From 46df3a4a9048253ef9fbf81d558892433d7c7f8da76d41297960799575bd0250 Mon Sep 17 00:00:00 2001 From: Johannes Segitz Date: Fri, 30 Sep 2022 08:11:19 +0000 Subject: [PATCH] Accepting request 1007183 from home:jsegitz:branches:security:SELinux - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch OBS-URL: https://build.opensuse.org/request/show/1007183 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=150 --- distro_suse_to_distro_redhat.patch | 195 +++++++++++++++++++++++++++++ fix_cron.patch | 16 +-- selinux-policy.changes | 8 ++ selinux-policy.spec | 4 +- 4 files changed, 213 insertions(+), 10 deletions(-) create mode 100644 distro_suse_to_distro_redhat.patch diff --git a/distro_suse_to_distro_redhat.patch b/distro_suse_to_distro_redhat.patch new file mode 100644 index 0000000..c931eb5 --- /dev/null +++ b/distro_suse_to_distro_redhat.patch @@ -0,0 +1,195 @@ +diff -r -u fedora-policy-20220714/policy/modules/contrib/apache.fc fedora-policy-20220714_changed/policy/modules/contrib/apache.fc +--- fedora-policy-20220714/policy/modules/contrib/apache.fc 2022-07-14 10:41:34.267983097 +0200 ++++ fedora-policy-20220714_changed/policy/modules/contrib/apache.fc 2022-09-30 09:07:02.245313656 +0200 +@@ -74,7 +74,7 @@ + /usr/sbin/suexec -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0) + /usr/sbin/thttpd -- gen_context(system_u:object_r:httpd_exec_t,s0) + +-ifdef(`distro_suse', ` ++ifdef(`distro_redhat', ` + /usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0) + ') + +diff -r -u fedora-policy-20220714/policy/modules/contrib/cron.fc fedora-policy-20220714_changed/policy/modules/contrib/cron.fc +--- fedora-policy-20220714/policy/modules/contrib/cron.fc 2022-07-14 10:41:34.279983278 +0200 ++++ fedora-policy-20220714_changed/policy/modules/contrib/cron.fc 2022-09-30 09:07:01.465301514 +0200 +@@ -51,7 +51,7 @@ + /var/spool/cron/lastrun/[^/]* -- <> + ') + +-ifdef(`distro_suse', ` ++ifdef(`distro_redhat', ` + /var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0) + /var/spool/cron/lastrun/[^/]* -- <> + /var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0) +@@ -70,7 +70,7 @@ + /var/spool/cron/lastrun/[^/]* -- <> + ') + +-ifdef(`distro_suse', ` ++ifdef(`distro_redhat', ` + /var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0) + /var/spool/cron/lastrun/[^/]* -- <> + /var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0) +diff -r -u fedora-policy-20220714/policy/modules/contrib/rpm.fc fedora-policy-20220714_changed/policy/modules/contrib/rpm.fc +--- fedora-policy-20220714/policy/modules/contrib/rpm.fc 2022-07-14 10:41:34.315983821 +0200 ++++ fedora-policy-20220714_changed/policy/modules/contrib/rpm.fc 2022-09-30 09:07:01.713305375 +0200 +@@ -79,7 +79,7 @@ + /var/run/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_run_t,s0) + + # SuSE +-ifdef(`distro_suse', ` ++ifdef(`distro_redhat', ` + /usr/bin/online_update -- gen_context(system_u:object_r:rpm_exec_t,s0) + /sbin/yast2 -- gen_context(system_u:object_r:rpm_exec_t,s0) + /var/lib/YaST2(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) +diff -r -u fedora-policy-20220714/policy/modules/kernel/corecommands.fc fedora-policy-20220714_changed/policy/modules/kernel/corecommands.fc +--- fedora-policy-20220714/policy/modules/kernel/corecommands.fc 2022-07-14 10:41:34.327984002 +0200 ++++ fedora-policy-20220714_changed/policy/modules/kernel/corecommands.fc 2022-09-30 09:07:01.273298522 +0200 +@@ -462,7 +462,7 @@ + /usr/share/texmf/texconfig/tcfmgr -- gen_context(system_u:object_r:bin_t,s0) + ') + +-ifdef(`distro_suse', ` ++ifdef(`distro_redhat', ` + /usr/lib/cron/run-crons -- gen_context(system_u:object_r:bin_t,s0) + /usr/lib/samba/classic/.