patch from dan Wed, 20 Sep 2006 12:12:49 -0400

diff --git a/Changelog b/Changelog
index 31d542c1f57daab1a2deab6485993bef4bdf72bd..3017da4269966f96d7145044c766842acb5a35a1 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -69,6 +69,7 @@
        Thu, 31 Aug 2006
        Fri, 01 Sep 2006
        Tue, 05 Sep 2006
+       Wed, 20 Sep 2006
 - Added modules:
        afs
        amavis (Erich Schubert)

diff --git a/policy/flask/mkaccess_vector.sh b/policy/flask/mkaccess_vector.sh
index b5da734b042dcc01478ceea2390b69d4911439ac..02f895ca333a24fdafec124f69de99b2b1fb9450 100755 (executable)
--- a/policy/flask/mkaccess_vector.sh
+++ b/policy/flask/mkaccess_vector.sh
@@ -118,7 +118,6 @@ $1 == "inherits" {
                                        printf(" ") > outfile; 
                                printf("0x%08xUL\n", ind[i]) > outfile; 
                        }
-                       printf("\n") > outfile;
                         for (i in ind) delete ind[i];
                         for (i in inherited_perms) delete inherited_perms[i];
 
@@ -214,8 +213,6 @@ $1 == "}"   {
                                printf("TE_(common_%s_perm_to_string)\n\n", common_name) > cpermfile; 
                        }
 
-                       printf("\n") > outfile;
-
                        nextstate = "COMMON_OR_AV";
                }
 END    {

diff --git a/policy/mcs b/policy/mcs
index 89cdec9eddcc3e2cada9ba654c63b45f16a55a9b..d51cf9774d4a1257e936b089ef5738365aca61c9 100644 (file)
--- a/policy/mcs
+++ b/policy/mcs
@@ -78,6 +78,9 @@ level s0:c0.c255;
 mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
        ( h1 dom h2 );
 
+mlsconstrain dir { create getattr setattr read write link unlink rename search add_name remove_name reparent rmdir lock ioctl }
+       (( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread ));
+
 # New filesystem object labels must be dominated by the relabeling subject
 # clearance, also the objects are single-level.
 mlsconstrain file { create relabelto }

diff --git a/policy/modules/admin/amanda.fc b/policy/modules/admin/amanda.fc
index 4caaa8ff8b4b06453254c58fafecbf0f9bc93d19..74ebff51802eb01d941ac3b2c179bbf378e449f7 100644 (file)
--- a/policy/modules/admin/amanda.fc
+++ b/policy/modules/admin/amanda.fc
@@ -14,10 +14,13 @@
 /usr/lib(64)?/amanda/amidxtaped        --      gen_context(system_u:object_r:amanda_inetd_exec_t,s0)
 /usr/lib(64)?/amanda/amindexd  --      gen_context(system_u:object_r:amanda_inetd_exec_t,s0)
 /usr/sbin/amrecover            --      gen_context(system_u:object_r:amanda_recover_exec_t,s0)
+
 /var/lib/amanda                        -d      gen_context(system_u:object_r:amanda_var_lib_t,s0)
+/var/lib/amanda/[^/]+(/.*)?            gen_context(system_u:object_r:amanda_data_t,s0)
+/var/lib/amanda/[^/]*/log(/.*)?                gen_context(system_u:object_r:amanda_log_t,s0)
 /var/lib/amanda/\.amandahosts  --      gen_context(system_u:object_r:amanda_config_t,s0)
-/var/lib/amanda/disklist       --      gen_context(system_u:object_r:amanda_data_t,s0)
 /var/lib/amanda/gnutar-lists(/.*)?     gen_context(system_u:object_r:amanda_gnutarlists_t,s0)
-/var/lib/amanda/index                  gen_context(system_u:object_r:amanda_data_t,s0)
+# the null string in here because index is a m4 builtin function
+/var/lib/amanda/[^/]+/index`'(/.*)?    gen_context(system_u:object_r:amanda_var_lib_t,s0)
 
 /var/log/amanda(/.*)?                  gen_context(system_u:object_r:amanda_log_t,s0)

diff --git a/policy/modules/admin/amanda.te b/policy/modules/admin/amanda.te
index b07c612c7a27067a5a14cd876c527c1ef1feee82..40815e024d99123dc92dd67a44551cd1a16ebfef 100644 (file)
--- a/policy/modules/admin/amanda.te
+++ b/policy/modules/admin/amanda.te
@@ -1,5 +1,5 @@
 
-policy_module(amanda,1.3.6)
+policy_module(amanda,1.3.7)
 
 #######################################
 #

diff --git a/policy/modules/admin/logwatch.te b/policy/modules/admin/logwatch.te
index 209fa4537362f2450c539e83e41077492953387e..14e63d7e6dd4358a96af86dc987483128c38c406 100644 (file)
--- a/policy/modules/admin/logwatch.te
+++ b/policy/modules/admin/logwatch.te
@@ -1,5 +1,5 @@
 
-policy_module(logwatch,1.1.3)
+policy_module(logwatch,1.1.4)
 
 #################################
 #
@@ -63,8 +63,10 @@ files_read_usr_files(logwatch_t)
 files_search_spool(logwatch_t)
 files_search_mnt(logwatch_t)
 files_dontaudit_search_home(logwatch_t)
+files_dontaudit_search_boot(logwatch_t)
 
 fs_getattr_all_fs(logwatch_t)
+fs_dontaudit_list_auto_mountpoints(logwatch_t)
 
 term_dontaudit_getattr_pty_dirs(logwatch_t)
 term_dontaudit_list_ptys(logwatch_t)

diff --git a/policy/modules/admin/rpm.fc b/policy/modules/admin/rpm.fc
index 384715c8913cfa05a8ba793e39e6a392946a7583..7ebe9f6568776926ddc5e063a35c81f9826ac474 100644 (file)
--- a/policy/modules/admin/rpm.fc
+++ b/policy/modules/admin/rpm.fc
@@ -10,11 +10,13 @@
 /usr/lib(64)?/rpm/rpmv         --      gen_context(system_u:object_r:bin_t,s0)
 
 /usr/sbin/system-install-packages --   gen_context(system_u:object_r:rpm_exec_t,s0)
+/usr/sbin/yum-updatesd         --      gen_context(system_u:object_r:rpm_exec_t,s0)
 
 /usr/share/yumex/yumex         --      gen_context(system_u:object_r:rpm_exec_t,s0)
 
 ifdef(`distro_redhat', `
 /usr/bin/fedora-rmdevelrpms    --      gen_context(system_u:object_r:rpm_exec_t,s0)
+/usr/bin/rpmdev-rmdevelrpms    --      gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/sbin/pirut                        --      gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/sbin/pup                  --      gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/sbin/rhn_check            --      gen_context(system_u:object_r:rpm_exec_t,s0)

diff --git a/policy/modules/admin/rpm.te b/policy/modules/admin/rpm.te
index da38ad56bf9e8e18c73ef2cea59ebafec940a218..70d96be8952c96c97b9f9af459443ef03315d836 100644 (file)
--- a/policy/modules/admin/rpm.te
+++ b/policy/modules/admin/rpm.te
@@ -1,5 +1,5 @@
 
-policy_module(rpm,1.3.10)
+policy_module(rpm,1.3.11)
 
