rpm/selinux-policy
SHA256
1
0
Fork 0
forked from pool/selinux-policy
Code Pull Requests Activity

Accepting request 874853 from security:SELinux

Browse Source 
OBS-URL: https://build.opensuse.org/request/show/874853
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/selinux-policy?expand=0&rev=7
This commit is contained in:
Richard Brown 2021-03-02 11:27:42 +00:00 committed by Git OBS Bridge
parent 4ffa4ec7ef
commit 2deb9860fa
6 changed files with 56 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fedora-policy-20210223.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:516f56e5a18c26d521edd8046ce05f9b7ce4fc3a3fcd365613fead98355ed70d
size 720664

3
fedora-policy.20210111.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:6b79293eb39ccccb68464902cae1a2665522dee82c70323d58e78fca05a1ee8b
size 717105

60
fix_init.patch
View File

@ -1,8 +1,16 @@
Index: fedora-policy/policy/modules/system/init.te
===================================================================
--- fedora-policy.orig/policy/modules/system/init.te
+++ fedora-policy/policy/modules/system/init.te
@@ -257,6 +257,7 @@ corecmd_exec_bin(init_t)
--- fedora-policy/policy/modules/system/init.if 2021-02-23 14:51:08.683163653 +0100
+++ fedora-policy/policy/modules/system/init.if 2021-02-23 15:04:46.397087937 +0100
@@ -3242,6 +3242,7 @@
files_etc_filetrans($1, machineid_t, file, "machine-id" )
files_pid_filetrans($1, initctl_t, fifo_file, "fifo" )
init_pid_filetrans($1, systemd_unit_file_t, dir, "generator")
+ init_pid_filetrans($1, systemd_unit_file_t, dir, "generator.late")
init_pid_filetrans($1, systemd_unit_file_t, dir, "system")
')
--- fedora-policy/policy/modules/system/init.te 2021-02-23 14:51:08.683163653 +0100
+++ fedora-policy/policy/modules/system/init.te 2021-02-23 15:06:10.293290652 +0100
@@ -262,6 +262,7 @@
corenet_all_recvfrom_netlabel(init_t)
corenet_tcp_bind_all_ports(init_t)
corenet_udp_bind_all_ports(init_t)
@ -10,7 +18,7 @@ Index: fedora-policy/policy/modules/system/init.te
dev_create_all_files(init_t)
dev_create_all_chr_files(init_t)
@@ -378,6 +379,7 @@ logging_manage_audit_config(init_t)
@@ -388,6 +389,7 @@
logging_create_syslog_netlink_audit_socket(init_t)
logging_write_var_log_dirs(init_t)
logging_manage_var_log_symlinks(init_t)
@ -18,23 +26,24 @@ Index: fedora-policy/policy/modules/system/init.te
seutil_read_config(init_t)
seutil_read_login_config(init_t)
@@ -427,10 +429,15 @@ ifdef(`distro_redhat',`
@@ -437,11 +439,16 @@
corecmd_shell_domtrans(init_t, initrc_t)
storage_raw_rw_fixed_disk(init_t)
+storage_raw_read_removable_device(init_t)
sysnet_read_dhcpc_state(init_t)
sysnet_watch_config(init_t)
optional_policy(`
+ networkmanager_initrc_read_lnk_files(init_t)
+ networkmanager_initrc_read_lnk_files(init_t)
+')
+
+optional_policy(`
bootloader_domtrans(init_t)
')
@@ -544,7 +551,7 @@ tunable_policy(`init_create_dirs',`
@@ -555,10 +562,10 @@
allow init_t self:system all_system_perms;
allow init_t self:system module_load;
allow init_t self:unix_dgram_socket { create_socket_perms sendto };
@ -42,8 +51,12 @@ Index: fedora-policy/policy/modules/system/init.te
+allow init_t self:process { setkeycreate setsockcreate setfscreate setrlimit setexec execmem };
allow init_t self:process { getcap setcap };
allow init_t self:unix_stream_socket { create_stream_socket_perms connectto recvfrom };
allow init_t self:netlink_kobject_uevent_socket create_socket_perms;
@@ -606,6 +613,7 @@ files_delete_all_spool_sockets(init_t)
-allow init_t self:netlink_kobject_uevent_socket create_socket_perms;
+allow init_t self:netlink_kobject_uevent_socket create_socket_perms;
allow init_t self:netlink_selinux_socket create_socket_perms;
allow init_t self:unix_dgram_socket lock;
# Until systemd is fixed
@@ -616,6 +623,7 @@
files_create_var_lib_dirs(init_t)
files_create_var_lib_symlinks(init_t)
files_read_var_lib_symlinks(init_t)
@ -51,7 +64,16 @@ Index: fedora-policy/policy/modules/system/init.te
files_manage_urandom_seed(init_t)
files_list_locks(init_t)
files_list_spool(init_t)
@@ -698,6 +706,7 @@ systemd_write_inherited_logind_sessions_
@@ -652,7 +660,7 @@
fs_list_auto_mountpoints(init_t)
fs_register_binary_executable_type(init_t)
fs_relabel_tmpfs_sock_file(init_t)
-fs_rw_tmpfs_files(init_t)
+fs_rw_tmpfs_files(init_t)
fs_relabel_cgroup_dirs(init_t)
fs_search_cgroup_dirs(init_t)
# for network namespaces
@@ -708,6 +716,7 @@
create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
create_dirs_pattern(init_t, var_log_t, var_log_t)
@ -59,7 +81,7 @@ Index: fedora-policy/policy/modules/system/init.te
auth_use_nsswitch(init_t)
auth_rw_login_records(init_t)
@@ -1543,6 +1552,8 @@ optional_policy(`
@@ -1561,6 +1570,8 @@
optional_policy(`
postfix_list_spool(initrc_t)
@ -68,15 +90,3 @@ Index: fedora-policy/policy/modules/system/init.te
')
optional_policy(`
Index: fedora-policy/policy/modules/system/init.if
===================================================================
--- fedora-policy.orig/policy/modules/system/init.if
+++ fedora-policy/policy/modules/system/init.if
@@ -3205,6 +3205,7 @@ interface(`init_filetrans_named_content'
files_etc_filetrans($1, machineid_t, file, "machine-id" )
files_pid_filetrans($1, initctl_t, fifo_file, "fifo" )
init_pid_filetrans($1, systemd_unit_file_t, dir, "generator")
+ init_pid_filetrans($1, systemd_unit_file_t, dir, "generator.late")
init_pid_filetrans($1, systemd_unit_file_t, dir, "system")
')

