rpms/fapolicyd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

SELinux fix

Browse Source 
- Label all fifo_file as fapolicyd_var_run_t in /var/run.
- Allow fapolicyd_t domain to create fifo files labeled as
  fapolicyd_var_run_t
This commit is contained in:
Radovan Sroka 2020-02-04 09:45:21 +01:00
parent 193b9f0cdf
commit 6e714e474b
2 changed files with 33 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
fapolicyd.spec
View File

@ -5,7 +5,7 @@
Summary: Application Whitelisting Daemon Summary: Application Whitelisting Daemon
Name: fapolicyd Name: fapolicyd
Version: 0.9.2 Version: 0.9.2
Release: 1%{?dist} Release: 2%{?dist}
License: GPLv3+ License: GPLv3+
URL: http://people.redhat.com/sgrubb/fapolicyd URL: http://people.redhat.com/sgrubb/fapolicyd
Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz
@ -22,6 +22,7 @@ Requires(preun): systemd-units
Requires(postun): systemd-units Requires(postun): systemd-units
Patch1: fapolicyd-conf.patch Patch1: fapolicyd-conf.patch
Patch2: selinux.patch
%description %description
Fapolicyd (File Access Policy Daemon) implements application whitelisting Fapolicyd (File Access Policy Daemon) implements application whitelisting
@ -53,6 +54,7 @@ sed -i "s/%python3_path%/`readlink -f %{__python3} | sed 's/\//\\\\\//g'`/g" ini
sed -i "s/%ld_so_path%/`find /usr/lib64/ -type f -name 'ld-2\.*.so' | sed 's/\//\\\\\//g'`/g" init/%{name}.rules sed -i "s/%ld_so_path%/`find /usr/lib64/ -type f -name 'ld-2\.*.so' | sed 's/\//\\\\\//g'`/g" init/%{name}.rules
%patch1 -p1 -b .default-conf %patch1 -p1 -b .default-conf
%patch2 -p1 -b .selinux
%build %build
@ -147,6 +149,11 @@ fi
%changelog %changelog
* Tue Feb 04 2020 Radovan Sroka <rsroka@redhat.com> - 0.9.2-2
- Label all fifo_file as fapolicyd_var_run_t in /var/run.
- Allow fapolicyd_t domain to create fifo files labeled as
fapolicyd_var_run_t
* Fri Jan 31 2020 Radovan Sroka <rsroka@redhat.com> - 0.9.2-1 * Fri Jan 31 2020 Radovan Sroka <rsroka@redhat.com> - 0.9.2-1
- rebase fapolicyd to 0.9.2 - rebase fapolicyd to 0.9.2
- allows watched mount points to be specified by file system types - allows watched mount points to be specified by file system types

25
selinux.patch Normal file
View File

@ -0,0 +1,25 @@
From 93d7fc7decfdca3a0622ecc5e0ae3fe5880a836a Mon Sep 17 00:00:00 2001
From: Lukas Vrabec <lvrabec@redhat.com>
Date: Tue, 4 Feb 2020 09:33:01 +0100
Subject: [PATCH] Allow fapolicyd create fifo files with own label
- Label all fifo_file as fapolicyd_var_run_t in /var/run.
- Allow fapolicyd_t domain to create fifo files labeled as
fapolicyd_var_run_t
---
fapolicyd.te | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fapolicyd.te b/fapolicyd.te
index 39f09f5..71eb6c0 100644
--- a/fapolicyd-selinux-0.2/fapolicyd.te
+++ b/fapolicyd-selinux-0.2/fapolicyd.te
@@ -48,7 +48,7 @@ manage_dirs_pattern(fapolicyd_t, fapolicyd_var_run_t, fapolicyd_var_run_t)
manage_files_pattern(fapolicyd_t, fapolicyd_var_run_t, fapolicyd_var_run_t)
manage_fifo_files_pattern(fapolicyd_t, fapolicyd_var_run_t,fapolicyd_var_run_t)
manage_lnk_files_pattern(fapolicyd_t, fapolicyd_var_run_t, fapolicyd_var_run_t)
-files_pid_filetrans(fapolicyd_t, fapolicyd_var_run_t, { dir file lnk_file })
+files_pid_filetrans(fapolicyd_t, fapolicyd_var_run_t, { dir file fifo_file lnk_file })
kernel_dgram_send(fapolicyd_t)