pool/selinux-policy
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 1061575 from home:jsegitz:branches:security:SELinux

Browse Source 
- Update to version 20230125. Refreshed:
  * distro_suse_to_distro_redhat.patch
  * fix_dnsmasq.patch
  * fix_init.patch
  * fix_ipsec.patch
  * fix_kernel_sysctl.patch
  * fix_logging.patch
  * fix_rpm.patch
  * fix_selinuxutil.patch
  * fix_systemd_watch.patch
  * fix_userdomain.patch
- More flexible lib(exec) matching in fix_fwupd.patch
- Removed sys_admin for systemd_gpt_generator_t in fix_systemd.patch
- Dropped fix_container.patch, is now upstream
- Added fix_entropyd.patch
  * Added new interface entropyd_semaphore_filetrans to properly transfer
    semaphore created during early boot. That doesn't work yet, so work
    around with next item
  * Allow reading tempfs files
- Added fix_kernel.patch. Added modutils_execute_kmod_tmpfs_files interace
  to allow kmod_tmpfs_t files to be executed. Necessary for firewalld
- Added fix_rtkit.patch to fix labeling of binary
- Modified fix_ntp.patch:
  * Proper labeling for start-ntpd
  * Fixed label rules for chroot path
  * Temporarily allow dac_override for ntpd_t (bsc#1207577)
  * Add interface ntp_manage_pid_files to allow management of pid
    files
- Updated fix_networkmanager.patch to allow managing ntp pid files

OBS-URL: https://build.opensuse.org/request/show/1061575
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=171
This commit is contained in:
Johannes Segitz 2023-01-27 14:51:33 +00:00 committed by Git OBS Bridge
parent 5b345f822c
commit c4556003bf
22 changed files with 391 additions and 172 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

