Changeset 2745

Show
Ignore:
Timestamp:
07/08/08 10:43:41 (5 months ago)
Author:
cpebenito
Message:

rbacsep: update to trunk 2744.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/rbacsep/Changelog

    r2705 r2745  
     1* Wed Jul 02 2008 Chris PeBenito <selinux@tresys.com> - 20080702 
     2- Fix httpd_enable_homedirs to actually provide the access it is supposed to 
     3  provide. 
     4- Add unused interface/template parameter metadata in XML. 
     5- Patch to handle postfix data_directory from Vaclav Ovsik. 
     6- SE-Postgresql policy from KaiGai Kohei. 
     7- Patch for X.org dbus support from Martin Orr. 
    18- Patch for labeled networking controls in 2.6.25 from Paul Moore. 
    29- Module loading now requires setsched on kernel threads. 
    …… 
    1219        kerneloops (Dan Walsh) 
    1320        kismet (Dan Walsh) 
     21        podsleuth (Dan Walsh) 
     22        prelude (Dan Walsh) 
     23        qemu (Dan Walsh) 
     24        virt (Dan Walsh) 
    1425 
    1526* Wed Apr 02 2008 Chris PeBenito <selinux@tresys.com> - 20080402 

  • branches/rbacsep/VERSION

    r2675 r2745  
    1 20080402 
     120080702 

  • branches/rbacsep/doc/policy.dtd

    r2243 r2745  
    2929<!ATTLIST param  
    3030      name CDATA #REQUIRED 
    31       optional (true|false) "false"> 
     31      optional (true|false) "false" 
     32      unused (true|false) "false"> 
    3233<!ELEMENT infoflow EMPTY> 
    3334<!ATTLIST infoflow  

  • branches/rbacsep/doc/templates/interface.html

    r476 r2745  
    3636[[end]] 
    3737<h5>Parameters</h5> 
    38 <table border="1" cellspacing="0" cellpadding="3" width="80%"> 
    39 <tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr> 
     38<table border="1" cellspacing="0" cellpadding="3" width="65%"> 
     39<tr><th >Parameter:</th><th >Description:</th></tr> 
    4040[[for arg in int['interface_parameters']]] 
    4141<tr><td> 
    …… 
    4343</td><td> 
    4444[[arg['desc']]] 
    45 </td><td> 
    46 [[arg['optional']]] 
    4745</td></tr> 
    4846[[end]] 

  • branches/rbacsep/doc/templates/template.html

    r476 r2745  
    3636[[end]] 
    3737<h5>Parameters</h5> 
    38 <table border="1" cellspacing="0" cellpadding="3" width="80%"> 
    39 <tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr> 
     38<table border="1" cellspacing="0" cellpadding="3" width="65%"> 
     39<tr><th >Parameter:</th><th >Description:</th></tr> 
    4040[[for arg in temp['template_parameters']]] 
    4141<tr><td> 
    …… 
    4343</td><td> 
    4444[[arg['desc']]] 
    45 </td><td> 
    46 [[arg['optional']]] 
    4745</td></tr> 
    4846[[end]] 

  • branches/rbacsep/policy/modules/admin/acct.te

    r2675 r2745  
    11 
    2 policy_module(acct,1.1.1) 
     2policy_module(acct, 1.2.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/admin/alsa.te

    r2675 r2745  
    11 
    2 policy_module(alsa,1.4.1) 
     2policy_module(alsa, 1.5.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/admin/amanda.te

    r2705 r2745  
    11 
    2 policy_module(amanda,1.8.1) 
     2policy_module(amanda, 1.9.0) 
    33 
    44####################################### 

  • branches/rbacsep/policy/modules/admin/anaconda.te

    r2675 r2745  
    11 
    2 policy_module(anaconda,1.2.1) 
     2policy_module(anaconda, 1.3.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/admin/bootloader.te

    r2675 r2745  
    11 
    2 policy_module(bootloader,1.7.1) 
     2policy_module(bootloader, 1.8.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/admin/dmesg.te

    r2675 r2745  
    11 
    2 policy_module(dmesg,1.1.1) 
     2policy_module(dmesg, 1.2.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/admin/firstboot.te

    r2675 r2745  
    11 
    2 policy_module(firstboot,1.6.1) 
     2policy_module(firstboot, 1.7.0) 
    33 
    44gen_require(` 

  • branches/rbacsep/policy/modules/admin/kudzu.te

    r2675 r2745  
    11 
    2 policy_module(kudzu,1.5.1) 
     2policy_module(kudzu, 1.6.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/admin/logrotate.te

    r2675 r2745  
    11 
    2 policy_module(logrotate,1.8.1) 
     2policy_module(logrotate, 1.9.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/admin/logwatch.te

    r2675 r2745  
    11 
    2 policy_module(logwatch,1.7.1) 
     2policy_module(logwatch, 1.8.0) 
    33 
    44################################# 

