rpm/selinux-policy
SHA256
1
0
Fork 0
forked from pool/selinux-policy
Code Pull Requests Activity

Accepting request 909370 from security:SELinux

Browse Source 
OBS-URL: https://build.opensuse.org/request/show/909370
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/selinux-policy?expand=0&rev=15
This commit is contained in:
Dominique Leuenberger 2021-08-02 10:04:33 +00:00 committed by Git OBS Bridge
commit 25bc21e926
27 changed files with 161 additions and 207 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fedora-policy-20210419.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:ad36b63becbe4fb8a7ac5597b58360c8ebaf7f15ec6681d3170ec16dc2e7a650
size 721823

3
fedora-policy-20210716.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:c72911f7b3d31ad5988df36f18c96337a5870044fc42be38dc6bbdd9caa95682
size 710155

13
fix_cockpit.patch
View File

@ -9,11 +9,11 @@ cockpit.socket fails to start if kerberos_enabled=false
policy/modules/contrib/cockpit.te | 2 ++ policy/modules/contrib/cockpit.te | 2 ++
1 file changed, 2 insertions(+) 1 file changed, 2 insertions(+)
diff --git a/policy/modules/contrib/cockpit.te b/policy/modules/contrib/cockpit.te Index: fedora-policy-20210628/policy/modules/contrib/cockpit.te
index a160ca6b6..5984711fa 100644 ===================================================================
--- a/policy/modules/contrib/cockpit.te --- fedora-policy-20210628.orig/policy/modules/contrib/cockpit.te
+++ b/policy/modules/contrib/cockpit.te +++ fedora-policy-20210628/policy/modules/contrib/cockpit.te
@@ -52,7 +52,9 @@ can_exec(cockpit_ws_t,cockpit_session_exec_t) @@ -51,7 +51,9 @@ can_exec(cockpit_ws_t,cockpit_session_ex
dev_read_urand(cockpit_ws_t) # for authkey dev_read_urand(cockpit_ws_t) # for authkey
dev_read_rand(cockpit_ws_t) # for libssh dev_read_rand(cockpit_ws_t) # for libssh
@ -23,6 +23,3 @@ index a160ca6b6..5984711fa 100644
# cockpit-ws can connect to other hosts via ssh # cockpit-ws can connect to other hosts via ssh
corenet_tcp_connect_ssh_port(cockpit_ws_t) corenet_tcp_connect_ssh_port(cockpit_ws_t)
--
2.26.2

9
fix_gift.patch
View File

@ -1,9 +0,0 @@
Index: fedora-policy/policy/modules/contrib/gift.te
===================================================================
--- fedora-policy.orig/policy/modules/contrib/gift.te 2019-08-05 09:39:48.645670248 +0200
+++ fedora-policy/policy/modules/contrib/gift.te 2019-08-05 10:05:44.787808191 +0200
@@ -113,4 +113,3 @@ files_read_etc_runtime_files(giftd_t)
sysnet_dns_name_resolve(giftd_t)
userdom_use_inherited_user_terminals(giftd_t)
-userdom_home_manager(gitd_t)

16
fix_hadoop.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20210419/policy/modules/roles/sysadm.te Index: fedora-policy-20210628/policy/modules/roles/sysadm.te
=================================================================== ===================================================================
--- fedora-policy-20210419.orig/policy/modules/roles/sysadm.te --- fedora-policy-20210628.orig/policy/modules/roles/sysadm.te
+++ fedora-policy-20210419/policy/modules/roles/sysadm.te +++ fedora-policy-20210628/policy/modules/roles/sysadm.te
@@ -298,10 +298,6 @@ optional_policy(` @@ -295,10 +295,6 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -13,11 +13,11 @@ Index: fedora-policy-20210419/policy/modules/roles/sysadm.te
iotop_run(sysadm_t, sysadm_r) iotop_run(sysadm_t, sysadm_r)
') ')
Index: fedora-policy-20210419/policy/modules/roles/unprivuser.te Index: fedora-policy-20210628/policy/modules/roles/unprivuser.te
=================================================================== ===================================================================
--- fedora-policy-20210419.orig/policy/modules/roles/unprivuser.te --- fedora-policy-20210628.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20210419/policy/modules/roles/unprivuser.te +++ fedora-policy-20210628/policy/modules/roles/unprivuser.te
@@ -209,10 +209,6 @@ ifndef(`distro_redhat',` @@ -205,10 +205,6 @@ ifndef(`distro_redhat',`
') ')
optional_policy(` optional_policy(`

