From a7283c99d6567666266ad4d3f208234608e09c5da75258efba6057e4664514bb Mon Sep 17 00:00:00 2001 From: Johannes Segitz Date: Fri, 24 Jun 2022 09:40:15 +0000 Subject: [PATCH] Accepting request 984855 from home:jsegitz:branches:security:SELinux - Update to version 20220624. Refreshed: * fix_init.patch * fix_kernel_sysctl.patch * fix_logging.patch * fix_networkmanager.patch * fix_unprivuser.patch Dropped fix_hadoop.patch, not necessary anymore * Updated fix_locallogin.patch to allow accesses for nss-systemd (bsc#1199630) OBS-URL: https://build.opensuse.org/request/show/984855 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=132 --- fedora-policy-20220520.tar.bz2 | 3 --- fedora-policy-20220624.tar.bz2 | 3 +++ fix_hadoop.patch | 30 ------------------------------ fix_init.patch | 22 +++++++++++----------- fix_kernel_sysctl.patch | 14 +++++++------- fix_locallogin.patch | 14 +++++++++++--- fix_logging.patch | 14 +++++++------- fix_networkmanager.patch | 16 ++++++++-------- fix_unprivuser.patch | 8 ++++---- selinux-policy.changes | 13 +++++++++++++ selinux-policy.spec | 3 +-- 11 files changed, 65 insertions(+), 75 deletions(-) delete mode 100644 fedora-policy-20220520.tar.bz2 create mode 100644 fedora-policy-20220624.tar.bz2 delete mode 100644 fix_hadoop.patch diff --git a/fedora-policy-20220520.tar.bz2 b/fedora-policy-20220520.tar.bz2 deleted file mode 100644 index 8523e23..0000000 --- a/fedora-policy-20220520.tar.bz2 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:90d1df3189f84ff576e2bd3cf5bc504bac06037d3475ea1904d2b9eda9d164e7 -size 730405 diff --git a/fedora-policy-20220624.tar.bz2 b/fedora-policy-20220624.tar.bz2 new file mode 100644 index 0000000..19e65ab --- /dev/null +++ b/fedora-policy-20220624.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:1cd368f29dfa53404b27e8cd3a055bf0a7f78214a4124b53b6ba616d00c7ff3e +size 731909 diff --git a/fix_hadoop.patch b/fix_hadoop.patch deleted file mode 100644 index 708fcb9..0000000 --- a/fix_hadoop.patch +++ /dev/null @@ -1,30 +0,0 @@ -Index: fedora-policy-20220428/policy/modules/roles/sysadm.te -=================================================================== ---- fedora-policy-20220428.orig/policy/modules/roles/sysadm.te -+++ fedora-policy-20220428/policy/modules/roles/sysadm.te -@@ -315,10 +315,6 @@ optional_policy(` - ') - - optional_policy(` -- hadoop_role(sysadm_r, sysadm_t) --') -- --optional_policy(` - iotop_run(sysadm_t, sysadm_r) - ') - -Index: fedora-policy-20220428/policy/modules/roles/unprivuser.te -=================================================================== ---- fedora-policy-20220428.orig/policy/modules/roles/unprivuser.te -+++ fedora-policy-20220428/policy/modules/roles/unprivuser.te -@@ -210,10 +210,6 @@ ifndef(`distro_redhat',` - ') - - optional_policy(` -- hadoop_role(user_r, user_t) -- ') -- -- optional_policy(` - irc_role(user_r, user_t) - ') - diff --git a/fix_init.patch b/fix_init.patch index f209bdb..239c74b 100644 --- a/fix_init.patch +++ b/fix_init.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20220428/policy/modules/system/init.te +Index: fedora-policy-20220624/policy/modules/system/init.te =================================================================== ---- fedora-policy-20220428.orig/policy/modules/system/init.te -+++ fedora-policy-20220428/policy/modules/system/init.te +--- fedora-policy-20220624.orig/policy/modules/system/init.te ++++ fedora-policy-20220624/policy/modules/system/init.te @@ -187,6 +187,8 @@ allow init_t self:bpf { map_create map_r # setuid (from /sbin/shutdown) # sys_chroot (from /usr/bin/chroot): now provided by corecmd_chroot_exec_chroot() @@ -28,7 +28,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te seutil_read_config(init_t) seutil_read_login_config(init_t) -@@ -446,9 +451,19 @@ ifdef(`distro_redhat',` +@@ -448,9 +453,19 @@ ifdef(`distro_redhat',` corecmd_shell_domtrans(init_t, initrc_t) storage_raw_rw_fixed_disk(init_t) @@ -46,9 +46,9 @@ Index: fedora-policy-20220428/policy/modules/system/init.te +') + optional_policy(` - bootloader_domtrans(init_t) - ') -@@ -573,10 +588,10 @@ tunable_policy(`init_audit_control',` + anaconda_stream_connect(init_t) + anaconda_create_unix_stream_sockets(init_t) +@@ -580,10 +595,10 @@ tunable_policy(`init_audit_control',` allow init_t self:system all_system_perms; allow init_t self:system module_load; allow init_t self:unix_dgram_socket { create_socket_perms sendto }; @@ -61,7 +61,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te allow init_t self:netlink_selinux_socket create_socket_perms; allow init_t self:unix_dgram_socket lock; # Until systemd is fixed -@@ -635,6 +650,7 @@ files_delete_all_spool_sockets(init_t) +@@ -642,6 +657,7 @@ files_delete_all_spool_sockets(init_t) files_create_var_lib_dirs(init_t) files_create_var_lib_symlinks(init_t) files_read_var_lib_symlinks(init_t) @@ -69,7 +69,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te files_manage_urandom_seed(init_t) files_list_locks(init_t) files_list_spool(init_t) -@@ -672,7 +688,7 @@ fs_list_all(init_t) +@@ -679,7 +695,7 @@ fs_list_all(init_t) fs_list_auto_mountpoints(init_t) fs_register_binary_executable_type(init_t) fs_relabel_tmpfs_sock_file(init_t) @@ -78,7 +78,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te fs_relabel_cgroup_dirs(init_t) fs_search_cgroup_dirs(init_t) # for network namespaces -@@ -728,6 +744,7 @@ systemd_write_inherited_logind_sessions_ +@@ -735,6 +751,7 @@ systemd_write_inherited_logind_sessions_ create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type) create_dirs_pattern(init_t, var_log_t, var_log_t) @@ -86,7 +86,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te auth_use_nsswitch(init_t) auth_rw_login_records(init_t) -@@ -1578,6 +1595,8 @@ optional_policy(` +@@ -1589,6 +1606,8 @@ optional_policy(` optional_policy(` postfix_list_spool(initrc_t) diff --git a/fix_kernel_sysctl.patch b/fix_kernel_sysctl.patch index b32448e..bd4527a 100644 --- a/fix_kernel_sysctl.patch +++ b/fix_kernel_sysctl.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20220428/policy/modules/kernel/files.fc +Index: fedora-policy-20220624/policy/modules/kernel/files.fc =================================================================== ---- fedora-policy-20220428.orig/policy/modules/kernel/files.fc -+++ fedora-policy-20220428/policy/modules/kernel/files.fc -@@ -236,6 +236,8 @@ ifdef(`distro_redhat',` +--- fedora-policy-20220624.orig/policy/modules/kernel/files.fc ++++ fedora-policy-20220624/policy/modules/kernel/files.fc +@@ -242,6 +242,8 @@ ifdef(`distro_redhat',` /usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0) /usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0) /usr/lib/modules(/.