Re: SE Linux policy update

2011-03-19 Thread Russell Coker
On Sat, 12 Mar 2011, Adam D. Barratt a...@adam-barratt.org.uk wrote: * Allow user domains to execute mysqld_exec_t, for KDE * Allow user_dbusd_t to execute gconfd_exec_t in user_gconfd_t. That's this change? + + optional_policy(` + gnome_role($2, $1_dbusd_t)

Re: SE Linux policy update

2011-03-19 Thread Adam D. Barratt
On Sat, 2011-03-19 at 14:58 +1100, Russell Coker wrote: On Sat, 12 Mar 2011, Adam D. Barratt a...@adam-barratt.org.uk wrote: On Fri, 2011-03-11 at 23:21 +1100, Russell Coker wrote: These are all serious updates that can be considered as a truly critical functionality problem for some

Re: SE Linux policy update

2011-03-19 Thread Russell Coker
On Sat, 19 Mar 2011, Adam D. Barratt a...@adam-barratt.org.uk wrote: They have all been tested on multiple systems. Also many of the changes are related to things that didn't work at all previously so there was little scope for regression. Okay. Apart from the one I just backed out.

Re: SE Linux policy update

2011-03-19 Thread Adam D. Barratt
On Sat, 2011-03-19 at 20:03 +1100, Russell Coker wrote: On Sat, 19 Mar 2011, Adam D. Barratt a...@adam-barratt.org.uk wrote: * Dontaudit bind_t write attempts to / for lwresd calling access(., W_OK) Don't audit Stops filling the logs when the daemon is just asking

Re: SE Linux policy update

2011-03-18 Thread Russell Coker
On Sat, 12 Mar 2011, Adam D. Barratt a...@adam-barratt.org.uk wrote: On Fri, 2011-03-11 at 23:21 +1100, Russell Coker wrote: The user friendly change list is that this makes USB flash storage devices usable by default on the desktop, Iceweasel works correctly, upowerd is run correctly in

Re: SE Linux policy update

2011-03-18 Thread Russell Coker
On Sat, 19 Mar 2011, Russell Coker russ...@coker.com.au wrote: Below is the definition of gnome_role, when it is called the first parameter $1 equals the second parameter $2 from the above optional_policy and $2 is the $1_dbusd_t. So it substitutes to domain_auto_trans($1_dbusd_t,

Re: SE Linux policy update

2011-03-11 Thread Adam D. Barratt
On Fri, 2011-03-11 at 23:21 +1100, Russell Coker wrote: The user friendly change list is that this makes USB flash storage devices usable by default on the desktop, Iceweasel works correctly, upowerd is run correctly in the devicekit_power_t domain, KDE mysqld access works, fetchmail works