31
fix_init.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20210419/policy/modules/system/init.if Index: fedora-policy-20210716/policy/modules/system/init.if
=================================================================== ===================================================================
--- fedora-policy-20210419.orig/policy/modules/system/init.if --- fedora-policy-20210716.orig/policy/modules/system/init.if
+++ fedora-policy-20210419/policy/modules/system/init.if +++ fedora-policy-20210716/policy/modules/system/init.if
@@ -3242,6 +3242,7 @@ interface(`init_filetrans_named_content' @@ -3296,6 +3296,7 @@ interface(`init_filetrans_named_content'
files_etc_filetrans($1, machineid_t, file, "machine-id" ) files_etc_filetrans($1, machineid_t, file, "machine-id" )
files_pid_filetrans($1, initctl_t, fifo_file, "fifo" ) files_pid_filetrans($1, initctl_t, fifo_file, "fifo" )
init_pid_filetrans($1, systemd_unit_file_t, dir, "generator") init_pid_filetrans($1, systemd_unit_file_t, dir, "generator")
@ -10,11 +10,11 @@ Index: fedora-policy-20210419/policy/modules/system/init.if
init_pid_filetrans($1, systemd_unit_file_t, dir, "system") init_pid_filetrans($1, systemd_unit_file_t, dir, "system")
') ')
Index: fedora-policy-20210419/policy/modules/system/init.te Index: fedora-policy-20210716/policy/modules/system/init.te
=================================================================== ===================================================================
--- fedora-policy-20210419.orig/policy/modules/system/init.te --- fedora-policy-20210716.orig/policy/modules/system/init.te
+++ fedora-policy-20210419/policy/modules/system/init.te +++ fedora-policy-20210716/policy/modules/system/init.te
@@ -269,6 +269,8 @@ corecmd_exec_bin(init_t) @@ -267,6 +267,8 @@ corecmd_exec_bin(init_t)
corenet_all_recvfrom_netlabel(init_t) corenet_all_recvfrom_netlabel(init_t)
corenet_tcp_bind_all_ports(init_t) corenet_tcp_bind_all_ports(init_t)
corenet_udp_bind_all_ports(init_t) corenet_udp_bind_all_ports(init_t)
@ -23,7 +23,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
dev_create_all_files(init_t) dev_create_all_files(init_t)
dev_create_all_chr_files(init_t) dev_create_all_chr_files(init_t)
@@ -397,6 +399,7 @@ logging_manage_audit_config(init_t) @@ -391,6 +393,7 @@ logging_manage_audit_config(init_t)
logging_create_syslog_netlink_audit_socket(init_t) logging_create_syslog_netlink_audit_socket(init_t)
logging_write_var_log_dirs(init_t) logging_write_var_log_dirs(init_t)
logging_manage_var_log_symlinks(init_t) logging_manage_var_log_symlinks(init_t)
@ -31,14 +31,13 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
seutil_read_config(init_t) seutil_read_config(init_t)
seutil_read_login_config(init_t) seutil_read_login_config(init_t)
@@ -446,11 +449,16 @@ ifdef(`distro_redhat',` @@ -441,10 +444,15 @@ ifdef(`distro_redhat',`
corecmd_shell_domtrans(init_t, initrc_t) corecmd_shell_domtrans(init_t, initrc_t)
storage_raw_rw_fixed_disk(init_t) storage_raw_rw_fixed_disk(init_t)
+storage_raw_read_removable_device(init_t) +storage_raw_read_removable_device(init_t)
sysnet_read_dhcpc_state(init_t) sysnet_read_dhcpc_state(init_t)
sysnet_watch_config(init_t)
optional_policy(` optional_policy(`
+ networkmanager_initrc_read_lnk_files(init_t) + networkmanager_initrc_read_lnk_files(init_t)
@ -48,7 +47,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
bootloader_domtrans(init_t) bootloader_domtrans(init_t)
') ')
@@ -568,10 +576,10 @@ tunable_policy(`init_audit_control',` @@ -562,10 +570,10 @@ tunable_policy(`init_audit_control',`
allow init_t self:system all_system_perms; allow init_t self:system all_system_perms;
allow init_t self:system module_load; allow init_t self:system module_load;
allow init_t self:unix_dgram_socket { create_socket_perms sendto }; allow init_t self:unix_dgram_socket { create_socket_perms sendto };
@ -61,7 +60,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
allow init_t self:netlink_selinux_socket create_socket_perms; allow init_t self:netlink_selinux_socket create_socket_perms;
allow init_t self:unix_dgram_socket lock; allow init_t self:unix_dgram_socket lock;
# Until systemd is fixed # Until systemd is fixed
@@ -629,6 +637,7 @@ files_delete_all_spool_sockets(init_t) @@ -623,6 +631,7 @@ files_delete_all_spool_sockets(init_t)
files_create_var_lib_dirs(init_t) files_create_var_lib_dirs(init_t)
files_create_var_lib_symlinks(init_t) files_create_var_lib_symlinks(init_t)
files_read_var_lib_symlinks(init_t) files_read_var_lib_symlinks(init_t)
@ -69,7 +68,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
files_manage_urandom_seed(init_t) files_manage_urandom_seed(init_t)
files_list_locks(init_t) files_list_locks(init_t)
files_list_spool(init_t) files_list_spool(init_t)
@@ -665,7 +674,7 @@ fs_list_all(init_t) @@ -659,7 +668,7 @@ fs_list_all(init_t)
fs_list_auto_mountpoints(init_t) fs_list_auto_mountpoints(init_t)
fs_register_binary_executable_type(init_t) fs_register_binary_executable_type(init_t)
fs_relabel_tmpfs_sock_file(init_t) fs_relabel_tmpfs_sock_file(init_t)
@ -78,7 +77,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
fs_relabel_cgroup_dirs(init_t) fs_relabel_cgroup_dirs(init_t)
fs_search_cgroup_dirs(init_t) fs_search_cgroup_dirs(init_t)
# for network namespaces # for network namespaces
@@ -721,6 +730,7 @@ systemd_write_inherited_logind_sessions_ @@ -715,6 +724,7 @@ systemd_write_inherited_logind_sessions_
create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type) create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
create_dirs_pattern(init_t, var_log_t, var_log_t) create_dirs_pattern(init_t, var_log_t, var_log_t)
@ -86,7 +85,7 @@ Index: fedora-policy-20210419/policy/modules/system/init.te
auth_use_nsswitch(init_t) auth_use_nsswitch(init_t)
auth_rw_login_records(init_t) auth_rw_login_records(init_t)
@@ -1574,6 +1584,8 @@ optional_policy(` @@ -1556,6 +1566,8 @@ optional_policy(`
optional_policy(` optional_policy(`
postfix_list_spool(initrc_t) postfix_list_spool(initrc_t)

