From ac7267ff7a8eccf68a4cdac7ea03e2bba2a50335 Mon Sep 17 00:00:00 2001
From: Lukas Vrabec <lvrabec(a)redhat.com>
Date: Thu, 30 Apr 2015 20:17:50 +0200
Subject: * Thu Apr 30 2015 Lukas Vrabec <lvrabec(a)redhat.com> 3.13.1-124 -
cloudinit and rhsmcertd need to communicate with dbus - Allow bacula access
to tape devices. - allow httpd_t to read nagios lib_var_lib_t to allow
rddtool generate graphs which will be shown by httpd . - Allow dnssec-trigger
to send sigchld to networkmanager - add interface networkmanager_sigchld -
Add dnssec-trigger unit file Label dnssec-trigger script in libexec - Remove
duplicate specification for /etc/localtime. - Add default labeling for
/etc/localtime symlink.
diff --git a/policy-f22-base.patch b/policy-f22-base.patch
index f46de33..cceca2d 100644
--- a/policy-f22-base.patch
+++ b/policy-f22-base.patch
@@ -35938,7 +35938,7 @@ index 79048c4..ce6f0ce 100644
udev_read_pid_files(lvm_t)
')
diff --git a/policy/modules/system/miscfiles.fc b/policy/modules/system/miscfiles.fc
-index 9fe8e01..3d71062 100644
+index 9fe8e01..ce00ccb 100644
--- a/policy/modules/system/miscfiles.fc
+++ b/policy/modules/system/miscfiles.fc
@@ -9,11 +9,14 @@ ifdef(`distro_gentoo',`
@@ -35949,7 +35949,7 @@ index 9fe8e01..3d71062 100644
-/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
+/etc/docker/certs\.d(/.*)? gen_context(system_u:object_r:cert_t,s0)
+/etc/httpd/alias(/.*)? gen_context(system_u:object_r:cert_t,s0)
-+/etc/localtime gen_context(system_u:object_r:locale_t,s0)
++/etc/localtime -l gen_context(system_u:object_r:locale_t,s0)
+/etc/locale.conf -- gen_context(system_u:object_r:locale_t,s0)
/etc/pki(/.*)? gen_context(system_u:object_r:cert_t,s0)
/etc/ssl(/.*)? gen_context(system_u:object_r:cert_t,s0)
@@ -41815,10 +41815,10 @@ index 0000000..d2a8fc7
+')
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644
-index 0000000..0005833
+index 0000000..e980df0
--- /dev/null
+++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,708 @@
+@@ -0,0 +1,709 @@
+policy_module(systemd, 1.0.0)
+
+#######################################
@@ -42074,6 +42074,7 @@ index 0000000..0005833
+
+kernel_dgram_send(systemd_networkd_t)
+kernel_request_load_module(systemd_networkd_t)
++kernel_rw_net_sysctls(systemd_networkd_t)
+
+dev_read_sysfs(systemd_networkd_t)
+
diff --git a/policy-f22-contrib.patch b/policy-f22-contrib.patch
index 36f4a0f..e4cf057 100644
--- a/policy-f22-contrib.patch
+++ b/policy-f22-contrib.patch
@@ -5157,7 +5157,7 @@ index f6eb485..164501c 100644
+ filetrans_pattern($1, { httpd_user_content_t httpd_user_script_exec_t },
httpd_user_htaccess_t, file, ".htaccess")
')
diff --git a/apache.te b/apache.te
-index 6649962..9c06038 100644
+index 6649962..d671bf8 100644
--- a/apache.te
+++ b/apache.te
@@ -5,280 +5,339 @@ policy_module(apache, 2.7.2)
@@ -6477,15 +6477,16 @@ index 6649962..9c06038 100644
tunable_policy(`httpd_can_network_connect_db',`
mysql_tcp_connect(httpd_t)
-@@ -832,6 +1029,7 @@ optional_policy(`
+@@ -832,6 +1029,8 @@ optional_policy(`
optional_policy(`
nagios_read_config(httpd_t)
++ nagios_read_lib(httpd_t)
+ nagios_read_log(httpd_t)
')
optional_policy(`
-@@ -842,20 +1040,40 @@ optional_policy(`
+@@ -842,20 +1041,40 @@ optional_policy(`
')
optional_policy(`
@@ -6532,7 +6533,7 @@ index 6649962..9c06038 100644
')
optional_policy(`
-@@ -863,19 +1081,35 @@ optional_policy(`
+@@ -863,19 +1082,35 @@ optional_policy(`
')
optional_policy(`
@@ -6568,7 +6569,7 @@ index 6649962..9c06038 100644
udev_read_db(httpd_t)
')
-@@ -883,65 +1117,189 @@ optional_policy(`
+@@ -883,65 +1118,189 @@ optional_policy(`
yam_read_content(httpd_t)
')
@@ -6780,7 +6781,7 @@ index 6649962..9c06038 100644
files_dontaudit_search_pids(httpd_suexec_t)
files_search_home(httpd_suexec_t)
-@@ -950,123 +1308,74 @@ auth_use_nsswitch(httpd_suexec_t)
+@@ -950,123 +1309,74 @@ auth_use_nsswitch(httpd_suexec_t)