90
distro_suse_to_distro_redhat.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20221019/policy/modules/contrib/apache.fc
Index: fedora-policy-20230116/policy/modules/contrib/apache.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/apache.fc
+++ fedora-policy-20221019/policy/modules/contrib/apache.fc
--- fedora-policy-20230116.orig/policy/modules/contrib/apache.fc
+++ fedora-policy-20230116/policy/modules/contrib/apache.fc
@@ -74,7 +74,7 @@ HOME_DIR/((www)|(web)|(public_html))(/.*
/usr/sbin/suexec -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0)
/usr/sbin/thttpd -- gen_context(system_u:object_r:httpd_exec_t,s0)
@ -11,10 +11,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/apache.fc
/usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0)
')
Index: fedora-policy-20221019/policy/modules/contrib/cron.fc
Index: fedora-policy-20230116/policy/modules/contrib/cron.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/cron.fc
+++ fedora-policy-20221019/policy/modules/contrib/cron.fc
--- fedora-policy-20230116.orig/policy/modules/contrib/cron.fc
+++ fedora-policy-20230116/policy/modules/contrib/cron.fc
@@ -51,7 +51,7 @@ ifdef(`distro_gentoo',`
/var/spool/cron/lastrun/[^/]* -- <<none>>
')
@ -33,11 +33,11 @@ Index: fedora-policy-20221019/policy/modules/contrib/cron.fc
/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
/var/spool/cron/lastrun/[^/]* -- <<none>>
/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc
Index: fedora-policy-20230116/policy/modules/contrib/rpm.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/rpm.fc
+++ fedora-policy-20221019/policy/modules/contrib/rpm.fc
@@ -80,7 +80,7 @@ ifdef(`distro_redhat', `
--- fedora-policy-20230116.orig/policy/modules/contrib/rpm.fc
+++ fedora-policy-20230116/policy/modules/contrib/rpm.fc
@@ -82,7 +82,7 @@ ifdef(`distro_redhat', `
/var/run/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_run_t,s0)
# SuSE
@ -46,10 +46,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc
/usr/bin/online_update -- gen_context(system_u:object_r:rpm_exec_t,s0)
/sbin/yast2 -- gen_context(system_u:object_r:rpm_exec_t,s0)
/var/lib/YaST2(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
Index: fedora-policy-20221019/policy/modules/kernel/corecommands.fc
Index: fedora-policy-20230116/policy/modules/kernel/corecommands.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/kernel/corecommands.fc
+++ fedora-policy-20221019/policy/modules/kernel/corecommands.fc
--- fedora-policy-20230116.orig/policy/modules/kernel/corecommands.fc
+++ fedora-policy-20230116/policy/modules/kernel/corecommands.fc
@@ -462,7 +462,7 @@ ifdef(`distro_redhat', `
/usr/share/texmf/texconfig/tcfmgr -- gen_context(system_u:object_r:bin_t,s0)
')
@ -68,10 +68,10 @@ Index: fedora-policy-20221019/policy/modules/kernel/corecommands.fc
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
')
Index: fedora-policy-20221019/policy/modules/kernel/devices.fc
Index: fedora-policy-20230116/policy/modules/kernel/devices.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/kernel/devices.fc
+++ fedora-policy-20221019/policy/modules/kernel/devices.fc
--- fedora-policy-20230116.orig/policy/modules/kernel/devices.fc
+++ fedora-policy-20230116/policy/modules/kernel/devices.fc
@@ -148,7 +148,7 @@
/dev/usb.+ -c gen_context(system_u:object_r:usb_device_t,s0)
/dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0)
@ -81,10 +81,10 @@ Index: fedora-policy-20221019/policy/modules/kernel/devices.fc
/dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0)
')
/dev/vmci -c gen_context(system_u:object_r:vmci_device_t,s0)
Index: fedora-policy-20221019/policy/modules/kernel/files.fc
Index: fedora-policy-20230116/policy/modules/kernel/files.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20221019/policy/modules/kernel/files.fc
--- fedora-policy-20230116.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20230116/policy/modules/kernel/files.fc
@@ -22,7 +22,7 @@ ifdef(`distro_redhat',`
/[^/]+ -- gen_context(system_u:object_r:etc_runtime_t,s0)
')
@ -103,10 +103,10 @@ Index: fedora-policy-20221019/policy/modules/kernel/files.fc
/etc/defkeymap\.map -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/rc\.d/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
')
Index: fedora-policy-20221019/policy/modules/services/xserver.fc
Index: fedora-policy-20230116/policy/modules/services/xserver.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/services/xserver.fc
+++ fedora-policy-20221019/policy/modules/services/xserver.fc
--- fedora-policy-20230116.orig/policy/modules/services/xserver.fc
+++ fedora-policy-20230116/policy/modules/services/xserver.fc
@@ -189,7 +189,7 @@ ifndef(`distro_debian',`
/var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0)
/var/run/systemd/multi-session-x(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
@ -116,10 +116,10 @@ Index: fedora-policy-20221019/policy/modules/services/xserver.fc
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
')
Index: fedora-policy-20221019/policy/modules/system/authlogin.fc
Index: fedora-policy-20230116/policy/modules/system/authlogin.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/authlogin.fc
+++ fedora-policy-20221019/policy/modules/system/authlogin.fc
--- fedora-policy-20230116.orig/policy/modules/system/authlogin.fc
+++ fedora-policy-20230116/policy/modules/system/authlogin.fc
@@ -31,7 +31,7 @@ HOME_DIR/\.google_authenticator~ gen_co
/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
@ -129,10 +129,10 @@ Index: fedora-policy-20221019/policy/modules/system/authlogin.fc
/sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
')
Index: fedora-policy-20221019/policy/modules/system/init.fc
Index: fedora-policy-20230116/policy/modules/system/init.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/init.fc
+++ fedora-policy-20221019/policy/modules/system/init.fc
--- fedora-policy-20230116.orig/policy/modules/system/init.fc
+++ fedora-policy-20230116/policy/modules/system/init.fc
@@ -92,7 +92,7 @@ ifdef(`distro_gentoo', `
/var/run/svscan\.pid -- gen_context(system_u:object_r:initrc_var_run_t,s0)
')
@ -142,11 +142,11 @@ Index: fedora-policy-20221019/policy/modules/system/init.fc
/var/run/bootsplashctl -p gen_context(system_u:object_r:initrc_var_run_t,s0)
/var/run/keymap -- gen_context(system_u:object_r:initrc_var_run_t,s0)
/var/run/numlock-on -- gen_context(system_u:object_r:initrc_var_run_t,s0)
Index: fedora-policy-20221019/policy/modules/system/init.te
Index: fedora-policy-20230116/policy/modules/system/init.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/init.te
+++ fedora-policy-20221019/policy/modules/system/init.te
@@ -1334,7 +1334,7 @@ ifdef(`distro_redhat',`
--- fedora-policy-20230116.orig/policy/modules/system/init.te
+++ fedora-policy-20230116/policy/modules/system/init.te
@@ -1330,7 +1330,7 @@ ifdef(`distro_redhat',`
')
')
@ -155,10 +155,10 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
optional_policy(`
# set permissions on /tmp/.X11-unix
xserver_setattr_xdm_tmp_dirs(initrc_t)
Index: fedora-policy-20221019/policy/modules/system/libraries.fc
Index: fedora-policy-20230116/policy/modules/system/libraries.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/libraries.fc
+++ fedora-policy-20221019/policy/modules/system/libraries.fc
--- fedora-policy-20230116.orig/policy/modules/system/libraries.fc
+++ fedora-policy-20230116/policy/modules/system/libraries.fc
@@ -329,7 +329,7 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_
/var/lib/spamassassin/compiled/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
/usr/lib/xfce4/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
@ -168,10 +168,10 @@ Index: fedora-policy-20221019/policy/modules/system/libraries.fc
/var/lib/samba/bin/.+\.so(\.[^/]*)* -l gen_context(system_u:object_r:lib_t,s0)
')
Index: fedora-policy-20221019/policy/modules/system/locallogin.te
Index: fedora-policy-20230116/policy/modules/system/locallogin.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/locallogin.te
+++ fedora-policy-20221019/policy/modules/system/locallogin.te
--- fedora-policy-20230116.orig/policy/modules/system/locallogin.te
+++ fedora-policy-20230116/policy/modules/system/locallogin.te
@@ -274,7 +274,7 @@ ifdef(`enable_mls',`
')
@ -181,10 +181,10 @@ Index: fedora-policy-20221019/policy/modules/system/locallogin.te
ifdef(`distro_debian', `define(`sulogin_no_pam')')
allow sulogin_t self:capability sys_tty_config;
Index: fedora-policy-20221019/policy/modules/system/logging.fc
Index: fedora-policy-20230116/policy/modules/system/logging.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/logging.fc
+++ fedora-policy-20221019/policy/modules/system/logging.fc
--- fedora-policy-20230116.orig/policy/modules/system/logging.fc
+++ fedora-policy-20230116/policy/modules/system/logging.fc
@@ -46,7 +46,7 @@
/var/lib/r?syslog(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,mls_systemhigh)
/var/lib/syslog-ng.persist -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
@ -194,11 +194,11 @@ Index: fedora-policy-20221019/policy/modules/system/logging.fc
/var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
')
Index: fedora-policy-20221019/policy/modules/system/logging.te
Index: fedora-policy-20230116/policy/modules/system/logging.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/logging.te
+++ fedora-policy-20221019/policy/modules/system/logging.te
@@ -682,7 +682,7 @@ ifdef(`distro_gentoo',`
--- fedora-policy-20230116.orig/policy/modules/system/logging.te
+++ fedora-policy-20230116/policy/modules/system/logging.te
@@ -685,7 +685,7 @@ ifdef(`distro_gentoo',`
term_dontaudit_setattr_unallocated_ttys(syslogd_t)
')

3
fedora-policy-20221019.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:e2cfe78d728e0b94dfbdc81413f6ede0a0f0e6064de4f6628fa7328d1f4d2ede
size 733130

3
fedora-policy-20230125.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:4653c59f1e4df7872bf6f0186e1d75819b2b0580e750cad1b32bcb8ae71146ee
size 736028

13
fix_container.patch
View File

@ -1,13 +0,0 @@
Index: fedora-policy-20221019/policy/modules/services/container.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/services/container.te
+++ fedora-policy-20221019/policy/modules/services/container.te
@@ -681,6 +681,8 @@ init_dbus_chat(spc_t)
optional_policy(`
systemd_dbus_chat_machined(spc_t)
systemd_dbus_chat_logind(spc_t)
+ systemd_dbus_chat_timedated(spc_t)
+ systemd_dbus_chat_localed(spc_t)
')
optional_policy(`

