/modules/services/procmail.te --- nsaserefpolicy/policy/modules/services/procmail.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/procmail.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/procmail.te 2007-08-03 14:06:26.000000000 -0400 @@ -30,6 +30,8 @@ allow procmail_t procmail_tmp_t:file manage_file_perms; files_tmp_filetrans(procmail_t, procmail_tmp_t, file) @@ -6673,9 +6654,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc +optional_policy(` + mailscanner_read_spool(procmail_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.4/policy/modules/services/pyzor.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.5/policy/modules/services/pyzor.if --- nsaserefpolicy/policy/modules/services/pyzor.if 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/pyzor.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/pyzor.if 2007-08-03 14:06:26.000000000 -0400 @@ -25,16 +25,16 @@ # template(`pyzor_per_role_template',` @@ -6698,9 +6679,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.0.4/policy/modules/services/pyzor.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.0.5/policy/modules/services/pyzor.te --- nsaserefpolicy/policy/modules/services/pyzor.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/pyzor.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/pyzor.te 2007-08-03 14:06:26.000000000 -0400 @@ -70,6 +70,11 @@ userdom_dontaudit_search_sysadm_home_dirs(pyzor_t) @@ -6724,9 +6705,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo optional_policy(` logging_send_syslog_msg(pyzord_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.4/policy/modules/services/radius.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.5/policy/modules/services/radius.te --- nsaserefpolicy/policy/modules/services/radius.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/radius.te 2007-07-25 14:09:14.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/radius.te 2007-08-03 14:06:26.000000000 -0400 @@ -82,6 +82,7 @@ auth_read_shadow(radiusd_t) @@ -6743,9 +6724,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi sysnet_read_config(radiusd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.4/policy/modules/services/rhgb.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.5/policy/modules/services/rhgb.te --- nsaserefpolicy/policy/modules/services/rhgb.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/rhgb.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/rhgb.te 2007-08-03 14:06:26.000000000 -0400 @@ -109,6 +109,7 @@ userdom_dontaudit_use_unpriv_user_fds(rhgb_t) @@ -6754,9 +6735,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb xserver_read_xdm_xserver_tmp_files(rhgb_t) xserver_kill_xdm_xserver(rhgb_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.4/policy/modules/services/ricci.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.5/policy/modules/services/ricci.te --- nsaserefpolicy/policy/modules/services/ricci.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/ricci.te 2007-07-25 14:09:18.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/ricci.te 2007-08-03 14:06:26.000000000 -0400 @@ -138,6 +138,7 @@ files_create_boot_flag(ricci_t) @@ -6784,9 +6765,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc optional_policy(` nscd_dontaudit_search_pid(ricci_modlog_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.4/policy/modules/services/rlogin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.5/policy/modules/services/rlogin.te --- nsaserefpolicy/policy/modules/services/rlogin.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/rlogin.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/rlogin.te 2007-08-03 14:06:26.000000000 -0400 @@ -65,6 +65,7 @@ fs_search_auto_mountpoints(rlogind_t) @@ -6795,9 +6776,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog auth_rw_login_records(rlogind_t) auth_use_nsswitch(rlogind_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.4/policy/modules/services/rpcbind.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.5/policy/modules/services/rpcbind.te --- nsaserefpolicy/policy/modules/services/rpcbind.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/rpcbind.te 2007-07-25 14:28:29.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/rpcbind.te 2007-08-03 14:06:26.000000000 -0400 @@ -21,11 +21,13 @@ # rpcbind local policy # @@ -6813,9 +6794,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb allow rpcbind_t self:tcp_socket create_stream_socket_perms; manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.4/policy/modules/services/rpc.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.5/policy/modules/services/rpc.if --- nsaserefpolicy/policy/modules/services/rpc.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/rpc.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/rpc.if 2007-08-03 14:06:26.000000000 -0400 @@ -81,6 +81,7 @@ corenet_tcp_bind_all_nodes($1_t) corenet_udp_bind_all_nodes($1_t) @@ -6837,9 +6818,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. fs_rw_rpc_named_pipes($1_t) fs_search_auto_mountpoints($1_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.4/policy/modules/services/rpc.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.5/policy/modules/services/rpc.te --- nsaserefpolicy/policy/modules/services/rpc.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/rpc.te 2007-08-01 13:05:49.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/rpc.te 2007-08-03 14:06:26.000000000 -0400 @@ -59,10 +59,14 @@ manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t) files_pid_filetrans(rpcd_t,rpcd_var_run_t,file) @@ -6910,9 +6891,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. tunable_policy(`allow_gssd_read_tmp',` userdom_list_unpriv_users_tmp(gssd_t) userdom_read_unpriv_users_tmp_files(gssd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.4/policy/modules/services/rshd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.5/policy/modules/services/rshd.te --- nsaserefpolicy/policy/modules/services/rshd.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/rshd.te 2007-07-25 16:26:56.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/rshd.te 2007-08-03 14:06:26.000000000 -0400 @@ -45,6 +45,7 @@ selinux_compute_user_contexts(rshd_t) @@ -6928,9 +6909,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd - unconfined_domain(rshd_t) unconfined_shell_domtrans(rshd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.4/policy/modules/services/rsync.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.5/policy/modules/services/rsync.te --- nsaserefpolicy/policy/modules/services/rsync.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/rsync.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/rsync.te 2007-08-03 14:06:26.000000000 -0400 @@ -17,6 +17,7 @@ type rsync_t; type rsync_exec_t; @@ -6939,17 +6920,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn role system_r types rsync_t; type rsync_data_t; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-3.0.4/policy/modules/services/rwho.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-3.0.5/policy/modules/services/rwho.fc --- nsaserefpolicy/policy/modules/services/rwho.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/rwho.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/rwho.fc 2007-08-03 14:06:26.000000000 -0400 @@ -1,3 +1,4 @@ /usr/sbin/rwhod -- gen_context(system_u:object_r:rwho_exec_t,s0) /var/spool/rwho(/.*)? gen_context(system_u:object_r:rwho_spool_t,s0) +/var/log/rwhod(/.*)? gen_context(system_u:object_r:rwho_log_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-3.0.4/policy/modules/services/rwho.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-3.0.5/policy/modules/services/rwho.if --- nsaserefpolicy/policy/modules/services/rwho.if 2007-06-15 14:54:33.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/rwho.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/rwho.if 2007-08-03 14:06:26.000000000 -0400 @@ -72,6 +72,47 @@ type rwho_spool_t; ') @@ -6999,9 +6980,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho + logging_search_logs($1) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-3.0.4/policy/modules/services/rwho.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-3.0.5/policy/modules/services/rwho.te --- nsaserefpolicy/policy/modules/services/rwho.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/rwho.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/rwho.te 2007-08-03 14:06:26.000000000 -0400 @@ -10,10 +10,12 @@ type rwho_exec_t; init_daemon_domain(rwho_t, rwho_exec_t) @@ -7027,9 +7008,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho kernel_read_system_state(rwho_t) corenet_all_recvfrom_unlabeled(rwho_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.4/policy/modules/services/samba.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.5/policy/modules/services/samba.fc --- nsaserefpolicy/policy/modules/services/samba.fc 2007-06-19 16:23:34.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/samba.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/samba.fc 2007-08-03 14:06:26.000000000 -0400 @@ -30,6 +30,8 @@ /var/lib/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0) /var/lib/samba/winbindd_privileged(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0) @@ -7039,9 +7020,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb /var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0) /var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.4/policy/modules/services/samba.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.5/policy/modules/services/samba.if --- nsaserefpolicy/policy/modules/services/samba.if 2007-06-19 16:23:35.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/samba.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/samba.if 2007-08-03 14:06:26.000000000 -0400 @@ -349,6 +349,7 @@ files_search_var($1) files_search_var_lib($1) @@ -7103,9 +7084,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb + read_files_pattern($1, samba_share_t, samba_share_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.4/policy/modules/services/samba.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.5/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/samba.te 2007-07-25 16:27:22.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/samba.te 2007-08-03 14:06:26.000000000 -0400 @@ -190,6 +190,8 @@ miscfiles_read_localization(samba_net_t) @@ -7234,9 +7215,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb seutil_sigchld_newrole(winbind_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.4/policy/modules/services/sasl.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.5/policy/modules/services/sasl.te --- nsaserefpolicy/policy/modules/services/sasl.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/sasl.