deab87434d
- Update to refpolicy 20190609. New modules for stubby and several systemd updates, including initial support for systemd --user sessions. Refreshed * label_var_run_rsyslog.patch * suse_modifications_cron.patch * suse_modifications_logging.patch * suse_modifications_ntp.patch * suse_modifications_usermanage.patch * suse_modifications_xserver.patch * sysconfig_network_scripts.patch OBS-URL: https://build.opensuse.org/request/show/714653 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=72
61 lines
2.4 KiB
Diff
61 lines
2.4 KiB
Diff
Index: refpolicy/policy/modules/services/cron.fc
|
|
===================================================================
|
|
--- refpolicy.orig/policy/modules/services/cron.fc 2019-06-09 20:05:20.000000000 +0200
|
|
+++ refpolicy/policy/modules/services/cron.fc 2019-07-11 14:31:20.905629406 +0200
|
|
@@ -69,7 +69,9 @@ ifdef(`distro_gentoo',`
|
|
')
|
|
|
|
ifdef(`distro_suse',`
|
|
-/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
|
|
+/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
|
|
/var/spool/cron/lastrun/[^/]* -- <<none>>
|
|
-/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
|
|
+/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
|
|
+/var/spool/cron/tabs/root -- gen_context(system_u:object_r:sysadm_cron_spool_t,s0)
|
|
+/var/spool/cron/tabs/[^/]* -- gen_context(system_u:object_r:user_cron_spool_t,s0)
|
|
')
|
|
Index: refpolicy/policy/modules/services/cron.te
|
|
===================================================================
|
|
--- refpolicy.orig/policy/modules/services/cron.te 2019-06-09 20:05:20.000000000 +0200
|
|
+++ refpolicy/policy/modules/services/cron.te 2019-07-11 14:31:20.909629472 +0200
|
|
@@ -788,3 +788,9 @@ tunable_policy(`cron_userdomain_transiti
|
|
optional_policy(`
|
|
unconfined_domain(unconfined_cronjob_t)
|
|
')
|
|
+
|
|
+ifdef(`distro_suse',`
|
|
+ files_read_default_symlinks(crontab_t)
|
|
+ userdom_manage_user_home_dirs(crontab_t)
|
|
+ xserver_non_drawing_client(crontab_t)
|
|
+')
|
|
Index: refpolicy/policy/modules/services/cron.if
|
|
===================================================================
|
|
--- refpolicy.orig/policy/modules/services/cron.if 2019-06-09 20:05:20.000000000 +0200
|
|
+++ refpolicy/policy/modules/services/cron.if 2019-07-11 14:31:20.909629472 +0200
|
|
@@ -139,7 +139,7 @@ interface(`cron_role',`
|
|
#
|
|
interface(`cron_unconfined_role',`
|
|
gen_require(`
|
|
- type unconfined_cronjob_t, crontab_t, crontab_exec_t;
|
|
+ type unconfined_cronjob_t, admin_crontab_t, crontab_t, crontab_exec_t;
|
|
type crond_t, user_cron_spool_t;
|
|
bool cron_userdomain_transition;
|
|
')
|
|
@@ -149,14 +149,14 @@ interface(`cron_unconfined_role',`
|
|
# Declarations
|
|
#
|
|
|
|
- role $1 types { unconfined_cronjob_t crontab_t };
|
|
+ role $1 types { unconfined_cronjob_t admin_crontab_t crontab_t };
|
|
|
|
##############################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
- domtrans_pattern($2, crontab_exec_t, crontab_t)
|
|
+ domtrans_pattern($2, crontab_exec_t, admin_crontab_t)
|
|
|
|
dontaudit crond_t $2:process { noatsecure siginh rlimitinh };
|
|
allow $2 crond_t:process sigchld;
|