Re: Latest diffs

On Mon, 2006-02-20 at 17:19 -0500, Daniel J Walsh wrote:
> Fixed up semodule policy; although matchpathcon does not seem to be
> returning the correct labels

Renamed semodule to semanage per the semodule policy discussion.

> plain text document attachment (diff)
> diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.2.17/policy/modules/services/spamassassin.te
> --- nsaserefpolicy/policy/modules/services/spamassassin.te 2006-02-20 14:07:37.000000000 -0500
> +++ serefpolicy-2.2.17/policy/modules/services/spamassassin.te 2006-02-20 16:22:06.000000000 -0500
> @@ -124,6 +124,7 @@
> term_dontaudit_use_generic_ptys(spamd_t)
> files_dontaudit_read_root_files(spamd_t)
> tunable_policy(`spamd_enable_home_dirs',`
> + userdom_search_unpriv_user_home_dirs(spamd_t)
> userdom_manage_generic_user_home_dirs(spamd_t)
> userdom_manage_generic_user_home_files(spamd_t)
> userdom_manage_generic_user_home_symlinks(spamd_t)

Fixed the userdom_manage_* interfaces to provide search on user_home_dir_t instead.

> @@ -137,6 +137,8 @@
> samba_domtrans_smbmount(mount_t)
> ')
>
> +userdom_mounton_generic_user_home_dir(mount_t)
> +
> ifdef(`TODO',`
> # TODO: Need to examine this further. Not sure how to handle this
> #type sysadm_mount_source_t, file_type, sysadmfile, $1_file_type;

Made user_home_dir_t and user_home_t mount points with files_mountpoint() instead.

> @@ -526,12 +526,74 @@
>
> miscfiles_read_localization(setfiles_t)
>
> +seutil_module_get_trans_lock(setfiles_t)
> +seutil_module_get_read_lock(setfiles_t)
> +
> userdom_use_all_users_fd(setfiles_t)
> # for config files in a home directory
> userdom_read_all_user_files(setfiles_t)

I dropped the trans lock for now, I don't see setfiles getting a trans lock in the code.

> diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.2.17/policy/modules/system/userdomain.te
> --- nsaserefpolicy/policy/modules/system/userdomain.te 2006-02-16 14:46:56.000000000 -0500
> +++ serefpolicy-2.2.17/policy/modules/system/userdomain.te 2006-02-20 16:22:06.000000000 -0500
> @@ -358,6 +358,8 @@
> seutil_run_checkpolicy(secadm_t,secadm_r,admin_terminal)
> seutil_run_loadpolicy(secadm_t,secadm_r,admin_terminal)
> seutil_run_setfiles(secadm_t,secadm_r,admin_terminal)
> + semodule_domtrans(secadm_t)
> + role secadm_r types semodule_t;
> seutil_run_restorecon(secadm_t,secadm_r,admin_terminal)
> ', `
> selinux_set_enforce_mode(sysadm_t)

Changed this to a run interface. Added a call for sysadm_t if mls is disabled.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.