From 72477b3ac5410e0cd7b3b2fd9586cc9a61ed950b55d0a95f248a1ff7756d3bea Mon Sep 17 00:00:00 2001 From: Johannes Segitz Date: Fri, 30 Jul 2021 09:07:13 +0000 Subject: [PATCH] Accepting request 909369 from home:jsegitz:branches:security:SELinux - Update to version 20210716 - Remove interfaces for container module before building the package (bsc#1188184) - Updated * fix_init.patch * fix_systemd_watch.patch to adapt to upstream changes - Use tabrmd SELinux modules from tpm2.0-abrmd instead of storing here - Update to version 20210419 - Dropped fix_gift.patch, module was removed - Updated wicked.te to removed dropped interface - Refreshed: * fix_cockpit.patch * fix_hadoop.patch * fix_init.patch * fix_logging.patch * fix_logrotate.patch * fix_networkmanager.patch * fix_nscd.patch * fix_rpm.patch * fix_selinuxutil.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch OBS-URL: https://build.opensuse.org/request/show/909369 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=113 --- fedora-policy-20210419.tar.bz2 | 3 --- fedora-policy-20210716.tar.bz2 | 3 +++ fix_cockpit.patch | 13 +++++------ fix_gift.patch | 9 -------- fix_hadoop.patch | 16 ++++++------- fix_init.patch | 31 +++++++++++++------------ fix_logging.patch | 14 ++++++------ fix_logrotate.patch | 8 +++---- fix_networkmanager.patch | 24 +++++++------------- fix_nscd.patch | 14 ++++++------ fix_rpm.patch | 20 ++++++++--------- fix_selinuxutil.patch | 16 ++++++------- fix_systemd.patch | 8 +++---- fix_systemd_watch.patch | 39 ++++++++------------------------ fix_thunderbird.patch | 8 +++---- fix_unconfined.patch | 8 +++---- fix_unconfineduser.patch | 14 ++++++------ fix_unprivuser.patch | 8 +++---- fix_xserver.patch | 16 ++++++------- modules-targeted-base.conf | 7 ------ selinux-policy.changes | 41 ++++++++++++++++++++++++++++++++++ selinux-policy.spec | 10 ++++----- tabrmd.fc | 2 -- tabrmd.if | 1 - tabrmd.te | 29 ------------------------ update.sh | 2 +- wicked.te | 4 ---- 27 files changed, 161 insertions(+), 207 deletions(-) delete mode 100644 fedora-policy-20210419.tar.bz2 create mode 100644 fedora-policy-20210716.tar.bz2 delete mode 100644 fix_gift.patch delete mode 100644 tabrmd.fc delete mode 100644 tabrmd.if delete mode 100644 tabrmd.te diff --git a/fedora-policy-20210419.tar.bz2 b/fedora-policy-20210419.tar.bz2 deleted file mode 100644 index 549e8d7..0000000 --- a/fedora-policy-20210419.tar.bz2 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:ad36b63becbe4fb8a7ac5597b58360c8ebaf7f15ec6681d3170ec16dc2e7a650 -size 721823 diff --git a/fedora-policy-20210716.tar.bz2 b/fedora-policy-20210716.tar.bz2 new file mode 100644 index 0000000..f558fe3 --- /dev/null +++ b/fedora-policy-20210716.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:c72911f7b3d31ad5988df36f18c96337a5870044fc42be38dc6bbdd9caa95682 +size 710155 diff --git a/fix_cockpit.patch b/fix_cockpit.patch index ed97de0..d4eae49 100644 --- a/fix_cockpit.patch +++ b/fix_cockpit.patch @@ -9,11 +9,11 @@ cockpit.socket fails to start if kerberos_enabled=false policy/modules/contrib/cockpit.te | 2 ++ 1 file changed, 2 insertions(+) -diff --git a/policy/modules/contrib/cockpit.te b/policy/modules/contrib/cockpit.te -index a160ca6b6..5984711fa 100644 ---- a/policy/modules/contrib/cockpit.te -+++ b/policy/modules/contrib/cockpit.te -@@ -52,7 +52,9 @@ can_exec(cockpit_ws_t,cockpit_session_exec_t) +Index: fedora-policy-20210628/policy/modules/contrib/cockpit.te +=================================================================== +--- fedora-policy-20210628.orig/policy/modules/contrib/cockpit.te ++++ fedora-policy-20210628/policy/modules/contrib/cockpit.te +@@ -51,7 +51,9 @@ can_exec(cockpit_ws_t,cockpit_session_ex dev_read_urand(cockpit_ws_t) # for authkey dev_read_rand(cockpit_ws_t) # for libssh @@ -23,6 +23,3 @@ index a160ca6b6..5984711fa 100644 # cockpit-ws can connect to other hosts via ssh corenet_tcp_connect_ssh_port(cockpit_ws_t) --- -2.26.2 - diff --git a/fix_gift.patch b/fix_gift.patch deleted file mode 100644 index 191375e..0000000 --- a/fix_gift.patch +++ /dev/null @@ -1,9 +0,0 @@ -Index: fedora-policy/policy/modules/contrib/gift.te -=================================================================== ---- fedora-policy.orig/policy/modules/contrib/gift.te 2019-08-05 09:39:48.645670248 +0200 -+++ fedora-policy/policy/modules/contrib/gift.te 2019-08-05 10:05:44.787808191 +0200 -@@ -113,4 +113,3 @@ files_read_etc_runtime_files(giftd_t) - sysnet_dns_name_resolve(giftd_t) - - userdom_use_inherited_user_terminals(giftd_t) --userdom_home_manager(gitd_t) diff --git a/fix_hadoop.patch b/fix_hadoop.patch index 0a8ee6c..99c9878 100644 --- a/fix_hadoop.patch +++ b/fix_hadoop.