diff -ru policy.tom/macros/program/apache_macros.te policy.new/macros/program/apache_macros.te --- policy.tom/macros/program/apache_macros.te 2004-10-26 23:20:42.000000000 +1000 +++ policy.new/macros/program/apache_macros.te 2004-10-26 23:19:27.000000000 +1000 @@ -21,7 +21,7 @@ ifelse($1, sys, ` #This type is for webpages # -type httpd_$1_content_t, file_type, homedirfile, sysadmfile; +type httpd_$1_content_t, file_type, homedirfile, sysadmfile, sysadm_domain_file_type; typealias httpd_sys_content_t alias httpd_sysadm_content_t; # This type is used for .htaccess files @@ -79,9 +79,9 @@ # The following are the only areas that # scripts can read, read/write, or append to # -type httpd_$1_script_ro_t, file_type, sysadmfile; -type httpd_$1_script_rw_t, file_type, sysadmfile; -type httpd_$1_script_ra_t, file_type, sysadmfile; +type httpd_$1_script_ro_t, file_type, sysadmfile, sysadm_domain_file_type; +type httpd_$1_script_rw_t, file_type, sysadmfile, sysadm_domain_file_type; +type httpd_$1_script_ra_t, file_type, sysadmfile, sysadm_domain_file_type; ', ` type httpd_$1_script_ro_t, file_type, sysadmfile, $1_domain_file_type; type httpd_$1_script_rw_t, file_type, sysadmfile, $1_domain_file_type; @@ -89,13 +89,6 @@ ') file_type_auto_trans(httpd_$1_script_t, tmp_t, httpd_$1_script_rw_t) -ifdef(`slocate.te', ` -ifelse($1, `sys', `', ` -allow $1_locate_t { httpd_$1_content_t httpd_$1_htaccess_t httpd_$1_script_exec_t httpd_$1_script_ro_t httpd_$1_script_rw_t httpd_$1_script_ra_t }:dir { getattr search }; -allow $1_locate_t { httpd_$1_content_t httpd_$1_htaccess_t httpd_$1_script_exec_t httpd_$1_script_ro_t httpd_$1_script_rw_t httpd_$1_script_ra_t }:file { getattr read }; -')dnl end ifelse -')dnl end slocate.te - ######################################################### # Permissions for running child processes and scripts ########################################################## diff -ru policy.tom/macros/program/crond_macros.te policy.new/macros/program/crond_macros.te --- policy.tom/macros/program/crond_macros.te 2004-10-26 23:20:42.000000000 +1000 +++ policy.new/macros/program/crond_macros.te 2004-10-27 00:18:59.000000000 +1000 @@ -36,7 +36,7 @@ r_dir_file($1_crond_t, selinux_config_t) # Type of user crontabs once moved to cron spool. -type $1_cron_spool_t, file_type, sysadmfile ifelse($1, `system', `', `, $1_domain_file_type'); +type $1_cron_spool_t, file_type, sysadmfile; ifdef(`fcron.te', ` allow crond_t $1_cron_spool_t:file create_file_perms; diff -ru policy.tom/macros/program/irc_macros.te policy.new/macros/program/irc_macros.te --- policy.tom/macros/program/irc_macros.te 2004-10-26 23:20:42.000000000 +1000 +++ policy.new/macros/program/irc_macros.te 2004-10-26 23:46:34.000000000 +1000 @@ -27,11 +27,6 @@ type $1_home_irc_t, file_type, homedirfile, sysadmfile, $1_domain_file_type; type $1_irc_exec_t, file_type, sysadmfile, $1_domain_file_type; -ifdef(`slocate.te', ` -allow $1_locate_t { $1_home_irc_t $1_irc_exec_t }:dir { getattr search }; -allow $1_locate_t { $1_home_irc_t $1_irc_exec_t }:file { getattr read }; -') - allow $1_t { $1_home_irc_t $1_irc_exec_t }:file { relabelfrom relabelto create_file_perms }; # Transition from the user domain to this domain. diff -ru policy.tom/macros/program/lpr_macros.te policy.new/macros/program/lpr_macros.te --- policy.tom/macros/program/lpr_macros.te 2004-10-26 23:20:42.000000000 +1000 +++ policy.new/macros/program/lpr_macros.te 2004-10-26 23:21:33.000000000 +1000 @@ -54,11 +54,11 @@ r_dir_file($1_lpr_t, printconf_t) ') -tmp_domain($1_lpr, `, $1_domain_file_type') +tmp_domain($1_lpr) r_dir_file($1_lpr_t, $1_tmp_t) # Type for spool files. -type $1_print_spool_t, file_type, sysadmfile, $1_domain_file_type; +type $1_print_spool_t, file_type, sysadmfile; # Use this type when creating files in /var/spool/lpd and /var/spool/cups. file_type_auto_trans($1_lpr_t, print_spool_t, $1_print_spool_t, file) allow $1_lpr_t var_spool_t:dir { search }; diff -ru policy.tom/macros/program/screen_macros.te policy.new/macros/program/screen_macros.te --- policy.tom/macros/program/screen_macros.te 2004-10-26 23:20:42.000000000 +1000 +++ policy.new/macros/program/screen_macros.te 2004-10-26 23:22:33.000000000 +1000 @@ -31,7 +31,7 @@ # Transition from the user