pool/selinux-policy
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 1065970 from home:cahu:branches:security:SELinux

Browse Source 
- Complete packaging rework: Move policy to git repository and
  only use tar_scm obs service to refresh from there: 
  https://gitlab.suse.de/selinux/selinux-policy
  Please use `osc service manualrun` to update this OBS package to the 
  newest git version.
  * Added README.Update describing how to update this package
  * Added _service file that pulls from selinux-policy and 
    upstream container-selinux and tars them
  * Adapted selinux-policy.spec to build selinux-policy with
    container-selinux
  * Removed update.sh as no longer needed
  * Removed suse specific modules as they are now covered by git commits
    * packagekit.te packagekit.if packagekit.fc
    * rebootmgr.te rebootmgr.if rebootmgr.fc
    * rtorrent.te rtorrent.if rtorrent.fc
    * wicked.te wicked.if wicked.fc
  * Removed *.patch as they are now covered by git commits:
    * distro_suse_to_distro_redhat.patch
    * dontaudit_interface_kmod_tmpfs.patch
    * fix_accountsd.patch
    * fix_alsa.patch
    * fix_apache.patch
    * fix_auditd.patch
    * fix_authlogin.patch
    * fix_automount.patch
    * fix_bitlbee.patch
    * fix_chronyd.patch
    * fix_cloudform.patch
    * fix_colord.patch
    * fix_corecommand.patch
    * fix_cron.patch
    * fix_dbus.patch
    * fix_djbdns.patch
    * fix_dnsmasq.patch
    * fix_dovecot.patch
    * fix_entropyd.patch
    * fix_firewalld.patch
    * fix_fwupd.patch
    * fix_geoclue.patch
    * fix_hypervkvp.patch
    * fix_init.patch
    * fix_ipsec.patch
    * fix_iptables.patch
    * fix_irqbalance.patch
    * fix_java.patch
    * fix_kernel.patch
    * fix_kernel_sysctl.patch
    * fix_libraries.patch
    * fix_locallogin.patch
    * fix_logging.patch
    * fix_logrotate.patch
    * fix_mcelog.patch
    * fix_miscfiles.patch
    * fix_nagios.patch
    * fix_networkmanager.patch
    * fix_nis.patch
    * fix_nscd.patch
    * fix_ntp.patch
    * fix_openvpn.patch
    * fix_postfix.patch
    * fix_rpm.patch
    * fix_rtkit.patch
    * fix_screen.patch
    * fix_selinuxutil.patch
    * fix_sendmail.patch
    * fix_smartmon.patch
    * fix_snapper.patch
    * fix_sslh.patch
    * fix_sysnetwork.patch
    * fix_systemd.patch
    * fix_systemd_watch.patch
    * fix_thunderbird.patch
    * fix_unconfined.patch
    * fix_unconfineduser.patch
    * fix_unprivuser.patch
    * fix_userdomain.patch
    * fix_usermanage.patch
    * fix_wine.patch
    * fix_xserver.patch
    * sedoctool.patch
    * systemd_domain_dyntrans_type.patch

OBS-URL: https://build.opensuse.org/request/show/1065970
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=173
This commit is contained in:
Johannes Segitz 2023-02-16 07:31:19 +00:00 committed by Git OBS Bridge
parent 2c0c138859
commit 330c32dde1
85 changed files with 158 additions and 4089 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
README.Update Normal file
View File

@ -0,0 +1,19 @@
# How to update this project
This project is updated using obs services.
The obs services pull from git repositories, which are specified in the `_service` file.
Please contribute all changes to the upstream git repositories listed there.
To update this project to the upstream versions, please make sure you installed these obs services locally:
```
sudo zypper in obs-service-tar_scm obs-service-recompress obs-service-set_version obs-service-download_files
```
Then, generate new tarballs, changelog and version number for this repository by running this command:
```
osc service manualrun
```
Afterwards, please check your local project state and remove old tarballs if necessary.
Then proceed as usual with check-in and build.

26
_service Normal file
View File

@ -0,0 +1,26 @@
<services>
<service name="tar_scm" mode="manual">
<param name="version">1</param>
<param name="versionformat">%cd</param>
<param name="url">https://gitlab.suse.de/selinux/selinux-policy.git</param>
<param name="scm">git</param>
<param name="changesgenerate">enable</param>
<param name="revision">factory</param>
</service>
<service name="tar_scm" mode="manual">
<param name="version">1</param>
<param name="versionformat">%cd</param>
<param name="url">https://github.com/containers/container-selinux.git</param>
<param name="scm">git</param>
<param name="changesgenerate">enable</param>
<param name="revision">main</param>
</service>
<service name="recompress" mode="manual">
<param name="compression">xz</param>
<param name="file">*.tar</param>
</service>
<service name="set_version" mode="manual" >
<param name="file">selinux-policy.spec</param>
</service>
</services>

6
_servicedata Normal file
View File

@ -0,0 +1,6 @@
<servicedata>
<service name="tar_scm">
<param name="url">https://gitlab.suse.de/selinux/selinux-policy.git</param>
<param name="changesrevision">167da331be8238b650e75d629a925576ca5bf70b</param></service><service name="tar_scm">
<param name="url">https://github.com/containers/container-selinux.git</param>
<param name="changesrevision">07b3034f6d9625ab84508a2f46515d8ff79b4204</param></service></servicedata>

3
container-selinux-20230214.tar.xz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:35976ddc019bac7363a4a7eb7f626fc92cf91a19deeca7bb8ff1458dbb0dc936
size 25128

209
distro_suse_to_distro_redhat.patch
View File

@ -1,209 +0,0 @@
Index: fedora-policy-20230116/policy/modules/contrib/apache.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/contrib/apache.fc
+++ fedora-policy-20230116/policy/modules/contrib/apache.fc
@@ -74,7 +74,7 @@ HOME_DIR/((www)|(web)|(public_html))(/.*
/usr/sbin/suexec -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0)
/usr/sbin/thttpd -- gen_context(system_u:object_r:httpd_exec_t,s0)
-ifdef(`distro_suse', `
+ifdef(`distro_redhat', `
/usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0)
')
Index: fedora-policy-20230116/policy/modules/contrib/cron.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/contrib/cron.fc
+++ fedora-policy-20230116/policy/modules/contrib/cron.fc
@@ -51,7 +51,7 @@ ifdef(`distro_gentoo',`
/var/spool/cron/lastrun/[^/]* -- <<none>>
')
-ifdef(`distro_suse', `
+ifdef(`distro_redhat', `
/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
/var/spool/cron/lastrun/[^/]* -- <<none>>
/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
@@ -70,7 +70,7 @@ ifdef(`distro_gentoo',`
/var/spool/cron/lastrun/[^/]* -- <<none>>
')
-ifdef(`distro_suse', `
+ifdef(`distro_redhat', `
/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
/var/spool/cron/lastrun/[^/]* -- <<none>>
/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
Index: fedora-policy-20230116/policy/modules/contrib/rpm.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/contrib/rpm.fc
+++ fedora-policy-20230116/policy/modules/contrib/rpm.fc
@@ -82,7 +82,7 @@ ifdef(`distro_redhat', `
/var/run/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_run_t,s0)
# SuSE
-ifdef(`distro_suse', `
+ifdef(`distro_redhat', `
/usr/bin/online_update -- gen_context(system_u:object_r:rpm_exec_t,s0)
/sbin/yast2 -- gen_context(system_u:object_r:rpm_exec_t,s0)
/var/lib/YaST2(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
Index: fedora-policy-20230116/policy/modules/kernel/corecommands.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/kernel/corecommands.fc
+++ fedora-policy-20230116/policy/modules/kernel/corecommands.fc
@@ -462,7 +462,7 @@ ifdef(`distro_redhat', `
/usr/share/texmf/texconfig/tcfmgr -- gen_context(system_u:object_r:bin_t,s0)
')
-ifdef(`distro_suse', `
+ifdef(`distro_redhat', `
/usr/lib/cron/run-crons -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/samba/classic/.* -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/ssh/.* -- gen_context(system_u:object_r:bin_t,s0)
@@ -491,7 +491,7 @@ ifdef(`distro_suse', `
/var/lib/glusterd/hooks/.*/.*\.sh -- gen_context(system_u:object_r:bin_t,s0)
/var/lib/glusterd/hooks/.*/.*\.py -- gen_context(system_u:object_r:bin_t,s0)
-ifdef(`distro_suse',`
+ifdef(`distro_redhat',`
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
')
Index: fedora-policy-20230116/policy/modules/kernel/devices.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/kernel/devices.fc
+++ fedora-policy-20230116/policy/modules/kernel/devices.fc
@@ -148,7 +148,7 @@
/dev/usb.+ -c gen_context(system_u:object_r:usb_device_t,s0)
/dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0)
/dev/usbmon.+ -c gen_context(system_u:object_r:usbmon_device_t,s0)
-ifdef(`distro_suse', `
+ifdef(`distro_redhat', `
/dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0)
')
/dev/vmci -c gen_context(system_u:object_r:vmci_device_t,s0)
Index: fedora-policy-20230116/policy/modules/kernel/files.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20230116/policy/modules/kernel/files.fc
@@ -22,7 +22,7 @@ ifdef(`distro_redhat',`
/[^/]+ -- gen_context(system_u:object_r:etc_runtime_t,s0)
')
-ifdef(`distro_suse',`
+ifdef(`distro_redhat',`
/success -- gen_context(system_u:object_r:etc_runtime_t,s0)
')
@@ -92,7 +92,7 @@ ifdef(`distro_gentoo', `
/etc/env\.d/.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
')
-ifdef(`distro_suse',`
+ifdef(`distro_redhat',`
/etc/defkeymap\.map -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/rc\.d/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
')
Index: fedora-policy-20230116/policy/modules/services/xserver.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/services/xserver.fc
+++ fedora-policy-20230116/policy/modules/services/xserver.fc
@@ -189,7 +189,7 @@ ifndef(`distro_debian',`
/var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0)
/var/run/systemd/multi-session-x(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
-ifdef(`distro_suse',`
+ifdef(`distro_redhat',`
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
')
Index: fedora-policy-20230116/policy/modules/system/authlogin.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/authlogin.fc
+++ fedora-policy-20230116/policy/modules/system/authlogin.fc
@@ -31,7 +31,7 @@ HOME_DIR/\.google_authenticator~ gen_co
/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
-ifdef(`distro_suse', `
+ifdef(`distro_redhat', `
/sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
')
Index: fedora-policy-20230116/policy/modules/system/init.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/init.fc
+++ fedora-policy-20230116/policy/modules/system/init.fc
@@ -92,7 +92,7 @@ ifdef(`distro_gentoo', `
/var/run/svscan\.pid -- gen_context(system_u:object_r:initrc_var_run_t,s0)
')
-ifdef(`distro_suse', `
+ifdef(`distro_redhat', `
/var/run/bootsplashctl -p gen_context(system_u:object_r:initrc_var_run_t,s0)
/var/run/keymap -- gen_context(system_u:object_r:initrc_var_run_t,s0)
/var/run/numlock-on -- gen_context(system_u:object_r:initrc_var_run_t,s0)
Index: fedora-policy-20230116/policy/modules/system/init.te
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/init.te
+++ fedora-policy-20230116/policy/modules/system/init.te
@@ -1330,7 +1330,7 @@ ifdef(`distro_redhat',`
')
')
-ifdef(`distro_suse',`
+ifdef(`distro_redhat',`
optional_policy(`
# set permissions on /tmp/.X11-unix
xserver_setattr_xdm_tmp_dirs(initrc_t)
Index: fedora-policy-20230116/policy/modules/system/libraries.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/libraries.fc
+++ fedora-policy-20230116/policy/modules/system/libraries.fc
@@ -329,7 +329,7 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_
/var/lib/spamassassin/compiled/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
/usr/lib/xfce4/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
-ifdef(`distro_suse',`
+ifdef(`distro_redhat',`
/var/lib/samba/bin/.+\.so(\.[^/]*)* -l gen_context(system_u:object_r:lib_t,s0)
')
Index: fedora-policy-20230116/policy/modules/system/locallogin.te
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/locallogin.te
+++ fedora-policy-20230116/policy/modules/system/locallogin.te
@@ -274,7 +274,7 @@ ifdef(`enable_mls',`
')
# suse and debian do not use pam with sulogin...
-ifdef(`distro_suse', `define(`sulogin_no_pam')')
+ifdef(`distro_redhat', `define(`sulogin_no_pam')')
ifdef(`distro_debian', `define(`sulogin_no_pam')')
allow sulogin_t self:capability sys_tty_config;
Index: fedora-policy-20230116/policy/modules/system/logging.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/logging.fc
+++ fedora-policy-20230116/policy/modules/system/logging.fc
@@ -46,7 +46,7 @@
/var/lib/r?syslog(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,mls_systemhigh)
/var/lib/syslog-ng.persist -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
-ifdef(`distro_suse', `
+ifdef(`distro_redhat', `
/var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
')
Index: fedora-policy-20230116/policy/modules/system/logging.te
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/logging.te
+++ fedora-policy-20230116/policy/modules/system/logging.te
@@ -685,7 +685,7 @@ ifdef(`distro_gentoo',`
term_dontaudit_setattr_unallocated_ttys(syslogd_t)
')
-ifdef(`distro_suse',`
+ifdef(`distro_redhat',`
# suse creates a /dev/log under /var/lib/stunnel for chrooted stunnel
files_var_lib_filetrans(syslogd_t, devlog_t, sock_file)
')

41
dontaudit_interface_kmod_tmpfs.patch
View File

@ -1,41 +0,0 @@
Index: fedora-policy-20221019/policy/modules/services/xserver.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/services/xserver.te
+++ fedora-policy-20221019/policy/modules/services/xserver.te
@@ -764,6 +764,10 @@ userdom_mounton_tmp_sockets(xdm_t)
userdom_nnp_transition_login_userdomain(xdm_t)
userdom_watch_user_home_dirs(xdm_t)
+# SUSE uses startproc to start the display manager. While checking for running processes
+# it goes over all running instances, triggering AVCs
+modutils_dontaudit_kmod_tmpfs_getattr(xdm_t)
+
#userdom_home_manager(xdm_t)
tunable_policy(`xdm_write_home',`
userdom_user_home_dir_filetrans(xdm_t, xdm_home_t, { file lnk_file })
Index: fedora-policy-20221019/policy/modules/system/modutils.if
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/modutils.if
+++ fedora-policy-20221019/policy/modules/system/modutils.if
@@ -507,3 +507,21 @@ interface(`modules_filetrans_named_conte
#files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.symbols")
#files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.symbols.bin")
')
+
+#######################################
+## <summary>
+## Don't audit accesses to tmp file type.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`modutils_dontaudit_kmod_tmpfs_getattr',`
+ gen_require(`
+ type kmod_tmpfs_t;
+ ')
+
+ dontaudit $1 kmod_tmpfs_t:file { getattr };
+')

3
fedora-policy-20230206.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:5cf93823fbb8094a509b23be28f1328e7d61a6d564c6265ecbb295c63c188979
size 736493

12
fix_accountsd.patch
View File

@ -1,12 +0,0 @@
Index: fedora-policy/policy/modules/contrib/accountsd.fc
===================================================================
--- fedora-policy.orig/policy/modules/contrib/accountsd.fc
+++ fedora-policy/policy/modules/contrib/accountsd.fc
@@ -1,6 +1,7 @@
/usr/lib/systemd/system/accountsd.* -- gen_context(system_u:object_r:accountsd_unit_file_t,s0)
/usr/libexec/accounts-daemon -- gen_context(system_u:object_r:accountsd_exec_t,s0)
+/usr/lib/accounts-daemon -- gen_context(system_u:object_r:accountsd_exec_t,s0)
/usr/lib/accountsservice/accounts-daemon -- gen_context(system_u:object_r:accountsd_exec_t,s0)

15
fix_alsa.patch
View File

@ -1,15 +0,0 @@
Index: fedora-policy-20221019/policy/modules/contrib/alsa.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/alsa.te
+++ fedora-policy-20221019/policy/modules/contrib/alsa.te
@@ -104,6 +104,10 @@ userdom_manage_unpriv_user_semaphores(al
userdom_manage_unpriv_user_shared_mem(alsa_t)
userdom_search_user_home_dirs(alsa_t)
+optional_policy(`
+ gnome_read_home_config(alsa_t)
+')
+
ifdef(`distro_debian',`
term_dontaudit_use_unallocated_ttys(alsa_t)

30
fix_apache.patch
View File

@ -1,30 +0,0 @@
Index: fedora-policy-20221019/policy/modules/contrib/apache.if
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/apache.if
+++ fedora-policy-20221019/policy/modules/contrib/apache.if
@@ -2007,3 +2007,25 @@ interface(`apache_read_semaphores',`
allow $1 httpd_t:sem r_sem_perms;
')
+
+#######################################
+## <summary>
+## Allow the specified domain to execute
+## httpd_sys_content_t and manage httpd_sys_rw_content_t
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`apache_exec_sys_content',`
+ gen_require(`
+ type httpd_sys_content_t;
+ type httpd_sys_rw_content_t;
+ ')
+
+ apache_manage_sys_content_rw($1)
+ filetrans_pattern($1, httpd_sys_content_t, httpd_sys_rw_content_t, { file dir lnk_file })
+ can_exec($1, httpd_sys_content_t)
+')

12
fix_auditd.patch
View File

@ -1,12 +0,0 @@
Index: fedora-policy-20211111/policy/modules/system/logging.if
===================================================================
--- fedora-policy-20211111.orig/policy/modules/system/logging.if
+++ fedora-policy-20211111/policy/modules/system/logging.if
@@ -431,6 +431,7 @@ interface(`logging_manage_audit_config',
files_search_etc($1)
manage_files_pattern($1, auditd_etc_t, auditd_etc_t)
+ allow $1 auditd_etc_t:dir mounton;
')
########################################

12
fix_authlogin.patch
View File

@ -1,12 +0,0 @@
Index: fedora-policy-20211111/policy/modules/system/authlogin.fc
===================================================================
--- fedora-policy-20211111.orig/policy/modules/system/authlogin.fc
+++ fedora-policy-20211111/policy/modules/system/authlogin.fc
@@ -56,6 +56,7 @@ ifdef(`distro_gentoo', `
/usr/libexec/chkpwd/tcb_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
/usr/libexec/chkpwd/tcb_updpwd -- gen_context(system_u:object_r:updpwd_exec_t,s0)
/usr/libexec/utempter/utempter -- gen_context(system_u:object_r:utempter_exec_t,s0)
+/usr/lib/utempter/utempter -- gen_context(system_u:object_r:utempter_exec_t,s0)
/var/ace(/.*)? gen_context(system_u:object_r:var_auth_t,s0)

15
fix_automount.patch
View File

@ -1,15 +0,0 @@
Index: fedora-policy/policy/modules/contrib/automount.te
===================================================================
--- fedora-policy.orig/policy/modules/contrib/automount.te
+++ fedora-policy/policy/modules/contrib/automount.te
@@ -154,6 +154,10 @@ optional_policy(`
')
optional_policy(`
+ networkmanager_read_pid_files(automount_t)
+')
+
+optional_policy(`
fstools_domtrans(automount_t)
')

12
fix_bitlbee.patch
View File

@ -1,12 +0,0 @@
Index: fedora-policy-20220124/policy/modules/contrib/bitlbee.fc
===================================================================
--- fedora-policy-20220124.orig/policy/modules/contrib/bitlbee.fc
+++ fedora-policy-20220124/policy/modules/contrib/bitlbee.fc
@@ -9,6 +9,5 @@
/var/log/bip.* gen_context(system_u:object_r:bitlbee_log_t,s0)
-/var/run/bitlbee\.pid -- gen_context(system_u:object_r:bitlbee_var_run_t,s0)
-/var/run/bitlbee\.sock -s gen_context(system_u:object_r:bitlbee_var_run_t,s0)
+/var/run/bitlbee(/.*)? gen_context(system_u:object_r:bitlbee_var_run_t,s0)
/var/run/bip(/.*)? gen_context(system_u:object_r:bitlbee_var_run_t,s0)