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20210419/policy/modules/roles/sysadm.te +Index: fedora-policy-20210628/policy/modules/roles/sysadm.te =================================================================== ---- fedora-policy-20210419.orig/policy/modules/roles/sysadm.te -+++ fedora-policy-20210419/policy/modules/roles/sysadm.te -@@ -298,10 +298,6 @@ optional_policy(` +--- fedora-policy-20210628.orig/policy/modules/roles/sysadm.te ++++ fedora-policy-20210628/policy/modules/roles/sysadm.te +@@ -295,10 +295,6 @@ optional_policy(` ') optional_policy(` @@ -13,11 +13,11 @@ Index: fedora-policy-20210419/policy/modules/roles/sysadm.te iotop_run(sysadm_t, sysadm_r) ') -Index: fedora-policy-20210419/policy/modules/roles/unprivuser.te +Index: fedora-policy-20210628/policy/modules/roles/unprivuser.te =================================================================== ---- fedora-policy-20210419.orig/policy/modules/roles/unprivuser.te -+++ fedora-policy-20210419/policy/modules/roles/unprivuser.te -@@ -209,10 +209,6 @@ ifndef(`distro_redhat',` +--- fedora-policy-20210628.orig/policy/modules/roles/unprivuser.te ++++ fedora-policy-20210628/policy/modules/roles/unprivuser.te +@@ -205,10 +205,6 @@ ifndef(`distro_redhat',` ') optional_policy(` diff --git a/fix_init.patch b/fix_init.patch index 925d9c9..ed85022 100644 --- a/fix_init.patch +++ b/fix_init.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20210419/policy/modules/system/init.if +Index: fedora-policy-20210716/policy/modules/system/init.if =================================================================== ---- fedora-policy-20210419.orig/policy/modules/system/init.if -+++ fedora-policy-20210419/policy/modules/system/init.if -@@ -3242,6 +3242,7 @@ interface(`init_filetrans_named_content' +--- fedora-policy-20210716.orig/policy/modules/system/init.if ++++ fedora-policy-20210716/policy/modules/system/init.if +@@ -3296,6 +3296,7 @@ interface(`init_filetrans_named_content' files_etc_filetrans($1, machineid_t, file, "machine-id" ) files_pid_filetrans($1, initctl_t, fifo_file, "fifo" ) init_pid_filetrans($1, systemd_unit_file_t, dir, "generator") @@ -10,11 +10,11 @@ Index: fedora-policy-20210419/policy/modules/system/init.if init_pid_filetrans($1, systemd_unit_file_t, dir, "system") ') -Index: fedora-policy-20210419/policy/modules/system/init.te +Index: fedora-policy-20210716/policy/modules/system/init.te =================================================================== ---- fedora-policy-20210419.orig/policy/modules/system/init.te -+++ fedora-policy-20210419/policy/modules/system/init.te -@@ -269,6 +269,8 @@ corecmd_exec_bin(init_t) +--- fedora-policy-20210716.orig/policy/modules/system/init.te ++++ fedora-policy-20210716/policy/modules/system/init.te +@@ -267,6 +267,8 @@ corecmd_exec_bin(init_t) corenet_all_recvfrom_netlabel(init_t) corenet_tcp_bind_all_ports(init_t) corenet_udp_bind_all_ports(init_t) @@ -23,7 +23,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te dev_create_all_files(init_t) dev_create_all_chr_files(init_t) -@@ -397,6 +399,7 @@ logging_manage_audit_config(init_t) +@@ -391,6 +393,7 @@ logging_manage_audit_config(init_t) logging_create_syslog_netlink_audit_socket(init_t) logging_write_var_log_dirs(init_t) logging_manage_var_log_symlinks(init_t) @@ -31,14 +31,13 @@ Index: fedora-policy-20210419/policy/modules/system/init.te seutil_read_config(init_t) seutil_read_login_config(init_t) -@@ -446,11 +449,16 @@ ifdef(`distro_redhat',` +@@ -441,10 +444,15 @@ ifdef(`distro_redhat',` corecmd_shell_domtrans(init_t, initrc_t) storage_raw_rw_fixed_disk(init_t) +storage_raw_read_removable_device(init_t) sysnet_read_dhcpc_state(init_t) - sysnet_watch_config(init_t) optional_policy(` + networkmanager_initrc_read_lnk_files(init_t) @@ -48,7 +47,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te bootloader_domtrans(init_t) ') -@@ -568,10 +576,10 @@ tunable_policy(`init_audit_control',` +@@ -562,10 +570,10 @@ tunable_policy(`init_audit_control',` allow init_t self:system all_system_perms; allow init_t self:system module_load; allow init_t self:unix_dgram_socket { create_socket_perms sendto }; @@ -61,7 +60,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te allow init_t