Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy; branch 'maste...

Conflicts:
	policy/modules/admin/alsa.te
	policy/modules/apps/cpufreqselector.if
	policy/modules/kernel/devices.fc
	policy/modules/kernel/devices.if
	policy/modules/services/dbus.te
	policy/modules/services/xserver.if
	policy/modules/services/xserver.te
	policy/modules/system/init.fc

diff --cc policy/modules/apps/cpufreqselector.te
index b440acb86dda9a4ae98234d91b8330a620716ee3,e51e7f513e9b0f9fc1a85dc543295623f1ed89e5..8e0405f81999b12188e057bba571fe487011ea3e
--- 1/policy/modules/apps/cpufreqselector.te
--- 2/policy/modules/apps/cpufreqselector.te
+++ b/policy/modules/apps/cpufreqselector.te
@@@ -15,9 -15,11 +15,12 @@@ application_domain(cpufreqselector_t, c
  #
  
  allow cpufreqselector_t self:capability { sys_nice sys_ptrace };
+ allow cpufreqselector_t self:process getsched;
  allow cpufreqselector_t self:fifo_file rw_fifo_file_perms;
 +allow cpufreqselector_t self:process getsched;
  
+ kernel_read_system_state(cpufreqselector_t)
+ 
  files_read_etc_files(cpufreqselector_t)
  files_read_usr_files(cpufreqselector_t)
  

diff --cc policy/modules/kernel/devices.fc
index c02f095ecf1120804f7af01a1219af0d5bc90922,6cf8784c1ec832b2bc60ed67637b0d544df7f2f7..4cb181f712242bd0cf8dfd5d567bde09f2619fb5
--- 1/policy/modules/kernel/devices.fc
--- 2/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@@ -158,9 -158,10 +158,11 @@@ ifdef(`distro_suse', 
  
  /dev/mfpports/.*      -c      gen_context(system_u:object_r:printer_device_t,s0)
  
+ /dev/mqueue(/.*)?             <<none>>
+ 
  /dev/mvideo/.*                -c      gen_context(system_u:object_r:xserver_misc_device_t,s0)
  
 +/dev/mqueue(/.*)?             <<none>>
  /dev/pts(/.*)?                        <<none>>
  
  /dev/s(ou)?nd/.*      -c      gen_context(system_u:object_r:sound_device_t,s0)

diff --cc policy/modules/kernel/devices.if
Simple merge

diff --cc policy/modules/kernel/devices.te
Simple merge

diff --cc policy/modules/kernel/files.fc
index f798a697d2183268cc0489b2b808b3781570e18d,16108f6e8c6c0a7859ff35f0cea529e241c3575a..2abd3eb5a4f39ddf1f679acddfe14f5fffd6a56f
--- 1/policy/modules/kernel/files.fc
--- 2/policy/modules/kernel/files.fc
+++ b/policy/modules/kernel/files.fc
@@@ -59,19 -55,9 +56,16 @@@ ifdef(`distro_suse',
  /etc/localtime                -l      gen_context(system_u:object_r:etc_t,s0)
  /etc/mtab             --      gen_context(system_u:object_r:etc_runtime_t,s0)
  /etc/mtab\.fuselock   --      gen_context(system_u:object_r:etc_runtime_t,s0)
- /etc/motd             --      gen_context(system_u:object_r:etc_runtime_t,s0)
  /etc/nohotplug                --      gen_context(system_u:object_r:etc_runtime_t,s0)
  /etc/nologin.*                --      gen_context(system_u:object_r:etc_runtime_t,s0)
- /etc/reader\.conf     --      gen_context(system_u:object_r:etc_runtime_t,s0)
- /etc/smartd\.conf.*   --      gen_context(system_u:object_r:etc_runtime_t,s0)
  
 +/etc/sysctl\.conf(\.old)?               --      gen_context(system_u:object_r:system_conf_t,s0)
 +/etc/sysconfig/ebtables.*                             --      gen_context(system_u:object_r:system_conf_t,s0)
 +/etc/sysconfig/ip6?tables.*             --      gen_context(system_u:object_r:system_conf_t,s0)
 +/etc/sysconfig/ipvsadm.*                --      gen_context(system_u:object_r:system_conf_t,s0)
 +/etc/sysconfig/system-config-firewall.* --      gen_context(system_u:object_r:system_conf_t,s0)
 +
 +
  /etc/cups/client\.conf        --      gen_context(system_u:object_r:etc_t,s0)
  
