rpm/selinux-policy
SHA256
1
0
Fork 0
forked from pool/selinux-policy
Code Pull Requests Activity

Accepting request 948335 from security:SELinux

Browse Source 
OBS-URL: https://build.opensuse.org/request/show/948335
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/selinux-policy?expand=0&rev=22
This commit is contained in:
Dominique Leuenberger 2022-01-26 20:26:31 +00:00 committed by Git OBS Bridge
parent bfd2a0a742
commit 80b8756a0f
10 changed files with 64 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fedora-policy-20211111.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:92e84c558e4c1a8d389205ddfc1e8b00f8a872585f01e05a7650b15e55643f2a
size 714235

3
fedora-policy-20220124.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:ebec268024dfd05d9563991a424d12892b0eb210d1eab2c484ae424f8fb757c5
size 725506

14
fix_hadoop.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20211111/policy/modules/roles/sysadm.te
Index: fedora-policy-20220124/policy/modules/roles/sysadm.te
===================================================================
--- fedora-policy-20211111.orig/policy/modules/roles/sysadm.te
+++ fedora-policy-20211111/policy/modules/roles/sysadm.te
@@ -311,10 +311,6 @@ optional_policy(`
--- fedora-policy-20220124.orig/policy/modules/roles/sysadm.te
+++ fedora-policy-20220124/policy/modules/roles/sysadm.te
@@ -315,10 +315,6 @@ optional_policy(`
')
optional_policy(`
@ -13,10 +13,10 @@ Index: fedora-policy-20211111/policy/modules/roles/sysadm.te
iotop_run(sysadm_t, sysadm_r)
')
Index: fedora-policy-20211111/policy/modules/roles/unprivuser.te
Index: fedora-policy-20220124/policy/modules/roles/unprivuser.te
===================================================================
--- fedora-policy-20211111.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20211111/policy/modules/roles/unprivuser.te
--- fedora-policy-20220124.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20220124/policy/modules/roles/unprivuser.te
@@ -205,10 +205,6 @@ ifndef(`distro_redhat',`
')

15
fix_hypervkvp.patch Normal file
View File

@ -0,0 +1,15 @@
Index: fedora-policy-20220124/policy/modules/contrib/hypervkvp.fc
===================================================================
--- fedora-policy-20220124.orig/policy/modules/contrib/hypervkvp.fc
+++ fedora-policy-20220124/policy/modules/contrib/hypervkvp.fc
@@ -3,8 +3,10 @@
/usr/lib/systemd/system/hypervvssd.* -- gen_context(system_u:object_r:hypervvssd_unit_file_t,s0)
/usr/sbin/hv_kvp_daemon -- gen_context(system_u:object_r:hypervkvp_exec_t,s0)
+/usr/lib/hyper-v/bin/.*kvp_daemon -- gen_context(system_u:object_r:hypervkvp_exec_t,s0)
/usr/sbin/hypervkvpd -- gen_context(system_u:object_r:hypervkvp_exec_t,s0)
/usr/sbin/hypervvssd -- gen_context(system_u:object_r:hypervvssd_exec_t,s0)
+/usr/lib/hyper-v/bin/.*vss_daemon -- gen_context(system_u:object_r:hypervvssd_exec_t,s0)
/var/lib/hyperv(/.*)? gen_context(system_u:object_r:hypervkvp_var_lib_t,s0)