14
fix_logging.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20210309/policy/modules/system/logging.fc Index: fedora-policy-20210628/policy/modules/system/logging.fc
=================================================================== ===================================================================
--- fedora-policy-20210309.orig/policy/modules/system/logging.fc --- fedora-policy-20210628.orig/policy/modules/system/logging.fc
+++ fedora-policy-20210309/policy/modules/system/logging.fc +++ fedora-policy-20210628/policy/modules/system/logging.fc
@@ -3,6 +3,8 @@ @@ -3,6 +3,8 @@
/etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
@ -19,11 +19,11 @@ Index: fedora-policy-20210309/policy/modules/system/logging.fc
/var/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) /var/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
/var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh) /var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh)
Index: fedora-policy-20210309/policy/modules/system/logging.if Index: fedora-policy-20210628/policy/modules/system/logging.if
=================================================================== ===================================================================
--- fedora-policy-20210309.orig/policy/modules/system/logging.if --- fedora-policy-20210628.orig/policy/modules/system/logging.if
+++ fedora-policy-20210309/policy/modules/system/logging.if +++ fedora-policy-20210628/policy/modules/system/logging.if
@@ -1722,3 +1722,22 @@ interface(`logging_dgram_send',` @@ -1782,3 +1782,22 @@ interface(`logging_dgram_send',`
allow $1 syslogd_t:unix_dgram_socket sendto; allow $1 syslogd_t:unix_dgram_socket sendto;
') ')

8
fix_logrotate.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy/policy/modules/contrib/logrotate.te Index: fedora-policy-20210628/policy/modules/contrib/logrotate.te
=================================================================== ===================================================================
--- fedora-policy.orig/policy/modules/contrib/logrotate.te --- fedora-policy-20210628.orig/policy/modules/contrib/logrotate.te
+++ fedora-policy/policy/modules/contrib/logrotate.te +++ fedora-policy-20210628/policy/modules/contrib/logrotate.te
@@ -107,6 +107,7 @@ files_var_lib_filetrans(logrotate_t, log @@ -104,6 +104,7 @@ files_var_lib_filetrans(logrotate_t, log
kernel_read_system_state(logrotate_t) kernel_read_system_state(logrotate_t)
kernel_read_kernel_sysctls(logrotate_t) kernel_read_kernel_sysctls(logrotate_t)

24
fix_networkmanager.patch
View File

@ -1,16 +1,8 @@
Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.te Index: fedora-policy-20210628/policy/modules/contrib/networkmanager.te
=================================================================== ===================================================================
--- fedora-policy-20210419.orig/policy/modules/contrib/networkmanager.te --- fedora-policy-20210628.orig/policy/modules/contrib/networkmanager.te
+++ fedora-policy-20210419/policy/modules/contrib/networkmanager.te +++ fedora-policy-20210628/policy/modules/contrib/networkmanager.te
@@ -97,6 +97,7 @@ read_files_pattern(NetworkManager_t, Net @@ -243,6 +243,9 @@ userdom_read_home_certs(NetworkManager_t
read_lnk_files_pattern(NetworkManager_t, NetworkManager_initrc_exec_t, NetworkManager_initrc_exec_t)
list_dirs_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t)
+watch_dirs_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t)
read_files_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t)
read_lnk_files_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_t)
@@ -241,6 +242,9 @@ userdom_read_home_certs(NetworkManager_t
userdom_read_user_home_content_files(NetworkManager_t) userdom_read_user_home_content_files(NetworkManager_t)
userdom_dgram_send(NetworkManager_t) userdom_dgram_send(NetworkManager_t)
@ -20,7 +12,7 @@ Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.te
tunable_policy(`use_nfs_home_dirs',` tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(NetworkManager_t) fs_read_nfs_files(NetworkManager_t)
') ')
@@ -258,6 +262,14 @@ optional_policy(` @@ -260,6 +263,14 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -35,10 +27,10 @@ Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.te
bind_domtrans(NetworkManager_t) bind_domtrans(NetworkManager_t)
bind_manage_cache(NetworkManager_t) bind_manage_cache(NetworkManager_t)
bind_kill(NetworkManager_t) bind_kill(NetworkManager_t)
Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.if Index: fedora-policy-20210628/policy/modules/contrib/networkmanager.if
=================================================================== ===================================================================
--- fedora-policy-20210419.orig/policy/modules/contrib/networkmanager.if --- fedora-policy-20210628.orig/policy/modules/contrib/networkmanager.if
+++ fedora-policy-20210419/policy/modules/contrib/networkmanager.if +++ fedora-policy-20210628/policy/modules/contrib/networkmanager.if
@@ -114,6 +114,24 @@ interface(`networkmanager_initrc_domtran @@ -114,6 +114,24 @@ interface(`networkmanager_initrc_domtran
init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t) init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t)
') ')