self:netlink_selinux_socket create_socket_perms; allow init_t self:unix_dgram_socket lock; # Until systemd is fixed -@@ -629,6 +637,7 @@ files_delete_all_spool_sockets(init_t) +@@ -623,6 +631,7 @@ files_delete_all_spool_sockets(init_t) files_create_var_lib_dirs(init_t) files_create_var_lib_symlinks(init_t) files_read_var_lib_symlinks(init_t) @@ -69,7 +68,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te files_manage_urandom_seed(init_t) files_list_locks(init_t) files_list_spool(init_t) -@@ -665,7 +674,7 @@ fs_list_all(init_t) +@@ -659,7 +668,7 @@ fs_list_all(init_t) fs_list_auto_mountpoints(init_t) fs_register_binary_executable_type(init_t) fs_relabel_tmpfs_sock_file(init_t) @@ -78,7 +77,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te fs_relabel_cgroup_dirs(init_t) fs_search_cgroup_dirs(init_t) # for network namespaces -@@ -721,6 +730,7 @@ systemd_write_inherited_logind_sessions_ +@@ -715,6 +724,7 @@ systemd_write_inherited_logind_sessions_ create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type) create_dirs_pattern(init_t, var_log_t, var_log_t) @@ -86,7 +85,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te auth_use_nsswitch(init_t) auth_rw_login_records(init_t) -@@ -1574,6 +1584,8 @@ optional_policy(` +@@ -1556,6 +1566,8 @@ optional_policy(` optional_policy(` postfix_list_spool(initrc_t) diff --git a/fix_logging.patch b/fix_logging.patch index 9014ac6..8f3a10d 100644 --- a/fix_logging.patch +++ b/fix_logging.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20210309/policy/modules/system/logging.fc +Index: fedora-policy-20210628/policy/modules/system/logging.fc =================================================================== ---- fedora-policy-20210309.orig/policy/modules/system/logging.fc -+++ fedora-policy-20210309/policy/modules/system/logging.fc +--- fedora-policy-20210628.orig/policy/modules/system/logging.fc ++++ fedora-policy-20210628/policy/modules/system/logging.fc @@ -3,6 +3,8 @@ /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) @@ -19,11 +19,11 @@ Index: fedora-policy-20210309/policy/modules/system/logging.fc /var/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) /var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh) -Index: fedora-policy-20210309/policy/modules/system/logging.if +Index: fedora-policy-20210628/policy/modules/system/logging.if =================================================================== ---- fedora-policy-20210309.orig/policy/modules/system/logging.if -+++ fedora-policy-20210309/policy/modules/system/logging.if -@@ -1722,3 +1722,22 @@ interface(`logging_dgram_send',` +--- fedora-policy-20210628.orig/policy/modules/system/logging.if ++++ fedora-policy-20210628/policy/modules/system/logging.if +@@ -1782,3 +1782,22 @@ interface(`logging_dgram_send',` allow $1 syslogd_t:unix_dgram_socket sendto; ') diff --git a/fix_logrotate.patch b/fix_logrotate.patch index 1b6fe37..7cb2f23 100644 --- a/fix_logrotate.patch +++ b/fix_logrotate.patch @@ -1,8 +1,8 @@ -Index: fedora-policy/policy/modules/contrib/logrotate.te +Index: fedora-policy-20210628/policy/modules/contrib/logrotate.te =================================================================== ---- fedora-policy.orig/policy/modules/contrib/logrotate.te -+++ fedora-policy/policy/modules/contrib/logrotate.te -@@ -107,6 +107,7 @@ files_var_lib_filetrans(logrotate_t, log +--- fedora-policy-20210628.orig/policy/modules/contrib/logrotate.te ++++ fedora-policy-20210628/policy/modules/contrib/logrotate.te +@@ -104,6 +104,7 @@ files_var_lib_filetrans(logrotate_t, log kernel_read_system_state(logrotate_t) kernel_read_kernel_sysctls(logrotate_t) diff --git a/fix_networkmanager.patch b/fix_networkmanager.patch index 50a8781..abaa320 100644 --- a/fix_networkmanager.patch +++ b/fix_networkmanager.patch @@ -1,16 +1,8 @@ -Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.te +Index: fedora-policy-20210628/policy/modules/contrib/networkmanager.te =================================================================== ---- fedora-policy-20210419.orig/policy/modules/contrib/networkmanager.te -+++ fedora-policy-20210419/policy/modules/contrib/networkmanager.te -@@ -97,6 +97,7 @@ read_files_pattern(NetworkManager_t, Net - read_lnk_files_pattern(NetworkManager_t, NetworkManager_initrc_exec_t, NetworkManager_initrc_exec_t) - - list_dirs_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t) -+watch_dirs_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t) - read_files_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t) - read_lnk_files_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t) - -@@ -241,6 +242,9 @@ userdom_read_home_certs(NetworkManager_t +--- fedora-policy-20210628.orig/policy/modules/contrib/networkmanager.te ++++ fedora-policy-20210628/policy/modules/contrib/networkmanager.te +@@ -243,6 +243,9 @@ userdom_read_home_certs(NetworkManager_t userdom_read_user_home_content_files(NetworkManager_t) userdom_dgram_send(NetworkManager_t) @@ -20,7 +12,7 @@ Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.te tunable_policy(`use_nfs_home_dirs',` fs_read_nfs_files(NetworkManager_t) ') -@@ -258,6 +262,14 @@ optional_policy(` +@@ -260,6 +263,14 @@ optional_policy(` ') optional_policy(` @@ -35,10 +27,10 @@ Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.te bind_domtrans(NetworkManager_t) bind_manage_cache(NetworkManager_t) bind_kill(NetworkManager_t) -Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.if +Index: fedora-policy-20210628/policy/modules/contrib/networkmanager.if =================================================================== ---- fedora-policy-20210419.orig/policy/modules/contrib/networkmanager.if -+++ fedora-policy-20210419/policy/modules/contrib/networkmanager.if +--- fedora-policy-20210628.orig/policy/modules/contrib/networkmanager.if ++++ fedora-policy-20210628/policy/modules/contrib/networkmanager.if @@ -114,6 +114,24 @@ interface(`networkmanager_initrc_domtran init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t) ') diff --git a/fix_nscd.patch b/fix_nscd.patch index 2f35b73..56a7c50 100644 --- a/fix_nscd.patch +++ b/fix_nscd.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20210309/policy/modules/contrib/nscd.fc +Index: fedora-policy-20210628/policy/modules/contrib/nscd.fc =================================================================== ---- fedora-policy-20210309.orig/policy/modules/contrib/nscd.fc -+++ fedora-policy-20210309/policy/modules/contrib/nscd.fc +--- fedora-policy-20210628.orig/policy/modules/contrib/nscd.fc ++++ fedora-policy-20210628/policy/modules/contrib/nscd.fc @@ -8,8 +8,10 @@ /var/log/nscd\.log.* -- gen_context(system_u:object_r:nscd_log_t,s0) @@ -14,11 +14,11 @@ Index: fedora-policy-20210309/policy/modules/contrib/nscd.fc /usr/lib/systemd/system/nscd\.service -- gen_context(system_u:object_r:nscd_unit_file_t,s0) + -Index: fedora-policy-20210309/policy/modules/contrib/nscd.te +Index: fedora-policy-20210628/policy/modules/contrib/nscd.te =================================================================== ---- fedora-policy-20210309.orig/policy/modules/contrib/nscd.te -+++ fedora-policy-20210309/policy/modules/contrib/nscd.te -@@ -131,6 +131,14 @@ userdom_dontaudit_use_unpriv_user_fds(ns +--- fedora-policy-20210628.orig/policy/modules/contrib/nscd.te ++++ fedora-policy-20210628/policy/modules/contrib/nscd.te +@@ -130,6 +130,14 @@ userdom_dontaudit_use_unpriv_user_fds(ns userdom_dontaudit_search_user_home_dirs(nscd_t) optional_policy(` diff --git a/fix_rpm.patch b/fix_rpm.patch index 0545aa8..e5d9b7c 100644 --- a/fix_rpm.patch +++ b/fix_rpm.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20210309/policy/modules/contrib/rpm.fc +Index: fedora-policy-20210628/policy/modules/contrib/rpm.fc =================================================================== ---- fedora-policy-20210309.orig/policy/modules/contrib/rpm.fc -+++ fedora-policy-20210309/policy/modules/contrib/rpm.fc +--- fedora-policy-20210628.orig/policy/modules/contrib/rpm.fc ++++ fedora-policy-20210628/policy/modules/contrib/rpm.fc @@ -18,6 +18,10 @@ /usr/bin/repoquery -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/bin/zif -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -22,11 +22,11 @@ Index: fedora-policy-20210309/policy/modules/contrib/rpm.fc /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) /var/lib/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) /var/lib/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) -Index: fedora-policy-20210309/policy/modules/contrib/rpm.if +Index: fedora-policy-20210628/policy/modules/contrib/rpm.if =================================================================== ---- fedora-policy-20210309.orig/policy/modules/contrib/rpm.if -+++ fedora-policy-20210309/policy/modules/contrib/rpm.if -@@ -476,8 +476,10 @@ interface(`rpm_named_filetrans',` +--- fedora-policy-20210628.orig/policy/modules/contrib/rpm.if ++++ fedora-policy-20210628/policy/modules/contrib/rpm.if +@@ -479,8 +479,10 @@ interface(`rpm_named_filetrans',` logging_log_named_filetrans($1, rpm_log_t, file, "yum.log") logging_log_named_filetrans($1, rpm_log_t, file, "hawkey.log") logging_log_named_filetrans($1, rpm_log_t, file, "up2date") @@ -37,10 +37,10 @@ Index: fedora-policy-20210309/policy/modules/contrib/rpm.if files_var_lib_filetrans($1, rpm_var_lib_t, dir, "dnf") files_var_lib_filetrans($1, rpm_var_lib_t, dir, "yum") files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpm") -Index: fedora-policy-20210309/policy/modules/kernel/files.fc +Index: fedora-policy-20210628/policy/modules/kernel/files.fc =================================================================== ---- fedora-policy-20210309.orig/policy/modules/kernel/files.fc -+++ fedora-policy-20210309/policy/modules/kernel/files.fc +--- fedora-policy-20210628.orig/policy/modules/kernel/files.fc ++++ fedora-policy-20210628/policy/modules/kernel/files.fc @@ -67,6 +67,7 @@ ifdef(`distro_suse',` /etc/sysconfig/ipvsadm.* -- gen_context(system_u:object_r:system_conf_t,s0) /etc/sysconfig/system-config-firewall.* -- gen_context(system_u:object_r:system_conf_t,s0) diff --git a/fix_selinuxutil.patch b/fix_selinuxutil.patch index 831ee7c..84e87ac 100644 --- a/fix_selinuxutil.patch +++ b/fix_selinuxutil.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20210309/policy/modules/system/selinuxutil.te +Index: fedora-policy-20210628/policy/modules/system/selinuxutil.te =================================================================== ---- fedora-policy-20210309.orig/policy/modules/system/selinuxutil.te -+++ fedora-policy-20210309/policy/modules/system/selinuxutil.te +--- fedora-policy-20210628.orig/policy/modules/system/selinuxutil.te ++++ fedora-policy-20210628/policy/modules/system/selinuxutil.te @@ -238,6 +238,10 @@ ifdef(`hide_broken_symptoms',` ') @@ -13,7 +13,7 @@ Index: fedora-policy-20210309/policy/modules/system/selinuxutil.te portage_dontaudit_use_fds(load_policy_t) ') -@@ -619,6 +623,10 @@ logging_send_audit_msgs(setfiles_t) +@@ -618,6 +622,10 @@ logging_send_audit_msgs(setfiles_t) logging_send_syslog_msg(setfiles_t) optional_policy(` @@ -24,11 +24,11 @@ Index: fedora-policy-20210309/policy/modules/system/selinuxutil.te cloudform_dontaudit_write_cloud_log(setfiles_t) ') -Index: fedora-policy-20210309/policy/modules/system/selinuxutil.if +Index: fedora-policy-20210628/policy/modules/system/selinuxutil.if =================================================================== ---- fedora-policy-20210309.orig/policy/modules/system/selinuxutil.if -+++ fedora-policy-20210309/policy/modules/system/selinuxutil.if -@@ -777,6 +777,8 @@ interface(`seutil_dontaudit_read_config' +--- fedora-policy-20210628.orig/policy/modules/system/selinuxutil.if ++++ fedora-policy-20210628/policy/modules/system/selinuxutil.if +@@ -795,6 +795,8 @@ interface(`seutil_dontaudit_read_config' dontaudit $1 selinux_config_t:dir search_dir_perms; dontaudit $1 selinux_config_t:file read_file_perms; diff --git a/fix_systemd.patch b/fix_systemd.patch index cd39f53..02f834e 100644 --- a/fix_systemd.patch +++ b/fix_systemd.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20210309/policy/modules/system/systemd.te +Index: fedora-policy-20210628/policy/modules/system/systemd.te =================================================================== ---- fedora-policy-20210309.orig/policy/modules/system/systemd.te -+++ fedora-policy-20210309/policy/modules/system/systemd.te +--- fedora-policy-20210628.orig/policy/modules/system/systemd.te ++++ fedora-policy-20210628/policy/modules/system/systemd.te @@ -347,6 +347,10 @@ userdom_manage_user_tmp_chr_files(system xserver_dbus_chat(systemd_logind_t) @@ -13,7 +13,7 @@ Index: fedora-policy-20210309/policy/modules/system/systemd.te apache_read_tmp_files(systemd_logind_t) ') -@@ -853,6 +857,10 @@ optional_policy(` +@@ -854,6 +858,10 @@ optional_policy(` udev_read_pid_files(systemd_hostnamed_t) ') diff --git a/fix_systemd_watch.patch b/fix_systemd_watch.patch index fb52641..65b98c8 100644 --- a/fix_systemd_watch.patch +++ b/fix_systemd_watch.patch @@ -1,38 +1,17 @@ -Index: fedora-policy-20210419/policy/modules/system/systemd.te +Index: fedora-policy-20210716/policy/modules/system/systemd.te =================================================================== ---- fedora-policy-20210419.orig/policy/modules/system/systemd.te -+++ fedora-policy-20210419/policy/modules/system/systemd.te -@@ -1357,3 +1357,10 @@ fstools_rw_swap_files(systemd_sleep_t) - +--- fedora-policy-20210716.orig/policy/modules/system/systemd.te ++++ fedora-policy-20210716/policy/modules/system/systemd.te +@@ -1396,6 +1396,12 @@ fstools_rw_swap_files(systemd_sleep_t) # systemd-sleep needs to getattr swap partitions storage_getattr_fixed_disk_dev(systemd_sleep_t) -+ -+ + +####################################### +# +# Allow systemd to watch certificate dir for ca-certificates +# +watch_dirs_pattern(init_t,cert_t,cert_t) -Index: fedora-policy-20210419/policy/modules/system/init.te -=================================================================== ---- fedora-policy-20210419.orig/policy/modules/system/init.te -+++ fedora-policy-20210419/policy/modules/system/init.te -@@ -317,7 +317,10 @@ files_etc_filetrans_etc_runtime(init_t, - # Run /etc/X11/prefdm: - files_exec_etc_files(init_t) - files_watch_etc_dirs(init_t) -+files_watch_etc_files(init_t) - files_read_usr_files(init_t) -+files_watch_usr_dirs(init_t) -+files_watch_usr_files(init_t) - files_watch_root_dirs(init_t) - files_write_root_dirs(init_t) - files_watch_var_dirs(init_t) -@@ -334,6 +337,7 @@ files_remount_rootfs(init_t) - files_create_var_dirs(init_t) - files_watch_home(init_t) - files_watch_all_pid(init_t) -+watch_dirs_pattern(init_t,lib_t,lib_t) - - fs_list_inotifyfs(init_t) - # cjp: this may be related to /dev/log ++ + optional_policy(` + sysstat_domtrans(systemd_sleep_t) + ') diff --git a/fix_thunderbird.patch b/fix_thunderbird.patch index 0e2ee48..159afc4 100644 --- a/fix_thunderbird.patch +++ b/fix_thunderbird.patch @@ -1,8 +1,8 @@ -Index: fedora-policy/policy/modules/contrib/thunderbird.te +Index: fedora-policy-20210628/policy/modules/contrib/thunderbird.te =================================================================== ---- fedora-policy.orig/policy/modules/contrib/thunderbird.te -+++ fedora-policy/policy/modules/contrib/thunderbird.te -@@ -139,7 +139,6 @@ optional_policy(` +--- fedora-policy-20210628.orig/policy/modules/contrib/thunderbird.te ++++ fedora-policy-20210628/policy/modules/contrib/thunderbird.te +@@ -138,7 +138,6 @@ optional_policy(` optional_policy(` gnome_stream_connect_gconf(thunderbird_t) gnome_domtrans_gconfd(thunderbird_t) diff --git a/fix_unconfined.patch b/fix_unconfined.patch index 468bdf3..114c71d 100644 --- a/fix_unconfined.patch +++ b/fix_unconfined.patch @@ -1,7 +1,7 @@ -Index: fedora-policy/policy/modules/system/unconfined.te +Index: fedora-policy-20210628/policy/modules/system/unconfined.te =================================================================== ---- fedora-policy.orig/policy/modules/system/unconfined.te -+++ fedora-policy/policy/modules/system/unconfined.te +--- fedora-policy-20210628.orig/policy/modules/system/unconfined.te ++++ fedora-policy-20210628/policy/modules/system/unconfined.te @@ -1,5 +1,10 @@ policy_module(unconfined, 3.5.0) @@ -13,7 +13,7 @@ Index: fedora-policy/policy/modules/system/unconfined.te ######################################## # # Declarations -@@ -39,3 +44,6 @@ optional_policy(` +@@ -41,3 +46,6 @@ optional_policy(` optional_policy(` container_runtime_domtrans(unconfined_service_t) ') diff --git a/fix_unconfineduser.patch b/fix_unconfineduser.patch index 55b9dda..0161703 100644 --- a/fix_unconfineduser.patch +++ b/fix_unconfineduser.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20210419/policy/modules/roles/unconfineduser.te +Index: fedora-policy-20210628/policy/modules/roles/unconfineduser.te =================================================================== ---- fedora-policy-20210419.orig/policy/modules/roles/unconfineduser.te -+++ fedora-policy-20210419/policy/modules/roles/unconfineduser.te -@@ -124,6 +124,11 @@ tunable_policy(`unconfined_dyntrans_all' +--- fedora-policy-20210628.orig/policy/modules/roles/unconfineduser.te ++++ fedora-policy-20210628/policy/modules/roles/unconfineduser.te +@@ -126,6 +126,11 @@ tunable_policy(`unconfined_dyntrans_all' domain_dyntrans(unconfined_t) ') @@ -14,7 +14,7 @@ Index: fedora-policy-20210419/policy/modules/roles/unconfineduser.te optional_policy(` gen_require(` type unconfined_t; -@@ -214,6 +219,10 @@ optional_policy(` +@@ -212,6 +217,10 @@ optional_policy(` ') optional_policy(` @@ -25,7 +25,7 @@ Index: fedora-policy-20210419/policy/modules/roles/unconfineduser.te chrome_role_notrans(unconfined_r, unconfined_t) tunable_policy(`unconfined_chrome_sandbox_transition',` -@@ -248,6 +257,18 @@ optional_policy(` +@@ -246,6 +255,18 @@ optional_policy(` dbus_stub(unconfined_t) optional_policy(` @@ -44,7 +44,7 @@ Index: fedora-policy-20210419/policy/modules/roles/unconfineduser.te bluetooth_dbus_chat(unconfined_t) ') -@@ -311,6 +332,10 @@ optional_policy(` +@@ -309,6 +330,10 @@ optional_policy(` ') optional_policy(` diff --git a/fix_unprivuser.patch b/fix_unprivuser.patch index 26ac928..f23ba18 100644 --- a/fix_unprivuser.patch +++ b/fix_unprivuser.