28
fix_init.patch
View File

@ -1,19 +1,7 @@
Index: fedora-policy-20211111/policy/modules/system/init.if
Index: fedora-policy-20220124/policy/modules/system/init.te
===================================================================
--- fedora-policy-20211111.orig/policy/modules/system/init.if
+++ fedora-policy-20211111/policy/modules/system/init.if
@@ -3296,6 +3296,7 @@ interface(`init_filetrans_named_content'
files_etc_filetrans($1, machineid_t, file, "machine-id" )
files_pid_filetrans($1, initctl_t, fifo_file, "fifo" )
init_pid_filetrans($1, systemd_unit_file_t, dir, "generator")
+ init_pid_filetrans($1, systemd_unit_file_t, dir, "generator.late")
init_pid_filetrans($1, systemd_unit_file_t, dir, "system")
')
Index: fedora-policy-20211111/policy/modules/system/init.te
===================================================================
--- fedora-policy-20211111.orig/policy/modules/system/init.te
+++ fedora-policy-20211111/policy/modules/system/init.te
--- fedora-policy-20220124.orig/policy/modules/system/init.te
+++ fedora-policy-20220124/policy/modules/system/init.te
@@ -267,6 +267,8 @@ corecmd_exec_bin(init_t)
corenet_all_recvfrom_netlabel(init_t)
corenet_tcp_bind_all_ports(init_t)
@ -47,7 +35,7 @@ Index: fedora-policy-20211111/policy/modules/system/init.te
bootloader_domtrans(init_t)
')
@@ -570,10 +578,10 @@ tunable_policy(`init_audit_control',`
@@ -571,10 +579,10 @@ tunable_policy(`init_audit_control',`
allow init_t self:system all_system_perms;
allow init_t self:system module_load;
allow init_t self:unix_dgram_socket { create_socket_perms sendto };
@ -60,7 +48,7 @@ Index: fedora-policy-20211111/policy/modules/system/init.te
allow init_t self:netlink_selinux_socket create_socket_perms;
allow init_t self:unix_dgram_socket lock;
# Until systemd is fixed
@@ -631,6 +639,7 @@ files_delete_all_spool_sockets(init_t)
@@ -633,6 +641,7 @@ files_delete_all_spool_sockets(init_t)
files_create_var_lib_dirs(init_t)
files_create_var_lib_symlinks(init_t)
files_read_var_lib_symlinks(init_t)
@ -68,7 +56,7 @@ Index: fedora-policy-20211111/policy/modules/system/init.te
files_manage_urandom_seed(init_t)
files_list_locks(init_t)
files_list_spool(init_t)
@@ -667,7 +676,7 @@ fs_list_all(init_t)
@@ -669,7 +678,7 @@ fs_list_all(init_t)
fs_list_auto_mountpoints(init_t)
fs_register_binary_executable_type(init_t)
fs_relabel_tmpfs_sock_file(init_t)
@ -77,7 +65,7 @@ Index: fedora-policy-20211111/policy/modules/system/init.te
fs_relabel_cgroup_dirs(init_t)
fs_search_cgroup_dirs(init_t)
# for network namespaces
@@ -723,6 +732,7 @@ systemd_write_inherited_logind_sessions_
@@ -725,6 +734,7 @@ systemd_write_inherited_logind_sessions_
create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
create_dirs_pattern(init_t, var_log_t, var_log_t)
@ -85,7 +73,7 @@ Index: fedora-policy-20211111/policy/modules/system/init.te
auth_use_nsswitch(init_t)
auth_rw_login_records(init_t)
@@ -1568,6 +1578,8 @@ optional_policy(`
@@ -1571,6 +1581,8 @@ optional_policy(`
optional_policy(`
postfix_list_spool(initrc_t)

14
fix_kernel_sysctl.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20211111/policy/modules/kernel/files.fc
Index: fedora-policy-20220124/policy/modules/kernel/files.fc
===================================================================
--- fedora-policy-20211111.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20211111/policy/modules/kernel/files.fc
--- fedora-policy-20220124.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20220124/policy/modules/kernel/files.fc
@@ -236,6 +236,8 @@ ifdef(`distro_redhat',`
/usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0)
/usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0)
@ -11,11 +11,11 @@ Index: fedora-policy-20211111/policy/modules/kernel/files.fc
/usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
Index: fedora-policy-20211111/policy/modules/system/systemd.te
Index: fedora-policy-20220124/policy/modules/system/systemd.te
===================================================================
--- fedora-policy-20211111.orig/policy/modules/system/systemd.te
+++ fedora-policy-20211111/policy/modules/system/systemd.te
@@ -1035,6 +1035,8 @@ init_stream_connect(systemd_sysctl_t)
--- fedora-policy-20220124.orig/policy/modules/system/systemd.te
+++ fedora-policy-20220124/policy/modules/system/systemd.te
@@ -1037,6 +1037,8 @@ init_stream_connect(systemd_sysctl_t)
logging_send_syslog_msg(systemd_sysctl_t)
systemd_read_efivarfs(systemd_sysctl_t)

