Accepting request 978251 from home:jsegitz:branches:security:SELinux_3.3

- Update to version 20220428. Refreshed: * fix_apache.patch * fix_hadoop.patch * fix_init.patch * fix_iptables.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unprivuser.patch * fix_usermanage.patch * fix_wine.patch OBS-URL: https://build.opensuse.org/request/show/978251 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=129
2022-05-20 09:46:20 +00:00 · 2022-05-20 09:46:20 +00:00 · 0ae8014c7e
commit 0ae8014c7e
parent c6e85fecc6
15 changed files with 81 additions and 74 deletions
--- a/fedora-policy-20220124.tar.bz2
+++ b/fedora-policy-20220124.tar.bz2
@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:ebec268024dfd05d9563991a424d12892b0eb210d1eab2c484ae424f8fb757c5
-size 725506
--- a/fedora-policy-20220428.tar.bz2
+++ b/fedora-policy-20220428.tar.bz2
@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6ea4a57107b3ca17ce7d74507ec1301abfc515874b6e271903b8ed726a716645
+size 37018074
--- a/fix_apache.patch
+++ b/fix_apache.patch
@ -1,8 +1,8 @@
-Index: fedora-policy/policy/modules/contrib/apache.if
+Index: fedora-policy-20220428/policy/modules/contrib/apache.if
 ===================================================================
--- fedora-policy.orig/policy/modules/contrib/apache.if
-+++ fedora-policy/policy/modules/contrib/apache.if
-@@ -1967,3 +1967,25 @@ interface(`apache_ioctl_stream_sockets',
+--- fedora-policy-20220428.orig/policy/modules/contrib/apache.if
+++ fedora-policy-20220428/policy/modules/contrib/apache.if
+@@ -1989,3 +1989,25 @@ interface(`apache_ioctl_stream_sockets',
 
     allow $1 httpd_t:unix_stream_socket ioctl;
 ')
--- a/fix_hadoop.patch
+++ b/fix_hadoop.patch
@ -1,7 +1,7 @@
-Index: fedora-policy-20220124/policy/modules/roles/sysadm.te
+Index: fedora-policy-20220428/policy/modules/roles/sysadm.te
 ===================================================================
--- fedora-policy-20220124.orig/policy/modules/roles/sysadm.te
-+++ fedora-policy-20220124/policy/modules/roles/sysadm.te
+--- fedora-policy-20220428.orig/policy/modules/roles/sysadm.te
+++ fedora-policy-20220428/policy/modules/roles/sysadm.te
@@ -315,10 +315,6 @@ optional_policy(`
 ')
 
@ -13,11 +13,11 @@ Index: fedora-policy-20220124/policy/modules/roles/sysadm.te
     iotop_run(sysadm_t, sysadm_r)
 ')
 
-Index: fedora-policy-20220124/policy/modules/roles/unprivuser.te
+Index: fedora-policy-20220428/policy/modules/roles/unprivuser.te
 ===================================================================
--- fedora-policy-20220124.orig/policy/modules/roles/unprivuser.te
-+++ fedora-policy-20220124/policy/modules/roles/unprivuser.te
-@@ -205,10 +205,6 @@ ifndef(`distro_redhat',`
+--- fedora-policy-20220428.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20220428/policy/modules/roles/unprivuser.te
+@@ -210,10 +210,6 @@ ifndef(`distro_redhat',`
 	')
 
 	optional_policy(`
--- a/fix_init.patch
+++ b/fix_init.patch
@ -1,7 +1,7 @@
-Index: fedora-policy-20220519/policy/modules/system/init.te
+Index: fedora-policy-20220428/policy/modules/system/init.te
 ===================================================================
--- fedora-policy-20220519.orig/policy/modules/system/init.te
-+++ fedora-policy-20220519/policy/modules/system/init.te
+--- fedora-policy-20220428.orig/policy/modules/system/init.te
+++ fedora-policy-20220428/policy/modules/system/init.te
@@ -187,6 +187,8 @@ allow init_t self:bpf { map_create map_r
 # setuid (from /sbin/shutdown)
 # sys_chroot (from /usr/bin/chroot): now provided by corecmd_chroot_exec_chroot()
@ -28,7 +28,7 @@ Index: fedora-policy-20220519/policy/modules/system/init.te
 
