summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2009-08-31reorganize tun patch changes.Chris PeBenito4-50/+47
2009-08-31refpol: Policy for the new TUN driver access controlsPaul Moore8-0/+56
Add policy for the new TUN driver access controls which allow policy to control which domains have the ability to create and attach to TUN/TAP devices. The policy rules for creating and attaching to a device are as shown below: # create a new device allow domain_t self:tun_socket { create }; # attach to a persistent device (created by tunlbl_t) allow domain_t tunlbl_t:tun_socket { relabelfrom }; allow domain_t self:tun_socket { relabelto }; Further discussion can be found on this thread: * http://marc.info/?t=125080850900002&r=1&w=2 Signed-off-by: Paul Moore <paul.moore@hp.com>
2009-08-31refpol: Add the "tun_socket" object class flask definitionsPaul Moore2-0/+4
Add the new "tun_socket" class to the flask definitions. The "tun_socket" object class is used by the new TUN driver hooks which allow policy to control access to TUN/TAP devices. Signed-off-by: Paul Moore <paul.moore@hp.com>
2009-08-28patch from Eamon Walsh to remove useage of deprecated xserver interfaces.Chris PeBenito5-6/+6
2009-08-28deprecate userdom_xwindows_client_templateChris PeBenito5-30/+117
The X policy for users is currently split between userdom_xwindows_client_template() and xserver_role(). Deprecate the former and put the rules into the latter. For preserving restricted X roles (xguest), divide the rules into xserver_restricted_role() and xserver_role().
2009-08-26Remove excessive permissions in logging_send_syslog_msg(). Ticket #14.Chris PeBenito2-5/+6
2009-08-25split dev_create_cardmgr_dev() into a create and a filetrans interface.Chris PeBenito3-8/+27
2009-08-25Merge branch 'master' of ssh://oss.tresys.com/home/git/refpolicyChris PeBenito5-5/+8
2009-08-25split dev_manage_dri_dev() into a manage and a filetrans interface.Chris PeBenito3-1/+20
2009-08-18reorganize dbus.fc.Chris PeBenito1-2/+2
2009-08-18module version bumps and changelog update for the previous 3 commits.Chris PeBenito3-2/+3
2009-08-18Gentoo dbus in libexecLABBE Corentin1-0/+1
2009-08-18portage need capability sys_niceLABBE Corentin1-0/+1
2009-08-18Missing comma in policykitLABBE Corentin1-1/+1
2009-08-18Debian policykit fixes from Martin Orr.Chris PeBenito3-1/+10
The policykit binaries on Debian live in /usr/lib/policykit so add file contexts for that. Also a couple of policykit rules.
2009-08-17Fix unconfined_r use of unconfined_java_t.Chris PeBenito4-3/+28
The unconfined role is running java in the unconfined_java_t. The current policy only has a domtrans interface, so the unconfined_java_t domain is not added to unconfined_r. Add a run interface and change the unconfined module to use this new interface.
2009-08-17Fix Makefile info message for installing policy headersChris PeBenito1-1/+1
The Makefile is currently using the policy TYPE (standard|mls|mcs) rather than the more informative NAME (eg strict, targeted, etc). Fix the Makefile to use NAME.
2009-08-14Add missing x_device rules for XI2 functions, from Eamon Walsh.Chris PeBenito2-0/+3
> Whats the difference between add/remove and create/destroy? > > The devices are in a kind of hierarchy. You can now create one or more > "master devices" (mouse cursor and keyboard focus). The physical input > devices are "slave devices" that attach to master devices. > > Add/remove controls the ability to add/remove slave devices from a > master device. Create/destroy controls the ability to create new master > devices.
2009-08-12Add missing rules to make unconfined_cronjob_t a valid cron job domain.Chris PeBenito2-1/+11
Unconfined_cronjob_t is not a valid cron job domain because the cron module is lacking a transition from the crond to the unconfined_cronjob_t domain. This adds the transition and also a constraints exemption since part of the transition is also a seuser and role change typically.
2009-08-11remove redundant xen_append_log() call in hostname.Chris PeBenito1-4/+0
2009-08-11Add btrfs and ext4 to labeling targets.Chris PeBenito2-5/+7
2009-08-10Fix infrastructure to expand macros in initrc_context when installing.Chris PeBenito4-2/+8
The initrc_context file uses the mls_systemhigh macro and needs to be properly expanded based on the build.conf settings. Add makefile support to do this.
2009-08-10fix refpolicy ticket #48.Chris PeBenito2-1/+4
2009-08-05Handle unix_chkpwd usage by useradd and groupadd; fixes ticket #49.Chris PeBenito2-6/+13
2009-08-05Add missing compatibility aliases for xdm_xserver*_t types.Chris PeBenito2-4/+6
When collapsing all of the xdm_xserver*_t types into xserver*_t, aliases for compatibility were mistakenly not added to the policy.
2009-08-05module version number bump for release 2.20090730 that was mistakenly omitted.Chris PeBenito219-219/+219
2009-08-05fix ordering in sysnetwork.Chris PeBenito1-18/+16
2009-08-05fix ordering in raid.Chris PeBenito1-12/+12
2009-08-05fix ordering in pcmcia.Chris PeBenito1-10/+9
2009-08-05fix ordering in mount.Chris PeBenito1-26/+27
2009-08-05fix ordering in modutils.Chris PeBenito1-78/+76
2009-08-05fix ordering of interface calls in lvm.Chris PeBenito1-18/+18
2009-08-05fix ordering of interface calls in locallogin.Chris PeBenito1-23/+23
2009-08-05fix ordering of interface calls in iptables.Chris PeBenito1-19/+19
2009-08-05fix ordering of interface calls in init.Chris PeBenito1-39/+38
2009-08-05fix ordering of interface calls in hostname.Chris PeBenito1-7/+7
2009-08-05fix ordering of interface calls in getty.Chris PeBenito1-8/+8
2009-08-05fix ordering of interface calls in fstools.Chris PeBenito1-30/+27
2009-08-05fix ordering of interface calls in clock.Chris PeBenito1-4/+4
2009-08-05fix ordering of interface calls in authlogin.Chris PeBenito1-15/+15
2009-08-05fix ordering of interface calls in sudo.Chris PeBenito1-15/+15
2009-07-30release 2.20090730Chris PeBenito2-1/+2
2009-07-30changelog entry for the previous gentoo fixesChris PeBenito1-0/+1
2009-07-30add bin_t labeling for gentoo dhcpcd-run-hooks locationChris PeBenito2-1/+4
2009-07-30openrc unfortunately mounts a tmpfs at /lib/rcChris PeBenito1-1/+7
2009-07-30gentoo init script system uses tmpfs for state dataChris PeBenito1-5/+3
2009-07-29gentoo init script system sends audit messages.Chris PeBenito1-1/+3
2009-07-29alsa file location update for debian, from Manoj.Chris PeBenito2-1/+6
2009-07-29whitespace fixes in apt.Chris PeBenito2-2/+2
2009-07-29clean up 6a192f70d42013fcbd4eefe1f35cab3de313cedbChris PeBenito2-19/+18
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-28 15:29:38 +0000