12
fix_systemd.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20211111/policy/modules/system/systemd.te
Index: fedora-policy-20220124/policy/modules/system/systemd.te
===================================================================
--- fedora-policy-20211111.orig/policy/modules/system/systemd.te
+++ fedora-policy-20211111/policy/modules/system/systemd.te
@@ -352,6 +352,10 @@ userdom_manage_user_tmp_chr_files(system
--- fedora-policy-20220124.orig/policy/modules/system/systemd.te
+++ fedora-policy-20220124/policy/modules/system/systemd.te
@@ -353,6 +353,10 @@ userdom_manage_user_tmp_chr_files(system
xserver_dbus_chat(systemd_logind_t)
optional_policy(`
@ -13,7 +13,7 @@ Index: fedora-policy-20211111/policy/modules/system/systemd.te
apache_read_tmp_files(systemd_logind_t)
')
@@ -866,6 +870,10 @@ optional_policy(`
@@ -868,6 +872,10 @@ optional_policy(`
udev_read_pid_files(systemd_hostnamed_t)
')
@ -24,7 +24,7 @@ Index: fedora-policy-20211111/policy/modules/system/systemd.te
#######################################
#
# rfkill policy
@@ -1109,6 +1117,8 @@ optional_policy(`
@@ -1115,6 +1123,8 @@ optional_policy(`
udev_read_pid_files(systemd_gpt_generator_t)
')

8
fix_systemd_watch.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20211111/policy/modules/system/systemd.te
Index: fedora-policy-20220124/policy/modules/system/systemd.te
===================================================================
--- fedora-policy-20211111.orig/policy/modules/system/systemd.te
+++ fedora-policy-20211111/policy/modules/system/systemd.te
@@ -1415,6 +1415,12 @@ fstools_rw_swap_files(systemd_sleep_t)
--- fedora-policy-20220124.orig/policy/modules/system/systemd.te
+++ fedora-policy-20220124/policy/modules/system/systemd.te
@@ -1421,6 +1421,12 @@ fstools_rw_swap_files(systemd_sleep_t)
storage_getattr_fixed_disk_dev(systemd_sleep_t)
storage_getattr_removable_dev(systemd_sleep_t)

12
selinux-policy.changes
View File

@ -1,3 +1,15 @@
-------------------------------------------------------------------
Mon Jan 24 07:33:34 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
- Update to version 20220124. Refreshed:
* fix_hadoop.patch
* fix_init.patch
* fix_kernel_sysctl.patch
* fix_systemd.patch
* fix_systemd_watch.patch
- Added fix_hypervkvp.patch to fix issues with hyperv labeling
(bsc#1193987)
-------------------------------------------------------------------
Fri Jan 14 15:07:00 UTC 2022 - Johannes Segitz <jsegitz@suse.com>

3
selinux-policy.spec
View File

@ -33,7 +33,7 @@ Summary: SELinux policy configuration
License: GPL-2.0-or-later
Group: System/Management
Name: selinux-policy
Version: 20211111
Version: 20220124
Release: 0
Source: fedora-policy-%{version}.tar.bz2
Source1: selinux-policy-rpmlintrc
@ -138,6 +138,7 @@ Patch053: fix_systemd_watch.patch
Patch054: fix_kernel_sysctl.patch
Patch055: fix_auditd.patch
Patch056: fix_wine.patch
Patch057: fix_hypervkvp.patch
Patch100: sedoctool.patch