Changeset 2772

Show
Ignore:
Timestamp:
08/07/08 09:17:50 (4 months ago)
Author:
cpebenito
Message:

trunk: 11 more cherry picks from fedora policy, by david hardeman.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/Changelog

    r2771 r2772  
    44- Database labeled networking update from KaiGai Kohei. 
    55- Several misc changes from the Fedora policy, cherry picked by David 
    6   Hrdeman. 
     6  Hardeman. 
    77- Large whitespace fix from Dominick Grift. 
    88- Pam_mount fix for local login from Stefan Schulze Frielinghaus. 

  • trunk/policy/modules/admin/amanda.fc

    r2009 r2772  
    44/etc/amandates                          gen_context(system_u:object_r:amanda_amandates_t,s0) 
    55/etc/dumpdates                          gen_context(system_u:object_r:amanda_dumpdates_t,s0) 
     6/etc/amanda/.*/index(/.*)?              gen_context(system_u:object_r:amanda_data_t,s0) 
    67 
    78/root/restore                   -d      gen_context(system_u:object_r:amanda_recover_dir_t,s0) 

  • trunk/policy/modules/admin/amanda.te

    r2763 r2772  
    11 
    2 policy_module(amanda, 1.9.0) 
     2policy_module(amanda, 1.9.1) 
    33 
    44####################################### 
    …… 
    8383 
    8484# access to amandas data structure 
    85 allow amanda_t amanda_data_t:dir { read search write }; 
    86 allow amanda_t amanda_data_t:file manage_file_perms; 
     85manage_dirs_pattern(amanda_t, amanda_data_t, amanda_data_t) 
     86manage_files_pattern(amanda_t, amanda_data_t, amanda_data_t) 
     87filetrans_pattern(amanda_t, amanda_config_t, amanda_data_t, { file dir }) 
    8788 
    8889# access to amanda_dumpdates_t 
    …… 
    147148 
    148149storage_raw_read_fixed_disk(amanda_t) 
     150storage_read_tape(amanda_t) 
     151storage_write_tape(amanda_t) 
    149152 
    150153# Added for targeted policy 

  • trunk/policy/modules/admin/anaconda.te

    r2763 r2772  
    11 
    2 policy_module(anaconda, 1.3.0) 
     2policy_module(anaconda, 1.3.1) 
    33 
    44######################################## 
    …… 
    3333seutil_domtrans_semanage(anaconda_t) 
    3434 
    35 unconfined_domain(anaconda_t) 
    36  
    3735unprivuser_home_dir_filetrans_home_content(anaconda_t, { dir file lnk_file fifo_file sock_file }) 
    38  
    39 optional_policy(` 
    40         dmesg_domtrans(anaconda_t) 
    41 ') 
    4236 
    4337optional_policy(` 
    …… 
    5953 
    6054optional_policy(` 
     55        unconfined_domain(anaconda_t) 
     56') 
     57 
     58optional_policy(` 
    6159        usermanage_domtrans_admin_passwd(anaconda_t) 
    6260') 

  • trunk/policy/modules/admin/kismet.te

    r2764 r2772  
    11 
    2 policy_module(kismet, 1.0.1) 
     2policy_module(kismet, 1.0.2) 
    33 
    44######################################## 
    …… 
    2626# 
    2727 
    28 allow kismet_t self:capability { net_admin setuid setgid }; 
     28allow kismet_t self:capability { net_admin net_raw setuid setgid }; 
    2929allow kismet_t self:packet_socket create_socket_perms; 
    3030 

  • trunk/policy/modules/admin/netutils.if

    r2763 r2772  
    6767 
    6868        can_exec($1, netutils_exec_t) 
     69') 
     70 
     71######################################## 
     72## <summary> 
     73##      Send generic signals to network utilities. 
     74## </summary> 
     75## <param name="domain"> 
     76##      <summary> 
     77##      Domain allowed access. 
     78##      </summary> 
     79## </param> 
     80# 
     81interface(`netutils_signal',` 
     82        gen_require(` 
     83                type netutils_t; 
     84        ') 
     85 
     86        allow $1 netutils_t:process signal; 
    6987') 
    7088 

  • trunk/policy/modules/admin/netutils.te

    r2763 r2772  
    11 
    2 policy_module(netutils, 1.6.0) 
     2policy_module(netutils, 1.6.1) 
    33 
    44######################################## 

