rpm/selinux-policy
SHA256
1
0
Fork 0
forked from pool/selinux-policy
Code Pull Requests Activity

Accepting request 984855 from home:jsegitz:branches:security:SELinux

Browse Source 
- Update to version 20220624. Refreshed:
  * fix_init.patch
  * fix_kernel_sysctl.patch
  * fix_logging.patch
  * fix_networkmanager.patch
  * fix_unprivuser.patch
  Dropped fix_hadoop.patch, not necessary anymore
* Updated fix_locallogin.patch to allow accesses for nss-systemd 
  (bsc#1199630)

OBS-URL: https://build.opensuse.org/request/show/984855
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=132
This commit is contained in:
Johannes Segitz 2022-06-24 09:40:15 +00:00 committed by Git OBS Bridge
parent 11a4df6bd1
commit a7283c99d6
11 changed files with 65 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fedora-policy-20220520.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:90d1df3189f84ff576e2bd3cf5bc504bac06037d3475ea1904d2b9eda9d164e7
size 730405

3
fedora-policy-20220624.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:1cd368f29dfa53404b27e8cd3a055bf0a7f78214a4124b53b6ba616d00c7ff3e
size 731909

30
fix_hadoop.patch
View File

@ -1,30 +0,0 @@
Index: fedora-policy-20220428/policy/modules/roles/sysadm.te
===================================================================
--- fedora-policy-20220428.orig/policy/modules/roles/sysadm.te
+++ fedora-policy-20220428/policy/modules/roles/sysadm.te
@@ -315,10 +315,6 @@ optional_policy(`
')
optional_policy(`
- hadoop_role(sysadm_r, sysadm_t)
-')
-
-optional_policy(`
iotop_run(sysadm_t, sysadm_r)
')
Index: fedora-policy-20220428/policy/modules/roles/unprivuser.te
===================================================================
--- fedora-policy-20220428.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20220428/policy/modules/roles/unprivuser.te
@@ -210,10 +210,6 @@ ifndef(`distro_redhat',`
')
optional_policy(`
- hadoop_role(user_r, user_t)
- ')
-
- optional_policy(`
irc_role(user_r, user_t)
')