60
fix_chronyd.patch
View File

@ -1,60 +0,0 @@
Index: fedora-policy-20221019/policy/modules/contrib/chronyd.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/chronyd.te
+++ fedora-policy-20221019/policy/modules/contrib/chronyd.te
@@ -144,6 +144,15 @@ systemd_exec_systemctl(chronyd_t)
userdom_dgram_send(chronyd_t)
optional_policy(`
+ networkmanager_read_pid_files(chronyd_t)
+ networkmanager_dispatcher_custom_dgram_send(chronyd_t)
+')
+
+optional_policy(`
+ wicked_read_pid_files(chronyd_t)
+')
+
+optional_policy(`
cron_dgram_send(chronyd_t)
')
Index: fedora-policy-20221019/policy/modules/contrib/chronyd.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/chronyd.fc
+++ fedora-policy-20221019/policy/modules/contrib/chronyd.fc
@@ -6,6 +6,8 @@
/usr/sbin/chronyd -- gen_context(system_u:object_r:chronyd_exec_t,s0)
/usr/libexec/chrony-helper -- gen_context(system_u:object_r:chronyd_exec_t,s0)
+/usr/lib/chrony/helper -- gen_context(system_u:object_r:chronyd_exec_t,s0)
+/usr/libexec/chrony/helper -- gen_context(system_u:object_r:chronyd_exec_t,s0)
/usr/bin/chronyc -- gen_context(system_u:object_r:chronyc_exec_t,s0)
Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.if
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.if
+++ fedora-policy-20221019/policy/modules/contrib/networkmanager.if
@@ -684,3 +684,22 @@ template(`networkmanager_dispatcher_plug
domtrans_pattern(NetworkManager_dispatcher_t, NetworkManager_dispatcher_$1_script_t, NetworkManager_dispatcher_$1_t)
')
+
+########################################
+## <summary>
+## Send a message to NetworkManager_dispatcher_custom
+## over a unix domain datagram socket.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`networkmanager_dispatcher_custom_dgram_send',`
+ gen_require(`
+ type NetworkManager_dispatcher_custom_t;
+ ')
+
+ allow $1 NetworkManager_dispatcher_custom_t:unix_dgram_socket sendto;
+')

13
fix_cloudform.patch
View File

@ -1,13 +0,0 @@
Index: fedora-policy/policy/modules/contrib/cloudform.te
===================================================================
--- cloudform.te 2022-07-18 14:06:56.735383426 +0200
+++ cloudform.te.new 2022-07-18 14:07:36.003069544 +0200
@@ -81,6 +81,8 @@
init_dbus_chat(cloud_init_t)
+snapper_dbus_chat(cloud_init_t)
+
kernel_read_network_state(cloud_init_t)
corenet_tcp_connect_http_port(cloud_init_t)

25
fix_colord.patch
View File

@ -1,25 +0,0 @@
Index: fedora-policy-20211111/policy/modules/contrib/colord.fc
===================================================================
--- fedora-policy-20211111.orig/policy/modules/contrib/colord.fc
+++ fedora-policy-20211111/policy/modules/contrib/colord.fc
@@ -6,6 +6,8 @@
/usr/libexec/colord -- gen_context(system_u:object_r:colord_exec_t,s0)
/usr/libexec/colord-sane -- gen_context(system_u:object_r:colord_exec_t,s0)
+/usr/lib/colord -- gen_context(system_u:object_r:colord_exec_t,s0)
+/usr/lib/colord-sane -- gen_context(system_u:object_r:colord_exec_t,s0)
/usr/lib/systemd/system/colord.* -- gen_context(system_u:object_r:colord_unit_file_t,s0)
Index: fedora-policy-20211111/policy/modules/contrib/colord.te
===================================================================
--- fedora-policy-20211111.orig/policy/modules/contrib/colord.te
+++ fedora-policy-20211111/policy/modules/contrib/colord.te
@@ -17,6 +17,7 @@ type colord_t;
type colord_exec_t;
dbus_system_domain(colord_t, colord_exec_t)
init_daemon_domain(colord_t, colord_exec_t)
+init_nnp_daemon_domain(colord_t)
type colord_tmp_t;
files_tmp_file(colord_tmp_t)

64
fix_corecommand.patch
View File

@ -1,64 +0,0 @@
Index: fedora-policy/policy/modules/kernel/corecommands.fc
===================================================================
--- fedora-policy.orig/policy/modules/kernel/corecommands.fc
+++ fedora-policy/policy/modules/kernel/corecommands.fc
@@ -86,7 +86,10 @@ ifdef(`distro_redhat',`
/etc/mail/make -- gen_context(system_u:object_r:bin_t,s0)
-/etc/mcelog/.*-error-trigger -- gen_context(system_u:object_r:bin_t,s0)
+
+/etc/netconfig.d/.* -- gen_context(system_u:object_r:bin_t,s0)
+
+/etc/mcelog/.*-error.*-trigger -- gen_context(system_u:object_r:bin_t,s0)
/etc/mcelog/.*\.local -- gen_context(system_u:object_r:bin_t,s0)
/etc/mcelog/.*\.setup -- gen_context(system_u:object_r:bin_t,s0)
@@ -251,6 +254,21 @@ ifdef(`distro_gentoo',`
/usr/lib/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0)
/usr/lib/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib/gnome-settings-daemon/.* -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-settings-daemon-3.0/.* -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-calculator-search-provider -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-control-center-search-provider -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-photos-thumbnailer -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-rr-debug -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-session-binary -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-session-check-accelerated -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-session-check-accelerated-gles-helper -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-session-check-accelerated-gl-helper -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-session-failed -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-software-cmd -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-software-restarter -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-terminal-migration -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-terminal-server -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/gnome-tweak-tool-lid-inhibitor -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/gvfs/.* -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/ipsec/.* -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/kde4/libexec/.* -- gen_context(system_u:object_r:bin_t,s0)
@@ -313,6 +331,8 @@ ifdef(`distro_gentoo',`
/usr/lib/xen/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/libexec(/.*)? gen_context(system_u:object_r:bin_t,s0)
+# also covers /usr/lib64/libexec due to equivalency rule '/usr/lib64 /usr/lib'
+/usr/lib/libexec(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/libexec/git-core/git-shell -- gen_context(system_u:object_r:shell_exec_t,s0)
/usr/libexec/cockpit-agent -- gen_context(system_u:object_r:shell_exec_t,s0)
@@ -324,6 +344,8 @@ ifdef(`distro_gentoo',`
/usr/lib/xfce4(/.*)? gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/build/.* -- gen_context(system_u:object_r:bin_t,s0)
+
/usr/Brother(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/Printer(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/Brother/(.*/)?inf/brprintconf.* gen_context(system_u:object_r:bin_t,s0)
@@ -391,6 +413,7 @@ ifdef(`distro_debian',`
/usr/lib/gdm3/.* -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/udisks/.* -- gen_context(system_u:object_r:bin_t,s0)
')
+/usr/lib/gdm/.* -- gen_context(system_u:object_r:bin_t,s0)
ifdef(`distro_gentoo', `
/usr/.*-.*-linux-gnu/gcc-bin/.*(/.*)? gen_context(system_u:object_r:bin_t,s0)

47
fix_cron.patch
View File

@ -1,47 +0,0 @@
Index: fedora-policy-20221019/policy/modules/contrib/cron.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/cron.fc
+++ fedora-policy-20221019/policy/modules/contrib/cron.fc
@@ -34,7 +34,7 @@
/var/spool/cron -d gen_context(system_u:object_r:user_cron_spool_t,s0)
#/var/spool/cron/root -- gen_context(system_u:object_r:sysadm_cron_spool_t,s0)
-/var/spool/cron/USER -- gen_context(system_u:object_r:user_cron_spool_t,s0)
+/var/spool/cron/tabs/USER -- gen_context(system_u:object_r:user_cron_spool_t,s0)
/var/spool/cron/crontabs -d gen_context(system_u:object_r:cron_spool_t,s0)
/var/spool/cron/crontabs/.* -- <<none>>
@@ -55,6 +55,10 @@ ifdef(`distro_redhat', `
/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
/var/spool/cron/lastrun/[^/]* -- <<none>>
/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
+
+/var/spool/atjobs -d gen_context(system_u:object_r:cron_spool_t,s0)
+/var/spool/atjobs/.SEQ -- gen_context(system_u:object_r:user_cron_spool_t,s0)
+/var/spool/atjobs/[^/]* -- <<none>>
')
ifdef(`distro_debian',`
@@ -69,9 +73,3 @@ ifdef(`distro_gentoo',`
/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
/var/spool/cron/lastrun/[^/]* -- <<none>>
')
-
-ifdef(`distro_redhat', `
-/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
-/var/spool/cron/lastrun/[^/]* -- <<none>>
-/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
-')
Index: fedora-policy-20221019/policy/modules/contrib/cron.if
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/cron.if
+++ fedora-policy-20221019/policy/modules/contrib/cron.if
@@ -1075,7 +1075,7 @@ interface(`cron_generic_log_filetrans_lo
#
interface(`cron_system_spool_entrypoint',`
gen_require(`
- attribute system_cron_spool_t;
+ type system_cron_spool_t;
')
allow $1 system_cron_spool_t:file entrypoint;
')

21
fix_dbus.patch
View File

@ -1,21 +0,0 @@
Index: fedora-policy-20221019/policy/modules/contrib/dbus.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/dbus.te
+++ fedora-policy-20221019/policy/modules/contrib/dbus.te
@@ -81,6 +81,7 @@ manage_dirs_pattern(system_dbusd_t, syst
manage_files_pattern(system_dbusd_t, system_dbusd_tmp_t, system_dbusd_tmp_t)
manage_sock_files_pattern(system_dbusd_t, system_dbusd_tmp_t, system_dbusd_tmp_t)
files_tmp_filetrans(system_dbusd_t, system_dbusd_tmp_t, { dir file sock_file })
+allow system_dbusd_t system_dbusd_tmp_t:file execute;
manage_files_pattern(system_dbusd_t, system_dbusd_tmpfs_t, system_dbusd_tmpfs_t)
manage_dirs_pattern(system_dbusd_t, system_dbusd_tmpfs_t, system_dbusd_tmpfs_t)
@@ -109,6 +110,8 @@ files_read_var_lib_symlinks(system_dbusd
files_rw_inherited_non_security_files(system_dbusd_t)
files_watch_usr_dirs(system_dbusd_t)
files_watch_var_lib_dirs(system_dbusd_t)
+# bsc#1205895
+files_watch_lib_dirs(system_dbusd_t)
fs_getattr_all_fs(system_dbusd_t)
fs_search_auto_mountpoints(system_dbusd_t)

33
fix_djbdns.patch
View File

@ -1,33 +0,0 @@
Index: fedora-policy/policy/modules/contrib/djbdns.te
===================================================================
--- fedora-policy.orig/policy/modules/contrib/djbdns.te 2019-08-05 09:39:48.641670181 +0200
+++ fedora-policy/policy/modules/contrib/djbdns.te 2019-08-05 09:53:08.383084236 +0200
@@ -24,28 +24,6 @@ allow djbdns_domain self:fifo_file rw_fi
allow djbdns_domain self:tcp_socket create_stream_socket_perms;
allow djbdns_domain self:udp_socket create_socket_perms;
-corenet_all_recvfrom_unlabeled(djbdns_domain)
-corenet_all_recvfrom_netlabel(djbdns_domain)
-corenet_tcp_sendrecv_generic_if(djbdns_domain)
-corenet_udp_sendrecv_generic_if(djbdns_domain)
-corenet_tcp_sendrecv_generic_node(djbdns_domain)
-corenet_udp_sendrecv_generic_node(djbdns_domain)
-corenet_tcp_sendrecv_all_ports(djbdns_domain)
-corenet_udp_sendrecv_all_ports(djbdns_domain)
-corenet_tcp_bind_generic_node(djbdns_domain)
-corenet_udp_bind_generic_node(djbdns_domain)
-
-corenet_sendrecv_dns_server_packets(djbdns_domain)
-corenet_tcp_bind_dns_port(djbdns_domain)
-corenet_udp_bind_dns_port(djbdns_domain)
-
-corenet_sendrecv_dns_client_packets(djbdns_domain)
-corenet_tcp_connect_dns_port(djbdns_domain)
-
-corenet_sendrecv_generic_server_packets(djbdns_domain)
-corenet_tcp_bind_generic_port(djbdns_domain)
-corenet_udp_bind_generic_port(djbdns_domain)
-
files_search_var(djbdns_domain)
daemontools_ipc_domain(djbdns_axfrdns_t)

12
fix_dnsmasq.patch
View File

@ -1,12 +0,0 @@
Index: fedora-policy-20230116/policy/modules/contrib/dnsmasq.te
===================================================================
--- fedora-policy-20230116.orig/policy/modules/contrib/dnsmasq.te
+++ fedora-policy-20230116/policy/modules/contrib/dnsmasq.te
@@ -116,6 +116,7 @@ libs_exec_ldconfig(dnsmasq_t)
logging_send_syslog_msg(dnsmasq_t)
miscfiles_read_public_files(dnsmasq_t)
+sysnet_manage_config_dirs(dnsmasq_t)
userdom_dontaudit_use_unpriv_user_fds(dnsmasq_t)
userdom_dontaudit_search_user_home_dirs(dnsmasq_t)

15
fix_dovecot.patch
View File

@ -1,15 +0,0 @@
Index: fedora-policy-20210419/policy/modules/contrib/dovecot.fc
===================================================================
--- fedora-policy-20210419.orig/policy/modules/contrib/dovecot.fc
+++ fedora-policy-20210419/policy/modules/contrib/dovecot.fc
@@ -34,6 +34,10 @@ ifdef(`distro_redhat', `
/usr/libexec/dovecot/dovecot-auth -- gen_context(system_u:object_r:dovecot_auth_exec_t,s0)
')
+/usr/lib/dovecot/auth -- gen_context(system_u:object_r:dovecot_auth_exec_t,s0)
+/usr/lib/dovecot/deliver -- gen_context(system_u:object_r:dovecot_deliver_exec_t,s0)
+/usr/lib/dovecot/dovecot-lda -- gen_context(system_u:object_r:dovecot_deliver_exec_t,s0)
+
#
# /var
#

76
fix_entropyd.patch
View File

@ -1,76 +0,0 @@
Index: fedora-policy-20230206/policy/modules/contrib/entropyd.te
===================================================================
--- fedora-policy-20230206.orig/policy/modules/contrib/entropyd.te
+++ fedora-policy-20230206/policy/modules/contrib/entropyd.te
@@ -24,6 +24,9 @@ init_script_file(entropyd_initrc_exec_t)
type entropyd_var_run_t;
files_pid_file(entropyd_var_run_t)
+type entropyd_tmpfs_t;
+files_tmpfs_file(entropyd_tmpfs_t)
+
########################################
#
# Local policy
@@ -36,6 +39,10 @@ allow entropyd_t self:process signal_per
manage_files_pattern(entropyd_t, entropyd_var_run_t, entropyd_var_run_t)
files_pid_filetrans(entropyd_t, entropyd_var_run_t, file)
+manage_dirs_pattern(entropyd_t, entropyd_tmpfs_t, entropyd_tmpfs_t)
+manage_files_pattern(entropyd_t, entropyd_tmpfs_t, entropyd_tmpfs_t)
+fs_tmpfs_filetrans(entropyd_t, entropyd_tmpfs_t, { file })
+
kernel_read_system_state(entropyd_t)
kernel_rw_kernel_sysctl(entropyd_t)
@@ -47,6 +54,8 @@ dev_write_rand(entropyd_t)
fs_getattr_all_fs(entropyd_t)
fs_search_auto_mountpoints(entropyd_t)
+# not great, but necessary for now since I can't get sem.haveged_sem to have a proper label
+fs_rw_tmpfs_files(entropyd_t)
domain_use_interactive_fds(entropyd_t)
Index: fedora-policy-20230206/policy/modules/contrib/entropyd.if
===================================================================
--- fedora-policy-20230206.orig/policy/modules/contrib/entropyd.if
+++ fedora-policy-20230206/policy/modules/contrib/entropyd.if
@@ -33,3 +33,22 @@ interface(`entropyd_admin',`
files_search_pids($1)
admin_pattern($1, entropyd_var_run_t)
')
+
+########################################
+## <summary>
+## Transition kernel created semaphore to correct type
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`entropyd_semaphore_filetrans',`
+ gen_require(`
+ type entropyd_tmpfs_t;
+ ')
+
+ fs_tmpfs_filetrans($1, entropyd_tmpfs_t, file, "sem.haveged_sem")
+')
Index: fedora-policy-20230206/policy/modules/kernel/kernel.te
===================================================================
--- fedora-policy-20230206.orig/policy/modules/kernel/kernel.te
+++ fedora-policy-20230206/policy/modules/kernel/kernel.te
@@ -401,6 +401,10 @@ optional_policy(`
')
optional_policy(`
+ entropyd_semaphore_filetrans(kernel_t)
+')
+
+optional_policy(`
abrt_filetrans_named_content(kernel_t)
abrt_dump_oops_domtrans(kernel_t)
')

42
fix_firewalld.patch
View File

@ -1,42 +0,0 @@
Index: fedora-policy-20211111/policy/modules/contrib/firewalld.te
===================================================================
--- fedora-policy-20211111.orig/policy/modules/contrib/firewalld.te
+++ fedora-policy-20211111/policy/modules/contrib/firewalld.te
@@ -131,6 +131,7 @@ optional_policy(`
')
optional_policy(`
+ iptables_manage_var_lib_files(firewalld_t)
iptables_domtrans(firewalld_t)
iptables_read_var_run(firewalld_t)
')
Index: fedora-policy-20211111/policy/modules/system/iptables.if
===================================================================
--- fedora-policy-20211111.orig/policy/modules/system/iptables.if
+++ fedora-policy-20211111/policy/modules/system/iptables.if
@@ -2,6 +2,25 @@
########################################
## <summary>
+## Allow management of iptables_var_lib_t files
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to mange files
+## </summary>
+## </param>
+#
+interface(`iptables_manage_var_lib_files',`
+ gen_require(`
+ type iptables_var_lib_t;
+ ')
+
+ manage_dirs_pattern($1, iptables_var_lib_t, iptables_var_lib_t)
+ manage_files_pattern($1, iptables_var_lib_t, iptables_var_lib_t)
+')
+
+########################################
+## <summary>
## Execute iptables in the iptables domain.
## </summary>
## <param name="domain">

17
fix_fwupd.patch
View File

@ -1,17 +0,0 @@
Index: fedora-policy-20230116/policy/modules/contrib/fwupd.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/contrib/fwupd.fc
+++ fedora-policy-20230116/policy/modules/contrib/fwupd.fc
@@ -2,9 +2,9 @@
/etc/pki/(fwupd|fwupd-metadata)(/.*)? gen_context(system_u:object_r:fwupd_cert_t,s0)
-/usr/libexec/fwupd/fwupd -- gen_context(system_u:object_r:fwupd_exec_t,s0)
-/usr/libexec/fwupd/fwupdoffline -- gen_context(system_u:object_r:fwupd_exec_t,s0)
-/usr/libexec/fwupd/fwupd-detect-cet -- gen_context(system_u:object_r:fwupd_exec_t,s0)
+/usr/lib(exec)?/fwupd/fwupd -- gen_context(system_u:object_r:fwupd_exec_t,s0)
+/usr/lib(exec)?/fwupd/fwupdoffline -- gen_context(system_u:object_r:fwupd_exec_t,s0)
+/usr/lib(exec)?/fwupd/fwupd-detect-cet -- gen_context(system_u:object_r:fwupd_exec_t,s0)
/var/cache/app-info(/.*)? gen_context(system_u:object_r:fwupd_cache_t,s0)
/var/cache/fwupd(/.*)? gen_context(system_u:object_r:fwupd_cache_t,s0)

10
fix_geoclue.patch
View File

@ -1,10 +0,0 @@
Index: fedora-policy/policy/modules/contrib/geoclue.fc
===================================================================
--- fedora-policy.orig/policy/modules/contrib/geoclue.fc
+++ fedora-policy/policy/modules/contrib/geoclue.fc
@@ -1,4 +1,4 @@
-
+/usr/lib/geoclue -- gen_context(system_u:object_r:geoclue_exec_t,s0)
/usr/libexec/geoclue -- gen_context(system_u:object_r:geoclue_exec_t,s0)
/var/lib/geoclue(/.*)? gen_context(system_u:object_r:geoclue_var_lib_t,s0)

