Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/F-8
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv23679
Modified Files:
policy-20070703.patch selinux-policy.spec
Log Message:
* Thu Jan 22 2008 Dan Walsh <dwalsh(a)redhat.com> 3.0.8-83
- Make oddjob_mkhomedir work with confined login domains
policy-20070703.patch:
Index: policy-20070703.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-8/policy-20070703.patch,v
retrieving revision 1.179
retrieving revision 1.180
diff -u -r1.179 -r1.180
--- policy-20070703.patch 31 Jan 2008 19:36:02 -0000 1.179
+++ policy-20070703.patch 31 Jan 2008 20:59:53 -0000 1.180
@@ -4586,7 +4586,7 @@
type lvm_control_t;
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if
serefpolicy-3.0.8/policy/modules/kernel/domain.if
--- nsaserefpolicy/policy/modules/kernel/domain.if 2007-10-22 13:21:42.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/kernel/domain.if 2008-01-17 09:03:07.000000000
-0500
++++ serefpolicy-3.0.8/policy/modules/kernel/domain.if 2008-01-31 15:48:18.000000000
-0500
@@ -45,6 +45,11 @@
# start with basic domain
domain_base_type($1)
@@ -7775,7 +7775,7 @@
## <param name="domain">
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te
serefpolicy-3.0.8/policy/modules/services/cron.te
--- nsaserefpolicy/policy/modules/services/cron.te 2007-10-22 13:21:36.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/cron.te 2008-01-17 09:03:07.000000000
-0500
++++ serefpolicy-3.0.8/policy/modules/services/cron.te 2008-01-31 15:35:05.000000000
-0500
@@ -50,6 +50,7 @@
type crond_tmp_t;
@@ -11671,6 +11671,111 @@
logrotate_exec(ntpd_t)
')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.fc
serefpolicy-3.0.8/policy/modules/services/oddjob.fc
+--- nsaserefpolicy/policy/modules/services/oddjob.fc 2007-10-22 13:21:39.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/oddjob.fc 2008-01-31 15:24:30.000000000
-0500
+@@ -1,5 +1,5 @@
+-/usr/lib/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0)
++/usr/lib(64)?/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0)
+
+ /usr/sbin/oddjobd -- gen_context(system_u:object_r:oddjob_exec_t,s0)
+
+-/var/run/oddjobd.pid gen_context(system_u:object_r:oddjob_var_run_t,s0)
++/var/run/oddjobd\.pid gen_context(system_u:object_r:oddjob_var_run_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.if
serefpolicy-3.0.8/policy/modules/services/oddjob.if
+--- nsaserefpolicy/policy/modules/services/oddjob.if 2007-10-22 13:21:39.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/oddjob.if 2008-01-31 15:50:05.000000000
-0500
+@@ -44,6 +44,7 @@
+ ')
+
+ domtrans_pattern(oddjob_t, $2, $1)
++ domain_user_exemption_target($1)
+ ')
+
+ ########################################
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te
serefpolicy-3.0.8/policy/modules/services/oddjob.te
+--- nsaserefpolicy/policy/modules/services/oddjob.te 2007-10-22 13:21:39.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/oddjob.te 2008-01-31 15:59:20.000000000
-0500
+@@ -1,5 +1,5 @@
+
+-policy_module(oddjob,1.3.0)
++policy_module(oddjob,1.4.0)
+
+ ########################################
+ #
+@@ -10,14 +10,20 @@
+ type oddjob_exec_t;
+ domain_type(oddjob_t)
+ init_daemon_domain(oddjob_t, oddjob_exec_t)
++domain_obj_id_change_exemption(oddjob_t)
+ domain_subj_id_change_exemption(oddjob_t)
+
+ type oddjob_mkhomedir_t;
+ type oddjob_mkhomedir_exec_t;
