diff --git a/fedora-policy-20211111.tar.bz2 b/fedora-policy-20211111.tar.bz2 deleted file mode 100644 index eb8aedb..0000000 --- a/fedora-policy-20211111.tar.bz2 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:92e84c558e4c1a8d389205ddfc1e8b00f8a872585f01e05a7650b15e55643f2a -size 714235 diff --git a/fedora-policy-20220124.tar.bz2 b/fedora-policy-20220124.tar.bz2 new file mode 100644 index 0000000..91d9636 --- /dev/null +++ b/fedora-policy-20220124.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:ebec268024dfd05d9563991a424d12892b0eb210d1eab2c484ae424f8fb757c5 +size 725506 diff --git a/fix_hadoop.patch b/fix_hadoop.patch index edc1bdc..4c24161 100644 --- a/fix_hadoop.patch +++ b/fix_hadoop.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20211111/policy/modules/roles/sysadm.te +Index: fedora-policy-20220124/policy/modules/roles/sysadm.te =================================================================== ---- fedora-policy-20211111.orig/policy/modules/roles/sysadm.te -+++ fedora-policy-20211111/policy/modules/roles/sysadm.te -@@ -311,10 +311,6 @@ optional_policy(` +--- fedora-policy-20220124.orig/policy/modules/roles/sysadm.te ++++ fedora-policy-20220124/policy/modules/roles/sysadm.te +@@ -315,10 +315,6 @@ optional_policy(` ') optional_policy(` @@ -13,10 +13,10 @@ Index: fedora-policy-20211111/policy/modules/roles/sysadm.te iotop_run(sysadm_t, sysadm_r) ') -Index: fedora-policy-20211111/policy/modules/roles/unprivuser.te +Index: fedora-policy-20220124/policy/modules/roles/unprivuser.te =================================================================== ---- fedora-policy-20211111.orig/policy/modules/roles/unprivuser.te -+++ fedora-policy-20211111/policy/modules/roles/unprivuser.te +--- fedora-policy-20220124.orig/policy/modules/roles/unprivuser.te ++++ fedora-policy-20220124/policy/modules/roles/unprivuser.te @@ -205,10 +205,6 @@ ifndef(`distro_redhat',` ') diff --git a/fix_hypervkvp.patch b/fix_hypervkvp.patch new file mode 100644 index 0000000..3cac649 --- /dev/null +++ b/fix_hypervkvp.patch @@ -0,0 +1,15 @@ +Index: fedora-policy-20220124/policy/modules/contrib/hypervkvp.fc +=================================================================== +--- fedora-policy-20220124.orig/policy/modules/contrib/hypervkvp.fc ++++ fedora-policy-20220124/policy/modules/contrib/hypervkvp.fc +@@ -3,8 +3,10 @@ + /usr/lib/systemd/system/hypervvssd.* -- gen_context(system_u:object_r:hypervvssd_unit_file_t,s0) + + /usr/sbin/hv_kvp_daemon -- gen_context(system_u:object_r:hypervkvp_exec_t,s0) ++/usr/lib/hyper-v/bin/.*kvp_daemon -- gen_context(system_u:object_r:hypervkvp_exec_t,s0) + /usr/sbin/hypervkvpd -- gen_context(system_u:object_r:hypervkvp_exec_t,s0) + + /usr/sbin/hypervvssd -- gen_context(system_u:object_r:hypervvssd_exec_t,s0) ++/usr/lib/hyper-v/bin/.*vss_daemon -- gen_context(system_u:object_r:hypervvssd_exec_t,s0) + + /var/lib/hyperv(/.*)? gen_context(system_u:object_r:hypervkvp_var_lib_t,s0) diff --git a/fix_init.patch b/fix_init.patch index 247dad3..18063b1 100644 --- a/fix_init.patch +++ b/fix_init.patch @@ -1,19 +1,7 @@ -Index: fedora-policy-20211111/policy/modules/system/init.if +Index: fedora-policy-20220124/policy/modules/system/init.te =================================================================== ---- fedora-policy-20211111.orig/policy/modules/system/init.if -+++ fedora-policy-20211111/policy/modules/system/init.if -@@ -3296,6 +3296,7 @@ interface(`init_filetrans_named_content' - files_etc_filetrans($1, machineid_t, file, "machine-id" ) - files_pid_filetrans($1, initctl_t, fifo_file, "fifo" ) - init_pid_filetrans($1, systemd_unit_file_t, dir, "generator") -+ init_pid_filetrans($1, systemd_unit_file_t, dir, "generator.late") - init_pid_filetrans($1, systemd_unit_file_t, dir, "system") - ') - -Index: fedora-policy-20211111/policy/modules/system/init.te -=================================================================== ---- fedora-policy-20211111.orig/policy/modules/system/init.te -+++ fedora-policy-20211111/policy/modules/system/init.te +--- fedora-policy-20220124.orig/policy/modules/system/init.te ++++ fedora-policy-20220124/policy/modules/system/init.te @@ -267,6 +267,8 @@ corecmd_exec_bin(init_t) corenet_all_recvfrom_netlabel(init_t) corenet_tcp_bind_all_ports(init_t) @@ -47,7 +35,7 @@ Index: fedora-policy-20211111/policy/modules/system/init.te bootloader_domtrans(init_t) ') -@@ -570,10 +578,10 @@ tunable_policy(`init_audit_control',` +@@ -571,10 +579,10 @@ tunable_policy(`init_audit_control',` allow init_t self:system all_system_perms; allow init_t self:system module_load; allow init_t self:unix_dgram_socket { create_socket_perms sendto }; @@ -60,7 +48,7 @@ Index: fedora-policy-20211111/policy/modules/system/init.te allow init_t self:netlink_selinux_socket create_socket_perms; allow init_t self:unix_dgram_socket lock; # Until systemd is fixed -@@ -631,6 +639,7 @@ files_delete_all_spool_sockets(init_t) +@@ -633,6 +641,7 @@ files_delete_all_spool_sockets(init_t) files_create_var_lib_dirs(init_t) files_create_var_lib_symlinks(init_t) files_read_var_lib_symlinks(init_t) @@ -68,7 +56,7 @@ Index: fedora-policy-20211111/policy/modules/system/init.te files_manage_urandom_seed(init_t) files_list_locks(init_t) files_list_spool(init_t) -@@ -667,7 +676,7 @@ fs_list_all(init_t) +@@ -669,7 +678,7 @@ fs_list_all(init_t) fs_list_auto_mountpoints(init_t) fs_register_binary_executable_type(init_t) fs_relabel_tmpfs_sock_file(init_t) @@ -77,7 +65,7 @@ Index: fedora-policy-20211111/policy/modules/system/init.te fs_relabel_cgroup_dirs(init_t) fs_search_cgroup_dirs(init_t) # for network namespaces -@@ -723,6 +732,7 @@ systemd_write_inherited_logind_sessions_ +@@ -725,6 +734,7 @@ systemd_write_inherited_logind_sessions_ create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type) create_dirs_pattern(init_t, var_log_t, var_log_t) @@ -85,7 +73,7 @@ Index: fedora-policy-20211111/policy/modules/system/init.te auth_use_nsswitch(init_t) auth_rw_login_records(init_t) -@@ -1568,6 +1578,8 @@ optional_policy(` +@@ -1571,6 +1581,8 @@ optional_policy(` optional_policy(` postfix_list_spool(initrc_t) diff --git a/fix_kernel_sysctl.patch b/fix_kernel_sysctl.patch index 8ed096e..7fb1b7e 100644 --- a/fix_kernel_sysctl.patch +++ b/fix_kernel_sysctl.patch @@ -1,7 +1,7 @@ -Index: fedora-policy-20211111/policy/modules/kernel/files.fc +Index: fedora-policy-20220124/policy/modules/kernel/files.fc =================================================================== ---- fedora-policy-20211111.orig/policy/modules/kernel/files.fc -+++ fedora-policy-20211111/policy/modules/kernel/files.fc +--- fedora-policy-20220124.orig/policy/modules/kernel/files.fc ++++ fedora-policy-20220124/policy/modules/kernel/files.fc @@ -236,6 +236,8 @@ ifdef(`distro_redhat',` /usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0) /usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0) @@ -11,11 +11,11 @@ Index: fedora-policy-20211111/policy/modules/kernel/files.fc /usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) -Index: fedora-policy-20211111/policy/modules/system/systemd.te +Index: fedora-policy-20220124/policy/modules/system/systemd.te =================================================================== ---- fedora-policy-20211111.orig/policy/modules/system/systemd.te -+++ fedora-policy-20211111/policy/modules/system/systemd.te -@@ -1035,6 +1035,8 @@ init_stream_connect(systemd_sysctl_t) +--- fedora-policy-20220124.orig/policy/modules/system/systemd.te ++++ fedora-policy-20220124/policy/modules/system/systemd.te +@@ -1037,6 +1037,8 @@ init_stream_connect(systemd_sysctl_t) logging_send_syslog_msg(systemd_sysctl_t) systemd_read_efivarfs(systemd_sysctl_t) diff --git a/fix_systemd.patch b/fix_systemd.patch index ae8dc7e..f923439 100644 --- a/fix_systemd.patch +++ b/fix_systemd.