June 2008 - scm-commits - Fedora Mailing-Lists

rpms/claws-mail/devel .cvsignore, 1.18, 1.19 claws-mail.spec, 1.34, 1.35 sources, 1.18, 1.19

by fedora-extras-commits＠redhat.com

Author: awjb Update of /cvs/pkgs/rpms/claws-mail/devel In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv26336/devel Modified Files: .cvsignore claws-mail.spec sources Log Message: - version upgrade - bugfixes Index: .cvsignore =================================================================== RCS file: /cvs/pkgs/rpms/claws-mail/devel/.cvsignore,v retrieving revision 1.18 retrieving revision 1.19 diff -u -r1.18 -r1.19 --- .cvsignore 23 Apr 2008 07:29:08 -0000 1.18 +++ .cvsignore 30 Jun 2008 20:54:14 -0000 1.19 @@ -1 +1 @@ -claws-mail-3.4.0.tar.bz2 +claws-mail-3.5.0.tar.bz2 Index: claws-mail.spec =================================================================== RCS file: /cvs/pkgs/rpms/claws-mail/devel/claws-mail.spec,v retrieving revision 1.34 retrieving revision 1.35 diff -u -r1.34 -r1.35 --- claws-mail.spec 17 Jun 2008 15:11:38 -0000 1.34 +++ claws-mail.spec 30 Jun 2008 20:54:14 -0000 1.35 @@ -1,17 +1,17 @@ Name: claws-mail -Version: 3.4.0 -Release: 2%{?dist} +Version: 3.5.0 +Release: 1%{?dist} Summary: The extended version of Sylpheed Group: Applications/Internet License: GPLv3+ URL: http://claws-mail.org -Source0: http://dl.sf.net/sylpheed-claws/claws-mail-3.4.0.tar.bz2 +Source0: http://dl.sf.net/sylpheed-claws/claws-mail-3.5.0.tar.bz2 Source1: claws-mail.desktop BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root BuildRequires: flex, bison BuildRequires: glib2-devel >= 2.6.2 -BuildRequires: gtk2-devel >= 2.6.2 +BuildRequires: gtk2-devel >= 2.10.0 BuildRequires: compface >= 1.4 BuildRequires: openssl-devel >= 0.9.7 BuildRequires: openldap-devel >= 2.0.7 @@ -24,7 +24,6 @@ BuildRequires: pkgconfig BuildRequires: gettext-devel BuildRequires: libetpan-devel >= 0.51 -BuildRequires: libgnomeprintui22-devel BuildRequires: compface-devel BuildRequires: perl BuildRequires: libtool @@ -34,7 +33,12 @@ Obsoletes: sylpheed-claws <= 2.6.0 Provides: sylpheed-claws = %{version}-%{release} +# dropped as of 3.3.1 Obsoletes: claws-mail-plugins-clamav <= 3.3.1 +Provides: claws-mail-plugins-clamav = 3.3.1 +# dropped as of 3.5.0 +Obsoletes: claws-mail-plugins-pdfviewer <= 3.4.0 +Provides: claws-mail-plugins-pdfviewer = 3.4.0 %description Claws Mail is an email client (and news reader), based on GTK+, featuring @@ -202,6 +206,12 @@ %{_libdir}/claws-mail/plugins/bogofilter.so %changelog +* Mon Jun 30 2008 Andreas Bierfert <andreas.bierfert[AT]lowlatency.de> +- 3.5.0-1 +- version upgrade (#453405, #448750) +- completely fix (#449209) +- provide upgrade path from dropped pdf plugin + * Tue Jun 17 2008 Andreas Bierfert <andreas.bierfert[AT]lowlatency.de> - 3.4.0-2 - rebuild for libetpan Index: sources =================================================================== RCS file: /cvs/pkgs/rpms/claws-mail/devel/sources,v retrieving revision 1.18 retrieving revision 1.19 diff -u -r1.18 -r1.19 --- sources 23 Apr 2008 07:29:08 -0000 1.18 +++ sources 30 Jun 2008 20:54:14 -0000 1.19 @@ -1 +1 @@ -ec5ee743baa198c7fd707b0461b6c68a claws-mail-3.4.0.tar.bz2 +597a9a0b9d113325de6fd01500c0af98 claws-mail-3.5.0.tar.bz2

11 years, 9 months

1
0
0 / 0

rpms/claws-mail/F-8 .cvsignore, 1.18, 1.19 claws-mail.spec, 1.31, 1.32 sources, 1.18, 1.19

by fedora-extras-commits＠redhat.com

Author: awjb Update of /cvs/pkgs/rpms/claws-mail/F-8 In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv26336/F-8 Modified Files: .cvsignore claws-mail.spec sources Log Message: - version upgrade - bugfixes Index: .cvsignore =================================================================== RCS file: /cvs/pkgs/rpms/claws-mail/F-8/.cvsignore,v retrieving revision 1.18 retrieving revision 1.19 diff -u -r1.18 -r1.19 --- .cvsignore 23 Apr 2008 07:28:51 -0000 1.18 +++ .cvsignore 30 Jun 2008 20:53:12 -0000 1.19 @@ -1 +1 @@ -claws-mail-3.4.0.tar.bz2 +claws-mail-3.5.0.tar.bz2 Index: claws-mail.spec =================================================================== RCS file: /cvs/pkgs/rpms/claws-mail/F-8/claws-mail.spec,v retrieving revision 1.31 retrieving revision 1.32 diff -u -r1.31 -r1.32 --- claws-mail.spec 17 Jun 2008 15:10:31 -0000 1.31 +++ claws-mail.spec 30 Jun 2008 20:53:12 -0000 1.32 @@ -1,16 +1,16 @@ Name: claws-mail -Version: 3.4.0 -Release: 2%{?dist} +Version: 3.5.0 +Release: 1%{?dist} Summary: The extended version of Sylpheed Group: Applications/Internet License: GPLv3+ URL: http://claws-mail.org -Source0: http://dl.sf.net/sylpheed-claws/claws-mail-3.4.0.tar.bz2 +Source0: http://dl.sf.net/sylpheed-claws/claws-mail-3.5.0.tar.bz2 Source1: claws-mail.desktop BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root BuildRequires: flex, bison BuildRequires: glib2-devel >= 2.6.2 -BuildRequires: gtk2-devel >= 2.6.2 +BuildRequires: gtk2-devel >= 2.10.0 BuildRequires: compface >= 1.4 BuildRequires: openssl-devel >= 0.9.7 BuildRequires: openldap-devel >= 2.0.7 @@ -28,10 +28,16 @@ BuildRequires: libtool BuildRequires: libSM-devel BuildRequires: NetworkManager-glib-devel dbus-glib-devel + Obsoletes: sylpheed-claws <= 2.6.0 Provides: sylpheed-claws = %{version}-%{release} +# dropped as of 3.3.1 Obsoletes: claws-mail-plugins-clamav <= 3.3.1 +Provides: claws-mail-plugins-clamav = 3.3.1 +# dropped as of 3.5.0 +Obsoletes: claws-mail-plugins-pdfviewer <= 3.4.0 +Provides: claws-mail-plugins-pdfviewer = 3.4.0 %description Claws Mail is an email client (and news reader), based on GTK+, featuring @@ -199,6 +205,12 @@ %{_libdir}/claws-mail/plugins/bogofilter.so %changelog +* Mon Jun 30 2008 Andreas Bierfert <andreas.bierfert[AT]lowlatency.de> +- 3.5.0-1 +- version upgrade (#453405, #448750) +- completely fix (#449209) +- provide upgrade path from dropped pdf plugin + * Tue Jun 17 2008 Andreas Bierfert <andreas.bierfert[AT]lowlatency.de> - 3.4.0-2 - rebuild for libetpan Index: sources =================================================================== RCS file: /cvs/pkgs/rpms/claws-mail/F-8/sources,v retrieving revision 1.18 retrieving revision 1.19 diff -u -r1.18 -r1.19 --- sources 23 Apr 2008 07:28:51 -0000 1.18 +++ sources 30 Jun 2008 20:53:12 -0000 1.19 @@ -1 +1 @@ -ec5ee743baa198c7fd707b0461b6c68a claws-mail-3.4.0.tar.bz2 +597a9a0b9d113325de6fd01500c0af98 claws-mail-3.5.0.tar.bz2

11 years, 9 months

1
0
0 / 0

rpms/claws-mail/F-9 .cvsignore, 1.18, 1.19 claws-mail.spec, 1.34, 1.35 sources, 1.18, 1.19

by fedora-extras-commits＠redhat.com

Author: awjb Update of /cvs/pkgs/rpms/claws-mail/F-9 In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv26336/F-9 Modified Files: .cvsignore claws-mail.spec sources Log Message: - version upgrade - bugfixes Index: .cvsignore =================================================================== RCS file: /cvs/pkgs/rpms/claws-mail/F-9/.cvsignore,v retrieving revision 1.18 retrieving revision 1.19 diff -u -r1.18 -r1.19 --- .cvsignore 23 Apr 2008 07:28:57 -0000 1.18 +++ .cvsignore 30 Jun 2008 20:53:52 -0000 1.19 @@ -1 +1 @@ -claws-mail-3.4.0.tar.bz2 +claws-mail-3.5.0.tar.bz2 Index: claws-mail.spec =================================================================== RCS file: /cvs/pkgs/rpms/claws-mail/F-9/claws-mail.spec,v retrieving revision 1.34 retrieving revision 1.35 diff -u -r1.34 -r1.35 --- claws-mail.spec 17 Jun 2008 15:11:06 -0000 1.34 +++ claws-mail.spec 30 Jun 2008 20:53:52 -0000 1.35 @@ -1,17 +1,17 @@ Name: claws-mail -Version: 3.4.0 -Release: 2%{?dist} +Version: 3.5.0 +Release: 1%{?dist} Summary: The extended version of Sylpheed Group: Applications/Internet License: GPLv3+ URL: http://claws-mail.org -Source0: http://dl.sf.net/sylpheed-claws/claws-mail-3.4.0.tar.bz2 +Source0: http://dl.sf.net/sylpheed-claws/claws-mail-3.5.0.tar.bz2 Source1: claws-mail.desktop BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root BuildRequires: flex, bison BuildRequires: glib2-devel >= 2.6.2 -BuildRequires: gtk2-devel >= 2.6.2 +BuildRequires: gtk2-devel >= 2.10.0 BuildRequires: compface >= 1.4 BuildRequires: openssl-devel >= 0.9.7 BuildRequires: openldap-devel >= 2.0.7 @@ -24,7 +24,6 @@ BuildRequires: pkgconfig BuildRequires: gettext-devel BuildRequires: libetpan-devel >= 0.51 -BuildRequires: libgnomeprintui22-devel BuildRequires: compface-devel BuildRequires: perl BuildRequires: libtool @@ -34,7 +33,12 @@ Obsoletes: sylpheed-claws <= 2.6.0 Provides: sylpheed-claws = %{version}-%{release} +# dropped as of 3.3.1 Obsoletes: claws-mail-plugins-clamav <= 3.3.1 +Provides: claws-mail-plugins-clamav = 3.3.1 +# dropped as of 3.5.0 +Obsoletes: claws-mail-plugins-pdfviewer <= 3.4.0 +Provides: claws-mail-plugins-pdfviewer = 3.4.0 %description Claws Mail is an email client (and news reader), based on GTK+, featuring @@ -202,6 +206,12 @@ %{_libdir}/claws-mail/plugins/bogofilter.so %changelog +* Mon Jun 30 2008 Andreas Bierfert <andreas.bierfert[AT]lowlatency.de> +- 3.5.0-1 +- version upgrade (#453405, #448750) +- completely fix (#449209) +- provide upgrade path from dropped pdf plugin + * Tue Jun 17 2008 Andreas Bierfert <andreas.bierfert[AT]lowlatency.de> - 3.4.0-2 - rebuild for libetpan Index: sources =================================================================== RCS file: /cvs/pkgs/rpms/claws-mail/F-9/sources,v retrieving revision 1.18 retrieving revision 1.19 diff -u -r1.18 -r1.19 --- sources 23 Apr 2008 07:28:57 -0000 1.18 +++ sources 30 Jun 2008 20:53:52 -0000 1.19 @@ -1 +1 @@ -ec5ee743baa198c7fd707b0461b6c68a claws-mail-3.4.0.tar.bz2 +597a9a0b9d113325de6fd01500c0af98 claws-mail-3.5.0.tar.bz2