 ########################################
 #
@@ -178,6 +178,8 @@ ifdef(`distro_redhat',`
 
 ifdef(`targeted_policy',`
        unconfined_domain(rpm_t)
+       # yum-updatesd requires this
+       unconfined_dbus_chat(rpm_t)
 ',`
        # cjp: these are here to stop type_transition
        # conflicts since rpm_t is an alias of

diff --git a/policy/modules/admin/su.if b/policy/modules/admin/su.if
index 8be3a0ce93f4afe0703a923898b8767aa69159bc..46300c4e0326dea7eee3e677309d6b5b637bb934 100644 (file)
--- a/policy/modules/admin/su.if
+++ b/policy/modules/admin/su.if
@@ -43,6 +43,7 @@ template(`su_restricted_domain_template', `
 
        allow $1_su_t self:capability { audit_control audit_write setuid setgid net_bind_service chown dac_override fowner sys_nice sys_resource };
        dontaudit $1_su_t self:capability sys_tty_config;
+       allow $1_su_t self:key { search write };
        allow $1_su_t self:process { setexec setsched setrlimit };
        allow $1_su_t self:fifo_file rw_file_perms;
        allow $1_su_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms };
@@ -62,6 +63,7 @@ template(`su_restricted_domain_template', `
 
        kernel_read_system_state($1_su_t)
        kernel_read_kernel_sysctls($1_su_t)
+       kernel_search_key($1_su_t)
 
        # for SSP
        dev_read_urand($1_su_t)

diff --git a/policy/modules/admin/su.te b/policy/modules/admin/su.te
index d9ef86aa42c5984e929cb4642432d3b87cfd3652..22085b2c279cc2c06a36f664be4166eb8e133ee1 100644 (file)
--- a/policy/modules/admin/su.te
+++ b/policy/modules/admin/su.te
@@ -1,5 +1,5 @@
 
-policy_module(su,1.3.3)
+policy_module(su,1.3.4)
 
 ########################################
 #

diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
index 6e3d73753b657f7ede9f130e93d8eea0b5a4bd1c..35352e82ad35868abe8f23d206697ec38533f158 100644 (file)
--- a/policy/modules/admin/usermanage.te
+++ b/policy/modules/admin/usermanage.te
@@ -1,5 +1,5 @@
 
-policy_module(usermanage,1.3.10)
+policy_module(usermanage,1.3.11)
 
 ########################################
 #
@@ -442,6 +442,10 @@ optional_policy(`
        nis_use_ypbind(sysadm_passwd_t)
 ')
 
+optional_policy(`
+       nscd_domtrans(sysadm_passwd_t)
+')
+
 ########################################
 #
 # Useradd local policy

diff --git a/policy/modules/apps/mono.te b/policy/modules/apps/mono.te
index 050530227f41961a7473ac1ac4d41f982bd2262d..c924b1653c86c8444c3245fce12cd43594e0514e 100644 (file)
--- a/policy/modules/apps/mono.te
+++ b/policy/modules/apps/mono.te
@@ -1,5 +1,5 @@
 
-policy_module(mono,1.1.3)
+policy_module(mono,1.1.4)
 
 ########################################
 #
@@ -7,10 +7,8 @@ policy_module(mono,1.1.3)
 #
 
 type mono_t;
-domain_type(mono_t)
-
 type mono_exec_t;
-domain_entry_file(mono_t,mono_exec_t)
+init_system_domain(mono_t,mono_exec_t)
 
 ########################################
 #
@@ -31,6 +29,10 @@ ifdef(`targeted_policy',`
                avahi_dbus_chat(mono_t)
        ')
 
+       optional_policy(`
+               cups_dbus_chat(mono_t)
+       ')
+
        optional_policy(`
                hal_dbus_chat(mono_t)
        ')

diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
index b00f0ee394f5b8c2bded6429f873dca6b445dc60..f7ea49ebf048bd65b07ace72930eca2b05daeb60 100644 (file)
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -125,7 +125,6 @@ ifdef(`distro_gentoo',`
 /usr/lib/ccache/bin(/.*)?              gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/pgsql/test/regress/.*\.sh --  gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/qt.*/bin(/.*)?                        gen_context(system_u:object_r:bin_t,s0)
-/usr/lib/vte/gnome-pty-helper --       gen_context(system_u:object_r:bin_t,s0)
 /usr/lib(64)?/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:bin_t,s0)
 /usr/lib(64)?/apt/methods.+    --      gen_context(system_u:object_r:bin_t,s0)
 /usr/lib(64)?/courier(/.*)?            gen_context(system_u:object_r:bin_t,s0)
@@ -143,6 +142,7 @@ ifdef(`distro_gentoo',`
 /usr/lib(64)?/news/bin(/.*)?           gen_context(system_u:object_r:bin_t,s0)
 /usr/lib(64)?/portage/bin(/.*)?                gen_context(system_u:object_r:bin_t,s0)
 /usr/lib(64)?/sftp-server      --      gen_context(system_u:object_r:bin_t,s0)
+/usr/lib(64)?/vte/gnome-pty-helper --  gen_context(system_u:object_r:bin_t,s0)
 
 /usr/lib(64)?/debug/bin(/.*)?  --      gen_context(system_u:object_r:bin_t,s0)
 /usr/lib(64)?/debug/sbin(/.*)? --      gen_context(system_u:object_r:sbin_t,s0)

diff --git a/policy/modules/kernel/corecommands.te b/policy/modules/kernel/corecommands.te
index 513514eb1bc82403458cd2994af0d4d710b6fba6..56586938a0974834bc8ada9dc0eb1c811dcce02e 100644 (file)
--- a/policy/modules/kernel/corecommands.te
+++ b/policy/modules/kernel/corecommands.te
@@ -1,5 +1,5 @@
 
-policy_module(corecommands,1.3.15)
+policy_module(corecommands,1.3.16)
 
 ########################################
 #

diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
index 1aa840be90bbbb4ce5069819d99f6fbcfc1cd71b..7ded82bc191e80aa5ebc09042fa63c46c52a07fa 100644 (file)
--- a/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@ -14,6 +14,7 @@
 /dev/beep              -c      gen_context(system_u:object_r:sound_device_t,s0)
 /dev/dsp.*             -c      gen_context(system_u:object_r:sound_device_t,s0)
 /dev/efirtc            -c      gen_context(system_u:object_r:clock_device_t,s0)
+/dev/em8300.*          -c      gen_context(system_u:object_r:v4l_device_t,s0)
 /dev/event.*           -c      gen_context(system_u:object_r:event_device_t,s0)
 /dev/evtchn            -c      gen_context(system_u:object_r:xen_device_t,s0)
 /dev/fb[0-9]*          -c      gen_context(system_u:object_r:framebuf_device_t,s0)
@@ -46,6 +47,7 @@
 /dev/radeon            -c      gen_context(system_u:object_r:dri_device_t,s0)
 /dev/radio.*           -c      gen_context(system_u:object_r:v4l_device_t,s0)
 /dev/random            -c      gen_context(system_u:object_r:random_device_t,s0)
+/dev/raw1394.          -c      gen_context(system_u:object_r:v4l_device_t,s0)
 /dev/(misc/)?rtc       -c      gen_context(system_u:object_r:clock_device_t,s0)
 /dev/sequencer         -c      gen_context(system_u:object_r:sound_device_t,s0)
 /dev/sequencer2                -c      gen_context(system_u:object_r:sound_device_t,s0)

diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
index bc5b1c0976df0b2e072800c3a22ef56eec661c06..9564c3d579bd4e3cf8ed915fa3386e6666e979ff 100644 (file)
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -1,5 +1,5 @@
 
-policy_module(devices,1.1.22)
+policy_module(devices,1.1.23)
 
 ########################################
 #

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index a9d46014f919ce277911c7c0b05a02a12495c831..1aa42798a0979b0054c879900fbd223068f6321d 100644 (file)
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -386,7 +386,7 @@ interface(`files_write_non_security_dirs',`
                attribute file_type, security_file_type;
        ')
 
-       allow $1 file_type:dir write;
+       allow $1 { file_type -security_file_type }:dir write;
 ')
 
