Updating link to change in openSUSE:Factory/selinux-policy revision 35
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=74bbc58f85e33fdb068953a18504e591
This commit is contained in:
parent
71b9302857
commit
124e8026e4
@ -1,8 +1,7 @@
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/apache.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/apache.fc
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/apache.fc
|
||||
@@ -74,7 +74,7 @@ HOME_DIR/((www)|(web)|(public_html))(/.*
|
||||
diff -r -u fedora-policy-20220714/policy/modules/contrib/apache.fc fedora-policy-20220714_changed/policy/modules/contrib/apache.fc
|
||||
--- fedora-policy-20220714/policy/modules/contrib/apache.fc 2022-07-14 10:41:34.267983097 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/contrib/apache.fc 2022-09-30 09:07:02.245313656 +0200
|
||||
@@ -74,7 +74,7 @@
|
||||
/usr/sbin/suexec -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0)
|
||||
/usr/sbin/thttpd -- gen_context(system_u:object_r:httpd_exec_t,s0)
|
||||
|
||||
@ -11,11 +10,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/apache.fc
|
||||
/usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0)
|
||||
')
|
||||
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/cron.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/cron.fc
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/cron.fc
|
||||
@@ -51,7 +51,7 @@ ifdef(`distro_gentoo',`
|
||||
diff -r -u fedora-policy-20220714/policy/modules/contrib/cron.fc fedora-policy-20220714_changed/policy/modules/contrib/cron.fc
|
||||
--- fedora-policy-20220714/policy/modules/contrib/cron.fc 2022-07-14 10:41:34.279983278 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/contrib/cron.fc 2022-09-30 09:07:01.465301514 +0200
|
||||
@@ -51,7 +51,7 @@
|
||||
/var/spool/cron/lastrun/[^/]* -- <<none>>
|
||||
')
|
||||
|
||||
@ -24,7 +22,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/cron.fc
|
||||
/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
|
||||
/var/spool/cron/lastrun/[^/]* -- <<none>>
|
||||
/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
|
||||
@@ -70,7 +70,7 @@ ifdef(`distro_gentoo',`
|
||||
@@ -70,7 +70,7 @@
|
||||
/var/spool/cron/lastrun/[^/]* -- <<none>>
|
||||
')
|
||||
|
||||
@ -33,11 +31,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/cron.fc
|
||||
/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
|
||||
/var/spool/cron/lastrun/[^/]* -- <<none>>
|
||||
/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/rpm.fc
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/rpm.fc
|
||||
@@ -80,7 +80,7 @@ ifdef(`distro_redhat', `
|
||||
diff -r -u fedora-policy-20220714/policy/modules/contrib/rpm.fc fedora-policy-20220714_changed/policy/modules/contrib/rpm.fc
|
||||
--- fedora-policy-20220714/policy/modules/contrib/rpm.fc 2022-07-14 10:41:34.315983821 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/contrib/rpm.fc 2022-09-30 09:07:01.713305375 +0200
|
||||
@@ -79,7 +79,7 @@
|
||||
/var/run/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_run_t,s0)
|
||||
|
||||
# SuSE
|
||||
@ -46,11 +43,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc
|
||||
/usr/bin/online_update -- gen_context(system_u:object_r:rpm_exec_t,s0)
|
||||
/sbin/yast2 -- gen_context(system_u:object_r:rpm_exec_t,s0)
|
||||
/var/lib/YaST2(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
|
||||
Index: fedora-policy-20221019/policy/modules/kernel/corecommands.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/kernel/corecommands.fc
|
||||
+++ fedora-policy-20221019/policy/modules/kernel/corecommands.fc
|
||||
@@ -462,7 +462,7 @@ ifdef(`distro_redhat', `
|
||||
diff -r -u fedora-policy-20220714/policy/modules/kernel/corecommands.fc fedora-policy-20220714_changed/policy/modules/kernel/corecommands.fc
|
||||
--- fedora-policy-20220714/policy/modules/kernel/corecommands.fc 2022-07-14 10:41:34.327984002 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/kernel/corecommands.fc 2022-09-30 09:07:01.273298522 +0200
|
||||
@@ -462,7 +462,7 @@
|
||||
/usr/share/texmf/texconfig/tcfmgr -- gen_context(system_u:object_r:bin_t,s0)
|
||||
')
|
||||
|
||||
@ -59,7 +55,7 @@ Index: fedora-policy-20221019/policy/modules/kernel/corecommands.fc
|
||||
/usr/lib/cron/run-crons -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib/samba/classic/.* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib/ssh/.* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
@@ -491,7 +491,7 @@ ifdef(`distro_suse', `
|
||||
@@ -491,7 +491,7 @@
|
||||
/var/lib/glusterd/hooks/.*/.*\.sh -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/var/lib/glusterd/hooks/.*/.*\.py -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
||||
@ -68,10 +64,9 @@ Index: fedora-policy-20221019/policy/modules/kernel/corecommands.fc
|
||||
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
|
||||
')
|
||||
|
||||
Index: fedora-policy-20221019/policy/modules/kernel/devices.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/kernel/devices.fc
|
||||
+++ fedora-policy-20221019/policy/modules/kernel/devices.fc
|
||||
diff -r -u fedora-policy-20220714/policy/modules/kernel/devices.fc fedora-policy-20220714_changed/policy/modules/kernel/devices.fc
|
||||
--- fedora-policy-20220714/policy/modules/kernel/devices.fc 2022-07-14 10:41:34.327984002 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/kernel/devices.fc 2022-09-30 09:07:01.265298397 +0200
|
||||
@@ -148,7 +148,7 @@
|
||||
/dev/usb.+ -c gen_context(system_u:object_r:usb_device_t,s0)
|
||||
/dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0)
|
||||
@ -81,11 +76,10 @@ Index: fedora-policy-20221019/policy/modules/kernel/devices.fc
|
||||
/dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0)
|
||||
')
|
||||
/dev/vmci -c gen_context(system_u:object_r:vmci_device_t,s0)
|
||||
Index: fedora-policy-20221019/policy/modules/kernel/files.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/kernel/files.fc
|
||||
+++ fedora-policy-20221019/policy/modules/kernel/files.fc
|
||||
@@ -22,7 +22,7 @@ ifdef(`distro_redhat',`
|
||||
diff -r -u fedora-policy-20220714/policy/modules/kernel/files.fc fedora-policy-20220714_changed/policy/modules/kernel/files.fc
|
||||
--- fedora-policy-20220714/policy/modules/kernel/files.fc 2022-07-14 10:41:34.331984062 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/kernel/files.fc 2022-09-30 09:07:01.289298772 +0200
