pool/selinux-policy
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 909369 from home:jsegitz:branches:security:SELinux

Browse Source 
- Update to version 20210716
- Remove interfaces for container module before building the package
  (bsc#1188184)
- Updated
  * fix_init.patch
  * fix_systemd_watch.patch
  to adapt to upstream changes

- Use tabrmd SELinux modules from tpm2.0-abrmd instead of storing
  here

- Update to version 20210419
- Dropped fix_gift.patch, module was removed
- Updated wicked.te to removed dropped interface
- Refreshed:
  * fix_cockpit.patch
  * fix_hadoop.patch
  * fix_init.patch
  * fix_logging.patch
  * fix_logrotate.patch
  * fix_networkmanager.patch
  * fix_nscd.patch
  * fix_rpm.patch
  * fix_selinuxutil.patch
  * fix_systemd.patch
  * fix_systemd_watch.patch
  * fix_thunderbird.patch
  * fix_unconfined.patch
  * fix_unconfineduser.patch
  * fix_unprivuser.patch

OBS-URL: https://build.opensuse.org/request/show/909369
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=113
This commit is contained in:
Johannes Segitz 2021-07-30 09:07:13 +00:00 committed by Git OBS Bridge
parent 0b03ae6097
commit 72477b3ac5
27 changed files with 161 additions and 207 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fedora-policy-20210419.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:ad36b63becbe4fb8a7ac5597b58360c8ebaf7f15ec6681d3170ec16dc2e7a650
size 721823

3
fedora-policy-20210716.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:c72911f7b3d31ad5988df36f18c96337a5870044fc42be38dc6bbdd9caa95682
size 710155

13
fix_cockpit.patch
View File

@ -9,11 +9,11 @@ cockpit.socket fails to start if kerberos_enabled=false
policy/modules/contrib/cockpit.te | 2 ++
1 file changed, 2 insertions(+)
diff --git a/policy/modules/contrib/cockpit.te b/policy/modules/contrib/cockpit.te
index a160ca6b6..5984711fa 100644
--- a/policy/modules/contrib/cockpit.te
+++ b/policy/modules/contrib/cockpit.te
@@ -52,7 +52,9 @@ can_exec(cockpit_ws_t,cockpit_session_exec_t)
Index: fedora-policy-20210628/policy/modules/contrib/cockpit.te
===================================================================
--- fedora-policy-20210628.orig/policy/modules/contrib/cockpit.te
+++ fedora-policy-20210628/policy/modules/contrib/cockpit.te
@@ -51,7 +51,9 @@ can_exec(cockpit_ws_t,cockpit_session_ex
dev_read_urand(cockpit_ws_t) # for authkey
dev_read_rand(cockpit_ws_t) # for libssh
@ -23,6 +23,3 @@ index a160ca6b6..5984711fa 100644
# cockpit-ws can connect to other hosts via ssh
corenet_tcp_connect_ssh_port(cockpit_ws_t)
--
2.26.2

9
fix_gift.patch
View File

@ -1,9 +0,0 @@
Index: fedora-policy/policy/modules/contrib/gift.te
===================================================================
--- fedora-policy.orig/policy/modules/contrib/gift.te 2019-08-05 09:39:48.645670248 +0200
+++ fedora-policy/policy/modules/contrib/gift.te 2019-08-05 10:05:44.787808191 +0200
@@ -113,4 +113,3 @@ files_read_etc_runtime_files(giftd_t)
sysnet_dns_name_resolve(giftd_t)
userdom_use_inherited_user_terminals(giftd_t)
-userdom_home_manager(gitd_t)

16
fix_hadoop.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20210419/policy/modules/roles/sysadm.te
Index: fedora-policy-20210628/policy/modules/roles/sysadm.te
===================================================================
--- fedora-policy-20210419.orig/policy/modules/roles/sysadm.te
+++ fedora-policy-20210419/policy/modules/roles/sysadm.te
@@ -298,10 +298,6 @@ optional_policy(`
--- fedora-policy-20210628.orig/policy/modules/roles/sysadm.te
+++ fedora-policy-20210628/policy/modules/roles/sysadm.te
@@ -295,10 +295,6 @@ optional_policy(`
')
optional_policy(`
@ -13,11 +13,11 @@ Index: fedora-policy-20210419/policy/modules/roles/sysadm.te
iotop_run(sysadm_t, sysadm_r)
')
Index: fedora-policy-20210419/policy/modules/roles/unprivuser.te
Index: fedora-policy-20210628/policy/modules/roles/unprivuser.te
===================================================================
--- fedora-policy-20210419.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20210419/policy/modules/roles/unprivuser.te
@@ -209,10 +209,6 @@ ifndef(`distro_redhat',`
--- fedora-policy-20210628.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20210628/policy/modules/roles/unprivuser.te
@@ -205,10 +205,6 @@ ifndef(`distro_redhat',`
')
optional_policy(`