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20210419/policy/modules/roles/unprivuser.te +Index: fedora-policy-20210628/policy/modules/roles/unprivuser.te =================================================================== ---- fedora-policy-20210419.orig/policy/modules/roles/unprivuser.te -+++ fedora-policy-20210419/policy/modules/roles/unprivuser.te -@@ -291,6 +291,13 @@ ifndef(`distro_redhat',` +--- fedora-policy-20210628.orig/policy/modules/roles/unprivuser.te ++++ fedora-policy-20210628/policy/modules/roles/unprivuser.te +@@ -287,6 +287,13 @@ ifndef(`distro_redhat',` ') optional_policy(` diff --git a/fix_xserver.patch b/fix_xserver.patch index 14f6700..785494c 100644 --- a/fix_xserver.patch +++ b/fix_xserver.patch @@ -1,7 +1,7 @@ -Index: fedora-policy/policy/modules/services/xserver.fc +Index: fedora-policy-20210628/policy/modules/services/xserver.fc =================================================================== ---- fedora-policy.orig/policy/modules/services/xserver.fc -+++ fedora-policy/policy/modules/services/xserver.fc +--- fedora-policy-20210628.orig/policy/modules/services/xserver.fc ++++ fedora-policy-20210628/policy/modules/services/xserver.fc @@ -71,6 +71,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_ /etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0) @@ -18,7 +18,7 @@ Index: fedora-policy/policy/modules/services/xserver.fc /usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0) /usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0) /usr/bin/razor-lightdm-.* -- gen_context(system_u:object_r:xdm_exec_t,s0) -@@ -135,6 +137,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_ +@@ -136,6 +138,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_ /usr/X11R6/lib/X11/xkb -d gen_context(system_u:object_r:xkb_var_lib_t,s0) /usr/X11R6/lib/X11/xkb/.* -- gen_context(system_u:object_r:xkb_var_lib_t,s0) @@ -26,11 +26,11 @@ Index: fedora-policy/policy/modules/services/xserver.fc ifndef(`distro_debian',` /usr/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0) ') -Index: fedora-policy/policy/modules/services/xserver.te +Index: fedora-policy-20210628/policy/modules/services/xserver.te =================================================================== ---- fedora-policy.orig/policy/modules/services/xserver.te -+++ fedora-policy/policy/modules/services/xserver.te -@@ -477,6 +477,10 @@ userdom_delete_user_home_content_files(x +--- fedora-policy-20210628.orig/policy/modules/services/xserver.te ++++ fedora-policy-20210628/policy/modules/services/xserver.te +@@ -473,6 +473,10 @@ userdom_delete_user_home_content_files(x userdom_signull_unpriv_users(xdm_t) userdom_dontaudit_read_admin_home_lnk_files(xdm_t) diff --git a/modules-targeted-base.conf b/modules-targeted-base.conf index 3c380c0..f5bcc4c 100644 --- a/modules-targeted-base.conf +++ b/modules-targeted-base.conf @@ -412,10 +412,3 @@ rtorrent = module # Policy for wicked # wicked = module - -# Layer: contrib -# Module: tabrmd -# -# Policy for tabrmd -# -tabrmd = module diff --git a/selinux-policy.changes b/selinux-policy.changes index b4cf233..a097bed 100644 --- a/selinux-policy.changes +++ b/selinux-policy.changes @@ -1,3 +1,20 @@ +------------------------------------------------------------------- +Fri Jul 16 07:11:57 UTC 2021 - Johannes Segitz + +- Update to version 20210716 +- Remove interfaces for container module before building the package + (bsc#1188184) +- Updated + * fix_init.patch + * fix_systemd_watch.patch + to adapt to upstream changes + +------------------------------------------------------------------- +Thu Jul 15 15:45:57 UTC 2021 - Callum Farmer + +- Use tabrmd SELinux modules from tpm2.0-abrmd instead of storing + here + ------------------------------------------------------------------- Tue Jul 6 13:55:19 UTC 2021 - Alberto Planas Dominguez @@ -5,6 +22,30 @@ Tue Jul 6 13:55:19 UTC 2021 - Alberto Planas Dominguez https://github.com/tpm2-software/tpm2-abrmd/tree/master/selinux - Automatic