Policy cleanup for upstream acceptance

diff --git a/policy/modules/kernel/terminal.fc b/policy/modules/kernel/terminal.fc
index eeb5889187e55a2a361593f2cba870329142eaf4..5c54a980c2f929369f689fa1c8d3f7df32abb0fe 100644 (file)
--- a/policy/modules/kernel/terminal.fc
+++ b/policy/modules/kernel/terminal.fc
@@ -19,7 +19,7 @@
 /dev/tty               -c      gen_context(system_u:object_r:devtty_t,s0)
 /dev/ttySG.*           -c      gen_context(system_u:object_r:tty_device_t,s0)
 /dev/ttyUSB[0-9]+      -c      gen_context(system_u:object_r:usbtty_device_t,s0)
-/dev/vport[0-9]p[0-9]+  -c  gen_context(system_u:object_r:virtio_device_t,s0)
+/dev/vport[0-9]p[0-9]+  -c     gen_context(system_u:object_r:virtio_device_t,s0)
 /dev/xvc[^/]*          -c      gen_context(system_u:object_r:tty_device_t,s0)
 
 /dev/pty/.*            -c      gen_context(system_u:object_r:bsdpty_device_t,s0)

diff --git a/policy/modules/services/glance.fc b/policy/modules/services/glance.fc
index 7d27335ee93ca5176459f95987b586b4f6f32a89..657d8f521d7481a495475f223dc822a16ba2d7fc 100644 (file)
--- a/policy/modules/services/glance.fc
+++ b/policy/modules/services/glance.fc
@@ -1,14 +1,13 @@
 
-/usr/bin/glance-registry       --      gen_context(system_u:object_r:glance_registry_exec_t,s0)
+/etc/rc\.d/init\.d/openstack-glance-api --     gen_context(system_u:object_r:glance_api_initrc_exec_t,s0)
 
-/usr/bin/glance-api    --      gen_context(system_u:object_r:glance_api_exec_t,s0)
+/etc/rc\.d/init\.d/openstack-glance-registry --        gen_context(system_u:object_r:glance_registry_initrc_exec_t,s0)
+
+/usr/bin/glance-api            --      gen_context(system_u:object_r:glance_api_exec_t,s0)
+/usr/bin/glance-registry       --      gen_context(system_u:object_r:glance_registry_exec_t,s0)
 
 /var/lib/glance(/.*)?          gen_context(system_u:object_r:glance_var_lib_t,s0)
 
 /var/log/glance(/.*)?          gen_context(system_u:object_r:glance_log_t,s0)
 
 /var/run/glance(/.*)?          gen_context(system_u:object_r:glance_var_run_t,s0)
-
-/etc/rc\.d/init\.d/openstack-glance-api --     gen_context(system_u:object_r:glance_api_initrc_exec_t,s0)
-
-/etc/rc\.d/init\.d/openstack-glance-registry --        gen_context(system_u:object_r:glance_registry_initrc_exec_t,s0)

diff --git a/policy/modules/services/glance.if b/policy/modules/services/glance.if
index 8cc6d17f5807594f2a6d0ef553166c06dae38131..8f0f77bb9ed3dd701041e7ea9b27b5839b2d3ce7 100644 (file)
--- a/policy/modules/services/glance.if
+++ b/policy/modules/services/glance.if
@@ -1,7 +1,6 @@
 
 ## <summary>policy for glance</summary>
 
-
 ########################################
 ## <summary>
 ##     Transition to glance.
@@ -40,7 +39,6 @@ interface(`glance_domtrans_api',`
        domtrans_pattern($1, glance_api_exec_t, glance_api_t)
 ')
 
