Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
aboutsummaryrefslogtreecommitdiff
path: root/policy/modules/contrib
Commit message (Collapse)AuthorAgeFilesLines
* modutils.if: Remove obsolete modutils_list_module_configLuis Ressel2016-11-271-1/+0
| | | | | | This interface is a custom gentoo addition and is solely used by the dracut policy. However, the permissions it grants have been added to the modutils_read_module_config interface back in 2012 (commit e74b098).
* chromium: allow random2.20161023-r1Jason Zaman2016-10-271-0/+1
| | | | | Fails to start with: gcrypt-Message: no entropy gathering module detected
* chromium: allow dbus chat to gnome keyring and upowerJason Zaman2016-10-271-0/+6
| | | | For saving secrets and inhibiting power management eg during videos
* Merging contrib moved syncthing into main root :-(Sven Vermeulen2016-10-243-0/+106
|
* chromium: perms for user_cert_tJason Zaman2016-10-241-7/+6
|
* Update Changelog for release.Chris PeBenito2016-10-241-0/+160
| | | | Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
* Bump module versions for release.Chris PeBenito2016-10-2460-60/+60
| | | | Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
* Module version bump for webalizer patch from Russell Coker.Chris PeBenito2016-10-242-2/+2
| | | | Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
* webalizer: Rearrange a couple lines.Chris PeBenito2016-10-241-2/+2
| | | | Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
* webalizer patch for inclusionRussell Coker via refpolicy2016-10-243-0/+27
| | | | | | | Thanks Chris for the suggestions, here's a patch that I think is worthy of inclusion. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
* Module version bump for networkmanager fix from Naftuli Tzvi Kay.Chris PeBenito2016-10-031-1/+1
|
* gpg: Whitespace fix.Chris PeBenito2016-10-031-1/+1
|
* Module version bump for evolution patch from Guido Trentalancia.Chris PeBenito2016-10-032-2/+2
|
* gpg: public key signature verification in evolutionGuido Trentalancia2016-10-032-0/+25
| | | | | | | | Let gpg verify public key signatures in the evolution mail client application. It doesn't need write permissions on such files for signing/encrypting messages. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
* Fix NetworkManager Read Pid Files MacroNaftuli Tzvi Kay2016-10-031-0/+1
| | | | | Bug found in pull #26 - permissions aren't granted for searching the NetworkManager_var_run_t directory, only to reading its files.
* Module version bump for gnome patch from Guido Trentalancia.Chris PeBenito2016-10-032-2/+2
|
* gnome: add support for the OIL Runtime Compiler (ORC) optimized code executionGuido Trentalancia via refpolicy2016-10-034-0/+111
| | | | | | | | | | | | | | | Add a new gstreamer_orcexec_t type and file context to the gnome module in order to support the OIL Runtime Compiler (ORC) optimized code execution (used for example by pulseaudio). Add optional policy to the pulseaudio module to support the ORC optimized code execution. This patch has been anticipated a few weeks ago as part of a larger gnome patch. It has now been split as a smaller patch, as required. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
* Module version bump for mozilla patch from Guido Trentalancia.Chris PeBenito2016-10-032-2/+2
|
* pulseaudio: Move interface definitions.Chris PeBenito2016-10-031-38/+38
|
* mozilla: let mozilla play audioGuido Trentalancia via refpolicy2016-10-032-0/+86
| | | | | | | | | | | Let mozilla play audio: - add new interfaces to the pulseaudio module; - let mozilla read alsa configuration files; - add further permissions to mozilla needed to use pulseaudio to play audio. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
* cups: Module version bump for hplip patch from Guido TrentalanciaChris PeBenito2016-10-031-1/+1
|
* cups: Move can_exec() line.Chris PeBenito2016-10-031-3/+3
|
* cups: update permissions for HP printers (load firmware)Guido Trentalancia2016-10-031-4/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update the cups module with some permissions needed to run HP printers (in particular to be able to load firmware on those printers that need it every time they are connected). The permission to execute shell scripts has been removed in this new version, as this is not required. Compared to previous versions, this new version creates a specific hplip pty (as suggested by Christopher PeBenito). Here is the list of printers that require firmware loading: HP LaserJet 1000 HP LaserJet 1005 series HP LaserJet 1018 HP LaserJet 1020 HP LaserJet p1005 HP LaserJet p1006 HP LaserJet p1007 HP LaserJet p1008 HP LaserJet p1009 HP LaserJet p1505 HP LaserJet Professional p1102 HP LaserJet Professional p1102w HP LaserJet Professional p1566 Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
* evolution: Read user certs from Guido Trentalancia.Chris PeBenito2016-10-031-1/+24
|
* Module version bump for Evolution SSL fix from Guido Trentalancia.Chris PeBenito2016-10-031-1/+1
|
* evolution: read SSL certificatesGuido Trentalancia via refpolicy2016-10-031-0/+3
| | | | | | | | | | | Update the evolution modules so that: - it is able to read SSL certificates (e.g. for server authentication); - it is able to read the random number generator device; - it doesn't audit attempts to get the attributes of extended attributes filesystems. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
* Module version bump for webalizer dead type removal from Sean Placchetti.Chris PeBenito2016-09-011-1/+1
|
* -Remove unused declarations from webalizer type enforcement fileSean Placchetti2016-09-011-6/+0
|
* ntp: fcontext for ntpctlJason Zaman2016-08-181-0/+3
| | | | | ntpctl is hardlinked to ntpd and causes a labelling conflict randomly. Set the fcontext on both to be the same so there are no issues.