|
||||
@@ -22,7 +22,7 @@
|
||||
/[^/]+ -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
||||
')
|
||||
|
||||
@ -94,7 +88,7 @@ Index: fedora-policy-20221019/policy/modules/kernel/files.fc
|
||||
/success -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
||||
')
|
||||
|
||||
@@ -92,7 +92,7 @@ ifdef(`distro_gentoo', `
|
||||
@@ -92,7 +92,7 @@
|
||||
/etc/env\.d/.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
||||
')
|
||||
|
||||
@ -103,11 +97,10 @@ Index: fedora-policy-20221019/policy/modules/kernel/files.fc
|
||||
/etc/defkeymap\.map -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
||||
/etc/rc\.d/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
||||
')
|
||||
Index: fedora-policy-20221019/policy/modules/services/xserver.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/services/xserver.fc
|
||||
+++ fedora-policy-20221019/policy/modules/services/xserver.fc
|
||||
@@ -189,7 +189,7 @@ ifndef(`distro_debian',`
|
||||
diff -r -u fedora-policy-20220714/policy/modules/services/xserver.fc fedora-policy-20220714_changed/policy/modules/services/xserver.fc
|
||||
--- fedora-policy-20220714/policy/modules/services/xserver.fc 2022-07-14 10:41:34.335984123 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/services/xserver.fc 2022-09-30 09:07:02.689320566 +0200
|
||||
@@ -189,7 +189,7 @@
|
||||
/var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0)
|
||||
/var/run/systemd/multi-session-x(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
|
||||
|
||||
@ -116,11 +109,10 @@ Index: fedora-policy-20221019/policy/modules/services/xserver.fc
|
||||
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
||||
')
|
||||
|
||||
Index: fedora-policy-20221019/policy/modules/system/authlogin.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/authlogin.fc
|
||||
+++ fedora-policy-20221019/policy/modules/system/authlogin.fc
|
||||
@@ -31,7 +31,7 @@ HOME_DIR/\.google_authenticator~ gen_co
|
||||
diff -r -u fedora-policy-20220714/policy/modules/system/authlogin.fc fedora-policy-20220714_changed/policy/modules/system/authlogin.fc
|
||||
--- fedora-policy-20220714/policy/modules/system/authlogin.fc 2022-07-14 10:41:34.335984123 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/system/authlogin.fc 2022-09-30 09:07:02.761321686 +0200
|
||||
@@ -31,7 +31,7 @@
|
||||
/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
|
||||
/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
|
||||
/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
|
||||
@ -129,11 +121,10 @@ Index: fedora-policy-20221019/policy/modules/system/authlogin.fc
|
||||
/sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
|
||||
')
|
||||
|
||||
Index: fedora-policy-20221019/policy/modules/system/init.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/init.fc
|
||||
+++ fedora-policy-20221019/policy/modules/system/init.fc
|
||||
@@ -92,7 +92,7 @@ ifdef(`distro_gentoo', `
|
||||
diff -r -u fedora-policy-20220714/policy/modules/system/init.fc fedora-policy-20220714_changed/policy/modules/system/init.fc
|
||||
--- fedora-policy-20220714/policy/modules/system/init.fc 2022-07-14 10:41:34.335984123 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/system/init.fc 2022-09-30 09:07:02.701320753 +0200
|
||||
@@ -92,7 +92,7 @@
|
||||
/var/run/svscan\.pid -- gen_context(system_u:object_r:initrc_var_run_t,s0)
|
||||
')
|
||||
|
||||
@ -142,11 +133,10 @@ Index: fedora-policy-20221019/policy/modules/system/init.fc
|
||||
/var/run/bootsplashctl -p gen_context(system_u:object_r:initrc_var_run_t,s0)
|
||||
/var/run/keymap -- gen_context(system_u:object_r:initrc_var_run_t,s0)
|
||||
/var/run/numlock-on -- gen_context(system_u:object_r:initrc_var_run_t,s0)
|
||||
Index: fedora-policy-20221019/policy/modules/system/init.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/init.te
|
||||
+++ fedora-policy-20221019/policy/modules/system/init.te
|
||||
@@ -1334,7 +1334,7 @@ ifdef(`distro_redhat',`
|
||||
diff -r -u fedora-policy-20220714/policy/modules/system/init.te fedora-policy-20220714_changed/policy/modules/system/init.te
|
||||
--- fedora-policy-20220714/policy/modules/system/init.te 2022-07-14 10:41:34.335984123 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/system/init.te 2022-09-30 09:07:02.725321126 +0200
|
||||
@@ -1330,7 +1330,7 @@
|
||||
')
|
||||
')
|
||||
|
||||
@ -155,11 +145,10 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
|
||||
optional_policy(`
|
||||
# set permissions on /tmp/.X11-unix
|
||||
xserver_setattr_xdm_tmp_dirs(initrc_t)
|
||||
Index: fedora-policy-20221019/policy/modules/system/libraries.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/libraries.fc
|
||||
+++ fedora-policy-20221019/policy/modules/system/libraries.fc
|
||||
@@ -329,7 +329,7 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_
|
||||
diff -r -u fedora-policy-20220714/policy/modules/system/libraries.fc fedora-policy-20220714_changed/policy/modules/system/libraries.fc
|
||||
--- fedora-policy-20220714/policy/modules/system/libraries.fc 2022-07-14 10:41:34.335984123 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/system/libraries.fc 2022-09-30 09:07:02.709320877 +0200
|
||||
@@ -329,7 +329,7 @@
|
||||
/var/lib/spamassassin/compiled/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
|
||||
/usr/lib/xfce4/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
|
||||
|
||||
@ -168,11 +157,10 @@ Index: fedora-policy-20221019/policy/modules/system/libraries.fc
|
||||
/var/lib/samba/bin/.+\.so(\.[^/]*)* -l gen_context(system_u:object_r:lib_t,s0)
|
||||
')
|
||||
|
||||
Index: fedora-policy-20221019/policy/modules/system/locallogin.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/locallogin.te
|
||||
+++ fedora-policy-20221019/policy/modules/system/locallogin.te
|
||||
@@ -274,7 +274,7 @@ ifdef(`enable_mls',`
|
||||
diff -r -u fedora-policy-20220714/policy/modules/system/locallogin.te fedora-policy-20220714_changed/policy/modules/system/locallogin.te
|
||||
--- fedora-policy-20220714/policy/modules/system/locallogin.te 2022-07-14 10:41:34.335984123 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/system/locallogin.te 2022-09-30 09:07:02.757321625 +0200
|
||||
@@ -274,7 +274,7 @@
|
||||
')
