[refpolicy] kernel_kernel.patch

[refpolicy] kernel_kernel.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_kernel.patch

Fix kernel_read_ssyctl to include

+       read_files_pattern($1, sysctl_t, sysctl_t)

Add interface to read crypto_sysctls

Add interface to relaeblto unlabeled_t, this allows livecd to create
files with labels the host file system does not know about.

Add filesystem mappnig for ininibandeventfs,

Add sysctl_crypto definition

Allow unlabeled_t to be put on file systems fro livecd

Make sure transitins happen correctly in homedir.  I think this is
required for when a remote nfs system create a homedir.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkkscHkACgkQrlYvE4MpobMUDgCgkGInulqiZTg6q0ro/8zoJ8wq
LfkAoKW/WN2iTM1x7FHur69o35e2n8h5
=Wd5H
-----END PGP SIGNATURE-----

[refpolicy] kernel_kernel.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_kernel.patch

Addition kernel interfaces.

Changes to allow unlabled files on disk when using MAC_ADMIN (mock,
liveusb_creator, install programs)

Fix kernel_read_sysctl

Add crypto_sysctls

Add infinibandeventfs
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkmu8D0ACgkQrlYvE4MpobOdSQCeI2mknN98Favg0dkEcJqDRhTr
Y8MAoOd2r9i8+3S3NDkDDC4AE6hwZkja
=PUVY
-----END PGP SIGNATURE-----

[refpolicy] kernel_kernel.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_kernel.patch

Additional interfaces used by Fedora

Fix some gen_require blocks

[refpolicy] kernel_kernel.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F12/kernel_kernel.patch

request_load_module is an import interface

uses module_request added to flask

[refpolicy] kernel_kernel.patch

[Christopher J. PeBenito]

On Thu, 2009-11-12 at 16:03 -0500, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F12/kernel_kernel.patch
> 
> request_load_module is an import interface
> 
> uses module_request added to flask
> 
Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] kernel_kernel.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F13/kernel_kernel.patch

+kernel_kill(rgmanager_t)
+kernel_mount_unlabeled(mount_t)
+kernel_relabelto_unlabeled(setfiles_mac_t)
+kernel_stream_connect(plymouth_t)
+kernel_stream_connect(initrc_t)

Add files context for infinibandeventfs_t

Allow unlabeled_t files to be put on disk in order to allow 
setfiles_mac_t (livecd_creater) to work.

Kernel needs access to all terms and ptmx
kernel_t does stuff in dracut which requires access to mountab

MLS access required for the kernel

kernel creating files in the homedir

And setting up files in xserver_xdm

Also create files with the right label in /

[refpolicy] kernel_kernel.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_kernel.patch

Add ability to dontaudit requiests to load kernel modules.  If you 
disable ipv6 every confined app that does ip, tries to get the kernel to 
load the module.

Better handling of unlabeled files by the kernel interfaces

Apps needs to connect to the kernel stream

Add type for infinibandeventfs

Need to allow unlabeled_t files to be put on disk in order that livecd 
will work.

[refpolicy] kernel_kernel.patch

[Christopher J. PeBenito]

On Wed, 2010-06-02 at 16:25 -0400, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_kernel.patch
> 
> Add ability to dontaudit requiests to load kernel modules.  If you 
> disable ipv6 every confined app that does ip, tries to get the kernel to 
> load the module.
> 
> Better handling of unlabeled files by the kernel interfaces
> 
> Apps needs to connect to the kernel stream

What are the examples?

> Add type for infinibandeventfs

This seems best suited for filesystem.

> Need to allow unlabeled_t files to be put on disk in order that livecd 
> will work.

Thats odd; I would think that the filesystem being created would be
iso9660_t.

Otherwise merged.


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] kernel_kernel.patch

[Daniel J Walsh]

On 06/07/2010 11:08 AM, Christopher J. PeBenito wrote:
> On Wed, 2010-06-02 at 16:25 -0400, Daniel J Walsh wrote:
>> http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_kernel.patch
>>
>> Add ability to dontaudit requiests to load kernel modules.  If you
>> disable ipv6 every confined app that does ip, tries to get the kernel to
>> load the module.
>>
>> Better handling of unlabeled files by the kernel interfaces
>>
>> Apps needs to connect to the kernel stream
>
I guess we should hold off on this and remove it.  Might have been 
caused by the transition from sysinit/mkinitrd to upstart/dracut.  I 
will remove from Rawhide and see if this comes back.
> What are the examples?
>
>> Add type for infinibandeventfs
>
> This seems best suited for filesystem.
>
Ok If you want to move them there, or I will when you commit the changes.
>> Need to allow unlabeled_t files to be put on disk in order that livecd
>> will work.
>
> Thats odd; I would think that the filesystem being created would be
> iso9660_t.
>
> Otherwise merged.
>
>

No, livecd-creator is labeling files with labels the kernel does not 
understand.  So from the host perspective, these labels are unlabeled_t 
(Worst name ever).
livecd-creator creates a directory under /tmp and starts installing 
files using rpm, rpm uses a file context file different from the host. 
Causing unlabeled_t files to be stored on ext3 file system

[refpolicy] kernel_kernel.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_kernel.patch

MLS and MCS fixes

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkx29lQACgkQrlYvE4MpobPzMACePCX62c1qlJ3MfuAwaZoVbJmw
t0AAoKK3MZFmpA9d8RXYRUeuUjBn8HIV
=H8Aj
-----END PGP SIGNATURE-----