rpm/selinux-policy
SHA256
1
0
Fork 0
forked from pool/selinux-policy
Code Pull Requests Activity

Accepting request 978298 from security:SELinux

Browse Source 
OBS-URL: https://build.opensuse.org/request/show/978298
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/selinux-policy?expand=0&rev=25
This commit is contained in:
Dominique Leuenberger 2022-06-20 13:36:43 +00:00 committed by Git OBS Bridge
commit a185359d28
21 changed files with 163 additions and 96 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fedora-policy-20220124.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:ebec268024dfd05d9563991a424d12892b0eb210d1eab2c484ae424f8fb757c5
size 725506

3
fedora-policy-20220520.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:90d1df3189f84ff576e2bd3cf5bc504bac06037d3475ea1904d2b9eda9d164e7
size 730405

8
fix_apache.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy/policy/modules/contrib/apache.if Index: fedora-policy-20220428/policy/modules/contrib/apache.if
=================================================================== ===================================================================
--- fedora-policy.orig/policy/modules/contrib/apache.if --- fedora-policy-20220428.orig/policy/modules/contrib/apache.if
+++ fedora-policy/policy/modules/contrib/apache.if +++ fedora-policy-20220428/policy/modules/contrib/apache.if
@@ -1967,3 +1967,25 @@ interface(`apache_ioctl_stream_sockets', @@ -1989,3 +1989,25 @@ interface(`apache_ioctl_stream_sockets',
allow $1 httpd_t:unix_stream_socket ioctl; allow $1 httpd_t:unix_stream_socket ioctl;
') ')

12
fix_dnsmasq.patch Normal file
View File

@ -0,0 +1,12 @@
Index: fedora-policy-20220519/policy/modules/contrib/dnsmasq.te
===================================================================
--- fedora-policy-20220519.orig/policy/modules/contrib/dnsmasq.te
+++ fedora-policy-20220519/policy/modules/contrib/dnsmasq.te
@@ -115,6 +115,7 @@ libs_exec_ldconfig(dnsmasq_t)
logging_send_syslog_msg(dnsmasq_t)
miscfiles_read_public_files(dnsmasq_t)
+sysnet_manage_config_dirs(dnsmasq_t)
userdom_dontaudit_use_unpriv_user_fds(dnsmasq_t)
userdom_dontaudit_search_user_home_dirs(dnsmasq_t)

14
fix_hadoop.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20220124/policy/modules/roles/sysadm.te Index: fedora-policy-20220428/policy/modules/roles/sysadm.te
=================================================================== ===================================================================
--- fedora-policy-20220124.orig/policy/modules/roles/sysadm.te --- fedora-policy-20220428.orig/policy/modules/roles/sysadm.te
+++ fedora-policy-20220124/policy/modules/roles/sysadm.te +++ fedora-policy-20220428/policy/modules/roles/sysadm.te
@@ -315,10 +315,6 @@ optional_policy(` @@ -315,10 +315,6 @@ optional_policy(`
') ')
@ -13,11 +13,11 @@ Index: fedora-policy-20220124/policy/modules/roles/sysadm.te
iotop_run(sysadm_t, sysadm_r) iotop_run(sysadm_t, sysadm_r)
') ')
Index: fedora-policy-20220124/policy/modules/roles/unprivuser.te Index: fedora-policy-20220428/policy/modules/roles/unprivuser.te
=================================================================== ===================================================================
--- fedora-policy-20220124.orig/policy/modules/roles/unprivuser.te --- fedora-policy-20220428.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20220124/policy/modules/roles/unprivuser.te +++ fedora-policy-20220428/policy/modules/roles/unprivuser.te
@@ -205,10 +205,6 @@ ifndef(`distro_redhat',` @@ -210,10 +210,6 @@ ifndef(`distro_redhat',`
') ')
optional_policy(` optional_policy(`

