|
|
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-strict/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv15117
Modified Files:
policy-20050606.patch selinux-policy-strict.spec
Log Message:
* Thu Jun 23 2005 Dan Walsh <dwalsh@xxxxxxxxxx> 1.23.18-16
- Fix postgres to allow it to connect to auth
- Change cyrus-imapd to write to /var/spool/imap
- Add Russell patches
policy-20050606.patch:
Makefile | 23 +-
attrib.te | 2
domains/misc/kernel.te | 7
domains/misc/local.te | 5
domains/program/fsadm.te | 5
domains/program/init.te | 4
domains/program/initrc.te | 11 +
domains/program/klogd.te | 2
domains/program/login.te | 2
domains/program/modutil.te | 2
domains/program/mount.te | 4
domains/program/restorecon.te | 5
domains/program/ssh.te | 4
domains/program/syslogd.te | 3
domains/program/unused/NetworkManager.te | 9 +
domains/program/unused/acct.te | 2
domains/program/unused/afs.te | 1
domains/program/unused/alsa.te | 17 ++
domains/program/unused/amanda.te | 7
domains/program/unused/amavis.te | 5
domains/program/unused/apache.te | 4
domains/program/unused/apmd.te | 2
domains/program/unused/asterisk.te | 2
domains/program/unused/auditd.te | 10 +
domains/program/unused/bonobo.te | 9 +
domains/program/unused/ciped.te | 5
domains/program/unused/clamav.te | 1
domains/program/unused/clockspeed.te | 2
domains/program/unused/consoletype.te | 2
domains/program/unused/cups.te | 33 ++++
domains/program/unused/cyrus.te | 2
domains/program/unused/dante.te | 1
domains/program/unused/dcc.te | 3
domains/program/unused/ddclient.te | 4
domains/program/unused/dhcpc.te | 16 +-
domains/program/unused/dhcpd.te | 3
domains/program/unused/dictd.te | 1
domains/program/unused/distcc.te | 1
domains/program/unused/dovecot.te | 4
domains/program/unused/ethereal.te | 48 ++++++
domains/program/unused/evolution.te | 13 +
domains/program/unused/fingerd.te | 1
domains/program/unused/gatekeeper.te | 1
domains/program/unused/gconf.te | 12 +
domains/program/unused/gift.te | 2
domains/program/unused/gnome.te | 7
domains/program/unused/gnome_vfs.te | 9 +
domains/program/unused/gpg.te | 3
domains/program/unused/hotplug.te | 2
domains/program/unused/howl.te | 1
domains/program/unused/i18n_input.te | 7
domains/program/unused/iceauth.te | 12 +
domains/program/unused/imazesrv.te | 1
domains/program/unused/inetd.te | 7
domains/program/unused/innd.te | 1
domains/program/unused/ircd.te | 1
domains/program/unused/jabberd.te | 3
domains/program/unused/lpd.te | 1
domains/program/unused/lrrd.te | 1
domains/program/unused/monopd.te | 1
domains/program/unused/mozilla.te | 6
domains/program/unused/mysqld.te | 4
domains/program/unused/named.te | 1
domains/program/unused/nessusd.te | 1
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 1
domains/program/unused/openvpn.te | 2
domains/program/unused/orbit.te | 7
domains/program/unused/pam.te | 5
domains/program/unused/pamconsole.te | 2
domains/program/unused/ping.te | 2
domains/program/unused/postgresql.te | 4
domains/program/unused/postgrey.te | 2
domains/program/unused/pppd.te | 7
domains/program/unused/pxe.te | 1
domains/program/unused/pyzor.te | 2
domains/program/unused/radius.te | 2
domains/program/unused/razor.te | 2
domains/program/unused/rpcd.te | 5
domains/program/unused/samba.te | 3
domains/program/unused/snmpd.te | 1
domains/program/unused/sound-server.te | 1
domains/program/unused/spamd.te | 1
domains/program/unused/squid.te | 1
domains/program/unused/stunnel.te | 1
domains/program/unused/tftpd.te | 2
domains/program/unused/thunderbird.te | 9 +
domains/program/unused/transproxy.te | 2
domains/program/unused/ucspi-tcp.te | 2
