forked from pool/selinux-policy
c4556003bf
- Update to version 20230125. Refreshed:
* distro_suse_to_distro_redhat.patch
* fix_dnsmasq.patch
* fix_init.patch
* fix_ipsec.patch
* fix_kernel_sysctl.patch
* fix_logging.patch
* fix_rpm.patch
* fix_selinuxutil.patch
* fix_systemd_watch.patch
* fix_userdomain.patch
- More flexible lib(exec) matching in fix_fwupd.patch
- Removed sys_admin for systemd_gpt_generator_t in fix_systemd.patch
- Dropped fix_container.patch, is now upstream
- Added fix_entropyd.patch
* Added new interface entropyd_semaphore_filetrans to properly transfer
semaphore created during early boot. That doesn't work yet, so work
around with next item
* Allow reading tempfs files
- Added fix_kernel.patch. Added modutils_execute_kmod_tmpfs_files interace
to allow kmod_tmpfs_t files to be executed. Necessary for firewalld
- Added fix_rtkit.patch to fix labeling of binary
- Modified fix_ntp.patch:
* Proper labeling for start-ntpd
* Fixed label rules for chroot path
* Temporarily allow dac_override for ntpd_t (bsc#1207577)
* Add interface ntp_manage_pid_files to allow management of pid
files
- Updated fix_networkmanager.patch to allow managing ntp pid files
OBS-URL: https://build.opensuse.org/request/show/1061575
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=171
53 lines
1.6 KiB
Diff
53 lines
1.6 KiB
Diff
Index: fedora-policy-20230125/policy/modules/kernel/kernel.te
|
|
===================================================================
|
|
--- fedora-policy-20230125.orig/policy/modules/kernel/kernel.te
|
|
+++ fedora-policy-20230125/policy/modules/kernel/kernel.te
|
|
@@ -389,6 +389,13 @@ ifdef(`distro_redhat',`
|
|
fs_rw_tmpfs_chr_files(kernel_t)
|
|
')
|
|
|
|
+# this is a temporary fix. This permission doesn't make a lot of sense, but
|
|
+# without a kernel change there's not much we can do about it. I don't want to
|
|
+# audit it due to the unknown impact (happens e.g. during firewall changes)
|
|
+optional_policy(`
|
|
+ modutils_execute_kmod_tmpfs_files(kernel_t)
|
|
+')
|
|
+
|
|
optional_policy(`
|
|
abrt_filetrans_named_content(kernel_t)
|
|
abrt_dump_oops_domtrans(kernel_t)
|
|
@@ -410,6 +417,7 @@ optional_policy(`
|
|
init_dbus_chat(kernel_t)
|
|
init_sigchld(kernel_t)
|
|
init_dyntrans(kernel_t)
|
|
+ init_read_state(kernel_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
Index: fedora-policy-20230125/policy/modules/system/modutils.if
|
|
===================================================================
|
|
--- fedora-policy-20230125.orig/policy/modules/system/modutils.if
|
|
+++ fedora-policy-20230125/policy/modules/system/modutils.if
|
|
@@ -525,3 +525,21 @@ interface(`modutils_dontaudit_kmod_tmpfs
|
|
|
|
dontaudit $1 kmod_tmpfs_t:file { getattr };
|
|
')
|
|
+
|
|
+#######################################
|
|
+## <summary>
|
|
+## Execute accesses to tmp file type.
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`modutils_execute_kmod_tmpfs_files',`
|
|
+ gen_require(`
|
|
+ type kmod_tmpfs_t;
|
|
+ ')
|
|
+
|
|
+ allow $1 kmod_tmpfs_t:file { execute execute_no_trans };
|
|
+')
|