4a6ab956fe
This is an automated DistroBaker update from upstream sources. If you do not know what this is about or would like to opt out, contact the OSCI team. Source: https://src.fedoraproject.org/rpms/policycoreutils.git#b47cf5c7c221d52f659303fe41a406239a74d8d3
110 lines
4.3 KiB
Diff
110 lines
4.3 KiB
Diff
From 2a60de8eca6bd91e276b60441a5dc72d85c6eda3 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
|
|
Date: Wed, 19 Aug 2020 17:05:34 +0200
|
|
Subject: [PATCH] sepolgen: sort extended rules like normal ones
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Currently:
|
|
|
|
#============= sshd_t ==============
|
|
|
|
#!!!! This avc is allowed in the current policy
|
|
#!!!! This av rule may have been overridden by an extended permission av rule
|
|
allow sshd_t ptmx_t:chr_file ioctl;
|
|
|
|
#!!!! This avc is allowed in the current policy
|
|
#!!!! This av rule may have been overridden by an extended permission av rule
|
|
allow sshd_t sshd_devpts_t:chr_file ioctl;
|
|
|
|
#!!!! This avc is allowed in the current policy
|
|
#!!!! This av rule may have been overridden by an extended permission av rule
|
|
allow sshd_t user_devpts_t:chr_file ioctl;
|
|
|
|
#============= user_t ==============
|
|
|
|
#!!!! This avc is allowed in the current policy
|
|
#!!!! This av rule may have been overridden by an extended permission av rule
|
|
allow user_t devtty_t:chr_file ioctl;
|
|
|
|
#!!!! This avc is allowed in the current policy
|
|
#!!!! This av rule may have been overridden by an extended permission av rule
|
|
allow user_t user_devpts_t:chr_file ioctl;
|
|
allowxperm sshd_t ptmx_t:chr_file ioctl { 0x5430-0x5431 0x5441 };
|
|
allowxperm sshd_t sshd_devpts_t:chr_file ioctl 0x5401;
|
|
allowxperm sshd_t user_devpts_t:chr_file ioctl { 0x5401-0x5402 0x540e };
|
|
allowxperm user_t user_devpts_t:chr_file ioctl { 0x4b33 0x5401 0x5403 0x540a 0x540f-0x5410 0x5413-0x5414 };
|
|
allowxperm user_t devtty_t:chr_file ioctl 0x4b33;
|
|
|
|
Changed:
|
|
|
|
#============= sshd_t ==============
|
|
|
|
#!!!! This avc is allowed in the current policy
|
|
#!!!! This av rule may have been overridden by an extended permission av rule
|
|
allow sshd_t ptmx_t:chr_file ioctl;
|
|
allowxperm sshd_t ptmx_t:chr_file ioctl { 0x5430-0x5431 0x5441 };
|
|
|
|
#!!!! This avc is allowed in the current policy
|
|
#!!!! This av rule may have been overridden by an extended permission av rule
|
|
allow sshd_t sshd_devpts_t:chr_file ioctl;
|
|
allowxperm sshd_t sshd_devpts_t:chr_file ioctl 0x5401;
|
|
|
|
#!!!! This avc is allowed in the current policy
|
|
#!!!! This av rule may have been overridden by an extended permission av rule
|
|
allow sshd_t user_devpts_t:chr_file ioctl;
|
|
allowxperm sshd_t user_devpts_t:chr_file ioctl { 0x5401-0x5402 0x540e };
|
|
|
|
#============= user_t ==============
|
|
|
|
#!!!! This avc is allowed in the current policy
|
|
#!!!! This av rule may have been overridden by an extended permission av rule
|
|
allow user_t devtty_t:chr_file ioctl;
|
|
allowxperm user_t devtty_t:chr_file ioctl 0x4b33;
|
|
|
|
#!!!! This avc is allowed in the current policy
|
|
#!!!! This av rule may have been overridden by an extended permission av rule
|
|
allow user_t user_devpts_t:chr_file ioctl;
|
|
allowxperm user_t user_devpts_t:chr_file ioctl { 0x4b33 0x5401 0x5403 0x540a 0x540f-0x5410 0x5413-0x5414 };
|
|
|
|
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
|
|
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
|
|
---
|
|
python/sepolgen/src/sepolgen/output.py | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/python/sepolgen/src/sepolgen/output.py b/python/sepolgen/src/sepolgen/output.py
|
|
index 3a21b64c19f7..aeeaafc889e7 100644
|
|
--- a/python/sepolgen/src/sepolgen/output.py
|
|
+++ b/python/sepolgen/src/sepolgen/output.py
|
|
@@ -84,7 +84,7 @@ def avrule_cmp(a, b):
|
|
return ret
|
|
|
|
# At this point, who cares - just return something
|
|
- return cmp(len(a.perms), len(b.perms))
|
|
+ return 0
|
|
|
|
# Compare two interface calls
|
|
def ifcall_cmp(a, b):
|
|
@@ -100,7 +100,7 @@ def rule_cmp(a, b):
|
|
else:
|
|
return id_set_cmp([a.args[0]], b.src_types)
|
|
else:
|
|
- if isinstance(b, refpolicy.AVRule):
|
|
+ if isinstance(b, refpolicy.AVRule) or isinstance(b, refpolicy.AVExtRule):
|
|
return avrule_cmp(a,b)
|
|
else:
|
|
return id_set_cmp(a.src_types, [b.args[0]])
|
|
@@ -130,6 +130,7 @@ def sort_filter(module):
|
|
# we assume is the first argument for interfaces).
|
|
rules = []
|
|
rules.extend(node.avrules())
|
|
+ rules.extend(node.avextrules())
|
|
rules.extend(node.interface_calls())
|
|
rules.sort(key=util.cmp_to_key(rule_cmp))
|
|
|
|
--
|
|
2.29.0
|
|
|