-
 ########################################
 ## <summary>
 ##     Read glance's log files.
@@ -236,13 +234,9 @@ interface(`glance_manage_pid_files',`
 #
 interface(`glance_admin',`
        gen_require(`
-               type glance_registry_t;
-               type glance_api_t;
-               type glance_log_t;
-               type glance_var_lib_t;
-               type glance_var_run_t;
-               type glance_registry_initrc_exec_t;
-               type glance_api_initrc_exec_t;
+               type glance_registry_t, glance_api_t, glance_log_t;
+               type glance_var_lib_t, glance_var_run_t;
+               type glance_registry_initrc_exec_t, glance_api_initrc_exec_t;
        ')
 
        allow $1 glance_registry_t:process signal_perms;
@@ -271,6 +265,4 @@ interface(`glance_admin',`
 
        files_search_pids($1)
        admin_pattern($1, glance_var_run_t)
-
 ')
-

diff --git a/policy/modules/services/glance.te b/policy/modules/services/glance.te
index 34385c9bd6effe01436e8d2ca835da052afd6e6d..4afb81fec5853207c343fbf05f759f87cdae365d 100644 (file)
--- a/policy/modules/services/glance.te
+++ b/policy/modules/services/glance.te
@@ -81,7 +81,6 @@ files_tmp_filetrans(glance_registry_t, glance_registry_tmp_t, { file dir })
 corenet_tcp_bind_generic_node(glance_registry_t)
 corenet_tcp_bind_glance_registry_port(glance_registry_t)
 
-
 ########################################
 #
 # glance-api local policy

diff --git a/policy/modules/services/matahari.fc b/policy/modules/services/matahari.fc
index 7f3687079c6ae0546a46e12ec90af454b0e26534..ea9dc7adaeef5df5349c7bc2beab6da795e20684 100644 (file)
--- a/policy/modules/services/matahari.fc
+++ b/policy/modules/services/matahari.fc
@@ -1,30 +1,25 @@
-/etc/rc\.d/init\.d/matahari-host       gen_context(system_u:object_r:matahari_initrc_exec_t,s0)
-/etc/rc\.d/init\.d/matahari-net                gen_context(system_u:object_r:matahari_initrc_exec_t,s0)
-/etc/rc\.d/init\.d/matahari-service    gen_context(system_u:object_r:matahari_initrc_exec_t,s0)
-/etc/rc\.d/init\.d/matahari-sysconfig  gen_context(system_u:object_r:matahari_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/matahari-host               gen_context(system_u:object_r:matahari_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/matahari-net                        gen_context(system_u:object_r:matahari_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/matahari-service            gen_context(system_u:object_r:matahari_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/matahari-sysconfig          gen_context(system_u:object_r:matahari_initrc_exec_t,s0)
 
-/usr/sbin/matahari-hostd       --      gen_context(system_u:object_r:matahari_hostd_exec_t,s0)
-
-/usr/sbin/matahari-dbus-hostd  --      gen_context(system_u:object_r:matahari_hostd_exec_t,s0)
-
-/usr/sbin/matahari-qmf-hostd   --      gen_context(system_u:object_r:matahari_hostd_exec_t,s0)
-
-/usr/sbin/matahari-qmf-sysconfigd      --      gen_context(system_u:object_r:matahari_sysconfigd_exec_t,s0)
+/usr/sbin/matahari-dbus-hostd          --      gen_context(system_u:object_r:matahari_hostd_exec_t,s0)
+/usr/sbin/matahari-dbus-networkd       --      gen_context(system_u:object_r:matahari_netd_exec_t,s0)
+/usr/sbin/matahari-dbus-serviced       --      gen_context(system_u:object_r:matahari_serviced_exec_t,s0)
 
-/usr/sbin/matahari-netd                --      gen_context(system_u:object_r:matahari_netd_exec_t,s0)
+/usr/sbin/matahari-hostd               --      gen_context(system_u:object_r:matahari_hostd_exec_t,s0)
 
-/usr/sbin/matahari-dbus-networkd               --      gen_context(system_u:object_r:matahari_netd_exec_t,s0)
+/usr/sbin/matahari-netd                        --      gen_context(system_u:object_r:matahari_netd_exec_t,s0)
 
+/usr/sbin/matahari-qmf-hostd           --      gen_context(system_u:object_r:matahari_hostd_exec_t,s0)
 /usr/sbin/matahari-qmf-networkd                --      gen_context(system_u:object_r:matahari_netd_exec_t,s0)
+/usr/sbin/matahari-qmf-serviced                --      gen_context(system_u:object_r:matahari_serviced_exec_t,s0)
+/usr/sbin/matahari-qmf-sysconfigd      --      gen_context(system_u:object_r:matahari_sysconfigd_exec_t,s0)
 