11 years, 9 months

1
0
0 / 0

rpms/selinux-policy/devel modules-mls.conf, 1.33, 1.34 policy-20080509.patch, 1.23, 1.24 selinux-policy.spec, 1.677, 1.678

by fedora-extras-commits＠redhat.com

Author: dwalsh Update of /cvs/extras/rpms/selinux-policy/devel In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv26323 Modified Files: modules-mls.conf policy-20080509.patch selinux-policy.spec Log Message: * Sun Jun 29 2008 Dan Walsh <dwalsh(a)redhat.com> 3.4.2-9 - Allow gdm to read rpm database - Allow nsplugin to read mplayer config files Index: modules-mls.conf =================================================================== RCS file: /cvs/extras/rpms/selinux-policy/devel/modules-mls.conf,v retrieving revision 1.33 retrieving revision 1.34 diff -u -r1.33 -r1.34 --- modules-mls.conf 19 May 2008 13:01:59 -0000 1.33 +++ modules-mls.conf 30 Jun 2008 20:52:56 -0000 1.34 @@ -1116,3 +1116,9 @@ # xguest = module +# Layer: services +# Module: courier +# +# IMAP and POP3 email servers +# +courier = module policy-20080509.patch: Index: policy-20080509.patch =================================================================== RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20080509.patch,v retrieving revision 1.23 retrieving revision 1.24 diff -u -r1.23 -r1.24 --- policy-20080509.patch 27 Jun 2008 11:58:29 -0000 1.23 +++ policy-20080509.patch 30 Jun 2008 20:52:56 -0000 1.24 @@ -284,18 +284,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.te serefpolicy-3.4.2/policy/modules/admin/amanda.te --- nsaserefpolicy/policy/modules/admin/amanda.te 2008-06-12 23:25:08.000000000 -0400 -+++ serefpolicy-3.4.2/policy/modules/admin/amanda.te 2008-06-12 23:37:53.000000000 -0400 -@@ -82,8 +82,7 @@ ++++ serefpolicy-3.4.2/policy/modules/admin/amanda.te 2008-06-29 08:00:12.000000000 -0400 +@@ -82,8 +82,9 @@ allow amanda_t amanda_config_t:file { getattr read }; # access to amandas data structure -allow amanda_t amanda_data_t:dir { read search write }; -allow amanda_t amanda_data_t:file manage_file_perms; ++manage_dirs_pattern(amanda_t, amanda_data_t, amanda_data_t) +manage_files_pattern(amanda_t, amanda_data_t, amanda_data_t) ++filetrans_pattern(amanda_t, amanda_config_t, amanda_data_t, { file dir }) # access to amanda_dumpdates_t allow amanda_t amanda_dumpdates_t:file { getattr lock read write }; -@@ -220,6 +219,7 @@ +@@ -220,6 +221,7 @@ auth_use_nsswitch(amanda_recover_t) fstools_domtrans(amanda_t) @@ -700,6 +702,34 @@ - dontaudit mrtg_t { boot_t device_t file_t lost_found_t }:dir getattr; - dontaudit mrtg_t root_t:lnk_file getattr; -') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.if serefpolicy-3.4.2/policy/modules/admin/netutils.if +--- nsaserefpolicy/policy/modules/admin/netutils.if 2008-06-12 23:25:08.000000000 -0400 ++++ serefpolicy-3.4.2/policy/modules/admin/netutils.if 2008-06-30 13:16:57.000000000 -0400 +@@ -124,6 +124,24 @@ + + ######################################## + ## <summary> ++## Send generic signals to netutils. ++## </summary> ++## <param name="domain"> ++## <summary> ++## Domain allowed access. ++## </summary> ++## </param> ++# ++interface(`netutils_signal',` ++ gen_require(` ++ type netutils_t; ++ ') ++ ++ allow $1 netutils_t:process signal; ++') ++ ++######################################## ++## <summary> + ## Execute ping in the ping domain, and + ## allow the specified role the ping domain. + ## </summary> diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.4.2/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2008-06-12 23:25:08.000000000 -0400 +++ serefpolicy-3.4.2/policy/modules/admin/netutils.te 2008-06-12 23:37:53.000000000 -0400 @@ -4543,8 +4573,8 @@ +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.4.2/policy/modules/apps/nsplugin.te --- nsaserefpolicy/policy/modules/apps/nsplugin.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.4.2/policy/modules/apps/nsplugin.te 2008-06-12 23:37:51.000000000 -0400 -@@ -0,0 +1,215 @@ ++++ serefpolicy-3.4.2/policy/modules/apps/nsplugin.te 2008-06-29 08:22:17.000000000 -0400 +@@ -0,0 +1,217 @@ + +policy_module(nsplugin,1.0.0) + @@ -4577,189 +4607,191 @@ +userdom_user_home_content(user,nsplugin_home_t) +typealias nsplugin_home_t alias user_nsplugin_home_t; + -+ type nsplugin_t; -+ type nsplugin_config_t; -+ application_domain(nsplugin_t, nsplugin_exec_t) -+ application_domain(nsplugin_config_t, nsplugin_config_exec_t) ++type nsplugin_t; ++type nsplugin_config_t; ++application_domain(nsplugin_t, nsplugin_exec_t) ++application_domain(nsplugin_config_t, nsplugin_config_exec_t) + -+ ######################################## -+ # -+ # nsplugin local policy -+ # -+ allow nsplugin_t self:fifo_file rw_file_perms; -+ allow nsplugin_t self:process { ptrace getsched setsched signal_perms }; ++######################################## ++# ++# nsplugin local policy ++# ++allow nsplugin_t self:fifo_file rw_file_perms; ++allow nsplugin_t self:process { ptrace getsched setsched signal_perms }; + -+ allow nsplugin_t self:sem create_sem_perms; -+ allow nsplugin_t self:shm create_shm_perms; -+ allow nsplugin_t self:msgq create_msgq_perms; -+ allow nsplugin_t self:unix_stream_socket { connectto create_stream_socket_perms }; -+ -+ tunable_policy(`allow_nsplugin_execmem',` -+ allow nsplugin_t self:process { execstack execmem }; -+ allow nsplugin_config_t self:process { execstack execmem }; -+ ') ++allow nsplugin_t self:sem create_sem_perms; ++allow nsplugin_t self:shm create_shm_perms; ++allow nsplugin_t self:msgq create_msgq_perms; ++allow nsplugin_t self:unix_stream_socket { connectto create_stream_socket_perms }; ++ ++tunable_policy(`allow_nsplugin_execmem',` ++ allow nsplugin_t self:process { execstack execmem }; ++ allow nsplugin_config_t self:process { execstack execmem }; ++') + -+ manage_dirs_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) -+ exec_files_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) -+ manage_files_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) -+ manage_lnk_files_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) -+ userdom_user_home_dir_filetrans(user, nsplugin_t, nsplugin_home_t, {file dir}) -+ unprivuser_dontaudit_write_home_content_files(nsplugin_t) -+ -+ corecmd_exec_bin(nsplugin_t) -+ corecmd_exec_shell(nsplugin_t) -+ -+ corenet_all_recvfrom_unlabeled(nsplugin_t) -+ corenet_all_recvfrom_netlabel(nsplugin_t) -+ corenet_tcp_connect_flash_port(nsplugin_t) -+ corenet_tcp_connect_pulseaudio_port(nsplugin_t) -+ corenet_tcp_connect_http_port(nsplugin_t) -+ corenet_tcp_sendrecv_generic_if(nsplugin_t) -+ corenet_tcp_sendrecv_all_nodes(nsplugin_t) -+ -+ domain_dontaudit_read_all_domains_state(nsplugin_t) -+ -+ dev_read_rand(nsplugin_t) -+ dev_read_sound(nsplugin_t) -+ dev_write_sound(nsplugin_t) -+ dev_read_video_dev(nsplugin_t) -+ dev_write_video_dev(nsplugin_t) -+ -+ kernel_read_kernel_sysctls(nsplugin_t) -+ kernel_read_system_state(nsplugin_t) -+ -+ files_read_usr_files(nsplugin_t) -+ files_read_etc_files(nsplugin_t) -+ -+ fs_list_inotifyfs(nsplugin_t) -+ fs_manage_tmpfs_files(nsplugin_t) -+ fs_getattr_tmpfs(nsplugin_t) -+ fs_getattr_xattr_fs(nsplugin_t) -+ -+ term_dontaudit_getattr_all_user_ptys(nsplugin_t) -+ term_dontaudit_getattr_all_user_ttys(nsplugin_t) -+ -+ auth_use_nsswitch(nsplugin_t) -+ -+ libs_use_ld_so(nsplugin_t) -+ libs_use_shared_libs(nsplugin_t) -+ libs_exec_ld_so(nsplugin_t) -+ -+ miscfiles_read_localization(nsplugin_t) -+ miscfiles_read_fonts(nsplugin_t) -+ -+ unprivuser_manage_tmp_dirs(nsplugin_t) -+ unprivuser_manage_tmp_files(nsplugin_t) -+ unprivuser_manage_tmp_sockets(nsplugin_t) -+ userdom_tmp_filetrans_user_tmp(user, nsplugin_t, { file dir sock_file }) -+ unprivuser_read_tmpfs_files(nsplugin_t) -+ unprivuser_rw_semaphores(nsplugin_t) -+ unprivuser_delete_tmpfs_files(nsplugin_t) -+ -+ unprivuser_read_home_content_symlinks(nsplugin_t) -+ unprivuser_read_home_content_files(nsplugin_t) -+ unprivuser_read_tmp_files(nsplugin_t) -+ userdom_write_user_tmp_sockets(user, nsplugin_t) -+ unprivuser_dontaudit_append_home_content_files(nsplugin_t) -+ userdom_dontaudit_manage_user_tmp_files(user, nsplugin_t) ++manage_dirs_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) ++exec_files_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) ++manage_files_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) ++manage_lnk_files_pattern(nsplugin_t, nsplugin_home_t, nsplugin_home_t) ++userdom_user_home_dir_filetrans(user, nsplugin_t, nsplugin_home_t, {file dir}) ++unprivuser_dontaudit_write_home_content_files(nsplugin_t) + -+ optional_policy(` -+ alsa_read_rw_config(nsplugin_t) -+ ') ++corecmd_exec_bin(nsplugin_t) ++corecmd_exec_shell(nsplugin_t) + -+ optional_policy(` -+ gnome_exec_gconf(nsplugin_t) -+ gnome_manage_user_gnome_config(user, nsplugin_t) -+ ') ++corenet_all_recvfrom_unlabeled(nsplugin_t) ++corenet_all_recvfrom_netlabel(nsplugin_t) ++corenet_tcp_connect_flash_port(nsplugin_t) ++corenet_tcp_connect_pulseaudio_port(nsplugin_t) ++corenet_tcp_connect_http_port(nsplugin_t) ++corenet_tcp_sendrecv_generic_if(nsplugin_t) ++corenet_tcp_sendrecv_all_nodes(nsplugin_t) + -+ optional_policy(` -+ mozilla_read_user_home_files(user, nsplugin_t) -+ mozilla_write_user_home_files(user, nsplugin_t) -+ ') ++domain_dontaudit_read_all_domains_state(nsplugin_t) + -+ optional_policy(` -+ mplayer_exec(nsplugin_t) -+ ') ++dev_read_rand(nsplugin_t) ++dev_read_sound(nsplugin_t) ++dev_write_sound(nsplugin_t) ++dev_read_video_dev(nsplugin_t) ++dev_write_video_dev(nsplugin_t) + -+ optional_policy(` -+ unconfined_execmem_signull(nsplugin_t) -+ unconfined_delete_tmpfs_files(nsplugin_t) -+ ') ++kernel_read_kernel_sysctls(nsplugin_t) ++kernel_read_system_state(nsplugin_t) + -+ optional_policy(` -+ xserver_stream_connect_xdm_xserver(nsplugin_t) -+ xserver_xdm_rw_shm(nsplugin_t) -+ xserver_read_xdm_tmp_files(nsplugin_t) -+ xserver_read_xdm_pid(nsplugin_t) -+ xserver_read_user_xauth(user, nsplugin_t) -+ xserver_use_user_fonts(user, nsplugin_t) -+ xserver_manage_home_fonts(nsplugin_t) -+ ') ++files_read_usr_files(nsplugin_t) ++files_read_etc_files(nsplugin_t) ++files_read_config_files(nsplugin_t) + -+ ######################################## -+ # -+ # nsplugin_config local policy -+ # ++fs_list_inotifyfs(nsplugin_t) ++fs_manage_tmpfs_files(nsplugin_t) ++fs_getattr_tmpfs(nsplugin_t) ++fs_getattr_xattr_fs(nsplugin_t) + -+ allow nsplugin_config_t self:capability { sys_nice setuid setgid }; -+ allow nsplugin_config_t self:process { setsched sigkill getsched execmem }; ++term_dontaudit_getattr_all_user_ptys(nsplugin_t) ++term_dontaudit_getattr_all_user_ttys(nsplugin_t) + -+ allow nsplugin_config_t self:fifo_file