Install SELinux policy hardening module
fapolicyd-hardening module prevents usage of sigstop, sigkill and ptrace Resolves: RHEL-1368
This commit is contained in:
Petr Lautrbach
parent
63ac76bd62
commit
ea744010c8
30
0100-Improve-install-process.patch
Normal file
30
0100-Improve-install-process.patch
Normal file
@ -0,0 +1,30 @@
|
||||
From 39acf75fff8fa706e75ef512a81e7b1850bfa0c4 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <lautrbach@redhat.com>
|
||||
Date: Thu, 6 Nov 2025 16:36:28 +0100
|
||||
Subject: [PATCH] Improve install process
|
||||
Content-type: text/plain
|
||||
|
||||
- install fapolicyd-hardening.cil together with fapolicyd.pp.bz2
|
||||
- follow the guidelines and install interface file to
|
||||
${SHAREDIR}/selinux/devel/include/distributed see
|
||||
https://fedoraproject.org/wiki/SELinux/IndependentPolicy#Using_custom_interfaces
|
||||
---
|
||||
Makefile | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/fapolicyd-selinux-1.0/Makefile b/fapolicyd-selinux-1.0/Makefile
|
||||
index b3dcfefca061..9fe67f3a2a7c 100644
|
||||
--- a/fapolicyd-selinux-1.0/Makefile
|
||||
+++ b/fapolicyd-selinux-1.0/Makefile
|
||||
@@ -39,6 +39,7 @@ install-policy: all
|
||||
|
||||
install: man
|
||||
install -D -m 644 ${TARGETS}.pp.bz2 ${DESTDIR}${SHAREDIR}/selinux/packages/${TARGETS}.pp.bz2
|
||||
- install -D -m 644 ${TARGETS}.if ${DESTDIR}${SHAREDIR}/selinux/devel/include/services/${TARGETS}.if
|
||||
+ install -D -m 644 ${TARGETS}-hardening.cil ${DESTDIR}${SHAREDIR}/selinux/packages/${TARGETS}-hardening.cil
|
||||
+ install -D -m 644 ${TARGETS}.if ${DESTDIR}${SHAREDIR}/selinux/devel/include/distributed/${TARGETS}.if
|
||||
install -D -m 644 ${TARGETS}_selinux.8 ${DESTDIR}${SHAREDIR}/man/man8/
|
||||
|
||||
--
|
||||
2.51.1
|
||||
|
||||
30
0101-fapolicyd-hardening-do-not-block-sigkill.patch
Normal file
30
0101-fapolicyd-hardening-do-not-block-sigkill.patch
Normal file
@ -0,0 +1,30 @@
|
||||
From 4c2726089b690fb1313057c15584c927c064acda Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <lautrbach@redhat.com>
|
||||
Date: Fri, 7 Nov 2025 15:15:09 +0100
|
||||
Subject: [PATCH] fapolicyd-hardening: do not block sigkill
|
||||
Content-type: text/plain
|
||||
|
||||
SIGKILL does not cause the system hang.
|
||||
|
||||
SIGKILL can't be blocked or ignored by fapolicyd. Also SIGKILL is used
|
||||
by systemd to forcibly terminate service when they don't stop after
|
||||
timeout.
|
||||
|
||||
Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
|
||||
---
|
||||
fapolicyd-hardening.cil | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/fapolicyd-selinux-1.0/fapolicyd-hardening.cil b/fapolicyd-selinux-1.0/fapolicyd-hardening.cil
|
||||
index ba4261f0f42e..89dd4ffff5f5 100644
|
||||
--- a/fapolicyd-selinux-1.0/fapolicyd-hardening.cil
|
||||
+++ b/fapolicyd-selinux-1.0/fapolicyd-hardening.cil
|
||||
@@ -1,4 +1,4 @@
|
||||
(optional fapolicyd_hardening_optional
|
||||
(typeattributeset cil_gen_require fapolicyd_t)
|
||||
- (deny domain fapolicyd_t ( process ( ptrace sigkill sigstop ) ) )
|
||||
+ (deny domain fapolicyd_t ( process ( ptrace sigstop ) ) )
|
||||
)
|
||||
--
|
||||
2.51.1
|
||||
|
||||
@ -23,6 +23,8 @@ Source20: https://github.com/troydhanson/uthash/archive/refs/tags/v2.3.0.tar.gz#
|
||||
# $ git format-patch -N --start-number 100 --src-prefix=a/fapolicyd-selinux-1.0/ --dst-prefix=b/fapolicyd-selinux-1.0/ v1.0
|
||||
# $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done
|
||||
# Patch list start
|
||||
Patch0100: 0100-Improve-install-process.patch
|
||||
Patch0101: 0101-fapolicyd-hardening-do-not-block-sigkill.patch
|
||||
# Patch list end
|
||||
|
||||
BuildRequires: gcc
|
||||
@ -141,6 +143,7 @@ chmod 644 %{buildroot}/%{_datadir}/%{name}/default-ruleset.known-libs
|
||||
# selinux
|
||||
install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
|
||||
install -m 0644 %{name}-selinux-%{semodule_version}/%{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
|
||||
install -m 0644 %{name}-selinux-%{semodule_version}/%{name}-hardening.cil %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
|
||||
install -d -p %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
|
||||
install -p -m 644 %{name}-selinux-%{semodule_version}/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/%{name}.if
|
||||
|
||||
@ -213,16 +216,17 @@ fi
|
||||
|
||||
%files selinux
|
||||
%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
|
||||
%{_datadir}/selinux/packages/%{selinuxtype}/%{name}-hardening.cil
|
||||
%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
|
||||
%{_datadir}/selinux/devel/include/%{moduletype}/%{name}.if
|
||||
|
||||
%post selinux
|
||||
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
|
||||
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 %{_datadir}/selinux/packages/%{selinuxtype}/%{name}-hardening.cil
|
||||
%selinux_relabel_post -s %{selinuxtype}
|
||||
|
||||
%postun selinux
|
||||
if [ $1 -eq 0 ]; then
|
||||
%selinux_modules_uninstall -s %{selinuxtype} %{name}
|
||||
%selinux_modules_uninstall -s %{selinuxtype} %{name}-hardening %{name}
|
||||
fi
|
||||
|
||||
%posttrans selinux
|
||||
|
||||
Loading…
Reference in New Issue
Block a user