]> git.ipfire.org Git - people/stevee/selinux-policy.git/blobdiff - policy/modules/services/networkmanager.te
projects / people / stevee / selinux-policy.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
Bump module versions for release.
[people/stevee/selinux-policy.git] / policy / modules / services / networkmanager.te
diff --git a/policy/modules/services/networkmanager.te b/policy/modules/services/networkmanager.te
index 704c68a2df718920c1525673ef437cfd95a5f556..d8dcbd498274ec352e9291b0a111d87b946f90e0 100644 (file)
--- a/policy/modules/services/networkmanager.te
+++ b/policy/modules/services/networkmanager.te
@@ -1,5 +1,5 @@
 
-policy_module(networkmanager, 1.12.2)
+policy_module(networkmanager, 1.14.0)
 
 ########################################
 #
@@ -19,6 +19,9 @@ logging_log_file(NetworkManager_log_t)
 type NetworkManager_tmp_t;
 files_tmp_file(NetworkManager_tmp_t)
 
+type NetworkManager_var_lib_t;
+files_type(NetworkManager_var_lib_t)
+
 type NetworkManager_var_run_t;
 files_pid_file(NetworkManager_var_run_t)
 
@@ -32,15 +35,17 @@ init_system_domain(wpa_cli_t, wpa_cli_exec_t)
 #
 
 # networkmanager will ptrace itself if gdb is installed
-# and it receives a unexpected signal (rh bug #204161) 
-allow NetworkManager_t self:capability { kill setgid setuid dac_override net_admin net_raw net_bind_service ipc_lock };
+# and it receives a unexpected signal (rh bug #204161)
+allow NetworkManager_t self:capability { chown fsetid kill setgid setuid sys_nice sys_ptrace dac_override net_admin net_raw net_bind_service ipc_lock };
 dontaudit NetworkManager_t self:capability { sys_tty_config sys_ptrace };
-allow NetworkManager_t self:process { ptrace setcap setpgid getsched signal_perms };
+allow NetworkManager_t self:process { ptrace getcap setcap setpgid getsched setsched signal_perms };
 allow NetworkManager_t self:fifo_file rw_fifo_file_perms;
 allow NetworkManager_t self:unix_dgram_socket { sendto create_socket_perms };
 allow NetworkManager_t self:unix_stream_socket create_stream_socket_perms;
 allow NetworkManager_t self:netlink_route_socket create_netlink_socket_perms;
+allow NetworkManager_t self:netlink_kobject_uevent_socket create_socket_perms;
 allow NetworkManager_t self:tcp_socket create_stream_socket_perms;
+allow NetworkManager_t self:tun_socket { create_socket_perms relabelfrom };
 allow NetworkManager_t self:udp_socket create_socket_perms;
 allow NetworkManager_t self:packet_socket create_socket_perms;
 
@@ -51,8 +56,13 @@ can_exec(NetworkManager_t, NetworkManager_exec_t)
 manage_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_t)
 logging_log_filetrans(NetworkManager_t, NetworkManager_log_t, file)
 
-rw_sock_files_pattern(NetworkManager_t, NetworkManager_tmp_t, NetworkManager_tmp_t)
-files_search_tmp(NetworkManager_t)
+manage_files_pattern(NetworkManager_t, NetworkManager_tmp_t, NetworkManager_tmp_t)
+manage_sock_files_pattern(NetworkManager_t, NetworkManager_tmp_t, NetworkManager_tmp_t)
+files_tmp_filetrans(NetworkManager_t, NetworkManager_tmp_t, { sock_file file })
+
+manage_dirs_pattern(NetworkManager_t, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
+manage_files_pattern(NetworkManager_t, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
+files_var_lib_filetrans(NetworkManager_t, NetworkManager_var_lib_t, dir)
 
 manage_dirs_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
 manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
@@ -62,7 +72,9 @@ files_pid_filetrans(NetworkManager_t, NetworkManager_var_run_t, { dir file sock_
 kernel_read_system_state(NetworkManager_t)
 kernel_read_network_state(NetworkManager_t)
 kernel_read_kernel_sysctls(NetworkManager_t)
-kernel_load_module(NetworkManager_t)
+kernel_request_load_module(NetworkManager_t)
+kernel_read_debugfs(NetworkManager_t)
+kernel_rw_net_sysctls(NetworkManager_t)
 
 corenet_all_recvfrom_unlabeled(NetworkManager_t)
 corenet_all_recvfrom_netlabel(NetworkManager_t)
@@ -81,13 +93,18 @@ corenet_tcp_connect_all_ports(NetworkManager_t)
 corenet_sendrecv_isakmp_server_packets(NetworkManager_t)
 corenet_sendrecv_dhcpc_server_packets(NetworkManager_t)
 corenet_sendrecv_all_client_packets(NetworkManager_t)
+corenet_rw_tun_tap_dev(NetworkManager_t)
+corenet_getattr_ppp_dev(NetworkManager_t)
 
 dev_read_sysfs(NetworkManager_t)
 dev_read_rand(NetworkManager_t)
 dev_read_urand(NetworkManager_t)
+dev_dontaudit_getattr_generic_blk_files(NetworkManager_t)
+dev_getattr_all_chr_files(NetworkManager_t)
 
 fs_getattr_all_fs(NetworkManager_t)
 fs_search_auto_mountpoints(NetworkManager_t)
+fs_list_inotifyfs(NetworkManager_t)
 
 mls_file_read_all_levels(NetworkManager_t)
 