22
fix_init.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20220428/policy/modules/system/init.te Index: fedora-policy-20220624/policy/modules/system/init.te
=================================================================== ===================================================================
--- fedora-policy-20220428.orig/policy/modules/system/init.te --- fedora-policy-20220624.orig/policy/modules/system/init.te
+++ fedora-policy-20220428/policy/modules/system/init.te +++ fedora-policy-20220624/policy/modules/system/init.te
@@ -187,6 +187,8 @@ allow init_t self:bpf { map_create map_r @@ -187,6 +187,8 @@ allow init_t self:bpf { map_create map_r
# setuid (from /sbin/shutdown) # setuid (from /sbin/shutdown)
# sys_chroot (from /usr/bin/chroot): now provided by corecmd_chroot_exec_chroot() # sys_chroot (from /usr/bin/chroot): now provided by corecmd_chroot_exec_chroot()
@ -28,7 +28,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te
seutil_read_config(init_t) seutil_read_config(init_t)
seutil_read_login_config(init_t) seutil_read_login_config(init_t)
@@ -446,9 +451,19 @@ ifdef(`distro_redhat',` @@ -448,9 +453,19 @@ ifdef(`distro_redhat',`
corecmd_shell_domtrans(init_t, initrc_t) corecmd_shell_domtrans(init_t, initrc_t)
storage_raw_rw_fixed_disk(init_t) storage_raw_rw_fixed_disk(init_t)
@ -46,9 +46,9 @@ Index: fedora-policy-20220428/policy/modules/system/init.te
+') +')
+ +
optional_policy(` optional_policy(`
bootloader_domtrans(init_t) anaconda_stream_connect(init_t)
') anaconda_create_unix_stream_sockets(init_t)
@@ -573,10 +588,10 @@ tunable_policy(`init_audit_control',` @@ -580,10 +595,10 @@ tunable_policy(`init_audit_control',`
allow init_t self:system all_system_perms; allow init_t self:system all_system_perms;
allow init_t self:system module_load; allow init_t self:system module_load;
allow init_t self:unix_dgram_socket { create_socket_perms sendto }; allow init_t self:unix_dgram_socket { create_socket_perms sendto };
@ -61,7 +61,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te
allow init_t self:netlink_selinux_socket create_socket_perms; allow init_t self:netlink_selinux_socket create_socket_perms;
allow init_t self:unix_dgram_socket lock; allow init_t self:unix_dgram_socket lock;
# Until systemd is fixed # Until systemd is fixed
@@ -635,6 +650,7 @@ files_delete_all_spool_sockets(init_t) @@ -642,6 +657,7 @@ files_delete_all_spool_sockets(init_t)
files_create_var_lib_dirs(init_t) files_create_var_lib_dirs(init_t)
files_create_var_lib_symlinks(init_t) files_create_var_lib_symlinks(init_t)
files_read_var_lib_symlinks(init_t) files_read_var_lib_symlinks(init_t)
@ -69,7 +69,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te
files_manage_urandom_seed(init_t) files_manage_urandom_seed(init_t)
files_list_locks(init_t) files_list_locks(init_t)
files_list_spool(init_t) files_list_spool(init_t)
@@ -672,7 +688,7 @@ fs_list_all(init_t) @@ -679,7 +695,7 @@ fs_list_all(init_t)
fs_list_auto_mountpoints(init_t) fs_list_auto_mountpoints(init_t)
fs_register_binary_executable_type(init_t) fs_register_binary_executable_type(init_t)
fs_relabel_tmpfs_sock_file(init_t) fs_relabel_tmpfs_sock_file(init_t)
@ -78,7 +78,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te
fs_relabel_cgroup_dirs(init_t) fs_relabel_cgroup_dirs(init_t)
fs_search_cgroup_dirs(init_t) fs_search_cgroup_dirs(init_t)
# for network namespaces # for network namespaces
@@ -728,6 +744,7 @@ systemd_write_inherited_logind_sessions_ @@ -735,6 +751,7 @@ systemd_write_inherited_logind_sessions_
create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type) create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
create_dirs_pattern(init_t, var_log_t, var_log_t) create_dirs_pattern(init_t, var_log_t, var_log_t)
@ -86,7 +86,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te
auth_use_nsswitch(init_t) auth_use_nsswitch(init_t)
auth_rw_login_records(init_t) auth_rw_login_records(init_t)
@@ -1578,6 +1595,8 @@ optional_policy(` @@ -1589,6 +1606,8 @@ optional_policy(`
optional_policy(` optional_policy(`
postfix_list_spool(initrc_t) postfix_list_spool(initrc_t)

14
fix_kernel_sysctl.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20220428/policy/modules/kernel/files.fc Index: fedora-policy-20220624/policy/modules/kernel/files.fc
=================================================================== ===================================================================
--- fedora-policy-20220428.orig/policy/modules/kernel/files.fc --- fedora-policy-20220624.orig/policy/modules/kernel/files.fc
+++ fedora-policy-20220428/policy/modules/kernel/files.fc +++ fedora-policy-20220624/policy/modules/kernel/files.fc
@@ -236,6 +236,8 @@ ifdef(`distro_redhat',` @@ -242,6 +242,8 @@ ifdef(`distro_redhat',`
/usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0) /usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0)
/usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0) /usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0)
/usr/lib/modules(/.*)/initramfs.img -- gen_context(system_u:object_r:usr_t,s0) /usr/lib/modules(/.*)/initramfs.img -- gen_context(system_u:object_r:usr_t,s0)
@ -11,10 +11,10 @@ Index: fedora-policy-20220428/policy/modules/kernel/files.fc
/usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) /usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
Index: fedora-policy-20220428/policy/modules/system/systemd.te Index: fedora-policy-20220624/policy/modules/system/systemd.te
=================================================================== ===================================================================
--- fedora-policy-20220428.orig/policy/modules/system/systemd.te --- fedora-policy-20220624.orig/policy/modules/system/systemd.te
+++ fedora-policy-20220428/policy/modules/system/systemd.te +++ fedora-policy-20220624/policy/modules/system/systemd.te
@@ -1052,6 +1052,8 @@ init_stream_connect(systemd_sysctl_t) @@ -1052,6 +1052,8 @@ init_stream_connect(systemd_sysctl_t)
logging_send_syslog_msg(systemd_sysctl_t) logging_send_syslog_msg(systemd_sysctl_t)