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20211111/policy/modules/system/systemd.te +Index: fedora-policy-20220124/policy/modules/system/systemd.te =================================================================== ---- fedora-policy-20211111.orig/policy/modules/system/systemd.te -+++ fedora-policy-20211111/policy/modules/system/systemd.te -@@ -352,6 +352,10 @@ userdom_manage_user_tmp_chr_files(system +--- fedora-policy-20220124.orig/policy/modules/system/systemd.te ++++ fedora-policy-20220124/policy/modules/system/systemd.te +@@ -353,6 +353,10 @@ userdom_manage_user_tmp_chr_files(system xserver_dbus_chat(systemd_logind_t) optional_policy(` @@ -13,7 +13,7 @@ Index: fedora-policy-20211111/policy/modules/system/systemd.te apache_read_tmp_files(systemd_logind_t) ') -@@ -866,6 +870,10 @@ optional_policy(` +@@ -868,6 +872,10 @@ optional_policy(` udev_read_pid_files(systemd_hostnamed_t) ') @@ -24,7 +24,7 @@ Index: fedora-policy-20211111/policy/modules/system/systemd.te ####################################### # # rfkill policy -@@ -1109,6 +1117,8 @@ optional_policy(` +@@ -1115,6 +1123,8 @@ optional_policy(` udev_read_pid_files(systemd_gpt_generator_t) ') diff --git a/fix_systemd_watch.patch b/fix_systemd_watch.patch index 6771ad7..8f6061d 100644 --- a/fix_systemd_watch.patch +++ b/fix_systemd_watch.patch @@ -1,8 +1,8 @@ -Index: fedora-policy-20211111/policy/modules/system/systemd.te +Index: fedora-policy-20220124/policy/modules/system/systemd.te =================================================================== ---- fedora-policy-20211111.orig/policy/modules/system/systemd.te -+++ fedora-policy-20211111/policy/modules/system/systemd.te -@@ -1415,6 +1415,12 @@ fstools_rw_swap_files(systemd_sleep_t) +--- fedora-policy-20220124.orig/policy/modules/system/systemd.te ++++ fedora-policy-20220124/policy/modules/system/systemd.te +@@ -1421,6 +1421,12 @@ fstools_rw_swap_files(systemd_sleep_t) storage_getattr_fixed_disk_dev(systemd_sleep_t) storage_getattr_removable_dev(systemd_sleep_t) diff --git a/selinux-policy.changes b/selinux-policy.changes index 87ce04b..d0049cd 100644 --- a/selinux-policy.changes +++ b/selinux-policy.changes @@ -1,3 +1,15 @@ +------------------------------------------------------------------- +Mon Jan 24 07:33:34 UTC 2022 - Johannes Segitz + +- Update to version 20220124. Refreshed: + * fix_hadoop.patch + * fix_init.patch + * fix_kernel_sysctl.patch + * fix_systemd.patch + * fix_systemd_watch.patch +- Added fix_hypervkvp.patch to fix issues with hyperv labeling + (bsc#1193987) + ------------------------------------------------------------------- Fri Jan 14 15:07:00 UTC 2022 - Johannes Segitz diff --git a/selinux-policy.spec b/selinux-policy.spec index 28271da..38c8223 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -33,7 +33,7 @@ Summary: SELinux policy configuration License: GPL-2.0-or-later Group: System/Management Name: selinux-policy -Version: 20211111 +Version: 20220124 Release: 0 Source: fedora-policy-%{version}.tar.bz2 Source1: selinux-policy-rpmlintrc @@ -138,6 +138,7 @@ Patch053: fix_systemd_watch.patch Patch054: fix_kernel_sysctl.patch Patch055: fix_auditd.patch Patch056: fix_wine.patch +Patch057: fix_hypervkvp.patch Patch100: sedoctool.patch