|
||||
|
||||
# suse and debian do not use pam with sulogin...
|
||||
@ -181,10 +169,9 @@ Index: fedora-policy-20221019/policy/modules/system/locallogin.te
|
||||
ifdef(`distro_debian', `define(`sulogin_no_pam')')
|
||||
|
||||
allow sulogin_t self:capability sys_tty_config;
|
||||
Index: fedora-policy-20221019/policy/modules/system/logging.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/logging.fc
|
||||
+++ fedora-policy-20221019/policy/modules/system/logging.fc
|
||||
diff -r -u fedora-policy-20220714/policy/modules/system/logging.fc fedora-policy-20220714_changed/policy/modules/system/logging.fc
|
||||
--- fedora-policy-20220714/policy/modules/system/logging.fc 2022-07-14 10:41:34.335984123 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/system/logging.fc 2022-09-30 09:07:02.757321625 +0200
|
||||
@@ -46,7 +46,7 @@
|
||||
/var/lib/r?syslog(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,mls_systemhigh)
|
||||
/var/lib/syslog-ng.persist -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
|
||||
@ -194,11 +181,10 @@ Index: fedora-policy-20221019/policy/modules/system/logging.fc
|
||||
/var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
|
||||
')
|
||||
|
||||
Index: fedora-policy-20221019/policy/modules/system/logging.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/logging.te
|
||||
+++ fedora-policy-20221019/policy/modules/system/logging.te
|
||||
@@ -682,7 +682,7 @@ ifdef(`distro_gentoo',`
|
||||
diff -r -u fedora-policy-20220714/policy/modules/system/logging.te fedora-policy-20220714_changed/policy/modules/system/logging.te
|
||||
--- fedora-policy-20220714/policy/modules/system/logging.te 2022-07-14 10:41:34.335984123 +0200
|
||||
+++ fedora-policy-20220714_changed/policy/modules/system/logging.te 2022-09-30 09:07:02.709320877 +0200
|
||||
@@ -674,7 +674,7 @@
|
||||
term_dontaudit_setattr_unallocated_ttys(syslogd_t)
|
||||
')
|
||||
|
||||
|
@ -1,41 +0,0 @@
|
||||
Index: fedora-policy-20221019/policy/modules/services/xserver.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/services/xserver.te
|
||||
+++ fedora-policy-20221019/policy/modules/services/xserver.te
|
||||
@@ -764,6 +764,10 @@ userdom_mounton_tmp_sockets(xdm_t)
|
||||
userdom_nnp_transition_login_userdomain(xdm_t)
|
||||
userdom_watch_user_home_dirs(xdm_t)
|
||||
|
||||
+# SUSE uses startproc to start the display manager. While checking for running processes
|
||||
+# it goes over all running instances, triggering AVCs
|
||||
+modutils_dontaudit_kmod_tmpfs_getattr(xdm_t)
|
||||
+
|
||||
#userdom_home_manager(xdm_t)
|
||||
tunable_policy(`xdm_write_home',`
|
||||
userdom_user_home_dir_filetrans(xdm_t, xdm_home_t, { file lnk_file })
|
||||
Index: fedora-policy-20221019/policy/modules/system/modutils.if
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/modutils.if
|
||||
+++ fedora-policy-20221019/policy/modules/system/modutils.if
|
||||
@@ -507,3 +507,21 @@ interface(`modules_filetrans_named_conte
|
||||
#files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.symbols")
|
||||
#files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.symbols.bin")
|
||||
')
|
||||
+
|
||||
+#######################################
|
||||
+## <summary>
|
||||
+## Don't audit accesses to tmp file type.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`modutils_dontaudit_kmod_tmpfs_getattr',`
|
||||
+ gen_require(`
|
||||
+ type kmod_tmpfs_t;
|
||||
+ ')
|
||||
+
|
||||
+ dontaudit $1 kmod_tmpfs_t:file { getattr };
|
||||
+')
|
3
fedora-policy-20220714.tar.bz2
Normal file
3
fedora-policy-20220714.tar.bz2
Normal file
@ -0,0 +1,3 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:dc7e16b718c4b36fc790d0e55a41fb18226a17e8b5e079afe127e611d16276a9
|
||||
size 731294
|
@ -1,3 +0,0 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:e2cfe78d728e0b94dfbdc81413f6ede0a0f0e6064de4f6628fa7328d1f4d2ede
|
||||
size 733130
|
@ -1,15 +0,0 @@
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/alsa.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/alsa.te
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/alsa.te
|
||||
@@ -104,6 +104,10 @@ userdom_manage_unpriv_user_semaphores(al
|
||||
userdom_manage_unpriv_user_shared_mem(alsa_t)
|
||||
userdom_search_user_home_dirs(alsa_t)
|
||||
|
||||
+optional_policy(`
|
||||
+ gnome_read_home_config(alsa_t)
|
||||
+')
|
||||
+
|
||||
ifdef(`distro_debian',`
|
||||
term_dontaudit_use_unallocated_ttys(alsa_t)
|
||||
|
@ -1,10 +1,10 @@
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/apache.if
|
||||
Index: fedora-policy-20220428/policy/modules/contrib/apache.if
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/apache.if
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/apache.if
|
||||
@@ -2007,3 +2007,25 @@ interface(`apache_read_semaphores',`
|
||||
--- fedora-policy-20220428.orig/policy/modules/contrib/apache.if
|
||||
+++ fedora-policy-20220428/policy/modules/contrib/apache.if
|
||||
@@ -1989,3 +1989,25 @@ interface(`apache_ioctl_stream_sockets',
|
||||
|
||||
allow $1 httpd_t:sem r_sem_perms;
|
||||
allow $1 httpd_t:unix_stream_socket ioctl;
|
||||
')
|
||||
+
|
||||
+#######################################
|
||||
|
@ -1,8 +1,8 @@
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/chronyd.te
|
||||
Index: fedora-policy-20220714/policy/modules/contrib/chronyd.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/chronyd.te
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/chronyd.te
|
||||
@@ -144,6 +144,14 @@ systemd_exec_systemctl(chronyd_t)
|
||||
--- fedora-policy-20220714.orig/policy/modules/contrib/chronyd.te
|
||||
+++ fedora-policy-20220714/policy/modules/contrib/chronyd.te
|
||||
@@ -141,6 +141,14 @@ systemd_exec_systemctl(chronyd_t)
|
||||
userdom_dgram_send(chronyd_t)
|
||||
|
||||
optional_policy(`
|
||||
@ -17,10 +17,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/chronyd.te
|
||||
cron_dgram_send(chronyd_t)
|
||||
')
|
||||
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/chronyd.fc
|
||||
Index: fedora-policy-20220714/policy/modules/contrib/chronyd.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/chronyd.fc
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/chronyd.fc
|
||||
--- fedora-policy-20220714.orig/policy/modules/contrib/chronyd.fc
|
||||
+++ fedora-policy-20220714/policy/modules/contrib/chronyd.fc
|
||||
@@ -6,6 +6,8 @@
|
||||
|
||||
/usr/sbin/chronyd -- gen_context(system_u:object_r:chronyd_exec_t,s0)
|
||||
|
47
fix_cockpit.patch
Normal file
47
fix_cockpit.patch
Normal file
@ -0,0 +1,47 @@
|
||||
From d63e6cf43bfe32d53b371b6920d4c09431647ddd Mon Sep 17 00:00:00 2001
|
||||
From: Ludwig Nussel <ludwig.nussel@suse.de>
|
||||
Date: Wed, 28 Apr 2021 17:09:49 +0200
|
||||
Subject: [PATCH] cockpit: allow cockpit socket to bind nodes
|
||||
|
||||
Looks like this setting is implicit with kerberos enabled.