31
fix_init.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20210419/policy/modules/system/init.if
Index: fedora-policy-20210716/policy/modules/system/init.if
===================================================================
--- fedora-policy-20210419.orig/policy/modules/system/init.if
+++ fedora-policy-20210419/policy/modules/system/init.if
@@ -3242,6 +3242,7 @@ interface(`init_filetrans_named_content'
--- fedora-policy-20210716.orig/policy/modules/system/init.if
+++ fedora-policy-20210716/policy/modules/system/init.if
@@ -3296,6 +3296,7 @@ interface(`init_filetrans_named_content'
files_etc_filetrans($1, machineid_t, file, "machine-id" )
files_pid_filetrans($1, initctl_t, fifo_file, "fifo" )
init_pid_filetrans($1, systemd_unit_file_t, dir, "generator")
@ -10,11 +10,11 @@ Index: fedora-policy-20210419/policy/modules/system/init.if
init_pid_filetrans($1, systemd_unit_file_t, dir, "system")
')
Index: fedora-policy-20210419/policy/modules/system/init.te
Index: fedora-policy-20210716/policy/modules/system/init.te
===================================================================
--- fedora-policy-20210419.orig/policy/modules/system/init.te
+++ fedora-policy-20210419/policy/modules/system/init.te
@@ -269,6 +269,8 @@ corecmd_exec_bin(init_t)
--- fedora-policy-20210716.orig/policy/modules/system/init.te
+++ fedora-policy-20210716/policy/modules/system/init.te
@@ -267,6 +267,8 @@ corecmd_exec_bin(init_t)
corenet_all_recvfrom_netlabel(init_t)
corenet_tcp_bind_all_ports(init_t)
corenet_udp_bind_all_ports(init_t)
@ -23,7 +23,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
dev_create_all_files(init_t)
dev_create_all_chr_files(init_t)
@@ -397,6 +399,7 @@ logging_manage_audit_config(init_t)
@@ -391,6 +393,7 @@ logging_manage_audit_config(init_t)
logging_create_syslog_netlink_audit_socket(init_t)
logging_write_var_log_dirs(init_t)
logging_manage_var_log_symlinks(init_t)
@ -31,14 +31,13 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
seutil_read_config(init_t)
seutil_read_login_config(init_t)
@@ -446,11 +449,16 @@ ifdef(`distro_redhat',`
@@ -441,10 +444,15 @@ ifdef(`distro_redhat',`
corecmd_shell_domtrans(init_t, initrc_t)
storage_raw_rw_fixed_disk(init_t)
+storage_raw_read_removable_device(init_t)
sysnet_read_dhcpc_state(init_t)
sysnet_watch_config(init_t)
optional_policy(`
+ networkmanager_initrc_read_lnk_files(init_t)
@ -48,7 +47,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
bootloader_domtrans(init_t)
')
@@ -568,10 +576,10 @@ tunable_policy(`init_audit_control',`
@@ -562,10 +570,10 @@ tunable_policy(`init_audit_control',`
allow init_t self:system all_system_perms;
allow init_t self:system module_load;
allow init_t self:unix_dgram_socket { create_socket_perms sendto };
@ -61,7 +60,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
allow init_t self:netlink_selinux_socket create_socket_perms;
allow init_t self:unix_dgram_socket lock;
# Until systemd is fixed
@@ -629,6 +637,7 @@ files_delete_all_spool_sockets(init_t)
@@ -623,6 +631,7 @@ files_delete_all_spool_sockets(init_t)
files_create_var_lib_dirs(init_t)
files_create_var_lib_symlinks(init_t)
files_read_var_lib_symlinks(init_t)
@ -69,7 +68,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
files_manage_urandom_seed(init_t)
files_list_locks(init_t)
files_list_spool(init_t)
@@ -665,7 +674,7 @@ fs_list_all(init_t)
@@ -659,7 +668,7 @@ fs_list_all(init_t)
fs_list_auto_mountpoints(init_t)
fs_register_binary_executable_type(init_t)
fs_relabel_tmpfs_sock_file(init_t)
@ -78,7 +77,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
fs_relabel_cgroup_dirs(init_t)
fs_search_cgroup_dirs(init_t)
# for network namespaces
@@ -721,6 +730,7 @@ systemd_write_inherited_logind_sessions_
@@ -715,6 +724,7 @@ systemd_write_inherited_logind_sessions_
create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
create_dirs_pattern(init_t, var_log_t, var_log_t)
@ -86,7 +85,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
auth_use_nsswitch(init_t)
auth_rw_login_records(init_t)
@@ -1574,6 +1584,8 @@ optional_policy(`
@@ -1556,6 +1566,8 @@ optional_policy(`
optional_policy(`
postfix_list_spool(initrc_t)