  • branches/rbacsep/policy/modules/admin/mrtg.te

    r2675 r2745  
    11 
    2 policy_module(mrtg,1.3.1) 
     2policy_module(mrtg, 1.4.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/admin/portage.te

    r2705 r2745  
    11 
    2 policy_module(portage,1.5.2) 
     2policy_module(portage, 1.6.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/admin/readahead.te

    r2675 r2745  
    11 
    2 policy_module(readahead,1.5.1) 
     2policy_module(readahead, 1.6.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/admin/usermanage.te

    r2727 r2745  
    11 
    2 policy_module(usermanage,1.10.1) 
     2policy_module(usermanage, 1.11.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/admin/vbetool.if

    r2239 r2745  
    55##      Execute vbetool application in the vbetool domain. 
    66## </summary> 
    7 ## <param name="domain" optional="true"> 
     7## <param name="domain"> 
    88##      <summary> 
    9 ##      N/A 
     9##      Domain allowed access. 
    1010##      </summary> 
    1111## </param> 

  • branches/rbacsep/policy/modules/apps/calamaris.te

    r2675 r2745  
    11 
    2 policy_module(calamaris,1.2.1) 
     2policy_module(calamaris, 1.3.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/apps/games.te

    r2724 r2745  
    11 
    2 policy_module(games,1.6.1) 
     2policy_module(games, 1.7.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/apps/gpg.te

    r2724 r2745  
    11 
    2 policy_module(gpg, 1.5.1) 
     2policy_module(gpg, 1.6.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/apps/mono.if

    r2169 r2745  
    1919        domtrans_pattern($1, mono_exec_t, mono_t) 
    2020') 
     21 
     22######################################## 
     23## <summary> 
     24##      Execute the mono program in the caller domain. 
     25## </summary> 
     26## <param name="domain"> 
     27##      <summary> 
     28##      Domain allowed access. 
     29##      </summary> 
     30## </param> 
     31# 
     32interface(`mono_exec',` 
     33        gen_require(` 
     34                type mono_t, mono_exec_t; 
     35        ') 
     36 
     37        corecmd_search_bin($1) 
     38        can_exec($1, mono_exec_t) 
     39') 

  • branches/rbacsep/policy/modules/apps/mono.te

    r2675 r2745  
    11 
    2 policy_module(mono,1.4.1) 
     2policy_module(mono, 1.5.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/apps/uml.te

    r2720 r2745  
    11 
    2 policy_module(uml,1.5.1) 
     2policy_module(uml, 1.6.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/apps/userhelper.te

    r2724 r2745  
    11 
    2 policy_module(userhelper,1.3.1) 
     2policy_module(userhelper, 1.4.0) 
    33 
    44######################################## 