14
fix_locallogin.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy/policy/modules/system/locallogin.te Index: fedora-policy-20220624/policy/modules/system/locallogin.te
=================================================================== ===================================================================
--- fedora-policy.orig/policy/modules/system/locallogin.te 2020-02-19 09:36:25.440182406 +0000 --- fedora-policy-20220624.orig/policy/modules/system/locallogin.te
+++ fedora-policy/policy/modules/system/locallogin.te 2020-02-21 08:52:35.961803038 +0000 +++ fedora-policy-20220624/policy/modules/system/locallogin.te
@@ -63,6 +63,7 @@ kernel_read_system_state(local_login_t) @@ -63,6 +63,7 @@ kernel_read_system_state(local_login_t)
kernel_read_kernel_sysctls(local_login_t) kernel_read_kernel_sysctls(local_login_t)
kernel_search_key(local_login_t) kernel_search_key(local_login_t)
@ -10,3 +10,11 @@ Index: fedora-policy/policy/modules/system/locallogin.te
corecmd_list_bin(local_login_t) corecmd_list_bin(local_login_t)
corecmd_read_bin_symlinks(local_login_t) corecmd_read_bin_symlinks(local_login_t)
@@ -137,6 +138,7 @@ auth_rw_faillog(local_login_t)
auth_manage_pam_console_data(local_login_t)
auth_domtrans_pam_console(local_login_t)
auth_use_nsswitch(local_login_t)
+auth_read_shadow(local_login_t)
init_dontaudit_use_fds(local_login_t)
init_stream_connect(local_login_t)

14
fix_logging.patch
View File

@ -1,7 +1,7 @@
Index: fedora-policy-20211111/policy/modules/system/logging.fc Index: fedora-policy-20220624/policy/modules/system/logging.fc
=================================================================== ===================================================================
--- fedora-policy-20211111.orig/policy/modules/system/logging.fc --- fedora-policy-20220624.orig/policy/modules/system/logging.fc
+++ fedora-policy-20211111/policy/modules/system/logging.fc +++ fedora-policy-20220624/policy/modules/system/logging.fc
@@ -3,6 +3,8 @@ @@ -3,6 +3,8 @@
/etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
@ -19,11 +19,11 @@ Index: fedora-policy-20211111/policy/modules/system/logging.fc
/var/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) /var/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
/var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh) /var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh)
Index: fedora-policy-20211111/policy/modules/system/logging.if Index: fedora-policy-20220624/policy/modules/system/logging.if
=================================================================== ===================================================================
--- fedora-policy-20211111.orig/policy/modules/system/logging.if --- fedora-policy-20220624.orig/policy/modules/system/logging.if
+++ fedora-policy-20211111/policy/modules/system/logging.if +++ fedora-policy-20220624/policy/modules/system/logging.if
@@ -1787,3 +1787,22 @@ interface(`logging_dgram_send',` @@ -1788,3 +1788,22 @@ interface(`logging_dgram_send',`
allow $1 syslogd_t:unix_dgram_socket sendto; allow $1 syslogd_t:unix_dgram_socket sendto;
') ')