14
fix_logging.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20210309/policy/modules/system/logging.fc
Index: fedora-policy-20210628/policy/modules/system/logging.fc
===================================================================
--- fedora-policy-20210309.orig/policy/modules/system/logging.fc
+++ fedora-policy-20210309/policy/modules/system/logging.fc
--- fedora-policy-20210628.orig/policy/modules/system/logging.fc
+++ fedora-policy-20210628/policy/modules/system/logging.fc
@@ -3,6 +3,8 @@
/etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
@ -19,11 +19,11 @@ Index: fedora-policy-20210309/policy/modules/system/logging.fc
/var/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
/var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh)
Index: fedora-policy-20210309/policy/modules/system/logging.if
Index: fedora-policy-20210628/policy/modules/system/logging.if
===================================================================
--- fedora-policy-20210309.orig/policy/modules/system/logging.if
+++ fedora-policy-20210309/policy/modules/system/logging.if
@@ -1722,3 +1722,22 @@ interface(`logging_dgram_send',`
--- fedora-policy-20210628.orig/policy/modules/system/logging.if
+++ fedora-policy-20210628/policy/modules/system/logging.if
@@ -1782,3 +1782,22 @@ interface(`logging_dgram_send',`
allow $1 syslogd_t:unix_dgram_socket sendto;
')

8
fix_logrotate.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy/policy/modules/contrib/logrotate.te
Index: fedora-policy-20210628/policy/modules/contrib/logrotate.te
===================================================================
--- fedora-policy.orig/policy/modules/contrib/logrotate.te
+++ fedora-policy/policy/modules/contrib/logrotate.te
@@ -107,6 +107,7 @@ files_var_lib_filetrans(logrotate_t, log
--- fedora-policy-20210628.orig/policy/modules/contrib/logrotate.te
+++ fedora-policy-20210628/policy/modules/contrib/logrotate.te
@@ -104,6 +104,7 @@ files_var_lib_filetrans(logrotate_t, log
kernel_read_system_state(logrotate_t)
kernel_read_kernel_sysctls(logrotate_t)

24
fix_networkmanager.patch
View File

@ -1,16 +1,8 @@
Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.te
Index: fedora-policy-20210628/policy/modules/contrib/networkmanager.te
===================================================================
--- fedora-policy-20210419.orig/policy/modules/contrib/networkmanager.te
+++ fedora-policy-20210419/policy/modules/contrib/networkmanager.te
@@ -97,6 +97,7 @@ read_files_pattern(NetworkManager_t, Net
read_lnk_files_pattern(NetworkManager_t, NetworkManager_initrc_exec_t, NetworkManager_initrc_exec_t)
list_dirs_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t)
+watch_dirs_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t)
read_files_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t)
read_lnk_files_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t)
@@ -241,6 +242,9 @@ userdom_read_home_certs(NetworkManager_t
--- fedora-policy-20210628.orig/policy/modules/contrib/networkmanager.te
+++ fedora-policy-20210628/policy/modules/contrib/networkmanager.te
@@ -243,6 +243,9 @@ userdom_read_home_certs(NetworkManager_t
userdom_read_user_home_content_files(NetworkManager_t)
userdom_dgram_send(NetworkManager_t)
@ -20,7 +12,7 @@ Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.te
tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(NetworkManager_t)
')
@@ -258,6 +262,14 @@ optional_policy(`
@@ -260,6 +263,14 @@ optional_policy(`
')
optional_policy(`
@ -35,10 +27,10 @@ Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.te
bind_domtrans(NetworkManager_t)
bind_manage_cache(NetworkManager_t)
bind_kill(NetworkManager_t)
Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.if
Index: fedora-policy-20210628/policy/modules/contrib/networkmanager.if
===================================================================
--- fedora-policy-20210419.orig/policy/modules/contrib/networkmanager.if
+++ fedora-policy-20210419/policy/modules/contrib/networkmanager.if
--- fedora-policy-20210628.orig/policy/modules/contrib/networkmanager.if
+++ fedora-policy-20210628/policy/modules/contrib/networkmanager.if
@@ -114,6 +114,24 @@ interface(`networkmanager_initrc_domtran
init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t)
')

