rpm/selinux-policy
SHA256
1
0
Fork 0
forked from pool/selinux-policy
Code Pull Requests Activity

Accepting request 978218 from home:jsegitz:branches:security:SELinux_3.3

Browse Source 
- Add fix_dnsmasq.patch to fix problems with virtualization on Microos
  (bsc#1199518)

- Modified fix_init.patch to allow init to setup contrained environment
  for accountsservice. This needs a better, more general solution
  (bsc#1197610)

- Add systemd_domain_dyntrans_type.patch to allow systemd to dyntransition.
  This happens in certain boot conditions (bsc#1182500)
- Changed fix_unconfineduser.patch to not transition into ldconfig_t
  from unconfined_t (bsc#1197169)

OBS-URL: https://build.opensuse.org/request/show/978218
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=128
This commit is contained in:
Johannes Segitz 2022-05-20 07:36:43 +00:00 committed by Git OBS Bridge
parent d6ac89f53f
commit c6e85fecc6
6 changed files with 79 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
fix_dnsmasq.patch Normal file
View File

@ -0,0 +1,12 @@
Index: fedora-policy-20220519/policy/modules/contrib/dnsmasq.te
===================================================================
--- fedora-policy-20220519.orig/policy/modules/contrib/dnsmasq.te
+++ fedora-policy-20220519/policy/modules/contrib/dnsmasq.te
@@ -115,6 +115,7 @@ libs_exec_ldconfig(dnsmasq_t)
logging_send_syslog_msg(dnsmasq_t)
miscfiles_read_public_files(dnsmasq_t)
+sysnet_manage_config_dirs(dnsmasq_t)
userdom_dontaudit_use_unpriv_user_fds(dnsmasq_t)
userdom_dontaudit_search_user_home_dirs(dnsmasq_t)

41
fix_init.patch
View File

@ -1,8 +1,17 @@
Index: fedora-policy-20220124/policy/modules/system/init.te
Index: fedora-policy-20220519/policy/modules/system/init.te
===================================================================
--- fedora-policy-20220124.orig/policy/modules/system/init.te
+++ fedora-policy-20220124/policy/modules/system/init.te
@@ -267,6 +267,8 @@ corecmd_exec_bin(init_t)
--- fedora-policy-20220519.orig/policy/modules/system/init.te
+++ fedora-policy-20220519/policy/modules/system/init.te
@@ -187,6 +187,8 @@ allow init_t self:bpf { map_create map_r
# setuid (from /sbin/shutdown)
# sys_chroot (from /usr/bin/chroot): now provided by corecmd_chroot_exec_chroot()
+# bsc#1197610, find a better, generic solution
+allow init_t self:file mounton;
allow init_t self:fifo_file rw_fifo_file_perms;
allow init_t self:service manage_service_perms;
@@ -267,6 +269,8 @@ corecmd_exec_bin(init_t)
corenet_all_recvfrom_netlabel(init_t)
corenet_tcp_bind_all_ports(init_t)
corenet_udp_bind_all_ports(init_t)
@ -11,7 +20,7 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
dev_create_all_files(init_t)
dev_create_all_chr_files(init_t)
@@ -394,6 +396,7 @@ logging_manage_audit_config(init_t)
@@ -396,6 +400,7 @@ logging_manage_audit_config(init_t)
logging_create_syslog_netlink_audit_socket(init_t)
logging_write_var_log_dirs(init_t)
logging_manage_var_log_symlinks(init_t)
@ -19,7 +28,7 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
seutil_read_config(init_t)
seutil_read_login_config(init_t)
@@ -444,10 +447,15 @@ ifdef(`distro_redhat',`
@@ -448,9 +453,19 @@ ifdef(`distro_redhat',`
corecmd_shell_domtrans(init_t, initrc_t)
storage_raw_rw_fixed_disk(init_t)
@ -27,15 +36,19 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
sysnet_read_dhcpc_state(init_t)
optional_policy(`
+ networkmanager_initrc_read_lnk_files(init_t)
+# bsc#1197610, find a better, generic solution
+optional_policy(`
+ mta_getattr_spool(init_t)
+')
+
+optional_policy(`
+ networkmanager_initrc_read_lnk_files(init_t)
+')
+
optional_policy(`
bootloader_domtrans(init_t)
')
@@ -571,10 +579,10 @@ tunable_policy(`init_audit_control',`
@@ -575,10 +590,10 @@ tunable_policy(`init_audit_control',`
allow init_t self:system all_system_perms;
allow init_t self:system module_load;
allow init_t self:unix_dgram_socket { create_socket_perms sendto };
@ -48,7 +61,7 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
allow init_t self:netlink_selinux_socket create_socket_perms;
allow init_t self:unix_dgram_socket lock;
# Until systemd is fixed
@@ -633,6 +641,7 @@ files_delete_all_spool_sockets(init_t)
@@ -637,6 +652,7 @@ files_delete_all_spool_sockets(init_t)
files_create_var_lib_dirs(init_t)
files_create_var_lib_symlinks(init_t)
files_read_var_lib_symlinks(init_t)
@ -56,7 +69,7 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
files_manage_urandom_seed(init_t)
files_list_locks(init_t)
files_list_spool(init_t)
@@ -669,7 +678,7 @@ fs_list_all(init_t)
@@ -674,7 +690,7 @@ fs_list_all(init_t)
fs_list_auto_mountpoints(init_t)
fs_register_binary_executable_type(init_t)
fs_relabel_tmpfs_sock_file(init_t)
@ -65,7 +78,7 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
fs_relabel_cgroup_dirs(init_t)
fs_search_cgroup_dirs(init_t)
# for network namespaces
@@ -725,6 +734,7 @@ systemd_write_inherited_logind_sessions_
@@ -730,6 +746,7 @@ systemd_write_inherited_logind_sessions_
create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
create_dirs_pattern(init_t, var_log_t, var_log_t)
@ -73,7 +86,7 @@ Index: fedora-policy-20220124/policy/modules/system/init.te
auth_use_nsswitch(init_t)
auth_rw_login_records(init_t)
@@ -1571,6 +1581,8 @@ optional_policy(`
@@ -1580,6 +1597,8 @@ optional_policy(`
optional_policy(`
postfix_list_spool(initrc_t)