16
fix_networkmanager.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.te Index: fedora-policy-20220624/policy/modules/contrib/networkmanager.te
=================================================================== ===================================================================
--- fedora-policy-20220428.orig/policy/modules/contrib/networkmanager.te --- fedora-policy-20220624.orig/policy/modules/contrib/networkmanager.te
+++ fedora-policy-20220428/policy/modules/contrib/networkmanager.te +++ fedora-policy-20220624/policy/modules/contrib/networkmanager.te
@@ -271,6 +271,9 @@ userdom_read_home_certs(NetworkManager_t @@ -276,6 +276,9 @@ userdom_read_home_certs(NetworkManager_t
userdom_read_user_home_content_files(NetworkManager_t) userdom_read_user_home_content_files(NetworkManager_t)
userdom_dgram_send(NetworkManager_t) userdom_dgram_send(NetworkManager_t)
@ -12,7 +12,7 @@ Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.te
tunable_policy(`use_nfs_home_dirs',` tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(NetworkManager_t) fs_read_nfs_files(NetworkManager_t)
') ')
@@ -288,6 +291,14 @@ optional_policy(` @@ -293,6 +296,14 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -27,10 +27,10 @@ Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.te
bind_domtrans(NetworkManager_t) bind_domtrans(NetworkManager_t)
bind_manage_cache(NetworkManager_t) bind_manage_cache(NetworkManager_t)
bind_kill(NetworkManager_t) bind_kill(NetworkManager_t)
Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.if Index: fedora-policy-20220624/policy/modules/contrib/networkmanager.if
=================================================================== ===================================================================
--- fedora-policy-20220428.orig/policy/modules/contrib/networkmanager.if --- fedora-policy-20220624.orig/policy/modules/contrib/networkmanager.if
+++ fedora-policy-20220428/policy/modules/contrib/networkmanager.if +++ fedora-policy-20220624/policy/modules/contrib/networkmanager.if
@@ -132,6 +132,24 @@ interface(`networkmanager_initrc_domtran @@ -132,6 +132,24 @@ interface(`networkmanager_initrc_domtran
init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t) init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t)
') ')

8
fix_unprivuser.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20220428/policy/modules/roles/unprivuser.te Index: fedora-policy-20220624/policy/modules/roles/unprivuser.te
=================================================================== ===================================================================
--- fedora-policy-20220428.orig/policy/modules/roles/unprivuser.te --- fedora-policy-20220624.orig/policy/modules/roles/unprivuser.te
+++ fedora-policy-20220428/policy/modules/roles/unprivuser.te +++ fedora-policy-20220624/policy/modules/roles/unprivuser.te
@@ -292,6 +292,13 @@ ifndef(`distro_redhat',` @@ -296,6 +296,13 @@ ifndef(`distro_redhat',`
') ')
optional_policy(` optional_policy(`

13
selinux-policy.changes
View File

@ -1,3 +1,16 @@
-------------------------------------------------------------------
Fri Jun 24 06:32:55 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
- Update to version 20220624. Refreshed:
* fix_init.patch
* fix_kernel_sysctl.patch
* fix_logging.patch
* fix_networkmanager.patch
* fix_unprivuser.patch
Dropped fix_hadoop.patch, not necessary anymore
* Updated fix_locallogin.patch to allow accesses for nss-systemd
(bsc#1199630)
------------------------------------------------------------------- -------------------------------------------------------------------
Fri May 20 13:46:47 UTC 2022 - Johannes Segitz <jsegitz@suse.com> Fri May 20 13:46:47 UTC 2022 - Johannes Segitz <jsegitz@suse.com>

3
selinux-policy.spec
View File

@ -33,7 +33,7 @@ Summary: SELinux policy configuration
License: GPL-2.0-or-later License: GPL-2.0-or-later
Group: System/Management Group: System/Management
Name: selinux-policy Name: selinux-policy
Version: 20220520 Version: 20220624
Release: 0 Release: 0
Source: fedora-policy-%{version}.tar.bz2 Source: fedora-policy-%{version}.tar.bz2
Source1: selinux-policy-rpmlintrc Source1: selinux-policy-rpmlintrc
@ -88,7 +88,6 @@ Source131: rebootmgr.fc
Patch001: fix_djbdns.patch Patch001: fix_djbdns.patch
Patch002: fix_dbus.patch Patch002: fix_dbus.patch
Patch004: fix_java.patch Patch004: fix_java.patch
Patch005: fix_hadoop.patch
Patch006: fix_thunderbird.patch Patch006: fix_thunderbird.patch
Patch007: fix_postfix.patch Patch007: fix_postfix.patch
Patch008: fix_nscd.patch Patch008: fix_nscd.patch