* -- gen_context(system_u:object_r:bin_t,s0) + /usr/lib/ssh/.* -- gen_context(system_u:object_r:bin_t,s0) +@@ -491,7 +491,7 @@ + /var/lib/glusterd/hooks/.*/.*\.sh -- gen_context(system_u:object_r:bin_t,s0) + /var/lib/glusterd/hooks/.*/.*\.py -- gen_context(system_u:object_r:bin_t,s0) + +-ifdef(`distro_suse',` ++ifdef(`distro_redhat',` + /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) + ') + +diff -r -u fedora-policy-20220714/policy/modules/kernel/devices.fc fedora-policy-20220714_changed/policy/modules/kernel/devices.fc +--- fedora-policy-20220714/policy/modules/kernel/devices.fc 2022-07-14 10:41:34.327984002 +0200 ++++ fedora-policy-20220714_changed/policy/modules/kernel/devices.fc 2022-09-30 09:07:01.265298397 +0200 +@@ -148,7 +148,7 @@ + /dev/usb.+ -c gen_context(system_u:object_r:usb_device_t,s0) + /dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0) + /dev/usbmon.+ -c gen_context(system_u:object_r:usbmon_device_t,s0) +-ifdef(`distro_suse', ` ++ifdef(`distro_redhat', ` + /dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0) + ') + /dev/vmci -c gen_context(system_u:object_r:vmci_device_t,s0) +diff -r -u fedora-policy-20220714/policy/modules/kernel/files.fc fedora-policy-20220714_changed/policy/modules/kernel/files.fc +--- fedora-policy-20220714/policy/modules/kernel/files.fc 2022-07-14 10:41:34.331984062 +0200 ++++ fedora-policy-20220714_changed/policy/modules/kernel/files.fc 2022-09-30 09:07:01.289298772 +0200 +@@ -22,7 +22,7 @@ + /[^/]+ -- gen_context(system_u:object_r:etc_runtime_t,s0) + ') + +-ifdef(`distro_suse',` ++ifdef(`distro_redhat',` + /success -- gen_context(system_u:object_r:etc_runtime_t,s0) + ') + +@@ -92,7 +92,7 @@ + /etc/env\.d/.* -- gen_context(system_u:object_r:etc_runtime_t,s0) + ') + +-ifdef(`distro_suse',` ++ifdef(`distro_redhat',` + /etc/defkeymap\.map -- gen_context(system_u:object_r:etc_runtime_t,s0) + /etc/rc\.d/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0) + ') +diff -r -u fedora-policy-20220714/policy/modules/services/xserver.fc fedora-policy-20220714_changed/policy/modules/services/xserver.fc +--- fedora-policy-20220714/policy/modules/services/xserver.fc 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/services/xserver.fc 2022-09-30 09:07:02.689320566 +0200 +@@ -189,7 +189,7 @@ + /var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0) + /var/run/systemd/multi-session-x(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) + +-ifdef(`distro_suse',` ++ifdef(`distro_redhat',` + /var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0) + ') + +diff -r -u fedora-policy-20220714/policy/modules/system/authlogin.fc fedora-policy-20220714_changed/policy/modules/system/authlogin.fc +--- fedora-policy-20220714/policy/modules/system/authlogin.fc 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/authlogin.fc 2022-09-30 09:07:02.761321686 +0200 +@@ -31,7 +31,7 @@ + /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) + /sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0) + /sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0) +-ifdef(`distro_suse', ` ++ifdef(`distro_redhat', ` + /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) + ') + +diff -r -u fedora-policy-20220714/policy/modules/system/init.fc