-/usr/sbin/matahari-serviced    --      gen_context(system_u:object_r:matahari_serviced_exec_t,s0)
-
-/usr/sbin/matahari-dbus-serviced       --      gen_context(system_u:object_r:matahari_serviced_exec_t,s0)
-
-/usr/sbin/matahari-qmf-serviced        --      gen_context(system_u:object_r:matahari_serviced_exec_t,s0)
+/usr/sbin/matahari-serviced            --      gen_context(system_u:object_r:matahari_serviced_exec_t,s0)
 
-/var/lib/matahari(/.*)?                        gen_context(system_u:object_r:matahari_var_lib_t,s0)
+/var/lib/matahari(/.*)?                                gen_context(system_u:object_r:matahari_var_lib_t,s0)
 
-/var/run/matahari(/.*)?                        gen_context(system_u:object_r:matahari_var_run_t,s0)
-/var/run/matahari\.pid --              gen_context(system_u:object_r:matahari_var_run_t,s0)
-/var/run/matahari-broker\.pid  --      gen_context(system_u:object_r:matahari_var_run_t,s0)
+/var/run/matahari(/.*)?                                gen_context(system_u:object_r:matahari_var_run_t,s0)
+/var/run/matahari\.pid                 --      gen_context(system_u:object_r:matahari_var_run_t,s0)
+/var/run/matahari-broker\.pid          --      gen_context(system_u:object_r:matahari_var_run_t,s0)

diff --git a/policy/modules/services/matahari.if b/policy/modules/services/matahari.if
index 0d771fd76b06033914f44104a8afce805e31693d..2e8b6d8598c0db437bbf2eea7567bfef395c523b 100644 (file)
--- a/policy/modules/services/matahari.if
+++ b/policy/modules/services/matahari.if
@@ -24,7 +24,6 @@ template(`matahari_domain_template',`
         type matahari_$1_t, matahari_domain;
         type matahari_$1_exec_t;
         init_daemon_domain(matahari_$1_t, matahari_$1_exec_t)
-
 ')             
 
 ########################################
@@ -104,7 +103,6 @@ interface(`matahari_manage_lib_dirs',`
         manage_dirs_pattern($1, matahari_var_lib_t, matahari_var_lib_t)
 ')
 
-
 ########################################
 ## <summary>
 ##     Read matahari PID files.
@@ -216,12 +214,9 @@ interface(`matahari_serviced_domtrans',`
 #
 interface(`matahari_admin',`
        gen_require(`
-               type matahari_initrc_exec_t;
-               type matahari_hostd_t;
-               type matahari_netd_t;
-               type matahari_serviced_t;
-                type matahari_var_lib_t;
-                type matahari_var_run_t;
+               type matahari_initrc_exec_t, matahari_hostd_t;
+               type matahari_netd_t, matahari_serviced_t;
+                type matahari_var_lib_t, matahari_var_run_t;
        ')
 
        init_labeled_script_domtrans($1, matahari_initrc_exec_t)
@@ -246,5 +241,4 @@ interface(`matahari_admin',`
 
        files_search_pids($1)
        admin_pattern($1, matahari_var_run_t)
-
 ')

diff --git a/policy/modules/services/matahari.te b/policy/modules/services/matahari.te
index 372ed05654c8045e68e2a78a0b98634d76bfc2ec..4ea6ac395277e096c7379fa8791f048a0d70aa33 100644 (file)
--- a/policy/modules/services/matahari.te
+++ b/policy/modules/services/matahari.te
@@ -77,7 +77,7 @@ dev_read_sysfs(matahari_sysconfigd_t)
 # matahari domain local policy
 #
 
