Features:
- policy for evolution
- policy for thunderbird
- policy for generic mail client that they derive from
- policy for gconf
- common gnome macros (mozilla, evolution, thunderbird, gift, games,
gconf) use those
- macro for secure storage at .gnome(2)_private
- attempt at per role fonts
- per application labeled orbit sockets
- per application labeled ice sockets ( this is rather broken right
now )
- begin structuring things to confine bonobo in the future
- introduce untrusted type, but don't do anything with it yet
- restricted home_domain macro set to allow specifying transition class
in /home.
Default is now { dir } only, which is more restrictive than before.
- rework gift networking rules
- start writing ethereal policy ( not finished )
- bugfixes
I believe this is against selinux-policy-strict-sources-1.23.17-2
Issues:
(see my other message (nsa-list) - file_type_auto_trans
is not sufficient)
- need to patch libfontconfig to create font cache with proper type
- need to patch libgnome to create .gnome2 .gnome2_private,
and .gnome2/share/*fonts*
with correct type
- need to patch ORBit to create /tmp/orbit-* with correct type
- need to patch libICE to create /tmp/.ICE_unix with correct type
- need to give getfscreate/setfscreate privileges to all of those
(just like it's done for orbit_domain)
- need to patch evolution to create autosave composer files in
~/.evolution, not in $HOME
- need to fix everything relating to $HOME/.ICEauthority
- need to finish evolution exchange policy
- need to finish ethereal policy
- need to update boolean file
Status:
- can log in with almost no denials. There are the usual
strict policy bugs, there's some iceauth related denials,
but nothing too bad. Evolution works, but it
keeps popping up warning boxes every 15 seconds saying
it can't write its autosave files to $HOME - that needs
to be patched.
--
Ivan Gyurdiev <ivg2@xxxxxxxxxxx>
Cornell University
patch.diff
Description: Text Data
|
