Hu
9dc19e60e0
- Enable sap module
- Add equivalency in file_contexts.subs_dist
* /bin /usr/bin
* /sbin /usr/bin
* /usr/sbin /usr/bin
- Update to version 20240710:
* Change fc in rebootmgr module for /sbin -> /usr/bin
* Change fc in rpm module for /sbin -> /usr/bin
* Change fc in rsync module for /sbin -> /usr/bin
* Change fc in wicked module for /sbin -> /usr/bin
* Confine libvirt-dbus
* Allow virtqemud the kill capability in user namespace
* Allow rshim get options of the netlink class for KOBJECT_UEVENT family
* Allow dhcpcd the kill capability
* Allow systemd-networkd list /var/lib/systemd/network
* Allow sysadm_t run systemd-nsresourced bpf programs
* Update policy for systemd generators interactions
* Allow create memory.pressure files with cgroup_memory_pressure_t
* Add support for libvirt hooks
* Allow certmonger read and write tpm devices
* Allow all domains to connect to systemd-nsresourced over a unix socket
* Allow systemd-machined read the vsock device
* Update policy for systemd generators
* Allow ptp4l_t request that the kernel load a kernel module
* Allow sbd to trace processes in user namespace
* Allow request-key execute scripts
* Update policy for haproxyd
* Update policy for systemd-nsresourced
* Correct sbin-related file context entries
* Allow login_userdomain execute systemd-tmpfiles in the caller domain
* Allow virt_driver_domain read files labeled unconfined_t
* Allow virt_driver_domain dbus chat with policykit
* Allow virtqemud manage nfs files when virt_use_nfs boolean is on
* Add rules for interactions between generators
* Label memory.pressure files with cgroup_memory_pressure_t
* Revert "Allow some systemd services write to cgroup files"
* Update policy for systemd-nsresourced
* Label /usr/bin/ntfsck with fsadm_exec_t
* Allow systemd_fstab_generator_t read tmpfs files
* Update policy for systemd-nsresourced
* Alias /usr/sbin to /usr/bin and change all /usr/sbin paths to /usr/bin
* Remove a few lines duplicated between {dkim,milter}.fc
* Alias /bin → /usr/bin and remove redundant paths
* Drop duplicate line for /usr/sbin/unix_chkpwd
* Drop duplicate paths for /usr/sbin
* Update systemd-generator policy
* Remove permissive domain for bootupd_t
* Remove permissive domain for coreos_installer_t
* Remove permissive domain for afterburn_t
* Add the sap module to modules.conf
* Move unconfined_domain(sap_unconfined_t) to an optional block
* Create the sap module
* Allow systemd-coredumpd sys_admin and sys_resource capabilities
* Allow systemd-coredump read nsfs files
* Allow generators auto file transition only for plain files
* Allow systemd-hwdb write to the kernel messages device
* Escape "interface" as a file name in a virt filetrans pattern
* Allow gnome-software work for login_userdomain
* Allow systemd-machined manage runtime sockets
* Revert "Allow systemd-machined manage runtime sockets"