14
fix_nscd.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20210309/policy/modules/contrib/nscd.fc Index: fedora-policy-20210628/policy/modules/contrib/nscd.fc
=================================================================== ===================================================================
--- fedora-policy-20210309.orig/policy/modules/contrib/nscd.fc --- fedora-policy-20210628.orig/policy/modules/contrib/nscd.fc
+++ fedora-policy-20210309/policy/modules/contrib/nscd.fc +++ fedora-policy-20210628/policy/modules/contrib/nscd.fc
@@ -8,8 +8,10 @@ @@ -8,8 +8,10 @@
/var/log/nscd\.log.* -- gen_context(system_u:object_r:nscd_log_t,s0) /var/log/nscd\.log.* -- gen_context(system_u:object_r:nscd_log_t,s0)
@ -14,11 +14,11 @@ Index: fedora-policy-20210309/policy/modules/contrib/nscd.fc
/usr/lib/systemd/system/nscd\.service -- gen_context(system_u:object_r:nscd_unit_file_t,s0) /usr/lib/systemd/system/nscd\.service -- gen_context(system_u:object_r:nscd_unit_file_t,s0)
+ +
Index: fedora-policy-20210309/policy/modules/contrib/nscd.te Index: fedora-policy-20210628/policy/modules/contrib/nscd.te
=================================================================== ===================================================================
--- fedora-policy-20210309.orig/policy/modules/contrib/nscd.te --- fedora-policy-20210628.orig/policy/modules/contrib/nscd.te
+++ fedora-policy-20210309/policy/modules/contrib/nscd.te +++ fedora-policy-20210628/policy/modules/contrib/nscd.te
@@ -131,6 +131,14 @@ userdom_dontaudit_use_unpriv_user_fds(ns @@ -130,6 +130,14 @@ userdom_dontaudit_use_unpriv_user_fds(ns
userdom_dontaudit_search_user_home_dirs(nscd_t) userdom_dontaudit_search_user_home_dirs(nscd_t)
optional_policy(` optional_policy(`

20
fix_rpm.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20210309/policy/modules/contrib/rpm.fc Index: fedora-policy-20210628/policy/modules/contrib/rpm.fc
=================================================================== ===================================================================
--- fedora-policy-20210309.orig/policy/modules/contrib/rpm.fc --- fedora-policy-20210628.orig/policy/modules/contrib/rpm.fc
+++ fedora-policy-20210309/policy/modules/contrib/rpm.fc +++ fedora-policy-20210628/policy/modules/contrib/rpm.fc
@@ -18,6 +18,10 @@ @@ -18,6 +18,10 @@
/usr/bin/repoquery -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/bin/repoquery -- gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/bin/zif -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/bin/zif -- gen_context(system_u:object_r:rpm_exec_t,s0)
@ -22,11 +22,11 @@ Index: fedora-policy-20210309/policy/modules/contrib/rpm.fc
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
/var/lib/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) /var/lib/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
/var/lib/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) /var/lib/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
Index: fedora-policy-20210309/policy/modules/contrib/rpm.if Index: fedora-policy-20210628/policy/modules/contrib/rpm.if
=================================================================== ===================================================================
--- fedora-policy-20210309.orig/policy/modules/contrib/rpm.if --- fedora-policy-20210628.orig/policy/modules/contrib/rpm.if
+++ fedora-policy-20210309/policy/modules/contrib/rpm.if +++ fedora-policy-20210628/policy/modules/contrib/rpm.if
@@ -476,8 +476,10 @@ interface(`rpm_named_filetrans',` @@ -479,8 +479,10 @@ interface(`rpm_named_filetrans',`
logging_log_named_filetrans($1, rpm_log_t, file, "yum.log") logging_log_named_filetrans($1, rpm_log_t, file, "yum.log")
logging_log_named_filetrans($1, rpm_log_t, file, "hawkey.log") logging_log_named_filetrans($1, rpm_log_t, file, "hawkey.log")
logging_log_named_filetrans($1, rpm_log_t, file, "up2date") logging_log_named_filetrans($1, rpm_log_t, file, "up2date")
@ -37,10 +37,10 @@ Index: fedora-policy-20210309/policy/modules/contrib/rpm.if
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "dnf") files_var_lib_filetrans($1, rpm_var_lib_t, dir, "dnf")
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "yum") files_var_lib_filetrans($1, rpm_var_lib_t, dir, "yum")
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpm") files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpm")
Index: fedora-policy-20210309/policy/modules/kernel/files.fc Index: fedora-policy-20210628/policy/modules/kernel/files.fc
=================================================================== ===================================================================
--- fedora-policy-20210309.orig/policy/modules/kernel/files.fc --- fedora-policy-20210628.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20210309/policy/modules/kernel/files.fc +++ fedora-policy-20210628/policy/modules/kernel/files.fc
@@ -67,6 +67,7 @@ ifdef(`distro_suse',` @@ -67,6 +67,7 @@ ifdef(`distro_suse',`
/etc/sysconfig/ipvsadm.* -- gen_context(system_u:object_r:system_conf_t,s0) /etc/sysconfig/ipvsadm.* -- gen_context(system_u:object_r:system_conf_t,s0)
/etc/sysconfig/system-config-firewall.* -- gen_context(system_u:object_r:system_conf_t,s0) /etc/sysconfig/system-config-firewall.* -- gen_context(system_u:object_r:system_conf_t,s0)

