8241b538af
trunk: udev update and brctl module from dan.
2007-09-05 17:55:57 +00:00
0a0b8078ca
trunk: 5 patches from dan.
2007-09-04 18:57:58 +00:00
4922765ec6
trunk: fix certwatch_run() interface, which had a typo in the name.
2007-08-30 15:01:48 +00:00
752ddf588f
trunk: add missing commas in can_exec in daemontools that worked by luck.
2007-08-24 15:55:06 +00:00
2af7b42a06
trunk: switch daemons from inheriting from all levels to initrc_t sharing to all levels.
2007-08-22 20:21:52 +00:00
8d2c34195e
trunk: updates from dan on 9 modules
2007-08-22 20:02:41 +00:00
f8233ab7b0
trunk: Deprecate mls_file_write_down() and mls_file_read_up(), replaced with mls_write_all_levels() and mls_read_all_levels(), for consistency.
2007-08-20 18:26:08 +00:00
2d0c9cecaf
trunk: several MLS enhancements.
2007-08-20 15:15:03 +00:00
d46cfe45cd
trunk: add application module
2007-07-19 18:57:48 +00:00
6929521e0a
trunk: fix missed netlabel deprecation
2007-07-19 15:11:19 +00:00
116c1da330
trunk: update module version numbers for release.
2007-06-29 14:48:13 +00:00
113b4fc4a2
Fix incorrectly named files_lib_filetrans_shared_lib() interface in the libraries module.
2007-06-28 17:25:46 +00:00
1900668638
trunk: Unified labeled networking policy from Paul Moore.
...
The latest revision of the labeled policy patches which enable both labeled
and unlabeled policy support for NetLabel. This revision takes into account
Chris' feedback from the first version and reduces the number of interface
calls in each domain down to two at present: one for unlabeled access, one for
NetLabel access. The older, transport layer specific interfaces, are still
present for use by third-party modules but are not used in the default policy
modules.
trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore.
This patch changes the policy to use the netmsg initial SID as the "base"
SID/context for NetLabel packets which only have MLS security attributes.
Currently we use the unlabeled initial SID which makes it very difficult to
distinquish between actual unlabeled packets and those packets which have MLS
security attributes.
2007-06-27 15:23:21 +00:00
7f089782ae
trunk: xen updates from dan
2007-06-21 13:36:05 +00:00
92d1ade254
trunk: trivial gentoo tweaks
2007-06-20 20:08:26 +00:00
cb10a2d5bf
trunk: Tunable connection to postgresql for users from KaiGai Kohei.
2007-06-19 14:30:06 +00:00
d5b81a81ff
trunk: Add logging_send_audit_msgs() interface and deprecate send_audit_msgs_pattern().
2007-06-12 18:46:14 +00:00
6649aec9d0
trunk: 3 patches from dan
2007-06-11 15:43:37 +00:00
d534d35a7e
trunk: 5 patches from dan
2007-06-11 15:01:10 +00:00
7782966db1
add fc entry for make_reiser4
2007-06-08 20:01:34 +00:00
38d0cf1b8a
trunk: long overdue cleanup from when range_transitions were only in the base module
2007-05-14 15:35:47 +00:00
762d2cb989
merge restorecon into setfiles
2007-05-11 17:10:43 +00:00
0ef5d66468
textrel lib update from dan
2007-05-03 13:43:44 +00:00
882186c933
- Patch to allow insmod to mount kvmfs and dontaudit rw unconfined_t pipes
...
to handle usage from userhelper.
2007-05-02 17:31:38 +00:00
d28e528b0d
Fixes for RHEL4 from the CLIP project.
2007-04-27 15:08:15 +00:00
b4dfdc7d30
Move program admin template usage out of userdom_admin_user_template() to sysadm policy in userdomain.te to fix usage of the template for third parties.
2007-04-19 14:30:57 +00:00
0251df3e39
bump module versions for release
2007-04-17 13:28:09 +00:00
697489040e
5 patches from dan. confine insmod and udev on targeted, misc fc fixes, sasl kerberos use, and samba port fixes
2007-04-11 17:56:03 +00:00
82e284bb89
last piece of dan's previous patch
2007-04-11 13:31:10 +00:00
19b2dee3cc
confine ldconfig in targeted, from dan
2007-04-10 19:39:22 +00:00
98faba122c
gentoo /lib can be a symlink on x86-64 systems
2007-04-02 13:33:18 +00:00
a26923c32e
Two patches from Paul Moore to for ipsec to remove redundant rules and have setkey read the config file.
2007-03-28 18:47:45 +00:00
9e8f65c83e
six trivial patches from dan for iptables, netutils, ipsec, devices, filesystem and cpuspeed
2007-03-26 20:47:29 +00:00
56e1b3d207
- Move booleans and tunables to modules when it is only used in a single
...
module.
- Add support for tunables and booleans local to a module.
2007-03-26 18:41:45 +00:00
8021cb4f63
Merge sbin_t and ls_exec_t into bin_t.