8
fix_dnsmasq.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20220519/policy/modules/contrib/dnsmasq.te
Index: fedora-policy-20230116/policy/modules/contrib/dnsmasq.te
===================================================================
--- fedora-policy-20220519.orig/policy/modules/contrib/dnsmasq.te
+++ fedora-policy-20220519/policy/modules/contrib/dnsmasq.te
@@ -115,6 +115,7 @@ libs_exec_ldconfig(dnsmasq_t)
--- fedora-policy-20230116.orig/policy/modules/contrib/dnsmasq.te
+++ fedora-policy-20230116/policy/modules/contrib/dnsmasq.te
@@ -116,6 +116,7 @@ libs_exec_ldconfig(dnsmasq_t)
logging_send_syslog_msg(dnsmasq_t)
miscfiles_read_public_files(dnsmasq_t)

76
fix_entropyd.patch Normal file
View File

@ -0,0 +1,76 @@
Index: fedora-policy-20230125/policy/modules/contrib/entropyd.te
===================================================================
--- fedora-policy-20230125.orig/policy/modules/contrib/entropyd.te
+++ fedora-policy-20230125/policy/modules/contrib/entropyd.te
@@ -24,6 +24,9 @@ init_script_file(entropyd_initrc_exec_t)
type entropyd_var_run_t;
files_pid_file(entropyd_var_run_t)
+type entropyd_tmpfs_t;
+files_tmpfs_file(entropyd_tmpfs_t)
+
########################################
#
# Local policy
@@ -36,6 +39,10 @@ allow entropyd_t self:process signal_per
manage_files_pattern(entropyd_t, entropyd_var_run_t, entropyd_var_run_t)
files_pid_filetrans(entropyd_t, entropyd_var_run_t, file)
+manage_dirs_pattern(entropyd_t, entropyd_tmpfs_t, entropyd_tmpfs_t)
+manage_files_pattern(entropyd_t, entropyd_tmpfs_t, entropyd_tmpfs_t)
+fs_tmpfs_filetrans(entropyd_t, entropyd_tmpfs_t, { file })
+
kernel_read_system_state(entropyd_t)
kernel_rw_kernel_sysctl(entropyd_t)
@@ -47,6 +54,8 @@ dev_write_rand(entropyd_t)
fs_getattr_all_fs(entropyd_t)
fs_search_auto_mountpoints(entropyd_t)
+# not great, but necessary for now since I can't get sem.haveged_sem to have a proper label
+fs_rw_tmpfs_files(entropyd_t)
domain_use_interactive_fds(entropyd_t)
Index: fedora-policy-20230125/policy/modules/contrib/entropyd.if
===================================================================
--- fedora-policy-20230125.orig/policy/modules/contrib/entropyd.if
+++ fedora-policy-20230125/policy/modules/contrib/entropyd.if
@@ -33,3 +33,22 @@ interface(`entropyd_admin',`
files_search_pids($1)
admin_pattern($1, entropyd_var_run_t)
')
+
+########################################
+## <summary>
+## Transition kernel created semaphore to correct type
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`entropyd_semaphore_filetrans',`
+ gen_require(`
+ type entropyd_tmpfs_t;
+ ')
+
+ fs_tmpfs_filetrans($1, entropyd_tmpfs_t, file, "sem.haveged_sem")
+')
Index: fedora-policy-20230125/policy/modules/kernel/kernel.te
===================================================================
--- fedora-policy-20230125.orig/policy/modules/kernel/kernel.te
+++ fedora-policy-20230125/policy/modules/kernel/kernel.te
@@ -397,6 +397,10 @@ optional_policy(`
')
optional_policy(`
+ entropyd_semaphore_filetrans(kernel_t)
+')
+
+optional_policy(`
abrt_filetrans_named_content(kernel_t)
abrt_dump_oops_domtrans(kernel_t)
')

17
fix_fwupd.patch
View File

@ -1,12 +1,17 @@
Index: fedora-policy/policy/modules/contrib/fwupd.fc
Index: fedora-policy-20230116/policy/modules/contrib/fwupd.fc
===================================================================
--- fedora-policy.orig/policy/modules/contrib/fwupd.fc
+++ fedora-policy/policy/modules/contrib/fwupd.fc
@@ -4,6 +4,7 @@
--- fedora-policy-20230116.orig/policy/modules/contrib/fwupd.fc
+++ fedora-policy-20230116/policy/modules/contrib/fwupd.fc
@@ -2,9 +2,9 @@
/etc/pki/(fwupd|fwupd-metadata)(/.*)? gen_context(system_u:object_r:fwupd_cert_t,s0)
/usr/libexec/fwupd/fwupd -- gen_context(system_u:object_r:fwupd_exec_t,s0)
+/usr/lib/fwupd/fwupd -- gen_context(system_u:object_r:fwupd_exec_t,s0)
-/usr/libexec/fwupd/fwupd -- gen_context(system_u:object_r:fwupd_exec_t,s0)
-/usr/libexec/fwupd/fwupdoffline -- gen_context(system_u:object_r:fwupd_exec_t,s0)
-/usr/libexec/fwupd/fwupd-detect-cet -- gen_context(system_u:object_r:fwupd_exec_t,s0)
+/usr/lib(exec)?/fwupd/fwupd -- gen_context(system_u:object_r:fwupd_exec_t,s0)
+/usr/lib(exec)?/fwupd/fwupdoffline -- gen_context(system_u:object_r:fwupd_exec_t,s0)
+/usr/lib(exec)?/fwupd/fwupd-detect-cet -- gen_context(system_u:object_r:fwupd_exec_t,s0)
/var/cache/app-info(/.*)? gen_context(system_u:object_r:fwupd_cache_t,s0)
/var/cache/fwupd(/.*)? gen_context(system_u:object_r:fwupd_cache_t,s0)