15
fix_hypervkvp.patch
View File

@ -1,15 +0,0 @@
Index: fedora-policy-20220124/policy/modules/contrib/hypervkvp.fc
===================================================================
--- fedora-policy-20220124.orig/policy/modules/contrib/hypervkvp.fc
+++ fedora-policy-20220124/policy/modules/contrib/hypervkvp.fc
@@ -3,8 +3,10 @@
/usr/lib/systemd/system/hypervvssd.* -- gen_context(system_u:object_r:hypervvssd_unit_file_t,s0)
/usr/sbin/hv_kvp_daemon -- gen_context(system_u:object_r:hypervkvp_exec_t,s0)
+/usr/lib/hyper-v/bin/.*kvp_daemon -- gen_context(system_u:object_r:hypervkvp_exec_t,s0)
/usr/sbin/hypervkvpd -- gen_context(system_u:object_r:hypervkvp_exec_t,s0)
/usr/sbin/hypervvssd -- gen_context(system_u:object_r:hypervvssd_exec_t,s0)
+/usr/lib/hyper-v/bin/.*vss_daemon -- gen_context(system_u:object_r:hypervvssd_exec_t,s0)
/var/lib/hyperv(/.*)? gen_context(system_u:object_r:hypervkvp_var_lib_t,s0)

88
fix_init.patch
View File

@ -1,88 +0,0 @@
Index: fedora-policy-20230116/policy/modules/system/init.te
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/init.te
+++ fedora-policy-20230116/policy/modules/system/init.te
@@ -270,6 +270,8 @@ corecmd_exec_bin(init_t)
corenet_all_recvfrom_netlabel(init_t)
corenet_tcp_bind_all_ports(init_t)
corenet_udp_bind_all_ports(init_t)
+corenet_udp_bind_generic_node(init_t)
+corenet_tcp_bind_generic_node(init_t)
dev_create_all_files(init_t)
dev_create_all_chr_files(init_t)
@@ -396,6 +398,7 @@ logging_manage_audit_config(init_t)
logging_create_syslog_netlink_audit_socket(init_t)
logging_write_var_log_dirs(init_t)
logging_manage_var_log_symlinks(init_t)
+logging_dgram_accept(init_t)
seutil_read_config(init_t)
seutil_read_login_config(init_t)
@@ -448,9 +451,19 @@ ifdef(`distro_redhat',`
corecmd_shell_domtrans(init_t, initrc_t)
storage_raw_rw_fixed_disk(init_t)
+storage_raw_read_removable_device(init_t)
sysnet_read_dhcpc_state(init_t)
+# bsc#1197610, find a better, generic solution
+optional_policy(`
+ mta_getattr_spool(init_t)
+')
+
+optional_policy(`
+ networkmanager_initrc_read_lnk_files(init_t)
+')
+
optional_policy(`
anaconda_stream_connect(init_t)
anaconda_create_unix_stream_sockets(init_t)
@@ -582,10 +595,10 @@ tunable_policy(`init_audit_control',`
allow init_t self:system all_system_perms;
allow init_t self:system module_load;
allow init_t self:unix_dgram_socket { create_socket_perms sendto };
-allow init_t self:process { setkeycreate setsockcreate setfscreate setrlimit setexec };
+allow init_t self:process { setkeycreate setsockcreate setfscreate setrlimit setexec execmem };
allow init_t self:process { getcap setcap };
allow init_t self:unix_stream_socket { create_stream_socket_perms connectto recvfrom };
-allow init_t self:netlink_kobject_uevent_socket create_socket_perms;
+allow init_t self:netlink_kobject_uevent_socket create_socket_perms;
allow init_t self:netlink_selinux_socket create_socket_perms;
allow init_t self:unix_dgram_socket lock;
# Until systemd is fixed
@@ -645,6 +658,7 @@ files_delete_all_spool_sockets(init_t)
files_create_var_lib_dirs(init_t)
files_create_var_lib_symlinks(init_t)
files_read_var_lib_symlinks(init_t)
+files_read_var_files(init_t)
files_manage_urandom_seed(init_t)
files_list_locks(init_t)
files_list_spool(init_t)
@@ -682,7 +696,7 @@ fs_list_all(init_t)
fs_list_auto_mountpoints(init_t)
fs_register_binary_executable_type(init_t)
fs_relabel_tmpfs_sock_file(init_t)
-fs_rw_tmpfs_files(init_t)
+fs_rw_tmpfs_files(init_t)
fs_relabel_cgroup_dirs(init_t)
fs_search_cgroup_dirs(init_t)
# for network namespaces
@@ -738,6 +752,7 @@ systemd_write_inherited_logind_sessions_
create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
create_dirs_pattern(init_t, var_log_t, var_log_t)
+files_manage_var_files(init_t)
auth_use_nsswitch(init_t)
auth_rw_login_records(init_t)
@@ -1592,6 +1607,8 @@ optional_policy(`
optional_policy(`
postfix_list_spool(initrc_t)
+ #allow init_t postfix_map_exec_t:file { open read execute execute_no_trans ioctl };
+ postfix_domtrans_map(init_t)
')
optional_policy(`

20
fix_ipsec.patch
View File

@ -1,20 +0,0 @@
Index: fedora-policy-20230116/policy/modules/system/ipsec.te
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/ipsec.te
+++ fedora-policy-20230116/policy/modules/system/ipsec.te
@@ -88,6 +88,7 @@ allow ipsec_t self:tcp_socket create_str
allow ipsec_t self:udp_socket create_socket_perms;
allow ipsec_t self:packet_socket create_socket_perms;
allow ipsec_t self:key_socket create_socket_perms;
+allow ipsec_t self:alg_socket create_socket_perms;
allow ipsec_t self:fifo_file read_fifo_file_perms;
allow ipsec_t self:netlink_xfrm_socket { create_netlink_socket_perms nlmsg_write };
allow ipsec_t self:netlink_selinux_socket create_socket_perms;
@@ -270,6 +271,7 @@ allow ipsec_mgmt_t self:unix_stream_sock
allow ipsec_mgmt_t self:tcp_socket create_stream_socket_perms;
allow ipsec_mgmt_t self:udp_socket create_socket_perms;
allow ipsec_mgmt_t self:key_socket create_socket_perms;
+allow ipsec_mgmt_t self:alg_socket create_socket_perms;
allow ipsec_mgmt_t self:fifo_file rw_fifo_file_perms;
allow ipsec_mgmt_t self:netlink_xfrm_socket { create_netlink_socket_perms nlmsg_read };
allow ipsec_mgmt_t self:netlink_route_socket { create_netlink_socket_perms };

12
fix_iptables.patch
View File

@ -1,12 +0,0 @@
Index: fedora-policy-20220428/policy/modules/system/iptables.te
===================================================================
--- fedora-policy-20220428.orig/policy/modules/system/iptables.te
+++ fedora-policy-20220428/policy/modules/system/iptables.te
@@ -76,6 +76,7 @@ kernel_read_network_state(iptables_t)
kernel_read_kernel_sysctls(iptables_t)
kernel_use_fds(iptables_t)
kernel_rw_net_sysctls(iptables_t)
+kernel_rw_pipes(iptables_t)
kernel_search_network_sysctl(iptables_t)

13
fix_irqbalance.patch
View File

@ -1,13 +0,0 @@
Index: fedora-policy-20221019/policy/modules/contrib/irqbalance.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/irqbalance.te
+++ fedora-policy-20221019/policy/modules/contrib/irqbalance.te
@@ -24,7 +24,7 @@ files_pid_file(irqbalance_var_run_t)
allow irqbalance_t self:capability { setpcap net_admin };
dontaudit irqbalance_t self:capability sys_tty_config;
allow irqbalance_t self:process { getcap getsched setcap signal_perms };
-allow irqbalance_t self:udp_socket create_socket_perms;
+allow irqbalance_t self:{udp_socket netlink_generic_socket} create_socket_perms;
manage_dirs_pattern(irqbalance_t, irqbalance_var_run_t, irqbalance_var_run_t)
manage_files_pattern(irqbalance_t, irqbalance_var_run_t, irqbalance_var_run_t)

41
fix_java.patch
View File

@ -1,41 +0,0 @@
Index: fedora-policy/policy/modules/contrib/java.te
===================================================================
--- fedora-policy.orig/policy/modules/contrib/java.te 2019-08-05 13:50:32.925673660 +0200
+++ fedora-policy/policy/modules/contrib/java.te 2019-08-05 14:06:51.896425229 +0200
@@ -21,6 +21,7 @@ roleattribute system_r java_roles;
attribute_role unconfined_java_roles;
type java_t, java_domain;
+typealias java_t alias java_domain_t;
type java_exec_t;
userdom_user_application_domain(java_t, java_exec_t)
typealias java_t alias { staff_javaplugin_t user_javaplugin_t sysadm_javaplugin_t };
@@ -71,19 +72,9 @@ can_exec(java_domain, { java_exec_t java
kernel_read_all_sysctls(java_domain)
kernel_search_vm_sysctl(java_domain)
kernel_read_network_state(java_domain)
-kernel_read_system_state(java_domain)
corecmd_search_bin(java_domain)
-corenet_all_recvfrom_unlabeled(java_domain)
-corenet_all_recvfrom_netlabel(java_domain)
-corenet_tcp_sendrecv_generic_if(java_domain)
-corenet_tcp_sendrecv_generic_node(java_domain)
-
-corenet_sendrecv_all_client_packets(java_domain)
-corenet_tcp_connect_all_ports(java_domain)
-corenet_tcp_sendrecv_all_ports(java_domain)
-
dev_read_sound(java_domain)
dev_write_sound(java_domain)
dev_read_urand(java_domain)
@@ -95,8 +86,6 @@ files_read_etc_runtime_files(java_domain
fs_getattr_all_fs(java_domain)
fs_dontaudit_rw_tmpfs_files(java_domain)
-logging_send_syslog_msg(java_domain)
-
miscfiles_read_localization(java_domain)
miscfiles_read_fonts(java_domain)

60
fix_kernel.patch
View File

@ -1,60 +0,0 @@
Index: fedora-policy-20230206/policy/modules/kernel/kernel.te
===================================================================
--- fedora-policy-20230206.orig/policy/modules/kernel/kernel.te
+++ fedora-policy-20230206/policy/modules/kernel/kernel.te
@@ -393,6 +393,13 @@ ifdef(`distro_redhat',`
fs_rw_tmpfs_chr_files(kernel_t)
')
+# this is a temporary fix. This permission doesn't make a lot of sense, but
+# without a kernel change there's not much we can do about it. I don't want to
+# audit it due to the unknown impact (happens e.g. during firewall changes)
+optional_policy(`
+ modutils_execute_kmod_tmpfs_files(kernel_t)
+')
+
optional_policy(`
abrt_filetrans_named_content(kernel_t)
abrt_dump_oops_domtrans(kernel_t)
@@ -418,6 +425,7 @@ optional_policy(`
init_dbus_chat(kernel_t)
init_sigchld(kernel_t)
init_dyntrans(kernel_t)
+ init_read_state(kernel_t)
')
optional_policy(`
@@ -519,6 +527,7 @@ optional_policy(`
')
optional_policy(`
+ xserver_read_xdm_state(kernel_t)
xserver_xdm_manage_spool(kernel_t)
xserver_filetrans_home_content(kernel_t)
')
Index: fedora-policy-20230206/policy/modules/system/modutils.if
===================================================================
--- fedora-policy-20230206.orig/policy/modules/system/modutils.if
+++ fedora-policy-20230206/policy/modules/system/modutils.if
@@ -525,3 +525,21 @@ interface(`modutils_dontaudit_kmod_tmpfs
dontaudit $1 kmod_tmpfs_t:file { getattr };
')
+
+#######################################
+## <summary>
+## Execute accesses to tmp file type.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`modutils_execute_kmod_tmpfs_files',`
+ gen_require(`
+ type kmod_tmpfs_t;
+ ')
+
+ allow $1 kmod_tmpfs_t:file { execute execute_no_trans };
+')

26
fix_kernel_sysctl.patch
View File

@ -1,26 +0,0 @@
Index: fedora-policy-20230116/policy/modules/kernel/files.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20230116/policy/modules/kernel/files.fc
@@ -242,6 +242,8 @@ ifdef(`distro_redhat',`
/usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0)
/usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0)
/usr/lib/modules(/.*)/initramfs.img -- gen_context(system_u:object_r:usr_t,s0)
+/usr/lib/modules(/.*)/sysctl.conf -- gen_context(system_u:object_r:usr_t,s0)
+/usr/lib/modules(/.*)/System.map -- gen_context(system_u:object_r:system_map_t,s0)
/usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
Index: fedora-policy-20230116/policy/modules/system/systemd.te
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/systemd.te
+++ fedora-policy-20230116/policy/modules/system/systemd.te
@@ -1113,6 +1113,8 @@ init_stream_connect(systemd_sysctl_t)
logging_send_syslog_msg(systemd_sysctl_t)
systemd_read_efivarfs(systemd_sysctl_t)
+# kernel specific sysctl.conf may be in modules dir
+allow systemd_sysctl_t modules_object_t:dir search;
#######################################
#

13
fix_libraries.patch
View File

@ -1,13 +0,0 @@
Index: fedora-policy-20210419/policy/modules/system/libraries.fc
===================================================================
--- fedora-policy-20210419.orig/policy/modules/system/libraries.fc
+++ fedora-policy-20210419/policy/modules/system/libraries.fc
@@ -124,6 +124,8 @@ ifdef(`distro_redhat',`
/usr/(.*/)?lib(/.*)?/ld-[^/]*\.so(\.[^/]*)* gen_context(system_u:object_r:ld_so_t,s0)
+/usr/lib/libreoffice/program/resource.* -- gen_context(system_u:object_r:lib_t,s0)
+
/usr/(.*/)?nvidia/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/(sse2/)?libfame-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)

20
fix_locallogin.patch
View File

@ -1,20 +0,0 @@
Index: fedora-policy-20220624/policy/modules/system/locallogin.te
===================================================================
--- fedora-policy-20220624.orig/policy/modules/system/locallogin.te
+++ fedora-policy-20220624/policy/modules/system/locallogin.te
@@ -63,6 +63,7 @@ kernel_read_system_state(local_login_t)
kernel_read_kernel_sysctls(local_login_t)
kernel_search_key(local_login_t)
kernel_link_key(local_login_t)
+kernel_getattr_proc(local_login_t)
corecmd_list_bin(local_login_t)
corecmd_read_bin_symlinks(local_login_t)
@@ -137,6 +138,7 @@ auth_rw_faillog(local_login_t)
auth_manage_pam_console_data(local_login_t)
auth_domtrans_pam_console(local_login_t)
auth_use_nsswitch(local_login_t)
+auth_read_shadow(local_login_t)
init_dontaudit_use_fds(local_login_t)
init_stream_connect(local_login_t)

48
fix_logging.patch
View File

@ -1,48 +0,0 @@
Index: fedora-policy-20230116/policy/modules/system/logging.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/logging.fc
+++ fedora-policy-20230116/policy/modules/system/logging.fc
@@ -3,6 +3,8 @@
/etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/rsyslog.d(/.*)? gen_context(system_u:object_r:syslog_conf_t,s0)
+/var/run/rsyslog/additional-log-sockets.conf -- gen_context(system_u:object_r:syslog_conf_t,s0)
+/run/rsyslog/additional-log-sockets.conf -- gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
/etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0)
/etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
@@ -83,6 +85,7 @@ ifdef(`distro_redhat',`
/var/run/syslogd\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
/var/run/syslog-ng.ctl -- gen_context(system_u:object_r:syslogd_var_run_t,s0)
/var/run/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,s0)
+/var/run/rsyslog(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,s0)
/var/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
/var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh)
Index: fedora-policy-20230116/policy/modules/system/logging.if
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/logging.if
+++ fedora-policy-20230116/policy/modules/system/logging.if
@@ -1806,3 +1806,22 @@ interface(`logging_dgram_send',`
allow $1 syslogd_t:unix_dgram_socket sendto;
')
+
+########################################
+## <summary>
+## Accept a message to syslogd over a unix domain
+## datagram socket.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`logging_dgram_accept',`
+ gen_require(`
+ type syslogd_t;
+ ')
+
+ allow $1 syslogd_t:unix_dgram_socket accept;
+')

12
fix_logrotate.patch
View File

@ -1,12 +0,0 @@
Index: fedora-policy-20210628/policy/modules/contrib/logrotate.te
===================================================================
--- fedora-policy-20210628.orig/policy/modules/contrib/logrotate.te
+++ fedora-policy-20210628/policy/modules/contrib/logrotate.te
@@ -104,6 +104,7 @@ files_var_lib_filetrans(logrotate_t, log
kernel_read_system_state(logrotate_t)
kernel_read_kernel_sysctls(logrotate_t)
+files_manage_mounttab(logrotate_t)
dev_read_urand(logrotate_t)
dev_read_sysfs(logrotate_t)

13
fix_mcelog.patch
View File

@ -1,13 +0,0 @@
Index: fedora-policy/policy/modules/contrib/mcelog.te
===================================================================
--- fedora-policy.orig/policy/modules/contrib/mcelog.te
+++ fedora-policy/policy/modules/contrib/mcelog.te
@@ -58,7 +58,7 @@ files_pid_file(mcelog_var_run_t)
# Local policy
#
-allow mcelog_t self:capability sys_admin;
+allow mcelog_t self:capability { sys_admin setgid };
allow mcelog_t self:unix_stream_socket connected_socket_perms;
allow mcelog_t mcelog_etc_t:dir list_dir_perms;

12
fix_miscfiles.patch
View File

@ -1,12 +0,0 @@
Index: fedora-policy/policy/modules/system/miscfiles.fc
===================================================================
--- fedora-policy.orig/policy/modules/system/miscfiles.fc 2019-08-05 09:39:39.117510678 +0200
+++ fedora-policy/policy/modules/system/miscfiles.fc 2019-08-22 12:44:01.678484113 +0200
@@ -46,6 +46,7 @@ ifdef(`distro_redhat',`
/usr/man(/.*)? gen_context(system_u:object_r:man_t,s0)
/usr/share/ca-certificates(/.*)? gen_context(system_u:object_r:cert_t,s0)
+/var/lib/ca-certificates(/.*)? gen_context(system_u:object_r:cert_t,s0)
/usr/share/fonts(/.*)? gen_context(system_u:object_r:fonts_t,s0)
/usr/share/ghostscript/fonts(/.*)? gen_context(system_u:object_r:fonts_t,s0)
/usr/share/locale(/.*)? gen_context(system_u:object_r:locale_t,s0)

24
fix_nagios.patch
View File

@ -1,24 +0,0 @@
Index: fedora-policy/policy/modules/contrib/nagios.fc
===================================================================
--- fedora-policy.orig/policy/modules/contrib/nagios.fc
+++ fedora-policy/policy/modules/contrib/nagios.fc
@@ -24,6 +24,7 @@
/var/log/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
/var/lib/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_var_lib_t,s0)
+/var/lib/nagios(/.*)? gen_context(system_u:object_r:nagios_var_lib_t,s0)
/var/run/nagios.* gen_context(system_u:object_r:nagios_var_run_t,s0)
Index: fedora-policy/policy/modules/contrib/nagios.te
===================================================================
--- fedora-policy.orig/policy/modules/contrib/nagios.te
+++ fedora-policy/policy/modules/contrib/nagios.te
@@ -161,6 +161,7 @@ allow nagios_t nagios_spool_t:file map;
manage_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
manage_fifo_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
manage_dirs_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
+manage_sock_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
files_var_lib_filetrans(nagios_t, nagios_var_lib_t, { dir file fifo_file })
kernel_read_system_state(nagios_t)

