Add a policy module for shibboleth authentication

Signed-off-by: Martin Lang <lang@automata.rwth-aachen.de>
Whitespace fix in shibboleth.te.
Module version bump for new shibboleth module from Martin Lang.

Reduces shibboleth to 1.0.0, as it is the initial refpolicy version.
apt: remove non-existing permission set write_dir_perms

write_dir_perms doesn't exist in policy/support/obj_perm_sets.spt so this
patch removes the buggy dontaudit statement from apt_read_cache.
Module version bump for apt fix from Nicolas Iooss.
dnsmasq reads MTU sysctl

The dnsmasq application reads in the value of the
/proc/sys/net/ipv6/conf/*/mtu values.

This is confirmed through looking at the source code of dnsmasq, in
src/radv.c.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Module version bump for dnsmasq MTU fix from Sven Vermeulen.
Support read/append/manage functions for various httpd content

We make the web content types as defined by the apache module more
generic in use so that other domains, who need to interact with these
types, can do so without getting too many privileges assigned (like with
apache_manage_all_content).

Within the apache module, the apache_content_template() allows creation
of additional derived types for "apache web content". But this is
actually being used to label generic web content, and it creates
additional types based on the prefix.

When we want to support additional web servers (or parsers used by web
servers, such as php-fpm) that do not run within the apache-provided
domains, they have a hard time accessing the data. There is currently
one interface available (apache_manage_all_content) but that is a lot of
privileges for a parser that possibly just needs to read content.

In this patch, we create additional attributes (httpd_ra_content for
read/append data, and httpd_rw_content for read/write content) and
define interfaces to manage the types that have these attributes
assigned.

This is the result of the discussion of June 2012, which was version 3
of the patchset (I never came to finish up the commit), see also
http://oss.tresys.com/pipermail/refpolicy/2012-June/005175.html

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Module version bump for apache content interfaces from Sven Vermeulen.
Label /usr/share/gitweb/static as httpd_git_content_t

This directory contains gitweb static files at least on Debian and ArchLinux.
Module version bump for gitweb fc entry on Debian and ArchLinux from Nicolas Iooss.
Fix strange file patterns

Some file patterns look very strange, like:

    /var/log/cluster/.*\.*log

I've found such patterns while writing a script that parses the file patterns.
Hence I haven't tested if the new file contexts apply to the existing files.
For example, this patch changes

    /var/run/*.fingerd\.pid

to

    /var/run/fingerd\.pid

because "/*" seems weird to me, but this also changes the semantic of the
pattern.  Another possibility which doesn't change the meaning is:

    /var/run/?.fingerd\.pid

I send this patch as an RFC because what I consider abnormal may in fact be
something expected or a workaround to fix some bugs I'm not aware of.
Module version bump for fc regex fixes from Nicolas Iooss.
Fix dbus_all_session_domain(), session_bus_type is an attribute

Fix dbus_all_session_domain(), session_bus_type is an attribute not a
type
Allow gconfd to be started by the session bus

Allow gconfd to be started by the session bus and make it transition to
its own domain.

It also connects to the system bus to listen to signals from
org.gnome.GConf.Defaults interface
Fix the usage of dbus_spec_session_domain() interface

Change the order of the parameters for the calls to
dbus_spec_session_domain() interface.

For consistancy with the other dbus interfaces and the backward
compatibility, we consider that the description was correct and we
change the callers instead.

The order of the parameter for this interface is the following:
 dbus_spec_session_domain(role_prefix, domain, entry_point)
Properly label exim4 initscript under Debian

Keep the same regex expression as for the other filecontexts
Add new gnome_spec_domtrans_all_gkeyringd() interface

Allow the caller to transition to all the gkeyringd domains
Module version bump for various fixes from Laurent Bigonville.
Label /usr/sbin/ModemManager as modemmanager_exec_t

modem-manager executable has been renamed in recent versions (>= 0.7.990)