[refpolicy] system_userdomain.patch

[refpolicy] system_userdomain.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F11/system_userdomain.patch

The biggest change in this patch is the addition of the $1_usertype.

Instead of using $1_t for all user access,  I use $1_usertype.  This
allows me to make $1_java_t == $1_t + { execmem execstack}. Similar for
$1_mono_t.

Changed many templates to interfaces, since they were not defining new
types.

Added labeling for symbolic links of homedirs

Labeling for /dev/shm files.


My labeling of /root

added userhomereader attribute in order to allow tunables within tunables.

Added user_home_type handling so we can define additionaly types to the
home dir and still allow users to manage them.  (ssh_home_t for example.)


Removed a couple of old booleans that really do not make sense
user_dmesg?  Should be only applied to a particular type staff_t maybe,
not all users.  guest_t will never run dmesg.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkmuwtgACgkQrlYvE4MpobNoAwCgjcErx5UIQQS91KBMYMnhAl3F
HlgAoLRQrISDwEe00jx73VWzQnq3sBpI
=TwUE
-----END PGP SIGNATURE-----

[refpolicy] system_userdomain.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F12/system_userdomain.patch

Widely varied from upstream because of consolodating on attributes rather then types.

[refpolicy] system_userdomain.patch

[Christopher J. PeBenito]

On Thu, 2009-11-12 at 17:18 -0500, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F12/system_userdomain.patch
> 
> Widely varied from upstream because of consolodating on attributes
> rather then types.

In principle this is fine, but I'm trying to hold out for a proper
clone/copy mechanism to be available again.  When that comes around, I'd
have to undo this change.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] system_userdomain.patch

[Daniel J Walsh]

On 02/12/2010 03:26 PM, Christopher J. PeBenito wrote:
> On Thu, 2009-11-12 at 17:18 -0500, Daniel J Walsh wrote:
>> http://people.fedoraproject.org/~dwalsh/SELinux/F12/system_userdomain.patch
>>
>> Widely varied from upstream because of consolodating on attributes
>> rather then types.
> 
> In principle this is fine, but I'm trying to hold out for a proper
> clone/copy mechanism to be available again.  When that comes around, I'd
> have to undo this change.
> 
Maybe, but we have been waiting for the clone/copy mechansim for several years now.  :^(

I have a hard time many people can use confined users without this mechanism or other distros do not use the exec* checks.
Or they do not use java/mono applications.

[refpolicy] system_userdomain.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F14/system_userdomain.patch

LOts of fixes.  Chery pick?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkx2/LMACgkQrlYvE4MpobM4tQCfYo/s45CNkbYPHUg5uK3ZJ02X
FroAoNKNcgB1goR0TRK9m+0mVxMZJeAg
=6SkR
-----END PGP SIGNATURE-----