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/sasl.te 2007-08-03 14:06:26.000000000 -0400 @@ -64,6 +64,7 @@ selinux_compute_access_vector(saslauthd_t) @@ -7245,9 +7226,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl auth_use_nsswitch(saslauthd_t) domain_use_interactive_fds(saslauthd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.4/policy/modules/services/sendmail.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.5/policy/modules/services/sendmail.if --- nsaserefpolicy/policy/modules/services/sendmail.if 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/sendmail.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/sendmail.if 2007-08-03 14:06:26.000000000 -0400 @@ -131,3 +131,21 @@ logging_log_filetrans($1,sendmail_log_t,file) @@ -7270,9 +7251,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send + allow $1 sendmail_t:process signal; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.0.4/policy/modules/services/setroubleshoot.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.0.5/policy/modules/services/setroubleshoot.if --- nsaserefpolicy/policy/modules/services/setroubleshoot.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/setroubleshoot.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/setroubleshoot.if 2007-08-03 14:06:26.000000000 -0400 @@ -19,3 +19,22 @@ allow $1 setroubleshoot_var_run_t:sock_file write; allow $1 setroubleshootd_t:unix_stream_socket connectto; @@ -7296,9 +7277,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr + dontaudit $1 setroubleshoot_var_run_t:sock_file write; + dontaudit $1 setroubleshootd_t:unix_stream_socket connectto; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.4/policy/modules/services/setroubleshoot.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.5/policy/modules/services/setroubleshoot.te --- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/setroubleshoot.te 2007-07-31 16:16:14.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/setroubleshoot.te 2007-08-03 14:06:26.000000000 -0400 @@ -33,7 +33,6 @@ allow setroubleshootd_t self:tcp_socket create_stream_socket_perms; allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -7333,9 +7314,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr -optional_policy(` - nis_use_ypbind(setroubleshootd_t) -') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.0.4/policy/modules/services/smartmon.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.0.5/policy/modules/services/smartmon.te --- nsaserefpolicy/policy/modules/services/smartmon.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/smartmon.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/smartmon.te 2007-08-03 14:06:26.000000000 -0400 @@ -61,6 +61,7 @@ fs_search_auto_mountpoints(fsdaemon_t) @@ -7344,88 +7325,291 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar storage_raw_read_fixed_disk(fsdaemon_t) storage_raw_write_fixed_disk(fsdaemon_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.0.4/policy/modules/services/snmp.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.0.5/policy/modules/services/snmp.fc --- nsaserefpolicy/policy/modules/services/snmp.fc 2007-06-19 16:23:35.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/snmp.fc 2007-07-25 13:27:51.000000000 -0400 -@@ -1,3 +1,10 @@ -+ -+# -+# /etc -+# -+ -+/etc/snmp/snmp(trap)?d\.conf -- gen_context(system_u:object_r:snmpd_etc_t,s0) ++++ serefpolicy-3.0.5/policy/modules/services/snmp.fc 2007-08-03 14:06:26.000000000 -0400 +@@ -1,3 +1,4 @@ + # # /usr # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.0.4/policy/modules/services/spamassassin.fc ---- nsaserefpolicy/policy/modules/services/spamassassin.fc 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/spamassassin.fc 2007-07-25 13:27:51.000000000 -0400 -@@ -10,3 +10,9 @@ - /var/lib/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_lib_t,s0) - - /var/spool/spamassassin(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) -+/var/spool/spamd(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.fc serefpolicy-3.0.5/policy/modules/services/soundserver.fc +--- nsaserefpolicy/policy/modules/services/soundserver.fc 2007-05-29 14:10:57.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/soundserver.fc 2007-08-03 14:06:26.000000000 -0400 +@@ -1,10 +1,22 @@ +-/etc/nas(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) +-/etc/yiff(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) +- +-/usr/bin/nasd -- gen_context(system_u:object_r:soundd_exec_t,s0) + /usr/bin/gpe-soundserver -- gen_context(system_u:object_r:soundd_exec_t,s0) +- + /usr/sbin/yiff -- gen_context(system_u:object_r:soundd_exec_t,s0) +- + /var/run/yiff-[0-9]+\.pid -- gen_context(system_u:object_r:soundd_var_run_t,s0) + /var/state/yiff(/.*)? gen_context(system_u:object_r:soundd_state_t,s0) + -+/var/run/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) -+/var/run/spamass-milter(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) + ++# ++# Following is for nas + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.0.4/policy/modules/services/spamassassin.te ---- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/spamassassin.te 2007-07-25 13:27:51.000000000 -0400 -@@ -83,8 +83,9 @@ - allow spamd_t spamd_var_lib_t:dir list_dir_perms; - read_files_pattern(spamd_t,spamd_var_lib_t,spamd_var_lib_t) - -+manage_dirs_pattern(spamd_t,spamd_var_run_t,spamd_var_run_t) - manage_files_pattern(spamd_t,spamd_var_run_t,spamd_var_run_t) --files_pid_filetrans(spamd_t,spamd_var_run_t,file) -+files_pid_filetrans(spamd_t,spamd_var_run_t,{ file dir }) - - kernel_read_all_sysctls(spamd_t) - kernel_read_system_state(spamd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.4/policy/modules/services/squid.fc ---- nsaserefpolicy/policy/modules/services/squid.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/squid.fc 2007-07-25 13:27:51.000000000 -0400 -@@ -12,3 +12,5 @@ - /var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0) - - /var/spool/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0) -+/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) -+/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.4/policy/modules/services/squid.te ---- nsaserefpolicy/policy/modules/services/squid.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/squid.te 2007-07-25 13:27:51.000000000 -0400 -@@ -109,6 +109,8 @@ - - fs_getattr_all_fs(squid_t) - fs_search_auto_mountpoints(squid_t) -+#squid requires the following when run in diskd mode, the recommended setting -+fs_rw_tmpfs_files(squid_t) - - selinux_dontaudit_getattr_dir(squid_t) - -@@ -176,7 +178,12 @@ - udev_read_db(squid_t) ++# ++# /usr/bin ++# ++ ++/usr/bin/nasd -- gen_context(system_u:object_r:soundd_exec_t,s0) ++ ++ ++# ++# /tmp ++# ++/tmp/\.sockets -d gen_context(system_u:object_r:soundd_tmp_t,s0) ++/tmp/\.sockets/.* -s <> ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.if serefpolicy-3.0.5/policy/modules/services/soundserver.if +--- nsaserefpolicy/policy/modules/services/soundserver.if 2007-05-29 14:10:57.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/soundserver.if 2007-08-03 14:06:26.000000000 -0400 +@@ -13,3 +13,64 @@ + interface(`soundserver_tcp_connect',` + refpolicywarn(`$0($*) has been deprecated.') ') - --ifdef(`TODO',` --#squid requires the following when run in diskd mode, the recommended setting --allow squid_t tmpfs_t:file { read write }; --') dnl end TODO -+optional_policy(` -+ apache_content_template(squid) -+ corenet_tcp_connect_http_cache_port(httpd_squid_script_t) -+ squid_read_config(httpd_squid_script_t) -+ allow httpd_squid_script_t self:tcp_socket create_socket_perms; -+ sysnet_read_config(httpd_squid_script_t) ++ ++ ++######################################## ++## ++## Execute a domain transition to run soundserver. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`soundserver_domtrans',` ++ gen_require(` ++ type soundd_t, soundd_exec_t; ++ ') ++ ++ domain_auto_trans($1,soundd_exec_t,soundd_t) ++ ++ allow soundd_t $1:fd use; ++ allow soundd_t $1:fifo_file rw_file_perms; ++ allow soundd_t $1:process sigchld; ++') ++ ++######################################## ++## ++## Do not audit attempts to read, ++## soundserver tmp files ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`soundserver_dontaudit_read_tmp_files',` ++ gen_require(` ++ type soundd_tmp_t; ++ ') ++ ++ dontaudit $1 soundd_tmp_t:file r_file_perms; ++') ++ ++######################################## ++## ++## Allow domain to read, soundserver tmp files ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`soundserver_read_tmp_files',` ++ gen_require(` ++ type soundd_tmp_t; ++ ') ++ ++ dontaudit $1 soundd_tmp_t:file r_file_perms; ++') ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.te serefpolicy-3.0.5/policy/modules/services/soundserver.te +--- nsaserefpolicy/policy/modules/services/soundserver.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/soundserver.te 2007-08-03 14:06:26.000000000 -0400 +@@ -1,5 +1,5 @@ + +-policy_module(soundserver,1.3.0) ++policy_module(soundserver,1.2.1) + + ######################################## + # +@@ -10,9 +10,6 @@ + type soundd_exec_t; + init_daemon_domain(soundd_t,soundd_exec_t) + +-type soundd_etc_t alias etc_soundd_t; +-files_type(soundd_etc_t) +- + type soundd_state_t; + files_type(soundd_state_t) + +@@ -28,20 +25,34 @@ + + ######################################## + # +-# Declarations ++# sound server local policy + # + + dontaudit soundd_t self:capability sys_tty_config; + allow soundd_t self:process { setpgid signal_perms }; ++ + allow soundd_t self:tcp_socket create_stream_socket_perms; + allow soundd_t self:udp_socket create_socket_perms; ++ ++allow soundd_t self:unix_stream_socket { connectto create_stream_socket_perms }; ++manage_sock_files_pattern(soundd_t,soundd_tmp_t,soundd_tmp_t) ++files_tmp_filetrans(soundd_t, soundd_tmp_t, { file dir sock_file }) ++ ++ ++# Remove /tmp/.sockets/audio$n ++delete_files_pattern(soundd_t,soundd_tmp_t,soundd_tmp_t) ++ ++allow soundd_t self:capability { dac_override }; ++ ++fs_getattr_all_fs(soundd_t) ++ ++optional_policy(` ++ alsa_domtrans(soundd_t) ++') ++ + # for yiff + allow soundd_t self:shm create_shm_perms; + +-allow soundd_t soundd_etc_t:dir list_dir_perms; +-allow soundd_t soundd_etc_t:file read_file_perms; +-allow soundd_t soundd_etc_t:lnk_file { getattr read }; +- + manage_files_pattern(soundd_t,soundd_state_t,soundd_state_t) + manage_lnk_files_pattern(soundd_t,soundd_state_t,soundd_state_t) + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.0.5/policy/modules/services/spamassassin.fc +--- nsaserefpolicy/policy/modules/services/spamassassin.fc 2007-06-11 16:05:30.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/spamassassin.fc 2007-08-03 14:06:26.000000000 -0400 +@@ -10,3 +10,9 @@ + /var/lib/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_lib_t,s0) + + /var/spool/spamassassin(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) ++/var/spool/spamd(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) ++ ++/var/run/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) ++/var/run/spamass-milter(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) ++ ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.0.5/policy/modules/services/spamassassin.te +--- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-08-02 08:17:27.