fapolicyd-1.4.3
https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4.3 https://github.com/linux-application-whitelisting/fapolicyd-selinux/releases/tag/v1.1 Resolves: RHEL-131723 Resolves: RHEL-132455 Resovles: RHEL-30443
This commit is contained in:
Petr Lautrbach
parent
1de364701d
commit
7770be8377
4
.gitignore
vendored
4
.gitignore
vendored
@ -42,3 +42,7 @@
|
||||
/fapolicyd-1.4.1.tar.gz.asc
|
||||
/fapolicyd-1.4.2.tar.gz
|
||||
/fapolicyd-1.4.2.tar.gz.asc
|
||||
/fapolicyd-1.4.3.tar.gz
|
||||
/fapolicyd-1.4.3.tar.gz.asc
|
||||
/fapolicyd-selinux-1.1.tar.gz
|
||||
/fapolicyd-selinux-1.1.tar.gz.asc
|
||||
|
||||
@ -1,30 +0,0 @@
|
||||
From 39acf75fff8fa706e75ef512a81e7b1850bfa0c4 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <lautrbach@redhat.com>
|
||||
Date: Thu, 6 Nov 2025 16:36:28 +0100
|
||||
Subject: [PATCH] Improve install process
|
||||
Content-type: text/plain
|
||||
|
||||
- install fapolicyd-hardening.cil together with fapolicyd.pp.bz2
|
||||
- follow the guidelines and install interface file to
|
||||
${SHAREDIR}/selinux/devel/include/distributed see
|
||||
https://fedoraproject.org/wiki/SELinux/IndependentPolicy#Using_custom_interfaces
|
||||
---
|
||||
Makefile | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/fapolicyd-selinux-1.0/Makefile b/fapolicyd-selinux-1.0/Makefile
|
||||
index b3dcfefca061..9fe67f3a2a7c 100644
|
||||
--- a/fapolicyd-selinux-1.0/Makefile
|
||||
+++ b/fapolicyd-selinux-1.0/Makefile
|
||||
@@ -39,6 +39,7 @@ install-policy: all
|
||||
|
||||
install: man
|
||||
install -D -m 644 ${TARGETS}.pp.bz2 ${DESTDIR}${SHAREDIR}/selinux/packages/${TARGETS}.pp.bz2
|
||||
- install -D -m 644 ${TARGETS}.if ${DESTDIR}${SHAREDIR}/selinux/devel/include/services/${TARGETS}.if
|
||||
+ install -D -m 644 ${TARGETS}-hardening.cil ${DESTDIR}${SHAREDIR}/selinux/packages/${TARGETS}-hardening.cil
|
||||
+ install -D -m 644 ${TARGETS}.if ${DESTDIR}${SHAREDIR}/selinux/devel/include/distributed/${TARGETS}.if
|
||||
install -D -m 644 ${TARGETS}_selinux.8 ${DESTDIR}${SHAREDIR}/man/man8/
|
||||
|
||||
--
|
||||
2.51.1
|
||||
|
||||
@ -1,30 +0,0 @@
|
||||
From 4c2726089b690fb1313057c15584c927c064acda Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <lautrbach@redhat.com>
|
||||
Date: Fri, 7 Nov 2025 15:15:09 +0100
|
||||
Subject: [PATCH] fapolicyd-hardening: do not block sigkill
|
||||
Content-type: text/plain
|
||||
|
||||
SIGKILL does not cause the system hang.
|
||||
|
||||
SIGKILL can't be blocked or ignored by fapolicyd. Also SIGKILL is used
|
||||
by systemd to forcibly terminate service when they don't stop after
|
||||
timeout.