41
fix_init.patch
View File

@ -1,8 +1,17 @@
Index: fedora-policy-20220124/policy/modules/system/init.te Index: fedora-policy-20220428/policy/modules/system/init.te
=================================================================== ===================================================================
--- fedora-policy-20220124.orig/policy/modules/system/init.te --- fedora-policy-20220428.orig/policy/modules/system/init.te
+++ fedora-policy-20220124/policy/modules/system/init.te +++ fedora-policy-20220428/policy/modules/system/init.te
@@ -267,6 +267,8 @@ corecmd_exec_bin(init_t) @@ -187,6 +187,8 @@ allow init_t self:bpf { map_create map_r
# setuid (from /sbin/shutdown)
# sys_chroot (from /usr/bin/chroot): now provided by corecmd_chroot_exec_chroot()
+# bsc#1197610, find a better, generic solution
+allow init_t self:file mounton;
allow init_t self:fifo_file rw_fifo_file_perms;
allow init_t self:service manage_service_perms;
@@ -267,6 +269,8 @@ corecmd_exec_bin(init_t)
corenet_all_recvfrom_netlabel(init_t) corenet_all_recvfrom_netlabel(init_t)
corenet_tcp_bind_all_ports(init_t) corenet_tcp_bind_all_ports(init_t)
corenet_udp_bind_all_ports(init_t) corenet_udp_bind_all_ports(init_t)
@ -11,7 +20,7 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
dev_create_all_files(init_t) dev_create_all_files(init_t)
dev_create_all_chr_files(init_t) dev_create_all_chr_files(init_t)
@@ -394,6 +396,7 @@ logging_manage_audit_config(init_t) @@ -396,6 +400,7 @@ logging_manage_audit_config(init_t)
logging_create_syslog_netlink_audit_socket(init_t) logging_create_syslog_netlink_audit_socket(init_t)
logging_write_var_log_dirs(init_t) logging_write_var_log_dirs(init_t)
logging_manage_var_log_symlinks(init_t) logging_manage_var_log_symlinks(init_t)
@ -19,7 +28,7 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
seutil_read_config(init_t) seutil_read_config(init_t)
seutil_read_login_config(init_t) seutil_read_login_config(init_t)
@@ -444,10 +447,15 @@ ifdef(`distro_redhat',` @@ -446,9 +451,19 @@ ifdef(`distro_redhat',`
corecmd_shell_domtrans(init_t, initrc_t) corecmd_shell_domtrans(init_t, initrc_t)
storage_raw_rw_fixed_disk(init_t) storage_raw_rw_fixed_disk(init_t)
@ -27,15 +36,19 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
sysnet_read_dhcpc_state(init_t) sysnet_read_dhcpc_state(init_t)
optional_policy(` +# bsc#1197610, find a better, generic solution
+ networkmanager_initrc_read_lnk_files(init_t) +optional_policy(`
+ mta_getattr_spool(init_t)
+') +')
+ +
+optional_policy(` +optional_policy(`
+ networkmanager_initrc_read_lnk_files(init_t)
+')
+
optional_policy(`
bootloader_domtrans(init_t) bootloader_domtrans(init_t)
') ')
@@ -573,10 +588,10 @@ tunable_policy(`init_audit_control',`
@@ -571,10 +579,10 @@ tunable_policy(`init_audit_control',`
allow init_t self:system all_system_perms; allow init_t self:system all_system_perms;
allow init_t self:system module_load; allow init_t self:system module_load;
allow init_t self:unix_dgram_socket { create_socket_perms sendto }; allow init_t self:unix_dgram_socket { create_socket_perms sendto };
@ -48,7 +61,7 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
allow init_t self:netlink_selinux_socket create_socket_perms; allow init_t self:netlink_selinux_socket create_socket_perms;
allow init_t self:unix_dgram_socket lock; allow init_t self:unix_dgram_socket lock;
# Until systemd is fixed # Until systemd is fixed
@@ -633,6 +641,7 @@ files_delete_all_spool_sockets(init_t) @@ -635,6 +650,7 @@ files_delete_all_spool_sockets(init_t)
files_create_var_lib_dirs(init_t) files_create_var_lib_dirs(init_t)
files_create_var_lib_symlinks(init_t) files_create_var_lib_symlinks(init_t)
files_read_var_lib_symlinks(init_t) files_read_var_lib_symlinks(init_t)
@ -56,7 +69,7 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
files_manage_urandom_seed(init_t) files_manage_urandom_seed(init_t)
files_list_locks(init_t) files_list_locks(init_t)
files_list_spool(init_t) files_list_spool(init_t)
@@ -669,7 +678,7 @@ fs_list_all(init_t) @@ -672,7 +688,7 @@ fs_list_all(init_t)
fs_list_auto_mountpoints(init_t) fs_list_auto_mountpoints(init_t)
fs_register_binary_executable_type(init_t) fs_register_binary_executable_type(init_t)
fs_relabel_tmpfs_sock_file(init_t) fs_relabel_tmpfs_sock_file(init_t)
@ -65,7 +78,7 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
fs_relabel_cgroup_dirs(init_t) fs_relabel_cgroup_dirs(init_t)
fs_search_cgroup_dirs(init_t) fs_search_cgroup_dirs(init_t)
# for network namespaces # for network namespaces
@@ -725,6 +734,7 @@ systemd_write_inherited_logind_sessions_ @@ -728,6 +744,7 @@ systemd_write_inherited_logind_sessions_
create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type) create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
create_dirs_pattern(init_t, var_log_t, var_log_t) create_dirs_pattern(init_t, var_log_t, var_log_t)
@ -73,7 +86,7 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
auth_use_nsswitch(init_t) auth_use_nsswitch(init_t)
auth_rw_login_records(init_t) auth_rw_login_records(init_t)
@@ -1571,6 +1581,8 @@ optional_policy(` @@ -1578,6 +1595,8 @@ optional_policy(`
optional_policy(` optional_policy(`
postfix_list_spool(initrc_t) postfix_list_spool(initrc_t)