22
fix_init.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20221019/policy/modules/system/init.te
Index: fedora-policy-20230116/policy/modules/system/init.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/init.te
+++ fedora-policy-20221019/policy/modules/system/init.te
@@ -269,6 +269,8 @@ corecmd_exec_bin(init_t)
--- fedora-policy-20230116.orig/policy/modules/system/init.te
+++ fedora-policy-20230116/policy/modules/system/init.te
@@ -270,6 +270,8 @@ corecmd_exec_bin(init_t)
corenet_all_recvfrom_netlabel(init_t)
corenet_tcp_bind_all_ports(init_t)
corenet_udp_bind_all_ports(init_t)
@ -11,7 +11,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
dev_create_all_files(init_t)
dev_create_all_chr_files(init_t)
@@ -398,6 +400,7 @@ logging_manage_audit_config(init_t)
@@ -396,6 +398,7 @@ logging_manage_audit_config(init_t)
logging_create_syslog_netlink_audit_socket(init_t)
logging_write_var_log_dirs(init_t)
logging_manage_var_log_symlinks(init_t)
@ -19,7 +19,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
seutil_read_config(init_t)
seutil_read_login_config(init_t)
@@ -450,9 +453,19 @@ ifdef(`distro_redhat',`
@@ -448,9 +451,19 @@ ifdef(`distro_redhat',`
corecmd_shell_domtrans(init_t, initrc_t)
storage_raw_rw_fixed_disk(init_t)
@ -39,7 +39,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
optional_policy(`
anaconda_stream_connect(init_t)
anaconda_create_unix_stream_sockets(init_t)
@@ -584,10 +597,10 @@ tunable_policy(`init_audit_control',`
@@ -582,10 +595,10 @@ tunable_policy(`init_audit_control',`
allow init_t self:system all_system_perms;
allow init_t self:system module_load;
allow init_t self:unix_dgram_socket { create_socket_perms sendto };
@ -52,7 +52,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
allow init_t self:netlink_selinux_socket create_socket_perms;
allow init_t self:unix_dgram_socket lock;
# Until systemd is fixed
@@ -647,6 +660,7 @@ files_delete_all_spool_sockets(init_t)
@@ -645,6 +658,7 @@ files_delete_all_spool_sockets(init_t)
files_create_var_lib_dirs(init_t)
files_create_var_lib_symlinks(init_t)
files_read_var_lib_symlinks(init_t)
@ -60,7 +60,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
files_manage_urandom_seed(init_t)
files_list_locks(init_t)
files_list_spool(init_t)
@@ -684,7 +698,7 @@ fs_list_all(init_t)
@@ -682,7 +696,7 @@ fs_list_all(init_t)
fs_list_auto_mountpoints(init_t)
fs_register_binary_executable_type(init_t)
fs_relabel_tmpfs_sock_file(init_t)
@ -69,7 +69,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
fs_relabel_cgroup_dirs(init_t)
fs_search_cgroup_dirs(init_t)
# for network namespaces
@@ -740,6 +754,7 @@ systemd_write_inherited_logind_sessions_
@@ -738,6 +752,7 @@ systemd_write_inherited_logind_sessions_
create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
create_dirs_pattern(init_t, var_log_t, var_log_t)
@ -77,7 +77,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te
auth_use_nsswitch(init_t)
auth_rw_login_records(init_t)
@@ -1596,6 +1611,8 @@ optional_policy(`
@@ -1592,6 +1607,8 @@ optional_policy(`
optional_policy(`
postfix_list_spool(initrc_t)

10
fix_ipsec.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20221019/policy/modules/system/ipsec.te
Index: fedora-policy-20230116/policy/modules/system/ipsec.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/ipsec.te
+++ fedora-policy-20221019/policy/modules/system/ipsec.te
@@ -87,6 +87,7 @@ allow ipsec_t self:tcp_socket create_str
--- fedora-policy-20230116.orig/policy/modules/system/ipsec.te
+++ fedora-policy-20230116/policy/modules/system/ipsec.te
@@ -88,6 +88,7 @@ allow ipsec_t self:tcp_socket create_str
allow ipsec_t self:udp_socket create_socket_perms;
allow ipsec_t self:packet_socket create_socket_perms;
allow ipsec_t self:key_socket create_socket_perms;
@ -10,7 +10,7 @@ Index: fedora-policy-20221019/policy/modules/system/ipsec.te
allow ipsec_t self:fifo_file read_fifo_file_perms;
allow ipsec_t self:netlink_xfrm_socket { create_netlink_socket_perms nlmsg_write };
allow ipsec_t self:netlink_selinux_socket create_socket_perms;
@@ -269,6 +270,7 @@ allow ipsec_mgmt_t self:unix_stream_sock
@@ -270,6 +271,7 @@ allow ipsec_mgmt_t self:unix_stream_sock
allow ipsec_mgmt_t self:tcp_socket create_stream_socket_perms;
allow ipsec_mgmt_t self:udp_socket create_socket_perms;
allow ipsec_mgmt_t self:key_socket create_socket_perms;

52
fix_kernel.patch Normal file
View File

@ -0,0 +1,52 @@
Index: fedora-policy-20230125/policy/modules/kernel/kernel.te
===================================================================
--- fedora-policy-20230125.orig/policy/modules/kernel/kernel.te
+++ fedora-policy-20230125/policy/modules/kernel/kernel.te
@@ -389,6 +389,13 @@ ifdef(`distro_redhat',`
fs_rw_tmpfs_chr_files(kernel_t)
')
+# this is a temporary fix. This permission doesn't make a lot of sense, but
+# without a kernel change there's not much we can do about it. I don't want to
+# audit it due to the unknown impact (happens e.g. during firewall changes)
+optional_policy(`
+ modutils_execute_kmod_tmpfs_files(kernel_t)
+')
+
optional_policy(`
abrt_filetrans_named_content(kernel_t)
abrt_dump_oops_domtrans(kernel_t)
@@ -410,6 +417,7 @@ optional_policy(`
init_dbus_chat(kernel_t)
init_sigchld(kernel_t)
init_dyntrans(kernel_t)
+ init_read_state(kernel_t)
')
optional_policy(`
Index: fedora-policy-20230125/policy/modules/system/modutils.if
===================================================================
--- fedora-policy-20230125.orig/policy/modules/system/modutils.if
+++ fedora-policy-20230125/policy/modules/system/modutils.if
@@ -525,3 +525,21 @@ interface(`modutils_dontaudit_kmod_tmpfs
dontaudit $1 kmod_tmpfs_t:file { getattr };
')
+
+#######################################
+## <summary>
+## Execute accesses to tmp file type.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`modutils_execute_kmod_tmpfs_files',`
+ gen_require(`
+ type kmod_tmpfs_t;
+ ')
+
+ allow $1 kmod_tmpfs_t:file { execute execute_no_trans };
+')

