forked from pool/selinux-policy
2c0c138859
- Update to version 20230206. Refreshed: * fix_entropyd.patch * fix_networkmanager.patch * fix_systemd_watch.patch * fix_unconfineduser.patch - Updated fix_kernel.patch to allow kernel_t access to xdm state. This is necessary as plymouth doesn't run in it's own domain in early boot OBS-URL: https://build.opensuse.org/request/show/1063441 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=172
61 lines
1.8 KiB
Diff
61 lines
1.8 KiB
Diff
Index: fedora-policy-20230206/policy/modules/kernel/kernel.te
|
|
===================================================================
|
|
--- fedora-policy-20230206.orig/policy/modules/kernel/kernel.te
|
|
+++ fedora-policy-20230206/policy/modules/kernel/kernel.te
|
|
@@ -393,6 +393,13 @@ ifdef(`distro_redhat',`
|
|
fs_rw_tmpfs_chr_files(kernel_t)
|
|
')
|
|
|
|
+# this is a temporary fix. This permission doesn't make a lot of sense, but
|
|
+# without a kernel change there's not much we can do about it. I don't want to
|
|
+# audit it due to the unknown impact (happens e.g. during firewall changes)
|
|
+optional_policy(`
|
|
+ modutils_execute_kmod_tmpfs_files(kernel_t)
|
|
+')
|
|
+
|
|
optional_policy(`
|
|
abrt_filetrans_named_content(kernel_t)
|
|
abrt_dump_oops_domtrans(kernel_t)
|
|
@@ -418,6 +425,7 @@ optional_policy(`
|
|
init_dbus_chat(kernel_t)
|
|
init_sigchld(kernel_t)
|
|
init_dyntrans(kernel_t)
|
|
+ init_read_state(kernel_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
@@ -519,6 +527,7 @@ optional_policy(`
|
|
')
|
|
|
|
optional_policy(`
|
|
+ xserver_read_xdm_state(kernel_t)
|
|
xserver_xdm_manage_spool(kernel_t)
|
|
xserver_filetrans_home_content(kernel_t)
|
|
')
|
|
Index: fedora-policy-20230206/policy/modules/system/modutils.if
|
|
===================================================================
|
|
--- fedora-policy-20230206.orig/policy/modules/system/modutils.if
|
|
+++ fedora-policy-20230206/policy/modules/system/modutils.if
|
|
@@ -525,3 +525,21 @@ interface(`modutils_dontaudit_kmod_tmpfs
|
|
|
|
dontaudit $1 kmod_tmpfs_t:file { getattr };
|
|
')
|
|
+
|
|
+#######################################
|
|
+## <summary>
|
|
+## Execute accesses to tmp file type.
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`modutils_execute_kmod_tmpfs_files',`
|
|
+ gen_require(`
|
|
+ type kmod_tmpfs_t;
|
|
+ ')
|
|
+
|
|
+ allow $1 kmod_tmpfs_t:file { execute execute_no_trans };
|
|
+')
|