From c4556003bf91d790ca313ff1a2062f02bf7c00c7fa1e59d1adcd478a2e9df3de Mon Sep 17 00:00:00 2001 From: Johannes Segitz Date: Fri, 27 Jan 2023 14:51:33 +0000 Subject: [PATCH] Accepting request 1061575 from home:jsegitz:branches:security:SELinux - Update to version 20230125. Refreshed: * distro_suse_to_distro_redhat.patch * fix_dnsmasq.patch * fix_init.patch * fix_ipsec.patch * fix_kernel_sysctl.patch * fix_logging.patch * fix_rpm.patch * fix_selinuxutil.patch * fix_systemd_watch.patch * fix_userdomain.patch - More flexible lib(exec) matching in fix_fwupd.patch - Removed sys_admin for systemd_gpt_generator_t in fix_systemd.patch - Dropped fix_container.patch, is now upstream - Added fix_entropyd.patch * Added new interface entropyd_semaphore_filetrans to properly transfer semaphore created during early boot. That doesn't work yet, so work around with next item * Allow reading tempfs files - Added fix_kernel.patch. Added modutils_execute_kmod_tmpfs_files interace to allow kmod_tmpfs_t files to be executed. Necessary for firewalld - Added fix_rtkit.patch to fix labeling of binary - Modified fix_ntp.patch: * Proper labeling for start-ntpd * Fixed label rules for chroot path * Temporarily allow dac_override for ntpd_t (bsc#1207577) * Add interface ntp_manage_pid_files to allow management of pid files - Updated fix_networkmanager.patch to allow managing ntp pid files OBS-URL: https://build.opensuse.org/request/show/1061575 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=171 --- distro_suse_to_distro_redhat.patch | 90 +++++++++++++++--------------- fedora-policy-20221019.tar.bz2 | 3 - fedora-policy-20230125.tar.bz2 | 3 + fix_container.patch | 13 ----- fix_dnsmasq.patch | 8 +-- fix_entropyd.patch | 76 +++++++++++++++++++++++++ fix_fwupd.patch | 17 ++++-- fix_init.patch | 22 ++++---- fix_ipsec.patch | 10 ++-- fix_kernel.patch | 52 +++++++++++++++++ fix_kernel_sysctl.patch | 14 ++--- fix_logging.patch | 14 ++--- fix_networkmanager.patch | 36 ++++++------ fix_ntp.patch | 78 +++++++++++++++++++++++--- fix_rpm.patch | 27 +++++---- fix_rtkit.patch | 11 ++++ fix_selinuxutil.patch | 16 +++--- fix_systemd.patch | 17 ++---- fix_systemd_watch.patch | 8 +-- fix_userdomain.patch | 8 +-- selinux-policy.changes | 33 +++++++++++ selinux-policy.spec | 7 ++- 22 files changed, 391 insertions(+), 172 deletions(-) delete mode 100644 fedora-policy-20221019.tar.bz2 create mode 100644 fedora-policy-20230125.tar.bz2 delete mode 100644 fix_container.patch create mode 100644 fix_entropyd.patch create mode 100644 fix_kernel.patch create mode 100644 fix_rtkit.patch diff --git a/distro_suse_to_distro_redhat.patch b/distro_suse_to_distro_redhat.patch index c11814e..f3832d5 100644 --- a/distro_suse_to_distro_redhat.patch +++ b/distro_suse_to_distro_redhat.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20221019/policy/modules/contrib/apache.fc +Index: fedora-policy-20230116/policy/modules/contrib/apache.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/apache.fc -+++ fedora-policy-20221019/policy/modules/contrib/apache.fc +--- fedora-policy-20230116.orig/policy/modules/contrib/apache.fc ++++ fedora-policy-20230116/policy/modules/contrib/apache.fc @@ -74,7 +74,7 @@ HOME_DIR/((www)|(web)|(public_html))(/.* /usr/sbin/suexec -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0) /usr/sbin/thttpd -- gen_context(system_u:object_r:httpd_exec_t,s0) @@ -11,10 +11,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/apache.fc /usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0) ') -Index: fedora-policy-20221019/policy/modules/contrib/cron.fc +Index: fedora-policy-20230116/policy/modules/contrib/cron.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/cron.fc -+++ fedora-policy-20221019/policy/modules/contrib/cron.fc +--- fedora-policy-20230116.orig/policy/modules/contrib/cron.fc ++++ fedora-policy-20230116/policy/modules/contrib/cron.fc @@ -51,7 +51,7 @@ ifdef(`distro_gentoo',` /var/spool/cron/lastrun/[^/]* -- <> ') @@ -33,11 +33,11 @@ Index: fedora-policy-20221019/policy/modules/contrib/cron.fc /var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0) /var/spool/cron/lastrun/[^/]* -- <> /var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0) -Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc +Index: fedora-policy-20230116/policy/modules/contrib/rpm.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/rpm.fc -+++ fedora-policy-20221019/policy/modules/contrib/rpm.fc -@@ -80,7 +80,7 @@ ifdef(`distro_redhat', ` +--- fedora-policy-20230116.orig/policy/modules/contrib/rpm.fc ++++ fedora-policy-20230116/policy/modules/contrib/rpm.fc +@@ -82,7 +82,7 @@ ifdef(`distro_redhat', ` /var/run/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_run_t,s0) # SuSE @@ -46,10 +46,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc /usr/bin/online_update -- gen_context(system_u:object_r:rpm_exec_t,s0) /sbin/yast2 -- gen_context(system_u:object_r:rpm_exec_t,s0) /var/lib/YaST2(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) -Index: fedora-policy-20221019/policy/modules/kernel/corecommands.fc +Index: fedora-policy-20230116/policy/modules/kernel/corecommands.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/kernel/corecommands.fc -+++ fedora-policy-20221019/policy/modules/kernel/corecommands.fc +--- fedora-policy-20230116.orig/policy/modules/kernel/corecommands.fc ++++ fedora-policy-20230116/policy/modules/kernel/corecommands.fc @@ -462,7 +462,7 @@ ifdef(`distro_redhat', ` /usr/share/texmf/texconfig/tcfmgr -- gen_context(system_u:object_r:bin_t,s0) ') @@ -68,10 +68,10 @@ Index: fedora-policy-20221019/policy/modules/kernel/corecommands.fc /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) ') -Index: fedora-policy-20221019/policy/modules/kernel/devices.fc +Index: fedora-policy-20230116/policy/modules/kernel/devices.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/kernel/devices.fc -+++ fedora-policy-20221019/policy/modules/kernel/devices.fc +--- fedora-policy-20230116.orig/policy/modules/kernel/devices.fc ++++ fedora-policy-20230116/policy/modules/kernel/devices.fc @@ -148,7 +148,7 @@ /dev/usb.