16
fix_selinuxutil.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20210309/policy/modules/system/selinuxutil.te Index: fedora-policy-20210628/policy/modules/system/selinuxutil.te
=================================================================== ===================================================================
--- fedora-policy-20210309.orig/policy/modules/system/selinuxutil.te --- fedora-policy-20210628.orig/policy/modules/system/selinuxutil.te
+++ fedora-policy-20210309/policy/modules/system/selinuxutil.te +++ fedora-policy-20210628/policy/modules/system/selinuxutil.te
@@ -238,6 +238,10 @@ ifdef(`hide_broken_symptoms',` @@ -238,6 +238,10 @@ ifdef(`hide_broken_symptoms',`
') ')
@ -13,7 +13,7 @@ Index: fedora-policy-20210309/policy/modules/system/selinuxutil.te
portage_dontaudit_use_fds(load_policy_t) portage_dontaudit_use_fds(load_policy_t)
') ')
@@ -619,6 +623,10 @@ logging_send_audit_msgs(setfiles_t) @@ -618,6 +622,10 @@ logging_send_audit_msgs(setfiles_t)
logging_send_syslog_msg(setfiles_t) logging_send_syslog_msg(setfiles_t)
optional_policy(` optional_policy(`
@ -24,11 +24,11 @@ Index: fedora-policy-20210309/policy/modules/system/selinuxutil.te
cloudform_dontaudit_write_cloud_log(setfiles_t) cloudform_dontaudit_write_cloud_log(setfiles_t)
') ')
Index: fedora-policy-20210309/policy/modules/system/selinuxutil.if Index: fedora-policy-20210628/policy/modules/system/selinuxutil.if
=================================================================== ===================================================================
--- fedora-policy-20210309.orig/policy/modules/system/selinuxutil.if --- fedora-policy-20210628.orig/policy/modules/system/selinuxutil.if
+++ fedora-policy-20210309/policy/modules/system/selinuxutil.if +++ fedora-policy-20210628/policy/modules/system/selinuxutil.if
@@ -777,6 +777,8 @@ interface(`seutil_dontaudit_read_config' @@ -795,6 +795,8 @@ interface(`seutil_dontaudit_read_config'
dontaudit $1 selinux_config_t:dir search_dir_perms; dontaudit $1 selinux_config_t:dir search_dir_perms;
dontaudit $1 selinux_config_t:file read_file_perms; dontaudit $1 selinux_config_t:file read_file_perms;

8
fix_systemd.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20210309/policy/modules/system/systemd.te Index: fedora-policy-20210628/policy/modules/system/systemd.te
=================================================================== ===================================================================
--- fedora-policy-20210309.orig/policy/modules/system/systemd.te --- fedora-policy-20210628.orig/policy/modules/system/systemd.te
+++ fedora-policy-20210309/policy/modules/system/systemd.te +++ fedora-policy-20210628/policy/modules/system/systemd.te
@@ -347,6 +347,10 @@ userdom_manage_user_tmp_chr_files(system @@ -347,6 +347,10 @@ userdom_manage_user_tmp_chr_files(system
xserver_dbus_chat(systemd_logind_t) xserver_dbus_chat(systemd_logind_t)
@ -13,7 +13,7 @@ Index: fedora-policy-20210309/policy/modules/system/systemd.te
apache_read_tmp_files(systemd_logind_t) apache_read_tmp_files(systemd_logind_t)
') ')
@@ -853,6 +857,10 @@ optional_policy(` @@ -854,6 +858,10 @@ optional_policy(`
udev_read_pid_files(systemd_hostnamed_t) udev_read_pid_files(systemd_hostnamed_t)
') ')

39
fix_systemd_watch.patch
View File

@ -1,38 +1,17 @@
Index: fedora-policy-20210419/policy/modules/system/systemd.te Index: fedora-policy-20210716/policy/modules/system/systemd.te
=================================================================== ===================================================================
--- fedora-policy-20210419.orig/policy/modules/system/systemd.te --- fedora-policy-20210716.orig/policy/modules/system/systemd.te
+++ fedora-policy-20210419/policy/modules/system/systemd.te +++ fedora-policy-20210716/policy/modules/system/systemd.te
@@ -1357,3 +1357,10 @@ fstools_rw_swap_files(systemd_sleep_t) @@ -1396,6 +1396,12 @@ fstools_rw_swap_files(systemd_sleep_t)
# systemd-sleep needs to getattr swap partitions # systemd-sleep needs to getattr swap partitions
storage_getattr_fixed_disk_dev(systemd_sleep_t) storage_getattr_fixed_disk_dev(systemd_sleep_t)
+
+
+####################################### +#######################################
+# +#
+# Allow systemd to watch certificate dir for ca-certificates +# Allow systemd to watch certificate dir for ca-certificates
+# +#
+watch_dirs_pattern(init_t,cert_t,cert_t) +watch_dirs_pattern(init_t,cert_t,cert_t)
Index: fedora-policy-20210419/policy/modules/system/init.te +
=================================================================== optional_policy(`
--- fedora-policy-20210419.orig/policy/modules/system/init.te sysstat_domtrans(systemd_sleep_t)
+++ fedora-policy-20210419/policy/modules/system/init.te ')
@@ -317,7 +317,10 @@ files_etc_filetrans_etc_runtime(init_t,
# Run /etc/X11/prefdm:
files_exec_etc_files(init_t)
files_watch_etc_dirs(init_t)
+files_watch_etc_files(init_t)
files_read_usr_files(init_t)
+files_watch_usr_dirs(init_t)
+files_watch_usr_files(init_t)
files_watch_root_dirs(init_t)
files_write_root_dirs(init_t)
files_watch_var_dirs(init_t)
@@ -334,6 +337,7 @@ files_remount_rootfs(init_t)
files_create_var_dirs(init_t)
files_watch_home(init_t)
files_watch_all_pid(init_t)
+watch_dirs_pattern(init_t,lib_t,lib_t)
fs_list_inotifyfs(init_t)
# cjp: this may be related to /dev/log

