[refpolicy] admin_prelink.patch

[refpolicy] admin_prelink.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F14/admin_prelink.patch

Lots of prelink fixes.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkx2z88ACgkQrlYvE4MpobOdlQCePSW6dzEHFDyzgQyPxF6ZJ9TR
sskAoII9NkXmP12eCAWM5TvOYMV2iDxy
=R3zu
-----END PGP SIGNATURE-----

[refpolicy] admin_prelink.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F14/admin_prelink.patch

Prelink has new directory under /var/lib

dontaudit leaks from domains that transition



prelink needs to manage executables in the users homedir.


cron job looks at all mount points.

[refpolicy] admin_prelink.patch

[Christopher J. PeBenito]

On Wed, 2010-06-02 at 15:51 -0400, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F14/admin_prelink.patch
> 
> Prelink has new directory under /var/lib

The files_search_var_lib() should be redundant due to the
files_var_lib_filetrans().

> dontaudit leaks from domains that transition
> 
> 
> 
> prelink needs to manage executables in the users homedir.

NAK  Prelink is highly trusted to manage system libraries.  This is too
easy of a way for users to compromise prelink, which could lead to
compromised system libraries.

> cron job looks at all mount points.

Otherwise merged.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] admin_prelink.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F13/admin_prelink.patch

Add context for prelink cron script

+    prelink_exec(abrt_t)

prelink needs tmpfs

[refpolicy] admin_prelink.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F12/admin_prelink.patch
http://people.fedoraproject.org/~dwalsh/SELinux/F12/services_cron.patch

cronjob for prelink relabels to appropriate context.

[refpolicy] admin_prelink.patch

[Christopher J. PeBenito]

On Fri, 2009-08-28 at 15:28 -0400, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F12/admin_prelink.patch
> http://people.fedoraproject.org/~dwalsh/SELinux/F12/services_cron.patch
> 
> cronjob for prelink relabels to appropriate context.

404 on cron

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] admin_prelink.patch

[Daniel J Walsh]

On 09/01/2009 08:51 AM, Christopher J. PeBenito wrote:
> On Fri, 2009-08-28 at 15:28 -0400, Daniel J Walsh wrote:
>> http://people.fedoraproject.org/~dwalsh/SELinux/F12/admin_prelink.patch
>> http://people.fedoraproject.org/~dwalsh/SELinux/F12/services_cron.patch
>>
>> cronjob for prelink relabels to appropriate context.
> 
> 404 on cron
> 
All f12 patches should be there now.

[refpolicy] admin_prelink.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F11/admin_prelink.patch

prelink managers files in /var/lib/misc/prelin*

[refpolicy] admin_prelink.patch

[Christopher J. PeBenito]

On Thu, 2009-05-21 at 10:13 -0400, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F11/admin_prelink.patch
> 
> prelink managers files in /var/lib/misc/prelin*

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] admin_prelink.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F10/admin_prelink.patch

needs sys_resource priv

needs to be able to execmod badly written libraries in /tmp

reads kernel_sysctls

Needs to manage files in /usr that do not have correctl label and
relabel them to the correct name for third party apps

Has to be able to manage files in homedirs

Finally I say the hell with it and run this as a unconfined_domain.

It can rewrite all executabels so no real good in confineing it.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkjvxhYACgkQrlYvE4MpobOxKQCdHenndfMKM/MDNguEHy41AG5W
CygAn2B4sMzEGO7TD3L9NkSl49QLAsDP
=c2ev
-----END PGP SIGNATURE-----