logging_search_logs(httpd_suexec_t)
logging_send_syslog_msg(httpd_suexec_t)
@@ -6935,7 +6936,7 @@ index 6649962..9c06038 100644
mysql_read_config(httpd_suexec_t)
tunable_policy(`httpd_can_network_connect_db',`
-@@ -1083,172 +1392,107 @@ optional_policy(`
+@@ -1083,172 +1393,107 @@ optional_policy(`
')
')
@@ -7173,7 +7174,7 @@ index 6649962..9c06038 100644
')
tunable_policy(`httpd_read_user_content',`
-@@ -1256,64 +1500,74 @@ tunable_policy(`httpd_read_user_content',`
+@@ -1256,64 +1501,74 @@ tunable_policy(`httpd_read_user_content',`
')
tunable_policy(`httpd_use_cifs',`
@@ -7270,7 +7271,7 @@ index 6649962..9c06038 100644
########################################
#
-@@ -1321,8 +1575,15 @@ miscfiles_read_localization(httpd_rotatelogs_t)
+@@ -1321,8 +1576,15 @@ miscfiles_read_localization(httpd_rotatelogs_t)
#
optional_policy(`
@@ -7287,7 +7288,7 @@ index 6649962..9c06038 100644
')
########################################
-@@ -1330,49 +1591,38 @@ optional_policy(`
+@@ -1330,49 +1592,38 @@ optional_policy(`
# User content local policy
#
@@ -7352,7 +7353,7 @@ index 6649962..9c06038 100644
kernel_read_system_state(httpd_passwd_t)
corecmd_exec_bin(httpd_passwd_t)
-@@ -1382,38 +1632,101 @@ dev_read_urand(httpd_passwd_t)
+@@ -1382,38 +1633,101 @@ dev_read_urand(httpd_passwd_t)
domain_use_interactive_fds(httpd_passwd_t)
@@ -8819,7 +8820,7 @@ index dcd774e..c240ffa 100644
allow $1 bacula_t:process { ptrace signal_perms };
diff --git a/bacula.te b/bacula.te
-index f16b000..3c80c4b 100644
+index f16b000..aac8d2e 100644
--- a/bacula.te
+++ b/bacula.te
@@ -27,6 +27,9 @@ type bacula_store_t;
@@ -8867,7 +8868,7 @@ index f16b000..3c80c4b 100644
corenet_sendrecv_hplip_server_packets(bacula_t)
corenet_tcp_bind_hplip_port(bacula_t)
corenet_udp_bind_hplip_port(bacula_t)
-@@ -99,12 +112,14 @@ dev_getattr_all_blk_files(bacula_t)
+@@ -99,12 +112,18 @@ dev_getattr_all_blk_files(bacula_t)
dev_getattr_all_chr_files(bacula_t)
files_dontaudit_getattr_all_sockets(bacula_t)
@@ -8878,11 +8879,15 @@ index f16b000..3c80c4b 100644
fs_getattr_xattr_fs(bacula_t)
fs_list_all(bacula_t)
++storage_raw_read_fixed_disk(bacula_t)
++storage_read_tape(bacula_t)
++storage_write_tape(bacula_t)
++
+auth_use_nsswitch(bacula_t)
auth_read_shadow(bacula_t)
logging_send_syslog_msg(bacula_t)
-@@ -125,6 +140,12 @@ optional_policy(`
+@@ -125,6 +144,12 @@ optional_policy(`
ldap_stream_connect(bacula_t)
')
@@ -8895,7 +8900,7 @@ index f16b000..3c80c4b 100644
########################################
#
# Client local policy
-@@ -148,11 +169,8 @@ corenet_tcp_connect_hplip_port(bacula_admin_t)
+@@ -148,11 +173,8 @@ corenet_tcp_connect_hplip_port(bacula_admin_t)
domain_use_interactive_fds(bacula_admin_t)
@@ -13529,10 +13534,10 @@ index 0000000..a06f04b
+')
diff --git a/cloudform.te b/cloudform.te
new file mode 100644
-index 0000000..8c06c5d
+index 0000000..ec3a39a
--- /dev/null
+++ b/cloudform.te
-@@ -0,0 +1,240 @@
+@@ -0,0 +1,244 @@
+policy_module(cloudform, 1.0)
+########################################
+#
@@ -13652,6 +13657,10 @@ index 0000000..8c06c5d
+')
+
+optional_policy(`
++ rhsmcertd_dbus_chat(cloud_init_t)
++')
++
++optional_policy(`
+ networkmanager_dbus_chat(cloud_init_t)
+')
+
@@ -24743,11 +24752,14 @@ index 37a3b7b..921056a 100644
+')
diff --git a/dnssec.fc b/dnssec.fc
new file mode 100644
-index 0000000..9e231a8
+index 0000000..1714fa6
--- /dev/null
+++ b/dnssec.fc
-@@ -0,0 +1,3 @@
+@@ -0,0 +1,6 @@
++/usr/lib/systemd/system/dnssec-triggerd.* --
gen_context(system_u:object_r:dnssec_trigger_unit_file_t,s0)
++
+/usr/sbin/dnssec-triggerd -- gen_context(system_u:object_r:dnssec_trigger_exec_t,s0)
++/usr/libexec/dnssec-trigger-script --
gen_context(system_u:object_r:dnssec_trigger_exec_t,s0)
+
+/var/run/dnssec.* gen_context(system_u:object_r:dnssec_trigger_var_run_t,s0)
diff --git a/dnssec.if b/dnssec.if
@@ -24843,10 +24855,10 @@ index 0000000..457d4dd
+')