|
||||
cockpit.socket fails to start if kerberos_enabled=false
|
||||
---
|
||||
policy/modules/contrib/cockpit.te | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
Index: fedora-policy-20210716/policy/modules/contrib/cockpit.te
|
||||
===================================================================
|
||||
--- fedora-policy-20210716.orig/policy/modules/contrib/cockpit.te
|
||||
+++ fedora-policy-20210716/policy/modules/contrib/cockpit.te
|
||||
@@ -51,7 +51,9 @@ can_exec(cockpit_ws_t,cockpit_session_ex
|
||||
dev_read_urand(cockpit_ws_t) # for authkey
|
||||
dev_read_rand(cockpit_ws_t) # for libssh
|
||||
|
||||
+# cockpit-ws allows connections on websm port
|
||||
corenet_tcp_bind_websm_port(cockpit_ws_t)
|
||||
+corenet_tcp_bind_generic_node(cockpit_ws_t)
|
||||
|
||||
# cockpit-ws can connect to other hosts via ssh
|
||||
corenet_tcp_connect_ssh_port(cockpit_ws_t)
|
||||
Index: fedora-policy-20210716/policy/modules/contrib/cockpit.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20210716.orig/policy/modules/contrib/cockpit.fc
|
||||
+++ fedora-policy-20210716/policy/modules/contrib/cockpit.fc
|
||||
@@ -3,12 +3,12 @@
|
||||
/usr/lib/systemd/system/cockpit.* -- gen_context(system_u:object_r:cockpit_unit_file_t,s0)
|
||||
/etc/systemd/system/cockpit.* -- gen_context(system_u:object_r:cockpit_unit_file_t,s0)
|
||||
|
||||
-/usr/libexec/cockpit-ws -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
|
||||
-/usr/libexec/cockpit-tls -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
|
||||
-/usr/libexec/cockpit-wsinstance-factory -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
|
||||
+/usr/lib(exec)?/cockpit-ws -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
|
||||
+/usr/lib(exec)?/cockpit-tls -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
|
||||
+/usr/lib(exec)?/cockpit-wsinstance-factory -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
|
||||
|
||||
-/usr/libexec/cockpit-session -- gen_context(system_u:object_r:cockpit_session_exec_t,s0)
|
||||
-/usr/libexec/cockpit-ssh -- gen_context(system_u:object_r:cockpit_session_exec_t,s0)
|
||||
+/usr/lib(exec)?/cockpit-session -- gen_context(system_u:object_r:cockpit_session_exec_t,s0)
|
||||
+/usr/lib(exec)?/cockpit-ssh -- gen_context(system_u:object_r:cockpit_session_exec_t,s0)
|
||||
|
||||
/usr/share/cockpit/motd/update-motd -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0)
|
||||
|
@ -1,7 +1,7 @@
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/cron.fc
|
||||
Index: fedora-policy-20220714/policy/modules/contrib/cron.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/cron.fc
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/cron.fc
|
||||
--- fedora-policy-20220714.orig/policy/modules/contrib/cron.fc
|
||||
+++ fedora-policy-20220714/policy/modules/contrib/cron.fc
|
||||
@@ -34,7 +34,7 @@
|
||||
|
||||
/var/spool/cron -d gen_context(system_u:object_r:user_cron_spool_t,s0)
|
||||
@ -32,11 +32,11 @@ Index: fedora-policy-20221019/policy/modules/contrib/cron.fc
|
||||
-/var/spool/cron/lastrun/[^/]* -- <<none>>
|
||||
-/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
|
||||
-')
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/cron.if
|
||||
Index: fedora-policy-20220714/policy/modules/contrib/cron.if
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/cron.if
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/cron.if
|
||||
@@ -1075,7 +1075,7 @@ interface(`cron_generic_log_filetrans_lo
|
||||
--- fedora-policy-20220714.orig/policy/modules/contrib/cron.if
|
||||
+++ fedora-policy-20220714/policy/modules/contrib/cron.if
|
||||
@@ -1057,7 +1057,7 @@ interface(`cron_generic_log_filetrans_lo
|
||||
#
|
||||
interface(`cron_system_spool_entrypoint',`
|
||||
gen_require(`
|
||||
|
@ -1,8 +1,17 @@
|
||||
Index: fedora-policy-20221019/policy/modules/system/init.te
|
||||
Index: fedora-policy-20220714/policy/modules/system/init.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/init.te
|
||||
+++ fedora-policy-20221019/policy/modules/system/init.te
|
||||
@@ -269,6 +269,8 @@ corecmd_exec_bin(init_t)
|
||||
--- fedora-policy-20220714.orig/policy/modules/system/init.te
|
||||
+++ fedora-policy-20220714/policy/modules/system/init.te
|
||||
@@ -187,6 +187,8 @@ allow init_t self:bpf { map_create map_r
|
||||
# setuid (from /sbin/shutdown)
|
||||
# sys_chroot (from /usr/bin/chroot): now provided by corecmd_chroot_exec_chroot()
|
||||
|
||||
+# bsc#1197610, find a better, generic solution
|
||||
+allow init_t self:file mounton;
|
||||
allow init_t self:fifo_file rw_fifo_file_perms;
|
||||
|
||||
allow init_t self:service manage_service_perms;
|
||||
@@ -267,6 +269,8 @@ corecmd_exec_bin(init_t)
|
||||
corenet_all_recvfrom_netlabel(init_t)
|
||||
corenet_tcp_bind_all_ports(init_t)
|
||||
corenet_udp_bind_all_ports(init_t)
|
||||
@ -11,7 +20,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
|
||||
|
||||
dev_create_all_files(init_t)
|
||||
dev_create_all_chr_files(init_t)
|
||||
@@ -398,6 +400,7 @@ logging_manage_audit_config(init_t)
|
||||
@@ -396,6 +400,7 @@ logging_manage_audit_config(init_t)
|
||||
logging_create_syslog_netlink_audit_socket(init_t)
|
||||
logging_write_var_log_dirs(init_t)
|
||||
logging_manage_var_log_symlinks(init_t)
|
||||
@ -19,7 +28,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
|
||||
|
||||
seutil_read_config(init_t)
|
||||
seutil_read_login_config(init_t)
|
||||
@@ -450,9 +453,19 @@ ifdef(`distro_redhat',`
|
||||
@@ -448,9 +453,19 @@ ifdef(`distro_redhat',`
|
||||
corecmd_shell_domtrans(init_t, initrc_t)
|
||||
|
||||
storage_raw_rw_fixed_disk(init_t)
|
||||
@ -39,7 +48,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
|
||||
optional_policy(`
|
||||
anaconda_stream_connect(init_t)
|
||||
anaconda_create_unix_stream_sockets(init_t)
|
||||
@@ -584,10 +597,10 @@ tunable_policy(`init_audit_control',`
|
||||
@@ -581,10 +596,10 @@ tunable_policy(`init_audit_control',`
|
||||
allow init_t self:system all_system_perms;
|
||||
allow init_t self:system module_load;
|
||||
allow init_t self:unix_dgram_socket { create_socket_perms sendto };
|
||||
@ -52,7 +61,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
|
||||