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/spamassassin.te 2007-08-03 14:06:26.000000000 -0400 +@@ -83,8 +83,9 @@ + allow spamd_t spamd_var_lib_t:dir list_dir_perms; + read_files_pattern(spamd_t,spamd_var_lib_t,spamd_var_lib_t) + ++manage_dirs_pattern(spamd_t,spamd_var_run_t,spamd_var_run_t) + manage_files_pattern(spamd_t,spamd_var_run_t,spamd_var_run_t) +-files_pid_filetrans(spamd_t,spamd_var_run_t,file) ++files_pid_filetrans(spamd_t,spamd_var_run_t,{ file dir }) + + kernel_read_all_sysctls(spamd_t) + kernel_read_system_state(spamd_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.5/policy/modules/services/squid.fc +--- nsaserefpolicy/policy/modules/services/squid.fc 2007-05-29 14:10:57.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/squid.fc 2007-08-03 14:06:26.000000000 -0400 +@@ -12,3 +12,5 @@ + /var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0) + + /var/spool/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0) ++/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) ++/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.5/policy/modules/services/squid.te +--- nsaserefpolicy/policy/modules/services/squid.te 2007-07-25 10:37:42.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/squid.te 2007-08-03 14:06:26.000000000 -0400 +@@ -36,7 +36,7 @@ + # Local policy + # + +-allow squid_t self:capability { setgid setuid dac_override sys_resource }; ++allow squid_t self:capability { setgid kill setuid dac_override sys_resource }; + dontaudit squid_t self:capability sys_tty_config; + allow squid_t self:process ~{ ptrace setcurrent setexec setfscreate execmem execstack execheap }; + allow squid_t self:fifo_file rw_fifo_file_perms; +@@ -53,6 +53,8 @@ + allow squid_t self:tcp_socket create_stream_socket_perms; + allow squid_t self:udp_socket create_socket_perms; + ++auth_use_nsswitch(squid_t) ++ + # Grant permissions to create, access, and delete cache files. + manage_dirs_pattern(squid_t,squid_cache_t,squid_cache_t) + manage_files_pattern(squid_t,squid_cache_t,squid_cache_t) +@@ -109,6 +111,8 @@ + + fs_getattr_all_fs(squid_t) + fs_search_auto_mountpoints(squid_t) ++#squid requires the following when run in diskd mode, the recommended setting ++fs_rw_tmpfs_files(squid_t) + + selinux_dontaudit_getattr_dir(squid_t) + +@@ -137,9 +141,6 @@ + miscfiles_read_certs(squid_t) + miscfiles_read_localization(squid_t) + +-sysnet_dns_name_resolve(squid_t) +-sysnet_read_config(squid_t) +- + userdom_use_unpriv_users_fds(squid_t) + userdom_dontaudit_use_unpriv_user_fds(squid_t) + userdom_dontaudit_search_sysadm_home_dirs(squid_t) +@@ -149,19 +150,7 @@ + ') + + optional_policy(` +- allow squid_t self:capability kill; +- cron_use_fds(squid_t) +- cron_use_system_job_fds(squid_t) +- cron_rw_pipes(squid_t) +- cron_write_system_job_pipes(squid_t) +-') +- +-optional_policy(` +- nis_use_ypbind(squid_t) +-') +- +-optional_policy(` +- nscd_socket_use(squid_t) ++ cron_system_entry(squid_t,squid_exec_t) + ') + + optional_policy(` +@@ -176,7 +165,12 @@ + udev_read_db(squid_t) + ') + +-ifdef(`TODO',` +-#squid requires the following when run in diskd mode, the recommended setting +-allow squid_t tmpfs_t:file { read write }; +-') dnl end TODO ++optional_policy(` ++ apache_content_template(squid) ++ corenet_tcp_connect_http_cache_port(httpd_squid_script_t) ++ squid_read_config(httpd_squid_script_t) ++ allow httpd_squid_script_t self:tcp_socket create_socket_perms; ++ sysnet_read_config(httpd_squid_script_t) + corenet_all_recvfrom_unlabeled(httpd_squid_script_t) + corenet_all_recvfrom_netlabel(httpd_squid_script_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.4/policy/modules/services/ssh.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.5/policy/modules/services/ssh.if --- nsaserefpolicy/policy/modules/services/ssh.if 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/ssh.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/ssh.if 2007-08-03 14:06:26.000000000 -0400 @@ -202,6 +202,7 @@ # template(`ssh_per_role_template',` @@ -7477,9 +7661,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. + dontaudit $2 $1_ssh_agent_t:fd use; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.4/policy/modules/services/ssh.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.5/policy/modules/services/ssh.te --- nsaserefpolicy/policy/modules/services/ssh.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/ssh.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/ssh.te 2007-08-03 14:06:26.000000000 -0400 @@ -24,7 +24,7 @@ # Type for the ssh-agent executable. @@ -7515,9 +7699,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. ') ifdef(`TODO',` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.4/policy/modules/services/uwimap.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.5/policy/modules/services/uwimap.te --- nsaserefpolicy/policy/modules/services/uwimap.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/uwimap.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/uwimap.te 2007-08-03 14:06:26.000000000 -0400 @@ -64,6 +64,7 @@ fs_search_auto_mountpoints(imapd_t) @@ -7526,20 +7710,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwim libs_use_ld_so(imapd_t) libs_use_shared_libs(imapd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.4/policy/modules/services/w3c.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.5/policy/modules/services/w3c.fc --- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/services/w3c.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/w3c.fc 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,2 @@ +/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0) +/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.4/policy/modules/services/w3c.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.5/policy/modules/services/w3c.if --- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/services/w3c.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/w3c.if 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1 @@ +## W3C -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.4/policy/modules/services/w3c.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.5/policy/modules/services/w3c.te --- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/services/w3c.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/w3c.te 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,14 @@ +policy_module(w3c,1.2.1) + @@ -7555,9 +7739,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c. +corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t) + +miscfiles_read_certs(httpd_w3c_validator_script_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.4/policy/modules/services/xserver.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.5/policy/modules/services/xserver.fc --- nsaserefpolicy/policy/modules/services/xserver.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/xserver.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/xserver.fc 2007-08-03 14:06:26.000000000 -0400 @@ -92,6 +92,7 @@ /var/log/XFree86.* -- gen_context(system_u:object_r:xserver_log_t,s0) /var/log/Xorg.* -- gen_context(system_u:object_r:xserver_log_t,s0) @@ -7566,9 +7750,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser /var/run/[gx]dm\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0) /var/run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.4/policy/modules/services/xserver.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.5/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/xserver.if 2007-07-30 10:01:38.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/xserver.if 2007-08-03 14:06:26.000000000 -0400 @@ -141,7 +141,7 @@ fs_getattr_xattr_fs($1_xserver_t) fs_search_nfs($1_xserver_t) @@ -7852,9 +8036,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser + +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.4/policy/modules/services/xserver.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.5/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/services/xserver.te 2007-07-31 10:08:15.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/services/xserver.te 2007-08-03 14:06:26.000000000 -0400 @@ -16,6 +16,13 @@ ## @@ -8009,9 +8193,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser -# -allow pam_t xdm_t:fifo_file { getattr ioctl write }; -') dnl end TODO -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.4/policy/modules/system/application.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.5/policy/modules/system/application.if --- nsaserefpolicy/policy/modules/system/application.if 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/application.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/application.if 2007-08-03 14:06:26.000000000 -0400 @@ -63,6 +63,26 @@ ######################################## @@ -8039,9 +8223,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic ## Create a domain which can be started by users ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.4/policy/modules/system/authlogin.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.5/policy/modules/system/authlogin.fc --- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/authlogin.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/authlogin.fc 2007-08-03 14:06:26.000000000 -0400 @@ -14,6 +14,7 @@ /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0) /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) @@ -8050,9 +8234,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ifdef(`distro_suse', ` /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.4/policy/modules/system/authlogin.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.5/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/authlogin.if 2007-07-27 13:58:33.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/authlogin.if 2007-08-03 14:06:26.000000000 -0400 @@ -26,7 +26,8 @@ type $1_chkpwd_t, can_read_shadow_passwords; application_domain($1_chkpwd_t,chkpwd_exec_t) @@ -8376,9 +8560,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + allow system_chkpwd_t $3:chr_file rw_file_perms; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.4/policy/modules/system/authlogin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.5/policy/modules/system/authlogin.te --- nsaserefpolicy/policy/modules/system/authlogin.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/authlogin.te 2007-07-27 13:45:53.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/authlogin.te 2007-08-03 14:06:26.000000000 -0400 @@ -9,6 +9,13 @@ attribute can_read_shadow_passwords; attribute can_write_shadow_passwords; @@ -8453,15 +8637,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +optional_policy(` + nscd_socket_use(updpwd_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.fc serefpolicy-3.0.4/policy/modules/system/brctl.