5edde88663
- release now has 3 integrity modes: file size, IMA, and sha256 based - it can now send event information to syslog - the syslog event information is tailorable to how you'd like to see it - there is now the ability to create sets of words that can be matched against in the rules engine - there are now 2 policies shipped: known-libs and restrictive - fapolicyd-cli can now dump the trust db for inspection - the integrity system needs sha256 hashes, it will print a warning for files in rpms that do not have them
21 lines
1.1 KiB
Diff
21 lines
1.1 KiB
Diff
diff -up ./fapolicyd-selinux-0.2/fapolicyd.te.selinux ./fapolicyd-selinux-0.2/fapolicyd.te
|
|
--- ./fapolicyd-selinux-0.2/fapolicyd.te.selinux 2019-11-05 14:17:08.000000000 +0100
|
|
+++ ./fapolicyd-selinux-0.2/fapolicyd.te 2020-05-25 15:02:37.196991039 +0200
|
|
@@ -30,6 +30,7 @@ files_pid_file(fapolicyd_var_run_t)
|
|
# fapolicyd local policy
|
|
#
|
|
allow fapolicyd_t self:capability { audit_write chown dac_override setgid setuid sys_admin sys_nice sys_ptrace };
|
|
+allow fapolicyd_t self:cap_userns sys_ptrace;
|
|
allow fapolicyd_t self:fifo_file rw_fifo_file_perms;
|
|
allow fapolicyd_t self:process { setcap setsched };
|
|
allow fapolicyd_t self:unix_stream_socket create_stream_socket_perms;
|
|
@@ -48,7 +49,7 @@ manage_dirs_pattern(fapolicyd_t, fapolic
|
|
manage_files_pattern(fapolicyd_t, fapolicyd_var_run_t, fapolicyd_var_run_t)
|
|
manage_fifo_files_pattern(fapolicyd_t, fapolicyd_var_run_t,fapolicyd_var_run_t)
|
|
manage_lnk_files_pattern(fapolicyd_t, fapolicyd_var_run_t, fapolicyd_var_run_t)
|
|
-files_pid_filetrans(fapolicyd_t, fapolicyd_var_run_t, { dir file lnk_file })
|
|
+files_pid_filetrans(fapolicyd_t, fapolicyd_var_run_t, { dir file fifo_file lnk_file })
|
|
|
|
kernel_dgram_send(fapolicyd_t)
|
|
|