allow init_t self:netlink_selinux_socket create_socket_perms;
|
||||
allow init_t self:unix_dgram_socket lock;
|
||||
# Until systemd is fixed
|
||||
@@ -647,6 +660,7 @@ files_delete_all_spool_sockets(init_t)
|
||||
@@ -643,6 +658,7 @@ files_delete_all_spool_sockets(init_t)
|
||||
files_create_var_lib_dirs(init_t)
|
||||
files_create_var_lib_symlinks(init_t)
|
||||
files_read_var_lib_symlinks(init_t)
|
||||
@ -60,7 +69,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
|
||||
files_manage_urandom_seed(init_t)
|
||||
files_list_locks(init_t)
|
||||
files_list_spool(init_t)
|
||||
@@ -684,7 +698,7 @@ fs_list_all(init_t)
|
||||
@@ -680,7 +696,7 @@ fs_list_all(init_t)
|
||||
fs_list_auto_mountpoints(init_t)
|
||||
fs_register_binary_executable_type(init_t)
|
||||
fs_relabel_tmpfs_sock_file(init_t)
|
||||
@ -69,7 +78,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
|
||||
fs_relabel_cgroup_dirs(init_t)
|
||||
fs_search_cgroup_dirs(init_t)
|
||||
# for network namespaces
|
||||
@@ -740,6 +754,7 @@ systemd_write_inherited_logind_sessions_
|
||||
@@ -736,6 +752,7 @@ systemd_write_inherited_logind_sessions_
|
||||
create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
|
||||
|
||||
create_dirs_pattern(init_t, var_log_t, var_log_t)
|
||||
@ -77,7 +86,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
|
||||
|
||||
auth_use_nsswitch(init_t)
|
||||
auth_rw_login_records(init_t)
|
||||
@@ -1596,6 +1611,8 @@ optional_policy(`
|
||||
@@ -1590,6 +1607,8 @@ optional_policy(`
|
||||
|
||||
optional_policy(`
|
||||
postfix_list_spool(initrc_t)
|
||||
|
@ -1,7 +1,7 @@
|
||||
Index: fedora-policy-20221019/policy/modules/kernel/files.fc
|
||||
Index: fedora-policy-20220624/policy/modules/kernel/files.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/kernel/files.fc
|
||||
+++ fedora-policy-20221019/policy/modules/kernel/files.fc
|
||||
--- fedora-policy-20220624.orig/policy/modules/kernel/files.fc
|
||||
+++ fedora-policy-20220624/policy/modules/kernel/files.fc
|
||||
@@ -242,6 +242,8 @@ ifdef(`distro_redhat',`
|
||||
/usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0)
|
||||
/usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0)
|
||||
@ -11,11 +11,11 @@ Index: fedora-policy-20221019/policy/modules/kernel/files.fc
|
||||
|
||||
/usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
|
||||
|
||||
Index: fedora-policy-20221019/policy/modules/system/systemd.te
|
||||
Index: fedora-policy-20220624/policy/modules/system/systemd.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/systemd.te
|
||||
+++ fedora-policy-20221019/policy/modules/system/systemd.te
|
||||
@@ -1105,6 +1105,8 @@ init_stream_connect(systemd_sysctl_t)
|
||||
--- fedora-policy-20220624.orig/policy/modules/system/systemd.te
|
||||
+++ fedora-policy-20220624/policy/modules/system/systemd.te
|
||||
@@ -1052,6 +1052,8 @@ init_stream_connect(systemd_sysctl_t)
|
||||
logging_send_syslog_msg(systemd_sysctl_t)
|
||||
|
||||
systemd_read_efivarfs(systemd_sysctl_t)
|
||||
|
@ -1,8 +1,8 @@
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
|
||||
Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.te
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/networkmanager.te
|
||||
@@ -275,6 +275,9 @@ userdom_read_home_certs(NetworkManager_t
|
||||
--- fedora-policy-20220714.orig/policy/modules/contrib/networkmanager.te
|
||||
+++ fedora-policy-20220714/policy/modules/contrib/networkmanager.te
|
||||
@@ -276,6 +276,9 @@ userdom_read_home_certs(NetworkManager_t
|
||||
userdom_read_user_home_content_files(NetworkManager_t)
|
||||
userdom_dgram_send(NetworkManager_t)
|
||||
|
||||
@ -12,18 +12,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
|
||||
tunable_policy(`use_nfs_home_dirs',`
|
||||
fs_read_nfs_files(NetworkManager_t)
|
||||
')
|
||||
@@ -284,6 +287,10 @@ tunable_policy(`use_samba_home_dirs',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
+ nis_systemctl_ypbind(NetworkManager_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
avahi_domtrans(NetworkManager_t)
|
||||
avahi_kill(NetworkManager_t)
|
||||
avahi_signal(NetworkManager_t)
|
||||
@@ -292,6 +299,14 @@ optional_policy(`
|
||||
@@ -293,6 +296,14 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -38,7 +27,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
|
||||
bind_domtrans(NetworkManager_t)
|
||||
bind_manage_cache(NetworkManager_t)
|
||||
bind_kill(NetworkManager_t)
|
||||
@@ -419,6 +434,8 @@ optional_policy(`
|
||||
@@ -420,6 +431,8 @@ optional_policy(`
|
||||
nscd_kill(NetworkManager_t)
|
||||
nscd_initrc_domtrans(NetworkManager_t)
|
||||
nscd_systemctl(NetworkManager_t)
|
||||
@ -47,7 +36,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -606,6 +623,7 @@ files_manage_etc_files(NetworkManager_di
|
||||
@@ -602,6 +615,7 @@ files_manage_etc_files(NetworkManager_di
|
||||
|
||||
init_status(NetworkManager_dispatcher_cloud_t)
|
||||
init_status(NetworkManager_dispatcher_ddclient_t)
|
||||
@ -55,21 +44,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
|
||||
init_append_stream_sockets(networkmanager_dispatcher_plugin)
|
||||
init_ioctl_stream_sockets(networkmanager_dispatcher_plugin)
|
||||
init_stream_connect(networkmanager_dispatcher_plugin)
|
||||
@@ -621,6 +639,10 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
+ nscd_shm_use(NetworkManager_dispatcher_chronyc_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
cloudform_init_domtrans(NetworkManager_dispatcher_cloud_t)
|
||||
')
|
||||
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.if
|
||||
Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.if
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.if
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/networkmanager.if
|
||||
--- fedora-policy-20220714.orig/policy/modules/contrib/networkmanager.if
|
||||
+++ fedora-policy-20220714/policy/modules/contrib/networkmanager.if
|
||||
@@ -132,6 +132,24 @@ interface(`networkmanager_initrc_domtran
|
||||
init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t)
|
||||
')
|
||||
@ -95,10 +73,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.if
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute NetworkManager server in the NetworkManager domain.