  • trunk/policy/modules/apps/usernetctl.if

    r2763 r2772  
    6464                modutils_run_insmod(usernetctl_t, $2, $3) 
    6565        ') 
     66 
     67 
     68        optional_policy(` 
     69                ppp_run(usernetctl_t,$2,$3) 
     70        ') 
    6671') 

  • trunk/policy/modules/apps/usernetctl.te

    r2763 r2772  
    11 
    2 policy_module(usernetctl, 1.3.0) 
     2policy_module(usernetctl, 1.3.1) 
    33 
    44######################################## 
    …… 
    5050fs_search_auto_mountpoints(usernetctl_t) 
    5151 
     52auth_use_nsswitch(usernetctl_t) 
     53 
    5254libs_use_ld_so(usernetctl_t) 
    5355libs_use_shared_libs(usernetctl_t) 
     56 
     57logging_send_syslog_msg(usernetctl_t) 
    5458 
    5559miscfiles_read_localization(usernetctl_t) 
    …… 
    5862 
    5963sysnet_read_config(usernetctl_t) 
     64 
     65term_search_ptys(usernetctl_t) 
    6066 
    6167optional_policy(` 

  • trunk/policy/modules/kernel/storage.fc

    r2478 r2772  
    1414/dev/dasd[^/]*          -b      gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) 
    1515/dev/dm-[0-9]+          -b      gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) 
     16/dev/drbd[^/]*          -b      gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) 
    1617/dev/fd[^/]+            -b      gen_context(system_u:object_r:removable_device_t,s0) 
    1718/dev/flash[^/]*         -b      gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) 
    …… 
    4950/dev/ub[a-z][^/]+       -b      gen_context(system_u:object_r:removable_device_t,mls_systemhigh) 
    5051/dev/ubd[^/]*           -b      gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) 
     52/dev/vd[^/]*            -b      gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) 
    5153/dev/xvd[^/]*           -b      gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) 
    5254 

  • trunk/policy/modules/kernel/storage.if

    r2763 r2772  
    7878 
    7979        dontaudit $1 fixed_disk_device_t:blk_file setattr; 
     80') 
     81 
     82######################################## 
     83## <summary> 
     84##      dontaudit the caller attempts to read from a fixed disk. 
     85## </summary> 
     86## <param name="domain"> 
     87##      <summary> 
     88##      The type of the process performing this action. 
     89##      </summary> 
     90## </param> 
     91# 
     92interface(`storage_dontaudit_raw_read_fixed_disk',` 
     93        gen_require(` 
     94                attribute fixed_disk_raw_read; 
     95                type fixed_disk_device_t; 
     96        ') 
     97 
     98        dontaudit $1 fixed_disk_device_t:blk_file read_blk_file_perms; 
     99        dontaudit $1 fixed_disk_device_t:chr_file read_chr_file_perms; 
    80100') 
    81101 

  • trunk/policy/modules/kernel/storage.te

    r2763 r2772  
    11 
    2 policy_module(storage, 1.6.0) 
     2policy_module(storage, 1.6.1) 
    33 
    44######################################## 

  • trunk/policy/modules/services/fetchmail.te

    r2763 r2772  
    11 
    2 policy_module(fetchmail, 1.6.0) 
     2policy_module(fetchmail, 1.6.1) 
    33 
    44######################################## 
    …… 
    1515 
    1616type fetchmail_etc_t; 
    17 files_type(fetchmail_etc_t) 
     17files_config_file(fetchmail_etc_t) 
    1818 
    1919type fetchmail_uidl_cache_t; 

  • trunk/policy/modules/services/oav.te

    r2763 r2772  
    11 
    2 policy_module(oav, 1.6.0) 
     2policy_module(oav, 1.6.1) 
    33 
    44######################################## 
    …… 
    1313# cjp: may be collapsable to etc_t 
    1414type oav_update_etc_t; 
    15 files_type(oav_update_etc_t) 
     15files_config_file(oav_update_etc_t) 
    1616 
    1717type oav_update_var_lib_t; 
    …… 
    2323 
    2424type scannerdaemon_etc_t; 
    25 files_type(scannerdaemon_etc_t) 
     25files_config_file(scannerdaemon_etc_t) 
    2626 
    2727type scannerdaemon_log_t; 