131
fix_networkmanager.patch
View File

@ -1,131 +0,0 @@
Index: fedora-policy-20230206/policy/modules/contrib/networkmanager.te
===================================================================
--- fedora-policy-20230206.orig/policy/modules/contrib/networkmanager.te
+++ fedora-policy-20230206/policy/modules/contrib/networkmanager.te
@@ -260,6 +260,7 @@ sysnet_search_dhcp_state(NetworkManager_
sysnet_manage_config(NetworkManager_t)
sysnet_filetrans_named_content(NetworkManager_t)
sysnet_filetrans_net_conf(NetworkManager_t)
+sysnet_watch_config(NetworkManager_t)
systemd_login_watch_pid_dirs(NetworkManager_t)
systemd_login_watch_session_dirs(NetworkManager_t)
@@ -276,6 +277,9 @@ userdom_read_home_certs(NetworkManager_t
userdom_read_user_home_content_files(NetworkManager_t)
userdom_dgram_send(NetworkManager_t)
+hostname_exec(NetworkManager_t)
+networkmanager_systemctl(NetworkManager_t)
+
tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(NetworkManager_t)
')
@@ -285,6 +289,14 @@ tunable_policy(`use_samba_home_dirs',`
')
optional_policy(`
+ ntp_manage_pid_files(NetworkManager_t)
+')
+
+optional_policy(`
+ nis_systemctl_ypbind(NetworkManager_t)
+')
+
+optional_policy(`
avahi_domtrans(NetworkManager_t)
avahi_kill(NetworkManager_t)
avahi_signal(NetworkManager_t)
@@ -293,6 +305,14 @@ optional_policy(`
')
optional_policy(`
+ packagekit_dbus_chat(NetworkManager_t)
+')
+
+optional_policy(`
+ networkmanager_dbus_chat(NetworkManager_t)
+')
+
+optional_policy(`
bind_domtrans(NetworkManager_t)
bind_manage_cache(NetworkManager_t)
bind_kill(NetworkManager_t)
@@ -420,6 +440,8 @@ optional_policy(`
nscd_kill(NetworkManager_t)
nscd_initrc_domtrans(NetworkManager_t)
nscd_systemctl(NetworkManager_t)
+ nscd_socket_use(NetworkManager_dispatcher_tlp_t)
+ nscd_socket_use(NetworkManager_dispatcher_custom_t)
')
optional_policy(`
@@ -608,6 +630,7 @@ files_manage_etc_files(NetworkManager_di
init_status(NetworkManager_dispatcher_cloud_t)
init_status(NetworkManager_dispatcher_ddclient_t)
+init_status(NetworkManager_dispatcher_custom_t)
init_append_stream_sockets(networkmanager_dispatcher_plugin)
init_ioctl_stream_sockets(networkmanager_dispatcher_plugin)
init_stream_connect(networkmanager_dispatcher_plugin)
@@ -623,6 +646,10 @@ optional_policy(`
')
optional_policy(`
+ nscd_shm_use(NetworkManager_dispatcher_chronyc_t)
+')
+
+optional_policy(`
cloudform_init_domtrans(NetworkManager_dispatcher_cloud_t)
')
Index: fedora-policy-20230206/policy/modules/contrib/networkmanager.if
===================================================================
--- fedora-policy-20230206.orig/policy/modules/contrib/networkmanager.if
+++ fedora-policy-20230206/policy/modules/contrib/networkmanager.if
@@ -132,6 +132,24 @@ interface(`networkmanager_initrc_domtran
init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t)
')
+#######################################
+## <summary>
+## Allow reading of NetworkManager link files
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to read the links
+## </summary>
+## </param>
+#
+interface(`networkmanager_initrc_read_lnk_files',`
+ gen_require(`
+ type NetworkManager_initrc_exec_t;
+ ')
+
+ read_lnk_files_pattern($1, NetworkManager_initrc_exec_t, NetworkManager_initrc_exec_t)
+')
+
########################################
## <summary>
## Execute NetworkManager server in the NetworkManager domain.
Index: fedora-policy-20230206/policy/modules/contrib/networkmanager.fc
===================================================================
--- fedora-policy-20230206.orig/policy/modules/contrib/networkmanager.fc
+++ fedora-policy-20230206/policy/modules/contrib/networkmanager.fc
@@ -24,6 +24,7 @@
/usr/lib/NetworkManager/dispatcher\.d/04-iscsi -- gen_context(system_u:object_r:NetworkManager_dispatcher_iscsid_script_t,s0)
/usr/lib/NetworkManager/dispatcher\.d/10-sendmail -- gen_context(system_u:object_r:NetworkManager_dispatcher_sendmail_script_t,s0)
/usr/lib/NetworkManager/dispatcher\.d/11-dhclient -- gen_context(system_u:object_r:NetworkManager_dispatcher_dhclient_script_t,s0)
+/usr/lib/NetworkManager/dispatcher\.d/20-chrony -- gen_context(system_u:object_r:NetworkManager_dispatcher_chronyc_script_t,s0)
/usr/lib/NetworkManager/dispatcher\.d/20-chrony-dhcp -- gen_context(system_u:object_r:NetworkManager_dispatcher_chronyc_script_t,s0)
/usr/lib/NetworkManager/dispatcher\.d/20-chrony-onoffline -- gen_context(system_u:object_r:NetworkManager_dispatcher_chronyc_script_t,s0)
/usr/lib/NetworkManager/dispatcher\.d/30-winbind -- gen_context(system_u:object_r:NetworkManager_dispatcher_winbind_script_t,s0)
@@ -37,6 +38,9 @@
/usr/libexec/nm-dispatcher -- gen_context(system_u:object_r:NetworkManager_dispatcher_exec_t,s0)
/usr/libexec/nm-priv-helper -- gen_context(system_u:object_r:NetworkManager_priv_helper_exec_t,s0)
+# bsc#1206355
+/usr/lib/nm-dispatcher -- gen_context(system_u:object_r:NetworkManager_dispatcher_exec_t,s0)
+/usr/lib/nm-priv-helper -- gen_context(system_u:object_r:NetworkManager_priv_helper_exec_t,s0)
/usr/bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0)
/usr/bin/wpa_cli -- gen_context(system_u:object_r:wpa_cli_exec_t,s0)

12
fix_nis.patch
View File

@ -1,12 +0,0 @@
Index: fedora-policy/policy/modules/contrib/nis.te
===================================================================
--- fedora-policy.orig/policy/modules/contrib/nis.te
+++ fedora-policy/policy/modules/contrib/nis.te
@@ -78,6 +78,7 @@ manage_files_pattern(ypbind_t, ypbind_va
files_pid_filetrans(ypbind_t, ypbind_var_run_t, file)
manage_files_pattern(ypbind_t, var_yp_t, var_yp_t)
+manage_dirs_pattern(ypbind_t, var_yp_t, var_yp_t)
kernel_read_system_state(ypbind_t)
kernel_read_kernel_sysctls(ypbind_t)

35
fix_nscd.patch
View File

@ -1,35 +0,0 @@
Index: fedora-policy-20210628/policy/modules/contrib/nscd.fc
===================================================================
--- fedora-policy-20210628.orig/policy/modules/contrib/nscd.fc
+++ fedora-policy-20210628/policy/modules/contrib/nscd.fc
@@ -8,8 +8,10 @@
/var/log/nscd\.log.* -- gen_context(system_u:object_r:nscd_log_t,s0)
/var/run/nscd\.pid -- gen_context(system_u:object_r:nscd_var_run_t,s0)
-/var/run/\.nscd_socket -s gen_context(system_u:object_r:nscd_var_run_t,s0)
+/var/run/nscd/socket -s gen_context(system_u:object_r:nscd_var_run_t,s0)
+/var/lib/nscd(/.*)? gen_context(system_u:object_r:nscd_var_run_t,s0)
/var/run/nscd(/.*)? gen_context(system_u:object_r:nscd_var_run_t,s0)
/usr/lib/systemd/system/nscd\.service -- gen_context(system_u:object_r:nscd_unit_file_t,s0)
+
Index: fedora-policy-20210628/policy/modules/contrib/nscd.te
===================================================================
--- fedora-policy-20210628.orig/policy/modules/contrib/nscd.te
+++ fedora-policy-20210628/policy/modules/contrib/nscd.te
@@ -130,6 +130,14 @@ userdom_dontaudit_use_unpriv_user_fds(ns
userdom_dontaudit_search_user_home_dirs(nscd_t)
optional_policy(`
+ networkmanager_read_pid_files(nscd_t)
+')
+
+optional_policy(`
+ wicked_read_pid_files(nscd_t)
+')
+
+optional_policy(`
accountsd_dontaudit_rw_fifo_file(nscd_t)
')

99
fix_ntp.patch
View File

@ -1,99 +0,0 @@
Index: fedora-policy-20230125/policy/modules/contrib/ntp.fc
===================================================================
--- fedora-policy-20230125.orig/policy/modules/contrib/ntp.fc
+++ fedora-policy-20230125/policy/modules/contrib/ntp.fc
@@ -9,6 +9,7 @@
/etc/rc\.d/init\.d/ntpd -- gen_context(system_u:object_r:ntpd_initrc_exec_t,s0)
+/usr/sbin/start-ntpd -- gen_context(system_u:object_r:ntpd_exec_t,s0)
/usr/sbin/ntpd -- gen_context(system_u:object_r:ntpd_exec_t,s0)
/usr/sbin/ntpdate -- gen_context(system_u:object_r:ntpdate_exec_t,s0)
/usr/libexec/ntpdate-wrapper -- gen_context(system_u:object_r:ntpdate_exec_t,s0)
@@ -16,7 +17,6 @@
/usr/lib/systemd/system/ntpd.* -- gen_context(system_u:object_r:ntpd_unit_file_t,s0)
-/var/lib/ntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
/var/lib/sntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
/var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
@@ -25,3 +25,26 @@
/var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0)
/var/run/ntpd\.pid -- gen_context(system_u:object_r:ntpd_var_run_t,s0)
+
+/var/lib/ntp gen_context(system_u:object_r:root_t,s0)
+/var/lib/ntp/kod gen_context(system_u:object_r:etc_runtime_t,s0)
+/var/lib/ntp/dev gen_context(system_u:object_r:device_t,s0)
+/var/lib/ntp/etc gen_context(system_u:object_r:etc_t,s0)
+/var/lib/ntp/etc/ntpd.*\.conf.* -- gen_context(system_u:object_r:ntp_conf_t,s0)
+/var/lib/ntp/etc/ntp/crypto(/.*)? -- gen_context(system_u:object_r:ntpd_key_t,s0)
+/var/lib/ntp/etc/ntp/data(/.*)? -- gen_context(system_u:object_r:ntp_drift_t,s0)
+/var/lib/ntp/etc/ntp/keys -- gen_context(system_u:object_r:ntpd_key_t,s0)
+/var/lib/ntp/etc/ntp/step-tickers.* -- gen_context(system_u:object_r:ntp_conf_t,s0)
+/var/lib/ntp/etc/ntp.conf.iburst -- gen_context(system_u:object_r:ntp_conf_t,s0)
+/var/lib/ntp/var(/.*)? gen_context(system_u:object_r:var_t,s0)
+/var/lib/ntp/var/lib(/.*)? gen_context(system_u:object_r:var_lib_t,s0)
+/var/lib/ntp/var/run(/.*)? gen_context(system_u:object_r:var_run_t,s0)
+/var/lib/ntp/var/run/ntp(/.*)? gen_context(system_u:object_r:ntpd_var_run_t,s0)
+/var/lib/ntp/var/lib/ntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
+/var/lib/ntp/var/lib/sntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
+/var/lib/ntp/var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
+/var/lib/ntp/drift gen_context(system_u:object_r:ntp_drift_t,s0)
+/var/lib/ntp/drift/ntp.drift -- gen_context(system_u:object_r:ntp_drift_t,s0)
+/var/lib/ntp/var/log/ntp.* -- gen_context(system_u:object_r:ntpd_log_t,s0)
+/var/lib/ntp/var/log/ntpstats(/.*)? gen_context(system_u:object_r:ntpd_log_t,s0)
+/var/lib/ntp/var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0)
Index: fedora-policy-20230125/policy/modules/contrib/ntp.te
===================================================================
--- fedora-policy-20230125.orig/policy/modules/contrib/ntp.te
+++ fedora-policy-20230125/policy/modules/contrib/ntp.te
@@ -49,6 +49,9 @@ init_system_domain(ntpd_t, ntpdate_exec_
allow ntpd_t self:capability { chown dac_read_search kill setgid setuid sys_time ipc_lock ipc_owner sys_chroot sys_nice sys_resource };
dontaudit ntpd_t self:capability { net_admin sys_tty_config fsetid sys_nice };
+# remove once 1207577 is done
+allow ntpd_t self:capability dac_override;
+
allow ntpd_t self:process { signal_perms getcap setcap setsched setrlimit };
allow ntpd_t self:fifo_file rw_fifo_file_perms;
allow ntpd_t self:shm create_shm_perms;
@@ -78,7 +81,8 @@ manage_files_pattern(ntpd_t, ntpd_tmpfs_
fs_tmpfs_filetrans(ntpd_t, ntpd_tmpfs_t, { dir file })
manage_files_pattern(ntpd_t, ntpd_var_run_t, ntpd_var_run_t)
-files_pid_filetrans(ntpd_t, ntpd_var_run_t, file)
+manage_lnk_files_pattern(ntpd_t, ntpd_var_run_t, ntpd_var_run_t)
+files_pid_filetrans(ntpd_t, ntpd_var_run_t, { file dir lnk_file })
can_exec(ntpd_t, ntpd_exec_t)
can_exec(ntpd_t, ntpdate_exec_t)
Index: fedora-policy-20230125/policy/modules/contrib/ntp.if
===================================================================
--- fedora-policy-20230125.orig/policy/modules/contrib/ntp.if
+++ fedora-policy-20230125/policy/modules/contrib/ntp.if
@@ -339,3 +339,23 @@ interface(`ntp_manage_log',`
manage_lnk_files_pattern($1, ntpd_log_t, ntpd_log_t)
')
+########################################
+## <summary>
+## Create, read, write, and delete
+## ntp pid (lnk) files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ntp_manage_pid_files',`
+ gen_require(`
+ type ntpd_var_run_t;
+ ')
+
+ files_search_pids($1)
+ manage_files_pattern($1, ntpd_var_run_t, ntpd_var_run_t)
+ manage_lnk_files_pattern($1, ntpd_var_run_t, ntpd_var_run_t)
+')

41
fix_openvpn.patch
View File

@ -1,41 +0,0 @@
Index: fedora-policy/policy/modules/contrib/openvpn.te
===================================================================
--- fedora-policy.orig/policy/modules/contrib/openvpn.te
+++ fedora-policy/policy/modules/contrib/openvpn.te
@@ -28,6 +28,14 @@ gen_tunable(openvpn_enable_homedirs, fal
## </desc>
gen_tunable(openvpn_can_network_connect, true)
+## <desc>
+## <p>
+## Determine whether openvpn can
+## change sysctl values (e.g. rp_filter)
+## </p>
+## </desc>
+gen_tunable(openvpn_allow_changing_sysctls, false)
+
attribute_role openvpn_roles;
type openvpn_t;
@@ -176,6 +184,10 @@ userdom_attach_admin_tun_iface(openvpn_t
userdom_read_inherited_user_tmp_files(openvpn_t)
userdom_read_inherited_user_home_content_files(openvpn_t)
+tunable_policy(`openvpn_allow_changing_sysctls',`
+ kernel_rw_net_sysctls(openvpn_t)
+')
+
tunable_policy(`openvpn_enable_homedirs',`
userdom_search_user_home_dirs(openvpn_t)
')
@@ -195,6 +207,10 @@ tunable_policy(`openvpn_can_network_conn
')
optional_policy(`
+ firewalld_dbus_chat(openvpn_t)
+')
+
+optional_policy(`
brctl_domtrans(openvpn_t)
')

120
fix_postfix.patch
View File

@ -1,120 +0,0 @@
Index: fedora-policy-20221019/policy/modules/contrib/postfix.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/postfix.fc
+++ fedora-policy-20221019/policy/modules/contrib/postfix.fc
@@ -1,37 +1,21 @@
# postfix
-/etc/rc\.d/init\.d/postfix -- gen_context(system_u:object_r:postfix_initrc_exec_t,s0)
-/etc/postfix.* gen_context(system_u:object_r:postfix_etc_t,s0)
-/etc/postfix/chroot-update -- gen_context(system_u:object_r:postfix_exec_t,s0)
-ifdef(`distro_redhat', `
-/usr/libexec/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
-/usr/libexec/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
-/usr/libexec/postfix/lmtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
-/usr/libexec/postfix/local -- gen_context(system_u:object_r:postfix_local_exec_t,s0)
-/usr/libexec/postfix/master -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
-/usr/libexec/postfix/pickup -- gen_context(system_u:object_r:postfix_pickup_exec_t,s0)
-/usr/libexec/postfix/(n)?qmgr -- gen_context(system_u:object_r:postfix_qmgr_exec_t,s0)
-/usr/libexec/postfix/showq -- gen_context(system_u:object_r:postfix_showq_exec_t,s0)
-/usr/libexec/postfix/smtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
-/usr/libexec/postfix/scache -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
-/usr/libexec/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
-/usr/libexec/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
-/usr/libexec/postfix/pipe -- gen_context(system_u:object_r:postfix_pipe_exec_t,s0)
-/usr/libexec/postfix/virtual -- gen_context(system_u:object_r:postfix_virtual_exec_t,s0)
-', `
-/usr/lib/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
-/usr/lib/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
-/usr/lib/postfix/local -- gen_context(system_u:object_r:postfix_local_exec_t,s0)
-/usr/lib/postfix/master -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
-/usr/lib/postfix/pickup -- gen_context(system_u:object_r:postfix_pickup_exec_t,s0)
-/usr/lib/postfix/(n)?qmgr -- gen_context(system_u:object_r:postfix_qmgr_exec_t,s0)
-/usr/lib/postfix/showq -- gen_context(system_u:object_r:postfix_showq_exec_t,s0)
-/usr/lib/postfix/smtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
-/usr/lib/postfix/lmtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
-/usr/lib/postfix/scache -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
-/usr/lib/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
-/usr/lib/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
-/usr/lib/postfix/pipe -- gen_context(system_u:object_r:postfix_pipe_exec_t,s0)
-')
+/etc/rc\.d/init\.d/postfix -- gen_context(system_u:object_r:postfix_initrc_exec_t,s0)
+/etc/postfix.* gen_context(system_u:object_r:postfix_etc_t,s0)
+/etc/postfix/chroot-update -- gen_context(system_u:object_r:postfix_exec_t,s0)
+/usr/lib/postfix/bin/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
+/usr/lib/postfix/systemd/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
+/usr/lib/postfix/bin/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
+/usr/lib/postfix/bin/local -- gen_context(system_u:object_r:postfix_local_exec_t,s0)
+/usr/lib/postfix/bin/master -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
+/usr/lib/postfix/bin/pickup -- gen_context(system_u:object_r:postfix_pickup_exec_t,s0)
+/usr/lib/postfix/bin/(n)?qmgr -- gen_context(system_u:object_r:postfix_qmgr_exec_t,s0)
+/usr/lib/postfix/bin/showq -- gen_context(system_u:object_r:postfix_showq_exec_t,s0)
+/usr/lib/postfix/bin/smtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
+/usr/lib/postfix/bin/lmtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
+/usr/lib/postfix/bin/scache -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
+/usr/lib/postfix/bin/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
+/usr/lib/postfix/bin/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
+/usr/lib/postfix/bin/pipe -- gen_context(system_u:object_r:postfix_pipe_exec_t,s0)
/etc/postfix/postfix-script.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
/etc/postfix/prng_exch -- gen_context(system_u:object_r:postfix_prng_t,s0)
/usr/sbin/postalias -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
@@ -45,13 +29,16 @@ ifdef(`distro_redhat', `
/usr/sbin/postqueue -- gen_context(system_u:object_r:postfix_postqueue_exec_t,s0)
/usr/sbin/postsuper -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
+/etc/postfix/system/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
+/etc/postfix/system/update_postmaps -- gen_context(system_u:object_r:postfix_map_exec_t,s0)
+
/var/lib/postfix.* gen_context(system_u:object_r:postfix_data_t,s0)
/var/spool/postfix.* gen_context(system_u:object_r:postfix_spool_t,s0)
/var/spool/postfix/deferred(/.*)? gen_context(system_u:object_r:postfix_spool_t,s0)
/var/spool/postfix/defer(/.*)? gen_context(system_u:object_r:postfix_spool_t,s0)
/var/spool/postfix/maildrop(/.*)? gen_context(system_u:object_r:postfix_spool_t,s0)
-/var/spool/postfix/pid/.* gen_context(system_u:object_r:postfix_var_run_t,s0)
+/var/spool/postfix/pid(/.*)? gen_context(system_u:object_r:postfix_var_run_t,s0)
/var/spool/postfix/private(/.*)? gen_context(system_u:object_r:postfix_private_t,s0)
/var/spool/postfix/public(/.*)? gen_context(system_u:object_r:postfix_public_t,s0)
/var/spool/postfix/bounce(/.*)? gen_context(system_u:object_r:postfix_spool_bounce_t,s0)
Index: fedora-policy-20221019/policy/modules/contrib/postfix.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/postfix.te
+++ fedora-policy-20221019/policy/modules/contrib/postfix.te
@@ -121,6 +121,8 @@ allow postfix_master_t self:udp_socket c
allow postfix_master_t postfix_etc_t:dir rw_dir_perms;
allow postfix_master_t postfix_etc_t:file rw_file_perms;
mta_filetrans_aliases(postfix_master_t, postfix_etc_t)
+# SUSE also runs this on /etc/alias
+mta_filetrans_aliases(postfix_master_t, etc_t)
can_exec(postfix_master_t, postfix_exec_t)
@@ -447,6 +449,14 @@ logging_send_syslog_msg(postfix_map_t)
userdom_use_inherited_user_ptys(postfix_map_t)
+corecmd_exec_bin(postfix_map_t)
+allow postfix_map_t postfix_map_exec_t:file execute_no_trans;
+init_ioctl_stream_sockets(postfix_map_t)
+
+optional_policy(`
+ mta_read_aliases(postfix_map_t)
+')
+
optional_policy(`
locallogin_dontaudit_use_fds(postfix_map_t)
')
@@ -687,6 +697,14 @@ corenet_tcp_connect_spamd_port(postfix_m
files_search_all_mountpoints(postfix_smtp_t)
optional_policy(`
+ networkmanager_read_pid_files(postfix_smtp_t)
+')
+
+optional_policy(`
+ wicked_read_pid_files(postfix_smtp_t)
+')
+
+optional_policy(`
cyrus_stream_connect(postfix_smtp_t)
cyrus_runtime_stream_connect(postfix_smtp_t)
')