 ########################################
@@ -4497,3 +4497,47 @@ interface(`files_unconfined',`
 
        typeattribute $1 files_unconfined_type;
 ')
+
+########################################
+## <summary>
+##     Allow attempts to monage any directory
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain to allow
+##     </summary>
+## </param>
+#
+interface(`files_manage_non_security_dirs',`
+       gen_require(`
+               attribute file_type, security_file_type;
+       ')
+
+       allow $1 { file_type -security_file_type }:dir create_dir_perms;
+')
+
+########################################
+## <summary>
+##     Create a aliased type to etc_runtime_t files.
+## </summary>
+## <desc>
+##     <p>
+##     Create a aliased type to etc runtime files.
+##     </p>
+##     <p>
+##     This is added to remove types that should have been etc_runtime_t
+##     </p>
+## </desc>
+## <param name="domain">
+##     <summary>
+##     Alias type for etc_runtime_t.
+##     </summary>
+## </param>
+#
+interface(`corecmd_etc_runtime_alias',`
+       gen_require(`
+               type etc_runtime_t;
+       ')
+
+       typealias etc_runtime_t alias $1;
+')

diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te
index 81e4660c46ec948165dcfd685f7675aa5a65aefa..e35bab1d11001160ecb17df16eb11cf98d2b1be2 100644 (file)
--- a/policy/modules/kernel/files.te
+++ b/policy/modules/kernel/files.te
@@ -1,5 +1,5 @@
 
-policy_module(files,1.2.17)
+policy_module(files,1.2.18)
 
 ########################################
 #

diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
index 5a7769c415d4768f23e7dbae99c62dbec36c4c59..c704c3f4de606d34362edb0973eb6f2243f21089 100644 (file)
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -2437,6 +2437,24 @@ interface(`fs_getattr_rpc_pipefs',`
        allow $1 rpc_pipefs_t:filesystem getattr;
 ')
 
+#########################################
+## <summary>
+##     Read and write RPC pipe filesystem named pipes.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`fs_rw_rpc_named_pipes',`
+       gen_require(`
+               type nfs_t;
+       ')
+
+       allow $1 rpc_pipefs_t:fifo_file { read write };
+')
+
 ########################################
 ## <summary>
 ##     Mount a tmpfs filesystem.

diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
index b9fa21b9b2dfaada32f6bf73eb56f824ef064cf9..dab245124c2b998cc88ec56af502417321053b47 100644 (file)
--- a/policy/modules/kernel/filesystem.te
+++ b/policy/modules/kernel/filesystem.te
@@ -1,5 +1,5 @@
 
-policy_module(filesystem,1.3.14)
+policy_module(filesystem,1.3.15)
 
 ########################################
 #

diff --git a/policy/modules/kernel/mcs.te b/policy/modules/kernel/mcs.te
index 5f8b1f4021002a8e267e2993f7a22aadaf1f268b..e75d5debe6c867484a50517ed2188e99679934a2 100644 (file)
--- a/policy/modules/kernel/mcs.te
+++ b/policy/modules/kernel/mcs.te
@@ -1,5 +1,5 @@
 
-policy_module(mcs,1.0.3)
+policy_module(mcs,1.0.4)
 
 ########################################
 #
@@ -43,6 +43,7 @@ range_transition initrc_t crond_exec_t s0 - s0:c0.c255;
 range_transition initrc_t cupsd_exec_t s0 - s0:c0.c255;
 range_transition initrc_t sshd_exec_t s0 - s0:c0.c255;
 range_transition initrc_t udev_exec_t s0 - s0:c0.c255;
+range_transition initrc_t setrans_exec_t s0 - s0:c0.c255;
 range_transition initrc_t xdm_exec_t s0 - s0:c0.c255;
 range_transition kernel_t udev_exec_t s0 - s0:c0.c255;
 

diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
index 0b8fa12f411a5625430b2c82897aebba08b12dca..9a3b1900d17a68b0abfdf11852c2415cbef38ae5 100644 (file)
--- a/policy/modules/kernel/terminal.if
+++ b/policy/modules/kernel/terminal.if
@@ -917,7 +917,7 @@ interface(`term_dontaudit_use_unallocated_ttys',`
                type tty_device_t;
        ')
 
-       dontaudit $1 tty_device_t:chr_file rw_file_perms;
+       dontaudit $1 tty_device_t:chr_file { rw_term_perms lock append };
 ')
 
 ########################################

diff --git a/policy/modules/kernel/terminal.te b/policy/modules/kernel/terminal.te
index fb4e1c2696ca3d380e43625de22d4b2b3cced553..d87def7e7b2277cd4241702ae08686e737ddf786 100644 (file)
--- a/policy/modules/kernel/terminal.te
+++ b/policy/modules/kernel/terminal.te
@@ -1,5 +1,5 @@
 
-policy_module(terminal,1.1.8)
+policy_module(terminal,1.1.9)
 
 ########################################
 #

diff --git a/policy/modules/services/amavis.te b/policy/modules/services/amavis.te
index e8f7662e9641c58f48a1b5202b0b3cdb782c46b3..ebac567edd65696f59cfaf7846cef4c4933a6f63 100644 (file)
--- a/policy/modules/services/amavis.te
+++ b/policy/modules/services/amavis.te
@@ -1,5 +1,5 @@
 
-policy_module(amavis,1.0.8)
+policy_module(amavis,1.0.9)
 
 ########################################
 #
@@ -156,6 +156,7 @@ mta_read_config(amavis_t)
 
 ifdef(`targeted_policy',`
        term_dontaudit_use_generic_ptys(amavis_t)
+       term_dontaudit_use_unallocated_ttys(amavis_t)
 ')
 
 optional_policy(`

diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
index 9e0e150637882c8135bd04b9797625314efd64be..7a2570cc102ac7811a32a6ee9734e5254c24cd10 100644 (file)
--- a/policy/modules/services/apache.te
+++ b/policy/modules/services/apache.te
@@ -1,5 +1,5 @@
 
-policy_module(apache,1.3.17)
+policy_module(apache,1.3.18)
 
 #
 # NOTES: 
@@ -514,6 +514,7 @@ optional_policy(`
 allow httpd_suexec_t self:capability { setuid setgid };
 allow httpd_suexec_t self:process signal_perms;
 allow httpd_suexec_t self:unix_stream_socket create_stream_socket_perms;
+allow httpd_suexec_t self:netlink_route_socket r_netlink_socket_perms;
 
 ifdef(`targeted_policy',`
        gen_tunable(httpd_suexec_disable_trans,false)
@@ -691,6 +692,10 @@ optional_policy(`
        nscd_socket_use(httpd_unconfined_script_t)
 ')
 
+optional_policy(`
+       snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
+')
+
 ########################################
 #
 # httpd_rotatelogs local policy
@@ -712,4 +717,5 @@ miscfiles_read_localization(httpd_rotatelogs_t)
 
 ifdef(`targeted_policy',`
        term_dontaudit_use_generic_ptys(httpd_rotatelogs_t)
+       term_dontaudit_use_unallocated_ttys(httpd_rotatelogs_t)
 ')

diff --git a/policy/modules/services/automount.te b/policy/modules/services/automount.te
index c92b118cff01043d7438b4caf14187c2d98528ee..ab4e301abc9a42ec01c23cfa1d49490582a8cf31 100644 (file)
--- a/policy/modules/services/automount.te
+++ b/policy/modules/services/automount.te
@@ -1,5 +1,5 @@
 
-policy_module(automount,1.2.8)
+policy_module(automount,1.2.9)
 