domain to this domain. domain_auto_trans($1_t, screen_exec_t, $1_screen_t) -tmp_domain($1_screen, `, $1_domain_file_type') +tmp_domain($1_screen) base_file_read_access($1_screen_t) # The user role is authorized for this domain. role $1_r types $1_screen_t; @@ -72,7 +72,7 @@ # Create fifo allow $1_screen_t var_t:dir search; file_type_auto_trans($1_screen_t, var_run_t, screen_dir_t, dir) -type $1_screen_var_run_t, file_type, sysadmfile, pidfile, $1_domain_file_type; +type $1_screen_var_run_t, file_type, sysadmfile, pidfile; file_type_auto_trans($1_screen_t, screen_dir_t, $1_screen_var_run_t, fifo_file) allow $1_screen_t self:process { fork signal_perms }; diff -ru policy.tom/macros/program/slocate_macros.te policy.new/macros/program/slocate_macros.te --- policy.tom/macros/program/slocate_macros.te 2004-09-03 14:10:35.000000000 +1000 +++ policy.new/macros/program/slocate_macros.te 2004-10-26 23:33:57.000000000 +1000 @@ -52,8 +52,8 @@ allow $1_locate_t $1_tty_device_t:chr_file rw_file_perms; allow $1_locate_t $1_devpts_t:chr_file rw_file_perms; -allow $1_locate_t { home_root_t $1_home_dir_t $1_home_t }:dir { getattr search }; -allow $1_locate_t $1_home_t:{ file lnk_file } { getattr read }; +allow $1_locate_t $1_domain_file_type:dir { getattr search }; +allow $1_locate_t $1_domain_file_type:{ file lnk_file sock_file fifo_file } { getattr read }; base_file_read_access($1_locate_t) r_dir_file($1_locate_t, { etc_t lib_t var_t }) diff -ru policy.tom/macros/program/ssh_macros.te policy.new/macros/program/ssh_macros.te --- policy.tom/macros/program/ssh_macros.te 2004-10-26 23:20:42.000000000 +1000 +++ policy.new/macros/program/ssh_macros.te 2004-10-26 23:46:14.000000000 +1000 @@ -115,11 +115,6 @@ r_dir_file({ sshd_t sshd_extern_t }, $1_home_ssh_t) rw_dir_create_file($1_t, $1_home_ssh_t) -ifdef(`slocate.te', ` -allow $1_locate_t $1_home_ssh_t:dir { getattr search }; -allow $1_locate_t $1_home_ssh_t:file { getattr read }; -') - # for /bin/sh used to execute xauth dontaudit $1_ssh_t proc_t:dir search; dontaudit $1_ssh_t proc_t:{ lnk_file file } { getattr read }; diff -ru policy.tom/macros/program/uml_macros.te policy.new/macros/program/uml_macros.te --- policy.tom/macros/program/uml_macros.te 2004-10-26 23:20:42.000000000 +1000 +++ policy.new/macros/program/uml_macros.te 2004-10-26 23:46:42.000000000 +1000 @@ -29,11 +29,6 @@ type $1_uml_ro_t, file_type, sysadmfile, $1_domain_file_type; type $1_uml_rw_t, file_type, sysadmfile, $1_domain_file_type; -ifdef(`slocate.te', ` -allow $1_locate_t { $1_uml_exec_t $1_uml_ro_t $1_uml_rw_t }:dir { getattr search }; -allow $1_locate_t { $1_uml_exec_t $1_uml_ro_t $1_uml_rw_t }:file { getattr read }; -') - can_ptrace($1_t, $1_uml_t) # for X diff -ru policy.tom/macros/program/x_client_macros.te policy.new/macros/program/x_client_macros.te --- policy.tom/macros/program/x_client_macros.te 2004-10-26 23:20:42.000000000 +1000 +++ policy.new/macros/program/x_client_macros.te 2004-10-26 23:46:20.000000000 +1000 @@ -81,11 +81,6 @@ allow $1_t $1_$2_ro_t:fifo_file create_file_perms; allow $1_t $1_$2_ro_t:{ dir file lnk_file } { relabelto relabelfrom }; -ifdef(`slocate.te', ` -allow $1_locate_t { $1_$2_ro_t $1_$2_rw_t }:dir { getattr search }; -allow $1_locate_t { $1_$2_ro_t $1_$2_rw_t }:file { getattr read }; -') - # Allow the user domain to send any signal to the $2 process. allow $1_t $1_$2_t:process signal_perms; diff -ru policy.tom/macros/program/xauth_macros.te policy.new/macros/program/xauth_macros.te --- policy.tom/macros/program/xauth_macros.te 2004-10-26 23:20:42.000000000 +1000 +++ policy.new/macros/program/xauth_macros.te 2004-10-26 23:46:26.000000000 +1000 @@ -26,10 +26,6 @@ type $1_xauth_t, domain; type $1_home_xauth_t, file_type, homedirfile, sysadmfile, $1_domain_file_type; -ifdef(`slocate.te', ` -allow $1_locate_t $1_home_xauth_t:file { getattr read }; -') - allow $1_xauth_t self:process signal; allow $1_t $1_home_xauth_t:file { relabelfrom relabelto create_file_perms }; @@ -84,7 +80,7 @@ allow $1_xauth_t home_root_t:dir search; file_type_auto_trans($1_xauth_t, $1_home_dir_t, $1_home_xauth_t, file) -tmp_domain($1_xauth, `, $1_domain_file_type') +tmp_domain($1_xauth) allow $1_xauth_t $1_tmp_t:file { getattr ioctl read }; ifdef(`nfs_home_dirs', `