+ -c gen_context(system_u:object_r:usb_device_t,s0) /dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0) @@ -81,10 +81,10 @@ Index: fedora-policy-20221019/policy/modules/kernel/devices.fc /dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0) ') /dev/vmci -c gen_context(system_u:object_r:vmci_device_t,s0) -Index: fedora-policy-20221019/policy/modules/kernel/files.fc +Index: fedora-policy-20230116/policy/modules/kernel/files.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/kernel/files.fc -+++ fedora-policy-20221019/policy/modules/kernel/files.fc +--- fedora-policy-20230116.orig/policy/modules/kernel/files.fc ++++ fedora-policy-20230116/policy/modules/kernel/files.fc @@ -22,7 +22,7 @@ ifdef(`distro_redhat',` /[^/]+ -- gen_context(system_u:object_r:etc_runtime_t,s0) ') @@ -103,10 +103,10 @@ Index: fedora-policy-20221019/policy/modules/kernel/files.fc /etc/defkeymap\.map -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/rc\.d/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0) ') -Index: fedora-policy-20221019/policy/modules/services/xserver.fc +Index: fedora-policy-20230116/policy/modules/services/xserver.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/services/xserver.fc -+++ fedora-policy-20221019/policy/modules/services/xserver.fc +--- fedora-policy-20230116.orig/policy/modules/services/xserver.fc ++++ fedora-policy-20230116/policy/modules/services/xserver.fc @@ -189,7 +189,7 @@ ifndef(`distro_debian',` /var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0) /var/run/systemd/multi-session-x(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) @@ -116,10 +116,10 @@ Index: fedora-policy-20221019/policy/modules/services/xserver.fc /var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0) ') -Index: fedora-policy-20221019/policy/modules/system/authlogin.fc +Index: fedora-policy-20230116/policy/modules/system/authlogin.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/authlogin.fc -+++ fedora-policy-20221019/policy/modules/system/authlogin.fc +--- fedora-policy-20230116.orig/policy/modules/system/authlogin.fc ++++ fedora-policy-20230116/policy/modules/system/authlogin.fc @@ -31,7 +31,7 @@ HOME_DIR/\.google_authenticator~ gen_co /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) /sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0) @@ -129,10 +129,10 @@ Index: fedora-policy-20221019/policy/modules/system/authlogin.fc /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) ') -Index: fedora-policy-20221019/policy/modules/system/init.fc +Index: fedora-policy-20230116/policy/modules/system/init.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/init.fc -+++ fedora-policy-20221019/policy/modules/system/init.fc +--- fedora-policy-20230116.orig/policy/modules/system/init.fc ++++ fedora-policy-20230116/policy/modules/system/init.fc @@ -92,7 +92,7 @@ ifdef(`distro_gentoo', ` /var/run/svscan\.pid -- gen_context(system_u:object_r:initrc_var_run_t,s0) ') @@ -142,11 +142,11 @@ Index: fedora-policy-20221019/policy/modules/system/init.fc /var/run/bootsplashctl -p gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/keymap -- gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/numlock-on -- gen_context(system_u:object_r:initrc_var_run_t,s0) -Index: fedora-policy-20221019/policy/modules/system/init.te +Index: fedora-policy-20230116/policy/modules/system/init.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/init.te -+++ fedora-policy-20221019/policy/modules/system/init.te -@@ -1334,7 +1334,7 @@ ifdef(`distro_redhat',` +--- fedora-policy-20230116.orig/policy/modules/system/init.te ++++ fedora-policy-20230116/policy/modules/system/init.te +@@ -1330,7 +1330,7 @@ ifdef(`distro_redhat',` ') ') @@ -155,10 +155,10 @@ Index: fedora-policy-20221019/policy/modules/system/init.te optional_policy(` # set permissions on /tmp/.X11-unix xserver_setattr_xdm_tmp_dirs(initrc_t) -Index: fedora-policy-20221019/policy/modules/system/libraries.fc +Index: fedora-policy-20230116/policy/modules/system/libraries.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/libraries.fc -+++ fedora-policy-20221019/policy/modules/system/libraries.fc +--- fedora-policy-20230116.orig/policy/modules/system/libraries.fc ++++ fedora-policy-20230116/policy/modules/system/libraries.fc @@ -329,7 +329,7 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_ /var/lib/spamassassin/compiled/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0) /usr/lib/xfce4/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0) @@ -168,10 +168,10 @@ Index: fedora-policy-20221019/policy/modules/system/libraries.fc /var/lib/samba/bin/.+\.so(\.[^/]*)* -l gen_context(system_u:object_r:lib_t,s0) ') -Index: fedora-policy-20221019/policy/modules/system/locallogin.te +Index: fedora-policy-20230116/policy/modules/system/locallogin.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/locallogin.te -+++ fedora-policy-20221019/policy/modules/system/locallogin.te +--- fedora-policy-20230116.orig/policy/modules/system/locallogin.te ++++ fedora-policy-20230116/policy/modules/system/locallogin.te @@ -274,7 +274,7 @@ ifdef(`enable_mls',` ') @@ -181,10 +181,10 @@ Index: fedora-policy-20221019/policy/modules/system/locallogin.te ifdef(`distro_debian', `define(`sulogin_no_pam')') allow sulogin_t self:capability sys_tty_config; -Index: fedora-policy-20221019/policy/modules/system/logging.fc +Index: fedora-policy-20230116/policy/modules/system/logging.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/logging.fc -+++ fedora-policy-20221019/policy/modules/system/logging.fc +--- fedora-policy-20230116.orig/policy/modules/system/logging.fc ++++ fedora-policy-20230116/policy/modules/system/logging.fc @@ -46,7 +46,7 @@ /var/lib/r?syslog(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,mls_systemhigh) /var/lib/syslog-ng.persist -- gen_context(system_u:object_r:syslogd_var_lib_t,s0) @@ -194,11 +194,11 @@ Index: fedora-policy-20221019/policy/modules/system/logging.fc /var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0) ') -Index: fedora-policy-20221019/policy/modules/system/logging.te +Index: fedora-policy-20230116/policy/modules/system/logging.