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.fc serefpolicy-3.0.5/policy/modules/system/brctl.fc --- nsaserefpolicy/policy/modules/system/brctl.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/system/brctl.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/brctl.fc 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,2 @@ + +/usr/sbin/brctl -- gen_context(system_u:object_r:brctl_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.if serefpolicy-3.0.4/policy/modules/system/brctl.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.if serefpolicy-3.0.5/policy/modules/system/brctl.if --- nsaserefpolicy/policy/modules/system/brctl.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/system/brctl.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/brctl.if 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,25 @@ + +## Utilities for configuring the linux ethernet bridge @@ -8488,9 +8672,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl. + allow brctl_t $1:fifo_file rw_file_perms; + allow brctl_t $1:process sigchld; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.te serefpolicy-3.0.4/policy/modules/system/brctl.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.te serefpolicy-3.0.5/policy/modules/system/brctl.te --- nsaserefpolicy/policy/modules/system/brctl.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/system/brctl.te 2007-07-30 11:23:32.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/brctl.te 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,50 @@ +policy_module(brctl,1.0.0) + @@ -8542,9 +8726,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl. +optional_policy(` + xen_append_log(brctl_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.4/policy/modules/system/fstools.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.5/policy/modules/system/fstools.fc --- nsaserefpolicy/policy/modules/system/fstools.fc 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/fstools.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/fstools.fc 2007-08-03 14:06:26.000000000 -0400 @@ -20,7 +20,6 @@ /sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0) @@ -8553,9 +8737,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.0.4/policy/modules/system/fstools.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.0.5/policy/modules/system/fstools.if --- nsaserefpolicy/policy/modules/system/fstools.if 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/fstools.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/fstools.if 2007-08-03 14:06:26.000000000 -0400 @@ -124,3 +124,22 @@ allow $1 swapfile_t:file getattr; @@ -8579,9 +8763,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool + allow $1 fsdaemon_t:fifo_file read_fifo_file_perms; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.4/policy/modules/system/fstools.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.5/policy/modules/system/fstools.te --- nsaserefpolicy/policy/modules/system/fstools.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/fstools.te 2007-08-01 10:57:11.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/fstools.te 2007-08-03 14:06:26.000000000 -0400 @@ -9,6 +9,7 @@ type fsadm_t; type fsadm_exec_t; @@ -8607,9 +8791,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool + xen_append_log(fsadm_t) + xen_rw_image_files(fsadm_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.4/policy/modules/system/fusermount.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.5/policy/modules/system/fusermount.fc --- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/system/fusermount.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/fusermount.fc 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,7 @@ +# fusermount executable will have: +# label: system_u:object_r:fusermount_exec_t @@ -8618,9 +8802,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + +/usr/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) +/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.4/policy/modules/system/fusermount.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.5/policy/modules/system/fusermount.if --- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/system/fusermount.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/fusermount.if 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,41 @@ +## policy for fusermount + @@ -8664,10 +8848,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + allow $1 fusermount_t:fd use; +') \ No newline at end of file -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.4/policy/modules/system/fusermount.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.5/policy/modules/system/fusermount.te --- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/system/fusermount.te 2007-07-25 13:27:51.000000000 -0400 -@@ -0,0 +1,46 @@ ++++ serefpolicy-3.0.5/policy/modules/system/fusermount.te 2007-08-03 14:06:26.000000000 -0400 +@@ -0,0 +1,44 @@ +policy_module(fusermount,1.0.0) + +######################################## @@ -8710,13 +8894,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + hal_rw_pipes(fusermount_t) +') + -+optional_policy(` -+ mount_ntfs_rw_stream_sockets(fusermount_t) -+') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.4/policy/modules/system/getty.te ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.5/policy/modules/system/getty.te --- nsaserefpolicy/policy/modules/system/getty.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/getty.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/getty.te 2007-08-03 14:06:26.000000000 -0400 @@ -33,7 +33,8 @@ # @@ -8727,9 +8909,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty. dontaudit getty_t self:capability sys_tty_config; allow getty_t self:process { getpgid setpgid getsession signal_perms }; allow getty_t self:fifo_file rw_fifo_file_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.4/policy/modules/system/hostname.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.5/policy/modules/system/hostname.te --- nsaserefpolicy/policy/modules/system/hostname.te 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/hostname.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/hostname.te 2007-08-03 14:06:26.000000000 -0400 @@ -8,8 +8,12 @@ type hostname_t; @@ -8756,9 +8938,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna +optional_policy(` + unconfined_dontaudit_rw_pipes(hostname_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.4/policy/modules/system/init.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.5/policy/modules/system/init.if --- nsaserefpolicy/policy/modules/system/init.if 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/init.if 2007-07-26 13:45:02.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/init.if 2007-08-03 14:06:26.000000000 -0400 @@ -194,9 +194,13 @@ gen_require(` type initrc_t; @@ -8826,9 +9008,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i + + allow $1 init_t:process ptrace; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.4/policy/modules/system/init.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.5/policy/modules/system/init.te --- nsaserefpolicy/policy/modules/system/init.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/init.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/init.te 2007-08-03 14:06:26.000000000 -0400 @@ -10,6 +10,20 @@ # Declarations # @@ -8941,9 +9123,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.0.4/policy/modules/system/ipsec.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.0.5/policy/modules/system/ipsec.if --- nsaserefpolicy/policy/modules/system/ipsec.if 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/ipsec.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/ipsec.if 2007-08-03 14:06:26.000000000 -0400 @@ -114,6 +114,26 @@ ######################################## @@ -8971,9 +9153,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. ## Execute racoon in the racoon domain. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.4/policy/modules/system/ipsec.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.5/policy/modules/system/ipsec.te --- nsaserefpolicy/policy/modules/system/ipsec.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/ipsec.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/ipsec.te 2007-08-03 14:06:26.000000000 -0400 @@ -283,6 +283,7 @@ allow racoon_t self:netlink_selinux_socket { bind create read }; allow racoon_t self:udp_socket create_socket_perms; @@ -8982,9 +9164,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. # manage pid file manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.4/policy/modules/system/iptables.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.5/policy/modules/system/iptables.te --- nsaserefpolicy/policy/modules/system/iptables.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/iptables.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/iptables.te 2007-08-03 14:06:26.000000000 -0400 @@ -44,6 +44,8 @@ corenet_relabelto_all_packets(iptables_t) @@ -9013,14 +9195,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl ppp_dontaudit_use_fds(iptables_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.4/policy/modules/system/libraries.fc ---- nsaserefpolicy/policy/modules/system/libraries.fc 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/libraries.fc 2007-07-25 13:27:51.000000000 -0400 -@@ -158,8 +158,11 @@ - /usr/(local/)?.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:shlib_t,s0) - /usr/(local/)?lib(64)?/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.5/policy/modules/system/libraries.fc +--- nsaserefpolicy/policy/modules/system/libraries.fc 2007-08-02 08:17:28.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/libraries.fc 2007-08-03 14:40:05.000000000 -0400 +@@ -135,6 +135,8 @@ /usr/(local/)?lib(64)?/(sse2/)?libfame-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -+ /usr/NX/lib/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/NX/lib/libjpeg\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib/nx/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -9028,7 +9207,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar /usr/X11R6/lib/libGL\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/X11R6/lib/libXvMCNVIDIA\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -@@ -261,6 +264,8 @@ +@@ -236,6 +238,8 @@ /usr/lib(64)?/libdivxdecore\.so\.0 -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/libdivxencore\.so\.0 -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -9037,30 +9216,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar /usr/lib(64)?/python2.4/site-packages/M2Crypto/__m2crypto.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) # vmware -@@ -313,3 +318,7 @@ - /var/spool/postfix/lib(64)?