+ domain_type(oddjob_mkhomedir_t)
+-init_daemon_domain(oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t)
++domain_obj_id_change_exemption(oddjob_mkhomedir_t)
++init_system_domain(oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t)
+ oddjob_system_entry(oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t)
+
++ifdef(`enable_mcs',`
++ init_ranged_daemon_domain(oddjob_t,oddjob_exec_t,s0 - mcs_systemhigh)
++')
++
+ # pid files
+ type oddjob_var_run_t;
+ files_pid_file(oddjob_var_run_t)
+@@ -56,7 +62,6 @@
+
+ optional_policy(`
+ dbus_system_bus_client_template(oddjob,oddjob_t)
+- dbus_send_system_bus(oddjob_t)
+ dbus_connect_system_bus(oddjob_t)
+ ')
+
+@@ -69,20 +74,38 @@
+ # oddjob_mkhomedir local policy
+ #
+
++allow oddjob_mkhomedir_t self:capability { chown fowner fsetid dac_override };
++allow oddjob_mkhomedir_t self:process setfscreate;
+ allow oddjob_mkhomedir_t self:fifo_file { read write };
+ allow oddjob_mkhomedir_t self:unix_stream_socket create_stream_socket_perms;
+
+ files_read_etc_files(oddjob_mkhomedir_t)
+
++kernel_read_system_state(oddjob_mkhomedir_t)
++
++auth_use_nsswitch(oddjob_mkhomedir_t)
++
+ libs_use_ld_so(oddjob_mkhomedir_t)
+ libs_use_shared_libs(oddjob_mkhomedir_t)
+
++logging_send_syslog_msg(oddjob_mkhomedir_t)
++
+ miscfiles_read_localization(oddjob_mkhomedir_t)
+
++selinux_get_fs_mount(oddjob_mkhomedir_t)
++selinux_validate_context(oddjob_mkhomedir_t)
++selinux_compute_access_vector(oddjob_mkhomedir_t)
++selinux_compute_create_context(oddjob_mkhomedir_t)
++selinux_compute_relabel_context(oddjob_mkhomedir_t)
++selinux_compute_user_contexts(oddjob_mkhomedir_t)
++
++seutil_read_config(oddjob_mkhomedir_t)
++seutil_read_file_contexts(oddjob_mkhomedir_t)
++seutil_read_default_contexts(oddjob_mkhomedir_t)
++
+ # Add/remove user home directories
++userdom_manage_unpriv_users_home_content_dirs(oddjob_mkhomedir_t)
+ userdom_home_filetrans_generic_user_home_dir(oddjob_mkhomedir_t)
+-userdom_manage_generic_user_home_content_dirs(oddjob_mkhomedir_t)
+-userdom_manage_generic_user_home_content_files(oddjob_mkhomedir_t)
+-userdom_manage_generic_user_home_dirs(oddjob_mkhomedir_t)
+-userdom_manage_staff_home_dirs(oddjob_mkhomedir_t)
++userdom_manage_all_users_home_content_dirs(oddjob_mkhomedir_t)
++userdom_manage_all_users_home_content_files(oddjob_mkhomedir_t)
+
userdom_generic_user_home_dir_filetrans_generic_user_home_content(oddjob_mkhomedir_t,notdevfile_class_set)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te
serefpolicy-3.0.8/policy/modules/services/openct.te
--- nsaserefpolicy/policy/modules/services/openct.te 2007-10-22 13:21:39.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/services/openct.te 2008-01-17 09:03:07.000000000
-0500
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-8/selinux-policy.spec,v
retrieving revision 1.608
retrieving revision 1.609
diff -u -r1.608 -r1.609
--- selinux-policy.spec 31 Jan 2008 18:53:49 -0000 1.608
+++ selinux-policy.spec 31 Jan 2008 20:59:53 -0000 1.609
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.0.8
-Release: 82%{?dist}
+Release: 83%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -381,6 +381,9 @@
%endif
%changelog
+* Thu Jan 22 2008 Dan Walsh <dwalsh(a)redhat.com> 3.0.8-83
+- Make oddjob_mkhomedir work with confined login domains
+
* Thu Jan 22 2008 Dan Walsh <dwalsh(a)redhat.com> 3.0.8-82
- Allow xdm to sys_ptrace