  • trunk/policy/modules/services/ricci.te

    r2763 r2772  
    11 
    2 policy_module(ricci, 1.3.0) 
     2policy_module(ricci, 1.3.1) 
    33 
    44######################################## 
    …… 
    444444files_lock_filetrans(ricci_modstorage_t, ricci_modstorage_lock_t, file) 
    445445 
     446corecmd_exec_shell(ricci_modstorage_t) 
    446447corecmd_exec_bin(ricci_modstorage_t) 
    447448 

  • trunk/policy/modules/services/rsync.fc

    r735 r2772  
    11 
    22/usr/bin/rsync          --      gen_context(system_u:object_r:rsync_exec_t,s0) 
     3 
     4/var/log/rsync\.log      --     gen_context(system_u:object_r:rsync_log_t,s0) 
     5 
     6/var/run/rsyncd\.lock      --   gen_context(system_u:object_r:rsync_log_t,s0) 

  • trunk/policy/modules/services/rsync.te

    r2763 r2772  
    11 
    2 policy_module(rsync, 1.6.0) 
     2policy_module(rsync, 1.6.1) 
    33 
    44######################################## 
    …… 
    3232files_type(rsync_data_t) 
    3333 
     34type rsync_log_t; 
     35logging_log_file(rsync_log_t) 
     36 
    3437type rsync_tmp_t; 
    3538files_tmp_file(rsync_tmp_t) 
    …… 
    4346# 
    4447 
    45 allow rsync_t self:capability sys_chroot; 
     48allow rsync_t self:capability { dac_read_search dac_override setuid setgid sys_chroot }; 
    4649allow rsync_t self:process signal_perms; 
    4750allow rsync_t self:fifo_file rw_fifo_file_perms; 
    …… 
    5356# search home and kerberos also. 
    5457allow rsync_t self:netlink_tcpdiag_socket r_netlink_socket_perms; 
    55 allow rsync_t self:capability { setuid setgid }; 
    5658#end for identd 
    5759 
    …… 
    9698 
    9799logging_send_syslog_msg(rsync_t) 
    98 logging_dontaudit_search_logs(rsync_t) 
     100manage_files_pattern(rsync_t,rsync_log_t,rsync_log_t) 
     101logging_log_filetrans(rsync_t,rsync_log_t,file) 
    99102 
    100103miscfiles_read_localization(rsync_t) 
    …… 
    118121 
    119122tunable_policy(`rsync_export_all_ro',` 
    120         allow rsync_t self:capability dac_override; 
    121123        fs_read_noxattr_fs_files(rsync_t)  
    122124        auth_read_all_files_except_shadow(rsync_t) 

  • trunk/policy/modules/services/stunnel.if

    r676 r2772  
    11## <summary>SSL Tunneling Proxy</summary> 
     2 
     3######################################## 
     4## <summary> 
     5##      Define the specified domain as a stunnel inetd service. 
     6## </summary> 
     7## <param name="domain"> 
     8##      <summary> 
     9##      The type associated with the stunnel inetd service process. 
     10##      </summary> 
     11## </param> 
     12## <param name="entrypoint"> 
     13##      <summary> 
     14##      The type associated with the process program. 
     15##      </summary> 
     16## </param> 
     17# 
     18interface(`stunnel_service_domain',` 
     19        gen_require(` 
     20                type stunnel_t; 
     21        ') 
     22 
     23        domtrans_pattern(stunnel_t,$2,$1) 
     24        allow $1 stunnel_t:tcp_socket rw_socket_perms; 
     25') 

  • trunk/policy/modules/services/stunnel.te

    r2763 r2772  
    11 
    2 policy_module(stunnel, 1.6.0) 
     2policy_module(stunnel, 1.6.1) 
    33 
    44######################################## 
    …… 
    2121 
    2222type stunnel_etc_t; 
    23 files_type(stunnel_etc_t) 
     23files_config_file(stunnel_etc_t) 
    2424 
    2525type stunnel_tmp_t; 

  • trunk/policy/modules/system/hotplug.te

    r2742 r2772  
    11 
    2 policy_module(hotplug, 1.9.0) 
     2policy_module(hotplug, 1.9.1) 
    33 
    44######################################## 
    …… 
    122122                # for arping used for static IP addresses on PCMCIA ethernet 
    123123                netutils_domtrans(hotplug_t) 
     124                netutils_signal(hotplug_t) 
    124125                fs_rw_tmpfs_chr_files(hotplug_t) 
    125126        ')