14
fix_kernel_sysctl.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20221019/policy/modules/kernel/files.fc
Index: fedora-policy-20230116/policy/modules/kernel/files.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20221019/policy/modules/kernel/files.fc
--- fedora-policy-20230116.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20230116/policy/modules/kernel/files.fc
@@ -242,6 +242,8 @@ ifdef(`distro_redhat',`
/usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0)
/usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0)
@ -11,11 +11,11 @@ Index: fedora-policy-20221019/policy/modules/kernel/files.fc
/usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
Index: fedora-policy-20221019/policy/modules/system/systemd.te
Index: fedora-policy-20230116/policy/modules/system/systemd.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/systemd.te
+++ fedora-policy-20221019/policy/modules/system/systemd.te
@@ -1105,6 +1105,8 @@ init_stream_connect(systemd_sysctl_t)
--- fedora-policy-20230116.orig/policy/modules/system/systemd.te
+++ fedora-policy-20230116/policy/modules/system/systemd.te
@@ -1113,6 +1113,8 @@ init_stream_connect(systemd_sysctl_t)
logging_send_syslog_msg(systemd_sysctl_t)
systemd_read_efivarfs(systemd_sysctl_t)

14
fix_logging.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20220624/policy/modules/system/logging.fc
Index: fedora-policy-20230116/policy/modules/system/logging.fc
===================================================================
--- fedora-policy-20220624.orig/policy/modules/system/logging.fc
+++ fedora-policy-20220624/policy/modules/system/logging.fc
--- fedora-policy-20230116.orig/policy/modules/system/logging.fc
+++ fedora-policy-20230116/policy/modules/system/logging.fc
@@ -3,6 +3,8 @@
/etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
@ -19,11 +19,11 @@ Index: fedora-policy-20220624/policy/modules/system/logging.fc
/var/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
/var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh)
Index: fedora-policy-20220624/policy/modules/system/logging.if
Index: fedora-policy-20230116/policy/modules/system/logging.if
===================================================================
--- fedora-policy-20220624.orig/policy/modules/system/logging.if
+++ fedora-policy-20220624/policy/modules/system/logging.if
@@ -1788,3 +1788,22 @@ interface(`logging_dgram_send',`
--- fedora-policy-20230116.orig/policy/modules/system/logging.if
+++ fedora-policy-20230116/policy/modules/system/logging.if
@@ -1806,3 +1806,22 @@ interface(`logging_dgram_send',`
allow $1 syslogd_t:unix_dgram_socket sendto;
')

36
fix_networkmanager.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
Index: fedora-policy-20230125/policy/modules/contrib/networkmanager.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.te
+++ fedora-policy-20221019/policy/modules/contrib/networkmanager.te
@@ -259,6 +259,7 @@ sysnet_search_dhcp_state(NetworkManager_
--- fedora-policy-20230125.orig/policy/modules/contrib/networkmanager.te
+++ fedora-policy-20230125/policy/modules/contrib/networkmanager.te
@@ -260,6 +260,7 @@ sysnet_search_dhcp_state(NetworkManager_
sysnet_manage_config(NetworkManager_t)
sysnet_filetrans_named_content(NetworkManager_t)
sysnet_filetrans_net_conf(NetworkManager_t)
@ -10,7 +10,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
systemd_login_watch_pid_dirs(NetworkManager_t)
systemd_login_watch_session_dirs(NetworkManager_t)
@@ -275,6 +276,9 @@ userdom_read_home_certs(NetworkManager_t
@@ -276,6 +277,9 @@ userdom_read_home_certs(NetworkManager_t
userdom_read_user_home_content_files(NetworkManager_t)
userdom_dgram_send(NetworkManager_t)
@ -20,10 +20,14 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(NetworkManager_t)
')
@@ -284,6 +288,10 @@ tunable_policy(`use_samba_home_dirs',`
@@ -285,6 +289,14 @@ tunable_policy(`use_samba_home_dirs',`
')
optional_policy(`
+ ntp_manage_pid_files(NetworkManager_t)
+')
+
+optional_policy(`
+ nis_systemctl_ypbind(NetworkManager_t)
+')
+
@ -31,7 +35,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
avahi_domtrans(NetworkManager_t)
avahi_kill(NetworkManager_t)
avahi_signal(NetworkManager_t)
@@ -292,6 +300,14 @@ optional_policy(`
@@ -293,6 +305,14 @@ optional_policy(`
')
optional_policy(`
@ -46,7 +50,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
bind_domtrans(NetworkManager_t)
bind_manage_cache(NetworkManager_t)
bind_kill(NetworkManager_t)
@@ -419,6 +435,8 @@ optional_policy(`
@@ -420,6 +440,8 @@ optional_policy(`
nscd_kill(NetworkManager_t)
nscd_initrc_domtrans(NetworkManager_t)
nscd_systemctl(NetworkManager_t)
@ -55,7 +59,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
')
optional_policy(`
@@ -606,6 +624,7 @@ files_manage_etc_files(NetworkManager_di
@@ -607,6 +629,7 @@ files_manage_etc_files(NetworkManager_di
init_status(NetworkManager_dispatcher_cloud_t)
init_status(NetworkManager_dispatcher_ddclient_t)
@ -63,7 +67,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
init_append_stream_sockets(networkmanager_dispatcher_plugin)
init_ioctl_stream_sockets(networkmanager_dispatcher_plugin)
init_stream_connect(networkmanager_dispatcher_plugin)
@@ -621,6 +640,10 @@ optional_policy(`
@@ -622,6 +645,10 @@ optional_policy(`
')
optional_policy(`
@ -74,10 +78,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te
cloudform_init_domtrans(NetworkManager_dispatcher_cloud_t)
')
Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.if
Index: fedora-policy-20230125/policy/modules/contrib/networkmanager.if
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.if
+++ fedora-policy-20221019/policy/modules/contrib/networkmanager.if
--- fedora-policy-20230125.orig/policy/modules/contrib/networkmanager.if
+++ fedora-policy-20230125/policy/modules/contrib/networkmanager.if
@@ -132,6 +132,24 @@ interface(`networkmanager_initrc_domtran
init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t)
')
@ -103,10 +107,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.if
########################################
## <summary>
## Execute NetworkManager server in the NetworkManager domain.
Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.fc
Index: fedora-policy-20230125/policy/modules/contrib/networkmanager.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.fc
+++ fedora-policy-20221019/policy/modules/contrib/networkmanager.fc
--- fedora-policy-20230125.orig/policy/modules/contrib/networkmanager.fc
+++ fedora-policy-20230125/policy/modules/contrib/networkmanager.fc
@@ -24,6 +24,7 @@
/usr/lib/NetworkManager/dispatcher\.d/04-iscsi -- gen_context(system_u:object_r:NetworkManager_dispatcher_iscsid_script_t,s0)
/usr/lib/NetworkManager/dispatcher\.d/10-sendmail -- gen_context(system_u:object_r:NetworkManager_dispatcher_sendmail_script_t,s0)