50
fix_rpm.patch
View File

@ -1,50 +0,0 @@
Index: fedora-policy-20230116/policy/modules/contrib/rpm.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/contrib/rpm.fc
+++ fedora-policy-20230116/policy/modules/contrib/rpm.fc
@@ -23,6 +23,9 @@
# This is in /usr, but is expected to be variable content from a policy perspective (#2042149)
/usr/lib/sysimage/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
+/usr/sbin/zypp-refresh -- gen_context(system_u:object_r:rpm_exec_t,s0)
+/usr/bin/zypper -- gen_context(system_u:object_r:rpm_exec_t,s0)
+
/usr/libexec/packagekitd -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/libexec/yumDBUSBackend.py -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/libexec/pegasus/pycmpiLMI_Software-cimprovagt -- gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -61,6 +64,8 @@ ifdef(`distro_redhat', `
/var/cache/yum(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0)
/var/cache/dnf(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0)
+/var/cache/zypp(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0)
+
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
/var/lib/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
/var/lib/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
Index: fedora-policy-20230116/policy/modules/contrib/rpm.if
===================================================================
--- fedora-policy-20230116.orig/policy/modules/contrib/rpm.if
+++ fedora-policy-20230116/policy/modules/contrib/rpm.if
@@ -515,8 +515,10 @@ interface(`rpm_named_filetrans',`
logging_log_named_filetrans($1, rpm_log_t, file, "yum.log")
logging_log_named_filetrans($1, rpm_log_t, file, "hawkey.log")
logging_log_named_filetrans($1, rpm_log_t, file, "up2date")
+ logging_log_named_filetrans($1, rpm_log_t, file, "zypper.log")
files_var_filetrans($1, rpm_var_cache_t, dir, "dnf")
files_var_filetrans($1, rpm_var_cache_t, dir, "yum")
+ files_var_filetrans($1, rpm_var_cache_t, dir, "zypp")
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "dnf")
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "yum")
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpm")
Index: fedora-policy-20230116/policy/modules/kernel/files.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20230116/policy/modules/kernel/files.fc
@@ -67,6 +67,7 @@ ifdef(`distro_redhat',`
/etc/sysconfig/ipvsadm.* -- gen_context(system_u:object_r:system_conf_t,s0)
/etc/sysconfig/system-config-firewall.* -- gen_context(system_u:object_r:system_conf_t,s0)
/etc/yum\.repos\.d(/.*)? gen_context(system_u:object_r:system_conf_t,s0)
+/etc/zypp(/.*)? gen_context(system_u:object_r:system_conf_t,s0)
/etc/ostree/remotes.d(/.*)? gen_context(system_u:object_r:system_conf_t,s0)
/ostree/repo(/.*)? gen_context(system_u:object_r:system_conf_t,s0)

11
fix_rtkit.patch
View File

@ -1,11 +0,0 @@
Index: fedora-policy-20230116/policy/modules/contrib/rtkit.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/contrib/rtkit.fc
+++ fedora-policy-20230116/policy/modules/contrib/rtkit.fc
@@ -1,5 +1,6 @@
/etc/rc\.d/init\.d/rtkit-daemon -- gen_context(system_u:object_r:rtkit_daemon_initrc_exec_t,s0)
/usr/libexec/rtkit-daemon -- gen_context(system_u:object_r:rtkit_daemon_exec_t,s0)
+/usr/libexec/rtkit/rtkit-daemon -- gen_context(system_u:object_r:rtkit_daemon_exec_t,s0)
/usr/lib/rtkit/rtkit-daemon -- gen_context(system_u:object_r:rtkit_daemon_exec_t,s0)

22
fix_screen.patch
View File

@ -1,22 +0,0 @@
Index: fedora-policy/policy/modules/contrib/screen.if
===================================================================
--- fedora-policy.orig/policy/modules/contrib/screen.if
+++ fedora-policy/policy/modules/contrib/screen.if
@@ -45,6 +45,7 @@ template(`screen_role_template',`
userdom_list_user_home_dirs($1_screen_t)
userdom_home_reader($1_screen_t)
+ userdom_read_user_home_content_symlinks($1_screen_t)
domtrans_pattern($3, screen_exec_t, $1_screen_t)
allow $3 $1_screen_t:process { signal sigchld };
Index: fedora-policy/policy/modules/contrib/screen.fc
===================================================================
--- fedora-policy.orig/policy/modules/contrib/screen.fc
+++ fedora-policy/policy/modules/contrib/screen.fc
@@ -8,4 +8,5 @@ HOME_DIR/\.tmux\.conf -- gen_context(sys
/usr/bin/tmux -- gen_context(system_u:object_r:screen_exec_t,s0)
/var/run/screen(/.*)? gen_context(system_u:object_r:screen_var_run_t,s0)
+/var/run/uscreens(/.*)?' gen_context(system_u:object_r:screen_var_run_t,s0)
/var/run/tmux(/.*)? gen_context(system_u:object_r:screen_var_run_t,s0)

39
fix_selinuxutil.patch
View File

@ -1,39 +0,0 @@
Index: fedora-policy-20230116/policy/modules/system/selinuxutil.te
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/selinuxutil.te
+++ fedora-policy-20230116/policy/modules/system/selinuxutil.te
@@ -239,6 +239,10 @@ ifdef(`hide_broken_symptoms',`
')
optional_policy(`
+ packagekit_read_write_fifo(load_policy_t)
+')
+
+optional_policy(`
portage_dontaudit_use_fds(load_policy_t)
')
@@ -619,6 +623,10 @@ logging_send_audit_msgs(setfiles_t)
logging_send_syslog_msg(setfiles_t)
optional_policy(`
+ packagekit_read_write_fifo(setfiles_t)
+')
+
+optional_policy(`
cloudform_dontaudit_write_cloud_log(setfiles_t)
')
Index: fedora-policy-20230116/policy/modules/system/selinuxutil.if
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/selinuxutil.if
+++ fedora-policy-20230116/policy/modules/system/selinuxutil.if
@@ -795,6 +795,8 @@ interface(`seutil_dontaudit_read_config'
dontaudit $1 selinux_config_t:dir search_dir_perms;
dontaudit $1 selinux_config_t:file read_file_perms;
+ # /etc/selinux/config was a link to /etc/sysconfig/selinux-policy, ignore read attemps
+ dontaudit $1 selinux_config_t:lnk_file read_lnk_file_perms;
')
########################################

32
fix_sendmail.patch
View File

@ -1,32 +0,0 @@
Index: fedora-policy-20221019/policy/modules/contrib/sendmail.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/sendmail.fc
+++ fedora-policy-20221019/policy/modules/contrib/sendmail.fc
@@ -1,8 +1,9 @@
/etc/rc\.d/init\.d/sendmail -- gen_context(system_u:object_r:sendmail_initrc_exec_t,s0)
+/etc/mail/system/sm-client.pre -- gen_context(system_u:object_r:sendmail_initrc_exec_t,s0)
/var/log/sendmail\.st.* -- gen_context(system_u:object_r:sendmail_log_t,s0)
/var/log/mail(/.*)? gen_context(system_u:object_r:sendmail_log_t,s0)
-/var/run/sendmail\.pid -- gen_context(system_u:object_r:sendmail_var_run_t,s0)
+/var/run/sendmail(/.*)? gen_context(system_u:object_r:sendmail_var_run_t,s0)
/var/run/sm-client\.pid -- gen_context(system_u:object_r:sendmail_var_run_t,s0)
Index: fedora-policy-20221019/policy/modules/contrib/sendmail.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/sendmail.te
+++ fedora-policy-20221019/policy/modules/contrib/sendmail.te
@@ -60,8 +60,10 @@ manage_dirs_pattern(sendmail_t, sendmail
manage_files_pattern(sendmail_t, sendmail_tmp_t, sendmail_tmp_t)
files_tmp_filetrans(sendmail_t, sendmail_tmp_t, { file dir })
-allow sendmail_t sendmail_var_run_t:file manage_file_perms;
-files_pid_filetrans(sendmail_t, sendmail_var_run_t, file)
+manage_dirs_pattern(sendmail_t, sendmail_var_run_t, sendmail_var_run_t)
+manage_files_pattern(sendmail_t, sendmail_var_run_t, sendmail_var_run_t)
+manage_sock_files_pattern(sendmail_t, sendmail_var_run_t, sendmail_var_run_t)
+files_pid_filetrans(sendmail_t, sendmail_var_run_t, { file dir })
kernel_read_network_state(sendmail_t)
kernel_read_kernel_sysctls(sendmail_t)

9
fix_smartmon.patch
View File

@ -1,9 +0,0 @@
Index: fedora-policy/policy/modules/contrib/smartmon.fc
===================================================================
--- fedora-policy.orig/policy/modules/contrib/smartmon.fc
+++ fedora-policy/policy/modules/contrib/smartmon.fc
@@ -5,3 +5,4 @@
/var/run/smartd\.pid -- gen_context(system_u:object_r:fsdaemon_var_run_t,s0)
/var/lib/smartmontools(/.*)? gen_context(system_u:object_r:fsdaemon_var_lib_t,s0)
+/var/lib/smartmontools/smartd_opts -- gen_context(system_u:object_r:etc_t,s0)

68
fix_snapper.patch
View File

@ -1,68 +0,0 @@
Index: fedora-policy-20221019/policy/modules/contrib/snapper.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/snapper.te
+++ fedora-policy-20221019/policy/modules/contrib/snapper.te
@@ -18,6 +18,9 @@ files_config_file(snapperd_conf_t)
type snapperd_data_t;
files_type(snapperd_data_t)
+type snapperd_tmp_t;
+files_tmp_file(snapperd_tmp_t)
+
########################################
#
# snapperd local policy
@@ -43,6 +46,10 @@ allow snapperd_t snapperd_data_t:dir { r
allow snapperd_t snapperd_data_t:file relabelfrom;
snapper_filetrans_named_content(snapperd_t)
+allow snapperd_t snapperd_tmp_t:file manage_file_perms;
+allow snapperd_t snapperd_tmp_t:dir manage_dir_perms;
+files_tmp_filetrans(snapperd_t, snapperd_tmp_t, { file dir })
+
kernel_setsched(snapperd_t)
domain_read_all_domains_state(snapperd_t)
@@ -73,6 +80,14 @@ storage_raw_read_fixed_disk(snapperd_t)
auth_use_nsswitch(snapperd_t)
optional_policy(`
+ packagekit_dbus_chat(snapperd_t)
+')
+
+optional_policy(`
+ rpm_dbus_chat(snapperd_t)
+')
+
+optional_policy(`
cron_system_entry(snapperd_t, snapperd_exec_t)
')
Index: fedora-policy-20221019/policy/modules/contrib/snapper.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/snapper.fc
+++ fedora-policy-20221019/policy/modules/contrib/snapper.fc
@@ -7,9 +7,17 @@
/var/log/snapper\.log.* -- gen_context(system_u:object_r:snapperd_log_t,s0)
-/mnt/(.*/)?\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
-/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
-/usr/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
-/var/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
-/etc/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
-HOME_ROOT/(.*/)?\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
+/mnt/(.*/)?\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
+/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
+/usr/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
+/var/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
+/etc/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
+HOME_ROOT/(.*/)?\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
+
+# ensure that the snapshots itself aren't relabled
+/mnt/(.*/)?\.snapshots/[^/]*/snapshot(/.*)? <<none>>
+/\.snapshots/[^/]*/snapshot(/.*)? <<none>>
+/usr/\.snapshots/[^/]*/snapshot(/.*)? <<none>>
+/var/\.snapshots/[^/]*/snapshot(/.*)? <<none>>
+/etc/\.snapshots/[^/]*/snapshot(/.*)? <<none>>
+HOME_ROOT/(.*/)?\.snapshots/[^/]*/snapshot(/.*)? <<none>>

33
fix_sslh.patch
View File

@ -1,33 +0,0 @@
Index: fedora-policy/policy/modules/contrib/sslh.te
===================================================================
--- fedora-policy.orig/policy/modules/contrib/sslh.te
+++ fedora-policy/policy/modules/contrib/sslh.te
@@ -28,6 +28,7 @@ gen_tunable(sslh_can_bind_any_port, fals
type sslh_t;
type sslh_exec_t;
init_daemon_domain(sslh_t, sslh_exec_t)
+init_nnp_daemon_domain(sslh_t)
type sslh_config_t;
files_config_file(sslh_config_t)
@@ -90,6 +91,7 @@ tunable_policy(`sslh_can_connect_any_por
# allow sslh to connect to any port
corenet_tcp_sendrecv_all_ports(sslh_t)
corenet_tcp_connect_all_ports(sslh_t)
+ corenet_tcp_connect_all_ports(sslh_t)
')
tunable_policy(`sslh_can_bind_any_port',`
Index: fedora-policy/policy/modules/contrib/sslh.fc
===================================================================
--- fedora-policy.orig/policy/modules/contrib/sslh.fc
+++ fedora-policy/policy/modules/contrib/sslh.fc
@@ -4,6 +4,8 @@
/etc/rc\.d/init\.d/sslh -- gen_context(system_u:object_r:sslh_initrc_exec_t,s0)
/etc/sslh(/.*)? gen_context(system_u:object_r:sslh_config_t,s0)
/etc/sslh\.cfg -- gen_context(system_u:object_r:sslh_config_t,s0)
+/etc/conf\.d/sslh -- gen_context(system_u:object_r:sslh_config_t,s0)
+/etc/default/sslh -- gen_context(system_u:object_r:sslh_config_t,s0)
/etc/sysconfig/sslh -- gen_context(system_u:object_r:sslh_config_t,s0)
/usr/lib/systemd/system/sslh.* -- gen_context(system_u:object_r:sslh_unit_file_t,s0)
/var/run/sslh.* gen_context(system_u:object_r:sslh_var_run_t,s0)

25
fix_sysnetwork.patch
View File

@ -1,25 +0,0 @@
Index: fedora-policy-20221019/policy/modules/system/sysnetwork.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/sysnetwork.fc
+++ fedora-policy-20221019/policy/modules/system/sysnetwork.fc
@@ -33,9 +33,9 @@ ifdef(`distro_debian',`
/etc/dhcp3?/dhclient.* gen_context(system_u:object_r:dhcp_etc_t,s0)
ifdef(`distro_redhat',`
-/etc/sysconfig/network-scripts/.*resolv\.conf -- gen_context(system_u:object_r:net_conf_t,s0)
+/etc/sysconfig/network/.*resolv\.conf -- gen_context(system_u:object_r:net_conf_t,s0)
/etc/sysconfig/networking(/.*)? gen_context(system_u:object_r:net_conf_t,s0)
-/etc/sysconfig/network-scripts(/.*)? gen_context(system_u:object_r:net_conf_t,s0)
+/etc/sysconfig/network(/.*)? gen_context(system_u:object_r:net_conf_t,s0)
/var/run/systemd/network(/.*)? gen_context(system_u:object_r:net_conf_t,s0)
/var/run/systemd/resolve/resolv\.conf -- gen_context(system_u:object_r:net_conf_t,s0)
/var/run/systemd/resolve/stub-resolv\.conf gen_context(system_u:object_r:net_conf_t,s0)
@@ -103,6 +103,8 @@ ifdef(`distro_debian',`
/var/run/network(/.*)? gen_context(system_u:object_r:net_conf_t,s0)
')
+/var/run/netconfig(/.*)? gen_context(system_u:object_r:net_conf_t,s0)
+
/var/run/netns -d gen_context(system_u:object_r:ifconfig_var_run_t,s0)
/var/run/netns/[^/]+ <<none>>

35
fix_systemd.patch
View File

@ -1,35 +0,0 @@
Index: fedora-policy-20230116/policy/modules/system/systemd.te
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/systemd.te
+++ fedora-policy-20230116/policy/modules/system/systemd.te
@@ -381,6 +381,10 @@ userdom_manage_user_tmp_chr_files(system
xserver_dbus_chat(systemd_logind_t)
optional_policy(`
+ packagekit_dbus_chat(systemd_logind_t)
+')
+
+optional_policy(`
apache_read_tmp_files(systemd_logind_t)
')
@@ -863,6 +867,10 @@ optional_policy(`
dbus_system_bus_client(systemd_localed_t)
')
+optional_policy(`
+ nscd_unconfined(systemd_hostnamed_t)
+')
+
#######################################
#
# Hostnamed policy
@@ -1195,6 +1203,8 @@ systemd_unit_file_filetrans(systemd_gpt_
systemd_create_unit_file_dirs(systemd_gpt_generator_t)
systemd_create_unit_file_lnk(systemd_gpt_generator_t)
+kernel_dgram_send(systemd_gpt_generator_t)
+
optional_policy(`
udev_read_pid_files(systemd_gpt_generator_t)
')

17
fix_systemd_watch.patch
View File

@ -1,17 +0,0 @@
Index: fedora-policy-20230206/policy/modules/system/systemd.te
===================================================================
--- fedora-policy-20230206.orig/policy/modules/system/systemd.te
+++ fedora-policy-20230206/policy/modules/system/systemd.te
@@ -1524,6 +1524,12 @@ fstools_rw_swap_files(systemd_sleep_t)
storage_getattr_fixed_disk_dev(systemd_sleep_t)
storage_getattr_removable_dev(systemd_sleep_t)
+#######################################
+#
+# Allow systemd to watch certificate dir for ca-certificates
+#
+watch_dirs_pattern(init_t,cert_t,cert_t)
+
optional_policy(`
sysstat_domtrans(systemd_sleep_t)
')

12
fix_thunderbird.patch
View File

@ -1,12 +0,0 @@
Index: fedora-policy-20210628/policy/modules/contrib/thunderbird.te
===================================================================
--- fedora-policy-20210628.orig/policy/modules/contrib/thunderbird.te
+++ fedora-policy-20210628/policy/modules/contrib/thunderbird.te
@@ -138,7 +138,6 @@ optional_policy(`
optional_policy(`
gnome_stream_connect_gconf(thunderbird_t)
gnome_domtrans_gconfd(thunderbird_t)
- gnome_manage_generic_home_content(thunderbird_t)
')
optional_policy(`

22
fix_unconfined.patch
View File

@ -1,22 +0,0 @@
Index: fedora-policy-20221019/policy/modules/system/unconfined.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/unconfined.te
+++ fedora-policy-20221019/policy/modules/system/unconfined.te
@@ -1,5 +1,10 @@
policy_module(unconfined, 3.5.0)
+require {
+ type var_run_t;
+ type net_conf_t;
+}
+
########################################
#
# Declarations
@@ -45,3 +50,6 @@ optional_policy(`
optional_policy(`
container_runtime_domtrans(unconfined_service_t)
')
+
+filetrans_pattern(unconfined_service_t, var_run_t, net_conf_t, dir)
+