 ########################################
 #
@@ -99,6 +99,8 @@ corenet_sendrecv_all_client_packets(automount_t)
 # Someone writes a showmount policy
 corenet_tcp_bind_reserved_port(automount_t)
 corenet_tcp_bind_all_rpc_ports(automount_t)
+corenet_udp_bind_reserved_port(automount_t)
+corenet_udp_bind_all_rpc_ports(automount_t)
 
 dev_read_sysfs(automount_t)
 # for SSP

diff --git a/policy/modules/services/bluetooth.fc b/policy/modules/services/bluetooth.fc
index ad826612344667711292e25da216dfbd17cb292e..3cb34d00efcc1102b931efd0c47f9b77a45ba334 100644 (file)
--- a/policy/modules/services/bluetooth.fc
+++ b/policy/modules/services/bluetooth.fc
@@ -8,6 +8,7 @@
 # /usr
 #
 /usr/bin/blue.*pin     --      gen_context(system_u:object_r:bluetooth_helper_exec_t,s0)
+/usr/bin/dund          --      gen_context(system_u:object_r:bluetooth_exec_t,s0)
 /usr/bin/hidd          --      gen_context(system_u:object_r:bluetooth_exec_t,s0)
 /usr/bin/rfcomm                --      gen_context(system_u:object_r:bluetooth_exec_t,s0)
 

diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te
index dac26bf36b2b2dbdc75031a3b6041982b813635d..fd6c738dae7e3fa3d7093426b61634ecf960b653 100644 (file)
--- a/policy/modules/services/bluetooth.te
+++ b/policy/modules/services/bluetooth.te
@@ -1,5 +1,5 @@
 
-policy_module(bluetooth,1.2.9)
+policy_module(bluetooth,1.2.10)
 
 ########################################
 #
@@ -217,6 +217,7 @@ ifdef(`targeted_policy',`
        fs_rw_tmpfs_files(bluetooth_helper_t)
 
        term_dontaudit_use_generic_ptys(bluetooth_helper_t)
+       term_dontaudit_use_unallocated_ttys(bluetooth_helper_t)
 
        unconfined_stream_connect(bluetooth_helper_t)
 
@@ -224,7 +225,8 @@ ifdef(`targeted_policy',`
 
        optional_policy(`
                corenet_tcp_connect_xserver_port(bluetooth_helper_t)
-
+               #Bugzilla https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=205956
+               xserver_read_xdm_tmp_files(bluetooth_helper_t)
                xserver_stream_connect_xdm(bluetooth_helper_t)
                xserver_use_xdm_fds(bluetooth_helper_t)
                xserver_rw_xdm_pipes(bluetooth_helper_t)
@@ -244,6 +246,10 @@ optional_policy(`
        nscd_socket_use(bluetooth_helper_t)
 ')
 
+optional_policy(`
+       ppp_domtrans(bluetooth_t)
+')
+
 optional_policy(`
                xserver_stream_connect_xdm(bluetooth_helper_t)
 ')     

diff --git a/policy/modules/services/clamav.te b/policy/modules/services/clamav.te
index e79e01443eafbe1d94bbadc34426c0b071f13fc0..a66b0aebfd6fceac72408b0ab5952ce7f38e4690 100644 (file)
--- a/policy/modules/services/clamav.te
+++ b/policy/modules/services/clamav.te
@@ -1,5 +1,5 @@
 
-policy_module(clamav,1.0.5)
+policy_module(clamav,1.0.6)
 
 ########################################
 #
@@ -121,6 +121,7 @@ cron_use_system_job_fds(clamd_t)
 cron_rw_pipes(clamd_t)
 
 ifdef(`targeted_policy',`
+       term_dontaudit_use_unallocated_ttys(clamd_t)
        term_dontaudit_use_generic_ptys(clamd_t)
 ')
 

diff --git a/policy/modules/services/cups.te b/policy/modules/services/cups.te
index 6043f6c8073123b51cbacd7408cfd6f8ec9d76eb..e0c3284dafc759d7b86b8a5b701489f325ffdcf9 100644 (file)
--- a/policy/modules/services/cups.te
+++ b/policy/modules/services/cups.te
@@ -1,5 +1,5 @@
 
-policy_module(cups,1.3.13)
+policy_module(cups,1.3.14)
 
 ########################################
 #
@@ -159,7 +159,7 @@ fs_getattr_all_fs(cupsd_t)
 fs_search_auto_mountpoints(cupsd_t)
 
 term_dontaudit_use_console(cupsd_t)
-term_write_unallocated_ttys(cupsd_t)
+term_use_unallocated_ttys(cupsd_t)
 term_search_ptys(cupsd_t)
 
 auth_domtrans_chk_passwd(cupsd_t)
@@ -530,7 +530,8 @@ optional_policy(`
 # HPLIP local policy
 #
 
-allow hplip_t self:capability net_raw;
+# Needed for USB Scanneer and xsane
+allow hplip_t self:capability { dac_override dac_read_search net_raw };
 dontaudit hplip_t self:capability sys_tty_config;
 allow hplip_t self:fifo_file rw_file_perms;
 allow hplip_t self:process signal_perms;

diff --git a/policy/modules/services/dhcp.te b/policy/modules/services/dhcp.te
index eff134a561d8d472407dfe002c23f39b7ba9f82c..3392bc40d9196c19547d26343f613443c711bd38 100644 (file)
--- a/policy/modules/services/dhcp.te
+++ b/policy/modules/services/dhcp.te
@@ -1,5 +1,5 @@
 
-policy_module(dhcp,1.1.2)
+policy_module(dhcp,1.1.3)
 
 ########################################
 #
@@ -123,6 +123,12 @@ optional_policy(`
        bind_read_dnssec_keys(dhcpd_t)
 ')
 
+optional_policy(`
+       dbus_system_bus_client_template(dhcpd,dhcpd_t)
+       dbus_connect_system_bus(dhcpd_t)
+       dbus_send_system_bus(dhcpd_t)
+')
+
 optional_policy(`
        nis_use_ypbind(dhcpd_t)
 ')

diff --git a/policy/modules/services/kerberos.if b/policy/modules/services/kerberos.if
index a475645fefe09bc540c94294b707b57fcd38f474..7854a02c829072c59bba8261242ce990d295c9c3 100644 (file)
--- a/policy/modules/services/kerberos.if
+++ b/policy/modules/services/kerberos.if
@@ -34,11 +34,13 @@
 interface(`kerberos_use',`
        gen_require(`
                type krb5_conf_t;
+               type krb5kdc_conf_t;
        ')
 
        files_search_etc($1)
        allow $1 krb5_conf_t:file { getattr read };
        dontaudit $1 krb5_conf_t:file write;
+       dontaudit $1 krb5kdc_conf_t:dir r_dir_perms;
 
        tunable_policy(`allow_kerberos',`
                allow $1 self:tcp_socket create_socket_perms;

diff --git a/policy/modules/services/kerberos.te b/policy/modules/services/kerberos.te
index 2a9c1dd6742d48972e47fa120c15df6b22d38c83..4e85529127a5f288f8abbc18cbeb21fda05c9f09 100644 (file)
--- a/policy/modules/services/kerberos.te
+++ b/policy/modules/services/kerberos.te
@@ -1,5 +1,5 @@
 
-policy_module(kerberos,1.1.3)
+policy_module(kerberos,1.1.4)
 