8
fix_iptables.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20210309/policy/modules/system/iptables.te Index: fedora-policy-20220428/policy/modules/system/iptables.te
=================================================================== ===================================================================
--- fedora-policy-20210309.orig/policy/modules/system/iptables.te --- fedora-policy-20220428.orig/policy/modules/system/iptables.te
+++ fedora-policy-20210309/policy/modules/system/iptables.te +++ fedora-policy-20220428/policy/modules/system/iptables.te
@@ -74,6 +74,7 @@ kernel_read_network_state(iptables_t) @@ -76,6 +76,7 @@ kernel_read_network_state(iptables_t)
kernel_read_kernel_sysctls(iptables_t) kernel_read_kernel_sysctls(iptables_t)
kernel_use_fds(iptables_t) kernel_use_fds(iptables_t)
kernel_rw_net_sysctls(iptables_t) kernel_rw_net_sysctls(iptables_t)

14
fix_kernel_sysctl.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20220124/policy/modules/kernel/files.fc Index: fedora-policy-20220428/policy/modules/kernel/files.fc
=================================================================== ===================================================================
--- fedora-policy-20220124.orig/policy/modules/kernel/files.fc --- fedora-policy-20220428.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20220124/policy/modules/kernel/files.fc +++ fedora-policy-20220428/policy/modules/kernel/files.fc
@@ -236,6 +236,8 @@ ifdef(`distro_redhat',` @@ -236,6 +236,8 @@ ifdef(`distro_redhat',`
/usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0) /usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0)
/usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0) /usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0)
@ -11,11 +11,11 @@ Index: fedora-policy-20220124/policy/modules/kernel/files.fc
/usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) /usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
Index: fedora-policy-20220124/policy/modules/system/systemd.te Index: fedora-policy-20220428/policy/modules/system/systemd.te
=================================================================== ===================================================================
--- fedora-policy-20220124.orig/policy/modules/system/systemd.te --- fedora-policy-20220428.orig/policy/modules/system/systemd.te
+++ fedora-policy-20220124/policy/modules/system/systemd.te +++ fedora-policy-20220428/policy/modules/system/systemd.te
@@ -1037,6 +1037,8 @@ init_stream_connect(systemd_sysctl_t) @@ -1052,6 +1052,8 @@ init_stream_connect(systemd_sysctl_t)
logging_send_syslog_msg(systemd_sysctl_t) logging_send_syslog_msg(systemd_sysctl_t)
systemd_read_efivarfs(systemd_sysctl_t) systemd_read_efivarfs(systemd_sysctl_t)