8
selinux-policy.changes
View File

@ -1,3 +1,11 @@
-------------------------------------------------------------------
Tue Feb 23 13:53:40 UTC 2021 - Thorsten Kukuk <kukuk@suse.com>
- Update to version 20210223
- Change name of tar file to a more common schema to allow
parallel installation of several source versions
- Adjust fix_init.patch
-------------------------------------------------------------------
Mon Jan 11 09:29:18 UTC 2021 - Thorsten Kukuk <kukuk@suse.com>

6
selinux-policy.spec
View File

@ -33,9 +33,9 @@ Summary: SELinux policy configuration
License: GPL-2.0-or-later
Group: System/Management
Name: selinux-policy
Version: 20210111
Version: 20210223
Release: 0
Source: fedora-policy.%{version}.tar.bz2
Source: fedora-policy-%{version}.tar.bz2
Source1: selinux-policy-rpmlintrc
Source10: modules-targeted-base.conf
@ -384,7 +384,7 @@ fi;
exit 0
%prep
%setup -n fedora-policy
%setup -n fedora-policy-%{version}
%patch001 -p1
%patch002 -p1
%patch003 -p1

14
update.sh
View File

@ -9,14 +9,14 @@ rm -rf fedora-policy container-selinux
git clone --depth 1 https://github.com/fedora-selinux/selinux-policy.git
git clone --depth 1 https://github.com/containers/container-selinux.git
mv selinux-policy fedora-policy
rm -rf fedora-policy/.git*
mv container-selinux/container.* fedora-policy/policy/modules/contrib/
mv selinux-policy fedora-policy-$date
rm -rf fedora-policy-$date/.git*
mv container-selinux/container.* fedora-policy-$date/policy/modules/contrib/
rm -f fedora-policy.$date.tar*
tar cf fedora-policy.$date.tar fedora-policy
bzip2 fedora-policy.$date.tar
rm -rf fedora-policy container-selinux
rm -f fedora-policy?$date.tar*
tar cf fedora-policy-$date.tar fedora-policy-$date
bzip2 fedora-policy-$date.tar
rm -rf fedora-policy-$date container-selinux
sed -i -e "s/^Version:.*/Version: $date/" selinux-policy.spec