rw_file_perms; -+ allow nsplugin_config_t self:unix_stream_socket create_stream_socket_perms; ++auth_use_nsswitch(nsplugin_t) + -+ fs_list_inotifyfs(nsplugin_config_t) ++libs_use_ld_so(nsplugin_t) ++libs_use_shared_libs(nsplugin_t) ++libs_exec_ld_so(nsplugin_t) + -+ can_exec(nsplugin_config_t, nsplugin_rw_t) -+ manage_dirs_pattern(nsplugin_config_t, nsplugin_rw_t, nsplugin_rw_t) -+ manage_files_pattern(nsplugin_config_t, nsplugin_rw_t, nsplugin_rw_t) -+ manage_lnk_files_pattern(nsplugin_config_t, nsplugin_rw_t, nsplugin_rw_t) ++miscfiles_read_localization(nsplugin_t) ++miscfiles_read_fonts(nsplugin_t) + -+ manage_dirs_pattern(nsplugin_config_t, nsplugin_home_t, nsplugin_home_t) -+ manage_files_pattern(nsplugin_config_t, nsplugin_home_t, nsplugin_home_t) -+ manage_lnk_files_pattern(nsplugin_config_t, nsplugin_home_t, nsplugin_home_t) ++unprivuser_manage_tmp_dirs(nsplugin_t) ++unprivuser_manage_tmp_files(nsplugin_t) ++unprivuser_manage_tmp_sockets(nsplugin_t) ++userdom_tmp_filetrans_user_tmp(user, nsplugin_t, { file dir sock_file }) ++unprivuser_read_tmpfs_files(nsplugin_t) ++unprivuser_rw_semaphores(nsplugin_t) ++unprivuser_delete_tmpfs_files(nsplugin_t) + -+ corecmd_exec_bin(nsplugin_config_t) -+ corecmd_exec_shell(nsplugin_config_t) ++unprivuser_read_home_content_symlinks(nsplugin_t) ++unprivuser_read_home_content_files(nsplugin_t) ++unprivuser_read_tmp_files(nsplugin_t) ++userdom_write_user_tmp_sockets(user, nsplugin_t) ++unprivuser_dontaudit_append_home_content_files(nsplugin_t) ++userdom_dontaudit_manage_user_tmp_files(user, nsplugin_t) + -+ kernel_read_system_state(nsplugin_config_t) ++optional_policy(` ++ alsa_read_rw_config(nsplugin_t) ++') + -+ files_read_etc_files(nsplugin_config_t) -+ files_read_usr_files(nsplugin_config_t) -+ files_dontaudit_search_home(nsplugin_config_t) ++optional_policy(` ++ gnome_exec_gconf(nsplugin_t) ++ gnome_manage_user_gnome_config(user, nsplugin_t) ++') + -+ auth_use_nsswitch(nsplugin_config_t) ++optional_policy(` ++ mozilla_read_user_home_files(user, nsplugin_t) ++ mozilla_write_user_home_files(user, nsplugin_t) ++') + -+ libs_use_ld_so(nsplugin_config_t) -+ libs_use_shared_libs(nsplugin_config_t) ++optional_policy(` ++ mplayer_exec(nsplugin_t) ++') + -+ miscfiles_read_localization(nsplugin_config_t) -+ miscfiles_read_fonts(nsplugin_config_t) ++optional_policy(` ++ unconfined_execmem_signull(nsplugin_t) ++ unconfined_delete_tmpfs_files(nsplugin_t) ++') + -+ userdom_search_all_users_home_content(nsplugin_config_t) ++optional_policy(` ++ xserver_stream_connect_xdm_xserver(nsplugin_t) ++ xserver_xdm_rw_shm(nsplugin_t) ++ xserver_read_xdm_tmp_files(nsplugin_t) ++ xserver_read_xdm_pid(nsplugin_t) ++ xserver_read_user_xauth(user, nsplugin_t) ++ xserver_use_user_fonts(user, nsplugin_t) ++ xserver_manage_home_fonts(nsplugin_t) ++') + -+ tunable_policy(`use_nfs_home_dirs',` -+ fs_manage_nfs_dirs(nsplugin_t) -+ fs_manage_nfs_files(nsplugin_t) -+ fs_manage_nfs_dirs(nsplugin_config_t) -+ fs_manage_nfs_files(nsplugin_config_t) -+ ') ++######################################## ++# ++# nsplugin_config local policy ++# + -+ tunable_policy(`use_samba_home_dirs',` -+ fs_manage_cifs_dirs(nsplugin_t) -+ fs_manage_cifs_files(nsplugin_t) -+ fs_manage_cifs_dirs(nsplugin_config_t) -+ fs_manage_cifs_files(nsplugin_config_t) -+ ') ++allow nsplugin_config_t self:capability { sys_nice setuid setgid }; ++allow nsplugin_config_t self:process { setsched sigkill getsched execmem }; + -+ domtrans_pattern(nsplugin_config_t, nsplugin_exec_t, nsplugin_t) ++allow nsplugin_config_t self:fifo_file rw_file_perms; ++allow nsplugin_config_t self:unix_stream_socket create_stream_socket_perms; + -+ optional_policy(` -+ xserver_read_home_fonts(nsplugin_config_t) -+ ') ++fs_list_inotifyfs(nsplugin_config_t) + -+ optional_policy(` -+ mozilla_read_user_home_files(user, nsplugin_config_t) -+ ') ++can_exec(nsplugin_config_t, nsplugin_rw_t) ++manage_dirs_pattern(nsplugin_config_t, nsplugin_rw_t, nsplugin_rw_t) ++manage_files_pattern(nsplugin_config_t, nsplugin_rw_t, nsplugin_rw_t) ++manage_lnk_files_pattern(nsplugin_config_t, nsplugin_rw_t, nsplugin_rw_t) ++ ++manage_dirs_pattern(nsplugin_config_t, nsplugin_home_t, nsplugin_home_t) ++manage_files_pattern(nsplugin_config_t, nsplugin_home_t, nsplugin_home_t) ++manage_lnk_files_pattern(nsplugin_config_t, nsplugin_home_t, nsplugin_home_t) ++ ++corecmd_exec_bin(nsplugin_config_t) ++corecmd_exec_shell(nsplugin_config_t) ++ ++kernel_read_system_state(nsplugin_config_t) ++ ++files_read_etc_files(nsplugin_config_t) ++files_read_usr_files(nsplugin_config_t) ++files_dontaudit_search_home(nsplugin_config_t) ++files_list_tmp(nsplugin_config_t) ++ ++auth_use_nsswitch(nsplugin_config_t) ++ ++libs_use_ld_so(nsplugin_config_t) ++libs_use_shared_libs(nsplugin_config_t) ++ ++miscfiles_read_localization(nsplugin_config_t) ++miscfiles_read_fonts(nsplugin_config_t) ++ ++userdom_search_all_users_home_content(nsplugin_config_t) ++ ++tunable_policy(`use_nfs_home_dirs',` ++ fs_manage_nfs_dirs(nsplugin_t) ++ fs_manage_nfs_files(nsplugin_t) ++ fs_manage_nfs_dirs(nsplugin_config_t) ++ fs_manage_nfs_files(nsplugin_config_t) ++') ++ ++tunable_policy(`use_samba_home_dirs',` ++ fs_manage_cifs_dirs(nsplugin_t) ++ fs_manage_cifs_files(nsplugin_t) ++ fs_manage_cifs_dirs(nsplugin_config_t) ++ fs_manage_cifs_files(nsplugin_config_t) ++') ++ ++domtrans_pattern(nsplugin_config_t, nsplugin_exec_t, nsplugin_t) ++ ++optional_policy(` ++ xserver_read_home_fonts(nsplugin_config_t) ++') ++ ++optional_policy(` ++ mozilla_read_user_home_files(user, nsplugin_config_t) ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.fc serefpolicy-3.4.2/policy/modules/apps/openoffice.fc --- nsaserefpolicy/policy/modules/apps/openoffice.fc 1969-12-31 19:00:00.000000000 -0500 +++ serefpolicy-3.4.2/policy/modules/apps/openoffice.fc 2008-06-12 23:37:51.000000000 -0400 @@ -9278,7 +9310,7 @@ +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.if serefpolicy-3.4.2/policy/modules/services/aide.if --- nsaserefpolicy/policy/modules/services/aide.if 2008-06-12 23:25:06.000000000 -0400 -+++ serefpolicy-3.4.2/policy/modules/services/aide.if 2008-06-12 23:37:52.000000000 -0400 ++++ serefpolicy-3.4.2/policy/modules/services/aide.if 2008-06-30 16:04:01.000000000 -0400 @@ -70,9 +70,11 @@ allow $1 aide_t:process { ptrace signal_perms }; ps_process_pattern($1, aide_t) @@ -12440,7 +12472,7 @@ +/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.4.2/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2008-06-12 23:25:06.000000000 -0400 -+++ serefpolicy-3.4.2/policy/modules/services/cron.if 2008-06-12 23:37:52.000000000 -0400 ++++ serefpolicy-3.4.2/policy/modules/services/cron.if 2008-06-30 08:30:16.000000000 -0400 @@ -35,38 +35,23 @@ # template(`cron_per_role_template',` @@ -13655,10 +13687,20 @@ + +sysadm_dontaudit_read_home_content_files(cups_pdf_t) + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.fc serefpolicy-3.4.2/policy/modules/services/cvs.fc +--- nsaserefpolicy/policy/modules/services/cvs.fc 2008-06-12 23:25:05.000000000 -0400 ++++ serefpolicy-3.4.2/policy/modules/services/cvs.fc 2008-06-30 16:00:10.000000000 -0400 +@@ -5,3 +5,6 @@ + + /var/cvs(/.*)? gen_context(system_u:object_r:cvs_data_t,s0) + ++#CVSWeb file context ++/usr/share/cvsweb/cvsweb\.cgi -- gen_context(system_u:object_r:httpd_cvs_script_exec_t,s0) ++/var/www/cgi-bin/cvsweb\.cgi -- gen_context(system_u:object_r:httpd_cvs_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.if serefpolicy-3.4.2/policy/modules/services/cvs.if --- nsaserefpolicy/policy/modules/services/cvs.if 2008-06-12 23:25:05.000000000 -0400 -+++ serefpolicy-3.4.2/policy/modules/services/cvs.if 2008-06-12 23:37:52.000000000 -0400 -@@ -36,3 +36,72 @@ ++++ serefpolicy-3.4.2/policy/modules/services/cvs.if 2008-06-30 16:04:16.000000000 -0400 +@@ -36,3 +36,70 @@ can_exec($1,cvs_exec_t) ') @@ -13706,15 +13748,13 @@ +# +interface(`cvs_admin',` + gen_require(` -+ type cvs_t; ++ type cvs_t, cvs_tmp_t; ++ type cvs_data_t, cvs_var_run_t; + type cvs_script_exec_t; -+ type cvs_tmp_t; -+ type cvs_data_t; -+ type cvs_var_run_t; + ') + -+ allow $1 cvs_t:process { ptrace signal_perms getattr }; -+ read_files_pattern($1, cvs_t, cvs_t) ++ allow $1 cvs_t:process { ptrace signal_perms }; ++ ps_process_pattern($1, cvs_t) + + # Allow cvs_t to restart the apache service + cvs_script_domtrans($1) @@ -13733,7 +13773,7 @@ + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.4.2/policy/modules/services/cvs.te --- nsaserefpolicy/policy/modules/services/cvs.te 2008-06-12 23:25:05.000000000 -0400 -+++ serefpolicy-3.4.2/policy/modules/services/cvs.te 2008-06-12 23:37:51.000000000 -0400 ++++ serefpolicy-3.4.2/policy/modules/services/cvs.te 2008-06-30 16:00:42.000000000 -0400 @@ -28,6 +28,9 @@ type cvs_var_run_t; files_pid_file(cvs_var_run_t) @@ -13761,15 +13801,23 @@ mta_send_mail(cvs_t) # cjp: typeattribute doesnt work in conditionals yet -@@ -102,11 +104,3 @@ - kerberos_read_config(cvs_t) +@@ -103,10 +105,13 @@ kerberos_dontaudit_write_config(cvs_t) ') -- + -optional_policy(` - nis_use_ypbind(cvs_t) -') -- ++######################################## ++# CVSWeb policy ++ ++apache_content_template(cvs) ++ ++read_files_pattern(httpd_cvs_script_t, cvs_data_t, cvs_data_t) ++manage_dirs_pattern(httpd_cvs_script_t_t,cvs_tmp_t,cvs_tmp_t) ++manage_files_pattern(httpd_cvs_script_t,cvs_tmp_t,cvs_tmp_t) ++files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir }) + -optional_policy(` - nscd_socket_use(cvs_t) -') @@ -15531,7 +15579,7 @@ ## </summary> diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.4.2/policy/modules/services/exim.te --- nsaserefpolicy/policy/modules/services/exim.te 2008-06-12 23:25:05.000000000 -0400 -+++ serefpolicy-3.4.2/policy/modules/services/exim.te 2008-06-12 23:37:52.000000000 -0400 ++++ serefpolicy-3.4.2/policy/modules/services/exim.te 2008-06-30 13:59:08.000000000 -0400 @@ -21,9 +21,20 @@ ## </desc> gen_tunable(exim_manage_user_files,false) @@ -15621,7 +15669,7 @@ files_read_etc_files(exim_t) auth_use_nsswitch(exim_t) -@@ -99,23 +125,90 @@ +@@ -99,23 +125,95 @@ logging_send_syslog_msg(exim_t) miscfiles_read_localization(exim_t) @@ -15671,7 +15719,7 @@ + tunable_policy(`exim_can_connect_db',` + mysql_stream_connect(exim_t) + ') - ') ++') + +optional_policy(` + tunable_policy(`exim_can_connect_db',` @@ -15686,13 +15734,18 @@ + +optional_policy(` + procmail_domtrans(exim_t) -+') + ') + +optional_policy(` + sasl_connect(exim_t) +') + +optional_policy(` ++ cron_read_pipes(exim_t) ++ cron_rw_system_job_pipes(exim_t) ++') ++ ++optional_policy(` + cyrus_stream_connect(exim_t) +') + @@ -17602,18 +17655,23 @@ +files_type(mailscanner_spool_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.4.2/policy/modules/services/mta.fc --- nsaserefpolicy/policy/modules/services/mta.fc 2008-06-12 23:25:05.000000000 -0400 -+++ serefpolicy-3.4.2/policy/modules/services/mta.fc 2008-06-12 23:37:52.000000000 -0400 -@@ -11,8 +11,10 @@ ++++ serefpolicy-3.4.2/policy/modules/services/mta.fc 2008-06-30 13:24:59.000000000 -0400 +@@ -11,6 +11,7 @@ /usr/lib(64)?