selinux-policy/fix_userdomain.patch

Index: fedora-policy-20230116/policy/modules/system/userdomain.if
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/userdomain.if
+++ fedora-policy-20230116/policy/modules/system/userdomain.if
@@ -1515,6 +1515,7 @@ tunable_policy(`deny_bluetooth',`',`
 
 	# port access is audited even if dac would not have allowed it, so dontaudit it here
 #	corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
+	corenet_dontaudit_udp_bind_all_rpc_ports($1_t)
 	# Need the following rule to allow users to run vpnc
 	corenet_tcp_bind_xserver_port($1_t)
 	corenet_tcp_bind_generic_node($1_usertype)
Accepting request 1061575 from home:jsegitz:branches:security:SELinux - Update to version 20230125. Refreshed: * distro_suse_to_distro_redhat.patch * fix_dnsmasq.patch * fix_init.patch * fix_ipsec.patch * fix_kernel_sysctl.patch * fix_logging.patch * fix_rpm.patch * fix_selinuxutil.patch * fix_systemd_watch.patch * fix_userdomain.patch - More flexible lib(exec) matching in fix_fwupd.patch - Removed sys_admin for systemd_gpt_generator_t in fix_systemd.patch - Dropped fix_container.patch, is now upstream - Added fix_entropyd.patch * Added new interface entropyd_semaphore_filetrans to properly transfer semaphore created during early boot. That doesn't work yet, so work around with next item * Allow reading tempfs files - Added fix_kernel.patch. Added modutils_execute_kmod_tmpfs_files interace to allow kmod_tmpfs_t files to be executed. Necessary for firewalld - Added fix_rtkit.patch to fix labeling of binary - Modified fix_ntp.patch: * Proper labeling for start-ntpd * Fixed label rules for chroot path * Temporarily allow dac_override for ntpd_t (bsc#1207577) * Add interface ntp_manage_pid_files to allow management of pid files - Updated fix_networkmanager.patch to allow managing ntp pid files OBS-URL: https://build.opensuse.org/request/show/1061575 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=171 2023-01-27 15:51:33 +01:00			`Index: fedora-policy-20230116/policy/modules/system/userdomain.if`
Accepting request 988924 from home:jsegitz:branches:security:SELinux - Update fix_systemd.patch to add sys_admin systemd_gpt_generator_t (bsc#1200911) - postfix: Label PID files and some helpers correctly (bsc#1197242) - Add fix_userdomain.patch to dontaudit UDP rpc ports (bsc#1193984) OBS-URL: https://build.opensuse.org/request/show/988924 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=134 2022-07-13 10:15:29 +02:00			`===================================================================`
Accepting request 1061575 from home:jsegitz:branches:security:SELinux - Update to version 20230125. Refreshed: * distro_suse_to_distro_redhat.patch * fix_dnsmasq.patch * fix_init.patch * fix_ipsec.patch * fix_kernel_sysctl.patch * fix_logging.patch * fix_rpm.patch * fix_selinuxutil.patch * fix_systemd_watch.patch * fix_userdomain.patch - More flexible lib(exec) matching in fix_fwupd.patch - Removed sys_admin for systemd_gpt_generator_t in fix_systemd.patch - Dropped fix_container.patch, is now upstream - Added fix_entropyd.patch * Added new interface entropyd_semaphore_filetrans to properly transfer semaphore created during early boot. That doesn't work yet, so work around with next item * Allow reading tempfs files - Added fix_kernel.patch. Added modutils_execute_kmod_tmpfs_files interace to allow kmod_tmpfs_t files to be executed. Necessary for firewalld - Added fix_rtkit.patch to fix labeling of binary - Modified fix_ntp.patch: * Proper labeling for start-ntpd * Fixed label rules for chroot path * Temporarily allow dac_override for ntpd_t (bsc#1207577) * Add interface ntp_manage_pid_files to allow management of pid files - Updated fix_networkmanager.patch to allow managing ntp pid files OBS-URL: https://build.opensuse.org/request/show/1061575 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=171 2023-01-27 15:51:33 +01:00			`--- fedora-policy-20230116.orig/policy/modules/system/userdomain.if`
			`+++ fedora-policy-20230116/policy/modules/system/userdomain.if`
			@@ -1515,6 +1515,7 @@ tunable_policy(`deny_bluetooth',`',`
Accepting request 988924 from home:jsegitz:branches:security:SELinux - Update fix_systemd.patch to add sys_admin systemd_gpt_generator_t (bsc#1200911) - postfix: Label PID files and some helpers correctly (bsc#1197242) - Add fix_userdomain.patch to dontaudit UDP rpc ports (bsc#1193984) OBS-URL: https://build.opensuse.org/request/show/988924 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=134 2022-07-13 10:15:29 +02:00
			`# port access is audited even if dac would not have allowed it, so dontaudit it here`
			`# corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)`
			`+ corenet_dontaudit_udp_bind_all_rpc_ports($1_t)`
			`# Need the following rule to allow users to run vpnc`
			`corenet_tcp_bind_xserver_port($1_t)`
			`corenet_tcp_bind_generic_node($1_usertype)`