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.fc
|
||||
Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.fc
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/networkmanager.fc
|
||||
--- fedora-policy-20220714.orig/policy/modules/contrib/networkmanager.fc
|
||||
+++ fedora-policy-20220714/policy/modules/contrib/networkmanager.fc
|
||||
@@ -24,6 +24,7 @@
|
||||
/usr/lib/NetworkManager/dispatcher\.d/04-iscsi -- gen_context(system_u:object_r:NetworkManager_dispatcher_iscsid_script_t,s0)
|
||||
/usr/lib/NetworkManager/dispatcher\.d/10-sendmail -- gen_context(system_u:object_r:NetworkManager_dispatcher_sendmail_script_t,s0)
|
||||
|
@ -1,7 +1,7 @@
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/postfix.fc
|
||||
Index: fedora-policy-20220624/policy/modules/contrib/postfix.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/postfix.fc
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/postfix.fc
|
||||
--- fedora-policy-20220624.orig/policy/modules/contrib/postfix.fc
|
||||
+++ fedora-policy-20220624/policy/modules/contrib/postfix.fc
|
||||
@@ -1,37 +1,21 @@
|
||||
# postfix
|
||||
-/etc/rc\.d/init\.d/postfix -- gen_context(system_u:object_r:postfix_initrc_exec_t,s0)
|
||||
@ -75,20 +75,11 @@ Index: fedora-policy-20221019/policy/modules/contrib/postfix.fc
|
||||
/var/spool/postfix/private(/.*)? gen_context(system_u:object_r:postfix_private_t,s0)
|
||||
/var/spool/postfix/public(/.*)? gen_context(system_u:object_r:postfix_public_t,s0)
|
||||
/var/spool/postfix/bounce(/.*)? gen_context(system_u:object_r:postfix_spool_bounce_t,s0)
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/postfix.te
|
||||
Index: fedora-policy-20220624/policy/modules/contrib/postfix.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/postfix.te
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/postfix.te
|
||||
@@ -121,6 +121,8 @@ allow postfix_master_t self:udp_socket c
|
||||
allow postfix_master_t postfix_etc_t:dir rw_dir_perms;
|
||||
allow postfix_master_t postfix_etc_t:file rw_file_perms;
|
||||
mta_filetrans_aliases(postfix_master_t, postfix_etc_t)
|
||||
+# SUSE also runs this on /etc/alias
|
||||
+mta_filetrans_aliases(postfix_master_t, etc_t)
|
||||
|
||||
can_exec(postfix_master_t, postfix_exec_t)
|
||||
|
||||
@@ -447,6 +449,14 @@ logging_send_syslog_msg(postfix_map_t)
|
||||
--- fedora-policy-20220624.orig/policy/modules/contrib/postfix.te
|
||||
+++ fedora-policy-20220624/policy/modules/contrib/postfix.te
|
||||
@@ -447,6 +447,14 @@ logging_send_syslog_msg(postfix_map_t)
|
||||
|
||||
userdom_use_inherited_user_ptys(postfix_map_t)
|
||||
|
||||
@ -103,7 +94,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/postfix.te
|
||||
optional_policy(`
|
||||
locallogin_dontaudit_use_fds(postfix_map_t)
|
||||
')
|
||||
@@ -687,6 +697,14 @@ corenet_tcp_connect_spamd_port(postfix_m
|
||||
@@ -687,6 +695,14 @@ corenet_tcp_connect_spamd_port(postfix_m
|
||||
files_search_all_mountpoints(postfix_smtp_t)
|
||||
|
||||
optional_policy(`
|
||||
|
@ -1,7 +1,7 @@
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc
|
||||
Index: fedora-policy-20210628/policy/modules/contrib/rpm.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/rpm.fc
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/rpm.fc
|
||||
--- fedora-policy-20210628.orig/policy/modules/contrib/rpm.fc
|
||||
+++ fedora-policy-20210628/policy/modules/contrib/rpm.fc
|
||||
@@ -18,6 +18,10 @@
|
||||
/usr/bin/repoquery -- gen_context(system_u:object_r:rpm_exec_t,s0)
|
||||
/usr/bin/zif -- gen_context(system_u:object_r:rpm_exec_t,s0)
|
||||
@ -13,7 +13,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc
|
||||
/usr/libexec/packagekitd -- gen_context(system_u:object_r:rpm_exec_t,s0)
|
||||
/usr/libexec/yumDBUSBackend.py -- gen_context(system_u:object_r:rpm_exec_t,s0)
|
||||
/usr/libexec/pegasus/pycmpiLMI_Software-cimprovagt -- gen_context(system_u:object_r:rpm_exec_t,s0)
|
||||
@@ -56,6 +60,8 @@ ifdef(`distro_redhat', `
|
||||
@@ -55,6 +59,8 @@ ifdef(`distro_redhat', `
|
||||
/var/cache/yum(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0)
|
||||
/var/cache/dnf(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0)
|
||||
|
||||
@ -22,11 +22,11 @@ Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc
|
||||
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
|
||||
/var/lib/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
|
||||
/var/lib/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/rpm.if
|
||||
Index: fedora-policy-20210628/policy/modules/contrib/rpm.if
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/rpm.if
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/rpm.if
|
||||
@@ -515,8 +515,10 @@ interface(`rpm_named_filetrans',`
|
||||
--- fedora-policy-20210628.orig/policy/modules/contrib/rpm.if
|
||||
+++ fedora-policy-20210628/policy/modules/contrib/rpm.if
|
||||
@@ -479,8 +479,10 @@ interface(`rpm_named_filetrans',`
|
||||
logging_log_named_filetrans($1, rpm_log_t, file, "yum.log")
|
||||
logging_log_named_filetrans($1, rpm_log_t, file, "hawkey.log")
|
||||
logging_log_named_filetrans($1, rpm_log_t, file, "up2date")
|
||||
@ -37,11 +37,11 @@ Index: fedora-policy-20221019/policy/modules/contrib/rpm.if
|
||||
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "dnf")
|
||||
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "yum")
|
||||
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpm")
|
||||
Index: fedora-policy-20221019/policy/modules/kernel/files.fc
|
||||
Index: fedora-policy-20210628/policy/modules/kernel/files.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/kernel/files.fc
|
||||
+++ fedora-policy-20221019/policy/modules/kernel/files.fc
|
||||
@@ -67,6 +67,7 @@ ifdef(`distro_redhat',`
|
||||
--- fedora-policy-20210628.orig/policy/modules/kernel/files.fc
|
||||
+++ fedora-policy-20210628/policy/modules/kernel/files.fc
|
||||
@@ -67,6 +67,7 @@ ifdef(`distro_suse',`
|
||||
/etc/sysconfig/ipvsadm.* -- gen_context(system_u:object_r:system_conf_t,s0)
|
||||
/etc/sysconfig/system-config-firewall.* -- gen_context(system_u:object_r:system_conf_t,s0)
|
||||
/etc/yum\.repos\.d(/.*)? gen_context(system_u:object_r:system_conf_t,s0)
|
||||
|
@ -1,7 +1,7 @@
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/snapper.te
|
||||
Index: fedora-policy/policy/modules/contrib/snapper.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/snapper.te