diff --git a/dnssec.te b/dnssec.te
new file mode 100644
-index 0000000..46f4d2c
+index 0000000..64f1a64
--- /dev/null
+++ b/dnssec.te
-@@ -0,0 +1,63 @@
+@@ -0,0 +1,68 @@
+policy_module(dnssec, 1.0.0)
+
+########################################
@@ -24858,6 +24870,9 @@ index 0000000..46f4d2c
+type dnssec_trigger_exec_t;
+init_daemon_domain(dnssec_trigger_t, dnssec_trigger_exec_t)
+
++type dnssec_trigger_unit_file_t;
++systemd_unit_file(dnssec_trigger_unit_file_t)
++
+type dnssec_trigger_var_run_t;
+files_pid_file(dnssec_trigger_var_run_t)
+
@@ -24909,6 +24924,8 @@ index 0000000..46f4d2c
+
+optional_policy(`
+ networkmanager_stream_connect(dnssec_trigger_t)
++ networkmanager_sigchld(dnssec_trigger_t)
++
+')
diff --git a/dnssectrigger.te b/dnssectrigger.te
index c7bb4e7..e6fe2f40 100644
@@ -55305,7 +55322,7 @@ index 94b9734..448a7e8 100644
+/var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
/var/run/wpa_supplicant-global -s gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
diff --git a/networkmanager.if b/networkmanager.if
-index 86dc29d..219892b 100644
+index 86dc29d..0c72c4d 100644
--- a/networkmanager.if
+++ b/networkmanager.if
@@ -2,7 +2,7 @@
@@ -55536,12 +55553,11 @@ index 86dc29d..219892b 100644
#
-interface(`networkmanager_read_pid_files',`
+interface(`networkmanager_manage_pid_files',`
- gen_require(`
- type NetworkManager_var_run_t;
- ')
-
- files_search_pids($1)
-- allow $1 NetworkManager_var_run_t:file read_file_perms;
++ gen_require(`
++ type NetworkManager_var_run_t;
++ ')
++
++ files_search_pids($1)
+ manage_files_pattern($1, NetworkManager_var_run_t, NetworkManager_var_run_t)
+')
+
@@ -55556,11 +55572,12 @@ index 86dc29d..219892b 100644
+## </param>
+#
+interface(`networkmanager_manage_pid_sock_files',`
-+ gen_require(`
-+ type NetworkManager_var_run_t;
-+ ')
-+
-+ files_search_pids($1)
+ gen_require(`
+ type NetworkManager_var_run_t;
+ ')
+
+ files_search_pids($1)
+- allow $1 NetworkManager_var_run_t:file read_file_perms;
+ manage_sock_files_pattern($1, NetworkManager_var_run_t, NetworkManager_var_run_t)
+')
+
@@ -55635,7 +55652,7 @@ index 86dc29d..219892b 100644
## <param name="role">
## <summary>
## Role allowed access.
-@@ -287,33 +425,132 @@ interface(`networkmanager_stream_connect',`
+@@ -287,33 +425,150 @@ interface(`networkmanager_stream_connect',`
## </param>
## <rolecap/>
#
@@ -55746,6 +55763,24 @@ index 86dc29d..219892b 100644
+
+########################################
+## <summary>
++## Send sigchld to networkmanager.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++#
++interface(`networkmanager_sigchld',`
++ gen_require(`
++ type networkmanager_t;
++ ')
++
++ allow $1 networkmanager_t:process sigchld;
++')
++########################################
++## <summary>
+## Transition to networkmanager named content
+## </summary>
+## <param name="domain">
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 3350a4d..0910d70 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 123%{?dist}
+Release: 124%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -602,6 +602,16 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Thu Apr 30 2015 Lukas Vrabec <lvrabec(a)redhat.com> 3.13.1-124
+- cloudinit and rhsmcertd need to communicate with dbus
+- Allow bacula access to tape devices.
+- allow httpd_t to read nagios lib_var_lib_t to allow rddtool generate graphs which will
be shown by httpd .
+- Allow dnssec-trigger to send sigchld to networkmanager
+- add interface networkmanager_sigchld
+- Add dnssec-trigger unit file Label dnssec-trigger script in libexec
+- Remove duplicate specification for /etc/localtime.
+- Add default labeling for /etc/localtime symlink.
+
* Mon Apr 20 2015 Lukas Vrabec <lvrabec(a)redhat.com> 3.13.1-123
- Define ipa_var_run_t type
- Add ipa_manage_pid_files interface.
--
cgit v0.10.2
http://pkgs.fedoraproject.org/cgit/selinux-policy.git/commit/?h=f22&i...