78
fix_ntp.patch
View File

@ -1,8 +1,16 @@
Index: fedora-policy/policy/modules/contrib/ntp.fc
Index: fedora-policy-20230125/policy/modules/contrib/ntp.fc
===================================================================
--- fedora-policy.orig/policy/modules/contrib/ntp.fc 2020-02-21 15:59:23.349556504 +0000
+++ fedora-policy/policy/modules/contrib/ntp.fc 2020-02-21 16:01:41.591761350 +0000
@@ -16,7 +16,6 @@
--- fedora-policy-20230125.orig/policy/modules/contrib/ntp.fc
+++ fedora-policy-20230125/policy/modules/contrib/ntp.fc
@@ -9,6 +9,7 @@
/etc/rc\.d/init\.d/ntpd -- gen_context(system_u:object_r:ntpd_initrc_exec_t,s0)
+/usr/sbin/start-ntpd -- gen_context(system_u:object_r:ntpd_exec_t,s0)
/usr/sbin/ntpd -- gen_context(system_u:object_r:ntpd_exec_t,s0)
/usr/sbin/ntpdate -- gen_context(system_u:object_r:ntpdate_exec_t,s0)
/usr/libexec/ntpdate-wrapper -- gen_context(system_u:object_r:ntpdate_exec_t,s0)
@@ -16,7 +17,6 @@
/usr/lib/systemd/system/ntpd.* -- gen_context(system_u:object_r:ntpd_unit_file_t,s0)
@ -10,7 +18,7 @@ Index: fedora-policy/policy/modules/contrib/ntp.fc
/var/lib/sntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
/var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
@@ -25,3 +24,26 @@
@@ -25,3 +25,26 @@
/var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0)
/var/run/ntpd\.pid -- gen_context(system_u:object_r:ntpd_var_run_t,s0)
@ -25,9 +33,10 @@ Index: fedora-policy/policy/modules/contrib/ntp.fc
+/var/lib/ntp/etc/ntp/keys -- gen_context(system_u:object_r:ntpd_key_t,s0)
+/var/lib/ntp/etc/ntp/step-tickers.* -- gen_context(system_u:object_r:ntp_conf_t,s0)
+/var/lib/ntp/etc/ntp.conf.iburst -- gen_context(system_u:object_r:ntp_conf_t,s0)
+/var/lib/ntp/var gen_context(system_u:object_r:var_t,s0)
+/var/lib/ntp/var/lib gen_context(system_u:object_r:var_lib_t,s0)
+/var/lib/ntp/var/run gen_context(system_u:object_r:var_run_t,s0)
+/var/lib/ntp/var(/.*)? gen_context(system_u:object_r:var_t,s0)
+/var/lib/ntp/var/lib(/.*)? gen_context(system_u:object_r:var_lib_t,s0)
+/var/lib/ntp/var/run(/.*)? gen_context(system_u:object_r:var_run_t,s0)
+/var/lib/ntp/var/run/ntp(/.*)? gen_context(system_u:object_r:ntpd_var_run_t,s0)
+/var/lib/ntp/var/lib/ntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
+/var/lib/ntp/var/lib/sntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
+/var/lib/ntp/var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
@ -36,4 +45,55 @@ Index: fedora-policy/policy/modules/contrib/ntp.fc
+/var/lib/ntp/var/log/ntp.* -- gen_context(system_u:object_r:ntpd_log_t,s0)
+/var/lib/ntp/var/log/ntpstats(/.*)? gen_context(system_u:object_r:ntpd_log_t,s0)
+/var/lib/ntp/var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0)
+/var/lib/ntp/var/run/ntpd\.pid -- gen_context(system_u:object_r:ntpd_var_run_t,s0)
Index: fedora-policy-20230125/policy/modules/contrib/ntp.te
===================================================================
--- fedora-policy-20230125.orig/policy/modules/contrib/ntp.te
+++ fedora-policy-20230125/policy/modules/contrib/ntp.te
@@ -49,6 +49,9 @@ init_system_domain(ntpd_t, ntpdate_exec_
allow ntpd_t self:capability { chown dac_read_search kill setgid setuid sys_time ipc_lock ipc_owner sys_chroot sys_nice sys_resource };
dontaudit ntpd_t self:capability { net_admin sys_tty_config fsetid sys_nice };
+# remove once 1207577 is done
+allow ntpd_t self:capability dac_override;
+
allow ntpd_t self:process { signal_perms getcap setcap setsched setrlimit };
allow ntpd_t self:fifo_file rw_fifo_file_perms;
allow ntpd_t self:shm create_shm_perms;
@@ -78,7 +81,8 @@ manage_files_pattern(ntpd_t, ntpd_tmpfs_
fs_tmpfs_filetrans(ntpd_t, ntpd_tmpfs_t, { dir file })
manage_files_pattern(ntpd_t, ntpd_var_run_t, ntpd_var_run_t)
-files_pid_filetrans(ntpd_t, ntpd_var_run_t, file)
+manage_lnk_files_pattern(ntpd_t, ntpd_var_run_t, ntpd_var_run_t)
+files_pid_filetrans(ntpd_t, ntpd_var_run_t, { file dir lnk_file })
can_exec(ntpd_t, ntpd_exec_t)
can_exec(ntpd_t, ntpdate_exec_t)
Index: fedora-policy-20230125/policy/modules/contrib/ntp.if
===================================================================
--- fedora-policy-20230125.orig/policy/modules/contrib/ntp.if
+++ fedora-policy-20230125/policy/modules/contrib/ntp.if
@@ -339,3 +339,23 @@ interface(`ntp_manage_log',`
manage_lnk_files_pattern($1, ntpd_log_t, ntpd_log_t)
')
+########################################
+## <summary>
+## Create, read, write, and delete
+## ntp pid (lnk) files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ntp_manage_pid_files',`
+ gen_require(`
+ type ntpd_var_run_t;
+ ')
+
+ files_search_pids($1)
+ manage_files_pattern($1, ntpd_var_run_t, ntpd_var_run_t)
+ manage_lnk_files_pattern($1, ntpd_var_run_t, ntpd_var_run_t)
+')