domains/program/unused/udev.te | 2
domains/program/unused/utempter.te | 5
domains/program/unused/watchdog.te | 2
domains/program/unused/xdm.te | 23 ++
domains/program/unused/xserver.te | 3
domains/program/unused/zebra.te | 1
domains/user.te | 14 +
file_contexts/distros.fc | 21 --
file_contexts/program/alsa.fc | 3
file_contexts/program/apache.fc | 2
file_contexts/program/bonobo.fc | 1
file_contexts/program/cups.fc | 4
file_contexts/program/cyrus.fc | 1
file_contexts/program/ethereal.fc | 3
file_contexts/program/evolution.fc | 8 +
file_contexts/program/fontconfig.fc | 6
file_contexts/program/fsadm.fc | 1
file_contexts/program/gconf.fc | 5
file_contexts/program/gnome.fc | 8 +
file_contexts/program/gnome_vfs.fc | 1
file_contexts/program/iceauth.fc | 3
file_contexts/program/irc.fc | 2
file_contexts/program/mozilla.fc | 4
file_contexts/program/orbit.fc | 3
file_contexts/program/thunderbird.fc | 2
file_contexts/program/xauth.fc | 1
file_contexts/program/xdm.fc | 1
file_contexts/program/xserver.fc | 2
file_contexts/types.fc | 5
macros/admin_macros.te | 12 +
macros/base_user_macros.te | 75 ++++++---
macros/content_macros.te | 185 +++++++++++++++++++++++
macros/global_macros.te | 121 +--------------
macros/home_macros.te | 130 ++++++++++++++++
macros/network_macros.te | 2
macros/program/apache_macros.te | 4
macros/program/bonobo_macros.te | 119 +++++++++++++++
macros/program/dbusd_macros.te | 3
macros/program/ethereal_macros.te | 83 ++++++++++
macros/program/evolution_macros.te | 241 +++++++++++++++++++++++++++++++
macros/program/fontconfig_macros.te | 38 ++++
macros/program/games_domain.te | 38 +---
macros/program/gconf_macros.te | 56 +++++++
macros/program/gift_macros.te | 60 ++-----
macros/program/gnome_macros.te | 115 ++++++++++++++
macros/program/gnome_vfs_macros.te | 49 ++++++
macros/program/gpg_agent_macros.te | 1
macros/program/gpg_macros.te | 45 -----
macros/program/ice_macros.te | 38 ++++
macros/program/iceauth_macros.te | 40 +++++
macros/program/inetd_macros.te | 1
macros/program/irc_macros.te | 1
macros/program/lpr_macros.te | 24 ---
macros/program/mail_client_macros.te | 48 ++++++
macros/program/mozilla_macros.te | 131 ++++++----------
macros/program/mplayer_macros.te | 15 +
macros/program/orbit_macros.te | 44 +++++
macros/program/pyzor_macros.te | 1
macros/program/razor_macros.te | 1
macros/program/spamassassin_macros.te | 9 -
macros/program/ssh_agent_macros.te | 3
macros/program/thunderbird_macros.te | 57 +++++++
macros/program/tvtime_macros.te | 1
macros/program/userhelper_macros.te | 3
macros/program/x_client_macros.te | 12 -
macros/program/xauth_macros.te | 1
macros/program/xdm_macros.te | 11 +
macros/program/xserver_macros.te | 17 +-
macros/user_macros.te | 8 -
mls | 41 ++---
net_contexts | 133 +++++------------
targeted/domains/program/crond.te | 2
targeted/domains/program/ssh.te | 1
targeted/domains/program/xdm.te | 1
targeted/domains/unconfined.te | 10 -
tunables/distro.tun | 2
tunables/tunable.tun | 4
types/device.te | 7
types/devpts.te | 2
types/file.te | 8 +
types/network.te | 98 +++++++++---
types/security.te | 2
171 files changed, 1998 insertions(+), 732 deletions(-)
Index: policy-20050606.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/policy-20050606.patch,v
retrieving revision 1.17
retrieving revision 1.18
diff -u -r1.17 -r1.18
--- policy-20050606.patch 23 Jun 2005 17:31:03 -0000 1.17
+++ policy-20050606.patch 24 Jun 2005 10:19:20 -0000 1.18
@@ -253,6 +253,17 @@
allow acct_t self:capability sys_pacct;
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/afs.te
policy-1.23.18/domains/program/unused/afs.te