 seutil_read_config(init_t)
 seutil_read_login_config(init_t)
-@@ -448,9 +453,19 @@ ifdef(`distro_redhat',`
+@@ -446,9 +451,19 @@ ifdef(`distro_redhat',`
 corecmd_shell_domtrans(init_t, initrc_t)
 
 storage_raw_rw_fixed_disk(init_t)
@ -48,7 +48,7 @@ Index: fedora-policy-20220519/policy/modules/system/init.te
 optional_policy(`
     bootloader_domtrans(init_t)
 ')
-@@ -575,10 +590,10 @@ tunable_policy(`init_audit_control',`
+@@ -573,10 +588,10 @@ tunable_policy(`init_audit_control',`
 allow init_t self:system all_system_perms;
 allow init_t self:system module_load;
 allow init_t self:unix_dgram_socket { create_socket_perms sendto };
@ -61,7 +61,7 @@ Index: fedora-policy-20220519/policy/modules/system/init.te
 allow init_t self:netlink_selinux_socket create_socket_perms;
 allow init_t self:unix_dgram_socket lock;
 # Until systemd is fixed
-@@ -637,6 +652,7 @@ files_delete_all_spool_sockets(init_t)
+@@ -635,6 +650,7 @@ files_delete_all_spool_sockets(init_t)
 files_create_var_lib_dirs(init_t)
 files_create_var_lib_symlinks(init_t)
 files_read_var_lib_symlinks(init_t)
@ -69,7 +69,7 @@ Index: fedora-policy-20220519/policy/modules/system/init.te
 files_manage_urandom_seed(init_t)
 files_list_locks(init_t)
 files_list_spool(init_t)
-@@ -674,7 +690,7 @@ fs_list_all(init_t)
+@@ -672,7 +688,7 @@ fs_list_all(init_t)
 fs_list_auto_mountpoints(init_t)
 fs_register_binary_executable_type(init_t)
 fs_relabel_tmpfs_sock_file(init_t)
@ -78,7 +78,7 @@ Index: fedora-policy-20220519/policy/modules/system/init.te
 fs_relabel_cgroup_dirs(init_t)
 fs_search_cgroup_dirs(init_t)
 # for network namespaces
-@@ -730,6 +746,7 @@ systemd_write_inherited_logind_sessions_
+@@ -728,6 +744,7 @@ systemd_write_inherited_logind_sessions_
 create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
 
 create_dirs_pattern(init_t, var_log_t, var_log_t)
@ -86,7 +86,7 @@ Index: fedora-policy-20220519/policy/modules/system/init.te
 
 auth_use_nsswitch(init_t)
 auth_rw_login_records(init_t)
-@@ -1580,6 +1597,8 @@ optional_policy(`
+@@ -1578,6 +1595,8 @@ optional_policy(`
 
 optional_policy(`
 	postfix_list_spool(initrc_t)
--- a/fix_iptables.patch
+++ b/fix_iptables.patch
@ -1,8 +1,8 @@
-Index: fedora-policy-20210309/policy/modules/system/iptables.te
+Index: fedora-policy-20220428/policy/modules/system/iptables.te
 ===================================================================
--- fedora-policy-20210309.orig/policy/modules/system/iptables.te
-+++ fedora-policy-20210309/policy/modules/system/iptables.te
-@@ -74,6 +74,7 @@ kernel_read_network_state(iptables_t)
+--- fedora-policy-20220428.orig/policy/modules/system/iptables.te
+++ fedora-policy-20220428/policy/modules/system/iptables.te
+@@ -76,6 +76,7 @@ kernel_read_network_state(iptables_t)
 kernel_read_kernel_sysctls(iptables_t)
 kernel_use_fds(iptables_t)
 kernel_rw_net_sysctls(iptables_t)
--- a/fix_kernel_sysctl.patch
+++ b/fix_kernel_sysctl.patch
@ -1,7 +1,7 @@
-Index: fedora-policy-20220124/policy/modules/kernel/files.fc
+Index: fedora-policy-20220428/policy/modules/kernel/files.fc
 ===================================================================
--- fedora-policy-20220124.orig/policy/modules/kernel/files.fc
-+++ fedora-policy-20220124/policy/modules/kernel/files.fc
+--- fedora-policy-20220428.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20220428/policy/modules/kernel/files.fc
@@ -236,6 +236,8 @@ ifdef(`distro_redhat',`
 /usr/lib/ostree-boot(/.*)?                gen_context(system_u:object_r:usr_t,s0)
 /usr/lib/modules(/.*)/vmlinuz         -- 	gen_context(system_u:object_r:usr_t,s0)
@ -11,11 +11,11 @@ Index: fedora-policy-20220124/policy/modules/kernel/files.fc
 
