This patch adds a new interface to the cpufreqselector module
to allow dbus chat. It then uses such interface to allow dbus chat
with system_dbusd_t and xdm_t. This patch also adds some other
permissions needed to run cpufreqselector.
Harry Ciao [Fri, 11 Feb 2011 07:03:10 +0000 (15:03 +0800)]
Make crond able to polyinstantiate all.
As one of entrypoint application, crond_t should have had the
files_polyinstantiate_all() interface called so that pam_namespace.so
could work well in crond_t. Otherwise the crond_t lacks the sys_admin
permission to make use of pam_namespace.so
BTW, the allow_polyinstantiation boolean need to be toggled true
accordingly.
Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
Harry Ciao [Wed, 2 Feb 2011 03:13:32 +0000 (11:13 +0800)]
Make crond able to use pam_loginuid.so
Entry point applications such as crond or atd use pam_loginuid.so for
the session phase of their PAM config files to set the process loginuid
attribute. Accordingly logging_set_loginuid interface should have been
called, otherwise we could run into below error message:
Sven Vermeulen [Sun, 6 Feb 2011 15:14:46 +0000 (16:14 +0100)]
Allow xfce (and most likely other DEs) to properly work with the authorization information
On my system, I use XFCE and start X from the commandline (using "startx")
rather than through a graphical DM. During the start-up, XFCE4 creates
temporary ICE files in /tmp (like /tmp/.xfsm-ICE-ABCDEF) which are later
read in by iceauth and at some point X.
I'm not that good at the entire ICE stuff, but without this, I was unable to
shut down my session ("log off").
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Chris PeBenito [Thu, 17 Feb 2011 14:32:00 +0000 (09:32 -0500)]
Reverse /dev/.udev/(/.*)? dir label fix.
I realized the policy wasn't complete for handling udev_tbl_t dirs, and
updating it wouldn't work because we couldn't make a filetrans on dirs,
since all the dirs in /dev would become udev_tbl_t. i.e. this would have
been required, but would make problems: dev_filetrans(udev_t, udev_tbl_t, dir);
Harry Ciao [Tue, 15 Feb 2011 02:16:32 +0000 (10:16 +0800)]
l1 domby l2 for contains MLS constraint
As identified by Stephan Smalley, the current MLS constraint for the
contains permission of the context class should consider the current
level of a user along with the clearance level so that mls_systemlow
is no longer considered contained in mls_systemhigh.
Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
Dominick Grift [Sun, 13 Feb 2011 17:58:38 +0000 (18:58 +0100)]
Users calling apache_role were not able to manage httpd_user_content_t files, directories and symbolic links.
From 78d6e4acfc000b07dbf85b076fa523e95e72da3f Sun, 13 Feb 2011 18:55:53 +0100
From: Dominick Grift <domg472@gmail.com>
Date: Sun, 13 Feb 2011 18:55:09 +0100
Subject: [PATCH] Users calling apache_role were not able to manage httpd_user_content_t files, directories and symbolic links.
Users calling apache_role were not able to manage httpd_user_content_t files, directories and symbolic links.
Stephen Smalley [Fri, 11 Feb 2011 21:07:08 +0000 (16:07 -0500)]
Change build.conf to default to modular policy builds
Change build.conf to default to modular policy builds rather than
monolithic policy builds. Rationale: All modern Linux distributions
that incorporate SELinux support have switched to using modular policy,
and many of the policy tools (semodule, semanage, and even modern
versions of setsebool) only work if using modular policy.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Stephen Smalley [Thu, 10 Feb 2011 16:17:33 +0000 (11:17 -0500)]
Refine xen policy
Various changes to the Xen userspace policy, including:
- Add gntdev and gntalloc device node labeling.
- Create separate domains for blktap and qemu-dm rather than leaving them in xend_t.
- No need to allow xen userspace to create its own device nodes anymore;
this is handled automatically by the kernel/udev.
- No need to allow xen userspace access to generic raw storage; even if
using dedicated partitions/LVs for disk images, you can just label them
with xen_image_t.
The blktap and qemu-dm domains are stubs and will likely need to be
further expanded, but they should definitely not be left in xend_t. Not
sure if I should try to use qemu_domain_template() instead for qemu-dm,
but I don't see any current users of that template (qemu_t uses
virt_domain_template instead), and qemu-dm has specific interactions
with Xen.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Sven Vermeulen [Sun, 6 Feb 2011 20:03:38 +0000 (21:03 +0100)]
Sudo timestamp directory has changed since v1.7.4, reflect this in .fc file
Since sudo 1.7.4, the timestamp directory has moved from /var/run/sudo to
/var/db/sudo, lib or adm (in that order). See also the sudo changeset
http://www.sudo.ws/repos/sudo/rev/8c9440423d98
Keeping the "old" one (/var/run/sudo) for a while for those systems where
sudo has not been updated yet (change is since 1.7.4, Jul 14 2010).
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Sven Vermeulen [Sun, 6 Feb 2011 15:09:18 +0000 (16:09 +0100)]
Allow xserver to process keyboard events
On an Xorg 1.9 system with evdev driver (for keyboard InputClass), the
xserver_t domain needs to be able to read from the proper device nodes as
well as query the udev_tbl_t directory and udev itself.
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Sven Vermeulen [Sun, 6 Feb 2011 14:36:23 +0000 (15:36 +0100)]
LVM uses systemwide semaphores for activities such as vgchange -ay
The LVM subsystem uses system-wide semaphores for various activities.
Although the system boots properly without these (apart from the AVC denials
of course), I would assume that they are here to ensure no corruption of any
kind happens in case of concurrent execution / race conditions.
As such, I rather enable it explicitly in the security policy.
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Sven Vermeulen [Sun, 6 Feb 2011 14:27:44 +0000 (15:27 +0100)]
Allow modprobe to request module load
The modprobe utility is sometimes used (for instance for ALSA) to request
the Linux kernel to load a module (through aliases) rather than explicitly
loading the module.
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
projects / people / stevee / selinux-policy.git / log