+--- nsapolicy/domains/program/unused/afs.te 2005-05-02 10:57:09.000000000
-0400
++++ policy-1.23.18/domains/program/unused/afs.te 2005-06-23
16:35:33.000000000 -0400
+@@ -18,7 +18,6 @@
+ define(`afs_server_domain',`
+ type afs_$1server_t, domain $2;
+ type afs_$1server_exec_t, file_type, sysadmfile;
+-type afs_$1_port_t, port_type;
+
+ role system_r types afs_$1server_t;
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/alsa.te
policy-1.23.18/domains/program/unused/alsa.te
--- nsapolicy/domains/program/unused/alsa.te 1969-12-31 19:00:00.000000000
-0500
+++ policy-1.23.18/domains/program/unused/alsa.te 2005-06-08
14:42:59.000000000 -0400
@@ -373,7 +384,7 @@
allow initrc_t asterisk_var_run_t:fifo_file unlink;
diff --exclude-from=exclude -N -u -r
nsapolicy/domains/program/unused/auditd.te
policy-1.23.18/domains/program/unused/auditd.te
--- nsapolicy/domains/program/unused/auditd.te 2005-06-01 06:11:22.000000000
-0400
-+++ policy-1.23.18/domains/program/unused/auditd.te 2005-06-20
11:33:22.000000000 -0400
++++ policy-1.23.18/domains/program/unused/auditd.te 2005-06-23
13:30:06.000000000 -0400
@@ -14,9 +14,9 @@
allow auditd_t self:netlink_audit_socket { create_netlink_socket_perms
nlmsg_relay nlmsg_readpriv };
@@ -386,11 +397,23 @@
allow auditd_t etc_t:file { getattr read };
# Do not use logdir_domain since this is a security file
-@@ -59,3 +59,4 @@
+@@ -27,6 +27,10 @@
+ can_exec(auditd_t, init_exec_t)
+ allow auditd_t initctl_t:fifo_file write;
+
++ifdef(`targeted_policy', `
++dontaudit auditd_t unconfined_t:fifo_file read;
++')
++
+ type auditctl_t, domain, privlog;
+ type auditctl_exec_t, file_type, exec_type, sysadmfile;
+ uses_shlib(auditctl_t)
+@@ -59,3 +63,5 @@
dontaudit auditctl_t init_t:fd use;
allow auditctl_t initrc_devpts_t:chr_file { read write };
allow auditctl_t privfd:fd use;
+
++
diff --exclude-from=exclude -N -u -r
nsapolicy/domains/program/unused/bonobo.te
policy-1.23.18/domains/program/unused/bonobo.te
--- nsapolicy/domains/program/unused/bonobo.te 1969-12-31 19:00:00.000000000
-0500
+++ policy-1.23.18/domains/program/unused/bonobo.te 2005-06-08
09:04:15.000000000 -0400
@@ -4403,8 +4426,29 @@
diff --exclude-from=exclude -N -u -r nsapolicy/Makefile policy-1.23.18/Makefile
--- nsapolicy/Makefile 2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/Makefile 2005-06-16 14:05:37.000000000 -0400
-@@ -144,9 +144,6 @@
++++ policy-1.23.18/Makefile 2005-06-23 16:44:19.000000000 -0400
+@@ -70,7 +70,7 @@
+ CONTEXTFILES += $(FCFILES)
+
+ APPDIR=$(CONTEXTPATH)
+-APPFILES = $(addprefix $(APPDIR)/,default_contexts default_type
initrc_context failsafe_context userhelper_context removable_context
dbus_contexts customizable_types) $(CONTEXTPATH)/files/media
++APPFILES = $(addprefix $(APPDIR)/,default_contexts default_type
initrc_context failsafe_context userhelper_context removable_context
dbus_contexts customizable_types port_types) $(CONTEXTPATH)/files/media
+ CONTEXTFILES += $(wildcard appconfig/*_context*) appconfig/media
+
+ ROOTFILES = $(addprefix $(APPDIR)/users/,root)
+@@ -115,6 +115,11 @@
+ @grep "^type .*customizable" $< | cut -d',' -f1 | cut -d' ' -f2 >
tmp/customizable_types
+ install -m 644 tmp/customizable_types $@
+
++$(APPDIR)/port_types: policy.conf
++ @mkdir -p $(APPDIR)
++ @grep "^type .*port_type" $< | cut -d',' -f1 | cut -d' ' -f2 >
tmp/port_types
++ install -m 644 tmp/port_types $@
++
+ $(APPDIR)/default_type: appconfig/default_type
+ @mkdir -p $(APPDIR)
+ install -m 644 $< $@
+@@ -144,9 +149,6 @@
@mkdir -p $(POLICYPATH)
$(CHECKPOLICY) $(CHECKPOLMLS) -o $@ policy.conf
ifneq ($(MLS),y)