/lib.*\.so.* -- gen_context(system_u:object_r:shlib_t,s0) - /var/spool/postfix/lib(64)?/[^/]*/lib.*\.so.* -- gen_context(system_u:object_r:shlib_t,s0) - /var/spool/postfix/lib(64)?/devfsd/.+\.so.* -- gen_context(system_u:object_r:shlib_t,s0) -+ +@@ -284,3 +288,7 @@ + /var/spool/postfix/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0) + /var/spool/postfix/usr(/.*)? gen_context(system_u:object_r:lib_t,s0) + /var/spool/postfix/lib(64)?/ld.*\.so.* -- gen_context(system_u:object_r:ld_so_t,s0) +/usr/lib/mozilla/plugins/libvlcplugin.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib64/mozilla/plugins/libvlcplugin.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.4/policy/modules/system/libraries.te ---- nsaserefpolicy/policy/modules/system/libraries.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/libraries.te 2007-07-25 13:27:51.000000000 -0400 -@@ -97,6 +97,11 @@ - ') - ') - -+ifdef(`targeted_policy',` -+ allow ldconfig_t lib_t:file read_file_perms; -+ files_read_generic_tmp_symlinks(ldconfig_t) -+') -+ - optional_policy(` - # dontaudit access to /usr/lib/apache, normal programs cannot read these libs anyway - apache_dontaudit_search_modules(ldconfig_t) -@@ -107,4 +112,11 @@ ++/var/cache/ldconfig(/.*)? gen_context(system_u:object_r:ld_so_cache_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.5/policy/modules/system/libraries.te +--- nsaserefpolicy/policy/modules/system/libraries.te 2007-08-02 08:17:28.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/libraries.te 2007-08-03 14:06:26.000000000 -0400 +@@ -96,4 +96,11 @@ # and executes ldconfig on it. If you dont allow this kernel installs # blow up. rpm_manage_script_tmp_files(ldconfig_t) @@ -9072,9 +9239,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar + # run mkinitrd as unconfined user + unconfined_manage_tmp_files(ldconfig_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.4/policy/modules/system/locallogin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.5/policy/modules/system/locallogin.te --- nsaserefpolicy/policy/modules/system/locallogin.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/locallogin.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/locallogin.te 2007-08-03 14:06:26.000000000 -0400 @@ -25,6 +25,7 @@ domain_role_change_exemption(sulogin_t) domain_interactive_fd(sulogin_t) @@ -9131,9 +9298,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall ################################# # # Sulogin local policy -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.4/policy/modules/system/logging.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.5/policy/modules/system/logging.fc --- nsaserefpolicy/policy/modules/system/logging.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/logging.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/logging.fc 2007-08-03 14:06:26.000000000 -0400 @@ -1,12 +1,15 @@ - /dev/log -s gen_context(system_u:object_r:devlog_t,s0) @@ -9157,9 +9324,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin /var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) + +/var/log/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.4/policy/modules/system/logging.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.5/policy/modules/system/logging.if --- nsaserefpolicy/policy/modules/system/logging.if 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/logging.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/logging.if 2007-08-03 14:06:26.000000000 -0400 @@ -33,8 +33,13 @@ ## # @@ -9385,9 +9552,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin + typeattribute $1 can_send_audit_msgs; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.4/policy/modules/system/logging.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.5/policy/modules/system/logging.te --- nsaserefpolicy/policy/modules/system/logging.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/logging.te 2007-07-26 14:57:10.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/logging.te 2007-08-03 14:06:26.000000000 -0400 @@ -7,10 +7,15 @@ # @@ -9525,9 +9692,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin files_read_etc_runtime_files(syslogd_t) # /initrd is not umounted before minilog starts files_dontaudit_search_isid_type_dirs(syslogd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.4/policy/modules/system/lvm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.5/policy/modules/system/lvm.fc --- nsaserefpolicy/policy/modules/system/lvm.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/lvm.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/lvm.fc 2007-08-03 14:06:26.000000000 -0400 @@ -15,6 +15,7 @@ # /etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0) @@ -9536,14 +9703,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc /etc/lvm/archive(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0) /etc/lvm/backup(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0) /etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.4/policy/modules/system/lvm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.5/policy/modules/system/lvm.te --- nsaserefpolicy/policy/modules/system/lvm.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/lvm.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/lvm.te 2007-08-03 14:06:26.000000000 -0400 @@ -16,6 +16,7 @@ type lvm_t; type lvm_exec_t; init_system_domain(lvm_t,lvm_exec_t) -+application_type(lvm_t) ++application_executable_file(lvm_exec_t) # needs privowner because it assigns the identity system_u to device nodes # but runs as the identity of the sysadmin domain_obj_id_change_exemption(lvm_t) @@ -9591,9 +9758,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te + xen_dontaudit_rw_unix_stream_sockets(lvm_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.0.4/policy/modules/system/miscfiles.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.0.5/policy/modules/system/miscfiles.fc --- nsaserefpolicy/policy/modules/system/miscfiles.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/miscfiles.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/miscfiles.fc 2007-08-03 14:06:26.000000000 -0400 @@ -66,6 +66,7 @@ /var/lib/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0) @@ -9602,9 +9769,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi /var/cache/man(/.*)? gen_context(system_u:object_r:man_t,s0) /var/spool/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.4/policy/modules/system/modutils.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.5/policy/modules/system/modutils.te --- nsaserefpolicy/policy/modules/system/modutils.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/modutils.te 2007-07-25 14:27:32.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/modutils.te 2007-08-03 14:06:26.000000000 -0400 @@ -42,7 +42,7 @@ # insmod local policy # @@ -9696,61 +9863,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.4/policy/modules/system/mount.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.5/policy/modules/system/mount.fc --- nsaserefpolicy/policy/modules/system/mount.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/mount.fc 2007-07-30 11:34:24.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/mount.fc 2007-08-03 14:06:26.000000000 -0400 @@ -1,4 +1,2 @@ /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) - -/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-3.0.4/policy/modules/system/mount.if ---- nsaserefpolicy/policy/modules/system/mount.if 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/mount.if 2007-07-25 13:27:51.000000000 -0400 -@@ -171,3 +171,40 @@ - role $2 types unconfined_mount_t; - allow unconfined_mount_t $3:chr_file rw_file_perms; - ') -+ -+######################################## -+## -+## Execute a domain transition to run mount_ntfs. -+## -+## -+## -+## Domain allowed to transition. -+## -+## -+# -+interface(`mount_ntfs_domtrans',` -+ gen_require(` -+ type mount_ntfs_t, mount_ntfs_exec_t; -+ ') -+ -+ domtrans_pattern($1,mount_ntfs_exec_t,mount_ntfs_t) -+') -+ -+######################################## -+## -+## Allow the specified domain to read/write to -+## init scripts with a unix domain stream sockets. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`mount_ntfs_rw_stream_sockets',` -+ gen_require(` -+ type mount_ntfs_t; -+ ') -+ -+ allow $1 mount_ntfs_t:unix_stream_socket { read write }; -+') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.4/policy/modules/system/mount.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.5/policy/modules/system/mount.te --- nsaserefpolicy/policy/modules/system/mount.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/mount.te 2007-07-30 11:32:20.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/mount.te 2007-08-03 14:20:27.000000000 -0400 @@ -8,6 +8,13 @@ ## @@ -9790,7 +9913,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ######################################## # -@@ -36,7 +45,7 @@ +@@ -36,14 +45,15 @@ # # setuid/setgid needed to mount cifs @@ -9798,8 +9921,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. +allow mount_t self:capability { fsetid ipc_lock sys_rawio sys_resource sys_admin dac_override chown sys_tty_config setuid setgid }; allow mount_t mount_loopback_t:file read_file_perms; - allow mount_t self:netlink_route_socket r_netlink_socket_perms; -@@ -51,6 +60,7 @@ +-allow mount_t self:netlink_route_socket r_netlink_socket_perms; + + allow mount_t mount_tmp_t:file manage_file_perms; + allow mount_t mount_tmp_t:dir manage_dir_perms; + ++auth_use_nsswitch(mount_t) ++ + can_exec(mount_t, mount_exec_t) + + files_tmp_filetrans(mount_t,mount_tmp_t,{ file dir }) +@@ -51,6 +61,7 @@ kernel_read_system_state(mount_t) kernel_read_kernel_sysctls(mount_t) kernel_dontaudit_getattr_core_if(mount_t) @@ -9807,7 +9939,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. dev_getattr_all_blk_files(mount_t) dev_list_all_dev_nodes(mount_t) -@@ -101,6 +111,8 @@ +@@ -101,6 +112,8 @@ init_use_fds(mount_t) init_use_script_ptys(mount_t) init_dontaudit_getattr_initctl(mount_t) @@ -9816,7 +9948,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. libs_use_ld_so(mount_t) libs_use_shared_libs(mount_t) -@@ -127,10 +139,15 @@ +@@ -127,10 +140,15 @@ ') ') @@ -9833,14 +9965,39 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ') optional_policy(` -@@ -201,4 +218,29 @@ +@@ -159,13 +177,8 @@ + + fs_search_rpc(mount_t) + +- sysnet_dns_name_resolve(mount_t) +- + rpc_stub(mount_t) + +- optional_policy(` +- nis_use_ypbind(mount_t) +- ') + ') + + optional_policy(` +@@ -189,10 +202,6 @@ + samba_domtrans_smbmount(mount_t) + ') + +-optional_policy(` +- nscd_socket_use(mount_t) +-') +- + ######################################## + # + # Unconfined mount local policy +@@ -201,4 +210,29 @@ optional_policy(` files_etc_filetrans_etc_runtime(unconfined_mount_t,file) unconfined_domain(unconfined_mount_t) + optional_policy(` + hal_dbus_chat(unconfined_mount_t) + ') - ') ++') + +######################################## +# @@ -9855,17 +10012,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. +fusermount_domtrans(mount_t) +fusermount_use_fds(mount_t) + -+# modutils_domtrans_insmod(mount_t) ++modutils_exec_insmod(mount_t) + +optional_policy(` + hal_write_log(mount_t) + hal_use_fds(mount_t) + hal_rw_pipes(mount_t) -+') + ') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-3.0.4/policy/modules/system/netlabel.