From 9f99cfb771702a0969e4315f53f51a560a75bdce Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Sat, 25 Feb 2017 11:20:19 -0500 Subject: [PATCH] Network daemon patches from Russell Coker. --- policy/modules/contrib | 2 +- policy/modules/kernel/corenetwork.te.in | 6 +++--- policy/modules/system/iptables.te | 4 +++- policy/modules/system/sysnetwork.fc | 2 ++ policy/modules/system/sysnetwork.te | 6 +++++- 5 files changed, 14 insertions(+), 6 deletions(-) diff --git a/policy/modules/contrib b/policy/modules/contrib index 3e57e8567..250ddfdf4 160000 --- a/policy/modules/contrib +++ b/policy/modules/contrib @@ -1 +1 @@ -Subproject commit 3e57e85675dba33e8742475a960409fcac148ca7 +Subproject commit 250ddfdf4ea6d6618299533b2d8b917ff2d56493 diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index 89ac53be9..1ca96d388 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -1,4 +1,4 @@ -policy_module(corenetwork, 1.23.2) +policy_module(corenetwork, 1.23.3) ######################################## # @@ -213,7 +213,7 @@ network_port(pop, tcp,106,s0, tcp,109,s0, tcp,110,s0, tcp,143,s0, tcp,220,s0, tc network_port(portmap, udp,111,s0, tcp,111,s0) network_port(postfix_policyd, tcp,10031,s0) network_port(postgresql, tcp,5432,s0) -network_port(postgrey, tcp,60000,s0) +network_port(postgrey, tcp,10023,s0, tcp,60000,s0) network_port(pptp, tcp,1723,s0, udp,1723,s0) network_port(prelude, tcp,4690,s0, udp,4690,s0) network_port(presence, tcp,5298-5299,s0, udp,5298-5299,s0) @@ -232,7 +232,7 @@ network_port(repository, tcp, 6363, s0) network_port(ricci, tcp,11111,s0, udp,11111,s0) network_port(ricci_modcluster, tcp,16851,s0, udp,16851,s0) network_port(rlogind, tcp,513,s0) -network_port(rndc, tcp,953,s0, udp,953,s0) +network_port(rndc, tcp,953,s0, udp,953,s0, tcp,8953,s0, udp,8953,s0) network_port(router, udp,520,s0, udp,521,s0, tcp,521,s0) network_port(rsh, tcp,514,s0) network_port(rsync, tcp,873,s0, udp,873,s0) diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te index 0380f55bf..e8063b99e 100644 --- a/policy/modules/system/iptables.te +++ b/policy/modules/system/iptables.te @@ -1,4 +1,4 @@ -policy_module(iptables, 1.18.1) +policy_module(iptables, 1.18.2) ######################################## # @@ -153,4 +153,6 @@ optional_policy(` optional_policy(` udev_read_db(iptables_t) + # this is for iptables_t to inherit a file hande from xen vif-bridge + udev_manage_pid_files(iptables_t) ') diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc index 4d6732ec7..95d2f86c2 100644 --- a/policy/modules/system/sysnetwork.fc +++ b/policy/modules/system/sysnetwork.fc @@ -58,6 +58,7 @@ ifdef(`distro_redhat',` /var/lib/dhcp3? -d gen_context(system_u:object_r:dhcp_state_t,s0) /var/lib/dhcp3?/dhclient.* gen_context(system_u:object_r:dhcpc_state_t,s0) /var/lib/dhcpcd(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0) +/var/lib/dhcpv6(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0) /var/lib/dhclient(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0) /var/lib/wifiroamd(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0) @@ -70,5 +71,6 @@ ifdef(`distro_gentoo',` ifdef(`distro_debian',` /run/network(/.*)? gen_context(system_u:object_r:net_conf_t,s0) +/var/run/resolvconf/.* -- gen_context(system_u:object_r:net_conf_t,s0) ') diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te index 36ae9923c..108b7fc45 100644 --- a/policy/modules/system/sysnetwork.te +++ b/policy/modules/system/sysnetwork.te @@ -1,4 +1,4 @@ -policy_module(sysnetwork, 1.20.3) +policy_module(sysnetwork, 1.20.4) ######################################## # @@ -241,6 +241,10 @@ optional_policy(` dev_rw_cardmgr(dhcpc_t) ') +optional_policy(` + samba_manage_config(dhcpc_t) +') + optional_policy(` seutil_sigchld_newrole(dhcpc_t) seutil_dontaudit_search_config(dhcpc_t)