@@ -4414,7 +4458,7 @@
endif
# Note: Can't use install, so not sure how to deal with mode, user, and group
# other than by default.
-@@ -155,21 +152,12 @@
+@@ -155,21 +157,12 @@
$(POLICYVER): policy.conf $(FC) $(CHECKPOLICY)
$(CHECKPOLICY) $(CHECKPOLMLS) -o $@ policy.conf
@@ -4436,7 +4480,16 @@
touch tmp/load
load: tmp/load $(FCPATH)
-@@ -242,7 +230,7 @@
+@@ -210,7 +203,7 @@
+ file_contexts/misc:
+ @mkdir -p file_contexts/misc
+
+-$(FCPATH): tmp/valid_fc $(USERPATH)/system.users $(APPDIR)/customizable_types
++$(FCPATH): tmp/valid_fc $(USERPATH)/system.users
$(APPDIR)/customizable_types $(APPDIR)/port_types
+ @echo "Installing file contexts files..."
+ @mkdir -p $(CONTEXTPATH)/files
+ install -m 644 $(HOMEDIR_TEMPLATE) $(HOMEDIRPATH)
+@@ -242,7 +235,7 @@
--regex-te='/^[ \t]*bool[ \t]+(\w+)/\1/b,bool/' $^
clean:
@@ -4540,7 +4593,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/net_contexts
policy-1.23.18/net_contexts
--- nsapolicy/net_contexts 2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/net_contexts 2005-06-23 11:45:45.000000000 -0400
++++ policy-1.23.18/net_contexts 2005-06-23 16:38:05.000000000 -0400
@@ -17,7 +17,6 @@
# protocol number context
# protocol low-high context
@@ -4650,7 +4703,7 @@
portcon tcp 631 system_u:object_r:ipp_port_t
portcon udp 631 system_u:object_r:ipp_port_t
portcon tcp 88 system_u:object_r:kerberos_port_t
-@@ -117,40 +110,25 @@
+@@ -117,41 +110,25 @@
portcon udp 750 system_u:object_r:kerberos_port_t
portcon tcp 4444 system_u:object_r:kerberos_master_port_t
portcon udp 4444 system_u:object_r:kerberos_master_port_t
@@ -4694,16 +4747,17 @@
portcon tcp 1721 system_u:object_r:gatekeeper_port_t
portcon tcp 7000 system_u:object_r:gatekeeper_port_t
-')
- ifdef(`afs.te', `
+-ifdef(`afs.te', `
portcon tcp 2040 system_u:object_r:afs_fs_port_t
portcon udp 7000 system_u:object_r:afs_fs_port_t
-@@ -160,41 +138,33 @@
+ portcon udp 7002 system_u:object_r:afs_pt_port_t
+@@ -159,42 +136,31 @@
+ portcon udp 7004 system_u:object_r:afs_ka_port_t
portcon udp 7005 system_u:object_r:afs_fs_port_t
portcon udp 7007 system_u:object_r:afs_bos_port_t
- ',`
+-',`
-ifdef(`ciped.te', `portcon udp 7007 system_u:object_r:cipe_port_t')
-+portcon udp 7007 system_u:object_r:cipe_port_t
- ')
+-')
-ifdef(`asterisk.te', `
portcon tcp 1720 system_u:object_r:asterisk_port_t
portcon udp 2427 system_u:object_r:asterisk_port_t
@@ -4751,7 +4805,7 @@
portcon tcp 6000 system_u:object_r:xserver_port_t
portcon tcp 6001 system_u:object_r:xserver_port_t
portcon tcp 6002 system_u:object_r:xserver_port_t
-@@ -215,51 +185,34 @@
+@@ -215,51 +181,34 @@
portcon tcp 6017 system_u:object_r:xserver_port_t
portcon tcp 6018 system_u:object_r:xserver_port_t
portcon tcp 6019 system_u:object_r:xserver_port_t
@@ -4953,7 +5007,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/types/network.te