|
||||
|
||||
Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
|
||||
---
|
||||
fapolicyd-hardening.cil | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/fapolicyd-selinux-1.0/fapolicyd-hardening.cil b/fapolicyd-selinux-1.0/fapolicyd-hardening.cil
|
||||
index ba4261f0f42e..89dd4ffff5f5 100644
|
||||
--- a/fapolicyd-selinux-1.0/fapolicyd-hardening.cil
|
||||
+++ b/fapolicyd-selinux-1.0/fapolicyd-hardening.cil
|
||||
@@ -1,4 +1,4 @@
|
||||
(optional fapolicyd_hardening_optional
|
||||
(typeattributeset cil_gen_require fapolicyd_t)
|
||||
- (deny domain fapolicyd_t ( process ( ptrace sigkill sigstop ) ) )
|
||||
+ (deny domain fapolicyd_t ( process ( ptrace sigstop ) ) )
|
||||
)
|
||||
--
|
||||
2.51.1
|
||||
|
||||
@ -1,10 +1,10 @@
|
||||
%global selinuxtype targeted
|
||||
%global moduletype distributed
|
||||
%define semodule_version 1.0
|
||||
%define semodule_version 1.1
|
||||
|
||||
Summary: Application Whitelisting Daemon
|
||||
Name: fapolicyd
|
||||
Version: 1.4.2
|
||||
Version: 1.4.3
|
||||
Release: 1%{?dist}
|
||||
License: GPL-3.0-or-later
|
||||
URL: https://github.com/linux-application-whitelisting/fapolicyd
|
||||
@ -18,13 +18,11 @@ Source11: https://github.com/linux-application-whitelisting/%{name}-selinux/rele
|
||||
Source20: https://github.com/troydhanson/uthash/archive/refs/tags/v2.3.0.tar.gz#/uthash-2.3.0.tar.gz
|
||||
|
||||
# https://github.com/linux-application-whitelisting/fapolicyd
|
||||
# $ git format-patch -N v1.4.1
|
||||
# $ git format-patch -N v1.4.3
|
||||
# https://github.com/linux-application-whitelisting/fapolicyd-selinux
|
||||
# $ git format-patch -N --start-number 100 --src-prefix=a/fapolicyd-selinux-1.0/ --dst-prefix=b/fapolicyd-selinux-1.0/ v1.0
|
||||
# $ git format-patch -N --start-number 100 --src-prefix=a/fapolicyd-selinux-1.1/ --dst-prefix=b/fapolicyd-selinux-1.1/ v1.1
|
||||
# $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done
|
||||
# Patch list start
|
||||
Patch0100: 0100-Improve-install-process.patch
|
||||
Patch0101: 0101-fapolicyd-hardening-do-not-block-sigkill.patch
|
||||
# Patch list end
|
||||
|
||||
BuildRequires: gcc
|
||||
@ -233,6 +231,11 @@ fi
|
||||
%selinux_relabel_post -s %{selinuxtype}
|
||||
|
||||
%changelog
|
||||
* Tue Jan 13 2026 Petr Lautrbach <lautrbach@redhat.com> - 1.4.3-1
|
||||
- fapolicyd-1.4.3
|
||||
https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4.3
|
||||
https://github.com/linux-application-whitelisting/fapolicyd-selinux/releases/tag/v1.1
|
||||
|
||||
* Wed Nov 26 2025 Petr Lautrbach <lautrbach@redhat.com> - 1.4.2-1
|
||||
- fapolicyd-1.4.2
|
||||
https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4.2
|
||||
|
||||
8
sources
8
sources
@ -1,5 +1,5 @@
|
||||
SHA512 (fapolicyd-1.4.2.tar.gz) = 74e96821c99121d44db5c8f80e664ede2b8204ba2ac7fe881c5d9f53f97c5cb52d14c0002957facaa79d5165ed7d9f1259f086a5c14ea1e2432e9e2992fccf0e
|
||||
SHA512 (fapolicyd-1.4.2.tar.gz.asc) = 2d603142554e6016626a262306e640b72f88dd9da48af2577b15dd016d40326898d2faafe3028b31d0b648125a9a32b0ed123a423545ed647a5c62908ae078e3
|
||||
SHA512 (fapolicyd-selinux-1.0.tar.gz) = 3c044b7570e2d5b990fcf85695e00526f3fd3c141d3d9b36209ee740f94031cb0a409a6887697f5b7a70f21a7c8fea2caab42eee605ba4b74d8b4a2fa1d8fa4a
|
||||
SHA512 (fapolicyd-selinux-1.0.tar.gz.asc) = caf55ef941587b10e62a9ed99b92dcf1dad32a444b80a5688899dbb49c4ee7ea0ff5d661c50e7403e38b1ab592cc893d907174f7ee071a10f7afcaeb6aa50858
|
||||
SHA512 (fapolicyd-1.4.3.tar.gz) = 486e1ac5ef0909fc3759eef8086143cd145e61c1e9430a6d0ade686a625534c93a5fcf7208b7ae8ab692ecffeed915ae17c441230635fccaa1fe6c1604a75142
|
||||
SHA512 (fapolicyd-1.4.3.tar.gz.asc) = 74d1743b58431a9d54f36b7b494405a23fca24bf95d75f595b430f6145d4ea405728035fef0e4daac260fb9159870c8606564dd0e5d1d707832945c032fd2c0c
|
||||
SHA512 (fapolicyd-selinux-1.1.tar.gz) = 64a7068f8f0a730363e546921ac2eec66a8195d027bacd53f9bf837f55c82d3a667563eb553c6111bc7dfbd90693029577ccefc99dca3d7fe9b7ae5bb61d19bd
|
||||
SHA512 (fapolicyd-selinux-1.1.tar.gz.asc) = e881e57d07b00143fce97349060b206f9f1706a914206c0cc4fc700318f4497ff362de1faea463f769594a6f6e5e30cfd18667e25146be7f138ff4cb13dbc7b8
|
||||
SHA512 (uthash-2.3.0.tar.gz) = 3b01f1074790fb242900411cb16eb82c1a9afcf58e3196a0f4611d9d7ef94690ad38c0a500e7783d3efa20328aa8d6ab14f246be63b3b3d385502ba2b6b2a294
|
||||
|
||||
Loading…
Reference in New Issue
Block a user