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-3.0.5/policy/modules/system/netlabel.te --- nsaserefpolicy/policy/modules/system/netlabel.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/netlabel.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/netlabel.te 2007-08-03 14:06:26.000000000 -0400 @@ -19,6 +19,8 @@ allow netlabel_mgmt_t self:capability net_admin; allow netlabel_mgmt_t self:netlink_socket create_socket_perms; @@ -9875,9 +10032,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlab kernel_read_network_state(netlabel_mgmt_t) libs_use_ld_so(netlabel_mgmt_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.4/policy/modules/system/raid.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.5/policy/modules/system/raid.te --- nsaserefpolicy/policy/modules/system/raid.te 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/raid.te 2007-07-31 09:56:48.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/raid.te 2007-08-03 14:06:26.000000000 -0400 @@ -19,7 +19,7 @@ # Local policy # @@ -9895,9 +10052,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t mta_send_mail(mdadm_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.4/policy/modules/system/selinuxutil.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.5/policy/modules/system/selinuxutil.fc --- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/selinuxutil.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/selinuxutil.fc 2007-08-03 14:06:26.000000000 -0400 @@ -38,8 +38,9 @@ /usr/sbin/restorecond -- gen_context(system_u:object_r:restorecond_exec_t,s0) /usr/sbin/run_init -- gen_context(system_u:object_r:run_init_exec_t,s0) @@ -9909,9 +10066,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu /usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0) # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.4/policy/modules/system/selinuxutil.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.5/policy/modules/system/selinuxutil.if --- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/selinuxutil.if 2007-07-25 14:07:42.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/selinuxutil.if 2007-08-03 14:06:26.000000000 -0400 @@ -432,6 +432,7 @@ role $2 types run_init_t; allow run_init_t $3:chr_file rw_term_perms; @@ -9996,7 +10153,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ## Full management of the semanage ## module store. ## -@@ -1058,3 +1112,121 @@ +@@ -1058,3 +1112,120 @@ files_search_etc($1) rw_files_pattern($1,selinux_config_t,semanage_trans_lock_t) ') @@ -10096,7 +10253,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu + +libs_use_ld_so($1) +libs_use_shared_libs($1) -+libs_use_lib_files($1) + +locallogin_use_fds($1) + @@ -10118,9 +10274,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu +seutil_manage_default_contexts($1) + +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.4/policy/modules/system/selinuxutil.te ---- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/selinuxutil.te 2007-07-25 14:07:51.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.5/policy/modules/system/selinuxutil.te +--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-08-02 08:17:28.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/selinuxutil.te 2007-08-03 14:06:26.000000000 -0400 @@ -76,7 +76,6 @@ type restorecond_exec_t; init_daemon_domain(restorecond_t,restorecond_exec_t) @@ -10140,19 +10296,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu type semanage_store_t; files_type(semanage_store_t) -@@ -151,6 +154,11 @@ - - userdom_use_all_users_fds(checkpolicy_t) - -+ifdef(`targeted_policy',` -+ term_use_generic_ptys(checkpolicy_t) -+ term_use_unallocated_ttys(checkpolicy_t) -+') -+ - ######################################## - # - # Load_policy local policy -@@ -173,6 +181,7 @@ +@@ -173,6 +176,7 @@ fs_getattr_xattr_fs(load_policy_t) mls_file_read_up(load_policy_t) @@ -10160,7 +10304,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu selinux_get_fs_mount(load_policy_t) selinux_load_policy(load_policy_t) -@@ -195,10 +204,15 @@ +@@ -195,7 +199,7 @@ # cjp: cover up stray file descriptors. dontaudit load_policy_t selinux_config_t:file write; optional_policy(` @@ -10169,15 +10313,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ') ') -+ifdef(`targeted_policy',` -+ term_use_unallocated_ttys(load_policy_t) -+ term_use_generic_ptys(load_policy_t) -+') -+ - ######################################## - # - # Newrole local policy -@@ -216,7 +230,7 @@ +@@ -216,7 +220,7 @@ allow newrole_t self:msg { send receive }; allow newrole_t self:unix_dgram_socket sendto; allow newrole_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -10186,7 +10322,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu read_files_pattern(newrole_t,selinux_config_t,selinux_config_t) read_lnk_files_pattern(newrole_t,selinux_config_t,selinux_config_t) -@@ -254,7 +268,9 @@ +@@ -254,7 +258,9 @@ term_dontaudit_use_unallocated_ttys(newrole_t) auth_domtrans_chk_passwd(newrole_t) @@ -10196,7 +10332,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu corecmd_list_bin(newrole_t) corecmd_read_bin_symlinks(newrole_t) -@@ -274,6 +290,7 @@ +@@ -274,6 +280,7 @@ libs_use_ld_so(newrole_t) libs_use_shared_libs(newrole_t) @@ -10204,7 +10340,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu logging_send_syslog_msg(newrole_t) miscfiles_read_localization(newrole_t) -@@ -362,7 +379,7 @@ +@@ -362,7 +369,7 @@ allow run_init_t self:process setexec; allow run_init_t self:capability setuid; allow run_init_t self:fifo_file rw_file_perms; @@ -10213,7 +10349,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # often the administrator runs such programs from a directory that is owned # by a different user or has restrictive SE permissions, do not want to audit -@@ -376,6 +393,7 @@ +@@ -376,6 +383,7 @@ term_dontaudit_list_ptys(run_init_t) auth_domtrans_chk_passwd(run_init_t) @@ -10221,7 +10357,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu auth_dontaudit_read_shadow(run_init_t) corecmd_exec_bin(run_init_t) -@@ -432,7 +450,7 @@ +@@ -432,7 +440,7 @@ allow semanage_t self:capability { dac_override audit_write }; allow semanage_t self:unix_stream_socket create_stream_socket_perms; allow semanage_t self:unix_dgram_socket create_socket_perms; @@ -10230,7 +10366,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu allow semanage_t policy_config_t:file { read write }; -@@ -443,7 +461,10 @@ +@@ -443,7 +451,10 @@ kernel_read_system_state(semanage_t) kernel_read_kernel_sysctls(semanage_t) @@ -10241,7 +10377,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu dev_read_urand(semanage_t) -@@ -467,6 +488,8 @@ +@@ -467,6 +478,8 @@ # Running genhomedircon requires this for finding all users auth_use_nsswitch(semanage_t) @@ -10250,7 +10386,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu libs_use_ld_so(semanage_t) libs_use_shared_libs(semanage_t) -@@ -491,6 +514,17 @@ +@@ -490,6 +503,17 @@ # netfilter_contexts: seutil_manage_default_contexts(semanage_t) @@ -10268,7 +10404,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # cjp: need a more general way to handle this: ifdef(`enable_mls',` # read secadm tmp files -@@ -518,6 +552,8 @@ +@@ -517,6 +541,8 @@ allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:file r_file_perms; allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:lnk_file r_file_perms; @@ -10277,7 +10413,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu kernel_read_system_state(setfiles_t) kernel_relabelfrom_unlabeled_dirs(setfiles_t) kernel_relabelfrom_unlabeled_files(setfiles_t) -@@ -534,6 +570,7 @@ +@@ -533,6 +559,7 @@ fs_getattr_xattr_fs(setfiles_t) fs_list_all(setfiles_t) @@ -10285,7 +10421,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu fs_search_auto_mountpoints(setfiles_t) fs_relabelfrom_noxattr_fs(setfiles_t) -@@ -589,6 +626,10 @@ +@@ -588,6 +615,10 @@ ifdef(`hide_broken_symptoms',` optional_policy(` @@ -10296,9 +10432,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu udev_dontaudit_rw_dgram_sockets(setfiles_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.4/policy/modules/system/sysnetwork.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.5/policy/modules/system/sysnetwork.if --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/sysnetwork.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/sysnetwork.if 2007-08-03 14:06:26.000000000 -0400 @@ -522,6 +522,8 @@ files_search_etc($1) @@ -10308,9 +10444,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.4/policy/modules/system/sysnetwork.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.5/policy/modules/system/sysnetwork.te --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/sysnetwork.te 2007-07-31 16:04:09.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/sysnetwork.te 2007-08-03 14:06:26.000000000 -0400 @@ -45,7 +45,7 @@ dontaudit dhcpc_t self:capability sys_tty_config; # for access("/etc/bashrc", X_OK) on Red Hat @@ -10356,9 +10492,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet term_dontaudit_use_all_user_ttys(ifconfig_t) term_dontaudit_use_all_user_ptys(ifconfig_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.4/policy/modules/system/udev.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.5/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/udev.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/udev.te 2007-08-03 14:06:26.000000000 -0400 @@ -68,8 +68,9 @@ allow udev_t udev_tbl_t:file manage_file_perms; dev_filetrans(udev_t,udev_tbl_t,file) @@ -10458,9 +10594,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t ') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.4/policy/modules/system/unconfined.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.5/policy/modules/system/unconfined.if --- nsaserefpolicy/policy/modules/system/unconfined.if 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/unconfined.if 2007-07-25 14:31:13.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/unconfined.if 2007-08-03 14:06:26.000000000 -0400 @@ -12,14 +12,13 @@ # interface(`unconfined_domain_noaudit',` @@ -10644,9 +10780,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + + allow $1 unconfined_terminal:chr_file rw_term_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.4/policy/modules/system/unconfined.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.5/policy/modules/system/unconfined.te --- nsaserefpolicy/policy/modules/system/unconfined.