/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) /usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) +/bin/mail -- gen_context(system_u:object_r:sendmail_exec_t,s0) /usr/sbin/sendmail\.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0) /usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0) -+/usr/lib/courier/bin/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) - - /var/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) +@@ -21,7 +22,3 @@ + /var/spool/imap(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) + /var/spool/(client)?mqueue(/.*)? gen_context(system_u:object_r:mqueue_spool_t,s0) + /var/spool/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) +- +-#ifdef(`postfix.te', `', ` +-#/var/spool/postfix(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) +-#') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.4.2/policy/modules/services/mta.if --- nsaserefpolicy/policy/modules/services/mta.if 2008-06-12 23:25:05.000000000 -0400 +++ serefpolicy-3.4.2/policy/modules/services/mta.if 2008-06-12 23:37:52.000000000 -0400 @@ -17809,7 +17867,7 @@ ## </summary> diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.4.2/policy/modules/services/mta.te --- nsaserefpolicy/policy/modules/services/mta.te 2008-06-12 23:25:05.000000000 -0400 -+++ serefpolicy-3.4.2/policy/modules/services/mta.te 2008-06-24 05:41:16.000000000 -0400 ++++ serefpolicy-3.4.2/policy/modules/services/mta.te 2008-06-30 08:33:53.000000000 -0400 @@ -6,6 +6,8 @@ # Declarations # @@ -17944,11 +18002,12 @@ optional_policy(` # why is mail delivered to a directory of type arpwatch_data_t? arpwatch_search_data(mailserver_delivery) -@@ -154,3 +214,4 @@ +@@ -154,3 +214,5 @@ cron_read_system_job_tmp_files(mta_user_agent) ') ') + ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.fc serefpolicy-3.4.2/policy/modules/services/munin.fc --- nsaserefpolicy/policy/modules/services/munin.fc 2008-06-12 23:25:05.000000000 -0400 +++ serefpolicy-3.4.2/policy/modules/services/munin.fc 2008-06-12 23:37:52.000000000 -0400 @@ -20071,8 +20130,8 @@ + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.te serefpolicy-3.4.2/policy/modules/services/polkit.te --- nsaserefpolicy/policy/modules/services/polkit.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.4.2/policy/modules/services/polkit.te 2008-06-12 23:37:52.000000000 -0400 -@@ -0,0 +1,219 @@ ++++ serefpolicy-3.4.2/policy/modules/services/polkit.te 2008-06-30 10:21:36.000000000 -0400 +@@ -0,0 +1,221 @@ +policy_module(polkit_auth,1.0.0) + +######################################## @@ -20229,6 +20288,8 @@ + +polkit_domtrans_auth(polkit_grant_t) + ++manage_files_pattern(polkit_grant_t,polkit_var_run_t,polkit_var_run_t) ++ +manage_files_pattern(polkit_grant_t, polkit_var_lib_t, polkit_var_lib_t) +userdom_read_all_users_state(polkit_grant_t) + @@ -21284,7 +21345,7 @@ ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.4.2/policy/modules/services/prelude.te --- nsaserefpolicy/policy/modules/services/prelude.te 2008-06-12 23:25:06.000000000 -0400 -+++ serefpolicy-3.4.2/policy/modules/services/prelude.te 2008-06-24 06:34:11.000000000 -0400 ++++ serefpolicy-3.4.2/policy/modules/services/prelude.te 2008-06-30 15:20:18.000000000 -0400 @@ -19,12 +19,31 @@ type prelude_var_lib_t; files_type(prelude_var_lib_t) @@ -21343,11 +21404,15 @@ dev_read_rand(prelude_audisp_t) dev_read_urand(prelude_audisp_t) -@@ -126,6 +150,80 @@ +@@ -123,9 +147,84 @@ + libs_use_shared_libs(prelude_audisp_t) + + logging_send_syslog_msg(prelude_audisp_t) ++logging_audisp_system_domain(prelude_audisp_t, prelude_audisp_exec_t) miscfiles_read_localization(prelude_audisp_t) -+logging_audisp_system_domain(prelude_audisp_t, prelude_audisp_exec_t) ++sysnet_dns_name_resolve(prelude_audisp_t) + +######################################## +# @@ -21424,7 +21489,7 @@ ######################################## # # prewikka_cgi Declarations -@@ -135,6 +233,10 @@ +@@ -135,6 +234,10 @@ apache_content_template(prewikka) files_read_etc_files(httpd_prewikka_script_t) @@ -23779,7 +23844,7 @@ +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.4.2/policy/modules/services/sendmail.te --- nsaserefpolicy/policy/modules/services/sendmail.te 2008-06-12 23:25:05.000000000 -0400 -+++ serefpolicy-3.4.2/policy/modules/services/sendmail.te 2008-06-12 23:37:51.000000000 -0400 ++++ serefpolicy-3.4.2/policy/modules/services/sendmail.te 2008-06-30 08:31:37.000000000 -0400 @@ -20,13 +20,17 @@ mta_mailserver_delivery(sendmail_t) mta_mailserver_sender(sendmail_t) @@ -27522,7 +27587,7 @@ ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.4.2/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2008-06-12 23:25:05.000000000 -0400 -+++ serefpolicy-3.4.2/policy/modules/services/xserver.te 2008-06-14 07:13:56.000000000 -0400 ++++ serefpolicy-3.4.2/policy/modules/services/xserver.te 2008-06-29 08:15:37.000000000 -0400 @@ -8,6 +8,14 @@ ## <desc> @@ -27803,7 +27868,7 @@ # Talk to the console mouse server. gpm_stream_connect(xdm_t) gpm_setattr_gpmctl(xdm_t) -@@ -382,16 +472,26 @@ +@@ -382,16 +472,32 @@ ') optional_policy(` @@ -27811,6 +27876,12 @@ + polkit_read_lib(xdm_t) +') + ++# On crash gdm execs gdb to dump stack ++optional_policy(` ++ rpm_read_db(xdm_t) ++ rpm_dontaudit_manage_db(xdm_t) ++') ++ +optional_policy(` seutil_sigchld_newrole(xdm_t) ') @@ -27831,7 +27902,7 @@ ifndef(`distro_redhat',` allow xdm_t self:process { execheap execmem }; -@@ -427,7 +527,7 @@ +@@ -427,7 +533,7 @@ allow xdm_xserver_t xdm_var_lib_t:file { getattr read }; dontaudit xdm_xserver_t xdm_var_lib_t:dir search; @@ -27840,7 +27911,7 @@ # Label pid and temporary files with derived types. manage_files_pattern(xdm_xserver_t,xdm_tmp_t,xdm_tmp_t) -@@ -439,6 +539,15 @@ +@@ -439,6 +545,15 @@ can_exec(xdm_xserver_t, xkb_var_lib_t) files_search_var_lib(xdm_xserver_t) @@ -27856,7 +27927,7 @@ # VNC v4 module in X server corenet_tcp_bind_vnc_port(xdm_xserver_t) -@@ -450,10 +559,19 @@ +@@ -450,10 +565,19 @@ # xdm_xserver_t may no longer have any reason # to read ROLE_home_t - examine this in more detail # (xauth?) @@ -27877,7 +27948,7 @@ tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(xdm_xserver_t) fs_manage_nfs_files(xdm_xserver_t) -@@ -468,7 +586,18 @@ +@@ -468,7 +592,18 @@ optional_policy(` dbus_system_bus_client_template(xdm_xserver, xdm_xserver_t) @@ -27897,7 +27968,7 @@ ') optional_policy(` -@@ -481,16 +610,32 @@ +@@ -481,16 +616,32 @@ ') optional_policy(` @@ -27938,7 +28009,7 @@ ') ######################################## -@@ -544,3 +689,10 @@ +@@ -544,3 +695,10 @@ # allow pam_t xdm_t:fifo_file { getattr ioctl write }; ') dnl end TODO @@ -28174,7 +28245,7 @@ +/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.4.2/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2008-06-12 23:25:07.000000000 -0400 -+++ serefpolicy-3.4.2/policy/modules/system/authlogin.if 2008-06-12 23:37:53.000000000 -0400 ++++ serefpolicy-3.4.2/policy/modules/system/authlogin.if 2008-06-30 16:47:52.000000000 -0400 @@ -56,10 +56,6 @@ miscfiles_read_localization($1_chkpwd_t) @@ -28232,7 +28303,15 @@ # for SSP/ProPolice dev_read_urand($1) # for fingerprint readers -@@ -226,8 +239,39 @@ +@@ -216,6 +229,7 @@ + auth_rw_faillog($1) + auth_exec_pam($1) + auth_use_nsswitch($1) ++ auth_manage_pam_pid($1) + + init_rw_utmp($1) + +@@ -226,8 +240,39 @@ seutil_read_config($1) seutil_read_default_contexts($1) @@ -28272,7 +28351,7 @@ ') ') -@@ -333,19 +377,15 @@ +@@ -333,19 +378,15 @@ dev_read_rand($1) dev_read_urand($1) @@ -28296,7 +28375,7 @@ ') optional_policy(` -@@ -356,6 +396,28 @@ +@@ -356,6 +397,28 @@ optional_policy(` samba_stream_connect_winbind($1) ') @@ -28325,7 +28404,7 @@ ') ######################################## -@@ -369,12 +431,12 @@ +@@ -369,12 +432,12 @@ ## </param> ## <param name="role"> ## <summary> @@ -28340,7 +28419,7 @@ ## </summary> ## </param> # -@@ -386,6 +448,7 @@ +@@ -386,6 +449,7 @@ auth_domtrans_chk_passwd($1) role $2 types system_chkpwd_t; allow system_chkpwd_t $3:chr_file rw_file_perms; @@ -28348,7 +28427,7 @@ ') ######################################## -@@ -1447,6 +1510,10 @@ +@@ -1447,6 +1511,10 @@ ') optional_policy(` @@ -28359,7 +28438,7 @@ nis_use_ypbind($1) ') -@@ -1457,6 +1524,7 @@ +@@ -1457,6 +1525,7 @@ optional_policy(` samba_stream_connect_winbind($1) samba_read_var_files($1) @@ -28367,7 +28446,7 @@ ') ') -@@ -1491,3 +1559,59 @@ +@@ -1491,3 +1560,59 @@ typeattribute $1 can_write_shadow_passwords; typeattribute $1 can_relabelto_shadow_passwords; ') @@ -28630,6 +28709,17 @@ role system_r types hostname_t; ######################################## +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplug.te serefpolicy-3.4.2/policy/modules/system/hotplug.te +--- nsaserefpolicy/policy/modules/system/hotplug.te 2008-06-12 23:25:07.000000000 -0400 ++++ serefpolicy-3.4.2/policy/modules/system/hotplug.te 2008-06-30 13:18:01.000000000 -0400 +@@ -121,6 +121,7 @@ + optional_policy(` + # for arping used for static IP addresses on PCMCIA ethernet + netutils_domtrans(hotplug_t) ++ netutils_signal(hotplug_t) + fs_rw_tmpfs_chr_files(hotplug_t) + ') + files_getattr_generic_locks(hotplug_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.fc serefpolicy-3.4.2/policy/modules/system/init.fc --- nsaserefpolicy/policy/modules/system/init.fc 2008-06-12 23:25:07.000000000 -0400 +++ serefpolicy-3.4.2/policy/modules/system/init.fc 2008-06-12 23:37:53.000000000 -0400 Index: selinux-policy.spec =================================================================== RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v retrieving revision 1.677 retrieving revision 1.678 diff -u -r1.677 -r1.678 --- selinux-policy.spec 26 Jun 2008 12:12:35 -0000 1.677 +++ selinux-policy.spec 30 Jun 2008 20:52:56 -0000 1.678 @@ -17,7 +17,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.4.2 -Release: 8%{?dist} +Release: 9%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -375,6 +375,10 @@ %endif %changelog +* Sun Jun 29 2008 Dan Walsh <dwalsh(a)redhat.com> 3.4.2-9 +- Allow gdm to read rpm database +- Allow nsplugin to read mplayer config files + * Thu Jun 26 2008 Dan Walsh <dwalsh(a)redhat.com> 3.4.2-8 - Allow vpnc to run ifconfig