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/logging.te -+++ fedora-policy-20221019/policy/modules/system/logging.te -@@ -682,7 +682,7 @@ ifdef(`distro_gentoo',` +--- fedora-policy-20230116.orig/policy/modules/system/logging.te ++++ fedora-policy-20230116/policy/modules/system/logging.te +@@ -685,7 +685,7 @@ ifdef(`distro_gentoo',` term_dontaudit_setattr_unallocated_ttys(syslogd_t) ') diff --git a/fedora-policy-20221019.tar.bz2 b/fedora-policy-20221019.tar.bz2 deleted file mode 100644 index 6fb0487..0000000 --- a/fedora-policy-20221019.tar.bz2 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:e2cfe78d728e0b94dfbdc81413f6ede0a0f0e6064de4f6628fa7328d1f4d2ede -size 733130 diff --git a/fedora-policy-20230125.tar.bz2 b/fedora-policy-20230125.tar.bz2 new file mode 100644 index 0000000..9b8400e --- /dev/null +++ b/fedora-policy-20230125.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4653c59f1e4df7872bf6f0186e1d75819b2b0580e750cad1b32bcb8ae71146ee +size 736028 diff --git a/fix_container.patch b/fix_container.patch deleted file mode 100644 index f54d046..0000000 --- a/fix_container.patch +++ /dev/null @@ -1,13 +0,0 @@ -Index: fedora-policy-20221019/policy/modules/services/container.te -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/services/container.te -+++ fedora-policy-20221019/policy/modules/services/container.te -@@ -681,6 +681,8 @@ init_dbus_chat(spc_t) - optional_policy(` - systemd_dbus_chat_machined(spc_t) - systemd_dbus_chat_logind(spc_t) -+ systemd_dbus_chat_timedated(spc_t) -+ systemd_dbus_chat_localed(spc_t) - ') - - optional_policy(` diff --git a/fix_dnsmasq.patch b/fix_dnsmasq.patch index 0471529..d9f6e29 100644 --- a/fix_dnsmasq.patch +++ b/fix_dnsmasq.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20220519/policy/modules/contrib/dnsmasq.te +Index: fedora-policy-20230116/policy/modules/contrib/dnsmasq.te =================================================================== ---- fedora-policy-20220519.orig/policy/modules/contrib/dnsmasq.te -+++ fedora-policy-20220519/policy/modules/contrib/dnsmasq.te -@@ -115,6 +115,7 @@ libs_exec_ldconfig(dnsmasq_t) +--- fedora-policy-20230116.orig/policy/modules/contrib/dnsmasq.te ++++ fedora-policy-20230116/policy/modules/contrib/dnsmasq.te +@@ -116,6 +116,7 @@ libs_exec_ldconfig(dnsmasq_t) logging_send_syslog_msg(dnsmasq_t) miscfiles_read_public_files(dnsmasq_t) diff --git a/fix_entropyd.patch b/fix_entropyd.patch new file mode 100644 index 0000000..bf7cd5b --- /dev/null +++ b/fix_entropyd.patch @@ -0,0 +1,76 @@ +Index: fedora-policy-20230125/policy/modules/contrib/entropyd.te +=================================================================== +--- fedora-policy-20230125.orig/policy/modules/contrib/entropyd.te ++++ fedora-policy-20230125/policy/modules/contrib/entropyd.te +@@ -24,6 +24,9 @@ init_script_file(entropyd_initrc_exec_t) + type entropyd_var_run_t; + files_pid_file(entropyd_var_run_t) + ++type entropyd_tmpfs_t; ++files_tmpfs_file(entropyd_tmpfs_t) ++ + ######################################## + # + # Local policy +@@ -36,6 +39,10 @@ allow entropyd_t self:process signal_per + manage_files_pattern(entropyd_t, entropyd_var_run_t, entropyd_var_run_t) + files_pid_filetrans(entropyd_t, entropyd_var_run_t, file) + ++manage_dirs_pattern(entropyd_t, entropyd_tmpfs_t, entropyd_tmpfs_t) ++manage_files_pattern(entropyd_t, entropyd_tmpfs_t, entropyd_tmpfs_t) ++fs_tmpfs_filetrans(entropyd_t, entropyd_tmpfs_t, { file }) ++ + kernel_read_system_state(entropyd_t) + kernel_rw_kernel_sysctl(entropyd_t) + +@@ -47,6 +54,8 @@ dev_write_rand(entropyd_t) + + fs_getattr_all_fs(entropyd_t) + fs_search_auto_mountpoints(entropyd_t) ++# not great, but necessary for now since I can't get sem.haveged_sem to have a proper label ++fs_rw_tmpfs_files(entropyd_t) + + domain_use_interactive_fds(entropyd_t) + +Index: fedora-policy-20230125/policy/modules/contrib/entropyd.if +=================================================================== +--- fedora-policy-20230125.orig/policy/modules/contrib/entropyd.if ++++ fedora-policy-20230125/policy/modules/contrib/entropyd.if +@@ -33,3 +33,22 @@ interface(`entropyd_admin',` + files_search_pids($1) + admin_pattern($1, entropyd_var_run_t) + ') ++ ++######################################## ++## ++## Transition kernel created semaphore to correct type ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++# ++interface(`entropyd_semaphore_filetrans',` ++ gen_require(` ++ type entropyd_tmpfs_t; ++ ') ++ ++ fs_tmpfs_filetrans($1, entropyd_tmpfs_t, file, "sem.haveged_sem") ++') +Index: fedora-policy-20230125/policy/modules/kernel/kernel.te +=================================================================== +--- fedora-policy-20230125.orig/policy/modules/kernel/kernel.te ++++ fedora-policy-20230125/policy/modules/kernel/kernel.te +@@ -397,6 +397,10 @@ optional_policy(` + ') + + optional_policy(` ++ entropyd_semaphore_filetrans(kernel_t) ++') ++ ++optional_policy(` + abrt_filetrans_named_content(kernel_t) + abrt_dump_oops_domtrans(kernel_t) + ') diff --git a/fix_fwupd.patch b/fix_fwupd.patch index 30bc0ae..2c970f5 100644 --- a/fix_fwupd.patch +++ b/fix_fwupd.patch @@ -1,12 +1,17 @@ -Index: fedora-policy/policy/modules/contrib/fwupd.fc +Index: fedora-policy-20230116/policy/modules/contrib/fwupd.fc =================================================================== ---- fedora-policy.orig/policy/modules/contrib/fwupd.fc -+++ fedora-policy/policy/modules/contrib/fwupd.fc -@@ -4,6 +4,7 @@ +--- fedora-policy-20230116.orig/policy/modules/contrib/fwupd.fc ++++ fedora-policy-20230116/policy/modules/contrib/fwupd.fc +@@ -2,9 +2,9 @@ + /etc/pki/(fwupd|fwupd-metadata)(/.