forked from pool/selinux-policy
Accepting request 984856 from security:SELinux
OBS-URL: https://build.opensuse.org/request/show/984856 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/selinux-policy?expand=0&rev=26
This commit is contained in:
Dominique Leuenberger
Git OBS Bridge
commit
c9dc623f03
@ -1,3 +0,0 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:90d1df3189f84ff576e2bd3cf5bc504bac06037d3475ea1904d2b9eda9d164e7
|
||||
size 730405
|
||||
3
fedora-policy-20220624.tar.bz2
Normal file
3
fedora-policy-20220624.tar.bz2
Normal file
@ -0,0 +1,3 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:1cd368f29dfa53404b27e8cd3a055bf0a7f78214a4124b53b6ba616d00c7ff3e
|
||||
size 731909
|
||||
@ -1,30 +0,0 @@
|
||||
Index: fedora-policy-20220428/policy/modules/roles/sysadm.te
|
||||
===================================================================
|
||||
--- fedora-policy-20220428.orig/policy/modules/roles/sysadm.te
|
||||
+++ fedora-policy-20220428/policy/modules/roles/sysadm.te
|
||||
@@ -315,10 +315,6 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
- hadoop_role(sysadm_r, sysadm_t)
|
||||
-')
|
||||
-
|
||||
-optional_policy(`
|
||||
iotop_run(sysadm_t, sysadm_r)
|
||||
')
|
||||
|
||||
Index: fedora-policy-20220428/policy/modules/roles/unprivuser.te
|
||||
===================================================================
|
||||
--- fedora-policy-20220428.orig/policy/modules/roles/unprivuser.te
|
||||
+++ fedora-policy-20220428/policy/modules/roles/unprivuser.te
|
||||
@@ -210,10 +210,6 @@ ifndef(`distro_redhat',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
- hadoop_role(user_r, user_t)
|
||||
- ')
|
||||
-
|
||||
- optional_policy(`
|
||||
irc_role(user_r, user_t)
|
||||
')
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
Index: fedora-policy-20220428/policy/modules/system/init.te
|
||||
Index: fedora-policy-20220624/policy/modules/system/init.te
|
||||
===================================================================
|
||||
--- fedora-policy-20220428.orig/policy/modules/system/init.te
|
||||
+++ fedora-policy-20220428/policy/modules/system/init.te
|
||||
--- fedora-policy-20220624.orig/policy/modules/system/init.te
|
||||
+++ fedora-policy-20220624/policy/modules/system/init.te
|
||||
@@ -187,6 +187,8 @@ allow init_t self:bpf { map_create map_r
|
||||
# setuid (from /sbin/shutdown)
|
||||
# sys_chroot (from /usr/bin/chroot): now provided by corecmd_chroot_exec_chroot()
|
||||
@ -28,7 +28,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te
|
||||
|
||||
seutil_read_config(init_t)
|
||||
seutil_read_login_config(init_t)
|
||||
@@ -446,9 +451,19 @@ ifdef(`distro_redhat',`
|
||||
@@ -448,9 +453,19 @@ ifdef(`distro_redhat',`
|
||||
corecmd_shell_domtrans(init_t, initrc_t)
|
||||
|
||||
storage_raw_rw_fixed_disk(init_t)
|
||||
@ -46,9 +46,9 @@ Index: fedora-policy-20220428/policy/modules/system/init.te
|
||||
+')
|
||||
+
|
||||
optional_policy(`
|
||||
bootloader_domtrans(init_t)
|
||||
')
|
||||
@@ -573,10 +588,10 @@ tunable_policy(`init_audit_control',`
|
||||
anaconda_stream_connect(init_t)
|
||||
anaconda_create_unix_stream_sockets(init_t)
|
||||
@@ -580,10 +595,10 @@ tunable_policy(`init_audit_control',`
|
||||
allow init_t self:system all_system_perms;
|
||||
allow init_t self:system module_load;
|
||||
allow init_t self:unix_dgram_socket { create_socket_perms sendto };