23
fix_unconfineduser.patch
View File

@ -1,8 +1,8 @@
Index: fedora-policy-20211111/policy/modules/roles/unconfineduser.te
Index: fedora-policy-20220509/policy/modules/roles/unconfineduser.te
===================================================================
--- fedora-policy-20211111.orig/policy/modules/roles/unconfineduser.te
+++ fedora-policy-20211111/policy/modules/roles/unconfineduser.te
@@ -122,6 +122,11 @@ tunable_policy(`unconfined_dyntrans_all'
--- fedora-policy-20220509.orig/policy/modules/roles/unconfineduser.te
+++ fedora-policy-20220509/policy/modules/roles/unconfineduser.te
@@ -124,6 +124,11 @@ tunable_policy(`unconfined_dyntrans_all'
domain_dyntrans(unconfined_t)
')
@ -14,7 +14,7 @@ Index: fedora-policy-20211111/policy/modules/roles/unconfineduser.te
optional_policy(`
gen_require(`
type unconfined_t;
@@ -208,6 +213,10 @@ optional_policy(`
@@ -210,6 +215,10 @@ optional_policy(`
')
optional_policy(`
@ -25,7 +25,7 @@ Index: fedora-policy-20211111/policy/modules/roles/unconfineduser.te
chrome_role_notrans(unconfined_r, unconfined_t)
tunable_policy(`unconfined_chrome_sandbox_transition',`
@@ -242,6 +251,18 @@ optional_policy(`
@@ -244,6 +253,18 @@ optional_policy(`
dbus_stub(unconfined_t)
optional_policy(`
@ -44,14 +44,3 @@ Index: fedora-policy-20211111/policy/modules/roles/unconfineduser.te
bluetooth_dbus_chat(unconfined_t)
')
@@ -305,6 +326,10 @@ optional_policy(`
')
optional_policy(`
+ libs_run_ldconfig(unconfined_t, unconfined_r)
+')
+
+optional_policy(`
firstboot_run(unconfined_t, unconfined_r)
')

19
selinux-policy.changes
View File

@ -1,4 +1,23 @@
-------------------------------------------------------------------
Thu May 19 12:25:31 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
- Add fix_dnsmasq.patch to fix problems with virtualization on Microos
(bsc#1199518)
-------------------------------------------------------------------
Tue May 3 13:18:38 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
- Modified fix_init.patch to allow init to setup contrained environment
for accountsservice. This needs a better, more general solution
(bsc#1197610)
-------------------------------------------------------------------
Mon May 2 11:27:49 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
- Add systemd_domain_dyntrans_type.patch to allow systemd to dyntransition.
This happens in certain boot conditions (bsc#1182500)
- Changed fix_unconfineduser.patch to not transition into ldconfig_t
from unconfined_t (bsc#1197169)
-------------------------------------------------------------------
Thu Feb 17 12:24:13 UTC 2022 - Klaus Kämpf <kkaempf@suse.com>
- use %license tag for COPYING file

2
selinux-policy.spec
View File

@ -140,6 +140,8 @@ Patch055: fix_auditd.patch
Patch056: fix_wine.patch
Patch057: fix_hypervkvp.patch
Patch058: fix_bitlbee.patch
Patch059: systemd_domain_dyntrans_type.patch
Patch060: fix_dnsmasq.patch
Patch100: sedoctool.patch

13
systemd_domain_dyntrans_type.patch Normal file
View File

@ -0,0 +1,13 @@
Index: fedora-policy-20220124/policy/modules/system/init.te
===================================================================
--- fedora-policy-20220124.orig/policy/modules/system/init.te
+++ fedora-policy-20220124/policy/modules/system/init.te
@@ -179,6 +179,8 @@ allow init_t self:tcp_socket { listen ac
allow init_t self:packet_socket create_socket_perms;
allow init_t self:key manage_key_perms;
allow init_t self:bpf { map_create map_read map_write prog_load prog_run };
+domain_dyntrans_type(init_t)
+allow init_t self:process { dyntransition setcurrent };
# is ~sys_module really needed? observed:
# sys_boot