16
fix_networkmanager.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20211111/policy/modules/contrib/networkmanager.te Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.te
=================================================================== ===================================================================
--- fedora-policy-20211111.orig/policy/modules/contrib/networkmanager.te --- fedora-policy-20220428.orig/policy/modules/contrib/networkmanager.te
+++ fedora-policy-20211111/policy/modules/contrib/networkmanager.te +++ fedora-policy-20220428/policy/modules/contrib/networkmanager.te
@@ -243,6 +243,9 @@ userdom_read_home_certs(NetworkManager_t @@ -271,6 +271,9 @@ userdom_read_home_certs(NetworkManager_t
userdom_read_user_home_content_files(NetworkManager_t) userdom_read_user_home_content_files(NetworkManager_t)
userdom_dgram_send(NetworkManager_t) userdom_dgram_send(NetworkManager_t)
@ -12,7 +12,7 @@ Index: fedora-policy-20211111/policy/modules/contrib/networkmanager.te
tunable_policy(`use_nfs_home_dirs',` tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(NetworkManager_t) fs_read_nfs_files(NetworkManager_t)
') ')
@@ -260,6 +263,14 @@ optional_policy(` @@ -288,6 +291,14 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -27,10 +27,10 @@ Index: fedora-policy-20211111/policy/modules/contrib/networkmanager.te
bind_domtrans(NetworkManager_t) bind_domtrans(NetworkManager_t)
bind_manage_cache(NetworkManager_t) bind_manage_cache(NetworkManager_t)
bind_kill(NetworkManager_t) bind_kill(NetworkManager_t)
Index: fedora-policy-20211111/policy/modules/contrib/networkmanager.if Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.if
=================================================================== ===================================================================
--- fedora-policy-20211111.orig/policy/modules/contrib/networkmanager.if --- fedora-policy-20220428.orig/policy/modules/contrib/networkmanager.if
+++ fedora-policy-20211111/policy/modules/contrib/networkmanager.if +++ fedora-policy-20220428/policy/modules/contrib/networkmanager.if
@@ -132,6 +132,24 @@ interface(`networkmanager_initrc_domtran @@ -132,6 +132,24 @@ interface(`networkmanager_initrc_domtran
init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t) init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t)
') ')

19
fix_systemd.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20220124/policy/modules/system/systemd.te Index: fedora-policy-20220428/policy/modules/system/systemd.te
=================================================================== ===================================================================
--- fedora-policy-20220124.orig/policy/modules/system/systemd.te --- fedora-policy-20220428.orig/policy/modules/system/systemd.te
+++ fedora-policy-20220124/policy/modules/system/systemd.te +++ fedora-policy-20220428/policy/modules/system/systemd.te
@@ -353,6 +353,10 @@ userdom_manage_user_tmp_chr_files(system @@ -355,6 +355,10 @@ userdom_manage_user_tmp_chr_files(system
xserver_dbus_chat(systemd_logind_t) xserver_dbus_chat(systemd_logind_t)
optional_policy(` optional_policy(`
@ -13,7 +13,7 @@ Index: fedora-policy-20220124/policy/modules/system/systemd.te
apache_read_tmp_files(systemd_logind_t) apache_read_tmp_files(systemd_logind_t)
') ')
@@ -868,6 +872,10 @@ optional_policy(` @@ -882,6 +886,10 @@ optional_policy(`
udev_read_pid_files(systemd_hostnamed_t) udev_read_pid_files(systemd_hostnamed_t)
') ')
@ -24,12 +24,3 @@ Index: fedora-policy-20220124/policy/modules/system/systemd.te
####################################### #######################################
# #
# rfkill policy # rfkill policy
@@ -1115,6 +1123,8 @@ optional_policy(`
udev_read_pid_files(systemd_gpt_generator_t)
')
+udev_read_pid_files(systemd_gpt_generator_t)
+
#######################################
#
# systemd_resolved domain

8
fix_systemd_watch.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20220124/policy/modules/system/systemd.te Index: fedora-policy-20220428/policy/modules/system/systemd.te
=================================================================== ===================================================================
--- fedora-policy-20220124.orig/policy/modules/system/systemd.te --- fedora-policy-20220428.orig/policy/modules/system/systemd.te
+++ fedora-policy-20220124/policy/modules/system/systemd.te +++ fedora-policy-20220428/policy/modules/system/systemd.te
@@ -1421,6 +1421,12 @@ fstools_rw_swap_files(systemd_sleep_t) @@ -1445,6 +1445,12 @@ fstools_rw_swap_files(systemd_sleep_t)
storage_getattr_fixed_disk_dev(systemd_sleep_t) storage_getattr_fixed_disk_dev(systemd_sleep_t)
storage_getattr_removable_dev(systemd_sleep_t) storage_getattr_removable_dev(systemd_sleep_t)