11 years, 9 months

1
0
0 / 0

rpms/selinux-policy/F-9 modules-mls.conf, 1.32, 1.33 policy-20071130.patch, 1.181, 1.182 selinux-policy.spec, 1.688, 1.689

by fedora-extras-commits＠redhat.com

Author: dwalsh Update of /cvs/extras/rpms/selinux-policy/F-9 In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv26221 Modified Files: modules-mls.conf policy-20071130.patch selinux-policy.spec Log Message: * Mon Jun 29 2008 Dan Walsh <dwalsh(a)redhat.com> 3.3.1-73 - Allow exim to use system_cron pipes - Allow gdm to read rpm database - Allow nsplugin to read mplayer config files - Allow login programs to write to /var/run/pam directory (Encrypted directories) Index: modules-mls.conf =================================================================== RCS file: /cvs/extras/rpms/selinux-policy/F-9/modules-mls.conf,v retrieving revision 1.32 retrieving revision 1.33 diff -u -r1.32 -r1.33 --- modules-mls.conf 14 Apr 2008 20:01:48 -0000 1.32 +++ modules-mls.conf 30 Jun 2008 20:52:16 -0000 1.33 @@ -1094,3 +1094,10 @@ # Root role used to manage audit system # auditadm = module + +# Layer: services +# Module: courier +# +# IMAP and POP3 email servers +# +courier = module policy-20071130.patch: Index: policy-20071130.patch =================================================================== RCS file: /cvs/extras/rpms/selinux-policy/F-9/policy-20071130.patch,v retrieving revision 1.181 retrieving revision 1.182 diff -u -r1.181 -r1.182 --- policy-20071130.patch 27 Jun 2008 11:15:46 -0000 1.181 +++ policy-20071130.patch 30 Jun 2008 20:52:16 -0000 1.182 @@ -1456,18 +1456,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.te serefpolicy-3.3.1/policy/modules/admin/amanda.te --- nsaserefpolicy/policy/modules/admin/amanda.te 2008-06-12 23:38:01.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/admin/amanda.te 2008-06-12 23:38:02.000000000 -0400 -@@ -82,8 +82,7 @@ ++++ serefpolicy-3.3.1/policy/modules/admin/amanda.te 2008-06-29 08:00:54.000000000 -0400 +@@ -82,8 +82,9 @@ allow amanda_t amanda_config_t:file { getattr read }; # access to amandas data structure -allow amanda_t amanda_data_t:dir { read search write }; -allow amanda_t amanda_data_t:file manage_file_perms; ++manage_dirs_pattern(amanda_t, amanda_data_t, amanda_data_t) +manage_files_pattern(amanda_t, amanda_data_t, amanda_data_t) ++filetrans_pattern(amanda_t, amanda_config_t, amanda_data_t, { file dir }) # access to amanda_dumpdates_t allow amanda_t amanda_dumpdates_t:file { getattr lock read write }; -@@ -94,7 +93,7 @@ +@@ -94,7 +95,7 @@ # access to amanda_gnutarlists_t (/var/lib/amanda/gnutar-lists) allow amanda_t amanda_gnutarlists_t:dir rw_dir_perms; allow amanda_t amanda_gnutarlists_t:file manage_file_perms; @@ -1476,7 +1478,7 @@ manage_dirs_pattern(amanda_t,amanda_var_lib_t,amanda_var_lib_t) manage_files_pattern(amanda_t,amanda_var_lib_t,amanda_var_lib_t) -@@ -220,6 +219,7 @@ +@@ -220,6 +221,7 @@ auth_use_nsswitch(amanda_recover_t) fstools_domtrans(amanda_t) @@ -2135,6 +2137,34 @@ - dontaudit mrtg_t { boot_t device_t file_t lost_found_t }:dir getattr; - dontaudit mrtg_t root_t:lnk_file getattr; -') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.if serefpolicy-3.3.1/policy/modules/admin/netutils.if +--- nsaserefpolicy/policy/modules/admin/netutils.if 2008-06-12 23:38:01.000000000 -0400 ++++ serefpolicy-3.3.1/policy/modules/admin/netutils.if 2008-06-30 13:17:25.000000000 -0400 +@@ -124,6 +124,24 @@ + + ######################################## + ## <summary> ++## Send generic signals to netutils. ++## </summary> ++## <param name="domain"> ++## <summary> ++## Domain allowed access. ++## </summary> ++## </param> ++# ++interface(`netutils_signal',` ++ gen_require(` ++ type netutils_t; ++ ') ++ ++ allow $1 netutils_t:process signal; ++') ++ ++######################################## ++## <summary> + ## Execute ping in the ping domain, and + ## allow the specified role the ping domain. + ## </summary> diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.3.1/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2008-06-12 23:38:01.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/admin/netutils.te 2008-06-12 23:38:03.000000000 -0400 @@ -6031,8 +6061,8 @@ +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.3.1/policy/modules/apps/nsplugin.te --- nsaserefpolicy/policy/modules/apps/nsplugin.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/apps/nsplugin.te 2008-06-12 23:38:04.000000000 -0400 -@@ -0,0 +1,210 @@ ++++ serefpolicy-3.3.1/policy/modules/apps/nsplugin.te 2008-06-29 08:22:11.000000000 -0400 +@@ -0,0 +1,211 @@ + +policy_module(nsplugin,1.0.0) + @@ -6116,6 +6146,7 @@ + +files_read_usr_files(nsplugin_t) +files_read_etc_files(nsplugin_t) ++files_read_config_files(nsplugin_t) + +fs_list_inotifyfs(nsplugin_t) +fs_manage_tmpfs_files(nsplugin_t) @@ -12263,19 +12294,20 @@ + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.fc serefpolicy-3.3.1/policy/modules/services/courier.fc --- nsaserefpolicy/policy/modules/services/courier.fc 2008-06-12 23:38:01.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/courier.fc 2008-06-12 23:38:04.000000000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/courier.fc 2008-06-30 13:23:49.000000000 -0400 @@ -1,4 +1,5 @@ /etc/courier(/.*)? gen_context(system_u:object_r:courier_etc_t,s0) +/etc/authlib(/.*)? gen_context(system_u:object_r:courier_etc_t,s0) /usr/bin/imapd -- gen_context(system_u:object_r:courier_pop_exec_t,s0) -@@ -6,11 +7,18 @@ +@@ -6,11 +7,19 @@ /usr/sbin/courierldapaliasd -- gen_context(system_u:object_r:courier_exec_t,s0) /usr/sbin/couriertcpd -- gen_context(system_u:object_r:courier_tcpd_exec_t,s0) +/usr/libexec/courier-authlib/.* -- gen_context(system_u:object_r:courier_authdaemon_exec_t,s0) /usr/lib(64)?/courier/authlib/.* -- gen_context(system_u:object_r:courier_authdaemon_exec_t,s0) ++/usr/lib(64)?/courier/sendmail -- gen_context(system_u:object_r:courier_exec_t,s0) +/usr/lib(64)?/courier/bin(/.*)? gen_context(system_u:object_r:courier_exec_t,s0) +/usr/lib(64)?/courier/sbin(/.*)? gen_context(system_u:object_r:courier_exec_t,s0) /usr/lib(64)?/courier/courier/.* -- gen_context(system_u:object_r:courier_exec_t,s0) @@ -12289,7 +12321,7 @@ /usr/lib(64)?/courier/imapd -- gen_context(system_u:object_r:courier_pop_exec_t,s0) /usr/lib(64)?/courier/pop3d -- gen_context(system_u:object_r:courier_pop_exec_t,s0) /usr/lib(64)?/courier/rootcerts(/.*)? gen_context(system_u:object_r:courier_etc_t,s0) -@@ -19,3 +27,5 @@ +@@ -19,3 +28,5 @@ /var/lib/courier(/.*)? -- gen_context(system_u:object_r:courier_var_lib_t,s0) /var/run/courier(/.*)? -- gen_context(system_u:object_r:courier_var_run_t,s0) @@ -12418,7 +12450,7 @@ +/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.3.1/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2008-06-12 23:38:01.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/cron.if 2008-06-12 23:38:04.000000000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cron.if 2008-06-30 13:57:14.000000000 -0400 @@ -35,38 +35,23 @@ # template(`cron_per_role_template',` @@ -13598,6 +13630,16 @@ + +userdom_dontaudit_read_sysadm_home_content_files(cups_pdf_t) + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.fc serefpolicy-3.3.1/policy/modules/services/cvs.fc +--- nsaserefpolicy/policy/modules/services/cvs.fc 2008-06-12 23:38:02.000000000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cvs.fc 2008-06-30 16:00:29.000000000 -0400 +@@ -5,3 +5,6 @@ + + /var/cvs(/.*)? gen_context(system_u:object_r:cvs_data_t,s0) + ++#CVSWeb file context ++/usr/share/cvsweb/cvsweb\.cgi -- gen_context(system_u:object_r:httpd_cvs_script_exec_t,s0) ++/var/www/cgi-bin/cvsweb\.cgi -- gen_context(system_u:object_r:httpd_cvs_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.if serefpolicy-3.3.1/policy/modules/services/cvs.if --- nsaserefpolicy/policy/modules/services/cvs.if 2008-06-12 23:38:02.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/services/cvs.if 2008-06-12 23:38:04.000000000 -0400 @@ -13676,7 +13718,7 @@ + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.3.1/policy/modules/services/cvs.te --- nsaserefpolicy/policy/modules/services/cvs.te 2008-06-12 23:38:01.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/cvs.te 2008-06-12 23:38:03.000000000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/cvs.te 2008-06-30 16:00:47.000000000 -0400 @@ -28,6 +28,9 @@ type cvs_var_run_t; files_pid_file(cvs_var_run_t) @@ -13704,18 +13746,25 @@ mta_send_mail(cvs_t) # cjp: typeattribute doesnt work in conditionals yet -@@ -102,11 +104,3 @@ - kerberos_read_config(cvs_t) +@@ -103,10 +105,12 @@ kerberos_dontaudit_write_config(cvs_t) ') -- + -optional_policy(` - nis_use_ypbind(cvs_t) -') -- ++######################################## ++# CVSWeb policy + -optional_policy(` - nscd_socket_use(cvs_t) -') ++apache_content_template(cvs) ++ ++read_files_pattern(httpd_cvs_script_t, cvs_data_t, cvs_data_t) ++manage_dirs_pattern(httpd_cvs_script_t_t,cvs_tmp_t,cvs_tmp_t) ++manage_files_pattern(httpd_cvs_script_t,cvs_tmp_t,cvs_tmp_t) ++files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir }) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyphesis.fc serefpolicy-3.3.1/policy/modules/services/cyphesis.fc --- nsaserefpolicy/policy/modules/services/cyphesis.fc 1969-12-31 19:00:00.000000000 -0500 +++ serefpolicy-3.3.1/policy/modules/services/cyphesis.fc 2008-06-12 23:38:04.000000000 -0400 @@ -15457,7 +15506,7 @@ ## </summary> diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.3.1/policy/modules/services/exim.te --- nsaserefpolicy/policy/modules/services/exim.te 2008-06-12 23:38:01.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/exim.te 2008-06-12 23:38:03.000000000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/exim.te 2008-06-30 13:58:55.000000000 -0400 @@ -21,9 +21,20 @@ ## </desc> gen_tunable(exim_manage_user_files,false) @@ -15562,7 +15611,7 @@ tunable_policy(`exim_read_user_files',` userdom_read_unpriv_users_home_content_files(exim_t) -@@ -111,3 +144,71 @@ +@@ -111,3 +144,76 @@ userdom_read_unpriv_users_tmp_files(exim_t) userdom_write_unpriv_users_tmp_files(exim_t) ') @@ -15604,6 +15653,11 @@ +') + +optional_policy(` ++ cron_read_pipes(exim_t) ++ cron_rw_system_job_pipes(exim_t) ++') ++ ++optional_policy(` + cyrus_stream_connect(exim_t) +') + @@ -17656,22 +17710,22 @@ +files_type(mailscanner_spool_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.3.1/policy/modules/services/mta.fc --- nsaserefpolicy/policy/modules/services/mta.fc 2008-06-12 23:38:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/mta.fc 2008-06-12 23:38:04.000000000 -0400 -@@ -9,8 +9,10 @@ - ') - ++++ serefpolicy-3.3.1/policy/modules/services/mta.fc 2008-06-30 13:25:01.000000000 -0400 +@@ -11,6 +11,7 @@ /usr/lib(64)?/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) -+/usr/lib(64)?/courier/sendmail -- gen_context(system_u:object_r:courier_exec_t,s0) /usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) +/bin/mail -- gen_context(system_u:object_r:sendmail_exec_t,s0) /usr/sbin/sendmail\.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0) /usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0) -@@ -25,3 +27,4 @@ - #ifdef(`postfix.te', `', ` - #/var/spool/postfix(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) - #') +@@ -22,6 +23,4 @@ + /var/spool/(client)?mqueue(/.*)? gen_context(system_u:object_r:mqueue_spool_t,s0) + /var/spool/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) + +-#ifdef(`postfix.te', `', ` +-#/var/spool/postfix(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) +-#') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.3.1/policy/modules/services/mta.if --- nsaserefpolicy/policy/modules/services/mta.if 2008-06-12 23:38:02.000000000 -0400 @@ -17850,7 +17904,7 @@ ## </summary> diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.3.1/policy/modules/services/mta.te --- nsaserefpolicy/policy/modules/services/mta.te 2008-06-12 23:38:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/mta.te 2008-06-24 05:41:39.000000000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/mta.te 2008-06-30 13:57:46.000000000 -0400 @@ -6,6 +6,8 @@ # Declarations # @@ -20141,8 +20195,8 @@ + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.te serefpolicy-3.3.1/policy/modules/services/polkit.te --- nsaserefpolicy/policy/modules/services/polkit.