forked from pool/selinux-policy
c4556003bf
- Update to version 20230125. Refreshed:
* distro_suse_to_distro_redhat.patch
* fix_dnsmasq.patch
* fix_init.patch
* fix_ipsec.patch
* fix_kernel_sysctl.patch
* fix_logging.patch
* fix_rpm.patch
* fix_selinuxutil.patch
* fix_systemd_watch.patch
* fix_userdomain.patch
- More flexible lib(exec) matching in fix_fwupd.patch
- Removed sys_admin for systemd_gpt_generator_t in fix_systemd.patch
- Dropped fix_container.patch, is now upstream
- Added fix_entropyd.patch
* Added new interface entropyd_semaphore_filetrans to properly transfer
semaphore created during early boot. That doesn't work yet, so work
around with next item
* Allow reading tempfs files
- Added fix_kernel.patch. Added modutils_execute_kmod_tmpfs_files interace
to allow kmod_tmpfs_t files to be executed. Necessary for firewalld
- Added fix_rtkit.patch to fix labeling of binary
- Modified fix_ntp.patch:
* Proper labeling for start-ntpd
* Fixed label rules for chroot path
* Temporarily allow dac_override for ntpd_t (bsc#1207577)
* Add interface ntp_manage_pid_files to allow management of pid
files
- Updated fix_networkmanager.patch to allow managing ntp pid files
OBS-URL: https://build.opensuse.org/request/show/1061575
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=171
210 lines
9.0 KiB
Diff
210 lines
9.0 KiB
Diff
Index: fedora-policy-20230116/policy/modules/contrib/apache.fc
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/contrib/apache.fc
|
|
+++ fedora-policy-20230116/policy/modules/contrib/apache.fc
|
|
@@ -74,7 +74,7 @@ HOME_DIR/((www)|(web)|(public_html))(/.*
|
|
/usr/sbin/suexec -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0)
|
|
/usr/sbin/thttpd -- gen_context(system_u:object_r:httpd_exec_t,s0)
|
|
|
|
-ifdef(`distro_suse', `
|
|
+ifdef(`distro_redhat', `
|
|
/usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0)
|
|
')
|
|
|
|
Index: fedora-policy-20230116/policy/modules/contrib/cron.fc
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/contrib/cron.fc
|
|
+++ fedora-policy-20230116/policy/modules/contrib/cron.fc
|
|
@@ -51,7 +51,7 @@ ifdef(`distro_gentoo',`
|
|
/var/spool/cron/lastrun/[^/]* -- <<none>>
|
|
')
|
|
|
|
-ifdef(`distro_suse', `
|
|
+ifdef(`distro_redhat', `
|
|
/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
|
|
/var/spool/cron/lastrun/[^/]* -- <<none>>
|
|
/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
|
|
@@ -70,7 +70,7 @@ ifdef(`distro_gentoo',`
|
|
/var/spool/cron/lastrun/[^/]* -- <<none>>
|
|
')
|
|
|
|
-ifdef(`distro_suse', `
|
|
+ifdef(`distro_redhat', `
|
|
/var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0)
|
|
/var/spool/cron/lastrun/[^/]* -- <<none>>
|
|
/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0)
|
|
Index: fedora-policy-20230116/policy/modules/contrib/rpm.fc
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/contrib/rpm.fc
|
|
+++ fedora-policy-20230116/policy/modules/contrib/rpm.fc
|
|
@@ -82,7 +82,7 @@ ifdef(`distro_redhat', `
|
|
/var/run/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_run_t,s0)
|
|
|
|
# SuSE
|
|
-ifdef(`distro_suse', `
|
|
+ifdef(`distro_redhat', `
|
|
/usr/bin/online_update -- gen_context(system_u:object_r:rpm_exec_t,s0)
|
|
/sbin/yast2 -- gen_context(system_u:object_r:rpm_exec_t,s0)
|
|
/var/lib/YaST2(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
|
|