*)/initramfs.img -- gen_context(system_u:object_r:usr_t,s0) @@ -11,10 +11,10 @@ Index: fedora-policy-20220428/policy/modules/kernel/files.fc /usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) -Index: fedora-policy-20220428/policy/modules/system/systemd.te +Index: fedora-policy-20220624/policy/modules/system/systemd.te =================================================================== ---- fedora-policy-20220428.orig/policy/modules/system/systemd.te -+++ fedora-policy-20220428/policy/modules/system/systemd.te +--- fedora-policy-20220624.orig/policy/modules/system/systemd.te ++++ fedora-policy-20220624/policy/modules/system/systemd.te @@ -1052,6 +1052,8 @@ init_stream_connect(systemd_sysctl_t) logging_send_syslog_msg(systemd_sysctl_t) diff --git a/fix_locallogin.patch b/fix_locallogin.patch index 6247e22..cdee73c 100644 --- a/fix_locallogin.patch +++ b/fix_locallogin.patch @@ -1,7 +1,7 @@ -Index: fedora-policy/policy/modules/system/locallogin.te +Index: fedora-policy-20220624/policy/modules/system/locallogin.te =================================================================== ---- fedora-policy.orig/policy/modules/system/locallogin.te 2020-02-19 09:36:25.440182406 +0000 -+++ fedora-policy/policy/modules/system/locallogin.te 2020-02-21 08:52:35.961803038 +0000 +--- fedora-policy-20220624.orig/policy/modules/system/locallogin.te ++++ fedora-policy-20220624/policy/modules/system/locallogin.te @@ -63,6 +63,7 @@ kernel_read_system_state(local_login_t) kernel_read_kernel_sysctls(local_login_t) kernel_search_key(local_login_t) @@ -10,3 +10,11 @@ Index: fedora-policy/policy/modules/system/locallogin.te corecmd_list_bin(local_login_t) corecmd_read_bin_symlinks(local_login_t) +@@ -137,6 +138,7 @@ auth_rw_faillog(local_login_t) + auth_manage_pam_console_data(local_login_t) + auth_domtrans_pam_console(local_login_t) + auth_use_nsswitch(local_login_t) ++auth_read_shadow(local_login_t) + + init_dontaudit_use_fds(local_login_t) + init_stream_connect(local_login_t) diff --git a/fix_logging.patch b/fix_logging.patch index 0ae3fec..8a74cb7 100644 --- a/fix_logging.patch +++ b/fix_logging.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20211111/policy/modules/system/logging.fc +Index: fedora-policy-20220624/policy/modules/system/logging.fc =================================================================== ---- fedora-policy-20211111.orig/policy/modules/system/logging.fc -+++ fedora-policy-20211111/policy/modules/system/logging.fc +--- fedora-policy-20220624.orig/policy/modules/system/logging.fc ++++ fedora-policy-20220624/policy/modules/system/logging.fc @@ -3,6 +3,8 @@ /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) @@ -19,11 +19,11 @@ Index: fedora-policy-20211111/policy/modules/system/logging.fc /var/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) /var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh) -Index: fedora-policy-20211111/policy/modules/system/logging.if +Index: fedora-policy-20220624/policy/modules/system/logging.if =================================================================== ---- fedora-policy-20211111.orig/policy/modules/system/logging.if -+++ fedora-policy-20211111/policy/modules/system/logging.if -@@ -1787,3 +1787,22 @@ interface(`logging_dgram_send',` +--- fedora-policy-20220624.orig/policy/modules/system/logging.if ++++ fedora-policy-20220624/policy/modules/system/logging.if +@@ -1788,3 +1788,22 @@ interface(`logging_dgram_send',` allow $1 syslogd_t:unix_dgram_socket sendto; ') diff --git a/fix_networkmanager.patch b/fix_networkmanager.patch index 58e611c..1a58fe3 100644 --- a/fix_networkmanager.patch +++ b/fix_networkmanager.