* Allow postfix_domain connect to postgresql over a unix socket
* Dontaudit systemd-coredump sys_admin capability
- Update container-selinux
OBS-URL: https://build.opensuse.org/request/show/1186574
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=233
381 lines
5.1 KiB
Plaintext
381 lines
5.1 KiB
Plaintext
# Layer: kernel
|
|
# Module: bootloader
|
|
#
|
|
# Policy for the kernel modules, kernel image, and bootloader.
|
|
#
|
|
bootloader = module
|
|
|
|
# Layer: kernel
|
|
# Module: corenetwork
|
|
# Required in base
|
|
#
|
|
# Policy controlling access to network objects
|
|
#
|
|
corenetwork = base
|
|
|
|
# Layer: admin
|
|
# Module: dmesg
|
|
#
|
|
# Policy for dmesg.
|
|
#
|
|
dmesg = module
|
|
|
|
# Layer: admin
|
|
# Module: netutils
|
|
#
|
|
# Network analysis utilities
|
|
#
|
|
netutils = module
|
|
|
|
# Layer: admin
|
|
# Module: sudo
|
|
#
|
|
# Execute a command with a substitute user
|
|
#
|
|
sudo = module
|
|
|
|
# Layer: admin
|
|
# Module: su
|
|
#
|
|
# Run shells with substitute user and group
|
|
#
|
|
su = module
|
|
|
|
# Layer: admin
|
|
# Module: usermanage
|
|
#
|
|
# Policy for managing user accounts.
|
|
#
|
|
usermanage = module
|
|
|
|
# Layer: apps
|
|
# Module: seunshare
|
|
#
|
|
# seunshare executable
|
|
#
|
|
seunshare = module
|
|
|
|
# Layer: kernel
|
|
# Module: corecommands
|
|
# Required in base
|
|
#
|
|
# Core policy for shells, and generic programs
|
|
# in /bin, /sbin, /usr/bin, and /usr/sbin.
|
|
#
|
|
corecommands = base
|
|
|
|
# Module: devices
|
|
# Required in base
|
|
#
|
|
# Device nodes and interfaces for many basic system devices.
|
|
#
|
|
devices = base
|
|
|
|
# Module: domain
|
|
# Required in base
|
|
#
|
|
# Core policy for domains.
|
|
#
|
|
domain = base
|
|
|
|
# Layer: system
|
|
# Module: userdomain
|
|
#
|
|
# Policy for user domains
|
|
#
|
|
userdomain = module
|
|
|
|
# Module: files
|
|
# Required in base
|
|
#
|
|
# Basic filesystem types and interfaces.
|
|
#
|
|
files = base
|
|
|
|
# Module: filesystem
|
|
# Required in base
|
|
#
|
|
# Policy for filesystems.
|
|
#
|
|
filesystem = base
|
|
|
|
# Module: kernel
|
|
# Required in base
|
|
#
|
|
# Policy for kernel threads, proc filesystem,and unlabeled processes and objects.
|
|
#
|
|
kernel = base
|
|
|
|
# Module: mcs
|
|
# Required in base
|
|
#
|
|
# MultiCategory security policy
|
|
#
|
|
mcs = base
|
|
|
|
# Module: mls
|
|
# Required in base
|
|
#
|
|
# Multilevel security policy
|
|
#
|
|
mls = base
|
|
|
|
# Module: selinux
|
|
# Required in base
|
|
#
|
|
# Policy for kernel security interface, in particular, selinuxfs.
|
|
#
|
|
selinux = base
|
|
|
|
# Layer: kernel
|
|
# Module: storage
|
|
#
|
|
# Policy controlling access to storage devices
|
|
#
|
|
storage = base
|
|
|
|
# Module: terminal
|
|
# Required in base
|
|
#
|
|
# Policy for terminals.
|
|
#
|
|
terminal = base
|
|
|
|
# Layer: kernel
|
|
# Module: ubac
|
|
#
|
|
#
|
|
#
|
|
ubac = base
|
|
|
|
# Layer: kernel
|
|
# Module: unlabelednet
|
|
#
|
|
# The unlabelednet module.
|
|
#
|
|
unlabelednet = module
|
|
|
|
# Layer: role
|
|
# Module: auditadm
|
|
#
|
|
# auditadm account on tty logins
|
|
#
|
|
auditadm = module
|
|
|
|
# Layer: role
|
|
# Module: logadm
|
|
#
|
|
# Minimally prived root role for managing logging system
|
|
#
|
|
logadm = module
|
|
|
|
# Layer: role
|
|
# Module: secadm
|
|
#
|
|
# secadm account on tty logins
|
|
#
|
|
secadm = module
|
|
|
|
# Layer:role
|
|
# Module: staff
|
|
#
|
|