14
fix_nscd.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20210309/policy/modules/contrib/nscd.fc
Index: fedora-policy-20210628/policy/modules/contrib/nscd.fc
===================================================================
--- fedora-policy-20210309.orig/policy/modules/contrib/nscd.fc
+++ fedora-policy-20210309/policy/modules/contrib/nscd.fc
--- fedora-policy-20210628.orig/policy/modules/contrib/nscd.fc
+++ fedora-policy-20210628/policy/modules/contrib/nscd.fc
@@ -8,8 +8,10 @@
/var/log/nscd\.log.* -- gen_context(system_u:object_r:nscd_log_t,s0)
@ -14,11 +14,11 @@ Index: fedora-policy-20210309/policy/modules/contrib/nscd.fc
/usr/lib/systemd/system/nscd\.service -- gen_context(system_u:object_r:nscd_unit_file_t,s0)
+
Index: fedora-policy-20210309/policy/modules/contrib/nscd.te
Index: fedora-policy-20210628/policy/modules/contrib/nscd.te
===================================================================
--- fedora-policy-20210309.orig/policy/modules/contrib/nscd.te
+++ fedora-policy-20210309/policy/modules/contrib/nscd.te
@@ -131,6 +131,14 @@ userdom_dontaudit_use_unpriv_user_fds(ns
--- fedora-policy-20210628.orig/policy/modules/contrib/nscd.te
+++ fedora-policy-20210628/policy/modules/contrib/nscd.te
@@ -130,6 +130,14 @@ userdom_dontaudit_use_unpriv_user_fds(ns
userdom_dontaudit_search_user_home_dirs(nscd_t)
optional_policy(`

20
fix_rpm.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20210309/policy/modules/contrib/rpm.fc
Index: fedora-policy-20210628/policy/modules/contrib/rpm.fc
===================================================================
--- fedora-policy-20210309.orig/policy/modules/contrib/rpm.fc
+++ fedora-policy-20210309/policy/modules/contrib/rpm.fc
--- fedora-policy-20210628.orig/policy/modules/contrib/rpm.fc
+++ fedora-policy-20210628/policy/modules/contrib/rpm.fc
@@ -18,6 +18,10 @@
/usr/bin/repoquery -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/bin/zif -- gen_context(system_u:object_r:rpm_exec_t,s0)
@ -22,11 +22,11 @@ Index: fedora-policy-20210309/policy/modules/contrib/rpm.fc
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
/var/lib/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
/var/lib/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
Index: fedora-policy-20210309/policy/modules/contrib/rpm.if
Index: fedora-policy-20210628/policy/modules/contrib/rpm.if
===================================================================
--- fedora-policy-20210309.orig/policy/modules/contrib/rpm.if
+++ fedora-policy-20210309/policy/modules/contrib/rpm.if
@@ -476,8 +476,10 @@ interface(`rpm_named_filetrans',`
--- fedora-policy-20210628.orig/policy/modules/contrib/rpm.if
+++ fedora-policy-20210628/policy/modules/contrib/rpm.if
@@ -479,8 +479,10 @@ interface(`rpm_named_filetrans',`
logging_log_named_filetrans($1, rpm_log_t, file, "yum.log")
logging_log_named_filetrans($1, rpm_log_t, file, "hawkey.log")
logging_log_named_filetrans($1, rpm_log_t, file, "up2date")
@ -37,10 +37,10 @@ Index: fedora-policy-20210309/policy/modules/contrib/rpm.if
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "dnf")
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "yum")
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpm")
Index: fedora-policy-20210309/policy/modules/kernel/files.fc
Index: fedora-policy-20210628/policy/modules/kernel/files.fc
===================================================================
--- fedora-policy-20210309.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20210309/policy/modules/kernel/files.fc
--- fedora-policy-20210628.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20210628/policy/modules/kernel/files.fc
@@ -67,6 +67,7 @@ ifdef(`distro_suse',`
/etc/sysconfig/ipvsadm.* -- gen_context(system_u:object_r:system_conf_t,s0)
/etc/sysconfig/system-config-firewall.* -- gen_context(system_u:object_r:system_conf_t,s0)

