ifconfig can also be in /bin

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Module version bump for ifconfig fc entry from Sven Vermeulen.
No longer use deprecated MLS interfaces

Since commit 2d0c9cec mls_file_read_up and mls_file_write_down
interfaces are deprecated even though they are still present.

Replace mls_file_read_up with mls_file_read_all_levels and
mls_file_write_down with mls_file_write_all_levels.
Module version bump for deprecated interface usage removal from Nicolas Iooss.
Update contrib.
Updating submodule URL to github
xserver_t needs to ender dirs labeled xdm_var_run_t

The LightDM application stores its xauth file in a subdirectory
(/var/run/lightdm/root) which is labeled as xdm_var_run_t. As a result,
X11 (xserver_t) needs search rights to this location.

With this setup, X is run as follows:
  /usr/bin/X :0 -auth /var/run/lightdm/root/:0

Changes since v1:
- Use read_files_pattern instead of separate allow rules

Signed-off-by: Jason Zaman <jason@perfinion.com>
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Enable rcs2log location for all distributions

Currently, the /usr/share/cvs/contrib/rcs2log is only labeled as bin_t
for redhat distributions. Moving this to the general one as it is also
in use on other distributions

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Module version bump for rcs2log and xserver updates from Sven Vermeulen.
Allow init to execute shutdown

In many inittabs, there's a line like
"ca:12345:ctrlaltdel:/sbin/shutdown -h now" which triggers a shutdown or
a reboot on Ctrl+Alt+Del.
Allow xdm_t to transition to shutdown_t domain

Several DMs offer the possibility to shutdown the system. I personally
don't think a bool is neccessary for this permission, but I wouldn't
oppose one either.
Module version bump for shutdown transitions from Luis Ressel.
Fix misspelling

Fix misspelling using  http://github.com/lyda/misspell-check

Signed-off-by: Elia Pinto <gitter.spiros@gmail.com>
Remove firstboot_rw_t as FC5 has been gone for a long time.
Module version bump for firstboot_rw_t alias removal.
Add dropbox_port_t support

The dropbox application has a feature called "LAN Sync" which works on
TCP & UDP port 17500. Marking this port as dropbox_port_t (instead of
the currently default unreserved_port_t) allows for more fine-grained
access control to this resource.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Module version bump for dropbox port from Sven Vermeulen.
Allow unconfined domains to use syslog capability

When an unconfined_t root user runs dmesg, the kernel complains with
this message in its logs (when SELinux is in enforcing mode):

  dmesg (16289): Attempt to access syslog with CAP_SYS_ADMIN but no
  CAP_SYSLOG (deprecated).

audit.log contains following AVC:

  avc:  denied  { syslog } for  pid=16289 comm="dmesg" capability=34
  scontext=unconfined_u:unconfined_r:unconfined_t
  tcontext=unconfined_u:unconfined_r:unconfined_t tclass=capability2
Module version bump for unconfined syslog cap from Nicolas Iooss.
Always use the unknown permissions handling build option.

This compile-time feature is in the minimum-required checkpolicy/checkmodule
for building the policy, so it should always be used.