 /usr/doc(/.*)?/lib(/.*)?	gen_context(system_u:object_r:usr_t,s0)
 
-Index: fedora-policy-20220124/policy/modules/system/systemd.te
+Index: fedora-policy-20220428/policy/modules/system/systemd.te
 ===================================================================
--- fedora-policy-20220124.orig/policy/modules/system/systemd.te
-+++ fedora-policy-20220124/policy/modules/system/systemd.te
-@@ -1037,6 +1037,8 @@ init_stream_connect(systemd_sysctl_t)
+--- fedora-policy-20220428.orig/policy/modules/system/systemd.te
+++ fedora-policy-20220428/policy/modules/system/systemd.te
+@@ -1052,6 +1052,8 @@ init_stream_connect(systemd_sysctl_t)
 logging_send_syslog_msg(systemd_sysctl_t)
 
 systemd_read_efivarfs(systemd_sysctl_t)
--- a/fix_networkmanager.patch
+++ b/fix_networkmanager.patch
@ -1,8 +1,8 @@
-Index: fedora-policy-20211111/policy/modules/contrib/networkmanager.te
+Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.te
 ===================================================================
--- fedora-policy-20211111.orig/policy/modules/contrib/networkmanager.te
-+++ fedora-policy-20211111/policy/modules/contrib/networkmanager.te
-@@ -243,6 +243,9 @@ userdom_read_home_certs(NetworkManager_t
+--- fedora-policy-20220428.orig/policy/modules/contrib/networkmanager.te
+++ fedora-policy-20220428/policy/modules/contrib/networkmanager.te
+@@ -271,6 +271,9 @@ userdom_read_home_certs(NetworkManager_t
 userdom_read_user_home_content_files(NetworkManager_t)
 userdom_dgram_send(NetworkManager_t)
 
@ -12,7 +12,7 @@ Index: fedora-policy-20211111/policy/modules/contrib/networkmanager.te
 tunable_policy(`use_nfs_home_dirs',`
     fs_read_nfs_files(NetworkManager_t)
 ')
-@@ -260,6 +263,14 @@ optional_policy(`
+@@ -288,6 +291,14 @@ optional_policy(`
 ')
 
 optional_policy(`
@ -27,10 +27,10 @@ Index: fedora-policy-20211111/policy/modules/contrib/networkmanager.te
 	bind_domtrans(NetworkManager_t)
 	bind_manage_cache(NetworkManager_t)
 	bind_kill(NetworkManager_t)
-Index: fedora-policy-20211111/policy/modules/contrib/networkmanager.if
+Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.if
 ===================================================================
--- fedora-policy-20211111.orig/policy/modules/contrib/networkmanager.if
-+++ fedora-policy-20211111/policy/modules/contrib/networkmanager.if
+--- fedora-policy-20220428.orig/policy/modules/contrib/networkmanager.if
+++ fedora-policy-20220428/policy/modules/contrib/networkmanager.if
@@ -132,6 +132,24 @@ interface(`networkmanager_initrc_domtran
         init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t)
 ')
--- a/fix_systemd.patch
+++ b/fix_systemd.patch
@ -1,8 +1,8 @@
-Index: fedora-policy-20220124/policy/modules/system/systemd.te
+Index: fedora-policy-20220428/policy/modules/system/systemd.te
 ===================================================================
--- fedora-policy-20220124.orig/policy/modules/system/systemd.te
-+++ fedora-policy-20220124/policy/modules/system/systemd.te
-@@ -353,6 +353,10 @@ userdom_manage_user_tmp_chr_files(system
+--- fedora-policy-20220428.orig/policy/modules/system/systemd.te
+++ fedora-policy-20220428/policy/modules/system/systemd.te
+@@ -355,6 +355,10 @@ userdom_manage_user_tmp_chr_files(system
 xserver_dbus_chat(systemd_logind_t)
 