 ########################################
 #

diff --git a/policy/modules/services/lpd.fc b/policy/modules/services/lpd.fc
index e97eb7aedb96468e42c05f434379c4e66c653ecb..adef45f5d6c7dff768a64f15416d74c0c287b106 100644 (file)
--- a/policy/modules/services/lpd.fc
+++ b/policy/modules/services/lpd.fc
@@ -9,6 +9,7 @@
 /usr/sbin/checkpc      --      gen_context(system_u:object_r:checkpc_exec_t,s0)
 /usr/sbin/lpd          --      gen_context(system_u:object_r:lpd_exec_t,s0)
 /usr/share/printconf/.* --     gen_context(system_u:object_r:printconf_t,s0)
+/usr/bin/lp(\.cups)?   --      gen_context(system_u:object_r:lpr_exec_t,s0)
 /usr/bin/lpr(\.cups)?  --      gen_context(system_u:object_r:lpr_exec_t,s0)
 /usr/bin/lpq(\.cups)?  --      gen_context(system_u:object_r:lpr_exec_t,s0)
 /usr/bin/lprm(\.cups)? --      gen_context(system_u:object_r:lpr_exec_t,s0)

diff --git a/policy/modules/services/lpd.te b/policy/modules/services/lpd.te
index 6adb18181cba8a0b79ae17629272514d56d46036..615069a68a0cc2e438cf3fc691f668436e909532 100644 (file)
--- a/policy/modules/services/lpd.te
+++ b/policy/modules/services/lpd.te
@@ -1,5 +1,5 @@
 
-policy_module(lpd,1.2.6)
+policy_module(lpd,1.2.7)
 
 ########################################
 #

diff --git a/policy/modules/services/networkmanager.fc b/policy/modules/services/networkmanager.fc
index da1e1e5a3d051754c29de0da0bf6bc337bfb443d..a1b3e624306c3eb5b7c33b8bafccec655a9fa739 100644 (file)
--- a/policy/modules/services/networkmanager.fc
+++ b/policy/modules/services/networkmanager.fc
@@ -3,3 +3,4 @@
 /var/run/NetworkManager\.pid   --      gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
 /var/run/NetworkManager(/.*)?          gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
 /var/run/wpa_supplicant(/.*)?          gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
+/var/run/wpa_supplicant-global --      gen_context(system_u:object_r:NetworkManager_var_run_t,s0)

diff --git a/policy/modules/services/networkmanager.te b/policy/modules/services/networkmanager.te
index a9de827c43e9b2fd884c59a802e3e22da7f16548..6b157e7d3f90d865d02370e258580f32680687f0 100644 (file)
--- a/policy/modules/services/networkmanager.te
+++ b/policy/modules/services/networkmanager.te
@@ -1,5 +1,5 @@
 
-policy_module(networkmanager,1.3.7)
+policy_module(networkmanager,1.3.8)
 
 ########################################
 #
@@ -21,7 +21,7 @@ files_pid_file(NetworkManager_var_run_t)
 # networkmanager will ptrace itself if gdb is installed
 # and it receives a unexpected signal (rh bug #204161) 
 allow NetworkManager_t self:capability { kill setgid setuid sys_nice dac_override net_admin net_raw net_bind_service ipc_lock};
-dontaudit NetworkManager_t self:capability sys_tty_config;
+dontaudit NetworkManager_t self:capability { sys_tty_config sys_ptrace };
 allow NetworkManager_t self:process { ptrace setcap getsched signal_perms };
 allow NetworkManager_t self:fifo_file rw_file_perms;
 allow NetworkManager_t self:unix_dgram_socket { sendto create_socket_perms };
@@ -78,6 +78,7 @@ corecmd_exec_ls(NetworkManager_t)
 
 domain_use_interactive_fds(NetworkManager_t)
 domain_read_confined_domains_state(NetworkManager_t)
+domain_dontaudit_read_all_domains_state(NetworkManager_t)
 
 files_read_etc_files(NetworkManager_t)
 files_read_etc_runtime_files(NetworkManager_t)
@@ -161,6 +162,7 @@ optional_policy(`
 
 optional_policy(`
        ppp_domtrans(NetworkManager_t)
+       ppp_read_pid_files(NetworkManager_t)
 ')
 
 optional_policy(`

diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te
index 534d2197584014d9915773013c099ff3cea1b67b..63b256a93bedcc1aec62fb212f31179c2913d66e 100644 (file)
--- a/policy/modules/services/ntp.te
+++ b/policy/modules/services/ntp.te
@@ -1,5 +1,5 @@
 
-policy_module(ntp,1.1.5)
+policy_module(ntp,1.1.6)
 
 ########################################
 #
@@ -122,6 +122,12 @@ ifdef(`targeted_policy', `
        term_dontaudit_use_unallocated_ttys(ntpd_t)
        term_dontaudit_use_generic_ptys(ntpd_t)
        files_dontaudit_read_root_files(ntpd_t)
+
+       optional_policy(`
+               # The Gnome date GUI code is requesting that 
+               # the ntp code change the date of the machine.
+               unconfined_rw_pipes(ntpd_t)
+       ')
 ')
 
 optional_policy(`

diff --git a/policy/modules/services/postfix.te b/policy/modules/services/postfix.te
index 9f574d29ec5ceb7fe3e2b9f2319d465bcc65bde2..60a5f71e3baf5b92a302362dfa1edb824bc54418 100644 (file)
--- a/policy/modules/services/postfix.te
+++ b/policy/modules/services/postfix.te
@@ -1,5 +1,5 @@
 
-policy_module(postfix,1.2.12)
+policy_module(postfix,1.2.13)
 
 ########################################
 #
@@ -171,6 +171,11 @@ sysnet_read_config(postfix_master_t)
 mta_rw_aliases(postfix_master_t)
 mta_read_sendmail_bin(postfix_master_t)
 
+ifdef(`targeted_policy',`
+       term_dontaudit_use_unallocated_ttys(postfix_master_t)
+       term_dontaudit_use_generic_ptys(postfix_master_t)
+')
+
 optional_policy(`
        cyrus_stream_connect(postfix_master_t)
 ')
@@ -361,6 +366,7 @@ seutil_read_config(postfix_map_t)
 sysnet_read_config(postfix_map_t)
 
 ifdef(`targeted_policy',`
+       term_dontaudit_use_unallocated_ttys(postfix_map_t)
        term_dontaudit_use_generic_ptys(postfix_map_t)
 ')
 

diff --git a/policy/modules/services/ppp.fc b/policy/modules/services/ppp.fc
index 3b2595ca4d644b43d1883da62294179aaffc2e88..ed6561f71a6634797d2e02bbb7eaa9733ab0c4f2 100644 (file)
--- a/policy/modules/services/ppp.fc
+++ b/policy/modules/services/ppp.fc
@@ -1,14 +1,20 @@
 #
 # /etc
 #
-/etc/ppp                               -d      gen_context(system_u:object_r:pppd_etc_t,s0)
-/etc/ppp/.*                    --      gen_context(system_u:object_r:pppd_etc_rw_t,s0)
+/etc/ppp                       -d      gen_context(system_u:object_r:pppd_etc_t,s0)
+/etc/ppp(/.*)?                 --      gen_context(system_u:object_r:pppd_etc_rw_t,s0)
+/etc/ppp/peers(/.*)?                   gen_context(system_u:object_r:pppd_etc_rw_t,s0)
 /etc/ppp/.*secrets             --      gen_context(system_u:object_r:pppd_secret_t,s0)
 /etc/ppp/resolv\.conf          --      gen_context(system_u:object_r:pppd_etc_rw_t,s0)
 
 # Fix /etc/ppp {up,down} family scripts (see man pppd)
 /etc/ppp/(auth|ip(v6|x)?)-(up|down) -- gen_context(system_u:object_r:pppd_script_exec_t,s0)
 