-allow matahari_domain self:process { signal };
+allow matahari_domain self:process signal;
 
 allow matahari_domain self:fifo_file rw_fifo_file_perms;
 allow matahari_domain self:unix_stream_socket create_stream_socket_perms;

diff --git a/policy/modules/services/rabbitmq.fc b/policy/modules/services/rabbitmq.fc
index 7908e1de0399339d38ac494f5aeab7f55d30a104..594c110210a268cab93142a2bf084539fc20d56e 100644 (file)
--- a/policy/modules/services/rabbitmq.fc
+++ b/policy/modules/services/rabbitmq.fc
@@ -1,7 +1,7 @@
 
-/usr/lib64/erlang/erts-5.8.5/bin/epmd          --      gen_context(system_u:object_r:rabbitmq_epmd_exec_t,s0)
 /usr/lib64/erlang/erts-5.8.5/bin/beam.*                --  gen_context(system_u:object_r:rabbitmq_beam_exec_t,s0)
-#/usr/lib64/erlang/lib/os_mon-2.2.7/priv/bin/cpu_sup   --      gen_context(system_u:object_r:rabbitmq_cpu_sup_exec_t,s0)
+/usr/lib64/erlang/erts-5.8.5/bin/epmd          --      gen_context(system_u:object_r:rabbitmq_epmd_exec_t,s0)
 
-/var/log/rabbitmq(/.*)?                                                        gen_context(system_u:object_r:rabbitmq_var_log_t,s0)
 /var/lib/rabbitmq(/.*)?                         gen_context(system_u:object_r:rabbitmq_var_lib_t,s0)
+
+/var/log/rabbitmq(/.*)?                                                        gen_context(system_u:object_r:rabbitmq_var_log_t,s0)

diff --git a/policy/modules/services/rabbitmq.if b/policy/modules/services/rabbitmq.if
index f15d8c3ec6ef5fd0727bb77de1fa5e2a969d75cb..491bd1f7d23917d9db6670ab7c2b28ac108e50c4 100644 (file)
--- a/policy/modules/services/rabbitmq.if
+++ b/policy/modules/services/rabbitmq.if
@@ -1,7 +1,6 @@
 
 ## <summary>policy for rabbitmq</summary>
 
-
 ########################################
 ## <summary>
 ##     Transition to rabbitmq.
@@ -20,4 +19,3 @@ interface(`rabbitmq_domtrans',`
        corecmd_search_bin($1)
        domtrans_pattern($1, rabbitmq_exec_t, rabbitmq_t)
 ')
-

diff --git a/policy/modules/services/rabbitmq.te b/policy/modules/services/rabbitmq.te
index 55aaca1d2a7ffe1330c9aeeaaedeb5bbd7db2ec9..591ca324d59f2382173cf34bbcd4bcb8f6606810 100644 (file)
--- a/policy/modules/services/rabbitmq.te
+++ b/policy/modules/services/rabbitmq.te
@@ -27,7 +27,7 @@ logging_log_file(rabbitmq_var_log_t)
 allow rabbitmq_beam_t self:process { setsched signal signull };
 
 allow rabbitmq_beam_t self:fifo_file rw_fifo_file_perms;
-allow rabbitmq_beam_t self:tcp_socket { accept listen };
+allow rabbitmq_beam_t self:tcp_socket create_stream_socket_perms;
 
 manage_dirs_pattern(rabbitmq_beam_t, rabbitmq_var_lib_t, rabbitmq_var_lib_t)
 manage_files_pattern(rabbitmq_beam_t, rabbitmq_var_lib_t, rabbitmq_var_lib_t)
@@ -65,7 +65,7 @@ optional_policy(`
 
 domtrans_pattern(rabbitmq_beam_t, rabbitmq_epmd_exec_t, rabbitmq_epmd_t)
 
-allow rabbitmq_epmd_t self:process { signal };
+allow rabbitmq_epmd_t self:process signal;
 
 allow rabbitmq_epmd_t self:fifo_file rw_fifo_file_perms;
 allow rabbitmq_epmd_t self:tcp_socket create_stream_socket_perms;

diff --git a/policy/modules/services/rhev.te b/policy/modules/services/rhev.te
index 1ec5e7c3a94fdcb628f6675559a81e38e927942c..6c38356191e5d9512ad331fa600d436be806f5b0 100644 (file)
--- a/policy/modules/services/rhev.te
+++ b/policy/modules/services/rhev.te
@@ -12,7 +12,6 @@ init_daemon_domain(rhev_agentd_t, rhev_agentd_exec_t)
 type rhev_agentd_var_run_t;
 files_pid_file(rhev_agentd_var_run_t)
 
