On Tue, 2006-11-07 at 16:51 -0500, James Antill wrote:

> Here is the policy changes needed for the context contains security
> checking in PAM and cron.

diff --git a/Changelog b/Changelog
index 87fd0ff08f1b3f11251e534d8f7c2c4dd377b586..1bdd76e7051a7f9c9366d837e94dee950a90caf8 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,4 @@
+- Context contains checking for PAM and cron from James Antill.
 - Add a reload target to Modules.devel and change the load
   target to only insert modules that were changed.
 - Allow semanage to read from /root on strict non-MLS for

diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors
index 641dcd23d17b4d0d6b8b5fab7bba41b0df10dab0..4848d25917160f3d964574f8880b941df269ef27 100644 (file)
--- a/policy/flask/access_vectors
+++ b/policy/flask/access_vectors
@@ -635,4 +635,5 @@ class key
 class context
 {
        translate
+       contains
 }

diff --git a/policy/mls b/policy/mls
index 8ab1332fc370d63dd495cac951aa0832d39fee2c..bdca162b83ea205304cefc48d694e5c38bb16e78 100644 (file)
--- a/policy/mls
+++ b/policy/mls
@@ -597,4 +597,7 @@ mlsconstrain association { polmatch }
 mlsconstrain context translate
        (( h1 dom h2 ) or ( t1 == mlstranslate ));
 
+mlsconstrain context contains
+       ( h1 dom h2 );
+
 ') dnl end enable_mls

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 0532edcd2c27ae44a9a9894d1b736a0956e220af..c47a891ba490e565a228c81204f39a454ffdf1ae 100644 (file)
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -22,6 +22,11 @@
 ## <rolebase/>
 #
 template(`userdom_base_user_template',`
+
+       gen_require(`
+               class context contains;
+       ')
+
        attribute $1_file_type;
 
        type $1_t, userdomain;
@@ -49,6 +54,7 @@ template(`userdom_base_user_template',`
        allow $1_t self:sem create_sem_perms;
        allow $1_t self:msgq create_msgq_perms;
        allow $1_t self:msg { send receive };
+       allow $1_t self:context contains;
        dontaudit $1_t self:socket create;
 
        allow $1_t $1_devpts_t:chr_file { setattr ioctl read getattr lock write append };

diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index 7999ffe4e374282b3dcbe26a9727a5e82338d5a1..865fd42181bcbabb7c636bd858c2a7b2a1271da3 100644 (file)
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -1,5 +1,5 @@
 
-policy_module(userdomain,2.0.2)
+policy_module(userdomain,2.0.3)
 
 gen_require(`
        role sysadm_r, staff_r, user_r;