*)? gen_context(system_u:object_r:fwupd_cert_t,s0) - /usr/libexec/fwupd/fwupd -- gen_context(system_u:object_r:fwupd_exec_t,s0) -+/usr/lib/fwupd/fwupd -- gen_context(system_u:object_r:fwupd_exec_t,s0) +-/usr/libexec/fwupd/fwupd -- gen_context(system_u:object_r:fwupd_exec_t,s0) +-/usr/libexec/fwupd/fwupdoffline -- gen_context(system_u:object_r:fwupd_exec_t,s0) +-/usr/libexec/fwupd/fwupd-detect-cet -- gen_context(system_u:object_r:fwupd_exec_t,s0) ++/usr/lib(exec)?/fwupd/fwupd -- gen_context(system_u:object_r:fwupd_exec_t,s0) ++/usr/lib(exec)?/fwupd/fwupdoffline -- gen_context(system_u:object_r:fwupd_exec_t,s0) ++/usr/lib(exec)?/fwupd/fwupd-detect-cet -- gen_context(system_u:object_r:fwupd_exec_t,s0) /var/cache/app-info(/.*)? gen_context(system_u:object_r:fwupd_cache_t,s0) /var/cache/fwupd(/.*)? gen_context(system_u:object_r:fwupd_cache_t,s0) diff --git a/fix_init.patch b/fix_init.patch index 29df1c9..e33e0e5 100644 --- a/fix_init.patch +++ b/fix_init.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20221019/policy/modules/system/init.te +Index: fedora-policy-20230116/policy/modules/system/init.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/init.te -+++ fedora-policy-20221019/policy/modules/system/init.te -@@ -269,6 +269,8 @@ corecmd_exec_bin(init_t) +--- fedora-policy-20230116.orig/policy/modules/system/init.te ++++ fedora-policy-20230116/policy/modules/system/init.te +@@ -270,6 +270,8 @@ corecmd_exec_bin(init_t) corenet_all_recvfrom_netlabel(init_t) corenet_tcp_bind_all_ports(init_t) corenet_udp_bind_all_ports(init_t) @@ -11,7 +11,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te dev_create_all_files(init_t) dev_create_all_chr_files(init_t) -@@ -398,6 +400,7 @@ logging_manage_audit_config(init_t) +@@ -396,6 +398,7 @@ logging_manage_audit_config(init_t) logging_create_syslog_netlink_audit_socket(init_t) logging_write_var_log_dirs(init_t) logging_manage_var_log_symlinks(init_t) @@ -19,7 +19,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te seutil_read_config(init_t) seutil_read_login_config(init_t) -@@ -450,9 +453,19 @@ ifdef(`distro_redhat',` +@@ -448,9 +451,19 @@ ifdef(`distro_redhat',` corecmd_shell_domtrans(init_t, initrc_t) storage_raw_rw_fixed_disk(init_t) @@ -39,7 +39,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te optional_policy(` anaconda_stream_connect(init_t) anaconda_create_unix_stream_sockets(init_t) -@@ -584,10 +597,10 @@ tunable_policy(`init_audit_control',` +@@ -582,10 +595,10 @@ tunable_policy(`init_audit_control',` allow init_t self:system all_system_perms; allow init_t self:system module_load; allow init_t self:unix_dgram_socket { create_socket_perms sendto }; @@ -52,7 +52,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te allow init_t self:netlink_selinux_socket create_socket_perms; allow init_t self:unix_dgram_socket lock; # Until systemd is fixed -@@ -647,6 +660,7 @@ files_delete_all_spool_sockets(init_t) +@@ -645,6 +658,7 @@ files_delete_all_spool_sockets(init_t) files_create_var_lib_dirs(init_t) files_create_var_lib_symlinks(init_t) files_read_var_lib_symlinks(init_t) @@ -60,7 +60,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te files_manage_urandom_seed(init_t) files_list_locks(init_t) files_list_spool(init_t) -@@ -684,7 +698,7 @@ fs_list_all(init_t) +@@ -682,7 +696,7 @@ fs_list_all(init_t) fs_list_auto_mountpoints(init_t) fs_register_binary_executable_type(init_t) fs_relabel_tmpfs_sock_file(init_t) @@ -69,7 +69,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te fs_relabel_cgroup_dirs(init_t) fs_search_cgroup_dirs(init_t) # for network namespaces -@@ -740,6 +754,7 @@ systemd_write_inherited_logind_sessions_ +@@ -738,6 +752,7 @@ systemd_write_inherited_logind_sessions_ create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type) create_dirs_pattern(init_t, var_log_t, var_log_t) @@ -77,7 +77,7 @@ Index: fedora-policy-20221019/policy/modules/system/init.te auth_use_nsswitch(init_t) auth_rw_login_records(init_t) -@@ -1596,6 +1611,8 @@ optional_policy(` +@@ -1592,6 +1607,8 @@ optional_policy(` optional_policy(` postfix_list_spool(initrc_t) diff --git a/fix_ipsec.patch b/fix_ipsec.patch index 42486de..f303a0a 100644 --- a/fix_ipsec.patch +++ b/fix_ipsec.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20221019/policy/modules/system/ipsec.te +Index: fedora-policy-20230116/policy/modules/system/ipsec.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/ipsec.te -+++ fedora-policy-20221019/policy/modules/system/ipsec.te -@@ -87,6 +87,7 @@ allow ipsec_t self:tcp_socket create_str +--- fedora-policy-20230116.orig/policy/modules/system/ipsec.te ++++ fedora-policy-20230116/policy/modules/system/ipsec.te +@@ -88,6 +88,7 @@ allow ipsec_t self:tcp_socket create_str allow ipsec_t self:udp_socket create_socket_perms; allow ipsec_t self:packet_socket create_socket_perms; allow ipsec_t self:key_socket create_socket_perms; @@ -10,7 +10,7 @@ Index: fedora-policy-20221019/policy/modules/system/ipsec.te allow ipsec_t self:fifo_file read_fifo_file_perms; allow ipsec_t self:netlink_xfrm_socket { create_netlink_socket_perms nlmsg_write }; allow ipsec_t self:netlink_selinux_socket create_socket_perms; -@@ -269,6 +270,7 @@ allow ipsec_mgmt_t self:unix_stream_sock +@@ -270,6 +271,7 @@ allow ipsec_mgmt_t self:unix_stream_sock allow ipsec_mgmt_t self:tcp_socket create_stream_socket_perms; allow ipsec_mgmt_t self:udp_socket create_socket_perms; allow ipsec_mgmt_t self:key_socket create_socket_perms; diff --git a/fix_kernel.patch b/fix_kernel.patch new file mode 100644 index 0000000..498b057 --- /dev/null +++ b/fix_kernel.patch @@ -0,0 +1,52 @@ +Index: fedora-policy-20230125/policy/modules/kernel/kernel.te +=================================================================== +--- fedora-policy-20230125.orig/policy/modules/kernel/kernel.te ++++ fedora-policy-20230125/policy/modules/kernel/kernel.te +@@ -389,6 +389,13 @@ ifdef(`distro_redhat',` + fs_rw_tmpfs_chr_files(kernel_t) + ') + ++# this is a temporary fix. This permission doesn't make a lot of sense, but ++# without a kernel change there's not much we can do about it. I don't want to ++# audit it due to the unknown impact (happens e.g. during firewall changes) ++optional_policy(` ++ modutils_execute_kmod_tmpfs_files(kernel_t) ++') ++ + optional_policy(` + abrt_filetrans_named_content(kernel_t) + abrt_dump_oops_domtrans(kernel_t) +@@ -410,6 +417,7 @@ optional_policy(` + init_dbus_chat(kernel_t) + init_sigchld(kernel_t) + init_dyntrans(kernel_t) ++ init_read_state(kernel_t) + ') + + optional_policy(` +Index: fedora-policy-20230125/policy/modules/system/modutils.if +=================================================================== +--- fedora-policy-20230125.orig/policy/modules/system/modutils.if ++++ fedora-policy-20230125/policy/modules/system/modutils.if +@@ -525,3 +525,21 @@ interface(`modutils_dontaudit_kmod_tmpfs + + dontaudit $1 kmod_tmpfs_t:file { getattr }; + ') ++ ++####################################### ++## ++## Execute accesses to tmp file type. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`modutils_execute_kmod_tmpfs_files',` ++ gen_require(` ++ type kmod_tmpfs_t; ++ ') ++ ++ allow $1 kmod_tmpfs_t:file { execute execute_no_trans }; ++') diff --git a/fix_kernel_sysctl.patch b/fix_kernel_sysctl.patch index 4769ca5..fb5a8bd 100644 --- a/fix_kernel_sysctl.patch +++ b/fix_kernel_sysctl.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20221019/policy/modules/kernel/files.fc +Index: fedora-policy-20230116/policy/modules/kernel/files.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/kernel/files.fc -+++ fedora-policy-20221019/policy/modules/kernel/files.fc +--- fedora-policy-20230116.orig/policy/modules/kernel/files.fc ++++ fedora-policy-20230116/policy/modules/kernel/files.fc @@ -242,6 +242,8 @@ ifdef(`distro_redhat',` /usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0) /usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0) @@ -11,11 +11,11 @@ Index: fedora-policy-20221019/policy/modules/kernel/files.fc /usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) -Index: fedora-policy-20221019/policy/modules/system/systemd.te +Index: fedora-policy-20230116/policy/modules/system/systemd.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/systemd.te -+++ fedora-policy-20221019/policy/modules/system/systemd.te -@@ -1105,6 +1105,8 @@ init_stream_connect(systemd_sysctl_t) +--- fedora-policy-20230116.orig/policy/modules/system/systemd.te ++++ fedora-policy-20230116/policy/modules/system/systemd.te +@@ -1113,6 +1113,8 @@ init_stream_connect(systemd_sysctl_t) logging_send_syslog_msg(systemd_sysctl_t) systemd_read_efivarfs(systemd_sysctl_t) diff --git a/fix_logging.patch b/fix_logging.patch index 8a74cb7..612c515 100644 --- a/fix_logging.patch +++ b/fix_logging.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20220624/policy/modules/system/logging.fc +Index: fedora-policy-20230116/policy/modules/system/logging.fc =================================================================== ---- fedora-policy-20220624.orig/policy/modules/system/logging.fc -+++ fedora-policy-20220624/policy/modules/system/logging.fc +--- fedora-policy-20230116.orig/policy/modules/system/logging.fc ++++ fedora-policy-20230116/policy/modules/system/logging.fc @@ -3,6 +3,8 @@ /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) @@ -19,11 +19,11 @@ Index: fedora-policy-20220624/policy/modules/system/logging.fc /var/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) /var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh) -Index: fedora-policy-20220624/policy/modules/system/logging.if +Index: fedora-policy-20230116/policy/modules/system/logging.if =================================================================== ---- fedora-policy-20220624.orig/policy/modules/system/logging.if -+++ fedora-policy-20220624/policy/modules/system/logging.if -@@ -1788,3 +1788,22 @@ interface(`logging_dgram_send',` +--- fedora-policy-20230116.orig/policy/modules/system/logging.if ++++ fedora-policy-20230116/policy/modules/system/logging.if +@@ -1806,3 +1806,22 @@ interface(`logging_dgram_send',` allow $1 syslogd_t:unix_dgram_socket sendto; ') diff --git a/fix_networkmanager.patch b/fix_networkmanager.patch index 85dc9f3..de2dfe7 100644 --- a/fix_networkmanager.patch +++ b/fix_networkmanager.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te +Index: fedora-policy-20230125/policy/modules/contrib/networkmanager.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.te -+++ fedora-policy-20221019/policy/modules/contrib/networkmanager.te -@@ -259,6 +259,7 @@ sysnet_search_dhcp_state(NetworkManager_ +--- fedora-policy-20230125.orig/policy/modules/contrib/networkmanager.te ++++ fedora-policy-20230125/policy/modules/contrib/networkmanager.te +@@ -260,6 +260,7 @@ sysnet_search_dhcp_state(NetworkManager_ sysnet_manage_config(NetworkManager_t) sysnet_filetrans_named_content(NetworkManager_t) sysnet_filetrans_net_conf(NetworkManager_t) @@ -10,7 +10,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te systemd_login_watch_pid_dirs(NetworkManager_t) systemd_login_watch_session_dirs(NetworkManager_t) -@@ -275,6 +276,9 @@ userdom_read_home_certs(NetworkManager_t +@@ -276,6 +277,9 @@ userdom_read_home_certs(NetworkManager_t userdom_read_user_home_content_files(NetworkManager_t) userdom_dgram_send(NetworkManager_t) @@ -20,10 +20,14 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te tunable_policy(`use_nfs_home_dirs',` fs_read_nfs_files(NetworkManager_t) ') -@@ -284,6 +288,10 @@ tunable_policy(`use_samba_home_dirs',` +@@ -285,6 +289,14 @@ tunable_policy(`use_samba_home_dirs',` ') optional_policy(` ++ ntp_manage_pid_files(NetworkManager_t) ++') ++ ++optional_policy(` + nis_systemctl_ypbind(NetworkManager_t) +') + @@ -31,7 +35,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te avahi_domtrans(NetworkManager_t) avahi_kill(NetworkManager_t) avahi_signal(NetworkManager_t) -@@ -292,6 +300,14 @@ optional_policy(` +@@ -293,6 +305,14 @@ optional_policy(` ') optional_policy(` @@ -46,7 +50,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te bind_domtrans(NetworkManager_t) bind_manage_cache(NetworkManager_t) bind_kill(NetworkManager_t) -@@ -419,6 +435,8 @@ optional_policy(` +@@ -420,6 +440,8 @@ optional_policy(` nscd_kill(NetworkManager_t) nscd_initrc_domtrans(NetworkManager_t) nscd_systemctl(NetworkManager_t) @@ -55,7 +59,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te ') optional_policy(` -@@ -606,6 +624,7 @@ files_manage_etc_files(NetworkManager_di +@@ -607,6 +629,7 @@ files_manage_etc_files(NetworkManager_di init_status(NetworkManager_dispatcher_cloud_t) init_status(NetworkManager_dispatcher_ddclient_t) @@ -63,7 +67,7 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te init_append_stream_sockets(networkmanager_dispatcher_plugin) init_ioctl_stream_sockets(networkmanager_dispatcher_plugin) init_stream_connect(networkmanager_dispatcher_plugin) -@@ -621,6 +640,10 @@ optional_policy(` +@@ -622,6 +645,10 @@ optional_policy(` ') optional_policy(` @@ -74,10 +78,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te cloudform_init_domtrans(NetworkManager_dispatcher_cloud_t) ') -Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.if +Index: fedora-policy-20230125/policy/modules/contrib/networkmanager.if =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.if -+++ fedora-policy-20221019/policy/modules/contrib/networkmanager.if +--- fedora-policy-20230125.orig/policy/modules/contrib/networkmanager.if ++++ fedora-policy-20230125/policy/modules/contrib/networkmanager.if @@ -132,6 +132,24 @@ interface(`networkmanager_initrc_domtran init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t) ') @@ -103,10 +107,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.if ######################################## ## ## Execute NetworkManager server in the NetworkManager domain. -Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.fc +Index: fedora-policy-20230125/policy/modules/contrib/networkmanager.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.fc -+++ fedora-policy-20221019/policy/modules/contrib/networkmanager.fc +--- fedora-policy-20230125.orig/policy/modules/contrib/networkmanager.fc ++++ fedora-policy-20230125/policy/modules/contrib/networkmanager.fc @@ -24,6 +24,7 @@ /usr/lib/NetworkManager/dispatcher\.d/04-iscsi -- gen_context(system_u:object_r:NetworkManager_dispatcher_iscsid_script_t,s0) /usr/lib/NetworkManager/dispatcher\.d/10-sendmail -- gen_context(system_u:object_r:NetworkManager_dispatcher_sendmail_script_t,s0) diff --git a/fix_ntp.patch b/fix_ntp.patch index b444775..c762c96 100644 --- a/fix_ntp.patch +++ b/fix_ntp.patch @@ -1,8 +1,16 @@ -Index: fedora-policy/policy/modules/contrib/ntp.fc +Index: fedora-policy-20230125/policy/modules/contrib/ntp.fc =================================================================== ---- fedora-policy.orig/policy/modules/contrib/ntp.fc 2020-02-21 15:59:23.349556504 +0000 -+++ fedora-policy/policy/modules/contrib/ntp.fc 2020-02-21 16:01:41.591761350 +0000 -@@ -16,7 +16,6 @@ +--- fedora-policy-20230125.orig/policy/modules/contrib/ntp.fc ++++ fedora-policy-20230125/policy/modules/contrib/ntp.fc +@@ -9,6 +9,7 @@ + + /etc/rc\.d/init\.d/ntpd -- gen_context(system_u:object_r:ntpd_initrc_exec_t,s0) + ++/usr/sbin/start-ntpd -- gen_context(system_u:object_r:ntpd_exec_t,s0) + /usr/sbin/ntpd -- gen_context(system_u:object_r:ntpd_exec_t,s0) + /usr/sbin/ntpdate -- gen_context(system_u:object_r:ntpdate_exec_t,s0) + /usr/libexec/ntpdate-wrapper -- gen_context(system_u:object_r:ntpdate_exec_t,s0) +@@ -16,7 +17,6 @@ /usr/lib/systemd/system/ntpd.* -- gen_context(system_u:object_r:ntpd_unit_file_t,s0) @@ -10,7 +18,7 @@ Index: fedora-policy/policy/modules/contrib/ntp.fc /var/lib/sntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0) /var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0) -@@ -25,3 +24,26 @@ +@@ -25,3 +25,26 @@ /var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0) /var/run/ntpd\.pid -- gen_context(system_u:object_r:ntpd_var_run_t,s0) @@ -25,9 +33,10 @@ Index: fedora-policy/policy/modules/contrib/ntp.fc +/var/lib/ntp/etc/ntp/keys -- gen_context(system_u:object_r:ntpd_key_t,s0) +/var/lib/ntp/etc/ntp/step-tickers.* -- gen_context(system_u:object_r:ntp_conf_t,s0) +/var/lib/ntp/etc/ntp.conf.iburst -- gen_context(system_u:object_r:ntp_conf_t,s0) -+/var/lib/ntp/var gen_context(system_u:object_r:var_t,s0) -+/var/lib/ntp/var/lib gen_context(system_u:object_r:var_lib_t,s0) -+/var/lib/ntp/var/run gen_context(system_u:object_r:var_run_t,s0) ++/var/lib/ntp/var(/.*)? gen_context(system_u:object_r:var_t,s0) ++/var/lib/ntp/var/lib(/.*)? gen_context(system_u:object_r:var_lib_t,s0) ++/var/lib/ntp/var/run(/.*)? gen_context(system_u:object_r:var_run_t,s0) ++/var/lib/ntp/var/run/ntp(/.*)? gen_context(system_u:object_r:ntpd_var_run_t,s0) +/var/lib/ntp/var/lib/ntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0) +/var/lib/ntp/var/lib/sntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0) +/var/lib/ntp/var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0) @@ -36,4 +45,55 @@ Index: fedora-policy/policy/modules/contrib/ntp.fc +/var/lib/ntp/var/log/ntp.* -- gen_context(system_u:object_r:ntpd_log_t,s0) +/var/lib/ntp/var/log/ntpstats(/.*)? gen_context(system_u:object_r:ntpd_log_t,s0) +/var/lib/ntp/var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0) -+/var/lib/ntp/var/run/ntpd\.pid -- gen_context(system_u:object_r:ntpd_var_run_t,s0) +Index: fedora-policy-20230125/policy/modules/contrib/ntp.te +=================================================================== +--- fedora-policy-20230125.orig/policy/modules/contrib/ntp.te ++++ fedora-policy-20230125/policy/modules/contrib/ntp.te +@@ -49,6 +49,9 @@ init_system_domain(ntpd_t, ntpdate_exec_ + + allow ntpd_t self:capability { chown dac_read_search kill setgid setuid sys_time ipc_lock ipc_owner sys_chroot sys_nice sys_resource }; + dontaudit ntpd_t self:capability { net_admin sys_tty_config fsetid sys_nice }; ++# remove once 1207577 is done ++allow ntpd_t self:capability dac_override; ++ + allow ntpd_t self:process { signal_perms getcap setcap setsched setrlimit }; + allow ntpd_t self:fifo_file rw_fifo_file_perms; + allow ntpd_t self:shm create_shm_perms; +@@ -78,7 +81,8 @@ manage_files_pattern(ntpd_t, ntpd_tmpfs_ + fs_tmpfs_filetrans(ntpd_t, ntpd_tmpfs_t, { dir file }) + + manage_files_pattern(ntpd_t, ntpd_var_run_t, ntpd_var_run_t) +-files_pid_filetrans(ntpd_t, ntpd_var_run_t, file) ++manage_lnk_files_pattern(ntpd_t, ntpd_var_run_t, ntpd_var_run_t) ++files_pid_filetrans(ntpd_t, ntpd_var_run_t, { file dir lnk_file }) + + can_exec(ntpd_t, ntpd_exec_t) + can_exec(ntpd_t, ntpdate_exec_t) +Index: fedora-policy-20230125/policy/modules/contrib/ntp.if +=================================================================== +--- fedora-policy-20230125.orig/policy/modules/contrib/ntp.if ++++ fedora-policy-20230125/policy/modules/contrib/ntp.if +@@ -339,3 +339,23 @@ interface(`ntp_manage_log',` + manage_lnk_files_pattern($1, ntpd_log_t, ntpd_log_t) + ') + ++######################################## ++## ++## Create, read, write, and delete ++## ntp pid (lnk) files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`ntp_manage_pid_files',` ++ gen_require(` ++ type ntpd_var_run_t; ++ ') ++ ++ files_search_pids($1) ++ manage_files_pattern($1, ntpd_var_run_t, ntpd_var_run_t) ++ manage_lnk_files_pattern($1, ntpd_var_run_t, ntpd_var_run_t) ++') diff --git a/fix_rpm.patch b/fix_rpm.patch index 67cf3c4..77ca8ac 100644 --- a/fix_rpm.patch +++ b/fix_rpm.patch @@ -1,19 +1,18 @@ -Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc +Index: fedora-policy-20230116/policy/modules/contrib/rpm.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/rpm.fc -+++ fedora-policy-20221019/policy/modules/contrib/rpm.fc -@@ -18,6 +18,10 @@ - /usr/bin/repoquery -- gen_context(system_u:object_r:rpm_exec_t,s0) - /usr/bin/zif -- gen_context(system_u:object_r:rpm_exec_t,s0) +--- fedora-policy-20230116.orig/policy/modules/contrib/rpm.fc ++++ fedora-policy-20230116/policy/modules/contrib/rpm.fc +@@ -23,6 +23,9 @@ + # This is in /usr, but is expected to be variable content from a policy perspective (#2042149) + /usr/lib/sysimage/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) +/usr/sbin/zypp-refresh -- gen_context(system_u:object_r:rpm_exec_t,s0) +/usr/bin/zypper -- gen_context(system_u:object_r:rpm_exec_t,s0) -+ + /usr/libexec/packagekitd -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/libexec/yumDBUSBackend.py -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/libexec/pegasus/pycmpiLMI_Software-cimprovagt -- gen_context(system_u:object_r:rpm_exec_t,s0) -@@ -56,6 +60,8 @@ ifdef(`distro_redhat', ` +@@ -61,6 +64,8 @@ ifdef(`distro_redhat', ` /var/cache/yum(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0) /var/cache/dnf(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0) @@ -22,10 +21,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) /var/lib/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) /var/lib/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) -Index: fedora-policy-20221019/policy/modules/contrib/rpm.if +Index: fedora-policy-20230116/policy/modules/contrib/rpm.if =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/rpm.if -+++ fedora-policy-20221019/policy/modules/contrib/rpm.if +--- fedora-policy-20230116.orig/policy/modules/contrib/rpm.if ++++ fedora-policy-20230116/policy/modules/contrib/rpm.if @@ -515,8 +515,10 @@ interface(`rpm_named_filetrans',` logging_log_named_filetrans($1, rpm_log_t, file, "yum.log") logging_log_named_filetrans($1, rpm_log_t, file, "hawkey.log") @@ -37,10 +36,10 @@ Index: fedora-policy-20221019/policy/modules/contrib/rpm.if files_var_lib_filetrans($1, rpm_var_lib_t, dir, "dnf") files_var_lib_filetrans($1, rpm_var_lib_t, dir, "yum") files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpm") -Index: fedora-policy-20221019/policy/modules/kernel/files.fc +Index: fedora-policy-20230116/policy/modules/kernel/files.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/kernel/files.fc -+++ fedora-policy-20221019/policy/modules/kernel/files.fc +--- fedora-policy-20230116.orig/policy/modules/kernel/files.fc ++++ fedora-policy-20230116/policy/modules/kernel/files.fc @@ -67,6 +67,7 @@ ifdef(`distro_redhat',` /etc/sysconfig/ipvsadm.* -- gen_context(system_u:object_r:system_conf_t,s0) /etc/sysconfig/system-config-firewall.* -- gen_context(system_u:object_r:system_conf_t,s0) diff --git a/fix_rtkit.patch b/fix_rtkit.patch new file mode 100644 index 0000000..0f6a9ab --- /dev/null +++ b/fix_rtkit.patch @@ -0,0 +1,11 @@ +Index: fedora-policy-20230116/policy/modules/contrib/rtkit.fc +=================================================================== +--- fedora-policy-20230116.orig/policy/modules/contrib/rtkit.fc ++++ fedora-policy-20230116/policy/modules/contrib/rtkit.fc +@@ -1,5 +1,6 @@ + /etc/rc\.d/init\.d/rtkit-daemon -- gen_context(system_u:object_r:rtkit_daemon_initrc_exec_t,s0) + + /usr/libexec/rtkit-daemon -- gen_context(system_u:object_r:rtkit_daemon_exec_t,s0) ++/usr/libexec/rtkit/rtkit-daemon -- gen_context(system_u:object_r:rtkit_daemon_exec_t,s0) + + /usr/lib/rtkit/rtkit-daemon -- gen_context(system_u:object_r:rtkit_daemon_exec_t,s0) diff --git a/fix_selinuxutil.patch b/fix_selinuxutil.patch index 84e87ac..3cc047a 100644 --- a/fix_selinuxutil.patch +++ b/fix_selinuxutil.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20210628/policy/modules/system/selinuxutil.te +Index: fedora-policy-20230116/policy/modules/system/selinuxutil.te =================================================================== ---- fedora-policy-20210628.orig/policy/modules/system/selinuxutil.te -+++ fedora-policy-20210628/policy/modules/system/selinuxutil.te -@@ -238,6 +238,10 @@ ifdef(`hide_broken_symptoms',` +--- fedora-policy-20230116.orig/policy/modules/system/selinuxutil.te ++++ fedora-policy-20230116/policy/modules/system/selinuxutil.te +@@ -239,6 +239,10 @@ ifdef(`hide_broken_symptoms',` ') optional_policy(` @@ -13,7 +13,7 @@ Index: fedora-policy-20210628/policy/modules/system/selinuxutil.te portage_dontaudit_use_fds(load_policy_t) ') -@@ -618,6 +622,10 @@ logging_send_audit_msgs(setfiles_t) +@@ -619,6 +623,10 @@ logging_send_audit_msgs(setfiles_t) logging_send_syslog_msg(setfiles_t) optional_policy(` @@ -24,10 +24,10 @@ Index: fedora-policy-20210628/policy/modules/system/selinuxutil.te cloudform_dontaudit_write_cloud_log(setfiles_t) ') -Index: fedora-policy-20210628/policy/modules/system/selinuxutil.if +Index: fedora-policy-20230116/policy/modules/system/selinuxutil.if =================================================================== ---- fedora-policy-20210628.orig/policy/modules/system/selinuxutil.if -+++ fedora-policy-20210628/policy/modules/system/selinuxutil.if +--- fedora-policy-20230116.orig/policy/modules/system/selinuxutil.if ++++ fedora-policy-20230116/policy/modules/system/selinuxutil.if @@ -795,6 +795,8 @@ interface(`seutil_dontaudit_read_config' dontaudit $1 selinux_config_t:dir search_dir_perms; diff --git a/fix_systemd.patch b/fix_systemd.patch index 1576754..11c069c 100644 --- a/fix_systemd.patch +++ b/fix_systemd.