16
fix_selinuxutil.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20210309/policy/modules/system/selinuxutil.te
Index: fedora-policy-20210628/policy/modules/system/selinuxutil.te
===================================================================
--- fedora-policy-20210309.orig/policy/modules/system/selinuxutil.te
+++ fedora-policy-20210309/policy/modules/system/selinuxutil.te
--- fedora-policy-20210628.orig/policy/modules/system/selinuxutil.te
+++ fedora-policy-20210628/policy/modules/system/selinuxutil.te
@@ -238,6 +238,10 @@ ifdef(`hide_broken_symptoms',`
')
@ -13,7 +13,7 @@ Index: fedora-policy-20210309/policy/modules/system/selinuxutil.te
portage_dontaudit_use_fds(load_policy_t)
')
@@ -619,6 +623,10 @@ logging_send_audit_msgs(setfiles_t)
@@ -618,6 +622,10 @@ logging_send_audit_msgs(setfiles_t)
logging_send_syslog_msg(setfiles_t)
optional_policy(`
@ -24,11 +24,11 @@ Index: fedora-policy-20210309/policy/modules/system/selinuxutil.te
cloudform_dontaudit_write_cloud_log(setfiles_t)
')
Index: fedora-policy-20210309/policy/modules/system/selinuxutil.if
Index: fedora-policy-20210628/policy/modules/system/selinuxutil.if
===================================================================
--- fedora-policy-20210309.orig/policy/modules/system/selinuxutil.if
+++ fedora-policy-20210309/policy/modules/system/selinuxutil.if
@@ -777,6 +777,8 @@ interface(`seutil_dontaudit_read_config'
--- fedora-policy-20210628.orig/policy/modules/system/selinuxutil.if
+++ fedora-policy-20210628/policy/modules/system/selinuxutil.if
@@ -795,6 +795,8 @@ interface(`seutil_dontaudit_read_config'
dontaudit $1 selinux_config_t:dir search_dir_perms;
dontaudit $1 selinux_config_t:file read_file_perms;

8
fix_systemd.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20210309/policy/modules/system/systemd.te
Index: fedora-policy-20210628/policy/modules/system/systemd.te
===================================================================
--- fedora-policy-20210309.orig/policy/modules/system/systemd.te
+++ fedora-policy-20210309/policy/modules/system/systemd.te
--- fedora-policy-20210628.orig/policy/modules/system/systemd.te
+++ fedora-policy-20210628/policy/modules/system/systemd.te
@@ -347,6 +347,10 @@ userdom_manage_user_tmp_chr_files(system
xserver_dbus_chat(systemd_logind_t)
@ -13,7 +13,7 @@ Index: fedora-policy-20210309/policy/modules/system/systemd.te
apache_read_tmp_files(systemd_logind_t)
')
@@ -853,6 +857,10 @@ optional_policy(`
@@ -854,6 +858,10 @@ optional_policy(`
udev_read_pid_files(systemd_hostnamed_t)
')

39
fix_systemd_watch.patch
View File

@ -1,38 +1,17 @@
Index: fedora-policy-20210419/policy/modules/system/systemd.te
Index: fedora-policy-20210716/policy/modules/system/systemd.te
===================================================================
--- fedora-policy-20210419.orig/policy/modules/system/systemd.te
+++ fedora-policy-20210419/policy/modules/system/systemd.te
@@ -1357,3 +1357,10 @@ fstools_rw_swap_files(systemd_sleep_t)
--- fedora-policy-20210716.orig/policy/modules/system/systemd.te
+++ fedora-policy-20210716/policy/modules/system/systemd.te
@@ -1396,6 +1396,12 @@ fstools_rw_swap_files(systemd_sleep_t)
# systemd-sleep needs to getattr swap partitions
storage_getattr_fixed_disk_dev(systemd_sleep_t)
+
+
+#######################################
+#
+# Allow systemd to watch certificate dir for ca-certificates
+#
+watch_dirs_pattern(init_t,cert_t,cert_t)
Index: fedora-policy-20210419/policy/modules/system/init.te
===================================================================
--- fedora-policy-20210419.orig/policy/modules/system/init.te
+++ fedora-policy-20210419/policy/modules/system/init.te
@@ -317,7 +317,10 @@ files_etc_filetrans_etc_runtime(init_t,
# Run /etc/X11/prefdm:
files_exec_etc_files(init_t)
files_watch_etc_dirs(init_t)
+files_watch_etc_files(init_t)
files_read_usr_files(init_t)
+files_watch_usr_dirs(init_t)
+files_watch_usr_files(init_t)
files_watch_root_dirs(init_t)
files_write_root_dirs(init_t)
files_watch_var_dirs(init_t)
@@ -334,6 +337,7 @@ files_remount_rootfs(init_t)
files_create_var_dirs(init_t)
files_watch_home(init_t)
files_watch_all_pid(init_t)
+watch_dirs_pattern(init_t,lib_t,lib_t)
fs_list_inotifyfs(init_t)
# cjp: this may be related to /dev/log
+
optional_policy(`
sysstat_domtrans(systemd_sleep_t)
')