+#
+# /sbin
+#
+/sbin/ppp-watch                        --      gen_context(system_u:object_r:pppd_exec_t,s0)
+
 #
 # /usr
 #
@@ -20,11 +26,10 @@
 # /var
 #
 /var/run/(i)?ppp.*pid          --      gen_context(system_u:object_r:pppd_var_run_t,s0)
-/var/run/pppd[0-9]*\.tdb               --      gen_context(system_u:object_r:pppd_var_run_t,s0)
+/var/run/pppd[0-9]*\.tdb       --      gen_context(system_u:object_r:pppd_var_run_t,s0)
 /var/run/ppp(/.*)?                     gen_context(system_u:object_r:pppd_var_run_t,s0)
 # Fix pptp sockets
 /var/run/pptp(/.*)?                    gen_context(system_u:object_r:pptp_var_run_t,s0)
 
 /var/log/ppp-connect-errors.*  --      gen_context(system_u:object_r:pppd_log_t,s0)
 /var/log/ppp/.*                        --      gen_context(system_u:object_r:pppd_log_t,s0)
-

diff --git a/policy/modules/services/ppp.if b/policy/modules/services/ppp.if
index d6453d2c579ed2de297c366b38f040a33424df59..4617701dbb26ff30a7305cc3eddbc7d27ee7cf07 100644 (file)
--- a/policy/modules/services/ppp.if
+++ b/policy/modules/services/ppp.if
@@ -202,6 +202,24 @@ interface(`ppp_read_secrets',`
        files_search_etc($1)
 ')
 
+########################################
+## <summary>
+##     Read PPP pid files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`ppp_read_pid_files',`
+       gen_require(`
+               type pppd_var_run_t;
+       ')
+
+       allow $1 pppd_var_run_t:file r_file_perms;
+')
+
 ########################################
 ## <summary>
 ##     Create, read, write, and delete PPP pid files.

diff --git a/policy/modules/services/ppp.te b/policy/modules/services/ppp.te
index 4f48f9b76c77871c6fd6f9406deb6b693b897685..fea68f7bb25cd8a946699b37504e022fe4f00c63 100644 (file)
--- a/policy/modules/services/ppp.te
+++ b/policy/modules/services/ppp.te
@@ -1,5 +1,5 @@
 
-policy_module(ppp,1.2.4)
+policy_module(ppp,1.2.5)
 
 ########################################
 #
@@ -64,7 +64,7 @@ allow pppd_t self:fifo_file rw_file_perms;
 allow pppd_t self:socket create_socket_perms;
 allow pppd_t self:unix_dgram_socket create_socket_perms;
 allow pppd_t self:unix_stream_socket create_socket_perms;
-allow pppd_t self:netlink_route_socket r_netlink_socket_perms;
+allow pppd_t self:netlink_route_socket rw_netlink_socket_perms;
 allow pppd_t self:tcp_socket create_stream_socket_perms;
 allow pppd_t self:udp_socket { connect connected_socket_perms };
 allow pppd_t self:packet_socket create_socket_perms;
@@ -80,9 +80,11 @@ allow pppd_t pppd_devpts_t:chr_file { rw_file_perms setattr };
 allow pppd_t pppd_etc_t:dir rw_dir_perms;
 allow pppd_t pppd_etc_t:file r_file_perms;
 allow pppd_t pppd_etc_t:lnk_file { getattr read };
-files_etc_filetrans(pppd_t,pppd_etc_t,file)
 
+allow pppd_t pppd_etc_rw_t:dir rw_dir_perms;
 allow pppd_t pppd_etc_rw_t:file create_file_perms;
+# Automatically label newly created files under /etc/ppp with this type
+type_transition pppd_t pppd_etc_t:file pppd_etc_rw_t;
 
 allow pppd_t pppd_lock_t:file create_file_perms;
 files_lock_filetrans(pppd_t,pppd_lock_t,file)
@@ -104,9 +106,6 @@ allow pppd_t pptp_t:process signal;
 # Access secret files
 allow pppd_t pppd_secret_t:file r_file_perms;
 
-# Automatically label newly created files under /etc/ppp with this type
-type_transition pppd_t pppd_etc_t:file pppd_etc_rw_t;
-
 kernel_read_kernel_sysctls(pppd_t)
 kernel_read_system_state(pppd_t)
 kernel_read_net_sysctls(pppd_t)
@@ -147,7 +146,10 @@ corecmd_exec_shell(pppd_t)
 domain_use_interactive_fds(pppd_t)
 
 files_exec_etc_files(pppd_t)
-files_read_etc_runtime_files(pppd_t)
+files_manage_etc_runtime_files(pppd_t)
+files_etc_filetrans_etc_runtime(pppd_t, { dir file })
+files_dontaudit_write_etc_files(pppd_t)
+
 # for scripts
 files_read_etc_files(pppd_t)
 
@@ -174,6 +176,8 @@ userdom_dontaudit_search_sysadm_home_dirs(pppd_t)
 userdom_search_sysadm_home_dirs(pppd_t)
 userdom_search_unpriv_users_home_dirs(pppd_t)
 
+ppp_exec(pppd_t)
+
 ifdef(`targeted_policy', `
        term_dontaudit_use_unallocated_ttys(pppd_t)
        term_dontaudit_use_generic_ptys(pppd_t)
@@ -305,6 +309,10 @@ ifdef(`targeted_policy',`
         files_dontaudit_read_root_files(pptp_t)
 ')
 
+optional_policy(`
+       consoletype_exec(pppd_t)
+')
+
 optional_policy(`
        hostname_exec(pptp_t)
 ')

diff --git a/policy/modules/services/rpc.if b/policy/modules/services/rpc.if
index 32b53713d309d7a6b99a3a71ae80ccc2dd2dba6f..30c32442ce91b88e660f297d78d32e842d6bd5fe 100644 (file)
--- a/policy/modules/services/rpc.if
+++ b/policy/modules/services/rpc.if
@@ -92,6 +92,7 @@ template(`rpc_domain_template', `
        corenet_udp_bind_reserved_port($1_t)
        corenet_sendrecv_generic_server_packets($1_t)
 
+       fs_rw_rpc_named_pipes($1_t) 
        fs_search_auto_mountpoints($1_t)
 
        term_dontaudit_use_console($1_t)

diff --git a/policy/modules/services/rpc.te b/policy/modules/services/rpc.te
index 955933c61a6dfdb2e17fddfef3bc30da99c3aef6..e5ec339f28adda16693e2b94190007b5e18e31a8 100644 (file)
--- a/policy/modules/services/rpc.te
+++ b/policy/modules/services/rpc.te
@@ -1,5 +1,5 @@
 
-policy_module(rpc,1.2.14)
+policy_module(rpc,1.2.15)
 
 ########################################
 #

diff --git a/policy/modules/services/sendmail.te b/policy/modules/services/sendmail.te
index 66ae8fe912a807482c6fd5766619d316333d7b4a..37a1f900fad06c3f02b3d24c9e6e1874134493c6 100644 (file)
--- a/policy/modules/services/sendmail.te
+++ b/policy/modules/services/sendmail.te
@@ -1,5 +1,5 @@
 
-policy_module(sendmail,1.2.2)
+policy_module(sendmail,1.2.3)
 
 ########################################
 #
@@ -37,6 +37,13 @@ allow sendmail_t sendmail_log_t:file create_file_perms;
 allow sendmail_t sendmail_log_t:dir { rw_dir_perms setattr };
 logging_log_filetrans(sendmail_t,sendmail_log_t,{ file dir })
 