|
||||
@ -61,7 +61,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te
|
||||
allow init_t self:netlink_selinux_socket create_socket_perms;
|
||||
allow init_t self:unix_dgram_socket lock;
|
||||
# Until systemd is fixed
|
||||
@@ -635,6 +650,7 @@ files_delete_all_spool_sockets(init_t)
|
||||
@@ -642,6 +657,7 @@ files_delete_all_spool_sockets(init_t)
|
||||
files_create_var_lib_dirs(init_t)
|
||||
files_create_var_lib_symlinks(init_t)
|
||||
files_read_var_lib_symlinks(init_t)
|
||||
@ -69,7 +69,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te
|
||||
files_manage_urandom_seed(init_t)
|
||||
files_list_locks(init_t)
|
||||
files_list_spool(init_t)
|
||||
@@ -672,7 +688,7 @@ fs_list_all(init_t)
|
||||
@@ -679,7 +695,7 @@ fs_list_all(init_t)
|
||||
fs_list_auto_mountpoints(init_t)
|
||||
fs_register_binary_executable_type(init_t)
|
||||
fs_relabel_tmpfs_sock_file(init_t)
|
||||
@ -78,7 +78,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te
|
||||
fs_relabel_cgroup_dirs(init_t)
|
||||
fs_search_cgroup_dirs(init_t)
|
||||
# for network namespaces
|
||||
@@ -728,6 +744,7 @@ systemd_write_inherited_logind_sessions_
|
||||
@@ -735,6 +751,7 @@ systemd_write_inherited_logind_sessions_
|
||||
create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
|
||||
|
||||
create_dirs_pattern(init_t, var_log_t, var_log_t)
|
||||
@ -86,7 +86,7 @@ Index: fedora-policy-20220428/policy/modules/system/init.te
|
||||
|
||||
auth_use_nsswitch(init_t)
|
||||
auth_rw_login_records(init_t)
|
||||
@@ -1578,6 +1595,8 @@ optional_policy(`
|
||||
@@ -1589,6 +1606,8 @@ optional_policy(`
|
||||
|
||||
optional_policy(`
|
||||
postfix_list_spool(initrc_t)
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
Index: fedora-policy-20220428/policy/modules/kernel/files.fc
|
||||
Index: fedora-policy-20220624/policy/modules/kernel/files.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20220428.orig/policy/modules/kernel/files.fc
|
||||
+++ fedora-policy-20220428/policy/modules/kernel/files.fc
|
||||
@@ -236,6 +236,8 @@ ifdef(`distro_redhat',`
|
||||
--- fedora-policy-20220624.orig/policy/modules/kernel/files.fc
|
||||
+++ fedora-policy-20220624/policy/modules/kernel/files.fc
|
||||
@@ -242,6 +242,8 @@ ifdef(`distro_redhat',`
|
||||
/usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0)
|
||||
/usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0)
|
||||
/usr/lib/modules(/.*)/initramfs.img -- gen_context(system_u:object_r:usr_t,s0)
|
||||
@ -11,10 +11,10 @@ Index: fedora-policy-20220428/policy/modules/kernel/files.fc
|
||||
|
||||
/usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
|
||||
|
||||
Index: fedora-policy-20220428/policy/modules/system/systemd.te
|
||||
Index: fedora-policy-20220624/policy/modules/system/systemd.te
|
||||
===================================================================
|
||||
--- fedora-policy-20220428.orig/policy/modules/system/systemd.te
|
||||
+++ fedora-policy-20220428/policy/modules/system/systemd.te
|
||||
--- fedora-policy-20220624.orig/policy/modules/system/systemd.te
|
||||
+++ fedora-policy-20220624/policy/modules/system/systemd.te
|
||||
@@ -1052,6 +1052,8 @@ init_stream_connect(systemd_sysctl_t)
|
||||
logging_send_syslog_msg(systemd_sysctl_t)
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
Index: fedora-policy/policy/modules/system/locallogin.te