-# WHY IS USED /TMP DIRECTORY
 type rhev_agentd_tmp_t;
 files_tmp_file(rhev_agentd_tmp_t)
 
@@ -80,4 +79,3 @@ optional_policy(`
 optional_policy(`
    xserver_dbus_chat_xdm(rhev_agentd_t)
 ')
-

diff --git a/policy/modules/services/rhsmcertd.fc b/policy/modules/services/rhsmcertd.fc
index 5094d93940373fcc04cb295f04f5f7e9eb6cf701..b2a8835bb2523531ca9b06b36ceacf9aefd6b8d9 100644 (file)
--- a/policy/modules/services/rhsmcertd.fc
+++ b/policy/modules/services/rhsmcertd.fc
@@ -3,10 +3,10 @@
 
 /usr/bin/rhsmcertd             --      gen_context(system_u:object_r:rhsmcertd_exec_t,s0)
 
-/var/lib/rhsm(/.*)?            gen_context(system_u:object_r:rhsmcertd_var_lib_t,s0)
-
-/var/log/rhsm(/.*)?            gen_context(system_u:object_r:rhsmcertd_log_t,s0)
+/var/lib/rhsm(/.*)?                    gen_context(system_u:object_r:rhsmcertd_var_lib_t,s0)
 
 /var/lock/subsys/rhsmcertd     --      gen_context(system_u:object_r:rhsmcertd_lock_t,s0)
 
-/var/run/rhsm(/.*)?            gen_context(system_u:object_r:rhsmcertd_var_run_t,s0)
+/var/log/rhsm(/.*)?                    gen_context(system_u:object_r:rhsmcertd_log_t,s0)
+
+/var/run/rhsm(/.*)?                    gen_context(system_u:object_r:rhsmcertd_var_run_t,s0)

diff --git a/policy/modules/services/rhsmcertd.if b/policy/modules/services/rhsmcertd.if
index 61d0a4cb6697b41d0b3c27317e0b655bb9e7734c..6572600c070af183898c0ca05c9d2c5c185873d4 100644 (file)
--- a/policy/modules/services/rhsmcertd.if
+++ b/policy/modules/services/rhsmcertd.if
@@ -20,7 +20,6 @@ interface(`rhsmcertd_domtrans',`
        domtrans_pattern($1, rhsmcertd_exec_t, rhsmcertd_t)
 ')
 
-
 ########################################
 ## <summary>
 ##     Execute rhsmcertd server in the rhsmcertd domain.
@@ -39,7 +38,6 @@ interface(`rhsmcertd_initrc_domtrans',`
        init_labeled_script_domtrans($1, rhsmcertd_initrc_exec_t)
 ')
 
-
 ########################################
 ## <summary>
 ##     Read rhsmcertd's log files.
@@ -176,7 +174,6 @@ interface(`rhsmcertd_manage_lib_dirs',`
        manage_dirs_pattern($1, rhsmcertd_var_lib_t, rhsmcertd_var_lib_t)
 ')
 
-
 ########################################
 ## <summary>
 ##     Read rhsmcertd PID files.
@@ -277,11 +274,8 @@ interface(`rhsmcertd_dontaudit_dbus_chat',`
 #
 interface(`rhsmcertd_admin',`
        gen_require(`
-               type rhsmcertd_t;
-       type rhsmcertd_initrc_exec_t;
-       type rhsmcertd_log_t;
-       type rhsmcertd_var_lib_t;
-       type rhsmcertd_var_run_t;
+               type rhsmcertd_t, rhsmcertd_initrc_exec_t, rhsmcertd_log_t;
+               type rhsmcertd_var_lib_t, rhsmcertd_var_run_t;
        ')
 
        allow $1 rhsmcertd_t:process signal_perms;
@@ -303,6 +297,4 @@ interface(`rhsmcertd_admin',`
 