  /etc/ipsec\.d/examples(/.*)?  gen_context(system_u:object_r:etc_t,s0)

diff --cc policy/modules/kernel/files.if
Simple merge

diff --cc policy/modules/kernel/files.te
Simple merge

diff --cc policy/modules/services/consolekit.if
index 8f23087efda373a475e1e6f91c82fd291fc797ad,fd15dfe1edd585aec795eea898e9067bca952d37..ad224fa662ec8fe06615ddf12b9a0514eac3a27b
--- 1/policy/modules/services/consolekit.if
--- 2/policy/modules/services/consolekit.if
+++ b/policy/modules/services/consolekit.if
@@@ -132,24 -93,6 +132,25 @@@ interface(`consolekit_read_pid_files',
        ')
  
        files_search_pids($1)
+       allow $1 consolekit_var_run_t:dir list_dir_perms;
        read_files_pattern($1, consolekit_var_run_t, consolekit_var_run_t)
  ')
 +
 +########################################
 +## <summary>
 +##    List consolekit PID files.
 +## </summary>
 +## <param name="domain">
 +##    <summary>
 +##    Domain allowed access.
 +##    </summary>
 +## </param>
 +#
 +interface(`consolekit_list_pid_files',`
 +      gen_require(`
 +              type consolekit_var_run_t;
 +      ')
 +
 +      files_search_pids($1)
 +      list_dirs_pattern($1, consolekit_var_run_t, consolekit_var_run_t)
 +')

diff --cc policy/modules/services/consolekit.te
Simple merge

diff --cc policy/modules/services/dbus.te
index a8a26f36289da921c54bd8a574832fcd255f97ab,86d09b4ed6d73af661a730b19ef58bec4b561420..1c0dd9b2fbc1e10a5e028b58ca9efd8e0db880d8
--- 1/policy/modules/services/dbus.te
--- 2/policy/modules/services/dbus.te
+++ b/policy/modules/services/dbus.te
@@@ -146,14 -140,10 +146,18 @@@ optional_policy(
        bind_domtrans(system_dbusd_t)
  ')
  
 +optional_policy(`
 +      gnome_exec_gconf(system_dbusd_t)
 +')
 +
+ optional_policy(`
+       cpufreqselector_dbus_chat(system_dbusd_t)
+ ')
+ 
 +optional_policy(`
 +      networkmanager_initrc_domtrans(system_dbusd_t)
 +')
 +
  optional_policy(`
        policykit_dbus_chat(system_dbusd_t)
        policykit_domtrans_auth(system_dbusd_t)

diff --cc policy/modules/services/plymouthd.te
Simple merge

diff --cc policy/modules/services/setroubleshoot.if
Simple merge

diff --cc policy/modules/services/smartmon.te
index 761df2d7e4e9c2e1aa440349a18e70e5c039f9f5,606a09815637034a24ef6742a8a26d531c1f4d2e..8b74d10909a8ce471d87065862e2c2dc1318078f
--- 1/policy/modules/services/smartmon.te
--- 2/policy/modules/services/smartmon.te
+++ b/policy/modules/services/smartmon.te
@@@ -70,9 -70,9 +70,10 @@@ domain_use_interactive_fds(fsdaemon_t
  
  files_exec_etc_files(fsdaemon_t)
  files_read_etc_runtime_files(fsdaemon_t)
+ files_read_usr_files(fsdaemon_t)
  # for config
  files_read_etc_files(fsdaemon_t)
 +files_read_usr_files(fsdaemon_t)
  
  fs_getattr_all_fs(fsdaemon_t)
  fs_search_auto_mountpoints(fsdaemon_t)

diff --cc policy/modules/services/xserver.if
index 572b6935a9bf30c4e55cc7da502167d1baa7159f,130ced965e021918efdcb8f6356b6c580247dc04..18696cb32f42db880c5f7ff3b3a90eaf5fd05d38
--- 1/policy/modules/services/xserver.if
--- 2/policy/modules/services/xserver.if
+++ b/policy/modules/services/xserver.if
@@@ -31,8 -30,7 +31,7 @@@ interface(`xserver_restricted_role',
        allow xserver_t $2:fd use;
        allow xserver_t $2:shm rw_shm_perms;
  
-       domtrans_pattern($2, xserver_exec_t, xserver_t)
 -      allow xserver_t $2:process signal;
 +      allow xserver_t $2:process { getpgid signal };
  
        allow xserver_t $2:shm rw_shm_perms;
  