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20221019/policy/modules/system/systemd.te +Index: fedora-policy-20230116/policy/modules/system/systemd.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/systemd.te -+++ fedora-policy-20221019/policy/modules/system/systemd.te +--- fedora-policy-20230116.orig/policy/modules/system/systemd.te ++++ fedora-policy-20230116/policy/modules/system/systemd.te @@ -381,6 +381,10 @@ userdom_manage_user_tmp_chr_files(system xserver_dbus_chat(systemd_logind_t) @@ -24,16 +24,7 @@ Index: fedora-policy-20221019/policy/modules/system/systemd.te ####################################### # # Hostnamed policy -@@ -1158,7 +1166,7 @@ systemd_read_efivarfs(systemd_hwdb_t) - # systemd_gpt_generator domain - # - --allow systemd_gpt_generator_t self:capability sys_rawio; -+allow systemd_gpt_generator_t self:capability { sys_rawio sys_admin}; - allow systemd_gpt_generator_t self:netlink_kobject_uevent_socket create_socket_perms; - - dev_read_sysfs(systemd_gpt_generator_t) -@@ -1185,6 +1193,8 @@ systemd_unit_file_filetrans(systemd_gpt_ +@@ -1195,6 +1203,8 @@ systemd_unit_file_filetrans(systemd_gpt_ systemd_create_unit_file_dirs(systemd_gpt_generator_t) systemd_create_unit_file_lnk(systemd_gpt_generator_t) diff --git a/fix_systemd_watch.patch b/fix_systemd_watch.patch index 530f381..40a25b7 100644 --- a/fix_systemd_watch.patch +++ b/fix_systemd_watch.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20221019/policy/modules/system/systemd.te +Index: fedora-policy-20230116/policy/modules/system/systemd.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/systemd.te -+++ fedora-policy-20221019/policy/modules/system/systemd.te -@@ -1508,6 +1508,12 @@ fstools_rw_swap_files(systemd_sleep_t) +--- fedora-policy-20230116.orig/policy/modules/system/systemd.te ++++ fedora-policy-20230116/policy/modules/system/systemd.te +@@ -1520,6 +1520,12 @@ fstools_rw_swap_files(systemd_sleep_t) storage_getattr_fixed_disk_dev(systemd_sleep_t) storage_getattr_removable_dev(systemd_sleep_t) diff --git a/fix_userdomain.patch b/fix_userdomain.patch index 6691ad8..a2ea637 100644 --- a/fix_userdomain.patch +++ b/fix_userdomain.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20220624/policy/modules/system/userdomain.if +Index: fedora-policy-20230116/policy/modules/system/userdomain.if =================================================================== ---- fedora-policy-20220624.orig/policy/modules/system/userdomain.if -+++ fedora-policy-20220624/policy/modules/system/userdomain.if -@@ -1497,6 +1497,7 @@ tunable_policy(`deny_bluetooth',`',` +--- fedora-policy-20230116.orig/policy/modules/system/userdomain.if ++++ fedora-policy-20230116/policy/modules/system/userdomain.if +@@ -1515,6 +1515,7 @@ tunable_policy(`deny_bluetooth',`',` # port access is audited even if dac would not have allowed it, so dontaudit it here # corenet_dontaudit_tcp_bind_all_reserved_ports($1_t) diff --git a/selinux-policy.changes b/selinux-policy.changes index 88845c2..e85f955 100644 --- a/selinux-policy.changes +++ b/selinux-policy.changes @@ -1,3 +1,36 @@ +------------------------------------------------------------------- +Mon Jan 16 08:42:09 UTC 2023 - Johannes Segitz + +- Update to version 20230125. Refreshed: + * distro_suse_to_distro_redhat.patch + * fix_dnsmasq.patch + * fix_init.patch + * fix_ipsec.patch + * fix_kernel_sysctl.patch + * fix_logging.patch + * fix_rpm.patch + * fix_selinuxutil.patch + * fix_systemd_watch.patch + * fix_userdomain.patch +- More flexible lib(exec) matching in fix_fwupd.patch +- Removed sys_admin for systemd_gpt_generator_t in fix_systemd.patch +- Dropped fix_container.patch, is now upstream +- Added fix_entropyd.patch + * Added new interface entropyd_semaphore_filetrans to properly transfer + semaphore created during early boot. That doesn't work yet, so work + around with next item + * Allow reading tempfs files +- Added fix_kernel.patch. Added modutils_execute_kmod_tmpfs_files interace + to allow kmod_tmpfs_t files to be executed. Necessary for firewalld +- Added fix_rtkit.patch to fix labeling of binary +- Modified fix_ntp.patch: + * Proper labeling for start-ntpd + * Fixed label rules for chroot path + * Temporarily allow dac_override for ntpd_t (bsc#1207577) + * Add interface ntp_manage_pid_files to allow management of pid + files +- Updated fix_networkmanager.patch to allow managing ntp pid files + ------------------------------------------------------------------- Thu Jan 12 13:01:47 UTC 2023 - Johannes Segitz diff --git a/selinux-policy.spec b/selinux-policy.spec index 6d85ed7..72b18f0 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -33,7 +33,7 @@ Summary: SELinux policy configuration License: GPL-2.0-or-later Group: System/Management Name: selinux-policy -Version: 20221019 +Version: 20230125 Release: 0 Source: fedora-policy-%{version}.tar.bz2 Source1: selinux-policy-rpmlintrc @@ -148,8 +148,9 @@ Patch063: fix_alsa.patch Patch064: dontaudit_interface_kmod_tmpfs.patch Patch065: fix_sendmail.patch Patch066: fix_ipsec.patch -# https://github.com/containers/container-selinux/pull/199, can be dropped once this is included -Patch067: fix_container.patch +Patch067: fix_kernel.patch +Patch068: fix_entropyd.patch +Patch069: fix_rtkit.patch Patch100: sedoctool.patch