2007-03-23 23:24:59 +00:00
ab514d6a89
remove disable_trans booleans
2007-03-23 21:01:49 +00:00
5f5b7a1ec6
network fix from dan
2007-03-22 14:33:00 +00:00
cc9130b90a
one-liner from dan
2007-03-22 14:01:55 +00:00
a5f5eba459
Add dontaudits for init fds and console to init_daemon_domain().
2007-03-20 18:47:18 +00:00
c224d91c7b
from Dan:
...
This is a new policy for the User Switching capability coming in gnome.
consolekit is a daemon that communicates with xdm_t and hal through dbus to change the
ownership/access on certain devices when the login session changes from one user to another
2007-03-19 18:01:15 +00:00
c5561c777d
patches for lvm and ricci fixes from Dan Walsh.
2007-03-06 15:35:02 +00:00
ecc98e19e3
patches for file contexts in networkmanager, miscfiles, corecommands, devices, and java from Dan Walsh.
2007-03-01 15:43:39 +00:00
ca448bd66c
add init_exec() to init_telinit().
2007-02-26 20:19:53 +00:00
5c45eaede1
On Tue, 2007-02-20 at 12:28 -0500, Daniel J Walsh wrote:
...
> audit needs fsetid
>
> syslog needs to be able to create a tcp_socket for off machine logging.
2007-02-23 20:19:29 +00:00
6b19be3360
patch from dan, Thu, 2007-01-25 at 08:12 -0500
2007-02-16 23:01:42 +00:00
42c5c5f612
bump versions for release.
2006-12-12 21:22:47 +00:00
c0868a7a3b
merge policy patterns to trunk
2006-12-12 20:08:08 +00:00
d6d16b9796
patch from dan Wed, 29 Nov 2006 17:06:40 -0500
2006-12-04 20:10:56 +00:00
563e58e863
patch from dan for some missing gen_require()s
2006-11-29 13:44:40 +00:00
c6a60bb28d
On Tue, 2006-11-07 at 16:51 -0500, James Antill wrote:
...
> Here is the policy changes needed for the context contains security
> checking in PAM and cron.
2006-11-14 13:38:52 +00:00
ed38ca9f3d
fixes from gentoo strict testing:
...
- Allow semanage to read from /root on strict non-MLS for
local policy modules.
- Gentoo init script fixes for udev.
- Allow udev to read kernel modules.inputmap.
- Dnsmasq fixes from testing.
- Allow kernel NFS server to getattr filesystems so df can work
on clients.
2006-11-13 03:24:07 +00:00
0f9a2be65d
add missing gentoo file contexts for initrc and lvm
2006-11-07 19:38:10 +00:00
d9845ae92a
patch from dan Tue, 24 Oct 2006 11:00:28 -0400
2006-10-31 21:01:48 +00:00
582438054d
fix up corecommands perm sets, add seutil_manage_config_dirs()
2006-10-27 13:55:35 +00:00
d5ae683e2b
add seutil_rw_config()
2006-10-25 20:48:04 +00:00
a8671ae5b2
enhanced setransd support from darrel goeddel
2006-10-20 14:44:23 +00:00
a52b4d4f23
bump versions to release numbers
2006-10-18 19:25:27 +00:00
b04eccd87b
fix duplicate /usr/bin/mplayer fc match for targeted
2006-10-18 17:31:14 +00:00
130f8a4aa5
merge netlabel stuff from labeled-networking branch
2006-10-17 16:58:17 +00:00
aeaae5185e
fix ticket #16
2006-10-16 16:51:57 +00:00
e45324d1ee
gentoo integrated run_init rules in wrong build option.
2006-10-15 00:23:06 +00:00
009b377174
more realplayer entries
2006-10-14 23:31:33 +00:00
14b1684aae
gentoo testing fixes.
2006-10-13 21:44:02 +00:00
93ddc66983
change transition from run_init to initrc to spec.
2006-10-09 18:52:19 +00:00
546c81ce25
more non .so lib files for acrobat
2006-10-05 20:39:25 +00:00
3c3c0439f6
patch from russell, Thu, 5 Oct 2006 22:44:49 +1000
...
Allow unconfined processes to see unlabeled processes in ps.
Removed a redundant rule in samba.te
Removed support for the pre-Fedora Red Hat code to create sym-links in /boot.
Removed support for devpts_t files in /tmp (there is no way that would ever
work).
Allowed postgrey to create socket files.
Made the specs for the /lib and /lib64 directories better support stem
compression.
2006-10-05 19:57:37 +00:00
e070dd2df0
- Move range transitions to modules.
...
- Make number of MLS sensitivities, and number of MLS and MCS
categories configurable as build options.
2006-10-04 17:25:34 +00:00
00219064d7
This patch adds a GConf policy to refpolicy.
...