8
fix_thunderbird.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy/policy/modules/contrib/thunderbird.te
Index: fedora-policy-20210628/policy/modules/contrib/thunderbird.te
===================================================================
--- fedora-policy.orig/policy/modules/contrib/thunderbird.te
+++ fedora-policy/policy/modules/contrib/thunderbird.te
@@ -139,7 +139,6 @@ optional_policy(`
--- fedora-policy-20210628.orig/policy/modules/contrib/thunderbird.te
+++ fedora-policy-20210628/policy/modules/contrib/thunderbird.te
@@ -138,7 +138,6 @@ optional_policy(`
optional_policy(`
gnome_stream_connect_gconf(thunderbird_t)
gnome_domtrans_gconfd(thunderbird_t)

8
fix_unconfined.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy/policy/modules/system/unconfined.te
Index: fedora-policy-20210628/policy/modules/system/unconfined.te
===================================================================
--- fedora-policy.orig/policy/modules/system/unconfined.te
+++ fedora-policy/policy/modules/system/unconfined.te
--- fedora-policy-20210628.orig/policy/modules/system/unconfined.te
+++ fedora-policy-20210628/policy/modules/system/unconfined.te
@@ -1,5 +1,10 @@
policy_module(unconfined, 3.5.0)
@ -13,7 +13,7 @@ Index: fedora-policy/policy/modules/system/unconfined.te
########################################
#
# Declarations
@@ -39,3 +44,6 @@ optional_policy(`
@@ -41,3 +46,6 @@ optional_policy(`
optional_policy(`
container_runtime_domtrans(unconfined_service_t)
')

14
fix_unconfineduser.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20210419/policy/modules/roles/unconfineduser.te
Index: fedora-policy-20210628/policy/modules/roles/unconfineduser.te
===================================================================
--- fedora-policy-20210419.orig/policy/modules/roles/unconfineduser.te
+++ fedora-policy-20210419/policy/modules/roles/unconfineduser.te
@@ -124,6 +124,11 @@ tunable_policy(`unconfined_dyntrans_all'
--- fedora-policy-20210628.orig/policy/modules/roles/unconfineduser.te
+++ fedora-policy-20210628/policy/modules/roles/unconfineduser.te
@@ -126,6 +126,11 @@ tunable_policy(`unconfined_dyntrans_all'
domain_dyntrans(unconfined_t)
')
@ -14,7 +14,7 @@ Index: fedora-policy-20210419/policy/modules/roles/unconfineduser.te
optional_policy(`
gen_require(`
type unconfined_t;
@@ -214,6 +219,10 @@ optional_policy(`
@@ -212,6 +217,10 @@ optional_policy(`
')
optional_policy(`
@ -25,7 +25,7 @@ Index: fedora-policy-20210419/policy/modules/roles/unconfineduser.te
chrome_role_notrans(unconfined_r, unconfined_t)
tunable_policy(`unconfined_chrome_sandbox_transition',`
@@ -248,6 +257,18 @@ optional_policy(`
@@ -246,6 +255,18 @@ optional_policy(`
dbus_stub(unconfined_t)
optional_policy(`
@ -44,7 +44,7 @@ Index: fedora-policy-20210419/policy/modules/roles/unconfineduser.te
bluetooth_dbus_chat(unconfined_t)
')
@@ -311,6 +332,10 @@ optional_policy(`
@@ -309,6 +330,10 @@ optional_policy(`
')
optional_policy(`

