- Fixed typo in contrib/avahi.if

Fixed typo in avahi.if

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
- Fixed typo in contrib/glusterfs.te

Removed uneeded ";" after macro call in glusterfs.te.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
- Fixed typo in contrib/jabber.if

Removed extra ")" from macro call in jabber.if.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
- Fixed typo in contrib/keystone.if

Added missing ")" for macro call in keystone.if.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
- Fixed typo in contrib/mailscanner.if

Added missing ")" for macro call in mailscanner.if.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
- Fixed typo in contrib/qpid.if

Fixed typo in qpid.if.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
- Fixed typo in contrib/readahead.fc.

Fixed typo in readahead.fc.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
- Fixed typo in contrib/rpm.if.

Added missing ")" for macro call in rpm.if.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
Fix monolithic built

Make unconfined_cronjob_t declaration mandatory, because else monolithic
built fails due to duplicate declaration

Deprecate kerberos_keytab_template:

Keytab type declarations have to be mandatory, because else monolithic
built fails due to out-of-scope

This keytab solution does not make sense in its current implementation,
as many corresponding file context specs are missing, and there are no
type transtion rules

Replaced two deprecated interface calls

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
Add aide bin /usr/bin and mark /var/lib/aide

In Gentoo, the aide binary is at /usr/bin/aide.

Also, the /var/lib/aide directory itself is best labeled as aide_db_t as well to
allow aide to handle its contents.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Change file context spec for aide log files to catch suffixes

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
Provide alsa_write_lib interface

The initrc_t domain needs write privileges in the /var/lib/alsa location to
store the asound.state file generated through the alsa init script. To prepare
for this, create the alsa_write_lib interface.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Run dmidecode after newrole or on terminals

The dmidecode application needs to use the file descriptors often owned by the
switching process (like newrole_t after switching roles with newrole), commonly
done by administrators.

Grant this through domain_use_interactive_fds(), allowing output for dmidecode
to be displayed on such terminals.

Also update style a bit to be confirm the coding style for refpolicy.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Grant write privileges to squid on its log files

The squid daemon currently seems to require write privileges on the files
(squid_log_t) - append no longer cuts it. This is confirmed for both the
cache.log file as well as the netdb.state file.

Switching append_files_pattern to write_files_pattern.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Module version bumps for changes in various policy modules by Sven
Vermeulen

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
Squid: Use a single pattern for brevity

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
Remove deprecated interfaces to make their usage fatal

Signed-off-by: Nicolas Iooss <nicolas.iooss_git@polytechnique.org>
Debian patch 7: Added new "lda" module for email local delivery agents such as maildrop and procmail
Debian patch 8: Add pythonsupport policy
Debian patch 13: Add debian apache paths and apache_script_exec_domain()

The patch firstly adds support for some Debian paths to the Apache
policy and has some minor changes to the access granted to user content.

The biggest change is to have a new interface apache_script_exec_domain() for
creating types for Apache content which doesn't need to be optional.  So the
types created by it can be used in a .fc file which will be included even if
apache.pp isn't loaded.  This means that a module which has a script that
Apache might run won't depend on apache.pp.