        files_search_pids($1)
        admin_pattern($1, rhsmcertd_var_run_t)
-
 ')
-

diff --git a/policy/modules/services/sanlock.te b/policy/modules/services/sanlock.te
index 96adff5961cd12faf6b7f0bf62ef2e86c1a52b6c..64d3e6ae9f8f10a20e23d6d438e5201aff0887d5 100644 (file)
--- a/policy/modules/services/sanlock.te
+++ b/policy/modules/services/sanlock.te
@@ -44,7 +44,7 @@ ifdef(`enable_mls',`
 #
 # sanlock local policy
 #
-allow sanlock_t self:capability { kill sys_nice ipc_lock };
+allow sanlock_t self:capability { sys_nice ipc_lock };
 allow sanlock_t self:process { setsched signull };
 
 allow sanlock_t self:fifo_file rw_fifo_file_perms;
@@ -68,11 +68,11 @@ storage_raw_rw_fixed_disk(sanlock_t)
 
 dev_read_urand(sanlock_t)
 
-logging_send_syslog_msg(sanlock_t)
-
 init_read_utmp(sanlock_t)
 init_dontaudit_write_utmp(sanlock_t)
 
+logging_send_syslog_msg(sanlock_t)
+
 miscfiles_read_localization(sanlock_t)
 
 tunable_policy(`sanlock_use_nfs',`

diff --git a/policy/modules/services/sblim.te b/policy/modules/services/sblim.te
index c4d91920b17aa202bb3bdcfc5133c2011a0e76bc..7fad05057963f94872222bc3ed6898f51ff947f9 100644 (file)
--- a/policy/modules/services/sblim.te
+++ b/policy/modules/services/sblim.te
@@ -22,11 +22,8 @@ files_pid_file(sblim_var_run_t)
 #
 # sblim_gatherd local policy
 #
-
-#needed by ps
-allow sblim_gatherd_t self:capability { kill dac_override };
+allow sblim_gatherd_t self:capability dac_override;
 allow sblim_gatherd_t self:process signal;
-
 allow sblim_gatherd_t self:fifo_file rw_fifo_file_perms;
 allow sblim_gatherd_t self:unix_stream_socket create_stream_socket_perms;
 
@@ -45,6 +42,8 @@ domain_read_all_domains_state(sblim_gatherd_t)
 
 fs_getattr_all_fs(sblim_gatherd_t)
 
+sysnet_dns_name_resolve(sblim_gatherd_t)
+
 term_getattr_pty_fs(sblim_gatherd_t)
 
 init_read_utmp(sblim_gatherd_t)
@@ -61,7 +60,6 @@ optional_policy(`
 
 optional_policy(`
        ssh_signull(sblim_gatherd_t)
-    sysnet_dns_name_resolve(sblim_gatherd_t)
 ')
 
 optional_policy(`
@@ -105,4 +103,3 @@ logging_send_syslog_msg(sblim_domain)
 files_read_etc_files(sblim_domain)
 
 miscfiles_read_localization(sblim_domain)
-

diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index e494f5cd4a79a46fb0405929e3d2d2f202a23aa7..c2efd25dddce7d2a8c4c15e402e59c884529804e 100644 (file)
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -479,6 +479,24 @@ interface(`ssh_signal',`
        allow $1 sshd_t:process signal;
 ')
 
+########################################
+## <summary>
+##     Send a null signal to sshd processes.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`ssh_signull',`
+       gen_require(`
+               type sshd_t;
+       ')
+
+       allow $1 sshd_t:process signull;
+')
+
 ########################################
 ## <summary>
 ##     Read a ssh server unnamed pipe.
@@ -870,24 +888,6 @@ interface(`ssh_delete_tmp',`
        delete_files_pattern($1, sshd_tmp_t, sshd_tmp_t)
 ')
 
-########################################
-## <summary>
-##     Send a null signal to sshd processes.
-## </summary>
-## <param name="domain">
-##     <summary>
-##     Domain allowed access.
-##     </summary>
-## </param>
-#
-interface(`ssh_signull',`
-       gen_require(`
-               type sshd_t;
-       ')
-
-       allow $1 sshd_t:process signull;
-')
-
 #####################################
 ## <summary>
 ##  Allow domain dyntransition to chroot_user_t domain.