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/unconfined.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/unconfined.te 2007-08-03 14:06:26.000000000 -0400 @@ -5,28 +5,36 @@ # # Declarations @@ -10839,9 +10975,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') + +corecmd_exec_all_executables(unconfined_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.4/policy/modules/system/userdomain.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.5/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/userdomain.if 2007-07-31 09:56:28.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/userdomain.if 2007-08-03 14:06:26.000000000 -0400 @@ -62,6 +62,10 @@ allow $1_t $1_tty_device_t:chr_file { setattr rw_chr_file_perms }; @@ -11200,63 +11336,47 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') optional_policy(` -@@ -908,45 +838,176 @@ +@@ -908,16 +838,6 @@ ') optional_policy(` - tunable_policy(`allow_user_postgresql_connect',` - postgresql_stream_connect($1_t) - ') -+ resmgr_stream_connect($1_t) - ') - - optional_policy(` +- ') +- +- optional_policy(` - quota_dontaudit_getattr_db($1_t) -+ rpc_dontaudit_getattr_exports($1_t) -+ rpc_manage_nfs_rw_content($1_t) +- ') +- +- optional_policy(` + resmgr_stream_connect($1_t) ') - optional_policy(` -- resmgr_stream_connect($1_t) -+ samba_stream_connect_winbind($1_t) - ') - - optional_policy(` -- rpc_dontaudit_getattr_exports($1_t) -- rpc_manage_nfs_rw_content($1_t) -+ slrnpull_search_spool($1_t) +@@ -927,11 +847,6 @@ ') optional_policy(` - rpm_read_db($1_t) - rpm_dontaudit_manage_db($1_t) -+ usernetctl_run($1_t,$1_r,{ $1_devpts_t $1_tty_device_t }) +- ') +- +- optional_policy(` + samba_stream_connect_winbind($1_t) ') -+') -+ -+####################################### -+## -+## The template for creating a unprivileged user. -+## -+## -+##

-+## This template creates a user domain, types, and -+## rules for the user's tty, pty, home directories, -+## tmp, and tmpfs files. -+##

-+## -+## -+## -+## The prefix of the user domain (e.g., user -+## is the prefix for user_t). -+## -+## -+# + +@@ -962,21 +877,162 @@ + ## + ## + # +-template(`userdom_unpriv_user_template', ` +- +template(`userdom_privhome_user_template',` -+ gen_require(` + gen_require(` +- attribute privhome, user_ptynode, user_home_dir_type, user_home_type, user_tmpfile, user_ttynode; + type $1_home_dir_t, $1_home_t; -+ ') -+ + ') + + # privileged home directory writers + manage_dirs_pattern(privhome,{ $1_home_dir_t $1_home_t },$1_home_t) + manage_files_pattern(privhome,{ $1_home_dir_t $1_home_t },$1_home_t) @@ -11309,11 +11429,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + + allow $1_t self:context contains; + -+ ############################## -+ # + ############################## + # +- # Declarations + # User domain Local policy -+ # -+ + # + +- # Inherit rules for ordinary users. +- userdom_common_user_template($1) + auth_dontaudit_write_login_records($1_t) + + dev_read_sysfs($1_t) @@ -11355,20 +11478,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + + userdom_poly_home_template($1) + userdom_poly_tmp_template($1) - - optional_policy(` -- samba_stream_connect_winbind($1_t) ++ ++ optional_policy(` + cups_stream_connect($1_t) + cups_stream_connect_ptal($1_t) - ') - - optional_policy(` -- slrnpull_search_spool($1_t) ++ ') ++ ++ optional_policy(` + kerberos_use($1_t) - ') - - optional_policy(` -- usernetctl_run($1_t,$1_r,{ $1_devpts_t $1_tty_device_t }) ++ ') ++ ++ optional_policy(` + mta_dontaudit_read_spool_symlinks($1_t) + ') + @@ -11379,41 +11499,47 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + optional_policy(` + rpm_read_db($1_t) + rpm_dontaudit_manage_db($1_t) - ') - ') - ++ ') ++') + - ####################################### - ## --## The template for creating a unprivileged user. ++ ++####################################### ++## +## The template for creating a unprivileged login user. - ## - ## - ##

-@@ -962,11 +1023,58 @@ - ##

- ## - # --template(`userdom_unpriv_user_template', ` -- ++## ++## ++##

++## This template creates a user domain, types, and ++## rules for the user's tty, pty, home directories, ++## tmp, and tmpfs files. ++##

++## ++## ++## ++## The prefix of the user domain (e.g., user ++## is the prefix for user_t). ++## ++## ++# +template(`userdom_unpriv_login_user', ` - gen_require(` ++ gen_require(` + attribute unpriv_userdomain; - attribute privhome, user_ptynode, user_home_dir_type, user_home_type, user_tmpfile, user_ttynode; - ') ++ attribute privhome, user_ptynode, user_home_dir_type, user_home_type, user_tmpfile, user_ttynode; ++ ') + userdom_login_user_template($1) + userdom_privhome_user_template($1) + + typeattribute $1_t unpriv_userdomain; + -+ typeattribute $1_t unpriv_userdomain; -+ -+ domain_interactive_fd($1_t) -+ -+ typeattribute $1_devpts_t user_ptynode; -+ typeattribute $1_home_dir_t user_home_dir_type; -+ typeattribute $1_home_t user_home_type; -+ typeattribute $1_tmp_t user_tmpfile; -+ typeattribute $1_tty_device_t user_ttynode; -+ + domain_interactive_fd($1_t) + + typeattribute $1_devpts_t user_ptynode; +@@ -985,15 +1041,53 @@ + typeattribute $1_tmp_t user_tmpfile; + typeattribute $1_tty_device_t user_ttynode; + +- userdom_poly_home_template($1) +- userdom_poly_tmp_template($1) + auth_exec_pam($1_t) + + optional_policy(` @@ -11451,32 +11577,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ############################## # -@@ -976,25 +1084,11 @@ - # Inherit rules for ordinary users. - userdom_common_user_template($1) - -- typeattribute $1_t unpriv_userdomain; -- domain_interactive_fd($1_t) -- -- typeattribute $1_devpts_t user_ptynode; -- typeattribute $1_home_dir_t user_home_dir_type; -- typeattribute $1_home_t user_home_type; -- typeattribute $1_tmp_t user_tmpfile; -- typeattribute $1_tty_device_t user_ttynode; -- -- userdom_poly_home_template($1) -- userdom_poly_tmp_template($1) -- - ############################## - # - # Local policy +- # Local policy ++ # Declarations # - corecmd_exec_all_executables($1_t) -- ++ # Inherit rules for ordinary users. ++ userdom_common_user_template($1) ++ ++ ############################## ++ # ++ # Local policy ++ # + # port access is audited even if dac would not have allowed it, so dontaudit it here corenet_dontaudit_tcp_bind_all_reserved_ports($1_t) - # Need the following rule to allow users to run vpnc @@ -1029,15 +1123,7 @@ # and may change other protocols tunable_policy(`user_tcp_server',` @@ -11630,7 +11745,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ## Unconfined access to user domains. (Deprecated) ## ## -@@ -5559,3 +5695,233 @@ +@@ -5559,3 +5695,275 @@ interface(`userdom_unconfined',` refpolicywarn(`$0($*) has been deprecated.') ') @@ -11813,6 +11928,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + +authlogin_per_role_template($1, $1_t, $1_r) + ++auth_search_pam_console_data($1_t) ++ +dev_read_sound($1_t) +dev_write_sound($1_t) + @@ -11864,9 +11981,49 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + ') + typeattribute $1 user_home_type; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.4/policy/modules/system/userdomain.te ---- nsaserefpolicy/policy/modules/system/userdomain.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/userdomain.te 2007-07-25 13:27:51.000000000 -0400 ++ ++######################################## ++## ++## Do not audit attempts to relabel unpriv user ++## home files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`userdom_dontaudit_relabel_unpriv_user_home_content_files',` ++ gen_require(` ++ attribute user_home_type; ++ ') ++ ++ dontaudit $1 user_home_type:file { relabelto relabelfrom }; ++') ++ ++ ++######################################## ++## ++## Mmap of unpriv user ++## home files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`userdom_mmap_unpriv_user_home_content_files',` ++ gen_require(` ++ attribute user_home_type; ++ ') ++ ++ files_search_home($1) ++ allow $1 user_home_type:file execute; ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.5/policy/modules/system/userdomain.te +--- nsaserefpolicy/policy/modules/system/userdomain.te 2007-08-02 08:17:28.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/userdomain.te 2007-08-03 14:06:26.000000000 -0400 @@ -74,6 +74,9 @@ # users home directory contents attribute home_type; @@ -11914,7 +12071,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo apache_run_helper(sysadm_t,sysadm_r,admin_terminal) #apache_run_all_scripts(sysadm_t,sysadm_r) #apache_domtrans_sys_script(sysadm_t) -@@ -290,14 +295,6 @@ +@@ -286,14 +291,6 @@ ') optional_policy(` @@ -11929,7 +12086,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo cron_admin_template(sysadm,sysadm_t,sysadm_r) ') -@@ -398,6 +395,10 @@ +@@ -394,6 +391,10 @@ ') optional_policy(` @@ -11940,7 +12097,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo netutils_run(sysadm_t,sysadm_r,admin_terminal) netutils_run_ping(sysadm_t,sysadm_r,admin_terminal) netutils_run_traceroute(sysadm_t,sysadm_r,admin_terminal) -@@ -451,11 +452,15 @@ +@@ -447,11 +448,15 @@ ') optional_policy(` @@ -11956,7 +12113,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ', ` userdom_security_admin_template(sysadm_t,sysadm_r,admin_terminal) ') -@@ -498,3 +503,7 @@ +@@ -494,3 +499,7 @@ optional_policy(` yam_run(sysadm_t,sysadm_r,admin_terminal) ') @@ -11964,9 +12121,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo +tunable_policy(`allow_console_login', ` + term_use_console(userdomain) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.4/policy/modules/system/xen.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.5/policy/modules/system/xen.if --- nsaserefpolicy/policy/modules/system/xen.if 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/xen.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/xen.if 2007-08-03 14:06:26.000000000 -0400 @@ -191,3 +191,24 @@ domtrans_pattern($1,xm_exec_t,xm_t) @@ -11992,9 +12149,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if + allow $1 xend_var_lib_t:dir search_dir_perms; + rw_files_pattern($1,xen_image_t,xen_image_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.4/policy/modules/system/xen.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.5/policy/modules/system/xen.te --- nsaserefpolicy/policy/modules/system/xen.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.4/policy/modules/system/xen.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/system/xen.te 2007-08-03 14:06:26.000000000 -0400 @@ -70,7 +70,7 @@ type xm_t; type xm_exec_t; @@ -12021,6 +12178,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te xen_stream_connect_xenstore(xenconsoled_t) ######################################## +@@ -265,7 +266,7 @@ + # Xen store local policy + # + +-allow xenstored_t self:capability { dac_override mknod ipc_lock }; ++allow xenstored_t self:capability { dac_override mknod ipc_lock sys_resource }; + allow xenstored_t self:unix_stream_socket create_stream_socket_perms; + allow xenstored_t self:unix_dgram_socket create_socket_perms; + @@ -336,6 +337,7 @@ kernel_write_xen_state(xm_t) @@ -12043,38 +12209,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te +fs_write_nfs_files(xend_t) +fs_read_nfs_files(xend_t) +fs_read_nfs_symlinks(xend_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.4/policy/modules/users/guest.