27
fix_rpm.patch
View File

@ -1,19 +1,18 @@
Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc
Index: fedora-policy-20230116/policy/modules/contrib/rpm.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/rpm.fc
+++ fedora-policy-20221019/policy/modules/contrib/rpm.fc
@@ -18,6 +18,10 @@
/usr/bin/repoquery -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/bin/zif -- gen_context(system_u:object_r:rpm_exec_t,s0)
--- fedora-policy-20230116.orig/policy/modules/contrib/rpm.fc
+++ fedora-policy-20230116/policy/modules/contrib/rpm.fc
@@ -23,6 +23,9 @@
# This is in /usr, but is expected to be variable content from a policy perspective (#2042149)
/usr/lib/sysimage/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
+/usr/sbin/zypp-refresh -- gen_context(system_u:object_r:rpm_exec_t,s0)
+/usr/bin/zypper -- gen_context(system_u:object_r:rpm_exec_t,s0)
+
+
/usr/libexec/packagekitd -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/libexec/yumDBUSBackend.py -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/libexec/pegasus/pycmpiLMI_Software-cimprovagt -- gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -56,6 +60,8 @@ ifdef(`distro_redhat', `
@@ -61,6 +64,8 @@ ifdef(`distro_redhat', `
/var/cache/yum(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0)
/var/cache/dnf(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0)
@ -22,10 +21,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
/var/lib/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
/var/lib/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
Index: fedora-policy-20221019/policy/modules/contrib/rpm.if
Index: fedora-policy-20230116/policy/modules/contrib/rpm.if
===================================================================
--- fedora-policy-20221019.orig/policy/modules/contrib/rpm.if
+++ fedora-policy-20221019/policy/modules/contrib/rpm.if
--- fedora-policy-20230116.orig/policy/modules/contrib/rpm.if
+++ fedora-policy-20230116/policy/modules/contrib/rpm.if
@@ -515,8 +515,10 @@ interface(`rpm_named_filetrans',`
logging_log_named_filetrans($1, rpm_log_t, file, "yum.log")
logging_log_named_filetrans($1, rpm_log_t, file, "hawkey.log")
@ -37,10 +36,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/rpm.if
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "dnf")
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "yum")
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpm")
Index: fedora-policy-20221019/policy/modules/kernel/files.fc
Index: fedora-policy-20230116/policy/modules/kernel/files.fc
===================================================================
--- fedora-policy-20221019.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20221019/policy/modules/kernel/files.fc
--- fedora-policy-20230116.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20230116/policy/modules/kernel/files.fc
@@ -67,6 +67,7 @@ ifdef(`distro_redhat',`
/etc/sysconfig/ipvsadm.* -- gen_context(system_u:object_r:system_conf_t,s0)
/etc/sysconfig/system-config-firewall.* -- gen_context(system_u:object_r:system_conf_t,s0)

11
fix_rtkit.patch Normal file
View File

@ -0,0 +1,11 @@
Index: fedora-policy-20230116/policy/modules/contrib/rtkit.fc
===================================================================
--- fedora-policy-20230116.orig/policy/modules/contrib/rtkit.fc
+++ fedora-policy-20230116/policy/modules/contrib/rtkit.fc
@@ -1,5 +1,6 @@
/etc/rc\.d/init\.d/rtkit-daemon -- gen_context(system_u:object_r:rtkit_daemon_initrc_exec_t,s0)
/usr/libexec/rtkit-daemon -- gen_context(system_u:object_r:rtkit_daemon_exec_t,s0)
+/usr/libexec/rtkit/rtkit-daemon -- gen_context(system_u:object_r:rtkit_daemon_exec_t,s0)
/usr/lib/rtkit/rtkit-daemon -- gen_context(system_u:object_r:rtkit_daemon_exec_t,s0)

16
fix_selinuxutil.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20210628/policy/modules/system/selinuxutil.te
Index: fedora-policy-20230116/policy/modules/system/selinuxutil.te
===================================================================
--- fedora-policy-20210628.orig/policy/modules/system/selinuxutil.te
+++ fedora-policy-20210628/policy/modules/system/selinuxutil.te
@@ -238,6 +238,10 @@ ifdef(`hide_broken_symptoms',`
--- fedora-policy-20230116.orig/policy/modules/system/selinuxutil.te
+++ fedora-policy-20230116/policy/modules/system/selinuxutil.te
@@ -239,6 +239,10 @@ ifdef(`hide_broken_symptoms',`
')
optional_policy(`
@ -13,7 +13,7 @@ Index: fedora-policy-20210628/policy/modules/system/selinuxutil.te
portage_dontaudit_use_fds(load_policy_t)
')
@@ -618,6 +622,10 @@ logging_send_audit_msgs(setfiles_t)
@@ -619,6 +623,10 @@ logging_send_audit_msgs(setfiles_t)
logging_send_syslog_msg(setfiles_t)
optional_policy(`
@ -24,10 +24,10 @@ Index: fedora-policy-20210628/policy/modules/system/selinuxutil.te
cloudform_dontaudit_write_cloud_log(setfiles_t)
')
Index: fedora-policy-20210628/policy/modules/system/selinuxutil.if
Index: fedora-policy-20230116/policy/modules/system/selinuxutil.if
===================================================================
--- fedora-policy-20210628.orig/policy/modules/system/selinuxutil.if
+++ fedora-policy-20210628/policy/modules/system/selinuxutil.if
--- fedora-policy-20230116.orig/policy/modules/system/selinuxutil.if
+++ fedora-policy-20230116/policy/modules/system/selinuxutil.if
@@ -795,6 +795,8 @@ interface(`seutil_dontaudit_read_config'
dontaudit $1 selinux_config_t:dir search_dir_perms;