diff --git a/policy/modules/services/uuidd.fc b/policy/modules/services/uuidd.fc
index c1846674b32de2054edaec6fa565a80652b30a52..d8102327e05337925d5f324a1df1531709895cf8 100644 (file)
--- a/policy/modules/services/uuidd.fc
+++ b/policy/modules/services/uuidd.fc
@@ -1,7 +1,6 @@
 
 /etc/rc\.d/init\.d/uuidd       --      gen_context(system_u:object_r:uuidd_initrc_exec_t,s0)
 
-
 /usr/sbin/uuidd                --      gen_context(system_u:object_r:uuidd_exec_t,s0)
 
 /var/lib/libuuid(/.*)?         gen_context(system_u:object_r:uuidd_var_lib_t,s0)

diff --git a/policy/modules/services/uuidd.if b/policy/modules/services/uuidd.if
index c82f17800f7e5454fee3907fdd88f7b04c1dc055..adf79eb99250219f7e31da4a2667a6a91f6d4bfb 100644 (file)
--- a/policy/modules/services/uuidd.if
+++ b/policy/modules/services/uuidd.if
@@ -171,10 +171,8 @@ interface(`uuidd_stream_connect_manager',`
 #
 interface(`uuidd_admin',`
        gen_require(`
-               type uuidd_t;
-       type uuidd_initrc_exec_t;
-       type uuidd_var_lib_t;
-       type uuidd_var_run_t;
+               type uuidd_t, uuidd_initrc_exec_t;
+               type uuidd_var_run_t, uuidd_var_lib_t;
        ')
 
        allow $1 uuidd_t:process signal_perms;

diff --git a/policy/modules/services/uuidd.te b/policy/modules/services/uuidd.te
index ac053f34e123a01ac8d0344b64e25c1a5743d14c..04589dc00892f7ed1d5a466b34599ec79467f2d2 100644 (file)
--- a/policy/modules/services/uuidd.te
+++ b/policy/modules/services/uuidd.te
@@ -22,9 +22,8 @@ files_pid_file(uuidd_var_run_t)
 #
 # uuidd local policy
 #
-allow uuidd_t self:capability { setuid };
-allow uuidd_t self:process { signal };
-
+allow uuidd_t self:capability setuid;
+allow uuidd_t self:process signal;
 allow uuidd_t self:fifo_file rw_fifo_file_perms;
 allow uuidd_t self:unix_stream_socket create_stream_socket_perms;
 allow uuidd_t self:udp_socket create_socket_perms;
@@ -43,4 +42,3 @@ domain_use_interactive_fds(uuidd_t)
 files_read_etc_files(uuidd_t)
 
 miscfiles_read_localization(uuidd_t)
-

diff --git a/policy/modules/services/vdagent.fc b/policy/modules/services/vdagent.fc
index 71d97843b75fdb3ab0cf82ec41968c2b0f87c60f..2ba852cd5fe6fcf76e0a6a715add87eb7720f3dd 100644 (file)
--- a/policy/modules/services/vdagent.fc
+++ b/policy/modules/services/vdagent.fc
@@ -1,11 +1,10 @@
+/usr/sbin/spice-vdagentd       --      gen_context(system_u:object_r:vdagent_exec_t,s0)
 
-/usr/sbin/spice-vdagentd               --      gen_context(system_u:object_r:vdagent_exec_t,s0)
+/var/log/spice-vdagentd(/.*)?           gen_context(system_u:object_r:vdagent_log_t,s0)
+/var/log/spice-vdagentd\.log   --      gen_context(system_u:object_r:vdagent_log_t,s0)
 
 /var/run/spice-vdagentd(/.*)?          gen_context(system_u:object_r:vdagent_var_run_t,s0)
 /var/run/spice-vdagentd.\pid   --      gen_context(system_u:object_r:vdagent_var_run_t,s0)
 