23
fix_unconfineduser.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20211111/policy/modules/roles/unconfineduser.te Index: fedora-policy-20220509/policy/modules/roles/unconfineduser.te
=================================================================== ===================================================================
--- fedora-policy-20211111.orig/policy/modules/roles/unconfineduser.te --- fedora-policy-20220509.orig/policy/modules/roles/unconfineduser.te
+++ fedora-policy-20211111/policy/modules/roles/unconfineduser.te +++ fedora-policy-20220509/policy/modules/roles/unconfineduser.te
@@ -122,6 +122,11 @@ tunable_policy(`unconfined_dyntrans_all' @@ -124,6 +124,11 @@ tunable_policy(`unconfined_dyntrans_all'
domain_dyntrans(unconfined_t) domain_dyntrans(unconfined_t)
') ')
@ -14,7 +14,7 @@ Index: fedora-policy-20211111/policy/modules/roles/unconfineduser.te
optional_policy(` optional_policy(`
gen_require(` gen_require(`
type unconfined_t; type unconfined_t;
@@ -208,6 +213,10 @@ optional_policy(` @@ -210,6 +215,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -25,7 +25,7 @@ Index: fedora-policy-20211111/policy/modules/roles/unconfineduser.te
chrome_role_notrans(unconfined_r, unconfined_t) chrome_role_notrans(unconfined_r, unconfined_t)
tunable_policy(`unconfined_chrome_sandbox_transition',` tunable_policy(`unconfined_chrome_sandbox_transition',`
@@ -242,6 +251,18 @@ optional_policy(` @@ -244,6 +253,18 @@ optional_policy(`
dbus_stub(unconfined_t) dbus_stub(unconfined_t)
optional_policy(` optional_policy(`
@ -44,14 +44,3 @@ Index: fedora-policy-20211111/policy/modules/roles/unconfineduser.te
bluetooth_dbus_chat(unconfined_t) bluetooth_dbus_chat(unconfined_t)
') ')
@@ -305,6 +326,10 @@ optional_policy(`
')
optional_policy(`
+ libs_run_ldconfig(unconfined_t, unconfined_r)
+')
+
+optional_policy(`
firstboot_run(unconfined_t, unconfined_r)
')

8
fix_unprivuser.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20210628/policy/modules/roles/unprivuser.te Index: fedora-policy-20220428/policy/modules/roles/unprivuser.te
=================================================================== ===================================================================
--- fedora-policy-20210628.orig/policy/modules/roles/unprivuser.te --- fedora-policy-20220428.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20210628/policy/modules/roles/unprivuser.te +++ fedora-policy-20220428/policy/modules/roles/unprivuser.te
@@ -287,6 +287,13 @@ ifndef(`distro_redhat',` @@ -292,6 +292,13 @@ ifndef(`distro_redhat',`
') ')
optional_policy(` optional_policy(`

10
fix_usermanage.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20210309/policy/modules/admin/usermanage.te Index: fedora-policy-20220428/policy/modules/admin/usermanage.te
=================================================================== ===================================================================
--- fedora-policy-20210309.orig/policy/modules/admin/usermanage.te --- fedora-policy-20220428.orig/policy/modules/admin/usermanage.te
+++ fedora-policy-20210309/policy/modules/admin/usermanage.te +++ fedora-policy-20220428/policy/modules/admin/usermanage.te
@@ -226,6 +226,7 @@ allow groupadd_t self:unix_dgram_socket @@ -226,6 +226,7 @@ allow groupadd_t self:unix_dgram_socket
allow groupadd_t self:unix_stream_socket create_stream_socket_perms; allow groupadd_t self:unix_stream_socket create_stream_socket_perms;
allow groupadd_t self:unix_dgram_socket sendto; allow groupadd_t self:unix_dgram_socket sendto;
@ -10,7 +10,7 @@ Index: fedora-policy-20210309/policy/modules/admin/usermanage.te
fs_getattr_xattr_fs(groupadd_t) fs_getattr_xattr_fs(groupadd_t)
fs_search_auto_mountpoints(groupadd_t) fs_search_auto_mountpoints(groupadd_t)
@@ -529,6 +530,7 @@ allow useradd_t self:unix_dgram_socket c @@ -538,6 +539,7 @@ allow useradd_t self:unix_dgram_socket c
allow useradd_t self:unix_stream_socket create_stream_socket_perms; allow useradd_t self:unix_stream_socket create_stream_socket_perms;
allow useradd_t self:unix_dgram_socket sendto; allow useradd_t self:unix_dgram_socket sendto;
allow useradd_t self:unix_stream_socket connectto; allow useradd_t self:unix_stream_socket connectto;
@ -18,7 +18,7 @@ Index: fedora-policy-20210309/policy/modules/admin/usermanage.te
manage_dirs_pattern(useradd_t, useradd_var_run_t, useradd_var_run_t) manage_dirs_pattern(useradd_t, useradd_var_run_t, useradd_var_run_t)
manage_files_pattern(useradd_t, useradd_var_run_t, useradd_var_run_t) manage_files_pattern(useradd_t, useradd_var_run_t, useradd_var_run_t)
@@ -537,6 +539,8 @@ files_pid_filetrans(useradd_t, useradd_v @@ -546,6 +548,8 @@ files_pid_filetrans(useradd_t, useradd_v
# for getting the number of groups # for getting the number of groups
kernel_read_kernel_sysctls(useradd_t) kernel_read_kernel_sysctls(useradd_t)