8
fix_thunderbird.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy/policy/modules/contrib/thunderbird.te Index: fedora-policy-20210628/policy/modules/contrib/thunderbird.te
=================================================================== ===================================================================
--- fedora-policy.orig/policy/modules/contrib/thunderbird.te --- fedora-policy-20210628.orig/policy/modules/contrib/thunderbird.te
+++ fedora-policy/policy/modules/contrib/thunderbird.te +++ fedora-policy-20210628/policy/modules/contrib/thunderbird.te
@@ -139,7 +139,6 @@ optional_policy(` @@ -138,7 +138,6 @@ optional_policy(`
optional_policy(` optional_policy(`
gnome_stream_connect_gconf(thunderbird_t) gnome_stream_connect_gconf(thunderbird_t)
gnome_domtrans_gconfd(thunderbird_t) gnome_domtrans_gconfd(thunderbird_t)

8
fix_unconfined.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy/policy/modules/system/unconfined.te Index: fedora-policy-20210628/policy/modules/system/unconfined.te
=================================================================== ===================================================================
--- fedora-policy.orig/policy/modules/system/unconfined.te --- fedora-policy-20210628.orig/policy/modules/system/unconfined.te
+++ fedora-policy/policy/modules/system/unconfined.te +++ fedora-policy-20210628/policy/modules/system/unconfined.te
@@ -1,5 +1,10 @@ @@ -1,5 +1,10 @@
policy_module(unconfined, 3.5.0) policy_module(unconfined, 3.5.0)
@ -13,7 +13,7 @@ Index: fedora-policy/policy/modules/system/unconfined.te
######################################## ########################################
# #
# Declarations # Declarations
@@ -39,3 +44,6 @@ optional_policy(` @@ -41,3 +46,6 @@ optional_policy(`
optional_policy(` optional_policy(`
container_runtime_domtrans(unconfined_service_t) container_runtime_domtrans(unconfined_service_t)
') ')

14
fix_unconfineduser.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20210419/policy/modules/roles/unconfineduser.te Index: fedora-policy-20210628/policy/modules/roles/unconfineduser.te
=================================================================== ===================================================================
--- fedora-policy-20210419.orig/policy/modules/roles/unconfineduser.te --- fedora-policy-20210628.orig/policy/modules/roles/unconfineduser.te
+++ fedora-policy-20210419/policy/modules/roles/unconfineduser.te +++ fedora-policy-20210628/policy/modules/roles/unconfineduser.te
@@ -124,6 +124,11 @@ tunable_policy(`unconfined_dyntrans_all' @@ -126,6 +126,11 @@ tunable_policy(`unconfined_dyntrans_all'
domain_dyntrans(unconfined_t) domain_dyntrans(unconfined_t)
') ')
@ -14,7 +14,7 @@ Index: fedora-policy-20210419/policy/modules/roles/unconfineduser.te
optional_policy(` optional_policy(`
gen_require(` gen_require(`
type unconfined_t; type unconfined_t;
@@ -214,6 +219,10 @@ optional_policy(` @@ -212,6 +217,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -25,7 +25,7 @@ Index: fedora-policy-20210419/policy/modules/roles/unconfineduser.te
chrome_role_notrans(unconfined_r, unconfined_t) chrome_role_notrans(unconfined_r, unconfined_t)
tunable_policy(`unconfined_chrome_sandbox_transition',` tunable_policy(`unconfined_chrome_sandbox_transition',`
@@ -248,6 +257,18 @@ optional_policy(` @@ -246,6 +255,18 @@ optional_policy(`
dbus_stub(unconfined_t) dbus_stub(unconfined_t)
optional_policy(` optional_policy(`
@ -44,7 +44,7 @@ Index: fedora-policy-20210419/policy/modules/roles/unconfineduser.te
bluetooth_dbus_chat(unconfined_t) bluetooth_dbus_chat(unconfined_t)
') ')
@@ -311,6 +332,10 @@ optional_policy(` @@ -309,6 +330,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`

8
fix_unprivuser.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20210419/policy/modules/roles/unprivuser.te Index: fedora-policy-20210628/policy/modules/roles/unprivuser.te
=================================================================== ===================================================================
--- fedora-policy-20210419.orig/policy/modules/roles/unprivuser.te --- fedora-policy-20210628.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20210419/policy/modules/roles/unprivuser.te +++ fedora-policy-20210628/policy/modules/roles/unprivuser.te
@@ -291,6 +291,13 @@ ifndef(`distro_redhat',` @@ -287,6 +287,13 @@ ifndef(`distro_redhat',`
') ')
optional_policy(` optional_policy(`