@@@ -102,10 -93,10 +101,12 @@@
        dev_rw_usbfs($2)
  
        miscfiles_read_fonts($2)
 +      miscfiles_setattr_fonts_cache_dirs($2)
 +      miscfiles_read_hwdata($2)
  
        xserver_common_x_domain_template(user, $2)
+       xserver_domtrans($2)
+       xserver_unconfined($2)
        xserver_xsession_entry_type($2)
        xserver_dontaudit_write_log($2)
        xserver_stream_connect_xdm($2)

diff --cc policy/modules/services/xserver.te
index 256a19a5fc7757bd60a2bed1d40d53b538c40c2e,6c01261eed5843505a4125329875f8e75d3f1060..4f5c07a9a453f8f615733de85ea6e04076f00c0c
--- 1/policy/modules/services/xserver.te
--- 2/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@@ -466,28 -337,11 +466,22 @@@ manage_files_pattern(xdm_t, xdm_tmpfs_t
  manage_lnk_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
  manage_fifo_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
  manage_sock_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
- 
- fs_getattr_all_fs(xdm_t)
- fs_list_inotifyfs(xdm_t)
- fs_dontaudit_list_noxattr_fs(xdm_t)
- fs_dontaudit_read_noxattr_fs_files(xdm_t)
- fs_manage_cgroup_dirs(xdm_t)
- fs_manage_cgroup_files(xdm_t)
+ fs_tmpfs_filetrans(xdm_t, xdm_tmpfs_t, { dir file lnk_file sock_file fifo_file })
  
 +manage_files_pattern(xdm_t, user_fonts_t, user_fonts_t)
 +
 +files_search_spool(xdm_t)
 +manage_dirs_pattern(xdm_t, xdm_spool_t, xdm_spool_t)
 +manage_files_pattern(xdm_t, xdm_spool_t, xdm_spool_t)
 +files_spool_filetrans(xdm_t, xdm_spool_t, { file dir })
 +
  manage_dirs_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)
  manage_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)
 -files_var_lib_filetrans(xdm_t, xdm_var_lib_t, file)
 +manage_lnk_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)
 +manage_sock_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)
 +files_var_lib_filetrans(xdm_t, xdm_var_lib_t, { file dir })
 +# Read machine-id
 +files_read_var_lib_files(xdm_t)
  
  manage_dirs_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
  manage_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)
@@@ -608,10 -436,6 +602,15 @@@ files_dontaudit_getattr_all_symlinks(xd
  
  fs_getattr_all_fs(xdm_t)
  fs_search_auto_mountpoints(xdm_t)
 +fs_rw_anon_inodefs_files(xdm_t)
 +fs_mount_tmpfs(xdm_t)
++fs_list_inotifyfs(xdm_t)
++fs_dontaudit_list_noxattr_fs(xdm_t)
++fs_dontaudit_read_noxattr_fs_files(xdm_t)
++fs_manage_cgroup_dirs(xdm_t)
++fs_manage_cgroup_files(xdm_t)
 +
 +mls_socket_write_to_clearance(xdm_t)
  
  storage_dontaudit_read_fixed_disk(xdm_t)
  storage_dontaudit_write_fixed_disk(xdm_t)
@@@ -740,37 -517,7 +739,37 @@@ optional_policy(
  ')
  
  optional_policy(`
 -      cpufreqselector_dbus_chat(xdm_t)
 +      # Use dbus to start other processes as xdm_t
 +      dbus_role_template(xdm, system_r, xdm_t)
 +
 +      dontaudit xdm_dbusd_t xdm_var_lib_t:dir search_dir_perms;
 +      xserver_xdm_append_log(xdm_dbusd_t)
 +      xserver_read_xdm_pid(xdm_dbusd_t)
 +
 +      corecmd_bin_entry_type(xdm_t)
 +
 +      dbus_system_bus_client(xdm_t)
 +
 +      optional_policy(`
 +              bluetooth_dbus_chat(xdm_t)
 +      ')
 +
 +       optional_policy(`
-                cpufreqselector_dbus_send(xdm_t)
++              cpufreqselector_dbus_chat(xdm_t)
 +      ')
 +
 +      optional_policy(`
 +              devicekit_dbus_chat_disk(xdm_t)
 +              devicekit_dbus_chat_power(xdm_t)
 +      ')
 +
 +      optional_policy(`
 +              hal_dbus_chat(xdm_t)
 +      ')
 +
 +      optional_policy(`
 +              networkmanager_dbus_chat(xdm_t)
 +      ')
  ')
  
  optional_policy(`

diff --cc policy/modules/system/authlogin.if
Simple merge

diff --cc policy/modules/system/authlogin.te
Simple merge

diff --cc policy/modules/system/init.fc
Simple merge

diff --cc policy/modules/system/init.te
Simple merge

diff --cc policy/modules/system/sysnetwork.fc
Simple merge

diff --cc policy/modules/system/sysnetwork.if
Simple merge

diff --cc policy/modules/system/sysnetwork.te
Simple merge