policy-1.23.18/types/network.te
--- nsapolicy/types/network.te 2005-05-25 11:28:11.000000000 -0400
-+++ policy-1.23.18/types/network.te 2005-06-18 07:03:59.000000000 -0400
++++ policy-1.23.18/types/network.te 2005-06-23 16:41:20.000000000 -0400
@@ -8,17 +8,7 @@
# Modified by Russell Coker
# Move port types to their respective domains, add ifdefs, other cleanups.
@@ -4998,7 +5052,7 @@
############################################
#
# Network types
-@@ -126,3 +106,75 @@
+@@ -126,3 +106,79 @@
# Kernel-generated traffic, e.g. TCP resets.
allow kernel_t netif_type:netif { tcp_send tcp_recv };
allow kernel_t node_type:node { tcp_send tcp_recv };
@@ -5033,11 +5087,11 @@
+type asterisk_port_t, port_type;
+type utcpserver_port_t, port_type;
+type nessus_port_t, port_type;
-+type razor_port_t, port_type, reserved_port_type;
++type razor_port_t, port_type;
+type distccd_port_t, port_type;
+type socks_port_t, port_type;
+type gatekeeper_port_t, port_type;
-+type dcc_port_t, port_type, reserved_port_type;
++type dcc_port_t, port_type;
+type lrrd_port_t, port_type;
+type jabber_client_port_t, port_type;
+type jabber_interserver_port_t, port_type;
@@ -5048,16 +5102,11 @@
+type monopd_port_t, port_type;
+# Differentiate between the port where amavisd receives mail, and the
+# port where it returns cleaned mail back to the MTA.
-+type amavisd_recv_port_t, port_type, reserved_port_type;
-+type amavisd_send_port_t, port_type, reserved_port_type;
++type amavisd_recv_port_t, port_type;
++type amavisd_send_port_t, port_type;
+type innd_port_t, port_type, reserved_port_type;
+type snmp_port_t, port_type, reserved_port_type;
+type biff_port_t, port_type, reserved_port_type;
-+ifdef(`afs.te',`
-+typealias afs_bos_port_t alias cipe_port_t;
-+',`
-+type cipe_port_t, port_type;
-+')
+type hplip_port_t, port_type;
+
+#inetd_child_ports
@@ -5065,14 +5114,23 @@
+type rlogind_port_t, port_type, reserved_port_type;
+type telnetd_port_t, port_type, reserved_port_type;
+type comsat_port_t, port_type, reserved_port_type;
-+type cvs_port_t, port_type, reserved_port_type;
++type cvs_port_t, port_type;
+type dbskkd_port_t, port_type, reserved_port_type;
+type inetd_child_port_t, port_type, reserved_port_type;
+type ktalkd_port_t, port_type, reserved_port_type;
+type rsync_port_t, port_type, reserved_port_type;
+type uucpd_port_t, port_type, reserved_port_type;
+type swat_port_t, port_type, reserved_port_type;
-+type zope_port_t, port_type, reserved_port_type;
++type zope_port_t, port_type;
++type auth_port_t, port_type, reserved_port_type;
++
++# afs ports
++
++type afs_fs_port_t, port_type;
++type afs_pt_port_t, port_type;
++type afs_vl_port_t, port_type;
++type afs_ka_port_t, port_type;
++type afs_bos_port_t, port_type;
+
diff --exclude-from=exclude -N -u -r nsapolicy/types/security.te
policy-1.23.18/types/security.te
--- nsapolicy/types/security.te 2005-05-25 11:28:11.000000000 -0400
Index: selinux-policy-strict.spec
===================================================================
RCS file:
/cvs/dist/rpms/selinux-policy-strict/devel/selinux-policy-strict.spec,v
retrieving revision 1.334
retrieving revision 1.335
diff -u -r1.334 -r1.335
--- selinux-policy-strict.spec 23 Jun 2005 17:31:03 -0000 1.334
+++ selinux-policy-strict.spec 24 Jun 2005 10:19:20 -0000 1.335
@@ -108,6 +108,7 @@
%config %{_sysconfdir}/selinux/%{type}/users/system.users
%config(noreplace) %{_sysconfdir}/selinux/%{type}/users/local.users
%{_sysconfdir}/selinux/%{type}/contexts/customizable_types
+%{_sysconfdir}/selinux/%{type}/contexts/port_types
%{_mandir}/man8/*
%{_sysconfdir}/profile.d/selinux.sh
%{_sysconfdir}/profile.d/selinux.csh
--
fedora-cvs-commits mailing list
fedora-cvs-commits@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-cvs-commits
|
|