spec-cleaner to fix ordering and misaligned spaces +------------------------------------------------------------------- +Mon Jun 28 08:11:25 UTC 2021 - Johannes Segitz + +- Update to version 20210419 +- Dropped fix_gift.patch, module was removed +- Updated wicked.te to removed dropped interface +- Refreshed: + * fix_cockpit.patch + * fix_hadoop.patch + * fix_init.patch + * fix_logging.patch + * fix_logrotate.patch + * fix_networkmanager.patch + * fix_nscd.patch + * fix_rpm.patch + * fix_selinuxutil.patch + * fix_systemd.patch + * fix_systemd_watch.patch + * fix_thunderbird.patch + * fix_unconfined.patch + * fix_unconfineduser.patch + * fix_unprivuser.patch + * fix_xserver.patch + ------------------------------------------------------------------- Tue May 18 11:10:59 UTC 2021 - Ludwig Nussel diff --git a/selinux-policy.spec b/selinux-policy.spec index 4687a5f..413e576 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -33,7 +33,7 @@ Summary: SELinux policy configuration License: GPL-2.0-or-later Group: System/Management Name: selinux-policy -Version: 20210419 +Version: 20210716 Release: 0 Source: fedora-policy-%{version}.tar.bz2 Source1: selinux-policy-rpmlintrc @@ -81,13 +81,9 @@ Source125: rtorrent.fc Source126: wicked.te Source127: wicked.if Source128: wicked.fc -Source129: tabrmd.te -Source130: tabrmd.if -Source131: tabrmd.fc Patch001: fix_djbdns.patch Patch002: fix_dbus.patch -Patch003: fix_gift.patch Patch004: fix_java.patch Patch005: fix_hadoop.patch Patch006: fix_thunderbird.patch @@ -424,7 +420,7 @@ for i in %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} cp $i selinux_config done -for i in %{SOURCE120} %{SOURCE121} %{SOURCE122} %{SOURCE123} %{SOURCE124} %{SOURCE125} %{SOURCE126} %{SOURCE127} %{SOURCE128} %{SOURCE129} %{SOURCE130} %{SOURCE131}; do +for i in %{SOURCE120} %{SOURCE121} %{SOURCE122} %{SOURCE123} %{SOURCE124} %{SOURCE125} %{SOURCE126} %{SOURCE127} %{SOURCE128}; do cp $i policy/modules/contrib done @@ -475,6 +471,8 @@ install -m 644 doc/policy.* %{buildroot}%{_datadir}/selinux/devel/ mkdir %{buildroot}%{_datadir}/selinux/devel/html mv %{buildroot}%{_datadir}/man/man8/*.html %{buildroot}%{_datadir}/selinux/devel/html mv %{buildroot}%{_datadir}/man/man8/style.css %{buildroot}%{_datadir}/selinux/devel/html +rm %{buildroot}%{_mandir}/man8/container_selinux.8* +rm %{buildroot}%{_datadir}/selinux/devel/include/services/container.if %post if [ ! -s %{_sysconfdir}/selinux/config ]; then diff --git a/tabrmd.fc b/tabrmd.fc deleted file mode 100644 index 9f9ec1e..0000000 --- a/tabrmd.fc +++ /dev/null @@ -1,2 +0,0 @@ -/usr/sbin/tpm2-abrmd -- gen_context(system_u:object_r:tabrmd_exec_t,s0) -/usr/local/sbin/tpm2-abrmd -- gen_context(system_u:object_r:tabrmd_exec_t,s0) diff --git a/tabrmd.if b/tabrmd.if deleted file mode 100644 index 5846dc1..0000000 --- a/tabrmd.if +++ /dev/null @@ -1 +0,0 @@ -## diff --git a/tabrmd.te b/tabrmd.te deleted file mode 100644 index b0f8af4..0000000 --- a/tabrmd.te +++ /dev/null @@ -1,29 +0,0 @@ -policy_module(tabrmd, 0.0.2) - -######################################## -# -# Declarations -# - -gen_tunable(`tabrmd_connect_all_unreserved', false) - -type tabrmd_t; -type tabrmd_exec_t; -init_daemon_domain(tabrmd_t, tabrmd_exec_t) - -allow tabrmd_t self:unix_dgram_socket { create_socket_perms }; - -dev_rw_tpm(tabrmd_t) -logging_send_syslog_msg(tabrmd_t) -sysnet_dns_name_resolve(tabrmd_t) - -optional_policy(` - dbus_stub() - dbus_system_domain(tabrmd_t, tabrmd_exec_t) - allow system_dbusd_t tabrmd_t:unix_stream_socket rw_stream_socket_perms; - fwupd_dbus_chat(tabrmd_t) -') - -tunable_policy(`tabrmd_connect_all_unreserved',` - corenet_tcp_connect_all_unreserved_ports(tabrmd_t) -') diff --git a/update.sh b/update.sh index a2790b1..92f709c 100644 --- a/update.sh +++ b/update.sh @@ -11,7 +11,7 @@ git clone --depth 1 https://github.com/containers/container-selinux.git mv selinux-policy fedora-policy-$date rm -rf fedora-policy-$date/.git* -mv container-selinux/container.* fedora-policy-$date/policy/modules/contrib/ +mv container-selinux/container.* fedora-policy-$date/policy/modules/services/ rm -f fedora-policy?$date.tar* tar cf fedora-policy-$date.tar fedora-policy-$date diff --git a/wicked.te b/wicked.te index 3e9849b..8441a29 100644 --- a/wicked.te +++ b/wicked.te @@ -326,10 +326,6 @@ optional_policy(` fcoe_dgram_send_fcoemon(wicked_t) ') -optional_policy(` - hal_write_log(wicked_t) -') - optional_policy(` howl_signal(wicked_t) ')