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/snapper.te
|
||||
--- fedora-policy.orig/policy/modules/contrib/snapper.te
|
||||
+++ fedora-policy/policy/modules/contrib/snapper.te
|
||||
@@ -18,6 +18,9 @@ files_config_file(snapperd_conf_t)
|
||||
type snapperd_data_t;
|
||||
files_type(snapperd_data_t)
|
||||
@ -23,25 +23,21 @@ Index: fedora-policy-20221019/policy/modules/contrib/snapper.te
|
||||
kernel_setsched(snapperd_t)
|
||||
|
||||
domain_read_all_domains_state(snapperd_t)
|
||||
@@ -73,6 +80,14 @@ storage_raw_read_fixed_disk(snapperd_t)
|
||||
@@ -73,6 +80,10 @@ storage_raw_read_fixed_disk(snapperd_t)
|
||||
auth_use_nsswitch(snapperd_t)
|
||||
|
||||
optional_policy(`
|
||||
+ packagekit_dbus_chat(snapperd_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ rpm_dbus_chat(snapperd_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
cron_system_entry(snapperd_t, snapperd_exec_t)
|
||||
')
|
||||
|
||||
Index: fedora-policy-20221019/policy/modules/contrib/snapper.fc
|
||||
Index: fedora-policy/policy/modules/contrib/snapper.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/contrib/snapper.fc
|
||||
+++ fedora-policy-20221019/policy/modules/contrib/snapper.fc
|
||||
--- fedora-policy.orig/policy/modules/contrib/snapper.fc
|
||||
+++ fedora-policy/policy/modules/contrib/snapper.fc
|
||||
@@ -7,9 +7,17 @@
|
||||
|
||||
/var/log/snapper\.log.* -- gen_context(system_u:object_r:snapperd_log_t,s0)
|
||||
|
@ -1,8 +1,8 @@
|
||||
Index: fedora-policy-20221019/policy/modules/system/sysnetwork.fc
|
||||
Index: fedora-policy/policy/modules/system/sysnetwork.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/sysnetwork.fc
|
||||
+++ fedora-policy-20221019/policy/modules/system/sysnetwork.fc
|
||||
@@ -103,6 +103,8 @@ ifdef(`distro_debian',`
|
||||
--- fedora-policy.orig/policy/modules/system/sysnetwork.fc
|
||||
+++ fedora-policy/policy/modules/system/sysnetwork.fc
|
||||
@@ -102,6 +102,8 @@ ifdef(`distro_debian',`
|
||||
/var/run/network(/.*)? gen_context(system_u:object_r:net_conf_t,s0)
|
||||
')
|
||||
|
||||
|
@ -1,8 +1,8 @@
|
||||
Index: fedora-policy-20221019/policy/modules/system/systemd.te
|
||||
Index: fedora-policy-20220624/policy/modules/system/systemd.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/systemd.te
|
||||
+++ fedora-policy-20221019/policy/modules/system/systemd.te
|
||||
@@ -381,6 +381,10 @@ userdom_manage_user_tmp_chr_files(system
|
||||
--- fedora-policy-20220624.orig/policy/modules/system/systemd.te
|
||||
+++ fedora-policy-20220624/policy/modules/system/systemd.te
|
||||
@@ -355,6 +355,10 @@ userdom_manage_user_tmp_chr_files(system
|
||||
xserver_dbus_chat(systemd_logind_t)
|
||||
|
||||
optional_policy(`
|
||||
@ -13,8 +13,8 @@ Index: fedora-policy-20221019/policy/modules/system/systemd.te
|
||||
apache_read_tmp_files(systemd_logind_t)
|
||||
')
|
||||
|
||||
@@ -863,6 +867,10 @@ optional_policy(`
|
||||
dbus_system_bus_client(systemd_localed_t)
|
||||
@@ -882,6 +886,10 @@ optional_policy(`
|
||||
udev_read_pid_files(systemd_hostnamed_t)
|
||||
')
|
||||
|
||||
+optional_policy(`
|
||||
@ -23,8 +23,8 @@ Index: fedora-policy-20221019/policy/modules/system/systemd.te
|
||||
+
|
||||
#######################################
|
||||
#
|
||||
# Hostnamed policy
|
||||
@@ -1158,7 +1166,7 @@ systemd_read_efivarfs(systemd_hwdb_t)
|
||||
# rfkill policy
|
||||
@@ -1105,7 +1113,7 @@ systemd_read_efivarfs(systemd_hwdb_t)
|
||||
# systemd_gpt_generator domain
|
||||
#
|
||||
|
||||
@ -33,7 +33,7 @@ Index: fedora-policy-20221019/policy/modules/system/systemd.te
|
||||
allow systemd_gpt_generator_t self:netlink_kobject_uevent_socket create_socket_perms;
|
||||
|
||||
dev_read_sysfs(systemd_gpt_generator_t)
|
||||
@@ -1185,6 +1193,8 @@ systemd_unit_file_filetrans(systemd_gpt_
|
||||
@@ -1127,6 +1135,8 @@ systemd_unit_file_filetrans(systemd_gpt_
|
||||
systemd_create_unit_file_dirs(systemd_gpt_generator_t)
|
||||
systemd_create_unit_file_lnk(systemd_gpt_generator_t)
|
||||
|
||||
|
@ -1,8 +1,8 @@
|
||||
Index: fedora-policy-20221019/policy/modules/system/systemd.te
|
||||
Index: fedora-policy-20220714/policy/modules/system/systemd.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/systemd.te
|
||||
+++ fedora-policy-20221019/policy/modules/system/systemd.te
|
||||
@@ -1508,6 +1508,12 @@ fstools_rw_swap_files(systemd_sleep_t)
|
||||
--- fedora-policy-20220714.orig/policy/modules/system/systemd.te
|
||||
+++ fedora-policy-20220714/policy/modules/system/systemd.te
|
||||
@@ -1447,6 +1447,12 @@ fstools_rw_swap_files(systemd_sleep_t)
|
||||
storage_getattr_fixed_disk_dev(systemd_sleep_t)
|
||||
storage_getattr_removable_dev(systemd_sleep_t)
|
||||
|
||||
|
@ -1,7 +1,7 @@
|
||||
Index: fedora-policy-20221019/policy/modules/system/unconfined.te
|
||||
Index: fedora-policy-20211111/policy/modules/system/unconfined.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/system/unconfined.te
|
||||
+++ fedora-policy-20221019/policy/modules/system/unconfined.te
|
||||
--- fedora-policy-20211111.orig/policy/modules/system/unconfined.te
|
||||
+++ fedora-policy-20211111/policy/modules/system/unconfined.te
|
||||
@@ -1,5 +1,10 @@
|
||||
policy_module(unconfined, 3.5.0)
|
||||
|
||||
@ -13,7 +13,7 @@ Index: fedora-policy-20221019/policy/modules/system/unconfined.te
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
@@ -45,3 +50,6 @@ optional_policy(`
|
||||
@@ -39,3 +44,6 @@ optional_policy(`
|
||||
optional_policy(`
|
||||
container_runtime_domtrans(unconfined_service_t)
|
||||
')
|
||||
|
@ -1,7 +1,7 @@
|
||||
Index: fedora-policy-20221019/policy/modules/roles/unconfineduser.te
|
||||
Index: fedora-policy-20220509/policy/modules/roles/unconfineduser.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/roles/unconfineduser.te
|
||||
+++ fedora-policy-20221019/policy/modules/roles/unconfineduser.te
|
||||
--- fedora-policy-20220509.orig/policy/modules/roles/unconfineduser.te
|
||||
+++ fedora-policy-20220509/policy/modules/roles/unconfineduser.te
|
||||
@@ -124,6 +124,11 @@ tunable_policy(`unconfined_dyntrans_all'
|
||||
domain_dyntrans(unconfined_t)
|
||||
')
|
||||
@ -14,7 +14,7 @@ Index: fedora-policy-20221019/policy/modules/roles/unconfineduser.te
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
type unconfined_t;
|
||||
@@ -214,6 +219,10 @@ optional_policy(`
|
||||
@@ -210,6 +215,10 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -25,7 +25,7 @@ Index: fedora-policy-20221019/policy/modules/roles/unconfineduser.te
