From 770c015f886fec99910485d584d5df64aa3e2bb5 Mon Sep 17 00:00:00 2001
From: Chris PeBenito <cpebenito@tresys.com>
Date: Thu, 14 Aug 2008 15:10:41 +0000
Subject: [PATCH] trunk: 2 patches from dan.

---
 policy/modules/kernel/filesystem.if   | 18 ++++++++++++++++++
 policy/modules/kernel/filesystem.te   |  2 +-
 policy/modules/services/postgresql.fc |  1 +
 policy/modules/services/postgresql.te |  3 ++-
 policy/modules/system/iptables.if     |  6 ++++++
 policy/modules/system/iptables.te     |  2 +-
 6 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
index 9a0442663..e8a526c08 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -1285,6 +1285,24 @@ interface(`fs_unmount_fusefs',`
         allow $1 fusefs_t:filesystem unmount;
 ')
 
+########################################
+## <summary>
+##	Read and write hugetlbfs files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_rw_hugetlbfs_files',`
+	gen_require(`
+		type hugetlbfs_t;
+	')
+
+	rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t)
+')
+
 ########################################
 ## <summary>
 ##	Search inotifyfs filesystem. 
diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
index 784616bef..c66b5f0f3 100644
--- a/policy/modules/kernel/filesystem.te
+++ b/policy/modules/kernel/filesystem.te
@@ -1,5 +1,5 @@
 
-policy_module(filesystem, 1.10.0)
+policy_module(filesystem, 1.10.1)
 
 ########################################
 #
diff --git a/policy/modules/services/postgresql.fc b/policy/modules/services/postgresql.fc
index ea8c80fca..ac18bee96 100644
--- a/policy/modules/services/postgresql.fc
+++ b/policy/modules/services/postgresql.fc
@@ -28,6 +28,7 @@ ifdef(`distro_redhat', `
 /var/lib/postgres(ql)?(/.*)? 		gen_context(system_u:object_r:postgresql_db_t,s0)
 
 /var/lib/pgsql/data(/.*)?		gen_context(system_u:object_r:postgresql_db_t,s0)
+/var/lib/pgsql/logfile(/.*)?		gen_context(system_u:object_r:postgresql_log_t,s0)
 /var/lib/pgsql/pgstartup\.log		gen_context(system_u:object_r:postgresql_log_t,s0)
 
 /var/lib/sepgsql(/.*)?			gen_context(system_u:object_r:postgresql_db_t,s0)
diff --git a/policy/modules/services/postgresql.te b/policy/modules/services/postgresql.te
index 3f7578b86..9c8db22d9 100644
--- a/policy/modules/services/postgresql.te
+++ b/policy/modules/services/postgresql.te
@@ -1,5 +1,5 @@
 
-policy_module(postgresql, 1.6.0)
+policy_module(postgresql, 1.6.1)
 
 gen_require(`
 	class db_database all_db_database_perms;
@@ -186,6 +186,7 @@ dev_read_urand(postgresql_t)
 
 fs_getattr_all_fs(postgresql_t)
 fs_search_auto_mountpoints(postgresql_t)
+fs_rw_hugetlbfs_files(postgresql_t)
 
 selinux_get_enforce_mode(postgresql_t)
 selinux_validate_context(postgresql_t)
diff --git a/policy/modules/system/iptables.if b/policy/modules/system/iptables.if
index 405449168..f05ae34ee 100644
--- a/policy/modules/system/iptables.if
+++ b/policy/modules/system/iptables.if
@@ -49,6 +49,12 @@ interface(`iptables_run',`
 	iptables_domtrans($1)
 	role $2 types iptables_t;
 	allow iptables_t $3:chr_file rw_term_perms;
+
+	sysnet_run_ifconfig(iptables_t, $2, $3)
+
+	optional_policy(`
+		modutils_run_insmod(iptables_t, $2, $3)
+	')
 ')
 
 ########################################
diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te
index 87aea7d91..5ce2bec2b 100644
--- a/policy/modules/system/iptables.te
+++ b/policy/modules/system/iptables.te
@@ -1,5 +1,5 @@
 
-policy_module(iptables, 1.6.1)
+policy_module(iptables, 1.6.2)
 
 ########################################
 #