16
fix_xserver.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy/policy/modules/services/xserver.fc Index: fedora-policy-20210628/policy/modules/services/xserver.fc
=================================================================== ===================================================================
--- fedora-policy.orig/policy/modules/services/xserver.fc --- fedora-policy-20210628.orig/policy/modules/services/xserver.fc
+++ fedora-policy/policy/modules/services/xserver.fc +++ fedora-policy-20210628/policy/modules/services/xserver.fc
@@ -71,6 +71,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_ @@ -71,6 +71,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
/etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0) /etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0)
@ -18,7 +18,7 @@ Index: fedora-policy/policy/modules/services/xserver.fc
/usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0) /usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0) /usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
/usr/bin/razor-lightdm-.* -- gen_context(system_u:object_r:xdm_exec_t,s0) /usr/bin/razor-lightdm-.* -- gen_context(system_u:object_r:xdm_exec_t,s0)
@@ -135,6 +137,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_ @@ -136,6 +138,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
/usr/X11R6/lib/X11/xkb -d gen_context(system_u:object_r:xkb_var_lib_t,s0) /usr/X11R6/lib/X11/xkb -d gen_context(system_u:object_r:xkb_var_lib_t,s0)
/usr/X11R6/lib/X11/xkb/.* -- gen_context(system_u:object_r:xkb_var_lib_t,s0) /usr/X11R6/lib/X11/xkb/.* -- gen_context(system_u:object_r:xkb_var_lib_t,s0)
@ -26,11 +26,11 @@ Index: fedora-policy/policy/modules/services/xserver.fc
ifndef(`distro_debian',` ifndef(`distro_debian',`
/usr/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0) /usr/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
') ')
Index: fedora-policy/policy/modules/services/xserver.te Index: fedora-policy-20210628/policy/modules/services/xserver.te
=================================================================== ===================================================================
--- fedora-policy.orig/policy/modules/services/xserver.te --- fedora-policy-20210628.orig/policy/modules/services/xserver.te
+++ fedora-policy/policy/modules/services/xserver.te +++ fedora-policy-20210628/policy/modules/services/xserver.te
@@ -477,6 +477,10 @@ userdom_delete_user_home_content_files(x @@ -473,6 +473,10 @@ userdom_delete_user_home_content_files(x
userdom_signull_unpriv_users(xdm_t) userdom_signull_unpriv_users(xdm_t)
userdom_dontaudit_read_admin_home_lnk_files(xdm_t) userdom_dontaudit_read_admin_home_lnk_files(xdm_t)

7
modules-targeted-base.conf
View File

@ -412,10 +412,3 @@ rtorrent = module
# Policy for wicked # Policy for wicked
# #
wicked = module wicked = module
# Layer: contrib
# Module: tabrmd
#
# Policy for tabrmd
#
tabrmd = module

41
selinux-policy.changes
View File

@ -1,3 +1,20 @@
-------------------------------------------------------------------
Fri Jul 16 07:11:57 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Update to version 20210716
- Remove interfaces for container module before building the package
(bsc#1188184)
- Updated
* fix_init.patch
* fix_systemd_watch.patch
to adapt to upstream changes
-------------------------------------------------------------------
Thu Jul 15 15:45:57 UTC 2021 - Callum Farmer <gmbr3@opensuse.org>
- Use tabrmd SELinux modules from tpm2.0-abrmd instead of storing
here
------------------------------------------------------------------- -------------------------------------------------------------------
Tue Jul 6 13:55:19 UTC 2021 - Alberto Planas Dominguez <aplanas@suse.com> Tue Jul 6 13:55:19 UTC 2021 - Alberto Planas Dominguez <aplanas@suse.com>
@ -5,6 +22,30 @@ Tue Jul 6 13:55:19 UTC 2021 - Alberto Planas Dominguez <aplanas@suse.com>
https://github.com/tpm2-software/tpm2-abrmd/tree/master/selinux https://github.com/tpm2-software/tpm2-abrmd/tree/master/selinux
- Automatic spec-cleaner to fix ordering and misaligned spaces - Automatic spec-cleaner to fix ordering and misaligned spaces
-------------------------------------------------------------------
Mon Jun 28 08:11:25 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Update to version 20210419
- Dropped fix_gift.patch, module was removed
- Updated wicked.te to removed dropped interface
- Refreshed:
* fix_cockpit.patch
* fix_hadoop.patch
* fix_init.patch
* fix_logging.patch
* fix_logrotate.patch
* fix_networkmanager.patch
* fix_nscd.patch
* fix_rpm.patch
* fix_selinuxutil.patch
* fix_systemd.patch
* fix_systemd_watch.patch
* fix_thunderbird.patch
* fix_unconfined.patch
* fix_unconfineduser.patch
* fix_unprivuser.patch
* fix_xserver.patch
------------------------------------------------------------------- -------------------------------------------------------------------
Tue May 18 11:10:59 UTC 2021 - Ludwig Nussel <lnussel@suse.de> Tue May 18 11:10:59 UTC 2021 - Ludwig Nussel <lnussel@suse.de>

