Lucid SELinux Policy Update

[Steve Lawrence]

Attached are two patches to update the SELinux policy for Ubuntu Lucid
Lynx.

The first patch applies to the repolicy-ubuntu package. This updates the
policy to the latest reference policy (2.20091117) and updates the
debian/patches to fix ubunutu specific policy issues. The majority of
the issues revolved around dbus starting various processes and ensuring
they transition to the correct domain.

The second patch applies to the selinux package. This adds two upstart
scripts to ensure that /var/run and /var/lock are relabeled once they
are mounted so they get the correct labels (var_run_t and var_lock_t
instead of tmpfs_t).

[Kees Cook (kees)]

Great! I've updated the packaging for refpolicy-ubuntu to use the upstream bz2 file, and tweaked the selinux restorecon calls a little more. These changes make a large positive difference on the boot warnings now; down to just a handful instead of hundreds. Thanks!

[Kees Cook (kees)]

Regression potential is low, since it doesn't actually work very well without these updates.

[Launchpad Janitor (janitor)]

This bug was fixed in the package selinux - 1:0.9

---------------
selinux (1:0.9) lucid; urgency=low

  * mounted-var{run,lock}.upstart, Makefile: add more restorecon
    calls for tmpfs filesystems, thanks to Stephen Lawrence (LP: #568744).
 -- Kees Cook <email address hidden> Thu, 22 Apr 2010 16:58:14 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package refpolicy-ubuntu - 0.2.20091117-0ubuntu1

---------------
refpolicy-ubuntu (0.2.20091117-0ubuntu1) lucid; urgency=low

  * New upstream release, converted to source format 3.
  * Updated Ubuntu-specific patches thanks to Steve Lawrence (LP: #568744).
  * Extracted Makefile change to debian/patches/bashisms.patch.
 -- Kees Cook <email address hidden> Thu, 22 Apr 2010 17:10:43 -0700