|
||||
Index: fedora-policy-20220624/policy/modules/system/locallogin.te
|
||||
===================================================================
|
||||
--- fedora-policy.orig/policy/modules/system/locallogin.te 2020-02-19 09:36:25.440182406 +0000
|
||||
+++ fedora-policy/policy/modules/system/locallogin.te 2020-02-21 08:52:35.961803038 +0000
|
||||
--- fedora-policy-20220624.orig/policy/modules/system/locallogin.te
|
||||
+++ fedora-policy-20220624/policy/modules/system/locallogin.te
|
||||
@@ -63,6 +63,7 @@ kernel_read_system_state(local_login_t)
|
||||
kernel_read_kernel_sysctls(local_login_t)
|
||||
kernel_search_key(local_login_t)
|
||||
@ -10,3 +10,11 @@ Index: fedora-policy/policy/modules/system/locallogin.te
|
||||
|
||||
corecmd_list_bin(local_login_t)
|
||||
corecmd_read_bin_symlinks(local_login_t)
|
||||
@@ -137,6 +138,7 @@ auth_rw_faillog(local_login_t)
|
||||
auth_manage_pam_console_data(local_login_t)
|
||||
auth_domtrans_pam_console(local_login_t)
|
||||
auth_use_nsswitch(local_login_t)
|
||||
+auth_read_shadow(local_login_t)
|
||||
|
||||
init_dontaudit_use_fds(local_login_t)
|
||||
init_stream_connect(local_login_t)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
Index: fedora-policy-20211111/policy/modules/system/logging.fc
|
||||
Index: fedora-policy-20220624/policy/modules/system/logging.fc
|
||||
===================================================================
|
||||
--- fedora-policy-20211111.orig/policy/modules/system/logging.fc
|
||||
+++ fedora-policy-20211111/policy/modules/system/logging.fc
|
||||
--- fedora-policy-20220624.orig/policy/modules/system/logging.fc
|
||||
+++ fedora-policy-20220624/policy/modules/system/logging.fc
|
||||
@@ -3,6 +3,8 @@
|
||||
/etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
|
||||
/etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
|
||||
@ -19,11 +19,11 @@ Index: fedora-policy-20211111/policy/modules/system/logging.fc
|
||||
/var/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
|
||||
|
||||
/var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh)
|
||||
Index: fedora-policy-20211111/policy/modules/system/logging.if
|
||||
Index: fedora-policy-20220624/policy/modules/system/logging.if
|
||||
===================================================================
|
||||
--- fedora-policy-20211111.orig/policy/modules/system/logging.if
|
||||
+++ fedora-policy-20211111/policy/modules/system/logging.if
|
||||
@@ -1787,3 +1787,22 @@ interface(`logging_dgram_send',`
|
||||
--- fedora-policy-20220624.orig/policy/modules/system/logging.if
|
||||
+++ fedora-policy-20220624/policy/modules/system/logging.if
|
||||
@@ -1788,3 +1788,22 @@ interface(`logging_dgram_send',`
|
||||
|
||||
allow $1 syslogd_t:unix_dgram_socket sendto;
|
||||
')
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.te
|
||||
Index: fedora-policy-20220624/policy/modules/contrib/networkmanager.te
|
||||
===================================================================
|
||||
--- fedora-policy-20220428.orig/policy/modules/contrib/networkmanager.te
|
||||
+++ fedora-policy-20220428/policy/modules/contrib/networkmanager.te
|
||||
@@ -271,6 +271,9 @@ userdom_read_home_certs(NetworkManager_t
|
||||
--- fedora-policy-20220624.orig/policy/modules/contrib/networkmanager.te
|
||||
+++ fedora-policy-20220624/policy/modules/contrib/networkmanager.te
|