+allow sendmail_t sendmail_tmp_t:dir manage_dir_perms;
+allow sendmail_t sendmail_tmp_t:file manage_file_perms;
+files_tmp_filetrans(sendmail_t, sendmail_tmp_t, { file dir })
+
+allow sendmail_t sendmail_var_run_t:file manage_file_perms;
+files_pid_filetrans(sendmail_t,sendmail_var_run_t,file)
+
 kernel_read_kernel_sysctls(sendmail_t)
 # for piping mail to a command
 kernel_read_system_state(sendmail_t)
@@ -104,13 +111,6 @@ ifdef(`targeted_policy',`
        term_dontaudit_use_unallocated_ttys(sendmail_t)
        term_dontaudit_use_generic_ptys(sendmail_t)
        files_dontaudit_read_root_files(sendmail_t)
-',`
-       allow sendmail_t sendmail_tmp_t:dir create_dir_perms;
-       allow sendmail_t sendmail_tmp_t:file create_file_perms;
-       files_tmp_filetrans(sendmail_t, sendmail_tmp_t, { file dir })
-
-       allow sendmail_t sendmail_var_run_t:file { getattr create read write append setattr unlink lock };
-       files_pid_filetrans(sendmail_t,sendmail_var_run_t,file)
 ')
 
 optional_policy(`

diff --git a/policy/modules/services/setroubleshoot.te b/policy/modules/services/setroubleshoot.te
index c3ced2a7bae5fbf37918bd13767a50753900ce42..34a8e5d299a39aea39489ab34730da20836c17ca 100644 (file)
--- a/policy/modules/services/setroubleshoot.te
+++ b/policy/modules/services/setroubleshoot.te
@@ -1,5 +1,5 @@
 
-policy_module(setroubleshoot,1.0.1)
+policy_module(setroubleshoot,1.0.2)
 
 ########################################
 #
@@ -69,6 +69,8 @@ corenet_sendrecv_smtp_client_packets(setroubleshootd_t)
 
 dev_read_urand(setroubleshootd_t)
 
+domain_dontaudit_search_all_domains_state(setroubleshootd_t)
+
 files_read_usr_files(setroubleshootd_t)
 files_read_etc_files(setroubleshootd_t)
 files_getattr_all_dirs(setroubleshootd_t)
@@ -82,6 +84,7 @@ term_dontaudit_use_all_user_ttys(setroubleshootd_t)
 init_read_utmp(setroubleshootd_t)
 init_dontaudit_write_utmp(setroubleshootd_t)
 init_use_fds(setroubleshootd_t)
+init_use_script_ptys(setroubleshootd_t)
 
 libs_use_ld_so(setroubleshootd_t)
 libs_use_shared_libs(setroubleshootd_t)
@@ -107,3 +110,7 @@ optional_policy(`
        rpm_dontaudit_manage_db(setroubleshootd_t)
         rpm_use_script_fds(setroubleshootd_t)
 ')
+
+optional_policy(`
+       nis_use_ypbind(setroubleshootd_t)
+')

diff --git a/policy/modules/services/snmp.if b/policy/modules/services/snmp.if
index 730a1acf57fffe27da65b5e041d5527e79e83b51..cbe73e446d7a1e030bfa83572790f69fe4d5523f 100644 (file)
--- a/policy/modules/services/snmp.if
+++ b/policy/modules/services/snmp.if
@@ -46,3 +46,22 @@ interface(`snmp_read_snmp_var_lib_files',`
        allow $1 snmpd_var_lib_t:file r_file_perms;
        allow $1 snmpd_var_lib_t:lnk_file { getattr read };
 ')
+
+########################################
+## <summary>
+##     dontaudit Read snmpd libraries.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`snmp_dontaudit_read_snmp_var_lib_files',`
+       gen_require(`
+               type snmpd_var_lib_t;
+       ')
+       dontaudit $1 snmpd_var_lib_t:dir r_dir_perms;
+       dontaudit $1 snmpd_var_lib_t:file r_file_perms;
+       dontaudit $1 snmpd_var_lib_t:lnk_file { getattr read };
+')

diff --git a/policy/modules/services/snmp.te b/policy/modules/services/snmp.te
index a5f45daea5049f8c61a8b4aa40e55a3b5a3e0b8e..68ccd3e674d58cc8244e31a9ea01d1a1dce11550 100644 (file)
--- a/policy/modules/services/snmp.te
+++ b/policy/modules/services/snmp.te
@@ -1,5 +1,5 @@
 
-policy_module(snmp,1.1.3)
+policy_module(snmp,1.1.4)
 
 ########################################
 #

diff --git a/policy/modules/services/xfs.te b/policy/modules/services/xfs.te
index a7b4e7e90ef0ddf97758c59397ed57a8a418ecaa..11723c04bd51d0df5c56bc3e5167ce0b7b2a3185 100644 (file)
--- a/policy/modules/services/xfs.te
+++ b/policy/modules/services/xfs.te
@@ -1,5 +1,5 @@
 
-policy_module(xfs,1.0.4)
+policy_module(xfs,1.0.5)
 
 ########################################
 #
@@ -21,7 +21,7 @@ files_pid_file(xfs_var_run_t)
 # Local policy
 #
 
-allow xfs_t self:capability { setgid setuid };
+allow xfs_t self:capability { dac_override setgid setuid };
 dontaudit xfs_t self:capability sys_tty_config;
 allow xfs_t self:process { signal_perms setpgid };
 allow xfs_t self:unix_stream_socket create_stream_socket_perms;

diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
index ca83c752857a73c38ec4a944a3f5029cab6b6816..bfa78aeccff2eb33b15db8604ff73f0e7f404458 100644 (file)
--- a/policy/modules/system/authlogin.te
+++ b/policy/modules/system/authlogin.te
@@ -1,5 +1,5 @@
 
-policy_module(authlogin,1.3.14)
+policy_module(authlogin,1.3.15)
 
 ########################################
 #
@@ -206,6 +206,8 @@ files_list_mnt(pam_console_t)
 # read /etc/mtab
 files_read_etc_runtime_files(pam_console_t)
 
+fs_list_auto_mountpoints(pam_console_t)
+
 init_use_fds(pam_console_t)
 init_use_script_ptys(pam_console_t)
 

diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te
index 0ef6d0bd48965341008f6f8366da14212a837cc7..bfa3b7f66f53e555a341f0fe5921b5e208af69b8 100644 (file)
--- a/policy/modules/system/fstools.te
+++ b/policy/modules/system/fstools.te
@@ -1,5 +1,5 @@
 
-policy_module(fstools,1.3.4)
+policy_module(fstools,1.3.5)
 
 ########################################
 #
@@ -112,6 +112,9 @@ corecmd_list_bin(fsadm_t)
 corecmd_list_sbin(fsadm_t)
 corecmd_read_bin_symlinks(fsadm_t)
 corecmd_read_sbin_symlinks(fsadm_t)
+#RedHat bug #201164
+corecmd_exec_shell(fsadm_t)
+
 # cjp: these are probably not needed:
 corecmd_read_bin_files(fsadm_t)
 corecmd_read_bin_pipes(fsadm_t)

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index d35db82df39772dfabc272f6c6ae5e3fbcd3891e..b95fa3d446c765a3c2fdcd9facd33590a0319602 100644 (file)
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -1,5 +1,5 @@
 
-policy_module(init,1.3.24)
+policy_module(init,1.3.25)
 
 gen_require(`
        class passwd rootok;
@@ -520,6 +520,11 @@ ifdef(`targeted_policy',`
 #      optional_policy(`',`
 #              mta_send_mail(initrc_t)
 #      ')
+
+       # allow init scripts to su
+       optional_policy(`
+               su_restricted_domain_template(initrc,initrc_t,system_r)
+       ')
 ')
 
 optional_policy(`
@@ -732,11 +737,6 @@ optional_policy(`
        ssh_dontaudit_read_server_keys(initrc_t)
 ')
 