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/polkit.te 2008-06-12 23:38:04.000000000 -0400 -@@ -0,0 +1,218 @@ ++++ serefpolicy-3.3.1/policy/modules/services/polkit.te 2008-06-30 10:22:01.000000000 -0400 +@@ -0,0 +1,220 @@ +policy_module(polkit_auth,1.0.0) + +######################################## @@ -20299,6 +20353,8 @@ + +polkit_domtrans_auth(polkit_grant_t) + ++manage_files_pattern(polkit_grant_t,polkit_var_run_t,polkit_var_run_t) ++ +manage_files_pattern(polkit_grant_t, polkit_var_lib_t, polkit_var_lib_t) +userdom_read_all_users_state(polkit_grant_t) + @@ -21404,8 +21460,8 @@ +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.3.1/policy/modules/services/prelude.te --- nsaserefpolicy/policy/modules/services/prelude.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.3.1/policy/modules/services/prelude.te 2008-06-24 06:34:17.000000000 -0400 -@@ -0,0 +1,248 @@ ++++ serefpolicy-3.3.1/policy/modules/services/prelude.te 2008-06-30 15:19:48.000000000 -0400 +@@ -0,0 +1,249 @@ + +policy_module(prelude, 1.0.0) + @@ -21555,10 +21611,11 @@ +libs_use_shared_libs(prelude_audisp_t) + +logging_send_syslog_msg(prelude_audisp_t) ++logging_audisp_system_domain(prelude_audisp_t, prelude_audisp_exec_t) + +miscfiles_read_localization(prelude_audisp_t) + -+logging_audisp_system_domain(prelude_audisp_t, prelude_audisp_exec_t) ++sysnet_dns_name_resolve(prelude_audisp_t) + +######################################## +# @@ -22368,7 +22425,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.if serefpolicy-3.3.1/policy/modules/services/razor.if --- nsaserefpolicy/policy/modules/services/razor.if 2008-06-12 23:38:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/razor.if 2008-06-12 23:38:04.000000000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/razor.if 2008-06-30 13:44:58.000000000 -0400 @@ -137,6 +137,7 @@ template(`razor_per_role_template',` gen_require(` @@ -22394,10 +22451,12 @@ ############################## # -@@ -218,3 +217,42 @@ +@@ -217,4 +216,44 @@ + ') domtrans_pattern($1, razor_exec_t, razor_t) - ') ++ allow $1 razor_t:process signal; ++') + +######################################## +## <summary> @@ -22435,7 +22494,7 @@ + allow $2 user_home_dir_t:dir search_dir_perms; + manage_files_pattern($2,user_razor_home_t,user_razor_home_t) + read_lnk_files_pattern($2,user_razor_home_t,user_razor_home_t) -+') + ') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.te serefpolicy-3.3.1/policy/modules/services/razor.te --- nsaserefpolicy/policy/modules/services/razor.te 2008-06-12 23:38:01.000000000 -0400 @@ -28294,7 +28353,7 @@ +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.3.1/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2008-06-12 23:38:02.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/services/xserver.te 2008-06-14 07:17:28.000000000 -0400 ++++ serefpolicy-3.3.1/policy/modules/services/xserver.te 2008-06-29 08:15:14.000000000 -0400 @@ -8,6 +8,14 @@ ## <desc> @@ -28367,7 +28426,7 @@ type iceauth_exec_t; -application_executable_file(iceauth_exec_t) +application_domain(iceauth_t,iceauth_exec_t) - ++ +type input_xevent_t, xevent_type; +type manage_xevent_t, xevent_type; +type output_xext_t, xextension_type; @@ -28383,7 +28442,7 @@ +type x_rootcolormap_t; +type x_rootscreen_t; +type x_rootwindow_t; -+ + +type xauth_t; type xauth_exec_t; -application_executable_file(xauth_exec_t) @@ -28642,14 +28701,14 @@ optional_policy(` alsa_domtrans(xdm_t) + alsa_read_rw_config(xdm_t) ++') ++ ++optional_policy(` ++ bootloader_domtrans(xdm_t) ') optional_policy(` - consolekit_dbus_chat(xdm_t) -+ bootloader_domtrans(xdm_t) -+') -+ -+optional_policy(` + consolekit_read_log(xdm_t) ') @@ -28689,7 +28748,7 @@ loadkeys_exec(xdm_t) ') -@@ -335,6 +499,11 @@ +@@ -335,6 +499,21 @@ ') optional_policy(` @@ -28698,10 +28757,20 @@ +') + +optional_policy(` ++ resmgr_stream_connect(xdm_t) ++') ++ ++# On crash gdm execs gdb to dump stack ++optional_policy(` ++ rpm_read_db(xdm_t) ++ rpm_dontaudit_manage_db(xdm_t) ++') ++ ++optional_policy(` seutil_sigchld_newrole(xdm_t) ') -@@ -343,8 +512,8 @@ +@@ -343,8 +522,8 @@ ') optional_policy(` @@ -28711,7 +28780,7 @@ ifndef(`distro_redhat',` allow xdm_t self:process { execheap execmem }; -@@ -380,7 +549,7 @@ +@@ -380,7 +559,7 @@ allow xdm_xserver_t xdm_var_lib_t:file { getattr read }; dontaudit xdm_xserver_t xdm_var_lib_t:dir search; @@ -28720,7 +28789,7 @@ # Label pid and temporary files with derived types. manage_files_pattern(xdm_xserver_t,xdm_tmp_t,xdm_tmp_t) -@@ -392,6 +561,15 @@ +@@ -392,6 +571,15 @@ can_exec(xdm_xserver_t, xkb_var_lib_t) files_search_var_lib(xdm_xserver_t) @@ -28736,7 +28805,7 @@ # VNC v4 module in X server corenet_tcp_bind_vnc_port(xdm_xserver_t) -@@ -404,9 +582,18 @@ +@@ -404,9 +592,18 @@ # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_unpriv_users_home_content_files(xdm_xserver_t) @@ -28755,10 +28824,11 @@ tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(xdm_xserver_t) fs_manage_nfs_files(xdm_xserver_t) -@@ -420,6 +607,22 @@ +@@ -420,7 +617,19 @@ ') optional_policy(` +- resmgr_stream_connect(xdm_t) + dbus_system_bus_client_template(xdm_xserver, xdm_xserver_t) + + optional_policy(` @@ -28772,13 +28842,10 @@ + +optional_policy(` + mono_rw_shm(xdm_xserver_t) -+') -+ -+optional_policy(` - resmgr_stream_connect(xdm_t) ') -@@ -429,47 +632,138 @@ + optional_policy(` +@@ -429,47 +638,138 @@ ') optional_policy(` @@ -28803,15 +28870,6 @@ + unconfined_signal(xdm_xserver_t) + unconfined_getpgid(xdm_xserver_t) + unconfined_domain(xdm_xserver_t) -+') -+ -+ -+tunable_policy(`allow_xserver_execmem', ` -+ allow xdm_xserver_t self:process { execheap execmem execstack }; -+') -+ -+ifndef(`distro_redhat',` -+ allow xdm_xserver_t self:process { execheap execmem }; ') -ifdef(`TODO',` @@ -28835,10 +28893,19 @@ -allow xdm_t polymember:lnk_file { create unlink }; -# xdm needs access for copying .Xauthority into new home -allow xdm_t polymember:file { create getattr write }; -+ifdef(`distro_rhel4',` ++ ++tunable_policy(`allow_xserver_execmem', ` ++ allow xdm_xserver_t self:process { execheap execmem execstack }; ++') ++ ++ifndef(`distro_redhat',` + allow xdm_xserver_t self:process { execheap execmem }; ') ++ifdef(`distro_rhel4',` ++ allow xdm_xserver_t self:process { execheap execmem }; ++') ++ +############################## # -# Wants to delete .xsession-errors file @@ -28889,10 +28956,11 @@ +') + +############################## -+# -+# iceauth_t Local policy # -allow xdm_t user_home_type:file unlink; ++# iceauth_t Local policy + # +-# Should fix exec of pam_timestamp_check is not closing xdm file descriptor + +allow iceauth_t user_iceauth_home_t:file manage_file_perms; +userdom_user_home_dir_filetrans($1,iceauth_t,user_iceauth_home_t,file) @@ -28917,11 +28985,10 @@ + +######################################## # --# Should fix exec of pam_timestamp_check is not closing xdm file descriptor -+# Rules for unconfined access to this module - # -allow pam_t xdm_t:fifo_file { getattr ioctl write }; -') dnl end TODO ++# Rules for unconfined access to this module ++# + +allow xserver_unconfined_type x_server_domain:x_server *; +allow xserver_unconfined_type { x_domain x_rootwindow_t self }:x_drawable *; @@ -29199,7 +29266,7 @@ +/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.3.1/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2008-06-12 23:38:01.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/system/authlogin.if 2008-06-12 23:38:02.000000000 -0400 ++++ serefpolicy-3.3.1/policy/modules/system/authlogin.if 2008-06-30 16:49:50.000000000 -0400 @@ -56,10 +56,6 @@ miscfiles_read_localization($1_chkpwd_t) @@ -29257,7 +29324,26 @@ # for SSP/ProPolice dev_read_urand($1) # for fingerprint readers -@@ -226,8 +239,40 @@ +@@ -207,14 +220,15 @@ + mls_process_set_level($1) + mls_fd_share_all_levels($1) + ++ auth_append_login_records($1) ++ auth_exec_pam($1) + auth_domtrans_chk_passwd($1) + auth_domtrans_upd_passwd($1) + auth_dontaudit_read_shadow($1) + auth_read_login_records($1) +- auth_append_login_records($1) +- auth_rw_lastlog($1) ++ auth_manage_pam_pid($1) + auth_rw_faillog($1) +- auth_exec_pam($1) ++ auth_rw_lastlog($1) + auth_use_nsswitch($1) + + init_rw_utmp($1) +@@ -226,8 +240,40 @@ seutil_read_config($1) seutil_read_default_contexts($1) @@ -29298,7 +29384,7 @@ ') ') -@@ -333,19 +378,15 @@ +@@ -333,19 +379,15 @@ dev_read_rand($1) dev_read_urand($1) @@ -29322,7 +29408,7 @@ ') optional_policy(` -@@ -356,6 +397,28 @@ +@@ -356,6 +398,28 @@ optional_policy(` samba_stream_connect_winbind($1) ') @@ -29351,7 +29437,7 @@ ') ######################################## -@@ -369,12 +432,12 @@ +@@ -369,12 +433,12 @@ ## </param> ## <param name="role"> ## <summary> @@ -29366,7 +29452,7 @@ ## </summary> ## </param> # -@@ -386,6 +449,7 @@ +@@ -386,6 +450,7 @@ auth_domtrans_chk_passwd($1) role $2 types system_chkpwd_t; allow system_chkpwd_t $3:chr_file rw_file_perms; @@ -29374,7 +29460,7 @@ ') ######################################## -@@ -1447,6 +1511,10 @@ +@@ -1447,6 +1512,10 @@ ') optional_policy(` @@ -29385,7 +29471,7 @@ nis_use_ypbind($1) ') -@@ -1457,6 +1525,7 @@ +@@ -1457,6 +1526,7 @@ optional_policy(` samba_stream_connect_winbind($1) samba_read_var_files($1) @@ -29393,7 +29479,7 @@ ') ') -@@ -1491,3 +1560,59 @@ +@@ -1491,3 +1561,59 @@ typeattribute $1 can_write_shadow_passwords; typeattribute $1 can_relabelto_shadow_passwords; ') @@ -29659,8 +29745,16 @@ ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplug.te serefpolicy-3.3.1/policy/modules/system/hotplug.te --- nsaserefpolicy/policy/modules/system/hotplug.te 2008-06-12 23:38:01.000000000 -0400 -+++ serefpolicy-3.3.1/policy/modules/system/hotplug.te 2008-06-12 23:38:02.000000000 -0400 -@@ -179,6 +179,7 @@ ++++ serefpolicy-3.3.1/policy/modules/system/hotplug.te 2008-06-30 13:17:55.000000000 -0400 +@@ -120,6 +120,7 @@ + optional_policy(` + # for arping used for static IP addresses on PCMCIA ethernet + netutils_domtrans(hotplug_t) ++ netutils_signal(hotplug_t) + fs_rw_tmpfs_chr_files(hotplug_t) + ') + files_getattr_generic_locks(hotplug_t) +@@ -179,6 +180,7 @@ sysnet_read_dhcpc_pid(hotplug_t) sysnet_rw_dhcp_config(hotplug_t) sysnet_domtrans_ifconfig(hotplug_t) Index: selinux-policy.spec =================================================================== RCS file: /cvs/extras/rpms/selinux-policy/F-9/selinux-policy.spec,v retrieving revision 1.688 retrieving revision 1.689 diff -u -r1.688 -r1.689 --- selinux-policy.spec 27 Jun 2008 11:15:46 -0000 1.688 +++ selinux-policy.spec 30 Jun 2008 20:52:17 -0000 1.689 @@ -17,7 +17,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.3.1 -Release: 72%{?dist} +Release: 73%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -57,7 +57,7 @@ %package devel Summary: SELinux policy development Group: System Environment/Base -Requires: checkpolicy >= %{CHECKPOLICYVER} m4 +Requires: checkpolicy >= %{CHECKPOLICYVER} m4 make Requires: selinux-policy = %{version}-%{release} policycoreutils >= %{POLICYCOREUTILSVER} %description devel @@ -385,6 +385,12 @@ %endif %changelog +* Mon Jun 29 2008 Dan Walsh <dwalsh(a)redhat.com> 3.3.1-73 +- Allow exim to use system_cron pipes +- Allow gdm to read rpm database +- Allow nsplugin to read mplayer config files +- Allow login programs to write to /var/run/pam directory (Encrypted directories) + * Wed Jun 23 2008 Dan Walsh <dwalsh(a)redhat.com> 3.3.1-72 - Fix file context of real player