* pulseaudio: Fix compile errors.Chris PeBenito2016-08-181-6/+1
|
* Module version bump for various patches from Guido Trentalancia.Chris PeBenito2016-08-1810-10/+10
|
* Update the sysnetwork module to add some permissions needed by the dhcp ↵Chris PeBenito2016-08-181-0/+19
| | | | | | | | | | | | | | client (another separate patch makes changes to the ifconfig part). Create auxiliary interfaces in the ntp module. The permission to execute restorecon/setfiles (required by the dhclient-script script and granted in a previous version of this patch) is not granted, as it does not break the script functioning. Include revisions from Chris PeBenito. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
* Update the pulseaudio module for usability and ORC supportGuido Trentalancia2016-08-183-4/+32
| | | | | | | | | | | | | | | | | | | | Update the pulseaudio module so that it is usable (tested with latest version pulseaudio 9.0). This patch depends on a recent patch to update the gnome module. Support for the OIL Runtime Compiler (OIL) optimized code execution is added to the pulseaudio module by using a few newly created interfaces and file contexts in the gnome module. Supports the execmem permission only through a boolean which defaults to false. Thanks to Dominick Grift for the useful suggestions that permitted to create this new improved version of the patch. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
* alsa: Add compatibility alias for alsa_etc_rw_t.Chris PeBenito2016-08-181-1/+1
|
* Update the alsa module so that the alsa_etc_t file context (previously ↵Chris PeBenito2016-08-188-26/+55
| | | | | | | | | | | | | | | | | | | | | | | | | alsa_etc_rw_t) is widened to the whole alsa share directory, instead of just a couple of files. The wrong and misleading _rw_ label has been deprecated in the alsa interface definitions and in their instances throughout the whole Reference Policy (static and system-wide configuration files are not runtime-writable). Warning messages are printed when the user attempts to use the old namings for the above mentioned alsa interface definitions. After applying this patch, the recent pulseaudio patch should also be applied to complete the removal of the _rw_ labels on the alsa interfaces. This version of the patch finally removes obsolete file contexts and grants read permissions instead of manage permissions for static configuration files in /usr/share/alsa and system-wide configuration files in /etc. Thanks to Dominick Grift for pointing out redundant interface usage in a previous version of this patch. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
* Update the telepathy module:Chris PeBenito2016-08-181-0/+23
| | | | | | | | | - add an interface to support chat over dbus in the mission control domain; - add support for dbus chat in the mission control domain for the telepathy role. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
* Module version bumps for patches from Guido Trentalancia.Chris PeBenito2016-08-145-5/+5
|
* Update the rtkit moduleGuido Trentalancia2016-08-141-1/+1
| | | | | | Update the rtkit daemon module so that the daemon can be started. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
* Let gpg disable core dumpsGuido Trentalancia2016-08-141-0/+1
| | | | | | | Update the gpg role interface so that core dumps can be disabled at runtime (required for successful execution of gpg). Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
* Update the policy for module apmGuido Trentalancia2016-08-141-0/+1
| | | | | | Update needed for the normal functioning of the acpi daemon. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
* Policykit module: add fs_getattr_xattr_fs()Guido Trentalancia2016-08-141-0/+1
| | | | | | Add a single permission to the policykit module. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
* cpucontrol: revise cpucontrol_conf_t labeling, from Guido Trentalancia.Chris PeBenito2016-08-142-2/+2
|
* Module version bump for pulseaudio fc fix from Jason Zaman.Chris PeBenito2016-08-141-1/+1
|
* pulseaudio: fix user runtime fcontextJason Zaman2016-08-141-1/+1
|
* Systemd units from Russell Coker.Chris PeBenito2016-08-1444-22/+139
|
* named reads vm sysctlsRussell Coker2016-08-141-0/+1
| | | | | | | | | | | | | | | | | | On Wed, 3 Aug 2016 09:43:18 AM Chris PeBenito wrote: > > kernel_read_kernel_sysctls(named_t) > > > > +kernel_read_vm_sysctls(named_t) > > > > kernel_read_system_state(named_t) > > kernel_read_network_state(named_t) > > Yes, there is a kernel_read_vm_overcommit_sysctl(). I've attached a new patch. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/
* Module version bump for watchdog pidfile option from Russell Coker.Chris PeBenito2016-08-141-1/+1
|
* watchdog: Move line.Chris PeBenito2016-08-141-2/+1
|
* watchdog reads pid filesRussell Coker2016-08-141-0/+2
| | | | This patch allows watchdog to read all pid files for the "pidfile" feature.
* rpcbind: Read /sys/devices/system/cpu/online from Russell Coker.Chris PeBenito2016-08-141-1/+3
|