-# allow init scripts to su
-optional_policy(`
-       su_restricted_domain_template(initrc,initrc_t,system_r)
-')
-
 optional_policy(`
        sysnet_read_dhcpc_state(initrc_t)
 ')

diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc
index bc9a6ac90bcc84296dbb040ac28822e84fbd09a7..ef686ba1365bf49f58d497b118e367ebe6f75a1c 100644 (file)
--- a/policy/modules/system/libraries.fc
+++ b/policy/modules/system/libraries.fc
@@ -128,6 +128,7 @@ ifdef(`distro_gentoo',`
 /usr/lib(64)?/libsipphoneapi\.so.*     --      gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib(64)?/ati-fglrx/.+\.so(\..*)?  --      gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib(64)?/(nvidia/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/fglrx/libGL\.so(\.[^/]*)*        --      gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib(64)?/libGLU\.so(\.[^/]*)*     --      gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib(64)?/libjs\.so.*              --      gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib(64)?(/.*)?/libnvidia.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -140,8 +141,7 @@ ifdef(`distro_gentoo',`
 
 /usr/(local/)?.*\.so(\.[^/]*)*         --      gen_context(system_u:object_r:shlib_t,s0)
 /usr/(local/)?lib(64)?/wine/.+\.so     --      gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/(local/)?lib/libfame-.*\.so.*     --      gen_context(system_u:object_r:textrel_shlib_t,s0)
-
+/usr/(local/)?lib(64)?/(sse2/)?libfame-.*\.so.*        --      gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/NX/lib/libXcomp\.so.*             --      gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/NX/lib/libjpeg\.so.*              --      gen_context(system_u:object_r:textrel_shlib_t,s0)
 
@@ -252,7 +252,7 @@ HOME_DIR/.*/plugins/libflashplayer\.so.* -- gen_context(system_u:object_r:textre
 /usr/lib(64)?/vmware/(.*/)?VmPerl\.so  --      gen_context(system_u:object_r:textrel_shlib_t,s0)
 
 # Java, Sun Microsystems (JPackage SRPM)
-/usr/(.*/)?jre.*/libdeploy\.so(\.[^/]*)*       --      gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/(.*/)?jre.*/libdeploy\.so(\.[^/]*)* --    gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/(local/)?(.*/)?jre.*/libjvm\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/(local/)?(.*/)?jre.*/libawt\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 
@@ -263,6 +263,7 @@ HOME_DIR/.*/plugins/libflashplayer\.so.* -- gen_context(system_u:object_r:textre
 /usr/(local/)?Adobe/(.*/)?lib/[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/(local/)?acroread/(.*/)?lib/[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/(local/)?Adobe/.*\.api            --      gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/(local/)?lib/xchat/plugins/systray.so --  gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/local/matlab.*/bin/glnx86/libmwlapack\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/(.*/)?intellinux/SPPlugins/ADMPlugin\.apl -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 

diff --git a/policy/modules/system/libraries.te b/policy/modules/system/libraries.te
index 1aad262e7ae67a5eaf7f3cc2b7d808f3bcd2f95e..634b95cfbe378cc6990bfccef81f863e825f1815 100644 (file)
--- a/policy/modules/system/libraries.te
+++ b/policy/modules/system/libraries.te
@@ -1,5 +1,5 @@
 
-policy_module(libraries,1.3.13)
+policy_module(libraries,1.3.14)
 
 ########################################
 #

diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
index 8b2ede961d5aa4caef3d97fa52f01bbae0c45767..ba03328aaf4ac78b41e30432600d3c92872697f2 100644 (file)
--- a/policy/modules/system/selinuxutil.te
+++ b/policy/modules/system/selinuxutil.te
@@ -1,5 +1,5 @@
 
-policy_module(selinuxutil,1.2.15)
+policy_module(selinuxutil,1.2.16)
 
 ifdef(`strict_policy',`
        gen_require(`
@@ -449,8 +449,6 @@ selinux_compute_create_context(restorecond_t)
 selinux_compute_relabel_context(restorecond_t)
 selinux_compute_user_contexts(restorecond_t)
 
-term_dontaudit_use_generic_ptys(restorecond_t)
-
 auth_relabel_all_files_except_shadow(restorecond_t )
 auth_read_all_files_except_shadow(restorecond_t)
 
@@ -466,6 +464,11 @@ logging_send_syslog_msg(restorecond_t)
 
 miscfiles_read_localization(restorecond_t)
 
+ifdef(`targeted_policy',`
+       term_dontaudit_use_generic_ptys(restorecond_t)
+       term_dontaudit_use_unallocated_ttys(restorecond_t)
+')
+
 optional_policy(`
        rpm_use_script_fds(restorecond_t)
 ')

diff --git a/policy/modules/system/setrans.te b/policy/modules/system/setrans.te
index 4ab9df0b4de10066c6afbcdf4383a27f572486aa..a42a0de121835763a7eda81295c795f1446905db 100644 (file)
--- a/policy/modules/system/setrans.te
+++ b/policy/modules/system/setrans.te
@@ -1,5 +1,5 @@
 
-policy_module(setrans,1.0.2)
+policy_module(setrans,1.0.3)
 
 ########################################
 #
@@ -43,6 +43,7 @@ kernel_read_proc_symlinks(setrans_t)
 
 # allow performing getpidcon() on all processes
 domain_read_all_domains_state(setrans_t)
+domain_dontaudit_search_all_domains_state(setrans_t)
 domain_getattr_all_domains(setrans_t)
 domain_getsession_all_domains(setrans_t)
 

diff --git a/policy/modules/system/xen.fc b/policy/modules/system/xen.fc
index 339e7a9fb11b1b4c812f8594596144cd412abc71..0a44f004b378e1a6be26525ef5863d76d74218f7 100644 (file)
--- a/policy/modules/system/xen.fc
+++ b/policy/modules/system/xen.fc
@@ -7,6 +7,7 @@
 /var/lib/xend(/.*)?            gen_context(system_u:object_r:xend_var_lib_t,s0)
 /var/lib/xenstored(/.*)?       gen_context(system_u:object_r:xenstored_var_lib_t,s0)
 
+/var/log/xen(/.*)?             gen_context(system_u:object_r:xend_var_log_t,s0)
 /var/log/xen-hotplug\.log --   gen_context(system_u:object_r:xend_var_log_t,s0)
 /var/log/xend\.log     --      gen_context(system_u:object_r:xend_var_log_t,s0)
 /var/log/xend-debug\.log --    gen_context(system_u:object_r:xend_var_log_t,s0)

diff --git a/policy/modules/system/xen.te b/policy/modules/system/xen.te
index 4954537eab2b510a48d8f13a1d1da8a5fe522117..b0ce265c7bd29142afab6e79021d8dc592d4bbf1 100644 (file)
--- a/policy/modules/system/xen.te
+++ b/policy/modules/system/xen.te
@@ -1,5 +1,5 @@
 
-policy_module(xen,1.0.10)
+policy_module(xen,1.0.11)
 
 ########################################
 #
@@ -68,7 +68,7 @@ init_daemon_domain(xm_t, xm_exec_t)
 # xend local policy
 #
 
-allow xend_t self:capability { dac_override ipc_lock net_admin setuid sys_nice sys_tty_config net_raw };
+allow xend_t self:capability { dac_override ipc_lock net_admin setuid sys_nice sys_ptrace sys_tty_config net_raw };
 dontaudit xend_t self:capability { sys_ptrace };
 allow xend_t self:process { signal sigkill };
 dontaudit xend_t self:process ptrace;
@@ -153,6 +153,7 @@ files_etc_filetrans_etc_runtime(xend_t,file)
 files_read_usr_files(xend_t)
 
 storage_raw_read_fixed_disk(xend_t)
+storage_raw_read_removable_device(xend_t)
 
 term_getattr_all_user_ptys(xend_t)
 term_use_generic_ptys(xend_t)