-/var/log/spice-vdagentd(/.*)?           gen_context(system_u:object_r:vdagent_log_t,s0)
-/var/log/spice-vdagentd\.log   --      gen_context(system_u:object_r:vdagent_log_t,s0)
-
 
 

diff --git a/policy/modules/services/vdagent.if b/policy/modules/services/vdagent.if
index 57471cc9692c0e567ac2c9ebadef6a5d19942d9d..6467d916d2f51fae5117e057eb772571eacabc82 100644 (file)
--- a/policy/modules/services/vdagent.if
+++ b/policy/modules/services/vdagent.if
@@ -1,24 +1,6 @@
 
 ## <summary>policy for vdagent</summary>
 
-#####################################
-## <summary>
-##  Getattr on vdagent executable.
-## </summary>
-## <param name="domain">
-##  <summary>
-##  Domain allowed to transition.
-##  </summary>
-## </param>
-#
-interface(`vdagent_getattr_exec',`
-    gen_require(`
-        type vdagent_exec_t;
-    ')
-
-    allow $1 vdagent_exec_t:file getattr;
-')
-
 ########################################
 ## <summary>
 ##     Execute a domain transition to run vdagent.
@@ -37,6 +19,24 @@ interface(`vdagent_domtrans',`
        domtrans_pattern($1, vdagent_exec_t, vdagent_t)
 ')
 
+#####################################
+## <summary>
+##  Getattr on vdagent executable.
+## </summary>
+## <param name="domain">
+##  <summary>
+##     Domain allowed access.
+##  </summary>
+## </param>
+#
+interface(`vdagent_getattr_exec',`
+    gen_require(`
+        type vdagent_exec_t;
+    ')
+
+    allow $1 vdagent_exec_t:file getattr;
+')
+
 #######################################
 ## <summary>
 ##  Get the attributes of vdagent logs.
@@ -114,8 +114,7 @@ interface(`vdagent_stream_connect',`
 #
 interface(`vdagent_admin',`
        gen_require(`
-               type vdagent_t;
-                type vdagent_var_run_t;
+               type vdagent_t, vdagent_var_run_t;
        ')
 
        allow $1 vdagent_t:process signal_perms;
@@ -126,6 +125,4 @@ interface(`vdagent_admin',`
 
        files_search_pids($1)
        admin_pattern($1, vdagent_var_run_t)
-
 ')
-

diff --git a/policy/modules/services/wdmd.fc b/policy/modules/services/wdmd.fc
index 2f21759f284b3fafe2a7568c04633b10ffca7d25..ad47e05023f7272319eff4e37d2c2fcd4fb241fd 100644 (file)
--- a/policy/modules/services/wdmd.fc
+++ b/policy/modules/services/wdmd.fc
@@ -1,6 +1,6 @@
 
 /etc/rc\.d/init\.d/wdmd        --      gen_context(system_u:object_r:wdmd_initrc_exec_t,s0)
 
-/var/run/wdmd(/.*)?                    gen_context(system_u:object_r:wdmd_var_run_t,s0)
+/var/run/wdmd(/.*)?            gen_context(system_u:object_r:wdmd_var_run_t,s0)
 
 /usr/sbin/wdmd         --      gen_context(system_u:object_r:wdmd_exec_t,s0)

diff --git a/policy/modules/system/authlogin.fc b/policy/modules/system/authlogin.fc
index a004698ada7f0880ea3738c1c69fbaff86796c65..a13830af97f50f9592f5fd1044030856975db264 100644 (file)
--- a/policy/modules/system/authlogin.fc
+++ b/policy/modules/system/authlogin.fc
@@ -31,8 +31,9 @@ ifdef(`distro_gentoo', `
 /usr/sbin/unix_chkpwd  --      gen_context(system_u:object_r:chkpwd_exec_t,s0)
 ')
 
+/var/ace(/.*)?                 gen_context(system_u:object_r:var_auth_t,s0)
+
 /var/cache/coolkey(/.*)?       gen_context(system_u:object_r:auth_cache_t,s0)
-/var/ace(/.*)?                 gen_context(system_u:object_r:auth_cache_t,s0)
 
 /var/db/shadow.*       --      gen_context(system_u:object_r:shadow_t,s0)