||||
@@ -276,6 +276,9 @@ userdom_read_home_certs(NetworkManager_t
|
||||
userdom_read_user_home_content_files(NetworkManager_t)
|
||||
userdom_dgram_send(NetworkManager_t)
|
||||
|
||||
@ -12,7 +12,7 @@ Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.te
|
||||
tunable_policy(`use_nfs_home_dirs',`
|
||||
fs_read_nfs_files(NetworkManager_t)
|
||||
')
|
||||
@@ -288,6 +291,14 @@ optional_policy(`
|
||||
@@ -293,6 +296,14 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -27,10 +27,10 @@ Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.te
|
||||
bind_domtrans(NetworkManager_t)
|
||||
bind_manage_cache(NetworkManager_t)
|
||||
bind_kill(NetworkManager_t)
|
||||
Index: fedora-policy-20220428/policy/modules/contrib/networkmanager.if
|
||||
Index: fedora-policy-20220624/policy/modules/contrib/networkmanager.if
|
||||
===================================================================
|
||||
--- fedora-policy-20220428.orig/policy/modules/contrib/networkmanager.if
|
||||
+++ fedora-policy-20220428/policy/modules/contrib/networkmanager.if
|
||||
--- fedora-policy-20220624.orig/policy/modules/contrib/networkmanager.if
|
||||
+++ fedora-policy-20220624/policy/modules/contrib/networkmanager.if
|
||||
@@ -132,6 +132,24 @@ interface(`networkmanager_initrc_domtran
|
||||
init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t)
|
||||
')
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
Index: fedora-policy-20220428/policy/modules/roles/unprivuser.te
|
||||
Index: fedora-policy-20220624/policy/modules/roles/unprivuser.te
|
||||
===================================================================
|
||||
--- fedora-policy-20220428.orig/policy/modules/roles/unprivuser.te
|
||||
+++ fedora-policy-20220428/policy/modules/roles/unprivuser.te
|
||||
@@ -292,6 +292,13 @@ ifndef(`distro_redhat',`
|
||||
--- fedora-policy-20220624.orig/policy/modules/roles/unprivuser.te
|
||||
+++ fedora-policy-20220624/policy/modules/roles/unprivuser.te
|
||||
@@ -296,6 +296,13 @@ ifndef(`distro_redhat',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
||||
@ -1,3 +1,16 @@
|
||||
-------------------------------------------------------------------
|
||||
Fri Jun 24 06:32:55 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Update to version 20220624. Refreshed:
|
||||
* fix_init.patch
|
||||
* fix_kernel_sysctl.patch
|
||||
* fix_logging.patch
|
||||
* fix_networkmanager.patch
|
||||
* fix_unprivuser.patch
|
||||
Dropped fix_hadoop.patch, not necessary anymore
|
||||
* Updated fix_locallogin.patch to allow accesses for nss-systemd
|
||||
(bsc#1199630)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri May 20 13:46:47 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
|
||||
@ -33,7 +33,7 @@ Summary: SELinux policy configuration
|
||||
License: GPL-2.0-or-later
|
||||
Group: System/Management
|
||||
Name: selinux-policy
|
||||
Version: 20220520
|
||||
Version: 20220624
|
||||
Release: 0
|
||||
Source: fedora-policy-%{version}.tar.bz2
|
||||
Source1: selinux-policy-rpmlintrc
|
||||
@ -88,7 +88,6 @@ Source131: rebootmgr.fc
|
||||
Patch001: fix_djbdns.patch
|
||||
Patch002: fix_dbus.patch
|
||||
Patch004: fix_java.patch
|
||||
Patch005: fix_hadoop.patch
|
||||
Patch006: fix_thunderbird.patch
|
||||
Patch007: fix_postfix.patch
|
||||
Patch008: fix_nscd.patch
|
||||
|
||||
Loading…
Reference in New Issue
Block a user