trunk: switch daemons from inheriting from all levels to initrc_t sharing to all...

diff --git a/Changelog b/Changelog
index d5d9fe2989cfa5c0ab8c3ef15de6a0d1ef66d618..fa8709a247d4ce531b03b2f04c017296c34210b1 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,5 @@
+- Allow initrc_t file descriptors to be inherited regardless of MLS level.
+  Accordingly drop MLS permissions from daemons that inherit from any level.
 - Files and radvd updates from Stefan Schulze Frielinghaus.
 - Deprecate mls_file_write_down() and mls_file_read_up(), replaced with
   mls_write_all_levels() and mls_read_all_levels(), for consistency.

diff --git a/policy/modules/services/cups.te b/policy/modules/services/cups.te
index f90d0541acff35ff20df32e2bae1cdf2b8c6c86b..89b05c332eb03225e9c4f92b803aa9e3c8698a4f 100644 (file)
--- a/policy/modules/services/cups.te
+++ b/policy/modules/services/cups.te
@@ -1,5 +1,5 @@
 
-policy_module(cups,1.7.1)
+policy_module(cups,1.7.2)
 
 ########################################
 #
@@ -165,7 +165,6 @@ domain_read_all_domains_state(cupsd_t)
 fs_getattr_all_fs(cupsd_t)
 fs_search_auto_mountpoints(cupsd_t)
 
-mls_fd_use_all_levels(cupsd_t)
 mls_file_downgrade(cupsd_t)
 mls_file_write_all_levels(cupsd_t)
 mls_file_read_all_levels(cupsd_t)

diff --git a/policy/modules/services/inetd.te b/policy/modules/services/inetd.te
index fc6a7b8e78e66d2654efd508186fdf2893c3e940..88311e107fe80919b651b941a19cdbfc9b2fddb4 100644 (file)
--- a/policy/modules/services/inetd.te
+++ b/policy/modules/services/inetd.te
@@ -1,5 +1,5 @@
 
-policy_module(inetd,1.4.0)
+policy_module(inetd,1.4.1)
 
 ########################################
 #
@@ -132,11 +132,9 @@ logging_send_syslog_msg(inetd_t)
 miscfiles_read_localization(inetd_t)
 
 # xinetd needs MLS override privileges to work
-mls_fd_use_all_levels(inetd_t)
 mls_fd_share_all_levels(inetd_t)
 mls_socket_read_to_clearance(inetd_t)
 mls_process_set_level(inetd_t)
-mls_socket_read_to_clearance(inetd_t)
 
 sysnet_read_config(inetd_t)
 

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index e4f2b873cfe19b3e40746875cbe6707d2a09a122..0b75d1c9e8348f3d9f7201aeb5c72a1ccc13debf 100644 (file)
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -1,5 +1,5 @@
 
-policy_module(init,1.7.2)
+policy_module(init,1.7.3)
 
 gen_require(`
        class passwd rootok;
@@ -292,6 +292,7 @@ mls_file_write_all_levels(initrc_t)
 mls_process_read_up(initrc_t)
 mls_process_write_down(initrc_t)
 mls_rangetrans_source(initrc_t)
+mls_fd_share_all_levels(initrc_t)
 
 selinux_get_enforce_mode(initrc_t)
 

diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 9628ffb353c195df92b96708fdc3f76daf2ad118..a649c07cfea97f0411e0923c4aa470ca897e1a95 100644 (file)
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -1,5 +1,5 @@
 
-policy_module(logging,1.7.1)
+policy_module(logging,1.7.2)
 
 ########################################
 #
@@ -155,7 +155,6 @@ miscfiles_read_localization(auditd_t)
 
 mls_file_read_all_levels(auditd_t)
 mls_file_write_all_levels(auditd_t) # Need to be able to write to /var/run/ directory
-mls_fd_use_all_levels(auditd_t)
 
 seutil_dontaudit_read_config(auditd_t)
 

diff --git a/policy/modules/system/setrans.te b/policy/modules/system/setrans.te
index 4c263a3edfed16cc1867943ba7b6e5680c602214..3c4a73a6043aad3d5608076b9a0324fda4e0e312 100644 (file)
--- a/policy/modules/system/setrans.te
+++ b/policy/modules/system/setrans.te
@@ -1,5 +1,5 @@
 
-policy_module(setrans,1.3.1)
+policy_module(setrans,1.3.2)
 
 ########################################
 #
@@ -58,7 +58,6 @@ mls_net_receive_all_levels(setrans_t)
 mls_socket_write_all_levels(setrans_t)
 mls_process_read_up(setrans_t)
 mls_socket_read_all_levels(setrans_t)
-mls_fd_use_all_levels(setrans_t)
 
 selinux_compute_access_vector(setrans_t)