fedora-policy-20220714_changed/policy/modules/system/init.fc +--- fedora-policy-20220714/policy/modules/system/init.fc 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/init.fc 2022-09-30 09:07:02.701320753 +0200 +@@ -92,7 +92,7 @@ + /var/run/svscan\.pid -- gen_context(system_u:object_r:initrc_var_run_t,s0) + ') + +-ifdef(`distro_suse', ` ++ifdef(`distro_redhat', ` + /var/run/bootsplashctl -p gen_context(system_u:object_r:initrc_var_run_t,s0) + /var/run/keymap -- gen_context(system_u:object_r:initrc_var_run_t,s0) + /var/run/numlock-on -- gen_context(system_u:object_r:initrc_var_run_t,s0) +diff -r -u fedora-policy-20220714/policy/modules/system/init.te fedora-policy-20220714_changed/policy/modules/system/init.te +--- fedora-policy-20220714/policy/modules/system/init.te 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/init.te 2022-09-30 09:07:02.725321126 +0200 +@@ -1330,7 +1330,7 @@ + ') + ') + +-ifdef(`distro_suse',` ++ifdef(`distro_redhat',` + optional_policy(` + # set permissions on /tmp/.X11-unix + xserver_setattr_xdm_tmp_dirs(initrc_t) +diff -r -u fedora-policy-20220714/policy/modules/system/libraries.fc fedora-policy-20220714_changed/policy/modules/system/libraries.fc +--- fedora-policy-20220714/policy/modules/system/libraries.fc 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/libraries.fc 2022-09-30 09:07:02.709320877 +0200 +@@ -329,7 +329,7 @@ + /var/lib/spamassassin/compiled/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0) + /usr/lib/xfce4/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0) + +-ifdef(`distro_suse',` ++ifdef(`distro_redhat',` + /var/lib/samba/bin/.+\.so(\.[^/]*)* -l gen_context(system_u:object_r:lib_t,s0) + ') + +diff -r -u fedora-policy-20220714/policy/modules/system/locallogin.te fedora-policy-20220714_changed/policy/modules/system/locallogin.te +--- fedora-policy-20220714/policy/modules/system/locallogin.te 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/locallogin.te 2022-09-30 09:07:02.757321625 +0200 +@@ -274,7 +274,7 @@ + ') + + # suse and debian do not use pam with sulogin... +-ifdef(`distro_suse', `define(`sulogin_no_pam')') ++ifdef(`distro_redhat', `define(`sulogin_no_pam')') + ifdef(`distro_debian', `define(`sulogin_no_pam')') + + allow sulogin_t self:capability sys_tty_config; +diff -r -u fedora-policy-20220714/policy/modules/system/logging.fc fedora-policy-20220714_changed/policy/modules/system/logging.fc +--- fedora-policy-20220714/policy/modules/system/logging.fc 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/logging.fc 2022-09-30 09:07:02.757321625 +0200 +@@ -46,7 +46,7 @@ + /var/lib/r?syslog(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,mls_systemhigh) + /var/lib/syslog-ng.persist -- gen_context(system_u:object_r:syslogd_var_lib_t,s0) + +-ifdef(`distro_suse', ` ++ifdef(`distro_redhat', ` + /var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0) + ') + +diff -r -u fedora-policy-20220714/policy/modules/system/logging.te fedora-policy-20220714_changed/policy/modules/system/logging.te +--- fedora-policy-20220714/policy/modules/system/logging.te 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/logging.te 2022-09-30 09:07:02.709320877 +0200 +@@ -674,7 +674,7 @@ + term_dontaudit_setattr_unallocated_ttys(syslogd_t) + ') + +-ifdef(`distro_suse',` ++ifdef(`distro_redhat',` + # suse creates a /dev/log under /var/lib/stunnel for chrooted stunnel + files_var_lib_filetrans(syslogd_t, devlog_t, sock_file) + ') diff --git a/fix_cron.patch b/fix_cron.patch index e2ccb9a..8b4135d 100644 --- a/fix_cron.patch +++ b/fix_cron.