# admin account
|
|
#
|
|
staff = module
|
|
|
|
# Layer:role
|
|
# Module: sysadm_secadm
|
|
#
|
|
# System Administrator with Security Admin rules
|
|
#
|
|
sysadm_secadm = module
|
|
|
|
# Layer:role
|
|
# Module: sysadm
|
|
#
|
|
# System Administrator
|
|
#
|
|
sysadm = module
|
|
|
|
# Layer: role
|
|
# Module: unprivuser
|
|
#
|
|
# Minimally privs guest account on tty logins
|
|
#
|
|
unprivuser = module
|
|
|
|
# Layer: services
|
|
# Module: postgresql
|
|
#
|
|
# PostgreSQL relational database
|
|
#
|
|
postgresql = module
|
|
|
|
# Layer: services
|
|
# Module: ssh
|
|
#
|
|
# Secure shell client and server policy.
|
|
#
|
|
ssh = module
|
|
|
|
# Layer: services
|
|
# Module: xserver
|
|
#
|
|
# X windows login display manager
|
|
#
|
|
xserver = module
|
|
|
|
# Module: application
|
|
# Required in base
|
|
#
|
|
# Defines attributs and interfaces for all user applications
|
|
#
|
|
application = module
|
|
|
|
# Layer: system
|
|
# Module: authlogin
|
|
#
|
|
# Common policy for authentication and user login.
|
|
#
|
|
authlogin = module
|
|
|
|
# Layer: system
|
|
# Module: clock
|
|
#
|
|
# Policy for reading and setting the hardware clock.
|
|
#
|
|
clock = module
|
|
|
|
# Layer: system
|
|
# Module: fstools
|
|
#
|
|
# Tools for filesystem management, such as mkfs and fsck.
|
|
#
|
|
fstools = module
|
|
|
|
# Layer: system
|
|
# Module: getty
|
|
#
|
|
# Policy for getty.
|
|
#
|
|
getty = module
|
|
|
|
# Layer: system
|
|
# Module: hostname
|
|
#
|
|
# Policy for changing the system host name.
|
|
#
|
|
hostname = module
|
|
|
|
# Layer: system
|
|
# Module: init
|
|
#
|
|
# System initialization programs (init and init scripts).
|
|
#
|
|
init = module
|
|
|
|
# Layer: system
|
|
# Module: ipsec
|
|
#
|
|
# TCP/IP encryption
|
|
#
|
|
ipsec = module
|
|
|
|
# Layer: system
|
|
# Module: iptables
|
|
#
|
|
# Policy for iptables.
|
|
#
|
|
iptables = module
|
|
|
|
# Layer: system
|
|
# Module: libraries
|
|
#
|
|
# Policy for system libraries.
|
|
#
|
|
libraries = module
|
|
|
|
# Layer: system
|
|
# Module: locallogin
|
|
#
|
|
# Policy for local logins.
|
|
#
|
|
locallogin = module
|
|
|
|
# Layer: system
|
|
# Module: logging
|
|
#
|
|
# Policy for the kernel message logger and system logging daemon.
|
|
#
|
|
logging = module
|
|
|
|
# Layer: system
|
|
# Module: lvm
|
|
#
|
|
# Policy for logical volume management programs.
|
|
#
|
|
lvm = module
|
|
|
|
# Layer: system
|
|
# Module: miscfiles
|
|
#
|
|
# Miscelaneous files.
|
|
#
|
|
miscfiles = module
|
|
|
|
# Layer: system
|
|
# Module: modutils
|
|
#
|
|
# Policy for kernel module utilities
|
|
#
|
|
modutils = module
|
|
|
|
# Layer: system
|
|
# Module: mount
|
|
#
|
|
# Policy for mount.
|
|
#
|
|
mount = module
|
|
|
|
# Layer: system
|
|
# Module: netlabel
|
|
#
|
|
# Basic netlabel types and interfaces.
|
|
#
|
|
netlabel = module
|
|
|
|
# Layer: system
|
|
# Module: selinuxutil
|
|
#
|
|
# Policy for SELinux policy and userland applications.
|
|
#
|
|
selinuxutil = module
|
|
|
|
# Module: setrans
|
|
# Required in base
|
|
#
|
|
# Policy for setrans
|
|
#
|
|
setrans = module
|
|
|
|
# Layer: system
|
|
# Module: sysnetwork
|
|
#
|
|
# Policy for network configuration: ifconfig and dhcp client.
|
|
#
|
|
sysnetwork = module
|
|
|
|
# Layer: system
|
|
# Module: systemd
|
|
#
|
|
# Policy for systemd components
|
|
#
|
|
systemd = module
|
|
|
|
# Layer: system
|
|
# Module: udev
|
|
#
|
|
# Policy for udev.
|
|
#
|
|
udev = module
|