@@ -98,15 +115,20 @@ corecmd_exec_bin(NetworkManager_t)
 
 domain_use_interactive_fds(NetworkManager_t)
 domain_read_confined_domains_state(NetworkManager_t)
-domain_dontaudit_read_all_domains_state(NetworkManager_t)
 
 files_read_etc_files(NetworkManager_t)
 files_read_etc_runtime_files(NetworkManager_t)
 files_read_usr_files(NetworkManager_t)
+files_read_usr_src_files(NetworkManager_t)
+
+storage_getattr_fixed_disk_dev(NetworkManager_t)
 
 init_read_utmp(NetworkManager_t)
+init_dontaudit_write_utmp(NetworkManager_t)
 init_domtrans_script(NetworkManager_t)
 
+auth_use_nsswitch(NetworkManager_t)
+
 logging_send_syslog_msg(NetworkManager_t)
 
 miscfiles_read_localization(NetworkManager_t)
@@ -131,10 +153,19 @@ userdom_dontaudit_use_user_ttys(NetworkManager_t)
 # Read gnome-keyring
 userdom_read_user_home_content_files(NetworkManager_t)
 
+optional_policy(`
+       avahi_domtrans(NetworkManager_t)
+       avahi_kill(NetworkManager_t)
+       avahi_signal(NetworkManager_t)
+       avahi_signull(NetworkManager_t)
+')
+
 optional_policy(`
        bind_domtrans(NetworkManager_t)
        bind_manage_cache(NetworkManager_t)
+       bind_kill(NetworkManager_t)
        bind_signal(NetworkManager_t)
+       bind_signull(NetworkManager_t)
 ')
 
 optional_policy(`
@@ -146,8 +177,25 @@ optional_policy(`
 ')
 
 optional_policy(`
-       dbus_system_bus_client(NetworkManager_t)
-       dbus_connect_system_bus(NetworkManager_t)
+       dbus_system_domain(NetworkManager_t, NetworkManager_exec_t)
+
+       optional_policy(`
+               consolekit_dbus_chat(NetworkManager_t)
+       ')
+')
+
+optional_policy(`
+       dnsmasq_read_pid_files(NetworkManager_t)
+       dnsmasq_delete_pid_files(NetworkManager_t)
+       dnsmasq_domtrans(NetworkManager_t)
+       dnsmasq_initrc_domtrans(NetworkManager_t)
+       dnsmasq_kill(NetworkManager_t)
+       dnsmasq_signal(NetworkManager_t)
+       dnsmasq_signull(NetworkManager_t)
+')
+
+optional_policy(`
+       hal_write_log(NetworkManager_t)
 ')
 
 optional_policy(`
@@ -155,23 +203,51 @@ optional_policy(`
 ')
 
 optional_policy(`
-       nis_use_ypbind(NetworkManager_t)
+       iptables_domtrans(NetworkManager_t)
 ')
 
 optional_policy(`
-       nscd_socket_use(NetworkManager_t)
+       nscd_domtrans(NetworkManager_t)
        nscd_signal(NetworkManager_t)
+       nscd_signull(NetworkManager_t)
+       nscd_kill(NetworkManager_t)
+       nscd_initrc_domtrans(NetworkManager_t)
+')
+
+optional_policy(`
+       # Dispatcher starting and stoping ntp
+       ntp_initrc_domtrans(NetworkManager_t)
 ')
 
 optional_policy(`
        openvpn_domtrans(NetworkManager_t)
+       openvpn_kill(NetworkManager_t)
        openvpn_signal(NetworkManager_t)
+       openvpn_signull(NetworkManager_t)
 ')
 
 optional_policy(`
+       policykit_dbus_chat(NetworkManager_t)
+       policykit_domtrans_auth(NetworkManager_t)
+       policykit_read_lib(NetworkManager_t)
+       policykit_read_reload(NetworkManager_t)
+       userdom_read_all_users_state(NetworkManager_t)
+')
+
+optional_policy(`
+       ppp_initrc_domtrans(NetworkManager_t)
        ppp_domtrans(NetworkManager_t)
-       ppp_read_pid_files(NetworkManager_t)
+       ppp_manage_pid_files(NetworkManager_t)
+       ppp_kill(NetworkManager_t)
        ppp_signal(NetworkManager_t)
+       ppp_signull(NetworkManager_t)
+       ppp_read_config(NetworkManager_t)
+')
+
+optional_policy(`
+       rpm_exec(NetworkManager_t)
+       rpm_read_db(NetworkManager_t)
+       rpm_dontaudit_manage_db(NetworkManager_t)
 ')
 
 optional_policy(`
@@ -179,12 +255,15 @@ optional_policy(`
 ')
 
 optional_policy(`
+       udev_exec(NetworkManager_t)
        udev_read_db(NetworkManager_t)
 ')
 
 optional_policy(`
        vpn_domtrans(NetworkManager_t)
+       vpn_kill(NetworkManager_t)
        vpn_signal(NetworkManager_t)
+       vpn_signull(NetworkManager_t)
 ')
 
 ########################################
The IPFire selinux policy.