Accepting request 912873 from security:SELinux

OBS-URL: https://build.opensuse.org/request/show/912873
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/selinux-policy?expand=0&rev=16

fix_kernel_sysctl.patch

@@ -0,0 +1,26 @@
+Index: fedora-policy-20210716/policy/modules/kernel/files.fc
+===================================================================
+--- fedora-policy-20210716.orig/policy/modules/kernel/files.fc
++++ fedora-policy-20210716/policy/modules/kernel/files.fc
+@@ -236,6 +236,8 @@ ifdef(`distro_redhat',`
+ /usr/lib/ostree-boot(/.*)?                gen_context(system_u:object_r:usr_t,s0)
+ /usr/lib/modules(/.*)/vmlinuz         -- 	gen_context(system_u:object_r:usr_t,s0)
+ /usr/lib/modules(/.*)/initramfs.img   --	gen_context(system_u:object_r:usr_t,s0)
++/usr/lib/modules(/.*)/sysctl.conf     --	gen_context(system_u:object_r:usr_t,s0)
++/usr/lib/modules(/.*)/System.map      --	gen_context(system_u:object_r:system_map_t,s0)
+ 
+ /usr/doc(/.*)?/lib(/.*)?	gen_context(system_u:object_r:usr_t,s0)
+ 
+Index: fedora-policy-20210716/policy/modules/system/systemd.te
+===================================================================
+--- fedora-policy-20210716.orig/policy/modules/system/systemd.te
++++ fedora-policy-20210716/policy/modules/system/systemd.te
+@@ -1027,6 +1027,8 @@ init_stream_connect(systemd_sysctl_t)
+ logging_send_syslog_msg(systemd_sysctl_t)
+ 
+ systemd_read_efivarfs(systemd_sysctl_t)
++# kernel specific sysctl.conf may be in modules dir
++allow systemd_sysctl_t modules_object_t:dir search;
+ 
+ #######################################
+ #

selinux-policy.changes

@@ -1,3 +1,14 @@
+-------------------------------------------------------------------
+Tue Aug 17 16:03:08 UTC 2021 - Ludwig Nussel <lnussel@suse.de>
+
+- Allow systemd-sysctl to read kernel specific sysctl.conf
+  (fix_kernel_sysctl.patch, boo#1184804)
+
+-------------------------------------------------------------------
+Tue Aug 10 08:31:16 UTC 2021 - Ludwig Nussel <lnussel@suse.de>
+
+- Fix quoting in postInstall macro
+
 -------------------------------------------------------------------
 Fri Jul 16 07:11:57 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
 

selinux-policy.spec

@@ -131,6 +131,8 @@ Patch051:       fix_dovecot.patch
 # https://github.com/cockpit-project/cockpit/pull/15758
 Patch052:       fix_cockpit.patch
 Patch053:       fix_systemd_watch.patch
+# kernel specific sysctl.conf (boo#1184804)
+Patch054:       fix_kernel_sysctl.patch
 
 Patch100:       sedoctool.patch
 
@@ -304,9 +306,9 @@ fi;
 
 %define postInstall() \
 . %{_sysconfdir}/selinux/config; \
-if [ -e %{_sysconfdir}/selinux/%%2/.rebuild ]; then \
+if [ -e %{_sysconfdir}/selinux/%2/.rebuild ]; then \
-  rm %{_sysconfdir}/selinux/%%2/.rebuild; \
+  rm %{_sysconfdir}/selinux/%2/.rebuild; \
-  /usr/sbin/semodule -B -n -s %%2; \
+  /usr/sbin/semodule -B -n -s %2; \
 fi; \
 if [ -n "${TRANSACTIONAL_UPDATE}" ]; then \
   touch /etc/selinux/.autorelabel \