  • branches/rbacsep/policy/modules/apps/vmware.fc

    r2437 r2745  
    2929 
    3030/usr/lib/vmware/config          --      gen_context(system_u:object_r:vmware_sys_conf_t,s0) 
     31/usr/lib/vmware/bin/vmplayer    --      gen_context(system_u:object_r:vmware_exec_t,s0) 
    3132/usr/lib/vmware/bin/vmware-mks  --      gen_context(system_u:object_r:vmware_exec_t,s0) 
    3233/usr/lib/vmware/bin/vmware-ui   --      gen_context(system_u:object_r:vmware_exec_t,s0) 
     34/usr/lib/vmware/bin/vmware-vmx  --      gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     35 
     36ifdef(`distro_redhat',` 
     37/usr/lib/vmware-tools/sbin32/vmware.* -- gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     38/usr/lib/vmware-tools/sbin64/vmware.* -- gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     39') 
    3340 
    3441/usr/lib64/vmware/config        --      gen_context(system_u:object_r:vmware_sys_conf_t,s0) 
    3542/usr/lib64/vmware/bin/vmware-mks --     gen_context(system_u:object_r:vmware_exec_t,s0) 
    3643/usr/lib64/vmware/bin/vmware-ui --      gen_context(system_u:object_r:vmware_exec_t,s0) 
     44/usr/lib64/vmware/bin/vmplayer  --      gen_context(system_u:object_r:vmware_exec_t,s0) 
     45/usr/lib64/vmware/bin/vmware-vmx --     gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     46 
     47/usr/sbin/vmware-guest.*        --      gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     48/usr/sbin/vmware-serverd        --      gen_context(system_u:object_r:vmware_exec_t,s0) 
    3749 
    3850ifdef(`distro_gentoo',` 
    39 /opt/vmware/workstation/bin/vmnet-bridge --   gen_context(system_u:object_r:vmware_host_exec_t,s0) 
    40 /opt/vmware/workstation/bin/vmnet-dhcpd        --     gen_context(system_u:object_r:vmware_host_exec_t,s0) 
    41 /opt/vmware/workstation/bin/vmnet-natd        --      gen_context(system_u:object_r:vmware_host_exec_t,s0) 
    42 /opt/vmware/workstation/bin/vmnet-netifup --  gen_context(system_u:object_r:vmware_host_exec_t,s0) 
    43 /opt/vmware/workstation/bin/vmnet-sniffer --  gen_context(system_u:object_r:vmware_host_exec_t,s0) 
    44 /opt/vmware/workstation/bin/vmware-nmbd        --     gen_context(system_u:object_r:vmware_host_exec_t,s0) 
    45 /opt/vmware/workstation/bin/vmware-ping        --     gen_context(system_u:object_r:vmware_host_exec_t,s0) 
    46 /opt/vmware/workstation/bin/vmware-smbd        --     gen_context(system_u:object_r:vmware_host_exec_t,s0) 
    47 /opt/vmware/workstation/bin/vmware-smbpasswd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) 
    48 /opt/vmware/workstation/bin/vmware-smbpasswd\.bin -- gen_context(system_u:object_r:vmware_host_exec_t,s0) 
    49 /opt/vmware/workstation/bin/vmware-wizard --  gen_context(system_u:object_r:vmware_exec_t,s0) 
    50 /opt/vmware/workstation/bin/vmware     --     gen_context(system_u:object_r:vmware_exec_t,s0) 
     51/opt/vmware/(workstation|player)/bin/vmnet-bridge --  gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     52/opt/vmware/(workstation|player)/bin/vmnet-dhcpd --   gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     53/opt/vmware/(workstation|player)/bin/vmnet-natd       --      gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     54/opt/vmware/(workstation|player)/bin/vmnet-netifup -- gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     55/opt/vmware/(workstation|player)/bin/vmnet-sniffer -- gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     56/opt/vmware/(workstation|player)/bin/vmware-nmbd --   gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     57/opt/vmware/(workstation|player)/bin/vmware-ping --   gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     58/opt/vmware/(workstation|player)/bin/vmware-smbd --   gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     59/opt/vmware/(workstation|player)/bin/vmware-smbpasswd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     60/opt/vmware/(workstation|player)/bin/vmware-smbpasswd\.bin -- gen_context(system_u:object_r:vmware_host_exec_t,s0) 
     61/opt/vmware/(workstation|player)/bin/vmware-wizard -- gen_context(system_u:object_r:vmware_exec_t,s0) 
     62/opt/vmware/(workstation|player)/bin/vmware --        gen_context(system_u:object_r:vmware_exec_t,s0) 
    5163') 
     64 
     65/var/log/vmware.*               --      gen_context(system_u:object_r:vmware_log_t,s0) 
     66 
     67/var/run/vmnat.*                -s      gen_context(system_u:object_r:vmware_var_run_t,s0) 
     68/var/run/vmware.*                       gen_context(system_u:object_r:vmware_var_run_t,s0) 

  • branches/rbacsep/policy/modules/apps/vmware.if

    r2726 r2745  
    7070        allow $1 vmware_sys_conf_t:file append; 
    7171') 
     72 
     73######################################## 
     74## <summary> 
     75##      Append to VMWare log files. 
     76## </summary> 
     77## <param name="domain"> 
     78##      <summary> 
     79##      Domain allowed access. 
     80##      </summary> 
     81## </param> 
     82# 
     83interface(`vmware_append_log',` 
     84        gen_require(` 
     85                type vmware_log_t; 
     86        ') 
     87 
     88        logging_search_logs($1) 
     89        append_files_pattern($1, vmware_log_t, vmware_log_t) 
     90') 

  • branches/rbacsep/policy/modules/apps/vmware.te

    r2724 r2745  
    11 
    2 policy_module(vmware,1.5.1) 
     2policy_module(vmware, 1.6.0) 
    33 
    44######################################## 
    …… 
    2626files_pid_file(vmware_host_pid_t) 
    2727 
     28type vmware_log_t; 
     29logging_log_file(vmware_log_t) 
     30 
    2831type vmware_pid_t; 
    2932files_pid_file(vmware_pid_t) 
    …… 
    4447# 
    4548 
    46 allow vmware_host_t self:capability { setuid net_raw }; 
     49allow vmware_host_t self:capability { setgid setuid net_raw }; 
    4750dontaudit vmware_host_t self:capability sys_tty_config; 
    4851allow vmware_host_t self:process signal_perms; 
    …… 
    5053allow vmware_host_t self:unix_stream_socket create_stream_socket_perms; 
    5154allow vmware_host_t self:rawip_socket create_socket_perms; 
     55allow vmware_host_t self:tcp_so