|
||||
chrome_role_notrans(unconfined_r, unconfined_t)
|
||||
|
||||
tunable_policy(`unconfined_chrome_sandbox_transition',`
|
||||
@@ -248,6 +257,18 @@ optional_policy(`
|
||||
@@ -244,6 +253,18 @@ optional_policy(`
|
||||
dbus_stub(unconfined_t)
|
||||
|
||||
optional_policy(`
|
||||
|
@ -1,8 +1,8 @@
|
||||
Index: fedora-policy-20221019/policy/modules/roles/unprivuser.te
|
||||
Index: fedora-policy-20220624/policy/modules/roles/unprivuser.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/roles/unprivuser.te
|
||||
+++ fedora-policy-20221019/policy/modules/roles/unprivuser.te
|
||||
@@ -300,6 +300,13 @@ ifndef(`distro_redhat',`
|
||||
--- fedora-policy-20220624.orig/policy/modules/roles/unprivuser.te
|
||||
+++ fedora-policy-20220624/policy/modules/roles/unprivuser.te
|
||||
@@ -296,6 +296,13 @@ ifndef(`distro_redhat',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
@ -1,7 +1,7 @@
|
||||
Index: fedora-policy-20221019/policy/modules/services/xserver.fc
|
||||
Index: fedora-policy-20220714/policy/modules/services/xserver.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/services/xserver.fc
|
||||
+++ fedora-policy-20221019/policy/modules/services/xserver.fc
|
||||
--- fedora-policy-20220714.orig/policy/modules/services/xserver.fc
|
||||
+++ fedora-policy-20220714/policy/modules/services/xserver.fc
|
||||
@@ -71,6 +71,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
|
||||
/etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
||||
/etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0)
|
||||
@ -51,13 +51,13 @@ Index: fedora-policy-20221019/policy/modules/services/xserver.fc
|
||||
|
||||
/var/run/video.rom -- gen_context(system_u:object_r:xserver_var_run_t,s0)
|
||||
/var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0)
|
||||
Index: fedora-policy-20221019/policy/modules/services/xserver.te
|
||||
Index: fedora-policy-20220714/policy/modules/services/xserver.te
|
||||
===================================================================
|
||||
--- fedora-policy-20221019.orig/policy/modules/services/xserver.te
|
||||
+++ fedora-policy-20221019/policy/modules/services/xserver.te
|
||||
@@ -475,6 +475,10 @@ userdom_dontaudit_read_admin_home_lnk_fi
|
||||
|
||||
kernel_read_vm_sysctls(xdm_t)
|
||||
--- fedora-policy-20220714.orig/policy/modules/services/xserver.te
|
||||
+++ fedora-policy-20220714/policy/modules/services/xserver.te
|
||||
@@ -473,6 +473,10 @@ userdom_delete_user_home_content_files(x
|
||||
userdom_signull_unpriv_users(xdm_t)
|
||||
userdom_dontaudit_read_admin_home_lnk_files(xdm_t)
|
||||
|
||||
+files_manage_generic_pids_symlinks(xdm_t)
|
||||
+userdom_manage_user_home_content_dirs(xdm_t)
|
||||
|
@ -342,6 +342,13 @@ cmirrord = module
|
||||
#
|
||||
cobbler = module
|
||||
|
||||
# Layer: contrib
|
||||
# Module: cockpit
|
||||
#
|
||||
# cockpit - Cockpit runs in a browser and can manage your network of GNU/Linux machines.
|
||||
#
|
||||
cockpit = module
|
||||
|
||||
# Layer: services
|
||||
# Module: collectd
|
||||
#
|
||||
@ -2360,6 +2367,13 @@ minissdpd = module
|
||||
#
|
||||
freeipmi = module
|
||||
|
||||
# Layer: contrib
|
||||
# Module: freeipmi
|
||||
#
|
||||
# ipa policy module contain SELinux policies for IPA services
|
||||
#
|
||||
ipa = module
|
||||
|
||||
# Layer: contrib
|
||||
# Module: mirrormanager
|
||||
#
|
||||
|
@ -342,6 +342,13 @@ cmirrord = module
|
||||
#
|
||||
cobbler = module
|
||||
|
||||
# Layer: contrib
|
||||
# Module: cockpit
|
||||
#
|
||||
# cockpit - Cockpit runs in a browser and can manage your network of GNU/Linux machines.
|
||||
#
|
||||
cockpit = module
|
||||
|
||||
# Layer: services
|
||||
# Module: collectd
|
||||
#
|
||||
@ -2374,6 +2381,13 @@ minissdpd = module
|
||||
#
|
||||
freeipmi = module
|
||||
|
||||
# Layer: contrib
|
||||
# Module: freeipmi
|
||||
#
|
||||
# ipa policy module contain SELinux policies for IPA services
|
||||
#
|
||||
ipa = module
|
||||
|
||||
# Layer: contrib
|
||||
# Module: mirrormanager
|
||||
#
|
||||
|
@ -1,31 +1,3 @@
|
||||
-------------------------------------------------------------------
|
||||
Wed Oct 19 11:45:57 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Update to version 20221019. Refreshed:
|
||||
* distro_suse_to_distro_redhat.patch
|
||||
* fix_apache.patch
|
||||
* fix_chronyd.patch
|
||||
* fix_cron.patch
|
||||
* fix_init.patch
|
||||
* fix_kernel_sysctl.patch
|
||||
* fix_networkmanager.patch
|
||||
* fix_rpm.patch
|
||||
* fix_sysnetwork.patch
|
||||
* fix_systemd.patch
|
||||
* fix_systemd_watch.patch
|
||||
* fix_unconfined.patch
|
||||
* fix_unconfineduser.patch
|
||||
* fix_unprivuser.patch
|
||||
* fix_xserver.patch
|
||||
- Dropped fix_cockpit.patch as this is now packaged with cockpit itself
|
||||
- Remove the ipa module, freeip ships their own module
|
||||
- Added fix_alsa.patch to allow reading of config files in home directories
|
||||
- Extended fix_networkmanager.patch and fix_postfix.patch to account
|
||||
for SUSE systems
|
||||
- Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc
|
||||
queries the running processes
|
||||
- Updated fix_snapper.patch to allow snapper to talk to rpm via dbus
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Sep 30 07:14:49 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
|
@ -33,7 +33,7 @@ Summary: SELinux policy configuration
|
||||
License: GPL-2.0-or-later
|
||||
Group: System/Management
|
||||
Name: selinux-policy
|
||||
Version: 20221019
|
||||
Version: 20220714
|
||||
Release: 0
|
||||
Source: fedora-policy-%{version}.tar.bz2
|
||||
Source1: selinux-policy-rpmlintrc
|
||||
@ -132,7 +132,7 @@ Patch049: fix_nis.patch
|
||||
Patch050: fix_libraries.patch
|
||||
Patch051: fix_dovecot.patch
|
||||
# https://github.com/cockpit-project/cockpit/pull/15758
|
||||
#Patch052: fix_cockpit.patch
|
||||
Patch052: fix_cockpit.patch
|
||||
Patch053: fix_systemd_watch.patch
|
||||
# kernel specific sysctl.conf (boo#1184804)
|
||||
Patch054: fix_kernel_sysctl.patch
|
||||
@ -144,8 +144,6 @@ Patch059: systemd_domain_dyntrans_type.patch
|
||||
Patch060: fix_dnsmasq.patch
|
||||
Patch061: fix_userdomain.patch
|
||||
Patch062: fix_cloudform.patch
|
||||
Patch063: fix_alsa.patch
|
||||
Patch064: dontaudit_interface_kmod_tmpfs.patch
|
||||
|
||||
Patch100: sedoctool.patch
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user