8
fix_unprivuser.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20210419/policy/modules/roles/unprivuser.te
Index: fedora-policy-20210628/policy/modules/roles/unprivuser.te
===================================================================
--- fedora-policy-20210419.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20210419/policy/modules/roles/unprivuser.te
@@ -291,6 +291,13 @@ ifndef(`distro_redhat',`
--- fedora-policy-20210628.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20210628/policy/modules/roles/unprivuser.te
@@ -287,6 +287,13 @@ ifndef(`distro_redhat',`
')
optional_policy(`

16
fix_xserver.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy/policy/modules/services/xserver.fc
Index: fedora-policy-20210628/policy/modules/services/xserver.fc
===================================================================
--- fedora-policy.orig/policy/modules/services/xserver.fc
+++ fedora-policy/policy/modules/services/xserver.fc
--- fedora-policy-20210628.orig/policy/modules/services/xserver.fc
+++ fedora-policy-20210628/policy/modules/services/xserver.fc
@@ -71,6 +71,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
/etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0)
@ -18,7 +18,7 @@ Index: fedora-policy/policy/modules/services/xserver.fc
/usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
/usr/bin/razor-lightdm-.* -- gen_context(system_u:object_r:xdm_exec_t,s0)
@@ -135,6 +137,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
@@ -136,6 +138,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
/usr/X11R6/lib/X11/xkb -d gen_context(system_u:object_r:xkb_var_lib_t,s0)
/usr/X11R6/lib/X11/xkb/.* -- gen_context(system_u:object_r:xkb_var_lib_t,s0)
@ -26,11 +26,11 @@ Index: fedora-policy/policy/modules/services/xserver.fc
ifndef(`distro_debian',`
/usr/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
')
Index: fedora-policy/policy/modules/services/xserver.te
Index: fedora-policy-20210628/policy/modules/services/xserver.te
===================================================================
--- fedora-policy.orig/policy/modules/services/xserver.te
+++ fedora-policy/policy/modules/services/xserver.te
@@ -477,6 +477,10 @@ userdom_delete_user_home_content_files(x
--- fedora-policy-20210628.orig/policy/modules/services/xserver.te
+++ fedora-policy-20210628/policy/modules/services/xserver.te
@@ -473,6 +473,10 @@ userdom_delete_user_home_content_files(x
userdom_signull_unpriv_users(xdm_t)
userdom_dontaudit_read_admin_home_lnk_files(xdm_t)

7
modules-targeted-base.conf
View File

@ -412,10 +412,3 @@ rtorrent = module
# Policy for wicked
#
wicked = module
# Layer: contrib
# Module: tabrmd
#
# Policy for tabrmd
#
tabrmd = module

41
selinux-policy.changes
View File

@ -1,3 +1,20 @@
-------------------------------------------------------------------
Fri Jul 16 07:11:57 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Update to version 20210716
- Remove interfaces for container module before building the package
(bsc#1188184)
- Updated
* fix_init.patch
* fix_systemd_watch.patch
to adapt to upstream changes
-------------------------------------------------------------------
Thu Jul 15 15:45:57 UTC 2021 - Callum Farmer <gmbr3@opensuse.org>
- Use tabrmd SELinux modules from tpm2.0-abrmd instead of storing
here
-------------------------------------------------------------------
Tue Jul 6 13:55:19 UTC 2021 - Alberto Planas Dominguez <aplanas@suse.com>
@ -5,6 +22,30 @@ Tue Jul 6 13:55:19 UTC 2021 - Alberto Planas Dominguez <aplanas@suse.com>
https://github.com/tpm2-software/tpm2-abrmd/tree/master/selinux
- Automatic spec-cleaner to fix ordering and misaligned spaces
-------------------------------------------------------------------
Mon Jun 28 08:11:25 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Update to version 20210419
- Dropped fix_gift.patch, module was removed
- Updated wicked.te to removed dropped interface
- Refreshed:
* fix_cockpit.patch
* fix_hadoop.patch
* fix_init.patch
* fix_logging.patch
* fix_logrotate.patch
* fix_networkmanager.patch
* fix_nscd.patch
* fix_rpm.patch
* fix_selinuxutil.patch
* fix_systemd.patch
* fix_systemd_watch.patch
* fix_thunderbird.patch
* fix_unconfined.patch
* fix_unconfineduser.patch
* fix_unprivuser.patch
* fix_xserver.patch
-------------------------------------------------------------------
Tue May 18 11:10:59 UTC 2021 - Ludwig Nussel <lnussel@suse.de>