This policy is much tighter than the GConf policy from the old example
policy. It only allows gconfd to access configuration data stored by
GConf. Users can modify configuration data using gconftool-2 or
gconf-editor, both of which use gconfd. GConf manages multiple
configuration sources, so gconfd should be used to make any changes
anyway. Normal users who aren't trying to directly edit the
configuration data of GConf won't notice anything different.
There is also a difference between this policy and the old example
policy in handling directories in /tmp. The old example policy
labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no
use of the file_type_auto_trans macro, if that directory was deleted
gconfd would create one labeled as tmp_t. This policy uses the
files_tmp-filetrans macro to cause a directory in /tmp created by gconfd
to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t,
because if /tmp/orbit-USER is deleted, gconfd will create it (through
use of ORBit) and it would get the $1_gconf_tmp_t label. By having
gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and
directories in directories labeled with $1_tmp_t, it can control its
data without requiring any future bonobo or Gnome policies to have
access to $1_gconf_tmp_t.
This patch is related to work that I am doing in making gconfd an
userspace object manager. If any user program can modify the
configuration data that GConf stores, than making gconfd an userspace
object manager would be useless.
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
e2b84ef79a
patch from dan Mon, 25 Sep 2006 15:46:40 -0400
2006-09-28 14:37:29 +00:00
693d4aedb5
patch from dan Fri, 22 Sep 2006 16:30:34 -0400
2006-09-25 18:53:06 +00:00
8708d9bef2
patch from dan Wed, 20 Sep 2006 12:12:49 -0400
2006-09-22 17:14:35 +00:00
a9e03b3752
* add a macro for generating category declarations
...
* fix userdom_search_all_users_home_content() to use search_dir_perms;
* change ssh daemon macro to use userdom_search_all_users_home_dirs() instead of _home_content()
2006-09-21 15:48:15 +00:00
bf469d7669
gentoo testing fixes
2006-09-19 17:02:29 +00:00
2b571d6880
common users list inotifyfs
2006-09-14 18:19:04 +00:00
2cac32a605
fix miscfiles_read_localization()
2006-09-13 18:08:17 +00:00
0d96ff339e
misc fixes
2006-09-13 14:23:04 +00:00
b1bf2f7811
add last bit of role infrastructure
2006-09-11 15:26:25 +00:00
bbcd3c97dd
add main part of role-o-matic
2006-09-06 22:07:25 +00:00
75beb95014
patch from dan Tue, 05 Sep 2006 17:06:06 -0400
2006-09-06 16:36:23 +00:00
91dabf4d78
fix up usb.ids per distro
2006-09-05 14:31:27 +00:00
13d7cec671
patch from erich Sat, 02 Sep 2006 03:37:44 +0200
2006-09-04 18:22:12 +00:00
5dbda5558a
patch from dan Fri, 01 Sep 2006 15:45:24 -0400
2006-09-04 15:15:35 +00:00
eac818f040
patch from dan Thu, 31 Aug 2006 15:16:30 -0400
2006-09-01 15:52:05 +00:00
a5e2133bc8
patch from dan Wed, 23 Aug 2006 14:03:49 -0400
2006-08-29 02:41:00 +00:00
ce6bf7cc23
more testing fixes
2006-08-28 02:46:20 +00:00
de222824e9
fix gentoo /opt contexts
2006-08-25 13:26:21 +00:00
98de871cee
more strict testing fixes
2006-08-23 19:36:04 +00:00
d15dd5a739
more testing fixes
2006-08-23 03:47:39 +00:00
5b4ff3a104
fix ordering bug
2006-08-22 19:56:59 +00:00
3ef029db7c
add nscd_socket_use() to auth_use_nsswitch() since it caches nss lookups.
2006-08-22 19:37:56 +00:00
e9b9e45214
testing fixes
2006-08-18 18:20:22 +00:00
4bc6e32e28
fix for netfilter_contexts
2006-08-18 14:01:48 +00:00
ba1a545fb3
cleanup in authlogin
2006-08-17 15:35:14 +00:00
33c7e6b4e8
remove dead selopt rules
2006-08-15 20:00:58 +00:00
497da0953c
ps/ptrace dontaudit cleanup
2006-08-08 17:49:03 +00:00
85476e94d8
fix up mtrr interfaces. missing the file class on a few interfaces, and read and write cannot be split.
2006-08-01 14:43:10 +00:00
4b3b46d7ef
add authlogin interface to abstract common login program perms
2006-07-31 22:26:59 +00:00
46551033aa
patch from dan Wed, 26 Jul 2006 14:42:46 -0400
2006-07-28 15:13:58 +00:00
ea3c1f508a
add helpers for printing warning and error messages
2006-07-25 17:27:00 +00:00
19ebf01d6a
patch to fix escaping of . in file contexts from james athey
2006-07-24 15:43:57 +00:00
da9bbc655a
fix up audit message perms now that audit_write denials are being audited by the kernel.
2006-07-13 17:22:08 +00:00
17de1b790b
remove extra level of directory
2006-07-12 20:32:27 +00:00
Chris PeBenito