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.te +Index: fedora-policy-20220624/policy/modules/contrib/networkmanager.te =================================================================== ---- fedora-policy-20220428.orig/policy/modules/contrib/networkmanager.te -+++ fedora-policy-20220428/policy/modules/contrib/networkmanager.te -@@ -271,6 +271,9 @@ userdom_read_home_certs(NetworkManager_t +--- fedora-policy-20220624.orig/policy/modules/contrib/networkmanager.te ++++ fedora-policy-20220624/policy/modules/contrib/networkmanager.te +@@ -276,6 +276,9 @@ userdom_read_home_certs(NetworkManager_t userdom_read_user_home_content_files(NetworkManager_t) userdom_dgram_send(NetworkManager_t) @@ -12,7 +12,7 @@ Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.te tunable_policy(`use_nfs_home_dirs',` fs_read_nfs_files(NetworkManager_t) ') -@@ -288,6 +291,14 @@ optional_policy(` +@@ -293,6 +296,14 @@ optional_policy(` ') optional_policy(` @@ -27,10 +27,10 @@ Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.te bind_domtrans(NetworkManager_t) bind_manage_cache(NetworkManager_t) bind_kill(NetworkManager_t) -Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.if +Index: fedora-policy-20220624/policy/modules/contrib/networkmanager.if =================================================================== ---- fedora-policy-20220428.orig/policy/modules/contrib/networkmanager.if -+++ fedora-policy-20220428/policy/modules/contrib/networkmanager.if +--- fedora-policy-20220624.orig/policy/modules/contrib/networkmanager.if ++++ fedora-policy-20220624/policy/modules/contrib/networkmanager.if @@ -132,6 +132,24 @@ interface(`networkmanager_initrc_domtran init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t) ') diff --git a/fix_unprivuser.patch b/fix_unprivuser.patch index 639da39..646fcde 100644 --- a/fix_unprivuser.patch +++ b/fix_unprivuser.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20220428/policy/modules/roles/unprivuser.te +Index: fedora-policy-20220624/policy/modules/roles/unprivuser.te =================================================================== ---- fedora-policy-20220428.orig/policy/modules/roles/unprivuser.te -+++ fedora-policy-20220428/policy/modules/roles/unprivuser.te -@@ -292,6 +292,13 @@ ifndef(`distro_redhat',` +--- fedora-policy-20220624.orig/policy/modules/roles/unprivuser.te ++++ fedora-policy-20220624/policy/modules/roles/unprivuser.te +@@ -296,6 +296,13 @@ ifndef(`distro_redhat',` ') optional_policy(` diff --git a/selinux-policy.changes b/selinux-policy.changes index dea6cfe..170fbc2 100644 --- a/selinux-policy.changes +++ b/selinux-policy.changes @@ -1,3 +1,16 @@ +------------------------------------------------------------------- +Fri Jun 24 06:32:55 UTC 2022 - Johannes Segitz + +- Update to version 20220624. Refreshed: + * fix_init.patch + * fix_kernel_sysctl.patch + * fix_logging.patch + * fix_networkmanager.patch + * fix_unprivuser.patch + Dropped fix_hadoop.patch, not necessary anymore +* Updated fix_locallogin.patch to allow accesses for nss-systemd + (bsc#1199630) + ------------------------------------------------------------------- Fri May 20 13:46:47 UTC 2022 - Johannes Segitz diff --git a/selinux-policy.spec b/selinux-policy.spec index dc83c18..0280976 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -33,7 +33,7 @@ Summary: SELinux policy configuration License: GPL-2.0-or-later Group: System/Management Name: selinux-policy -Version: 20220520 +Version: 20220624 Release: 0 Source: fedora-policy-%{version}.tar.bz2 Source1: selinux-policy-rpmlintrc @@ -88,7 +88,6 @@ Source131: rebootmgr.fc Patch001: fix_djbdns.patch Patch002: fix_dbus.patch Patch004: fix_java.patch -Patch005: fix_hadoop.patch Patch006: fix_thunderbird.patch Patch007: fix_postfix.patch Patch008: fix_nscd.patch