11 years, 9 months

1
0
0 / 0

rpms/policycoreutils/devel policycoreutils-po.patch, 1.34, 1.35 policycoreutils-rhat.patch, 1.369, 1.370 policycoreutils.spec, 1.532, 1.533

by fedora-extras-commits＠redhat.com

Author: dwalsh Update of /cvs/extras/rpms/policycoreutils/devel In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv26105 Modified Files: policycoreutils-po.patch policycoreutils-rhat.patch policycoreutils.spec Log Message: * Mon Jun 30 2008 Dan Walsh <dwalsh(a)redhat.com> 2.0.50-1 - Update to upstream * Fix audit2allow generation of role-type rules from Karl MacMillan. policycoreutils-po.patch: View full diff with command: /usr/bin/cvs -f diff -kk -u -N -r 1.34 -r 1.35 policycoreutils-po.patch Index: policycoreutils-po.patch =================================================================== RCS file: /cvs/extras/rpms/policycoreutils/devel/policycoreutils-po.patch,v retrieving revision 1.34 retrieving revision 1.35 diff -u -r1.34 -r1.35 --- policycoreutils-po.patch 30 Jun 2008 15:52:24 -0000 1.34 +++ policycoreutils-po.patch 30 Jun 2008 20:51:23 -0000 1.35 @@ -1,361 +1,304613 @@ -diff --exclude-from=exclude --exclude=sepolgen-1.0.12 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.50/Makefile ---- nsapolicycoreutils/Makefile 2008-06-12 23:25:24.000000000 -0400 -+++ policycoreutils-2.0.50/Makefile 2008-06-30 11:49:38.000000000 -0400 -@@ -1,4 +1,4 @@ --SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po -+SUBDIRS = setfiles semanage load_policy newrole run_init secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui - - INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null) - -diff --exclude-from=exclude --exclude=sepolgen-1.0.12 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/VERSION policycoreutils-2.0.50/VERSION ---- nsapolicycoreutils/VERSION 2008-06-30 11:12:04.000000000 -0400 -+++ policycoreutils-2.0.50/VERSION 2008-06-30 11:49:38.000000000 -0400 -@@ -1 +1 @@ --2.0.50 -+2.0.49 -diff --exclude-from=exclude --exclude=sepolgen-1.0.12 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.50/restorecond/restorecond.c ---- nsapolicycoreutils/restorecond/restorecond.c 2008-06-12 23:25:21.000000000 -0400 -+++ policycoreutils-2.0.50/restorecond/restorecond.c 2008-06-30 11:49:38.000000000 -0400 -@@ -210,9 +210,10 @@ - } - - if (fsetfilecon(fd, scontext) < 0) { -- syslog(LOG_ERR, -- "set context %s->%s failed:'%s'\n", -- filename, scontext, strerror(errno)); -+ if (errno != EOPNOTSUPP) -+ syslog(LOG_ERR, -+ "set context %s->%s failed:'%s'\n", -+ filename, scontext, strerror(errno)); - if (retcontext >= 0) - free(prev_context); - free(scontext); -@@ -225,8 +226,9 @@ - if (retcontext >= 0) - free(prev_context); - } else { -- syslog(LOG_ERR, "get context on %s failed: '%s'\n", -- filename, strerror(errno)); -+ if (errno != EOPNOTSUPP) -+ syslog(LOG_ERR, "get context on %s failed: '%s'\n", -+ filename, strerror(errno)); - } - free(scontext); - close(fd); -diff --exclude-from=exclude --exclude=sepolgen-1.0.12 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.init policycoreutils-2.0.50/restorecond/restorecond.init ---- nsapolicycoreutils/restorecond/restorecond.init 2008-06-12 23:25:21.000000000 -0400 -+++ policycoreutils-2.0.50/restorecond/restorecond.init 2008-06-30 11:49:38.000000000 -0400 -@@ -2,7 +2,7 @@ - # - # restorecond: Daemon used to maintain path file context - # --# chkconfig: 2345 12 87 -+# chkconfig: - 12 87 - # description: restorecond uses inotify to look for creation of new files \ - # listed in the /etc/selinux/restorecond.conf file, and restores the \ - # correct security context. -diff --exclude-from=exclude --exclude=sepolgen-1.0.12 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/fixfiles policycoreutils-2.0.50/scripts/fixfiles ---- nsapolicycoreutils/scripts/fixfiles 2008-06-12 23:25:21.000000000 -0400 -+++ policycoreutils-2.0.50/scripts/fixfiles 2008-06-30 11:49:38.000000000 -0400 -@@ -138,6 +138,9 @@ - fi - LogReadOnly - ${SETFILES} -q ${OUTFILES} ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE -+rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* -+find /tmp -context "*:file_t*" -exec chcon -t tmp_t {} \; -+find /var/tmp -context "*:file_t*" -exec chcon -t tmp_t {} \; - exit $? - } - -@@ -180,6 +183,10 @@ - check) restore -n -v;; - verify) restore -n -o -;; - relabel) relabel;; -+ onboot) -+ touch /.autorelabel -+ echo "System will relabel on next boot" -+ ;; - *) - usage - exit 1 -@@ -189,6 +196,7 @@ - echo $"Usage: $0 [-l logfile ] [-o outputfile ] { check | restore|[-F] relabel } [[dir] ... ] " - echo or - echo $"Usage: $0 -R rpmpackage[,rpmpackage...] -C PREVIOUS_FILECONTEXT [-l logfile ] [-o outputfile ] { check | restore }" -+ echo $"Usage: $0 onboot" - } - - if [ $# = 0 ]; then -diff --exclude-from=exclude --exclude=sepolgen-1.0.12 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/fixfiles.8 policycoreutils-2.0.50/scripts/fixfiles.8 ---- nsapolicycoreutils/scripts/fixfiles.8 2008-06-12 23:25:21.000000000 -0400 -+++ policycoreutils-2.0.50/scripts/fixfiles.8 2008-06-30 11:49:38.000000000 -0400 -@@ -7,6 +7,8 @@ - - .B fixfiles [-F] [-l logfile ] [-o outputfile ] { check | restore|[-f] relabel | verify } [[dir/file] ... ] - -+.B fixfiles onboot -+ - .SH "DESCRIPTION" - This manual page describes the - .BR fixfiles -@@ -20,6 +22,9 @@ - as you expect. By default it will relabel all mounted ext2, ext3, xfs and - jfs file systems as long as they do not have a security context mount - option. You can use the -R flag to use rpmpackages as an alternative. -+.P -+.B fixfiles onboot -+will setup the machine to relabel on the next reboot. - - .SH "OPTIONS" - .TP -diff --exclude-from=exclude --exclude=sepolgen-1.0.12 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/semanage policycoreutils-2.0.50/semanage/semanage ---- nsapolicycoreutils/semanage/semanage 2008-06-12 23:25:21.000000000 -0400 -+++ policycoreutils-2.0.50/semanage/semanage 2008-06-30 11:49:38.000000000 -0400 -@@ -43,49 +43,52 @@ - if __name__ == '__main__': - - def usage(message = ""): -- print _('\ --semanage {boolean|login|user|port|interface|fcontext|translation} -{l|D} [-n] \n\ --semanage login -{a|d|m} [-sr] login_name\n\ --semanage user -{a|d|m} [-LrRP] selinux_name\n\ --semanage port -{a|d|m} [-tr] [ -p proto ] port | port_range\n\ --semanage interface -{a|d|m} [-tr] interface_spec\n\ --semanage fcontext -{a|d|m} [-frst] file_spec\n\ --semanage translation -{a|d|m} [-T] level\n\n\ --semanage boolean -{d|m} boolean\n\n\ --\ --Primary Options:\n\ --\ -- -a, --add Add a OBJECT record NAME\n\ -- -d, --delete Delete a OBJECT record NAME\n\ -- -m, --modify Modify a OBJECT record NAME\n\ -- -l, --list List the OBJECTS\n\n\ -- -C, --locallist List OBJECTS local customizations\n\n\ -- -D, --deleteall Remove all OBJECTS local customizations\n\ --\ -- -h, --help Display this message\n\ -- -n, --noheading Do not print heading when listing OBJECTS\n\ -- -S, --store Select and alternate SELinux store to manage\n\n\ --Object-specific Options (see above):\n\ -- -f, --ftype File Type of OBJECT \n\ -- "" (all files) \n\ -- -- (regular file) \n\ -- -d (directory) \n\ -- -c (character device) \n\ -- -b (block device) \n\ -- -s (socket) \n\ -- -l (symbolic link) \n\ -- -p (named pipe) \n\n\ --\ -- -p, --proto Port protocol (tcp or udp)\n\ -- -P, --prefix Prefix for home directory labeling\n\ -- -L, --level Default SELinux Level (MLS/MCS Systems only)\n\ -- -R, --roles SELinux Roles (ex: "sysadm_r staff_r")\n\ -- -T, --trans SELinux Level Translation (MLS/MCS Systems only)\n\n\ --\ -- -s, --seuser SELinux User Name\n\ -- -t, --type SELinux Type for the object\n\ -- -r, --range MLS/MCS Security Range (MLS/MCS Systems only)\n\ --') -+ print _(""" -+semanage {boolean|login|user|port|interface|fcontext|translation} -{l|D} [-n] -+semanage login -{a|d|m} [-sr] login_name -+semanage user -{a|d|m} [-LrRP] selinux_name -+semanage port -{a|d|m} [-tr] [ -p proto ] port | port_range -+semanage interface -{a|d|m} [-tr] interface_spec -+semanage fcontext -{a|d|m} [-frst] file_spec -+semanage translation -{a|d|m} [-T] level -+semanage boolean -{d|m} boolean -+semanage permissive -{d|a} type -+ -+Primary Options: -+ -+ -a, --add Add a OBJECT record NAME -+ -d, --delete Delete a OBJECT record NAME -+ -m, --modify Modify a OBJECT record NAME -+ -l, --list List the OBJECTS -+ -C, --locallist List OBJECTS local customizations -+ -D, --deleteall Remove all OBJECTS local customizations -+ -+ -h, --help Display this message -+ -n, --noheading Do not print heading when listing OBJECTS -+ -S, --store Select and alternate SELinux store to manage -+ -+Object-specific Options (see above): -+ -+ -f, --ftype File Type of OBJECT -+ "" (all files) -+ -- (regular file) -+ -d (directory) -+ -c (character device) [...304583 lines suppressed...] ++#: ../gui/system-config-selinux.glade:2414 ++#: ../gui/system-config-selinux.glade:2600 ++#: ../gui/system-config-selinux.glade:2842 ++#: ../gui/system-config-selinux.glade:3066 ++msgid "Filter" + msgstr "" + +-#: ../semanage/seobject.py:1054 +-#, python-format +-msgid "Could not set role in file context for %s" ++#: ../gui/system-config-selinux.glade:1926 ++msgid "label50" + msgstr "" + +-#: ../semanage/seobject.py:1058 +-#, python-format +-msgid "Could not set type in file context for %s" ++#: ../gui/system-config-selinux.glade:1963 ++msgid "Add File Context" + msgstr "" + +-#: ../semanage/seobject.py:1063 +-#, python-format +-msgid "Could not set mls fields in file context for %s" ++#: ../gui/system-config-selinux.glade:1979 ++msgid "Modify File Context" + msgstr "" + +-#: ../semanage/seobject.py:1069 +-#, python-format +-msgid "Could not set file context for %s" ++#: ../gui/system-config-selinux.glade:1995 ++msgid "Delete File Context" + msgstr "" + +-#: ../semanage/seobject.py:1077 ../semanage/seobject.py:1081 +-#, python-format +-msgid "Could not add file context for %s" ++#: ../gui/system-config-selinux.glade:2011 ++msgid "Toggle between all and customized file context" + msgstr "" + +-#: ../semanage/seobject.py:1089 +-msgid "Requires setype, serange or seuser" ++#: ../gui/system-config-selinux.glade:2130 ++msgid "label38" + msgstr "" + +-#: ../semanage/seobject.py:1099 ../semanage/seobject.py:1144 +-#, python-format +-msgid "File context for %s is not defined" ++#: ../gui/system-config-selinux.glade:2167 ++msgid "Add SELinux User Mapping" + msgstr "" + +-#: ../semanage/seobject.py:1103 +-#, python-format +-msgid "Could not query file context for %s" ++#: ../gui/system-config-selinux.glade:2183 ++msgid "Modify SELinux User Mapping" + msgstr "" + +-#: ../semanage/seobject.py:1120 ../semanage/seobject.py:1124 +-#, python-format +-msgid "Could not modify file context for %s" ++#: ../gui/system-config-selinux.glade:2199 ++msgid "Delete SELinux User Mapping" + msgstr "" + +-#: ../semanage/seobject.py:1142 +-#, python-format +-msgid "File context for %s is defined in policy, cannot be deleted" ++#: ../gui/system-config-selinux.glade:2316 ++msgid "label39" + msgstr "" + +-#: ../semanage/seobject.py:1152 ../semanage/seobject.py:1156 +-#, python-format +-msgid "Could not delete file context for %s" ++#: ../gui/system-config-selinux.glade:2353 ++msgid "Add Translation" + msgstr "" + +-#: ../semanage/seobject.py:1164 +-msgid "Could not list file contexts" ++#: ../gui/system-config-selinux.glade:2369 ++msgid "Modify Translation" + msgstr "" + +-#: ../semanage/seobject.py:1168 +-msgid "Could not list local file contexts" ++#: ../gui/system-config-selinux.glade:2385 ++msgid "Delete Translation" + msgstr "" + +-#: ../semanage/seobject.py:1203 +-msgid "Requires value" ++#: ../gui/system-config-selinux.glade:2502 ++msgid "label41" + msgstr "" + +-#: ../semanage/seobject.py:1211 ../semanage/seobject.py:1245 +-#: ../semanage/seobject.py:1251 +-#, python-format +-msgid "Could not check if boolean %s is defined" ++#: ../gui/system-config-selinux.glade:2555 ++msgid "Modify SELinux User" + msgstr "" + +-#: ../semanage/seobject.py:1213 ../semanage/seobject.py:1247 +-#, python-format +-msgid "Boolean %s is not defined" ++#: ../gui/system-config-selinux.glade:2688 ++msgid "label40" + msgstr "" + +-#: ../semanage/seobject.py:1217 +-#, python-format +-msgid "Could not query file context %s" ++#: ../gui/system-config-selinux.glade:2725 ++msgid "Add Network Port" + msgstr "" + +-#: ../semanage/seobject.py:1229 ../semanage/seobject.py:1233 +-#, python-format +-msgid "Could not modify boolean %s" ++#: ../gui/system-config-selinux.glade:2741 ++msgid "Edit Network Port" + msgstr "" + +-#: ../semanage/seobject.py:1253 +-#, python-format +-msgid "Boolean %s is defined in policy, cannot be deleted" ++#: ../gui/system-config-selinux.glade:2757 ++msgid "Delete Network Port" + msgstr "" + +-#: ../semanage/seobject.py:1261 ../semanage/seobject.py:1265 +-#, python-format +-msgid "Could not delete boolean %s" ++#: ../gui/system-config-selinux.glade:2793 ++#: ../gui/system-config-selinux.glade:2811 ++msgid "Toggle between Customized and All Ports" + msgstr "" + +-#: ../semanage/seobject.py:1273 +-msgid "Could not list booleans" ++#: ../gui/system-config-selinux.glade:2930 ++msgid "label42" + msgstr "" + +-#: ../audit2allow/audit2allow:183 +-#, c-format +-msgid "Generating type enforcment file: %s.te" ++#: ../gui/system-config-selinux.glade:2967 ++msgid "Generate new policy module" + msgstr "" + +-#: ../audit2allow/audit2allow:189 ../audit2allow/audit2allow:194 +-msgid "Compiling policy" ++#: ../gui/system-config-selinux.glade:2983 ++msgid "Load policy module" + msgstr "" + +-#: ../audit2allow/audit2allow:205 +-msgid "" +-"\n" +-"******************** IMPORTANT ***********************\n" ++#: ../gui/system-config-selinux.glade:2999 ++msgid "Remove loadable policy module" + msgstr "" + +-#: ../audit2allow/audit2allow:206 +-#, c-format ++#: ../gui/system-config-selinux.glade:3035 + msgid "" +-"In order to load this newly created policy package into the kernel,\n" +-"you are required to execute \n" +-"\n" +-"semodule -i %s.pp\n" +-"\n" ++"Enable/Disable additional audit rules, that are normally not reported in the " ++"log files." + msgstr "" + +-#: ../audit2allow/audit2allow:211 +-#, c-format +-msgid "Options Error: %s " ++#: ../gui/system-config-selinux.glade:3154 ++msgid "label44" ++msgstr "" ++ ++#: ../gui/translationsPage.py:53 ++msgid "Sensitvity Level" ++msgstr "" ++ ++#: ../gui/usersPage.py:138 ++#, python-format ++msgid "SELinux user '%s' is required" + msgstr "" policycoreutils-rhat.patch: Index: policycoreutils-rhat.patch =================================================================== RCS file: /cvs/extras/rpms/policycoreutils/devel/policycoreutils-rhat.patch,v retrieving revision 1.369 retrieving revision 1.370 diff -u -r1.369 -r1.370 --- policycoreutils-rhat.patch 30 Jun 2008 15:52:24 -0000 1.369 +++ policycoreutils-rhat.patch 30 Jun 2008 20:51:23 -0000 1.370 @@ -7,12 +7,6 @@ INOTIFYH = $(shell ls /usr/include/sys/inotify.h 2>/dev/null) -diff --exclude-from=exclude --exclude=sepolgen-1.0.11 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/VERSION policycoreutils-2.0.49/VERSION ---- nsapolicycoreutils/VERSION 2008-06-30 11:12:04.000000000 -0400 -+++ policycoreutils-2.0.49/VERSION 2008-05-16 10:55:40.000000000 -0400 -@@ -1 +1 @@ --2.0.50 -+2.0.49 diff --exclude-from=exclude --exclude=sepolgen-1.0.11 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.49/restorecond/restorecond.c --- nsapolicycoreutils/restorecond/restorecond.c 2008-06-12 23:25:21.000000000 -0400 +++ policycoreutils-2.0.49/restorecond/restorecond.c 2008-06-27 07:21:06.000000000 -0400 Index: policycoreutils.spec =================================================================== RCS file: /cvs/extras/rpms/policycoreutils/devel/policycoreutils.spec,v retrieving revision 1.532 retrieving revision 1.533 diff -u -r1.532 -r1.533 --- policycoreutils.spec 30 Jun 2008 15:52:24 -0000 1.532 +++ policycoreutils.spec 30 Jun 2008 20:51:23 -0000 1.533 @@ -6,7 +6,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 2.0.50 -Release: 11%{?dist} +Release: 1%{?dist} License: GPLv2+ Group: System Environment/Base Source: http://www.nsa.gov/selinux/archives/policycoreutils-%{version}.tgz @@ -112,6 +112,7 @@ Requires: gnome-python2, pygtk2, pygtk2-libglade, gnome-python2-canvas Requires: usermode Requires: setools-console +Requires: selinux-policy-devel Requires: python >= 2.4 BuildRequires: desktop-file-utils