10
selinux-policy.spec
View File

@ -33,7 +33,7 @@ Summary: SELinux policy configuration
License: GPL-2.0-or-later
Group: System/Management
Name: selinux-policy
Version: 20210419
Version: 20210716
Release: 0
Source: fedora-policy-%{version}.tar.bz2
Source1: selinux-policy-rpmlintrc
@ -81,13 +81,9 @@ Source125: rtorrent.fc
Source126: wicked.te
Source127: wicked.if
Source128: wicked.fc
Source129: tabrmd.te
Source130: tabrmd.if
Source131: tabrmd.fc
Patch001: fix_djbdns.patch
Patch002: fix_dbus.patch
Patch003: fix_gift.patch
Patch004: fix_java.patch
Patch005: fix_hadoop.patch
Patch006: fix_thunderbird.patch
@ -424,7 +420,7 @@ for i in %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15}
cp $i selinux_config
done
for i in %{SOURCE120} %{SOURCE121} %{SOURCE122} %{SOURCE123} %{SOURCE124} %{SOURCE125} %{SOURCE126} %{SOURCE127} %{SOURCE128} %{SOURCE129} %{SOURCE130} %{SOURCE131}; do
for i in %{SOURCE120} %{SOURCE121} %{SOURCE122} %{SOURCE123} %{SOURCE124} %{SOURCE125} %{SOURCE126} %{SOURCE127} %{SOURCE128}; do
cp $i policy/modules/contrib
done
@ -475,6 +471,8 @@ install -m 644 doc/policy.* %{buildroot}%{_datadir}/selinux/devel/
mkdir %{buildroot}%{_datadir}/selinux/devel/html
mv %{buildroot}%{_datadir}/man/man8/*.html %{buildroot}%{_datadir}/selinux/devel/html
mv %{buildroot}%{_datadir}/man/man8/style.css %{buildroot}%{_datadir}/selinux/devel/html
rm %{buildroot}%{_mandir}/man8/container_selinux.8*
rm %{buildroot}%{_datadir}/selinux/devel/include/services/container.if
%post
if [ ! -s %{_sysconfdir}/selinux/config ]; then

2
tabrmd.fc
View File

@ -1,2 +0,0 @@
/usr/sbin/tpm2-abrmd -- gen_context(system_u:object_r:tabrmd_exec_t,s0)
/usr/local/sbin/tpm2-abrmd -- gen_context(system_u:object_r:tabrmd_exec_t,s0)

1
tabrmd.if
View File

@ -1 +0,0 @@
## <summary></summary>

29
tabrmd.te
View File

@ -1,29 +0,0 @@
policy_module(tabrmd, 0.0.2)
########################################
#
# Declarations
#
gen_tunable(`tabrmd_connect_all_unreserved', false)
type tabrmd_t;
type tabrmd_exec_t;
init_daemon_domain(tabrmd_t, tabrmd_exec_t)
allow tabrmd_t self:unix_dgram_socket { create_socket_perms };
dev_rw_tpm(tabrmd_t)
logging_send_syslog_msg(tabrmd_t)
sysnet_dns_name_resolve(tabrmd_t)
optional_policy(`
dbus_stub()
dbus_system_domain(tabrmd_t, tabrmd_exec_t)
allow system_dbusd_t tabrmd_t:unix_stream_socket rw_stream_socket_perms;
fwupd_dbus_chat(tabrmd_t)
')
tunable_policy(`tabrmd_connect_all_unreserved',`
corenet_tcp_connect_all_unreserved_ports(tabrmd_t)
')

2
update.sh
View File

@ -11,7 +11,7 @@ git clone --depth 1 https://github.com/containers/container-selinux.git
mv selinux-policy fedora-policy-$date
rm -rf fedora-policy-$date/.git*
mv container-selinux/container.* fedora-policy-$date/policy/modules/contrib/
mv container-selinux/container.* fedora-policy-$date/policy/modules/services/
rm -f fedora-policy?$date.tar*
tar cf fedora-policy-$date.tar fedora-policy-$date

4
wicked.te
View File

@ -326,10 +326,6 @@ optional_policy(`
fcoe_dgram_send_fcoemon(wicked_t)
')
optional_policy(`
hal_write_log(wicked_t)
')
optional_policy(`
howl_signal(wicked_t)
')