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20220124/policy/modules/contrib/cron.fc +Index: fedora-policy-20220714/policy/modules/contrib/cron.fc =================================================================== ---- fedora-policy-20220124.orig/policy/modules/contrib/cron.fc -+++ fedora-policy-20220124/policy/modules/contrib/cron.fc +--- fedora-policy-20220714.orig/policy/modules/contrib/cron.fc ++++ fedora-policy-20220714/policy/modules/contrib/cron.fc @@ -34,7 +34,7 @@ /var/spool/cron -d gen_context(system_u:object_r:user_cron_spool_t,s0) @@ -11,7 +11,7 @@ Index: fedora-policy-20220124/policy/modules/contrib/cron.fc /var/spool/cron/crontabs -d gen_context(system_u:object_r:cron_spool_t,s0) /var/spool/cron/crontabs/.* -- <> -@@ -55,6 +55,10 @@ ifdef(`distro_suse', ` +@@ -55,6 +55,10 @@ ifdef(`distro_redhat', ` /var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0) /var/spool/cron/lastrun/[^/]* -- <> /var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0) @@ -27,15 +27,15 @@ Index: fedora-policy-20220124/policy/modules/contrib/cron.fc /var/spool/cron/lastrun/[^/]* -- <> ') - --ifdef(`distro_suse', ` +-ifdef(`distro_redhat', ` -/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0) -/var/spool/cron/lastrun/[^/]* -- <> -/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0) -') -Index: fedora-policy-20220124/policy/modules/contrib/cron.if +Index: fedora-policy-20220714/policy/modules/contrib/cron.if =================================================================== ---- fedora-policy-20220124.orig/policy/modules/contrib/cron.if -+++ fedora-policy-20220124/policy/modules/contrib/cron.if +--- fedora-policy-20220714.orig/policy/modules/contrib/cron.if ++++ fedora-policy-20220714/policy/modules/contrib/cron.if @@ -1057,7 +1057,7 @@ interface(`cron_generic_log_filetrans_lo # interface(`cron_system_spool_entrypoint',` diff --git a/selinux-policy.changes b/selinux-policy.changes index 671e11c..adcc217 100644 --- a/selinux-policy.changes +++ b/selinux-policy.changes @@ -1,3 +1,11 @@ +------------------------------------------------------------------- +Fri Sep 30 07:14:49 UTC 2022 - Johannes Segitz + +- Updated quilt couldn't unpack tarball. This will cause ongoing issues + so drop the sed statement in the %prep section and add + distro_suse_to_distro_redhat.patch to add the necessary changes + via a patch + ------------------------------------------------------------------- Thu Sep 29 12:54:15 UTC 2022 - Johannes Segitz diff --git a/selinux-policy.spec b/selinux-policy.spec index bacbf24..eb4bf37 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -17,7 +17,7 @@ # There are almost no SUSE specific modifications available in the policy, so we utilize the -# ones used by redhat and include also the SUSE specific ones (see sed statement below) +# ones used by redhat and include also the SUSE specific ones (distro_suse_to_distro_redhat.patch) %define distro redhat %define ubac n %define polyinstatiate n @@ -85,6 +85,7 @@ Source129: rebootmgr.te Source130: rebootmgr.if Source131: rebootmgr.fc +Patch000: distro_suse_to_distro_redhat.patch Patch001: fix_djbdns.patch Patch002: fix_dbus.patch Patch004: fix_java.patch @@ -406,7 +407,6 @@ exit 0 %prep %autosetup -n fedora-policy-%{version} -p1 -find . -type f -exec sed -i -e "s/distro_suse/distro_redhat/" \{\} \; %build