46
fix_unconfineduser.patch
View File

@ -1,46 +0,0 @@
Index: fedora-policy-20230206/policy/modules/roles/unconfineduser.te
===================================================================
--- fedora-policy-20230206.orig/policy/modules/roles/unconfineduser.te
+++ fedora-policy-20230206/policy/modules/roles/unconfineduser.te
@@ -126,6 +126,11 @@ tunable_policy(`unconfined_dyntrans_all'
domain_dyntrans(unconfined_t)
')
+# FIXME this is probably caused by some wierd PAM interaction
+corecmd_entrypoint_all_executables(unconfined_t)
+# FIXME sddm JITs some code, requiring execmod on user_tmp_t. Check how to disable this behaviour in sddm/qtdeclarative
+files_execmod_tmp(unconfined_t)
+
optional_policy(`
gen_require(`
type unconfined_t;
@@ -216,6 +221,10 @@ optional_policy(`
')
optional_policy(`
+ cron_system_spool_entrypoint(unconfined_t)
+')
+
+optional_policy(`
chrome_role_notrans(unconfined_r, unconfined_t)
tunable_policy(`unconfined_chrome_sandbox_transition',`
@@ -250,6 +259,18 @@ optional_policy(`
dbus_stub(unconfined_t)
optional_policy(`
+ accountsd_dbus_chat(unconfined_dbusd_t)
+ ')
+
+ optional_policy(`
+ networkmanager_dbus_chat(unconfined_dbusd_t)
+ ')
+
+ optional_policy(`
+ systemd_dbus_chat_logind(unconfined_dbusd_t)
+ ')
+
+ optional_policy(`
bluetooth_dbus_chat(unconfined_t)
')

18
fix_unprivuser.patch
View File

@ -1,18 +0,0 @@
Index: fedora-policy-20221019/policy/modules/roles/unprivuser.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20221019/policy/modules/roles/unprivuser.te
@@ -300,6 +300,13 @@ ifndef(`distro_redhat',`
')
optional_policy(`
+ rtorrent_role(user_r, user_t)
+ # needed for tunable rtorrent_send_mails
+ mta_role_access_system_mail(user_r)
+')
+
+
+optional_policy(`
vmtools_run_helper(user_t, user_r)
')

12
fix_userdomain.patch
View File

@ -1,12 +0,0 @@
Index: fedora-policy-20230116/policy/modules/system/userdomain.if
===================================================================
--- fedora-policy-20230116.orig/policy/modules/system/userdomain.if
+++ fedora-policy-20230116/policy/modules/system/userdomain.if
@@ -1515,6 +1515,7 @@ tunable_policy(`deny_bluetooth',`',`
# port access is audited even if dac would not have allowed it, so dontaudit it here
# corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
+ corenet_dontaudit_udp_bind_all_rpc_ports($1_t)
# Need the following rule to allow users to run vpnc
corenet_tcp_bind_xserver_port($1_t)
corenet_tcp_bind_generic_node($1_usertype)

29
fix_usermanage.patch
View File

@ -1,29 +0,0 @@
Index: fedora-policy-20220428/policy/modules/admin/usermanage.te
===================================================================
--- fedora-policy-20220428.orig/policy/modules/admin/usermanage.te
+++ fedora-policy-20220428/policy/modules/admin/usermanage.te
@@ -226,6 +226,7 @@ allow groupadd_t self:unix_dgram_socket
allow groupadd_t self:unix_stream_socket create_stream_socket_perms;
allow groupadd_t self:unix_dgram_socket sendto;
allow groupadd_t self:unix_stream_socket connectto;
+allow groupadd_t self:netlink_selinux_socket create_socket_perms;
fs_getattr_xattr_fs(groupadd_t)
fs_search_auto_mountpoints(groupadd_t)
@@ -538,6 +539,7 @@ allow useradd_t self:unix_dgram_socket c
allow useradd_t self:unix_stream_socket create_stream_socket_perms;
allow useradd_t self:unix_dgram_socket sendto;
allow useradd_t self:unix_stream_socket connectto;
+allow useradd_t self:netlink_selinux_socket create_socket_perms;
manage_dirs_pattern(useradd_t, useradd_var_run_t, useradd_var_run_t)
manage_files_pattern(useradd_t, useradd_var_run_t, useradd_var_run_t)
@@ -546,6 +548,8 @@ files_pid_filetrans(useradd_t, useradd_v
# for getting the number of groups
kernel_read_kernel_sysctls(useradd_t)
+selinux_compute_access_vector(useradd_t)
+
corecmd_exec_shell(useradd_t)
# Execute /usr/bin/{passwd,chfn,chsh} and /usr/sbin/{useradd,vipw}.
corecmd_exec_bin(useradd_t)

23
fix_wine.patch
View File

@ -1,23 +0,0 @@
Index: fedora-policy-20220428/policy/modules/system/libraries.fc
===================================================================
--- fedora-policy-20220428.orig/policy/modules/system/libraries.fc
+++ fedora-policy-20220428/policy/modules/system/libraries.fc
@@ -90,7 +90,7 @@ ifdef(`distro_redhat',`
/opt/Adobe/Reader.?/Reader/intellinux/plug_ins/.*\.api -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/opt/Adobe/Reader.?/Reader/intellinux/SPPlugins/.*\.ap[il] -- gen_context(system_u:object_r:lib_t,s0)
/opt/cisco-vpnclient/lib/libvpnapi\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-/opt/cx.*/lib/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/opt/cx.*/lib/wine/.+\.(so|dll) -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/opt/f-secure/fspms/libexec/librapi\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/opt/ibm/java.*/jre/.+\.jar -- gen_context(system_u:object_r:lib_t,s0)
/opt/ibm/java.*/jre/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -173,7 +173,8 @@ ifdef(`distro_redhat',`
/usr/lib/systemd/libsystemd-.+\.so.* -- gen_context(system_u:object_r:lib_t,s0)
/usr/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:lib_t,s0)
-/usr/lib/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib/wine/*-windows/* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/NX/lib/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/NX/lib/libjpeg\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)

68
fix_xserver.patch
View File

@ -1,68 +0,0 @@
Index: fedora-policy-20221019/policy/modules/services/xserver.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/services/xserver.fc
+++ fedora-policy-20221019/policy/modules/services/xserver.fc
@@ -71,6 +71,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
/etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0)
/etc/X11/wdm/Xsetup.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
+/etc/X11/xdm/Xsetup -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/X11/wdm/Xstartup.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/X11/Xsession[^/]* -- gen_context(system_u:object_r:xsession_exec_t,s0)
@@ -102,6 +103,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
/usr/bin/sddm -- gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/bin/sddm-greeter -- gen_context(system_u:object_r:xdm_exec_t,s0)
+/usr/lib/sddm/sddm-helper -- gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
/usr/bin/razor-lightdm-.* -- gen_context(system_u:object_r:xdm_exec_t,s0)
@@ -114,6 +116,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
/usr/bin/Xwayland -- gen_context(system_u:object_r:xserver_exec_t,s0)
/usr/bin/x11vnc -- gen_context(system_u:object_r:xserver_exec_t,s0)
/usr/bin/nvidia.* -- gen_context(system_u:object_r:xserver_exec_t,s0)
+/usr/bin/greetd -- gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/libexec/Xorg\.bin -- gen_context(system_u:object_r:xserver_exec_t,s0)
/usr/libexec/Xorg\.wrap -- gen_context(system_u:object_r:xserver_exec_t,s0)
@@ -137,6 +140,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
/usr/X11R6/lib/X11/xkb -d gen_context(system_u:object_r:xkb_var_lib_t,s0)
/usr/X11R6/lib/X11/xkb/.* -- gen_context(system_u:object_r:xkb_var_lib_t,s0)
+/usr/lib/X11/display-manager -- gen_context(system_u:object_r:xdm_exec_t,s0)
ifndef(`distro_debian',`
/usr/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
')
@@ -155,6 +159,7 @@ ifndef(`distro_debian',`
/var/lib/[mxkwg]dm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
/var/lib/xkb(/.*)? gen_context(system_u:object_r:xkb_var_lib_t,s0)
/var/lib/xorg(/.*)? gen_context(system_u:object_r:xserver_var_lib_t,s0)
+/var/lib/greetd(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
/var/cache/lightdm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
/var/cache/[mg]dm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
@@ -184,6 +189,8 @@ ifndef(`distro_debian',`
/var/run/xauth(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
/var/run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
/var/run/sddm(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
+/var/run/greetd[^/]*\.sock -s gen_context(system_u:object_r:xdm_var_run_t,s0)
+/var/run/greetd\.run -- gen_context(system_u:object_r:xdm_var_run_t,s0)
/var/run/video.rom -- gen_context(system_u:object_r:xserver_var_run_t,s0)
/var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0)
Index: fedora-policy-20221019/policy/modules/services/xserver.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/services/xserver.te
+++ fedora-policy-20221019/policy/modules/services/xserver.te
@@ -475,6 +475,10 @@ userdom_dontaudit_read_admin_home_lnk_fi
kernel_read_vm_sysctls(xdm_t)
+files_manage_generic_pids_symlinks(xdm_t)
+userdom_manage_user_home_content_dirs(xdm_t)
+userdom_manage_user_home_content_files(xdm_t)
+
# Allow gdm to run gdm-binary
can_exec(xdm_t, xdm_exec_t)
can_exec(xdm_t, xsession_exec_t)

44
packagekit.fc
View File

@ -1,44 +0,0 @@
/usr/lib/systemd/system/packagekit.* -- gen_context(system_u:object_r:packagekit_unit_file_t,s0)
/usr/bin/packagekit -- gen_context(system_u:object_r:packagekit_exec_t,s0)
#/var/lib/PackageKit(/.*)? gen_context(system_u:object_r:packagekit_var_lib_t,s0)
/usr/bin/pkcon -- gen_context(system_u:object_r:packagekit_exec_t,s0)
/usr/bin/pkmon -- gen_context(system_u:object_r:packagekit_exec_t,s0)
/usr/lib/packagekit-direct -- gen_context(system_u:object_r:packagekit_exec_t,s0)
/usr/lib/packagekitd -- gen_context(system_u:object_r:packagekit_exec_t,s0)
/usr/lib/pk-offline-update -- gen_context(system_u:object_r:packagekit_exec_t,s0)
#/etc/PackageKit
#/etc/dbus-1/system.d/org.freedesktop.PackageKit.conf
#/usr/lib/tmpfiles.d
#/usr/lib/tmpfiles.d/PackageKit.conf
#/usr/lib64/packagekit-backend
#/usr/lib64/packagekit-backend/libpk_backend_dummy.so
#/usr/sbin/rcpackagekit
#/usr/sbin/rcpackagekit-offline-update
#/usr/share/PackageKit
#/usr/share/PackageKit/helpers
#/usr/share/PackageKit/helpers/test_spawn
#/usr/share/PackageKit/helpers/test_spawn/search-name.sh
#/usr/share/PackageKit/packagekit-background.sh
#/usr/share/PackageKit/pk-upgrade-distro.sh
#/usr/share/PackageKit/transactions.db
#/usr/share/bash-completion/completions/pkcon
#/usr/share/dbus-1/interfaces/org.freedesktop.PackageKit.Transaction.xml
#/usr/share/dbus-1/interfaces/org.freedesktop.PackageKit.xml
#/usr/share/dbus-1/system-services/org.freedesktop.PackageKit.service
#/usr/share/doc/packages/PackageKit
#/usr/share/doc/packages/PackageKit/AUTHORS
#/usr/share/doc/packages/PackageKit/HACKING
#/usr/share/doc/packages/PackageKit/NEWS
#/usr/share/doc/packages/PackageKit/README
#/usr/share/doc/packages/PackageKit/org.freedesktop.packagekit.rules
#/usr/share/licenses/PackageKit
#/usr/share/licenses/PackageKit/COPYING
#/usr/share/man/man1/pkcon.1.gz
#/usr/share/man/man1/pkmon.1.gz
#/usr/share/polkit-1/actions/org.freedesktop.packagekit.policy
#/var/cache/PackageKit

40
packagekit.if
View File

@ -1,40 +0,0 @@
## <summary>A temporary policy for packagekit.</summary>
########################################
## <summary>
## Allow reading of fifo files
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to mange files
## </summary>
## </param>
#
interface(`packagekit_read_write_fifo',`
gen_require(`
type packagekit_t;
')
allow $1 packagekit_t:fifo_file rw_inherited_fifo_file_perms;
')
########################################
## <summary>
## Send and receive messages from
## packagekit over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`packagekit_dbus_chat',`
gen_require(`
type packagekit_t;
class dbus send_msg;
')
allow $1 packagekit_t:dbus send_msg;
allow packagekit_t $1:dbus send_msg;
')

38
packagekit.te
View File

@ -1,38 +0,0 @@
policy_module(packagekit,1.0.0)
########################################
#
# Declarations
#
type packagekit_t;
type packagekit_exec_t;
init_daemon_domain(packagekit_t,packagekit_exec_t)
type packagekit_unit_file_t;
systemd_unit_file(packagekit_unit_file_t)
type packagekit_var_lib_t;
files_type(packagekit_var_lib_t)
unconfined_dbus_chat(packagekit_t)
init_dbus_chat(packagekit_t)
optional_policy(`
policykit_dbus_chat(packagekit_t)
')
optional_policy(`
unconfined_domain(packagekit_t)
')
optional_policy(`
snapper_dbus_chat(packagekit_t)
')
optional_policy(`
systemd_dbus_chat_logind(packagekit_t)
')
optional_policy(`
rpm_transition_script(packagekit_t,system_r)
')

1
rebootmgr.fc
View File

@ -1 +0,0 @@
/usr/sbin/rebootmgrd -- gen_context(system_u:object_r:rebootmgr_exec_t,s0)

61
rebootmgr.if
View File

@ -1,61 +0,0 @@
## <summary>policy for rebootmgr</summary>
########################################
## <summary>
## Execute rebootmgr_exec_t in the rebootmgr domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`rebootmgr_domtrans',`
gen_require(`
type rebootmgr_t, rebootmgr_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, rebootmgr_exec_t, rebootmgr_t)
')
######################################
## <summary>
## Execute rebootmgr in the caller domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`rebootmgr_exec',`
gen_require(`
type rebootmgr_exec_t;
')
corecmd_search_bin($1)
can_exec($1, rebootmgr_exec_t)
')
########################################
## <summary>
## Send and receive messages from
## rebootmgr over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`rebootmgr_dbus_chat',`
gen_require(`
type rebootmgr_t;
class dbus send_msg;
')
allow $1 rebootmgr_t:dbus send_msg;
allow rebootmgr_t $1:dbus send_msg;
')

37
rebootmgr.te
View File

@ -1,37 +0,0 @@
policy_module(rebootmgr, 1.0.0)
########################################
#
# Declarations
#
type rebootmgr_t;
type rebootmgr_exec_t;
init_daemon_domain(rebootmgr_t, rebootmgr_exec_t)
########################################
#
# rebootmgr local policy
#
allow rebootmgr_t self:process { fork };
allow rebootmgr_t self:fifo_file rw_fifo_file_perms;
allow rebootmgr_t self:unix_stream_socket create_stream_socket_perms;
domain_use_interactive_fds(rebootmgr_t)
files_manage_etc_files(rebootmgr_t)
logging_send_syslog_msg(rebootmgr_t)
miscfiles_read_localization(rebootmgr_t)
systemd_start_power_services(rebootmgr_t)
systemd_dbus_chat_logind(rebootmgr_t)
unconfined_dbus_chat(rebootmgr_t)
optional_policy(`
dbus_system_bus_client(rebootmgr_t)
dbus_connect_system_bus(rebootmgr_t)
')

1
rtorrent.fc
View File

@ -1 +0,0 @@
/usr/bin/rtorrent -- gen_context(system_u:object_r:rtorrent_exec_t,s0)

95
rtorrent.if
View File

@ -1,95 +0,0 @@
## <summary>policy for rtorrent</summary>
########################################
## <summary>
## Execute rtorrent_exec_t in the rtorrent domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`rtorrent_domtrans',`
gen_require(`
type rtorrent_t, rtorrent_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, rtorrent_exec_t, rtorrent_t)
')
######################################
## <summary>
## Execute rtorrent in the caller domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`rtorrent_exec',`
gen_require(`
type rtorrent_exec_t;
')
corecmd_search_bin($1)
can_exec($1, rtorrent_exec_t)
')
########################################
## <summary>
## Execute rtorrent in the rtorrent domain, and
## allow the specified role the rtorrent domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition
## </summary>
## </param>
## <param name="role">
## <summary>
## The role to be allowed the rtorrent domain.
## </summary>
## </param>
#
interface(`rtorrent_run',`
gen_require(`
type rtorrent_t;
attribute_role rtorrent_roles;
')
rtorrent_domtrans($1)
roleattribute $2 rtorrent_roles;
')
########################################
## <summary>
## Role access for rtorrent
## </summary>
## <param name="role">
## <summary>
## Role allowed access
## </summary>
## </param>
## <param name="domain">
## <summary>
## User domain for the role
## </summary>
## </param>
#
interface(`rtorrent_role',`
gen_require(`
type rtorrent_t;
attribute_role rtorrent_roles;
')
roleattribute $1 rtorrent_roles;
rtorrent_domtrans($2)
ps_process_pattern($2, rtorrent_t)
allow $2 rtorrent_t:process { signull signal sigkill };
')

101
rtorrent.te
View File

@ -1,101 +0,0 @@
policy_module(rtorrent, 1.0.0)
########################################
#
# Declarations
#
## <desc>
## <p>
## Allow rtorrent to use send mails
## </p>
## </desc>
gen_tunable(rtorrent_send_mails, false)
## <desc>
## <p>
## Enable necessary permissions for rutorrent
## </p>
## </desc>
gen_tunable(rtorrent_enable_rutorrent, false)
## <desc>
## <p>
## Allow rtorrent to execute helper scripts in home directories
## </p>
## </desc>
gen_tunable(rtorrent_exec_scripts, false)
attribute_role rtorrent_roles;
roleattribute system_r rtorrent_roles;
type rtorrent_t;
type rtorrent_exec_t;
application_domain(rtorrent_t, rtorrent_exec_t)
role rtorrent_roles types rtorrent_t;
########################################
#
# rtorrent local policy
#
allow rtorrent_t self:process { fork signal_perms };
allow rtorrent_t self:fifo_file manage_fifo_file_perms;
allow rtorrent_t self:unix_stream_socket create_stream_socket_perms;
domain_use_interactive_fds(rtorrent_t)
files_read_etc_files(rtorrent_t)
miscfiles_read_localization(rtorrent_t)
sysnet_dns_name_resolve(rtorrent_t)
optional_policy(`
gen_require(`
type staff_t;
role staff_r;
')
rtorrent_run(staff_t, staff_r)
')
type rtorrent_port_t;
corenet_port(rtorrent_port_t)
allow rtorrent_t rtorrent_port_t:tcp_socket name_bind;
userdom_read_user_home_content_symlinks(rtorrent_t)
userdom_manage_user_home_content_files(rtorrent_t)
userdom_manage_user_home_content_dirs(rtorrent_t)
allow rtorrent_t self:tcp_socket { accept listen };
corenet_tcp_connect_all_ports(rtorrent_t)
fs_getattr_xattr_fs(rtorrent_t)
userdom_use_inherited_user_terminals(rtorrent_t)
# this might be to much
userdom_home_manager(rtorrent_t)
userdom_filetrans_home_content(rtorrent_t)
optional_policy(`
tunable_policy(`rtorrent_send_mails',`
userdom_exec_user_bin_files(rtorrent_t)
userdom_exec_user_home_content_files(rtorrent_t)
files_manage_generic_tmp_files(rtorrent_t)
mta_send_mail(rtorrent_t)
')
')
optional_policy(`
tunable_policy(`rtorrent_enable_rutorrent',`
apache_manage_sys_content(rtorrent_t)
apache_exec_sys_content(rtorrent_t)
')
')
tunable_policy(`rtorrent_exec_scripts',`
# execute helper scripts
corecmd_exec_bin(rtorrent_t)
userdom_exec_user_bin_files(rtorrent_t)
')

22
sedoctool.patch
View File

@ -1,22 +0,0 @@
Index: fedora-policy/support/sedoctool.py
===================================================================
--- fedora-policy.orig/support/sedoctool.py
+++ fedora-policy/support/sedoctool.py
@@ -810,7 +810,7 @@ if booleans:
namevalue_list = []
if os.path.exists(booleans):
try:
- conf = open(booleans, 'r')
+ conf = open(booleans, 'r', errors='replace')
except:
error("Could not open booleans file for reading")
@@ -831,7 +831,7 @@ if modules:
namevalue_list = []
if os.path.exists(modules):
try:
- conf = open(modules, 'r')
+ conf = open(modules, 'r', errors='replace')
except:
error("Could not open modules file for reading")
namevalue_list = get_conf(conf)