Index: fedora-policy-20230116/policy/modules/kernel/corecommands.fc
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/kernel/corecommands.fc
|
|
+++ fedora-policy-20230116/policy/modules/kernel/corecommands.fc
|
|
@@ -462,7 +462,7 @@ ifdef(`distro_redhat', `
|
|
/usr/share/texmf/texconfig/tcfmgr -- gen_context(system_u:object_r:bin_t,s0)
|
|
')
|
|
|
|
-ifdef(`distro_suse', `
|
|
+ifdef(`distro_redhat', `
|
|
/usr/lib/cron/run-crons -- gen_context(system_u:object_r:bin_t,s0)
|
|
/usr/lib/samba/classic/.* -- gen_context(system_u:object_r:bin_t,s0)
|
|
/usr/lib/ssh/.* -- gen_context(system_u:object_r:bin_t,s0)
|
|
@@ -491,7 +491,7 @@ ifdef(`distro_suse', `
|
|
/var/lib/glusterd/hooks/.*/.*\.sh -- gen_context(system_u:object_r:bin_t,s0)
|
|
/var/lib/glusterd/hooks/.*/.*\.py -- gen_context(system_u:object_r:bin_t,s0)
|
|
|
|
-ifdef(`distro_suse',`
|
|
+ifdef(`distro_redhat',`
|
|
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
|
|
')
|
|
|
|
Index: fedora-policy-20230116/policy/modules/kernel/devices.fc
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/kernel/devices.fc
|
|
+++ fedora-policy-20230116/policy/modules/kernel/devices.fc
|
|
@@ -148,7 +148,7 @@
|
|
/dev/usb.+ -c gen_context(system_u:object_r:usb_device_t,s0)
|
|
/dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0)
|
|
/dev/usbmon.+ -c gen_context(system_u:object_r:usbmon_device_t,s0)
|
|
-ifdef(`distro_suse', `
|
|
+ifdef(`distro_redhat', `
|
|
/dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0)
|
|
')
|
|
/dev/vmci -c gen_context(system_u:object_r:vmci_device_t,s0)
|
|
Index: fedora-policy-20230116/policy/modules/kernel/files.fc
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/kernel/files.fc
|
|
+++ fedora-policy-20230116/policy/modules/kernel/files.fc
|
|
@@ -22,7 +22,7 @@ ifdef(`distro_redhat',`
|
|
/[^/]+ -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
')
|
|
|
|
-ifdef(`distro_suse',`
|
|
+ifdef(`distro_redhat',`
|
|
/success -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
')
|
|
|
|
@@ -92,7 +92,7 @@ ifdef(`distro_gentoo', `
|
|
/etc/env\.d/.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
')
|
|
|
|
-ifdef(`distro_suse',`
|
|
+ifdef(`distro_redhat',`
|
|
/etc/defkeymap\.map -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
/etc/rc\.d/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
|
|
')
|
|
Index: fedora-policy-20230116/policy/modules/services/xserver.fc
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/services/xserver.fc
|
|
+++ fedora-policy-20230116/policy/modules/services/xserver.fc
|
|
@@ -189,7 +189,7 @@ ifndef(`distro_debian',`
|
|
/var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0)
|
|
/var/run/systemd/multi-session-x(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
|
|
-ifdef(`distro_suse',`
|
|
+ifdef(`distro_redhat',`
|
|
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
|
')
|
|
|
|
Index: fedora-policy-20230116/policy/modules/system/authlogin.fc
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/system/authlogin.fc
|
|
+++ fedora-policy-20230116/policy/modules/system/authlogin.fc
|
|
@@ -31,7 +31,7 @@ HOME_DIR/\.google_authenticator~ gen_co
|
|
/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
|
|
/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
|
|
/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
|
|
-ifdef(`distro_suse', `
|
|
+ifdef(`distro_redhat', `
|
|
/sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
|
|
')
|
|
|
|
Index: fedora-policy-20230116/policy/modules/system/init.fc
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/system/init.fc
|
|
+++ fedora-policy-20230116/policy/modules/system/init.fc
|
|
@@ -92,7 +92,7 @@ ifdef(`distro_gentoo', `
|
|
/var/run/svscan\.pid -- gen_context(system_u:object_r:initrc_var_run_t,s0)
|
|
')
|
|
|
|
-ifdef(`distro_suse', `
|
|
+ifdef(`distro_redhat', `
|
|
/var/run/bootsplashctl -p gen_context(system_u:object_r:initrc_var_run_t,s0)
|
|
/var/run/keymap -- gen_context(system_u:object_r:initrc_var_run_t,s0)
|
|
/var/run/numlock-on -- gen_context(system_u:object_r:initrc_var_run_t,s0)
|
|
Index: fedora-policy-20230116/policy/modules/system/init.te
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/system/init.te
|
|
+++ fedora-policy-20230116/policy/modules/system/init.te
|
|
@@ -1330,7 +1330,7 @@ ifdef(`distro_redhat',`
|
|
')
|
|
')
|
|
|
|
-ifdef(`distro_suse',`
|
|
+ifdef(`distro_redhat',`
|
|
optional_policy(`
|
|
# set permissions on /tmp/.X11-unix
|
|
xserver_setattr_xdm_tmp_dirs(initrc_t)
|
|
Index: fedora-policy-20230116/policy/modules/system/libraries.fc
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/system/libraries.fc
|
|
+++ fedora-policy-20230116/policy/modules/system/libraries.fc
|
|
@@ -329,7 +329,7 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_
|
|
/var/lib/spamassassin/compiled/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
|
|
/usr/lib/xfce4/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
|
|
|
|
-ifdef(`distro_suse',`
|
|
+ifdef(`distro_redhat',`
|
|
/var/lib/samba/bin/.+\.so(\.[^/]*)* -l gen_context(system_u:object_r:lib_t,s0)
|
|
')
|
|
|
|
Index: fedora-policy-20230116/policy/modules/system/locallogin.te
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/system/locallogin.te
|
|
+++ fedora-policy-20230116/policy/modules/system/locallogin.te
|
|
@@ -274,7 +274,7 @@ ifdef(`enable_mls',`
|
|
')
|
|
|
|
# suse and debian do not use pam with sulogin...
|
|
-ifdef(`distro_suse', `define(`sulogin_no_pam')')
|
|
+ifdef(`distro_redhat', `define(`sulogin_no_pam')')
|
|
ifdef(`distro_debian', `define(`sulogin_no_pam')')
|
|
|
|
allow sulogin_t self:capability sys_tty_config;
|
|
Index: fedora-policy-20230116/policy/modules/system/logging.fc
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/system/logging.fc
|
|
+++ fedora-policy-20230116/policy/modules/system/logging.fc
|
|
@@ -46,7 +46,7 @@
|
|
/var/lib/r?syslog(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,mls_systemhigh)
|
|
/var/lib/syslog-ng.persist -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
|
|
|
|
-ifdef(`distro_suse', `
|
|
+ifdef(`distro_redhat', `
|
|
/var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
|
|
')
|
|
|
|
Index: fedora-policy-20230116/policy/modules/system/logging.te
|
|
===================================================================
|
|
--- fedora-policy-20230116.orig/policy/modules/system/logging.te
|
|
+++ fedora-policy-20230116/policy/modules/system/logging.te
|
|
@@ -685,7 +685,7 @@ ifdef(`distro_gentoo',`
|
|
term_dontaudit_setattr_unallocated_ttys(syslogd_t)
|
|
')
|
|
|
|
-ifdef(`distro_suse',`
|
|
+ifdef(`distro_redhat',`
|
|
# suse creates a /dev/log under /var/lib/stunnel for chrooted stunnel
|
|
files_var_lib_filetrans(syslogd_t, devlog_t, sock_file)
|
|
')
|