 optional_policy(`
@ -13,7 +13,7 @@ Index: fedora-policy-20220124/policy/modules/system/systemd.te
 	apache_read_tmp_files(systemd_logind_t)
 ')
 
-@@ -868,6 +872,10 @@ optional_policy(`
+@@ -882,6 +886,10 @@ optional_policy(`
 	udev_read_pid_files(systemd_hostnamed_t)
 ')
 
@ -24,12 +24,3 @@ Index: fedora-policy-20220124/policy/modules/system/systemd.te
 #######################################
 #
 # rfkill policy
-@@ -1115,6 +1123,8 @@ optional_policy(`
- 	udev_read_pid_files(systemd_gpt_generator_t)
- ')
- 
-+udev_read_pid_files(systemd_gpt_generator_t)
-+
- #######################################
- #
- # systemd_resolved domain
--- a/fix_systemd_watch.patch
+++ b/fix_systemd_watch.patch
@ -1,8 +1,8 @@
-Index: fedora-policy-20220124/policy/modules/system/systemd.te
+Index: fedora-policy-20220428/policy/modules/system/systemd.te
 ===================================================================
--- fedora-policy-20220124.orig/policy/modules/system/systemd.te
-+++ fedora-policy-20220124/policy/modules/system/systemd.te
-@@ -1421,6 +1421,12 @@ fstools_rw_swap_files(systemd_sleep_t)
+--- fedora-policy-20220428.orig/policy/modules/system/systemd.te
+++ fedora-policy-20220428/policy/modules/system/systemd.te
+@@ -1445,6 +1445,12 @@ fstools_rw_swap_files(systemd_sleep_t)
 storage_getattr_fixed_disk_dev(systemd_sleep_t)
 storage_getattr_removable_dev(systemd_sleep_t)
 
--- a/fix_unprivuser.patch
+++ b/fix_unprivuser.patch
@ -1,8 +1,8 @@
-Index: fedora-policy-20210628/policy/modules/roles/unprivuser.te
+Index: fedora-policy-20220428/policy/modules/roles/unprivuser.te
 ===================================================================
--- fedora-policy-20210628.orig/policy/modules/roles/unprivuser.te
-+++ fedora-policy-20210628/policy/modules/roles/unprivuser.te
-@@ -287,6 +287,13 @@ ifndef(`distro_redhat',`
+--- fedora-policy-20220428.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20220428/policy/modules/roles/unprivuser.te
+@@ -292,6 +292,13 @@ ifndef(`distro_redhat',`
 ')
 
 optional_policy(`
--- a/fix_usermanage.patch
+++ b/fix_usermanage.patch
@ -1,7 +1,7 @@
-Index: fedora-policy-20210309/policy/modules/admin/usermanage.te
+Index: fedora-policy-20220428/policy/modules/admin/usermanage.te
 ===================================================================
--- fedora-policy-20210309.orig/policy/modules/admin/usermanage.te
-+++ fedora-policy-20210309/policy/modules/admin/usermanage.te
+--- fedora-policy-20220428.orig/policy/modules/admin/usermanage.te
+++ fedora-policy-20220428/policy/modules/admin/usermanage.te
@@ -226,6 +226,7 @@ allow groupadd_t self:unix_dgram_socket
 allow groupadd_t self:unix_stream_socket create_stream_socket_perms;
 allow groupadd_t self:unix_dgram_socket sendto;
@ -10,7 +10,7 @@ Index: fedora-policy-20210309/policy/modules/admin/usermanage.te
 