3
selinux-policy-20230214.tar.xz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:9693ed2c5547a04fe58227ee5f6db761b68cc2f4c7267492220e33678788a83f
size 752564

87
selinux-policy.changes
View File

@ -1,3 +1,90 @@
-------------------------------------------------------------------
Tue Feb 14 21:41:54 UTC 2023 - Hu <cathy.hu@suse.com>
- Complete packaging rework: Move policy to git repository and
only use tar_scm obs service to refresh from there:
https://gitlab.suse.de/selinux/selinux-policy
Please use `osc service manualrun` to update this OBS package to the
newest git version.
* Added README.Update describing how to update this package
* Added _service file that pulls from selinux-policy and
upstream container-selinux and tars them
* Adapted selinux-policy.spec to build selinux-policy with
container-selinux
* Removed update.sh as no longer needed
* Removed suse specific modules as they are now covered by git commits
* packagekit.te packagekit.if packagekit.fc
* rebootmgr.te rebootmgr.if rebootmgr.fc
* rtorrent.te rtorrent.if rtorrent.fc
* wicked.te wicked.if wicked.fc
* Removed *.patch as they are now covered by git commits:
* distro_suse_to_distro_redhat.patch
* dontaudit_interface_kmod_tmpfs.patch
* fix_accountsd.patch
* fix_alsa.patch
* fix_apache.patch
* fix_auditd.patch
* fix_authlogin.patch
* fix_automount.patch
* fix_bitlbee.patch
* fix_chronyd.patch
* fix_cloudform.patch
* fix_colord.patch
* fix_corecommand.patch
* fix_cron.patch
* fix_dbus.patch
* fix_djbdns.patch
* fix_dnsmasq.patch
* fix_dovecot.patch
* fix_entropyd.patch
* fix_firewalld.patch
* fix_fwupd.patch
* fix_geoclue.patch
* fix_hypervkvp.patch
* fix_init.patch
* fix_ipsec.patch
* fix_iptables.patch
* fix_irqbalance.patch
* fix_java.patch
* fix_kernel.patch
* fix_kernel_sysctl.patch
* fix_libraries.patch
* fix_locallogin.patch
* fix_logging.patch
* fix_logrotate.patch
* fix_mcelog.patch
* fix_miscfiles.patch
* fix_nagios.patch
* fix_networkmanager.patch
* fix_nis.patch
* fix_nscd.patch
* fix_ntp.patch
* fix_openvpn.patch
* fix_postfix.patch
* fix_rpm.patch
* fix_rtkit.patch
* fix_screen.patch
* fix_selinuxutil.patch
* fix_sendmail.patch
* fix_smartmon.patch
* fix_snapper.patch
* fix_sslh.patch
* fix_sysnetwork.patch
* fix_systemd.patch
* fix_systemd_watch.patch
* fix_thunderbird.patch
* fix_unconfined.patch
* fix_unconfineduser.patch
* fix_unprivuser.patch
* fix_userdomain.patch
* fix_usermanage.patch
* fix_wine.patch
* fix_xserver.patch
* sedoctool.patch
* systemd_domain_dyntrans_type.patch
-------------------------------------------------------------------
Mon Feb 6 08:36:32 UTC 2023 - Johannes Segitz <jsegitz@suse.com>

105
selinux-policy.spec
View File

@ -33,10 +33,11 @@ Summary: SELinux policy configuration
License: GPL-2.0-or-later
Group: System/Management
Name: selinux-policy
Version: 20230206
Version: 20230214
Release: 0
Source: fedora-policy-%{version}.tar.bz2
Source1: selinux-policy-rpmlintrc
Source0: %{name}-%{version}.tar.xz
Source1: container-selinux-%{version}.tar.xz
Source2: selinux-policy-rpmlintrc
Source10: modules-targeted-base.conf
Source11: modules-targeted-contrib.conf
@ -70,89 +71,6 @@ Source92: customizable_types
#Source93: config.tgz
Source94: file_contexts.subs_dist
Source95: macros.selinux-policy
Source96: update.sh
Source120: packagekit.te
Source121: packagekit.if
Source122: packagekit.fc
Source123: rtorrent.te
Source124: rtorrent.if
Source125: rtorrent.fc
Source126: wicked.te
Source127: wicked.if
Source128: wicked.fc
Source129: rebootmgr.te
Source130: rebootmgr.if
Source131: rebootmgr.fc
Patch000: distro_suse_to_distro_redhat.patch
Patch001: fix_djbdns.patch
Patch002: fix_dbus.patch
Patch004: fix_java.patch
Patch006: fix_thunderbird.patch
Patch007: fix_postfix.patch
Patch008: fix_nscd.patch
Patch009: fix_sysnetwork.patch
Patch010: fix_logging.patch
Patch011: fix_xserver.patch
Patch012: fix_miscfiles.patch
Patch013: fix_init.patch
Patch014: fix_locallogin.patch
Patch016: fix_iptables.patch
Patch017: fix_irqbalance.patch
Patch018: fix_ntp.patch
Patch019: fix_fwupd.patch
Patch020: fix_firewalld.patch
Patch021: fix_logrotate.patch
Patch022: fix_selinuxutil.patch
Patch024: fix_corecommand.patch
Patch025: fix_snapper.patch
Patch026: fix_systemd.patch
Patch027: fix_unconfined.patch
Patch028: fix_unconfineduser.patch
Patch029: fix_chronyd.patch
Patch030: fix_networkmanager.patch
Patch032: fix_accountsd.patch
Patch033: fix_automount.patch
Patch034: fix_colord.patch
Patch035: fix_mcelog.patch
Patch036: fix_sslh.patch
Patch037: fix_nagios.patch
Patch038: fix_openvpn.patch
Patch039: fix_cron.patch
Patch040: fix_usermanage.patch
Patch041: fix_smartmon.patch
Patch042: fix_geoclue.patch
Patch044: fix_authlogin.patch
Patch045: fix_screen.patch
Patch046: fix_unprivuser.patch
Patch047: fix_rpm.patch
Patch048: fix_apache.patch
Patch049: fix_nis.patch
Patch050: fix_libraries.patch
Patch051: fix_dovecot.patch
# https://github.com/cockpit-project/cockpit/pull/15758
#Patch052: fix_cockpit.patch
Patch053: fix_systemd_watch.patch
# kernel specific sysctl.conf (boo#1184804)
Patch054: fix_kernel_sysctl.patch
Patch055: fix_auditd.patch
Patch056: fix_wine.patch
Patch057: fix_hypervkvp.patch
Patch058: fix_bitlbee.patch
Patch059: systemd_domain_dyntrans_type.patch
Patch060: fix_dnsmasq.patch
Patch061: fix_userdomain.patch
Patch062: fix_cloudform.patch
Patch063: fix_alsa.patch
Patch064: dontaudit_interface_kmod_tmpfs.patch
Patch065: fix_sendmail.patch
Patch066: fix_ipsec.patch
Patch067: fix_kernel.patch
Patch068: fix_entropyd.patch
Patch069: fix_rtkit.patch
Patch100: sedoctool.patch
URL: https://github.com/fedora-selinux/selinux-policy.git
BuildRoot: %{_tmppath}/%{name}-%{version}-build
@ -413,7 +331,16 @@ fi;
exit 0
%prep
%autosetup -n fedora-policy-%{version} -p1
# set up selinux-policy
%autosetup -n %{name}-%{version} -p1
# dirty hack for container-selinux, because selinux-policy won't build without it
# upstream does not want to include it in main policy tree:
# see discussion in https://github.com/containers/container-selinux/issues/186
%setup -T -D -b 1
cp ../container-selinux-%{version}/container.* policy/modules/services/
rm -rf ../container-selinux-%{version}
%build
@ -440,10 +367,6 @@ for i in %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15}
cp $i selinux_config
done
for i in %{SOURCE120} %{SOURCE121} %{SOURCE122} %{SOURCE123} %{SOURCE124} %{SOURCE125} %{SOURCE126} %{SOURCE127} %{SOURCE128} %{SOURCE129} %{SOURCE130} %{SOURCE131}; do
cp $i policy/modules/contrib
done
make clean
%if %{BUILD_TARGETED}
%makeCmds targeted mcs allow

13
systemd_domain_dyntrans_type.patch
View File

@ -1,13 +0,0 @@
Index: fedora-policy-20220124/policy/modules/system/init.te
===================================================================
--- fedora-policy-20220124.orig/policy/modules/system/init.te
+++ fedora-policy-20220124/policy/modules/system/init.te
@@ -179,6 +179,8 @@ allow init_t self:tcp_socket { listen ac
allow init_t self:packet_socket create_socket_perms;
allow init_t self:key manage_key_perms;
allow init_t self:bpf { map_create map_read map_write prog_load prog_run };
+domain_dyntrans_type(init_t)
+allow init_t self:process { dyntransition setcurrent };
# is ~sys_module really needed? observed:
# sys_boot

23
update.sh
View File

@ -1,23 +0,0 @@
#!/bin/sh
date=$(date '+%Y%m%d')
echo Update to $date
rm -rf fedora-policy container-selinux
git clone --depth 1 https://github.com/fedora-selinux/selinux-policy.git
git clone --depth 1 https://github.com/containers/container-selinux.git
mv selinux-policy fedora-policy-$date
rm -rf fedora-policy-$date/.git*
mv container-selinux/container.* fedora-policy-$date/policy/modules/services/
rm -f fedora-policy?$date.tar*
tar cf fedora-policy-$date.tar fedora-policy-$date
bzip2 fedora-policy-$date.tar
rm -rf fedora-policy-$date container-selinux
sed -i -e "s/^Version:.*/Version: $date/" selinux-policy.spec
echo "remove old tar file, then osc addremove"

50
wicked.fc
View File

@ -1,50 +0,0 @@
# not used
#/etc/wicked/dispatcher\.d(/.*)? gen_context(system_u:object_r:wicked_initrc_exec_t,s0)
#/usr/lib/wicked/dispatcher\.d(/.*)? gen_context(system_u:object_r:wicked_initrc_exec_t,s0)
/etc/wicked(/.*)? gen_context(system_u:object_r:wicked_etc_t,s0)
/etc/wicked/extensions/.* -- gen_context(system_u:object_r:wicked_exec_t,s0)
#/etc/wicked/wicked\.conf gen_context(system_u:object_r:wicked_etc_rw_t,s0)
#/etc/wicd/wired-settings.conf -- gen_context(system_u:object_r:wicked_var_lib_t, s0)
/usr/lib/systemd/system/wicked.* -- gen_context(system_u:object_r:wicked_unit_file_t,s0)
/sbin/ifdown -- gen_context(system_u:object_r:wicked_exec_t,s0)
/sbin/ifprobe -- gen_context(system_u:object_r:wicked_exec_t,s0)
/sbin/ifstatus -- gen_context(system_u:object_r:wicked_exec_t,s0)
/sbin/ifup -- gen_context(system_u:object_r:wicked_exec_t,s0)
/usr/sbin/ifup -- gen_context(system_u:object_r:wicked_exec_t,s0)
/usr/sbin/rcwicked.* -- gen_context(system_u:object_r:wicked_initrc_exec_t,s0)
/usr/lib/wicked/bin(/.*)? gen_context(system_u:object_r:wicked_exec_t,s0)
/usr/libexec/wicked/bin(/.*)? gen_context(system_u:object_r:wicked_exec_t,s0)
#/usr/lib64/libwicked-0.6.63.so
/usr/sbin/wicked -- gen_context(system_u:object_r:wicked_exec_t,s0)
/usr/sbin/wickedd -- gen_context(system_u:object_r:wicked_exec_t,s0)
/usr/sbin/wickedd-nanny -- gen_context(system_u:object_r:wicked_exec_t,s0)
#/usr/share/wicked/schema/wireless.xml
/var/lib/wicked(/.*)? gen_context(system_u:object_r:wicked_var_lib_t,s0)
#/etc/sysconfig/network/ifcfg-lo
#/usr/sbin/wpa_cli -- gen_context(system_u:object_r:wpa_cli_exec_t,s0)
#/usr/bin/wpa_supplicant -- gen_context(system_u:object_r:wicked_exec_t,s0)
#/var/lib/wicd(/.*)? gen_context(system_u:object_r:wicked_var_lib_t,s0)
#/var/log/wicd.* -- gen_context(system_u:object_r:wicked_log_t,s0)
/var/run/wicked(/.*)? gen_context(system_u:object_r:wicked_var_run_t,s0)
#/etc/dbus-1
#/etc/dbus-1/system.d
#/etc/dbus-1/system.d/org.opensuse.Network.AUTO4.conf
#/etc/dbus-1/system.d/org.opensuse.Network.DHCP4.conf
#/etc/dbus-1/system.d/org.opensuse.Network.DHCP6.conf
#/etc/dbus-1/system.d/org.opensuse.Network.Nanny.conf
#/etc/dbus-1/system.d/org.opensuse.Network.conf
/etc/sysconfig/network/scripts(/.*)? gen_context(system_u:object_r:wicked_script_t,s0)
/etc/sysconfig/network/scripts/samba-winbindd -- gen_context(system_u:object_r:wicked_winbind_script_t,s0)
/etc/sysconfig/network/scripts/dhcpd-restart-hook -- gen_context(system_u:object_r:wicked_dhcp_script_t,s0)

678
wicked.if
View File

@ -1,678 +0,0 @@
## <summary>Manager for dynamically switching between networks.</summary>
########################################
## <summary>
## Read and write wicked UDP sockets.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
# cjp: added for named.
interface(`wicked_rw_udp_sockets',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:udp_socket { read write };
')
########################################
## <summary>
## Read and write wicked packet sockets.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
# cjp: added for named.
interface(`wicked_rw_packet_sockets',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:packet_socket { read write };
')
#######################################
## <summary>
## Allow caller to relabel tun_socket
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_attach_tun_iface',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:tun_socket relabelfrom;
allow $1 self:tun_socket relabelto;
')
########################################
## <summary>
## Read and write wicked netlink
## routing sockets.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
# cjp: added for named.
interface(`wicked_rw_routing_sockets',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:netlink_route_socket { read write };
')
########################################
## <summary>
## Execute wicked with a domain transition.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`wicked_domtrans',`
gen_require(`
type wicked_t, wicked_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, wicked_exec_t, wicked_t)
')
#######################################
## <summary>
## Execute wicked scripts with an automatic domain transition to initrc.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`wicked_initrc_domtrans',`
gen_require(`
type wicked_initrc_exec_t;
')
init_labeled_script_domtrans($1, wicked_initrc_exec_t)
')
#######################################
## <summary>
## Allow reading of wicked link files
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to read the links
## </summary>
## </param>
#
interface(`wicked_initrc_read_lnk_files',`
gen_require(`
type wicked_initrc_exec_t;
')
read_lnk_files_pattern($1, wicked_initrc_exec_t, wicked_initrc_exec_t)
')
########################################
## <summary>
## Execute wicked server in the wicked domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`wicked_systemctl',`
gen_require(`
type wicked_unit_file_t;
type wicked_t;
')
systemd_exec_systemctl($1)
init_reload_services($1)
allow $1 wicked_unit_file_t:file read_file_perms;
allow $1 wicked_unit_file_t:service manage_service_perms;
ps_process_pattern($1, wicked_t)
')
########################################
## <summary>
## Send and receive messages from
## wicked over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_dbus_chat',`
gen_require(`
type wicked_t;
class dbus send_msg;
')
allow $1 wicked_t:dbus send_msg;
allow wicked_t $1:dbus send_msg;
')
#######################################
## <summary>
## Read metworkmanager process state files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_read_state',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:dir search_dir_perms;
allow $1 wicked_t:file read_file_perms;
allow $1 wicked_t:lnk_file read_lnk_file_perms;
')
########################################
## <summary>
## Do not audit attempts to send and
## receive messages from wicked
## over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`wicked_dontaudit_dbus_chat',`
gen_require(`
type wicked_t;
class dbus send_msg;
')
dontaudit $1 wicked_t:dbus send_msg;
dontaudit wicked_t $1:dbus send_msg;
')
########################################
## <summary>
## Send a generic signal to wicked
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_signal',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:process signal;
')
########################################
## <summary>
## Create, read, and write
## wicked library files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_manage_lib_files',`
gen_require(`
type wicked_var_lib_t;
')
files_search_var_lib($1)
manage_files_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
allow $1 wicked_var_lib_t:file map;
')
########################################
## <summary>
## Read wicked lib files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_read_lib_files',`
gen_require(`
type wicked_var_lib_t;
')
files_search_var_lib($1)
list_dirs_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
read_files_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
allow $1 wicked_var_lib_t:file map;
')
#######################################
## <summary>
## Read wicked conf files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_read_conf',`
gen_require(`
type wicked_etc_t;
type wicked_etc_rw_t;
')
allow $1 wicked_etc_t:dir list_dir_perms;
read_files_pattern($1,wicked_etc_t,wicked_etc_t)
read_files_pattern($1,wicked_etc_rw_t,wicked_etc_rw_t)
')
########################################
## <summary>
## Read wicked PID files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_read_pid_files',`
gen_require(`
type wicked_var_run_t;
')
files_search_pids($1)
read_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
')
########################################
## <summary>
## Manage wicked PID files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_manage_pid_files',`
gen_require(`
type wicked_var_run_t;
')
files_search_pids($1)
manage_dirs_pattern($1, wicked_var_run_t, wicked_var_run_t)
manage_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
')
########################################
## <summary>
## Manage wicked PID sock files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_manage_pid_sock_files',`
gen_require(`
type wicked_var_run_t;
')
files_search_pids($1)
manage_sock_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
')
########################################
## <summary>
## Create objects in /etc with a private
## type using a type_transition.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="file_type">
## <summary>
## Private file type.
## </summary>
## </param>
## <param name="class">
## <summary>
## Object classes to be created.
## </summary>
## </param>
## <param name="name" optional="true">
## <summary>
## The name of the object being created.
## </summary>
## </param>
#
interface(`wicked_pid_filetrans',`
gen_require(`
type wicked_var_run_t;
')
filetrans_pattern($1, wicked_var_run_t, $2, $3, $4)
')
####################################
## <summary>
## Connect to wicked over
## a unix domain stream socket.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_stream_connect',`
gen_require(`
type wicked_t, wicked_var_run_t;
')
files_search_pids($1)
stream_connect_pattern($1, wicked_var_run_t, wicked_var_run_t, wicked_t)
')
########################################
## <summary>
## Delete wicked PID files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_delete_pid_files',`
gen_require(`
type wicked_var_run_t;
')
files_search_pids($1)
delete_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
')
########################################
## <summary>
## Execute wicked in the wicked domain, and
## allow the specified role the wicked domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`wicked_run',`
gen_require(`
type wicked_t, wicked_exec_t;
')
wicked_domtrans($1)
role $2 types wicked_t;
')
########################################
## <summary>
## Allow the specified domain to append
## to Network Manager log files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_append_log',`
gen_require(`
type wicked_log_t;
')
logging_search_logs($1)
allow $1 wicked_log_t:dir list_dir_perms;
append_files_pattern($1, wicked_log_t, wicked_log_t)
allow $1 wicked_log_t:file map;
')
#######################################
## <summary>
## Allow the specified domain to manage
## to Network Manager lib files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_manage_lib',`
gen_require(`
type wicked_var_lib_t;
')
manage_files_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
allow $1 wicked_var_lib_t:file map;
')
#######################################
## <summary>
## Send to wicked with a unix dgram socket.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_dgram_send',`
gen_require(`
type wicked_t, wicked_var_run_t;
')
files_search_pids($1)
dgram_send_pattern($1, wicked_var_run_t, wicked_var_run_t, wicked_t)
')
########################################
## <summary>
## Send sigchld to wicked.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
#
interface(`wicked_sigchld',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:process sigchld;
')
########################################
## <summary>
## Send signull to wicked.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
#
interface(`wicked_signull',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:process signull;
')
########################################
## <summary>
## Send sigkill to wicked.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
#
interface(`wicked_sigkill',`
gen_require(`
type wicked_t;
')
allow $1 wicked_t:process sigkill;
')
########################################
## <summary>
## Transition to wicked named content
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`wicked_filetrans_named_content',`
gen_require(`
type wicked_var_run_t;
type wicked_var_lib_t;
')
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth0.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth1.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth2.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth3.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth4.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth5.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth6.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth7.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth8.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth9.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth0.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth1.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth2.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth3.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth4.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth5.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth6.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth7.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth8.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth9.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em0.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em1.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em2.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em3.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em4.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em5.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em6.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em7.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em8.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em9.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em0.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em1.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em2.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em3.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em4.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em5.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em6.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em7.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em8.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em9.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.lo.dhcp.ipv4")
files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.lo.dhcp.ipv6")
files_pid_filetrans($1, wicked_var_run_t, dir, "extension")
files_pid_filetrans($1, wicked_var_run_t, dir, "nanny")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-1.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-2.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-3.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-4.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-5.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-6.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-7.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-8.xml")
files_etc_filetrans($1, wicked_var_lib_t, file, "state-9.xml")
')
########################################
## <summary>
## Create a set of derived types for various wicked scripts
## </summary>
## <param name="prefix">
## <summary>
## The name to be used for deriving type names.
## </summary>
## </param>
#
template(`wicked_script_template',`
gen_require(`
attribute wicked_plugin, wicked_script;
type wicked_t;
')
type wicked_$1_t, wicked_plugin;
type wicked_$1_script_t, wicked_script;
application_domain(wicked_$1_t, wicked_$1_script_t)
role system_r types wicked_$1_t;
domtrans_pattern(wicked_t, wicked_$1_script_t, wicked_$1_t)
')