17
fix_systemd.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20221019/policy/modules/system/systemd.te
Index: fedora-policy-20230116/policy/modules/system/systemd.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/systemd.te
+++ fedora-policy-20221019/policy/modules/system/systemd.te
--- fedora-policy-20230116.orig/policy/modules/system/systemd.te
+++ fedora-policy-20230116/policy/modules/system/systemd.te
@@ -381,6 +381,10 @@ userdom_manage_user_tmp_chr_files(system
xserver_dbus_chat(systemd_logind_t)
@ -24,16 +24,7 @@ Index: fedora-policy-20221019/policy/modules/system/systemd.te
#######################################
#
# Hostnamed policy
@@ -1158,7 +1166,7 @@ systemd_read_efivarfs(systemd_hwdb_t)
# systemd_gpt_generator domain
#
-allow systemd_gpt_generator_t self:capability sys_rawio;
+allow systemd_gpt_generator_t self:capability { sys_rawio sys_admin};
allow systemd_gpt_generator_t self:netlink_kobject_uevent_socket create_socket_perms;
dev_read_sysfs(systemd_gpt_generator_t)
@@ -1185,6 +1193,8 @@ systemd_unit_file_filetrans(systemd_gpt_
@@ -1195,6 +1203,8 @@ systemd_unit_file_filetrans(systemd_gpt_
systemd_create_unit_file_dirs(systemd_gpt_generator_t)
systemd_create_unit_file_lnk(systemd_gpt_generator_t)

8
fix_systemd_watch.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20221019/policy/modules/system/systemd.te
Index: fedora-policy-20230116/policy/modules/system/systemd.te
===================================================================
--- fedora-policy-20221019.orig/policy/modules/system/systemd.te
+++ fedora-policy-20221019/policy/modules/system/systemd.te
@@ -1508,6 +1508,12 @@ fstools_rw_swap_files(systemd_sleep_t)
--- fedora-policy-20230116.orig/policy/modules/system/systemd.te
+++ fedora-policy-20230116/policy/modules/system/systemd.te
@@ -1520,6 +1520,12 @@ fstools_rw_swap_files(systemd_sleep_t)
storage_getattr_fixed_disk_dev(systemd_sleep_t)
storage_getattr_removable_dev(systemd_sleep_t)

8
fix_userdomain.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20220624/policy/modules/system/userdomain.if
Index: fedora-policy-20230116/policy/modules/system/userdomain.if
===================================================================
--- fedora-policy-20220624.orig/policy/modules/system/userdomain.if
+++ fedora-policy-20220624/policy/modules/system/userdomain.if
@@ -1497,6 +1497,7 @@ tunable_policy(`deny_bluetooth',`',`
--- fedora-policy-20230116.orig/policy/modules/system/userdomain.if
+++ fedora-policy-20230116/policy/modules/system/userdomain.if
@@ -1515,6 +1515,7 @@ tunable_policy(`deny_bluetooth',`',`
# port access is audited even if dac would not have allowed it, so dontaudit it here
# corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)

33
selinux-policy.changes
View File

@ -1,3 +1,36 @@
-------------------------------------------------------------------
Mon Jan 16 08:42:09 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
- Update to version 20230125. Refreshed:
* distro_suse_to_distro_redhat.patch
* fix_dnsmasq.patch
* fix_init.patch
* fix_ipsec.patch
* fix_kernel_sysctl.patch
* fix_logging.patch
* fix_rpm.patch
* fix_selinuxutil.patch
* fix_systemd_watch.patch
* fix_userdomain.patch
- More flexible lib(exec) matching in fix_fwupd.patch
- Removed sys_admin for systemd_gpt_generator_t in fix_systemd.patch
- Dropped fix_container.patch, is now upstream
- Added fix_entropyd.patch
* Added new interface entropyd_semaphore_filetrans to properly transfer
semaphore created during early boot. That doesn't work yet, so work
around with next item
* Allow reading tempfs files
- Added fix_kernel.patch. Added modutils_execute_kmod_tmpfs_files interace
to allow kmod_tmpfs_t files to be executed. Necessary for firewalld
- Added fix_rtkit.patch to fix labeling of binary
- Modified fix_ntp.patch:
* Proper labeling for start-ntpd
* Fixed label rules for chroot path
* Temporarily allow dac_override for ntpd_t (bsc#1207577)
* Add interface ntp_manage_pid_files to allow management of pid
files
- Updated fix_networkmanager.patch to allow managing ntp pid files
-------------------------------------------------------------------
Thu Jan 12 13:01:47 UTC 2023 - Johannes Segitz <jsegitz@suse.com>

7
selinux-policy.spec
View File

@ -33,7 +33,7 @@ Summary: SELinux policy configuration
License: GPL-2.0-or-later
Group: System/Management
Name: selinux-policy
Version: 20221019
Version: 20230125
Release: 0
Source: fedora-policy-%{version}.tar.bz2
Source1: selinux-policy-rpmlintrc
@ -148,8 +148,9 @@ Patch063: fix_alsa.patch
Patch064: dontaudit_interface_kmod_tmpfs.patch
Patch065: fix_sendmail.patch
Patch066: fix_ipsec.patch
# https://github.com/containers/container-selinux/pull/199, can be dropped once this is included
Patch067: fix_container.patch
Patch067: fix_kernel.patch
Patch068: fix_entropyd.patch
Patch069: fix_rtkit.patch
Patch100: sedoctool.patch