 fs_getattr_xattr_fs(groupadd_t)
 fs_search_auto_mountpoints(groupadd_t)
-@@ -529,6 +530,7 @@ allow useradd_t self:unix_dgram_socket c
+@@ -538,6 +539,7 @@ allow useradd_t self:unix_dgram_socket c
 allow useradd_t self:unix_stream_socket create_stream_socket_perms;
 allow useradd_t self:unix_dgram_socket sendto;
 allow useradd_t self:unix_stream_socket connectto;
@ -18,7 +18,7 @@ Index: fedora-policy-20210309/policy/modules/admin/usermanage.te
 
 manage_dirs_pattern(useradd_t, useradd_var_run_t, useradd_var_run_t)
 manage_files_pattern(useradd_t, useradd_var_run_t, useradd_var_run_t)
-@@ -537,6 +539,8 @@ files_pid_filetrans(useradd_t, useradd_v
+@@ -546,6 +548,8 @@ files_pid_filetrans(useradd_t, useradd_v
 # for getting the number of groups
 kernel_read_kernel_sysctls(useradd_t)
 
--- a/fix_wine.patch
+++ b/fix_wine.patch
@ -1,7 +1,7 @@
-Index: fedora-policy-20210716/policy/modules/system/libraries.fc
+Index: fedora-policy-20220428/policy/modules/system/libraries.fc
 ===================================================================
--- fedora-policy-20210716.orig/policy/modules/system/libraries.fc
-+++ fedora-policy-20210716/policy/modules/system/libraries.fc
+--- fedora-policy-20220428.orig/policy/modules/system/libraries.fc
+++ fedora-policy-20220428/policy/modules/system/libraries.fc
@@ -90,7 +90,7 @@ ifdef(`distro_redhat',`
 /opt/Adobe/Reader.?/Reader/intellinux/plug_ins/.*\.api -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 /opt/Adobe/Reader.?/Reader/intellinux/SPPlugins/.*\.ap[il] -- gen_context(system_u:object_r:lib_t,s0)
@ -12,7 +12,7 @@ Index: fedora-policy-20210716/policy/modules/system/libraries.fc
 /opt/ibm/java.*/jre/.+\.jar		--	gen_context(system_u:object_r:lib_t,s0)
 /opt/ibm/java.*/jre/.+\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -173,7 +173,8 @@ ifdef(`distro_redhat',`
- /usr/lib/systemd/libsystemd-shared-[0-9]+\.so.*	--	gen_context(system_u:object_r:lib_t,s0)
+ /usr/lib/systemd/libsystemd-.+\.so.*	--	gen_context(system_u:object_r:lib_t,s0)
 
 /usr/.*\.so(\.[^/]*)*		--	gen_context(system_u:object_r:lib_t,s0)
 -/usr/lib/wine/.+\.so	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
--- a/selinux-policy.changes
+++ b/selinux-policy.changes
@ -1,3 +1,19 @@
+-------------------------------------------------------------------
+Fri May 20 09:14:58 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
+
+- Update to version 20220428. Refreshed:
+  * fix_apache.patch
+  * fix_hadoop.patch
+  * fix_init.patch
+  * fix_iptables.patch
+  * fix_kernel_sysctl.patch
+  * fix_networkmanager.patch
+  * fix_systemd.patch
+  * fix_systemd_watch.patch
+  * fix_unprivuser.patch
+  * fix_usermanage.patch
+  * fix_wine.patch
+
 -------------------------------------------------------------------
 Thu May 19 12:25:31 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
 - Add fix_dnsmasq.patch to fix problems with virtualization on Microos
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@ -33,7 +33,7 @@ Summary:        SELinux policy configuration
 License:        GPL-2.0-or-later
 Group:          System/Management
 Name:           selinux-policy
-Version:        20220124
+Version:        20220428
 Release:        0
 Source:         fedora-policy-%{version}.tar.bz2
 Source1:        selinux-policy-rpmlintrc