8
fix_wine.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20210716/policy/modules/system/libraries.fc Index: fedora-policy-20220428/policy/modules/system/libraries.fc
=================================================================== ===================================================================
--- fedora-policy-20210716.orig/policy/modules/system/libraries.fc --- fedora-policy-20220428.orig/policy/modules/system/libraries.fc
+++ fedora-policy-20210716/policy/modules/system/libraries.fc +++ fedora-policy-20220428/policy/modules/system/libraries.fc
@@ -90,7 +90,7 @@ ifdef(`distro_redhat',` @@ -90,7 +90,7 @@ ifdef(`distro_redhat',`
/opt/Adobe/Reader.?/Reader/intellinux/plug_ins/.*\.api -- gen_context(system_u:object_r:textrel_shlib_t,s0) /opt/Adobe/Reader.?/Reader/intellinux/plug_ins/.*\.api -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/opt/Adobe/Reader.?/Reader/intellinux/SPPlugins/.*\.ap[il] -- gen_context(system_u:object_r:lib_t,s0) /opt/Adobe/Reader.?/Reader/intellinux/SPPlugins/.*\.ap[il] -- gen_context(system_u:object_r:lib_t,s0)
@ -12,7 +12,7 @@ Index: fedora-policy-20210716/policy/modules/system/libraries.fc
/opt/ibm/java.*/jre/.+\.jar -- gen_context(system_u:object_r:lib_t,s0) /opt/ibm/java.*/jre/.+\.jar -- gen_context(system_u:object_r:lib_t,s0)
/opt/ibm/java.*/jre/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /opt/ibm/java.*/jre/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -173,7 +173,8 @@ ifdef(`distro_redhat',` @@ -173,7 +173,8 @@ ifdef(`distro_redhat',`
/usr/lib/systemd/libsystemd-shared-[0-9]+\.so.* -- gen_context(system_u:object_r:lib_t,s0) /usr/lib/systemd/libsystemd-.+\.so.* -- gen_context(system_u:object_r:lib_t,s0)
/usr/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:lib_t,s0) /usr/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:lib_t,s0)
-/usr/lib/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) -/usr/lib/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)

40
selinux-policy.changes
View File

@ -1,4 +1,44 @@
------------------------------------------------------------------- -------------------------------------------------------------------
Fri May 20 13:46:47 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
- Update to version 20220520 to pass stricter 3.4 toolchain checks
-------------------------------------------------------------------
Fri May 20 09:14:58 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
- Update to version 20220428. Refreshed:
* fix_apache.patch
* fix_hadoop.patch
* fix_init.patch
* fix_iptables.patch
* fix_kernel_sysctl.patch
* fix_networkmanager.patch
* fix_systemd.patch
* fix_systemd_watch.patch
* fix_unprivuser.patch
* fix_usermanage.patch
* fix_wine.patch
-------------------------------------------------------------------
Thu May 19 12:25:31 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
- Add fix_dnsmasq.patch to fix problems with virtualization on Microos
(bsc#1199518)
-------------------------------------------------------------------
Tue May 3 13:18:38 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
- Modified fix_init.patch to allow init to setup contrained environment
for accountsservice. This needs a better, more general solution
(bsc#1197610)
-------------------------------------------------------------------
Mon May 2 11:27:49 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
- Add systemd_domain_dyntrans_type.patch to allow systemd to dyntransition.
This happens in certain boot conditions (bsc#1182500)
- Changed fix_unconfineduser.patch to not transition into ldconfig_t
from unconfined_t (bsc#1197169)
-------------------------------------------------------------------
Thu Feb 17 12:24:13 UTC 2022 - Klaus Kämpf <kkaempf@suse.com> Thu Feb 17 12:24:13 UTC 2022 - Klaus Kämpf <kkaempf@suse.com>
- use %license tag for COPYING file - use %license tag for COPYING file