572
wicked.te
View File

@ -1,572 +0,0 @@
policy_module(wicked, 1.0.0)
########################################
#
# Declarations
#
type wicked_t;
type wicked_exec_t;
init_daemon_domain(wicked_t, wicked_exec_t)
type wicked_initrc_exec_t;
init_script_file(wicked_initrc_exec_t)
type wicked_unit_file_t;
systemd_unit_file(wicked_unit_file_t)
type wicked_etc_t;
files_config_file(wicked_etc_t)
type wicked_etc_rw_t;
files_config_file(wicked_etc_rw_t)
#type wicked_log_t;
#logging_log_file(wicked_log_t)
type wicked_tmp_t;
files_tmp_file(wicked_tmp_t)
type wicked_var_lib_t;
files_type(wicked_var_lib_t)
type wicked_var_run_t;
files_pid_file(wicked_var_run_t)
# Wicked scripts
attribute wicked_plugin;
attribute wicked_script;
type wicked_script_t, wicked_script;
type wicked_custom_t, wicked_plugin;
role system_r types wicked_custom_t;
application_domain(wicked_custom_t, wicked_script_t)
domtrans_pattern(wicked_t, wicked_script_t, wicked_custom_t)
wicked_script_template(winbind);
wicked_script_template(dhcp);
#type wpa_cli_t;
#type wpa_cli_exec_t;
#init_system_domain(wpa_cli_t, wpa_cli_exec_t)
########################################
#
# Local policy
#
# wicked will ptrace itself if gdb is installed
# and it receives a unexpected signal (rh bug #204161)
allow wicked_t self:capability { fowner chown fsetid kill setgid setuid sys_admin sys_nice dac_read_search dac_override net_admin net_raw net_bind_service ipc_lock sys_chroot };
dontaudit wicked_t self:capability sys_tty_config;
allow wicked_t self:bpf { map_create map_read map_write prog_load prog_run };
ifdef(`hide_broken_symptoms',`
# caused by some bogus kernel code
dontaudit wicked_t self:capability sys_module;
')
# alternatively allow with
# kernel_load_module( wicked_t )
allow wicked_t self:process { getcap setcap setpgid getsched setsched signal_perms };
allow wicked_t self:process setfscreate;
selinux_validate_context(wicked_t)
tunable_policy(`deny_ptrace',`',`
allow wicked_t self:capability sys_ptrace;
allow wicked_t self:process ptrace;
')
allow wicked_t self:fifo_file rw_fifo_file_perms;
allow wicked_t self:unix_dgram_socket { sendto create_socket_perms };
allow wicked_t self:unix_stream_socket{ create_stream_socket_perms connectto };
allow wicked_t self:netlink_generic_socket create_socket_perms;
allow wicked_t self:netlink_route_socket create_netlink_socket_perms;
allow wicked_t self:netlink_xfrm_socket create_netlink_socket_perms;
allow wicked_t self:netlink_socket create_socket_perms;
allow wicked_t self:netlink_kobject_uevent_socket create_socket_perms;
allow wicked_t self:tcp_socket create_stream_socket_perms;
allow wicked_t self:tun_socket { create_socket_perms relabelfrom relabelto };
allow wicked_t self:udp_socket create_socket_perms;
allow wicked_t self:packet_socket create_socket_perms;
allow wicked_t self:rawip_socket create_socket_perms;
allow wicked_t self:socket create_socket_perms;
tunable_policy(`deny_bluetooth',`',`
allow wicked_t self:bluetooth_socket create_stream_socket_perms;
')
#allow wicked_t wpa_cli_t:unix_dgram_socket sendto;
can_exec(wicked_t, wicked_exec_t)
#wicd
# can_exec(wicked_t, wpa_cli_exec_t)
list_dirs_pattern(wicked_t, wicked_initrc_exec_t, wicked_initrc_exec_t)
read_files_pattern(wicked_t, wicked_initrc_exec_t, wicked_initrc_exec_t)
read_lnk_files_pattern(wicked_t, wicked_initrc_exec_t, wicked_initrc_exec_t)
list_dirs_pattern(wicked_t, wicked_etc_t, wicked_etc_t)
read_files_pattern(wicked_t, wicked_etc_t, wicked_etc_t)
read_lnk_files_pattern(wicked_t, wicked_etc_t, wicked_etc_t)
read_lnk_files_pattern(wicked_t, wicked_etc_rw_t, wicked_etc_rw_t)
manage_dirs_pattern(wicked_t, wicked_etc_rw_t, wicked_etc_rw_t)
manage_files_pattern(wicked_t, wicked_etc_rw_t, wicked_etc_rw_t)
filetrans_pattern(wicked_t, wicked_etc_t, wicked_etc_rw_t, { dir file })
#allow wicked_t wicked_log_t:dir setattr_dir_perms;
#append_files_pattern(wicked_t, wicked_log_t, wicked_log_t)
#create_files_pattern(wicked_t, wicked_log_t, wicked_log_t)
#setattr_files_pattern(wicked_t, wicked_log_t, wicked_log_t)
#logging_log_filetrans(wicked_t, wicked_log_t, file)
can_exec(wicked_t, wicked_tmp_t)
manage_files_pattern(wicked_t, wicked_tmp_t, wicked_tmp_t)
manage_sock_files_pattern(wicked_t, wicked_tmp_t, wicked_tmp_t)
files_tmp_filetrans(wicked_t, wicked_tmp_t, { sock_file file })
manage_dirs_pattern(wicked_t, wicked_var_lib_t, wicked_var_lib_t)
manage_files_pattern(wicked_t, wicked_var_lib_t, wicked_var_lib_t)
manage_lnk_files_pattern(wicked_t, wicked_var_lib_t, wicked_var_lib_t)
files_var_lib_filetrans(wicked_t, wicked_var_lib_t, { dir file lnk_file })
manage_dirs_pattern(wicked_t, wicked_var_run_t, wicked_var_run_t)
manage_files_pattern(wicked_t, wicked_var_run_t, wicked_var_run_t)
manage_sock_files_pattern(wicked_t, wicked_var_run_t, wicked_var_run_t)
files_pid_filetrans(wicked_t, wicked_var_run_t, { dir file sock_file })
kernel_read_system_state(wicked_t)
kernel_read_network_state(wicked_t)
kernel_read_kernel_sysctls(wicked_t)
kernel_request_load_module(wicked_t)
kernel_read_debugfs(wicked_t)
kernel_rw_net_sysctls(wicked_t)
kernel_dontaudit_setsched(wicked_t)
kernel_signull(wicked_t)
corenet_ib_manage_subnet_unlabeled_endports(wicked_t)
corenet_ib_access_unlabeled_pkeys(wicked_t)
corenet_all_recvfrom_netlabel(wicked_t)
corenet_tcp_sendrecv_generic_if(wicked_t)
corenet_udp_sendrecv_generic_if(wicked_t)
corenet_raw_sendrecv_generic_if(wicked_t)
corenet_tcp_sendrecv_generic_node(wicked_t)
corenet_udp_sendrecv_generic_node(wicked_t)
corenet_raw_sendrecv_generic_node(wicked_t)
corenet_tcp_sendrecv_all_ports(wicked_t)
corenet_udp_sendrecv_all_ports(wicked_t)
corenet_udp_bind_generic_node(wicked_t)
corenet_udp_bind_isakmp_port(wicked_t)
corenet_udp_bind_dhcpc_port(wicked_t)
corenet_tcp_connect_all_ports(wicked_t)
corenet_sendrecv_isakmp_server_packets(wicked_t)
corenet_sendrecv_dhcpc_server_packets(wicked_t)
corenet_sendrecv_all_client_packets(wicked_t)
corenet_rw_tun_tap_dev(wicked_t)
corenet_getattr_ppp_dev(wicked_t)
dev_access_check_sysfs(wicked_t)
dev_rw_sysfs(wicked_t)
dev_write_sysfs_dirs(wicked_t)
dev_read_rand(wicked_t)
dev_read_urand(wicked_t)
dev_dontaudit_getattr_generic_blk_files(wicked_t)
dev_getattr_all_chr_files(wicked_t)
dev_rw_wireless(wicked_t)
fs_getattr_all_fs(wicked_t)
fs_search_auto_mountpoints(wicked_t)
fs_list_inotifyfs(wicked_t)
fs_read_nsfs_files(wicked_t)
mls_file_read_all_levels(wicked_t)
selinux_dontaudit_search_fs(wicked_t)
corecmd_exec_shell(wicked_t)
corecmd_exec_bin(wicked_t)
domain_use_interactive_fds(wicked_t)
domain_read_all_domains_state(wicked_t)
files_read_etc_runtime_files(wicked_t)
files_read_system_conf_files(wicked_t)
files_read_usr_src_files(wicked_t)
files_read_isid_type_files(wicked_t)
storage_getattr_fixed_disk_dev(wicked_t)
term_open_unallocated_ttys(wicked_t)
init_read_utmp(wicked_t)
init_dontaudit_write_utmp(wicked_t)
init_domtrans_script(wicked_t)
init_signull_script(wicked_t)
init_signal_script(wicked_t)
init_sigkill_script(wicked_t)
auth_use_nsswitch(wicked_t)
libs_exec_ldconfig(wicked_t)
logging_send_syslog_msg(wicked_t)
logging_send_audit_msgs(wicked_t)
miscfiles_read_generic_certs(wicked_t)
seutil_read_config(wicked_t)
seutil_run_setfiles(wicked_t, system_r)
sysnet_domtrans_ifconfig(wicked_t)
sysnet_domtrans_dhcpc(wicked_t)
sysnet_signal_dhcpc(wicked_t)
sysnet_signull_dhcpc(wicked_t)
sysnet_read_dhcpc_pid(wicked_t)
sysnet_read_dhcp_config(wicked_t)
sysnet_delete_dhcpc_pid(wicked_t)
sysnet_kill_dhcpc(wicked_t)
sysnet_read_dhcpc_state(wicked_t)
sysnet_delete_dhcpc_state(wicked_t)
sysnet_search_dhcp_state(wicked_t)
# in /etc created by wicked will be labelled net_conf_t.
sysnet_manage_config(wicked_t)
sysnet_filetrans_named_content(wicked_t)
sysnet_filetrans_net_conf(wicked_t)
systemd_machined_read_pid_files(wicked_t)
term_use_unallocated_ttys(wicked_t)
userdom_stream_connect(wicked_t)
userdom_dontaudit_use_unpriv_user_fds(wicked_t)
userdom_dontaudit_use_user_ttys(wicked_t)
# Read gnome-keyring
userdom_read_home_certs(wicked_t)
userdom_read_user_home_content_files(wicked_t)
userdom_dgram_send(wicked_t)
hostname_exec(wicked_t)
wicked_systemctl(wicked_t)
sysnet_manage_config_dirs(wicked_t)
# Wicked scripts
list_dirs_pattern(wicked_t, wicked_script_t, wicked_script)
read_files_pattern(wicked_t, wicked_script_t, wicked_script)
read_lnk_files_pattern(wicked_t, wicked_script_t, wicked_script)
list_dirs_pattern(wicked_plugin, wicked_script_t, wicked_script_t)
read_lnk_files_pattern(wicked_plugin, wicked_script_t, wicked_script)
auth_read_passwd(wicked_plugin)
corecmd_exec_bin(wicked_plugin)
corecmd_exec_shell(wicked_winbind_t)
#tunable_policy(`use_nfs_home_dirs',`
# fs_read_nfs_files(wicked_t)
#')
#
#tunable_policy(`use_samba_home_dirs',`
# fs_read_cifs_files(wicked_t)
#')
optional_policy(`
avahi_domtrans(wicked_t)
avahi_kill(wicked_t)
avahi_signal(wicked_t)
avahi_signull(wicked_t)
avahi_dbus_chat(wicked_t)
')
optional_policy(`
packagekit_dbus_chat(wicked_t)
')
optional_policy(`
firewalld_dbus_chat(wicked_t)
')
optional_policy(`
wicked_dbus_chat(wicked_t)
')
optional_policy(`
bind_domtrans(wicked_t)
bind_manage_cache(wicked_t)
bind_kill(wicked_t)
bind_signal(wicked_t)
bind_signull(wicked_t)
')
optional_policy(`
bluetooth_dontaudit_read_helper_state(wicked_t)
')
optional_policy(`
consoletype_exec(wicked_t)
')
optional_policy(`
cron_read_system_job_lib_files(wicked_t)
')
optional_policy(`
chronyd_domtrans_chronyc(wicked_t)
chronyd_domtrans(wicked_t)
')
optional_policy(`
dbus_system_domain(wicked_t, wicked_exec_t)
init_dbus_chat(wicked_t)
optional_policy(`
consolekit_dbus_chat(wicked_t)
consolekit_read_pid_files(wicked_t)
')
')
optional_policy(`
dnsmasq_read_pid_files(wicked_t)
dnsmasq_dbus_chat(wicked_t)
dnsmasq_delete_pid_files(wicked_t)
dnsmasq_domtrans(wicked_t)
dnsmasq_initrc_domtrans(wicked_t)
dnsmasq_kill(wicked_t)
dnsmasq_signal(wicked_t)
dnsmasq_signull(wicked_t)
dnsmasq_systemctl(wicked_t)
')
optional_policy(`
dnssec_trigger_domtrans(wicked_t)
dnssec_trigger_signull(wicked_t)
dnssec_trigger_sigkill(wicked_t)
')
optional_policy(`
fcoe_dgram_send_fcoemon(wicked_t)
')
optional_policy(`
howl_signal(wicked_t)
')
optional_policy(`
gnome_dontaudit_search_config(wicked_t)
')
optional_policy(`
iscsid_domtrans(wicked_t)
')
optional_policy(`
iodined_domtrans(wicked_t)
')
optional_policy(`
ipsec_domtrans_mgmt(wicked_t)
ipsec_kill_mgmt(wicked_t)
ipsec_signal_mgmt(wicked_t)
ipsec_signull_mgmt(wicked_t)
ipsec_domtrans(wicked_t)
ipsec_kill(wicked_t)
ipsec_signal(wicked_t)
ipsec_signull(wicked_t)
')
optional_policy(`
iptables_domtrans(wicked_t)
')
optional_policy(`
l2tpd_domtrans(wicked_t)
l2tpd_sigkill(wicked_t)
l2tpd_signal(wicked_t)
l2tpd_signull(wicked_t)
')
optional_policy(`
lldpad_dgram_send(wicked_t)
')
optional_policy(`
kdump_dontaudit_inherited_kdumpctl_tmp_pipes(wicked_t)
')
optional_policy(`
netutils_exec_ping(wicked_t)
netutils_exec(wicked_t)
')
optional_policy(`
nscd_domtrans(wicked_t)
nscd_signal(wicked_t)
nscd_signull(wicked_t)
nscd_kill(wicked_t)
nscd_initrc_domtrans(wicked_t)
nscd_systemctl(wicked_t)
')
optional_policy(`
# Dispatcher starting and stoping ntp
ntp_initrc_domtrans(wicked_t)
ntp_systemctl(wicked_t)
')
optional_policy(`
modutils_domtrans_kmod(wicked_t)
')
optional_policy(`
openvpn_read_config(wicked_t)
openvpn_domtrans(wicked_t)
openvpn_kill(wicked_t)
openvpn_signal(wicked_t)
openvpn_signull(wicked_t)
openvpn_stream_connect(wicked_t)
openvpn_noatsecure(wicked_t)
')
optional_policy(`
policykit_dbus_chat(wicked_t)
policykit_domtrans_auth(wicked_t)
policykit_read_lib(wicked_t)
policykit_read_reload(wicked_t)
userdom_read_all_users_state(wicked_t)
')
optional_policy(`
polipo_systemctl(wicked_t)
')
optional_policy(`
ppp_initrc_domtrans(wicked_t)
ppp_domtrans(wicked_t)
ppp_manage_pid_files(wicked_t)
ppp_kill(wicked_t)
ppp_signal(wicked_t)
ppp_signull(wicked_t)
ppp_read_config(wicked_t)
ppp_systemctl(wicked_t)
')
optional_policy(`
rpm_exec(wicked_t)
rpm_read_db(wicked_t)
rpm_dontaudit_manage_db(wicked_t)
')
optional_policy(`
samba_service_status(wicked_t)
')
optional_policy(`
seutil_sigchld_newrole(wicked_t)
')
optional_policy(`
sysnet_manage_dhcpc_state(wicked_t)
')
optional_policy(`
systemd_write_inhibit_pipes(wicked_t)
systemd_read_logind_sessions_files(wicked_t)
systemd_dbus_chat_logind(wicked_t)
systemd_dbus_chat_hostnamed(wicked_t)
systemd_hostnamed_manage_config(wicked_t)
')
optional_policy(`
ssh_basic_client_template(wicked, wicked_t, system_r)
term_use_generic_ptys(wicked_ssh_t)
modutils_domtrans_kmod(wicked_ssh_t)
dbus_connect_system_bus(wicked_ssh_t)
dbus_system_bus_client(wicked_ssh_t)
wicked_dbus_chat(wicked_ssh_t)
')
optional_policy(`
udev_exec(wicked_t)
udev_read_db(wicked_t)
udev_read_pid_files(wicked_t)
')
optional_policy(`
vpn_domtrans(wicked_t)
vpn_kill(wicked_t)
vpn_signal(wicked_t)
vpn_signull(wicked_t)
vpn_relabelfrom_tun_socket(wicked_t)
')
optional_policy(`
openfortivpn_domtrans(wicked_t)
openfortivpn_sigkill(wicked_t)
openfortivpn_signal(wicked_t)
openfortivpn_signull(wicked_t)
')
optional_policy(`
openvswitch_stream_connect(wicked_t)
')
optional_policy(`
virt_dbus_chat(wicked_t)
')
optional_policy(`
networkmanager_dbus_chat(wicked_t)
')
optional_policy(`
logging_send_syslog_msg(wicked_winbind_t)
')
optional_policy(`
sysnet_exec_ifconfig(wicked_plugin)
sysnet_read_config(wicked_plugin)
')
optional_policy(`
systemd_exec_systemctl(wicked_winbind_t)
systemd_exec_systemctl(wicked_dhcp_t)
')
optional_policy(`
samba_domtrans_smbcontrol(wicked_winbind_t)
samba_read_config(wicked_winbind_t)
samba_service_status(wicked_winbind_t)
')
#tunable_policy(`use_ecryptfs_home_dirs',`
#fs_manage_ecryptfs_files(wicked_t)
#')
########################################
#
# wpa_cli local policy
#
#allow wpa_cli_t self:capability { dac_read_search };
#allow wpa_cli_t self:unix_dgram_socket create_socket_perms;
#
#allow wpa_cli_t wicked_t:unix_dgram_socket sendto;
#
#manage_sock_files_pattern(wpa_cli_t, wicked_tmp_t, wicked_tmp_t)
#files_tmp_filetrans(wpa_cli_t, wicked_tmp_t, sock_file)
#
#list_dirs_pattern(wpa_cli_t, wicked_var_run_t, wicked_var_run_t)
#rw_sock_files_pattern(wpa_cli_t, wicked_var_run_t, wicked_var_run_t)
#
#init_dontaudit_use_fds(wpa_cli_t)
#init_use_script_ptys(wpa_cli_t)
#
#term_dontaudit_use_console(wpa_cli_t)