11 years, 9 months

1
0
0 / 0

rpms/clive/F-8 .cvsignore, 1.2, 1.3 clive.spec, 1.1, 1.2 sources, 1.2, 1.3

by fedora-extras-commits＠redhat.com

Author: eponyme Update of /cvs/pkgs/rpms/clive/F-8 In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv26021 Modified Files: .cvsignore clive.spec sources Log Message: Update to 0.4.17 Index: .cvsignore =================================================================== RCS file: /cvs/pkgs/rpms/clive/F-8/.cvsignore,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- .cvsignore 30 Jun 2008 18:08:11 -0000 1.2 +++ .cvsignore 30 Jun 2008 20:49:43 -0000 1.3 @@ -1 +1 @@ -clive-0.4.16.tar.bz2 +clive-0.4.17.tar.bz2 Index: clive.spec =================================================================== RCS file: /cvs/pkgs/rpms/clive/F-8/clive.spec,v retrieving revision 1.1 retrieving revision 1.2 diff -u -r1.1 -r1.2 --- clive.spec 30 Jun 2008 18:08:11 -0000 1.1 +++ clive.spec 30 Jun 2008 20:49:43 -0000 1.2 @@ -1,9 +1,9 @@ %{!?python_sitelib: %define python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")} %define major_version 0.4 -%define minor_version 16 +%define minor_version 17 Name: clive Version: %{major_version}.%{minor_version} -Release: 3%{?dist} +Release: 1%{?dist} Summary: Video extraction tool for user-uploaded video hosts Group: Applications/Multimedia @@ -36,6 +36,7 @@ %install rm -rf $RPM_BUILD_ROOT +# used to have lib64 on x86_64 instead of lib sed -i -e s@"\${exec_prefix}/lib/python2.5/site-packages"@$RPM_BUILD_ROOT/%{python_sitelib}@ Makefile sed -i -e s@"\${prefix}/lib/python2.5/site-packages"@$RPM_BUILD_ROOT/%{python_sitelib}@ Makefile make install DESTDIR=$RPM_BUILD_ROOT @@ -57,6 +58,8 @@ %changelog +* Sun Jun 29 2008 Nicoleau Fabien <nicoleau.fabien(a)gmail.com> 0.4.17-1 +- rebuild for 0.4.17 * Fri Jun 27 2008 Nicoleau Fabien <nicoleau.fabien(a)gmail.com> 0.4.16-3 - non-macro usage for commands * Wed Jun 25 2008 Nicoleau Fabien <nicoleau.fabien(a)gmail.com> 0.4.16-2 Index: sources =================================================================== RCS file: /cvs/pkgs/rpms/clive/F-8/sources,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- sources 30 Jun 2008 18:08:11 -0000 1.2 +++ sources 30 Jun 2008 20:49:43 -0000 1.3 @@ -1 +1 @@ -89413f736339d5ca1876250a61feef44 clive-0.4.16.tar.bz2 +b8738baf23abd9381d33f1e6a950b985 clive-0.4.17.tar.bz2

11 years, 9 months

1
0
0 / 0

rpms/mysql-proxy/devel mysql-proxy.spec,1.6,1.7

by fedora-extras-commits＠redhat.com

Author: ruben Update of /cvs/pkgs/rpms/mysql-proxy/devel In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv25340 Modified Files: mysql-proxy.spec Log Message: * Mon Jun 30 2008 Ruben Kerkhof <ruben(a)rubenkerkhof.com> - 0.6.1-2 - Rebuild to pick up new libevent Index: mysql-proxy.spec =================================================================== RCS file: /cvs/pkgs/rpms/mysql-proxy/devel/mysql-proxy.spec,v retrieving revision 1.6 retrieving revision 1.7 diff -u -r1.6 -r1.7 --- mysql-proxy.spec 9 Feb 2008 13:14:14 -0000 1.6 +++ mysql-proxy.spec 30 Jun 2008 20:35:40 -0000 1.7 @@ -1,6 +1,6 @@ Name: mysql-proxy Version: 0.6.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A proxy for the MySQL Client/Server protocol Group: Applications/Databases @@ -54,6 +54,9 @@ %changelog +* Mon Jun 30 2008 Ruben Kerkhof <ruben(a)rubenkerkhof.com> - 0.6.1-2 +- Rebuild to pick up new libevent + * Sat Feb 09 2008 Ruben Kerkhof <ruben(a)rubenkerkhof.com> - 0.6.1-1 - Sync with upstream

11 years, 9 months

1
0
0 / 0

rpms/libibumad/devel libibumad.spec, NONE, 1.1 .cvsignore, 1.1, 1.2 sources, 1.1, 1.2

by fedora-extras-commits＠redhat.com

Author: dledford Update of /cvs/extras/rpms/libibumad/devel In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv24962 Modified Files: .cvsignore sources Added Files: libibumad.spec Log Message: * Sun Jun 08 2008 Doug Ledford <dledford(a)redhat.com> - 1.2.0-1 - Initial package for Fedora review process --- NEW FILE libibumad.spec --- Summary: OpenFabrics Alliance InfiniBand umad (user MAD) library Name: libibumad Version: 1.2.0 Release: 1%{?dist} License: GPLv2 or BSD Group: System Environment/Libraries BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Source: http://www.openfabrics.org/downloads/management/%{name}-%{version}.tar.gz Url: http://openfabrics.org Requires(post): /sbin/ldconfig Requires(postun): /sbin/ldconfig BuildRequires: libibcommon-devel >= 1.1.0, libtool %description libibumad provides the user MAD library functions which sit on top of the user MAD modules in the kernel. These are used by the IB diagnostic and management tools, including OpenSM. %package devel Summary: Development files for the libibumad library Group: System Environment/Libraries Requires: %{name} = %{version}-%{release}, libibcommon-devel %description devel Development files for the libibumad library. %package static Summary: Static version of the libibumad library Group: System Environment/Libraries Requires: %{name}-devel = %{version}-%{release} %description static Static version of the libibumad library. %prep %setup -q %build %configure make %{?_smp_mflags} %install rm -rf $RPM_BUILD_ROOT make DESTDIR=${RPM_BUILD_ROOT} install # remove unpackaged files from the buildroot rm -f $RPM_BUILD_ROOT%{_libdir}/*.la %clean rm -rf $RPM_BUILD_ROOT %post -p /sbin/ldconfig %postun -p /sbin/ldconfig %files %defattr(-,root,root) %{_libdir}/libibumad*.so.* %{_mandir}/man3/* %doc AUTHORS COPYING ChangeLog %files devel %defattr(-,root,root) %{_libdir}/libibumad.so %{_includedir}/infiniband/*.h %files static %defattr(-,root,root) %{_libdir}/libibumad.a %changelog * Sun Jun 08 2008 Doug Ledford <dledford(a)redhat.com> - 1.2.0-1 - Initial package for Fedora review process Index: .cvsignore =================================================================== RCS file: /cvs/extras/rpms/libibumad/devel/.cvsignore,v retrieving revision 1.1 retrieving revision 1.2 diff -u -r1.1 -r1.2 --- .cvsignore 30 Jun 2008 16:18:15 -0000 1.1 +++ .cvsignore 30 Jun 2008 20:31:47 -0000 1.2 @@ -0,0 +1 @@ +libibumad-1.2.0.tar.gz Index: sources =================================================================== RCS file: /cvs/extras/rpms/libibumad/devel/sources,v retrieving revision 1.1 retrieving revision 1.2 diff -u -r1.1 -r1.2 --- sources 30 Jun 2008 16:18:15 -0000 1.1 +++ sources 30 Jun 2008 20:31:47 -0000 1.2 @@ -0,0 +1 @@ +abce72fbb91530a97493eba7a28a0de6 libibumad-1.2.0.tar.gz

11 years, 9 months

1
0
0 / 0

rpms/libibumad/F-9 libibumad.spec, NONE, 1.1 .cvsignore, 1.1, 1.2 sources, 1.1, 1.2

by fedora-extras-commits＠redhat.com

Author: dledford Update of /cvs/extras/rpms/libibumad/F-9 In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv24808 Modified Files: .cvsignore sources Added Files: libibumad.spec Log Message: * Sun Jun 08 2008 Doug Ledford <dledford(a)redhat.com> - 1.2.0-1 - Initial package for Fedora review process --- NEW FILE libibumad.spec --- Summary: OpenFabrics Alliance InfiniBand umad (user MAD) library Name: libibumad Version: 1.2.0 Release: 1%{?dist} License: GPLv2 or BSD Group: System Environment/Libraries BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Source: http://www.openfabrics.org/downloads/management/%{name}-%{version}.tar.gz Url: http://openfabrics.org Requires(post): /sbin/ldconfig Requires(postun): /sbin/ldconfig BuildRequires: libibcommon-devel >= 1.1.0, libtool %description libibumad provides the user MAD library functions which sit on top of the user MAD modules in the kernel. These are used by the IB diagnostic and management tools, including OpenSM. %package devel Summary: Development files for the libibumad library Group: System Environment/Libraries Requires: %{name} = %{version}-%{release}, libibcommon-devel %description devel Development files for the libibumad library. %package static Summary: Static version of the libibumad library Group: System Environment/Libraries Requires: %{name}-devel = %{version}-%{release} %description static Static version of the libibumad library. %prep %setup -q %build %configure make %{?_smp_mflags} %install rm -rf $RPM_BUILD_ROOT make DESTDIR=${RPM_BUILD_ROOT} install # remove unpackaged files from the buildroot rm -f $RPM_BUILD_ROOT%{_libdir}/*.la %clean rm -rf $RPM_BUILD_ROOT %post -p /sbin/ldconfig %postun -p /sbin/ldconfig %files %defattr(-,root,root) %{_libdir}/libibumad*.so.* %{_mandir}/man3/* %doc AUTHORS COPYING ChangeLog %files devel %defattr(-,root,root) %{_libdir}/libibumad.so %{_includedir}/infiniband/*.h %files static %defattr(-,root,root) %{_libdir}/libibumad.a %changelog * Sun Jun 08 2008 Doug Ledford <dledford(a)redhat.com> - 1.2.0-1 - Initial package for Fedora review process Index: .cvsignore =================================================================== RCS file: /cvs/extras/rpms/libibumad/F-9/.cvsignore,v retrieving revision 1.1 retrieving revision 1.2 diff -u -r1.1 -r1.2 --- .cvsignore 30 Jun 2008 16:18:15 -0000 1.1 +++ .cvsignore 30 Jun 2008 20:30:17 -0000 1.2 @@ -0,0 +1 @@ +libibumad-1.2.0.tar.gz Index: sources =================================================================== RCS file: /cvs/extras/rpms/libibumad/F-9/sources,v retrieving revision 1.1 retrieving revision 1.2 diff -u -r1.1 -r1.2 --- sources 30 Jun 2008 16:18:15 -0000 1.1 +++ sources 30 Jun 2008 20:30:17 -0000 1.2 @@ -0,0 +1 @@ +abce72fbb91530a97493eba7a28a0de6 libibumad-1.2.0.tar.gz

11 years, 9 months

1
0
0 / 0

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

scm-commits June 2008