5
selinux-policy.spec
View File

@ -33,7 +33,7 @@ Summary: SELinux policy configuration
License: GPL-2.0-or-later License: GPL-2.0-or-later
Group: System/Management Group: System/Management
Name: selinux-policy Name: selinux-policy
Version: 20220124 Version: 20220520
Release: 0 Release: 0
Source: fedora-policy-%{version}.tar.bz2 Source: fedora-policy-%{version}.tar.bz2
Source1: selinux-policy-rpmlintrc Source1: selinux-policy-rpmlintrc
@ -140,6 +140,8 @@ Patch055: fix_auditd.patch
Patch056: fix_wine.patch Patch056: fix_wine.patch
Patch057: fix_hypervkvp.patch Patch057: fix_hypervkvp.patch
Patch058: fix_bitlbee.patch Patch058: fix_bitlbee.patch
Patch059: systemd_domain_dyntrans_type.patch
Patch060: fix_dnsmasq.patch
Patch100: sedoctool.patch Patch100: sedoctool.patch
@ -274,6 +276,7 @@ rm -f %{buildroot}%{_sharedstatedir}/selinux/%1/active/*.linked \
%{_sharedstatedir}/selinux/%1/active/seusers \ %{_sharedstatedir}/selinux/%1/active/seusers \
%{_sharedstatedir}/selinux/%1/active/file_contexts \ %{_sharedstatedir}/selinux/%1/active/file_contexts \
%{_sharedstatedir}/selinux/%1/active/policy.kern \ %{_sharedstatedir}/selinux/%1/active/policy.kern \
%{_sharedstatedir}/selinux/%1/active/modules_checksum \
%ghost %{_sharedstatedir}/selinux/%1/active/policy.linked \ %ghost %{_sharedstatedir}/selinux/%1/active/policy.linked \
%ghost %{_sharedstatedir}/selinux/%1/active/seusers.linked \ %ghost %{_sharedstatedir}/selinux/%1/active/seusers.linked \
%ghost %{_sharedstatedir}/selinux/%1/active/users_extra.linked \ %ghost %{_sharedstatedir}/selinux/%1/active/users_extra.linked \

13
systemd_domain_dyntrans_type.patch Normal file
View File

@ -0,0 +1,13 @@
Index: fedora-policy-20220124/policy/modules/system/init.te
===================================================================
--- fedora-policy-20220124.orig/policy/modules/system/init.te
+++ fedora-policy-20220124/policy/modules/system/init.te
@@ -179,6 +179,8 @@ allow init_t self:tcp_socket { listen ac
allow init_t self:packet_socket create_socket_perms;
allow init_t self:key manage_key_perms;
allow init_t self:bpf { map_create map_read map_write prog_load prog_run };
+domain_dyntrans_type(init_t)
+allow init_t self:process { dyntransition setcurrent };
# is ~sys_module really needed? observed:
# sys_boot

1
users-minimum
View File

@ -36,3 +36,4 @@ gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
# not in the sysadm_r. # not in the sysadm_r.
# #
gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats) gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)

2
users-mls
View File

@ -36,3 +36,5 @@ gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
# not in the sysadm_r. # not in the sysadm_r.
# #
gen_user(root, user, sysadm_r staff_r secadm_r auditadm_r system_r, s0, s0 - mls_systemhigh, mcs_allcats) gen_user(root, user, sysadm_r staff_r secadm_r auditadm_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
gen_user(guest_u, user, guest_r, s0, s0)
gen_user(xguest_u, user, xguest_r, s0, s0)

3
users-targeted
View File

@ -36,3 +36,6 @@ gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
# not in the sysadm_r. # not in the sysadm_r.
# #
gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats) gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
gen_user(guest_u, user, guest_r, s0, s0)
gen_user(xguest_u, user, xguest_r, s0, s0)