10
selinux-policy.spec
View File

@ -33,7 +33,7 @@ Summary: SELinux policy configuration
License: GPL-2.0-or-later License: GPL-2.0-or-later
Group: System/Management Group: System/Management
Name: selinux-policy Name: selinux-policy
Version: 20210419 Version: 20210716
Release: 0 Release: 0
Source: fedora-policy-%{version}.tar.bz2 Source: fedora-policy-%{version}.tar.bz2
Source1: selinux-policy-rpmlintrc Source1: selinux-policy-rpmlintrc
@ -81,13 +81,9 @@ Source125: rtorrent.fc
Source126: wicked.te Source126: wicked.te
Source127: wicked.if Source127: wicked.if
Source128: wicked.fc Source128: wicked.fc
Source129: tabrmd.te
Source130: tabrmd.if
Source131: tabrmd.fc
Patch001: fix_djbdns.patch Patch001: fix_djbdns.patch
Patch002: fix_dbus.patch Patch002: fix_dbus.patch
Patch003: fix_gift.patch
Patch004: fix_java.patch Patch004: fix_java.patch
Patch005: fix_hadoop.patch Patch005: fix_hadoop.patch
Patch006: fix_thunderbird.patch Patch006: fix_thunderbird.patch
@ -424,7 +420,7 @@ for i in %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15}
cp $i selinux_config cp $i selinux_config
done done
for i in %{SOURCE120} %{SOURCE121} %{SOURCE122} %{SOURCE123} %{SOURCE124} %{SOURCE125} %{SOURCE126} %{SOURCE127} %{SOURCE128} %{SOURCE129} %{SOURCE130} %{SOURCE131}; do for i in %{SOURCE120} %{SOURCE121} %{SOURCE122} %{SOURCE123} %{SOURCE124} %{SOURCE125} %{SOURCE126} %{SOURCE127} %{SOURCE128}; do
cp $i policy/modules/contrib cp $i policy/modules/contrib
done done
@ -475,6 +471,8 @@ install -m 644 doc/policy.* %{buildroot}%{_datadir}/selinux/devel/
mkdir %{buildroot}%{_datadir}/selinux/devel/html mkdir %{buildroot}%{_datadir}/selinux/devel/html
mv %{buildroot}%{_datadir}/man/man8/*.html %{buildroot}%{_datadir}/selinux/devel/html mv %{buildroot}%{_datadir}/man/man8/*.html %{buildroot}%{_datadir}/selinux/devel/html
mv %{buildroot}%{_datadir}/man/man8/style.css %{buildroot}%{_datadir}/selinux/devel/html mv %{buildroot}%{_datadir}/man/man8/style.css %{buildroot}%{_datadir}/selinux/devel/html
rm %{buildroot}%{_mandir}/man8/container_selinux.8*
rm %{buildroot}%{_datadir}/selinux/devel/include/services/container.if
%post %post
if [ ! -s %{_sysconfdir}/selinux/config ]; then if [ ! -s %{_sysconfdir}/selinux/config ]; then

2
tabrmd.fc
View File

@ -1,2 +0,0 @@
/usr/sbin/tpm2-abrmd -- gen_context(system_u:object_r:tabrmd_exec_t,s0)
/usr/local/sbin/tpm2-abrmd -- gen_context(system_u:object_r:tabrmd_exec_t,s0)

1
tabrmd.if
View File

@ -1 +0,0 @@
## <summary></summary>

29
tabrmd.te
View File

@ -1,29 +0,0 @@
policy_module(tabrmd, 0.0.2)
########################################
#
# Declarations
#
gen_tunable(`tabrmd_connect_all_unreserved', false)
type tabrmd_t;
type tabrmd_exec_t;
init_daemon_domain(tabrmd_t, tabrmd_exec_t)
allow tabrmd_t self:unix_dgram_socket { create_socket_perms };
dev_rw_tpm(tabrmd_t)
logging_send_syslog_msg(tabrmd_t)
sysnet_dns_name_resolve(tabrmd_t)
optional_policy(`
dbus_stub()
dbus_system_domain(tabrmd_t, tabrmd_exec_t)
allow system_dbusd_t tabrmd_t:unix_stream_socket rw_stream_socket_perms;
fwupd_dbus_chat(tabrmd_t)
')
tunable_policy(`tabrmd_connect_all_unreserved',`
corenet_tcp_connect_all_unreserved_ports(tabrmd_t)
')

2
update.sh
View File

@ -11,7 +11,7 @@ git clone --depth 1 https://github.com/containers/container-selinux.git
mv selinux-policy fedora-policy-$date mv selinux-policy fedora-policy-$date
rm -rf fedora-policy-$date/.git* rm -rf fedora-policy-$date/.git*
mv container-selinux/container.* fedora-policy-$date/policy/modules/contrib/ mv container-selinux/container.* fedora-policy-$date/policy/modules/services/
rm -f fedora-policy?$date.tar* rm -f fedora-policy?$date.tar*
tar cf fedora-policy-$date.tar fedora-policy-$date tar cf fedora-policy-$date.tar fedora-policy-$date

4
wicked.te
View File

@ -326,10 +326,6 @@ optional_policy(`
fcoe_dgram_send_fcoemon(wicked_t) fcoe_dgram_send_fcoemon(wicked_t)
') ')
optional_policy(`
hal_write_log(wicked_t)
')
optional_policy(` optional_policy(`
howl_signal(wicked_t) howl_signal(wicked_t)
') ')