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.5/policy/modules/users/guest.fc --- nsaserefpolicy/policy/modules/users/guest.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/users/guest.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/users/guest.fc 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1 @@ +# No guest file contexts. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.4/policy/modules/users/guest.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.5/policy/modules/users/guest.if --- nsaserefpolicy/policy/modules/users/guest.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/users/guest.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/users/guest.if 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1 @@ +## Policy for guest user -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.4/policy/modules/users/guest.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.5/policy/modules/users/guest.te --- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/users/guest.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/users/guest.te 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,5 @@ +policy_module(guest,1.0.0) +userdom_unpriv_login_user(guest) +userdom_unpriv_login_user(gadmin) +userdom_unpriv_xwindows_login_user(xguest) +mozilla_per_role_template(xguest, xguest_t, xguest_r) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.4/policy/modules/users/logadm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.5/policy/modules/users/logadm.fc --- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/users/logadm.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/users/logadm.fc 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1 @@ +# No logadm file contexts. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.4/policy/modules/users/logadm.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.5/policy/modules/users/logadm.if --- nsaserefpolicy/policy/modules/users/logadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/users/logadm.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/users/logadm.if 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1 @@ +## Policy for logadm user -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.4/policy/modules/users/logadm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.5/policy/modules/users/logadm.te --- nsaserefpolicy/policy/modules/users/logadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/users/logadm.te 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/users/logadm.te 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,33 @@ +policy_module(logadm,1.0.0) + @@ -12109,24 +12275,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm. + +files_dontaudit_search_all_dirs(logadm_t) +files_dontaudit_getattr_all_files(logadm_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.4/policy/modules/users/metadata.xml +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.5/policy/modules/users/metadata.xml --- nsaserefpolicy/policy/modules/users/metadata.xml 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/users/metadata.xml 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/users/metadata.xml 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1 @@ +Policy modules for users -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.4/policy/modules/users/webadm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.5/policy/modules/users/webadm.fc --- nsaserefpolicy/policy/modules/users/webadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/users/webadm.fc 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/users/webadm.fc 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1 @@ +# No webadm file contexts. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.4/policy/modules/users/webadm.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.5/policy/modules/users/webadm.if --- nsaserefpolicy/policy/modules/users/webadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/users/webadm.if 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/users/webadm.if 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1 @@ +## Policy for webadm user -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.4/policy/modules/users/webadm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.5/policy/modules/users/webadm.te --- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.4/policy/modules/users/webadm.te 2007-07-27 14:44:20.000000000 -0400 ++++ serefpolicy-3.0.5/policy/modules/users/webadm.te 2007-08-03 14:06:26.000000000 -0400 @@ -0,0 +1,70 @@ +policy_module(webadm,1.0.0) + @@ -12198,9 +12364,69 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm. +allow webadm_t gadmin_t:dir getattr; + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.4/policy/support/obj_perm_sets.spt +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/file_patterns.spt serefpolicy-3.0.5/policy/support/file_patterns.spt +--- nsaserefpolicy/policy/support/file_patterns.spt 2007-05-29 14:10:59.000000000 -0400 ++++ serefpolicy-3.0.5/policy/support/file_patterns.spt 2007-08-03 14:06:26.000000000 -0400 +@@ -310,47 +310,47 @@ + # + define(`getattr_sock_files_pattern',` + allow $1 $2:dir search_dir_perms; +- allow $1 $3:sock_file getattr_fifo_file_perms; ++ allow $1 $3:sock_file getattr_sock_file_perms; + ') + + define(`setattr_sock_files_pattern',` + allow $1 $2:dir search_dir_perms; +- allow $1 $3:sock_file setattr_fifo_file_perms; ++ allow $1 $3:sock_file setattr_sock_file_perms; + ') + + define(`read_sock_files_pattern',` + allow $1 $2:dir search_dir_perms; +- allow $1 $3:sock_file read_fifo_file_perms; ++ allow $1 $3:sock_file read_sock_file_perms; + ') + + define(`write_sock_files_pattern',` + allow $1 $2:dir search_dir_perms; +- allow $1 $3:sock_file write_fifo_file_perms; ++ allow $1 $3:sock_file write_sock_file_perms; + ') + + define(`rw_sock_files_pattern',` + allow $1 $2:dir search_dir_perms; +- allow $1 $3:sock_file rw_fifo_file_perms; ++ allow $1 $3:sock_file rw_sock_file_perms; + ') + + define(`create_sock_files_pattern',` + allow $1 $2:dir add_entry_dir_perms; +- allow $1 $3:sock_file create_fifo_file_perms; ++ allow $1 $3:sock_file create_sock_file_perms; + ') + + define(`delete_sock_files_pattern',` + allow $1 $2:dir del_entry_dir_perms; +- allow $1 $3:sock_file delete_fifo_file_perms; ++ allow $1 $3:sock_file delete_sock_file_perms; + ') + + define(`rename_sock_files_pattern',` + allow $1 $2:dir rw_dir_perms; +- allow $1 $3:sock_file rename_fifo_file_perms; ++ allow $1 $3:sock_file rename_sock_file_perms; + ') + + define(`manage_sock_files_pattern',` + allow $1 $2:dir rw_dir_perms; +- allow $1 $3:sock_file manage_fifo_file_perms; ++ allow $1 $3:sock_file manage_sock_file_perms; + ') + + define(`relabelfrom_sock_files_pattern',` +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.5/policy/support/obj_perm_sets.spt --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.4/policy/support/obj_perm_sets.spt 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/support/obj_perm_sets.spt 2007-08-03 14:06:26.000000000 -0400 @@ -201,7 +201,7 @@ define(`search_dir_perms',`{ getattr search }') define(`list_dir_perms',`{ getattr search read lock ioctl }') @@ -12233,9 +12459,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets +define(`all_association', `{ sendto recvfrom setcontext polmatch } ') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.4/policy/users +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.5/policy/users --- nsaserefpolicy/policy/users 2007-07-17 14:52:27.000000000 -0400 -+++ serefpolicy-3.0.4/policy/users 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/policy/users 2007-08-03 14:06:26.000000000 -0400 @@ -16,7 +16,7 @@ # and a user process should never be assigned the system user # identity. @@ -12270,9 +12496,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0 - gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) -') +gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.4/Rules.modular +diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.5/Rules.modular --- nsaserefpolicy/Rules.modular 2007-05-25 09:09:10.000000000 -0400 -+++ serefpolicy-3.0.4/Rules.modular 2007-07-25 13:27:51.000000000 -0400 ++++ serefpolicy-3.0.5/Rules.modular 2007-08-03 14:06:26.000000000 -0400 @@ -167,7 +167,7 @@ # these have to run individually because order matters: $(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true @@ -12299,43 +12525,3 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3. # Clean the sources # clean: -diff --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.0.4/support/Makefile.devel ---- nsaserefpolicy/support/Makefile.devel 2007-05-29 13:53:56.000000000 -0400 -+++ serefpolicy-3.0.4/support/Makefile.devel 2007-07-25 13:27:51.000000000 -0400 -@@ -24,7 +24,7 @@ - XMLLINT := $(BINDIR)/xmllint - - # set default build options if missing --TYPE ?= standard -+TYPE ?= strict - DIRECT_INITRC ?= n - POLY ?= n - QUIET ?= y -@@ -39,15 +39,25 @@ - globaltun = $(HEADERDIR)/global_tunables.xml - globalbool = $(HEADERDIR)/global_booleans.xml - -+# compile strict policy if requested. -+ifneq ($(findstring strict,$(TYPE)),) -+ M4PARAM += -D strict_policy -+endif -+ -+# compile targeted policy if requested. -+ifneq ($(findstring targeted,$(TYPE)),) -+ M4PARAM += -D targeted_policy -+endif -+ - # enable MLS if requested. --ifeq "$(TYPE)" "mls" -+ifneq ($(findstring -mls,$(TYPE)),) - M4PARAM += -D enable_mls - CHECKPOLICY += -M - CHECKMODULE += -M - endif - - # enable MLS if MCS requested. --ifeq "$(TYPE)" "mcs" -+ifneq ($(findstring -mcs,$(TYPE)),) - M4PARAM += -D enable_mcs - CHECKPOLICY += -M - CHECKMODULE += -M diff --git a/selinux-policy.spec b/selinux-policy.spec index b927e55..690e99d 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -142,7 +142,6 @@ install -m0644 ${RPM_SOURCE_DIR}/setrans-%1.conf %{buildroot}%{_sysconfdir}/seli %dir %{_sysconfdir}/selinux/%1/contexts/users \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/guest_u \ -%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \ %config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u @@ -305,6 +304,7 @@ exit 0 %files targeted %fileList targeted +%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u %endif %if %{BUILD_OLPC} diff --git a/sources b/sources index 0e2abb7..5144f2d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -a19850a065ff7c17da5eff9259b86d9c serefpolicy-3.0.4.tgz +917b210229667898aa462391e8473e66 serefpolicy-3.0.5.tgz