rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Allow postgresql to manage rgmanager pid files 

- Allow postgresql to read ccs data
- Allow systemd_domain to send dbus messages to policykit
- Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create
- All systemd domains that create content are reading the file_context file and setfscreat
- Systemd domains need to search through init_var_run_t
- Allow sshd to communicate with libvirt to set containers labels
- Add interface to manage pid files
- Allow NetworkManger_t to read /etc/hostname
- Dontaudit leaked locked files into openshift_domains
- Add fixes for oo-cgroup-read - it nows creates tmp files
- Allow gluster to manage all directories as well as files
- Dontaudit chrome_sandbox_nacl_t using user terminals
- Allow sysstat to manage its own log files
- Allow virtual machines to setrlimit and send itself signals.
- Add labeling for /var/run/hplip
This commit is contained in:
Miroslav Grepl 2013-03-07 11:49:39 +01:00
parent e30ef5a20a
commit 06b84e3300
3 changed files with 331 additions and 143 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

215
policy-rawhide-base.patch
View File

@ -7634,7 +7634,7 @@ index 6a1e4d1..adafd25 100644
+ dontaudit $1 domain:socket_class_set { read write };
')
diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
index cf04cb5..8601a3e 100644
index cf04cb5..431baa5 100644
--- a/policy/modules/kernel/domain.te
+++ b/policy/modules/kernel/domain.te
@@ -4,6 +4,29 @@ policy_module(domain, 1.11.0)
@ -7760,7 +7760,7 @@ index cf04cb5..8601a3e 100644
# Create/access any System V IPC objects.
allow unconfined_domain_type domain:{ sem msgq shm } *;
@@ -166,5 +227,262 @@ allow unconfined_domain_type domain:lnk_file { read_lnk_file_perms ioctl lock };
@@ -166,5 +227,261 @@ allow unconfined_domain_type domain:lnk_file { read_lnk_file_perms ioctl lock };
# act on all domains keys
allow unconfined_domain_type domain:key *;
@ -8022,7 +8022,6 @@ index cf04cb5..8601a3e 100644
+ prelink_exec(domain)
+ ')
+')
+
diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
index c2c6e05..d0e6d1c 100644
--- a/policy/modules/kernel/files.fc
@ -17466,7 +17465,7 @@ index 9d2f311..9e87525 100644
+ postgresql_filetrans_named_content($1)
')
diff --git a/policy/modules/services/postgresql.te b/policy/modules/services/postgresql.te
index 346d011..d84cfd8 100644
index 346d011..a00f4ea 100644
--- a/policy/modules/services/postgresql.te
+++ b/policy/modules/services/postgresql.te
@@ -19,25 +19,32 @@ gen_require(`
@ -17479,15 +17478,15 @@ index 346d011..d84cfd8 100644
+## <p>
+## Allow postgresql to use ssh and rsync for point-in-time recovery
+## </p>
## </desc>
-gen_tunable(sepgsql_enable_users_ddl, false)
+## </desc>
+gen_tunable(postgresql_can_rsync, false)
+
+## <desc>
+## <p>
+## Allow unprivileged users to execute DDL statement
+## </p>
+## </desc>
## </desc>
-gen_tunable(sepgsql_enable_users_ddl, false)
+gen_tunable(postgresql_selinux_users_ddl, true)
## <desc>
@ -17566,16 +17565,27 @@ index 346d011..d84cfd8 100644
seutil_libselinux_linked(postgresql_t)
seutil_read_default_contexts(postgresql_t)
@@ -367,7 +373,7 @@ optional_policy(`
@@ -364,10 +370,18 @@ userdom_dontaudit_search_user_home_dirs(postgresql_t)
userdom_dontaudit_use_user_terminals(postgresql_t)
optional_policy(`
+ ccs_read_config(postgresql_t)
+')
+
+optional_policy(`
mta_getattr_spool(postgresql_t)
')
-tunable_policy(`allow_execmem',`
+optional_policy(`
+ rgmanager_manage_pid_files(postgresql_t)
+')
+
+tunable_policy(`deny_execmem',`',`
allow postgresql_t self:process execmem;
')
@@ -485,10 +491,52 @@ dontaudit { postgresql_t sepgsql_admin_type sepgsql_client_type sepgsql_unconfin
@@ -485,10 +499,52 @@ dontaudit { postgresql_t sepgsql_admin_type sepgsql_client_type sepgsql_unconfin
# It is always allowed to operate temporary objects for any database client.
allow sepgsql_client_type sepgsql_temp_object_t:{db_schema db_table db_column db_tuple db_sequence db_view db_procedure} ~{ relabelto relabelfrom };
@ -17632,7 +17642,7 @@ index 346d011..d84cfd8 100644
allow sepgsql_client_type sepgsql_schema_t:db_schema { add_name remove_name };
')
@@ -536,7 +584,7 @@ allow sepgsql_admin_type sepgsql_module_type:db_database install_module;
@@ -536,7 +592,7 @@ allow sepgsql_admin_type sepgsql_module_type:db_database install_module;
kernel_relabelfrom_unlabeled_database(sepgsql_admin_type)
@ -17641,7 +17651,7 @@ index 346d011..d84cfd8 100644
allow sepgsql_admin_type sepgsql_database_type:db_database *;
allow sepgsql_admin_type sepgsql_schema_type:db_schema *;
@@ -589,3 +637,17 @@ allow sepgsql_unconfined_type sepgsql_blob_type:db_blob *;
@@ -589,3 +645,17 @@ allow sepgsql_unconfined_type sepgsql_blob_type:db_blob *;
allow sepgsql_unconfined_type sepgsql_module_type:db_database install_module;
kernel_relabelfrom_unlabeled_database(sepgsql_unconfined_type)
@ -18323,7 +18333,7 @@ index fe0c682..da12170 100644
+ allow $1 sshd_devpts_t:chr_file rw_inherited_chr_file_perms;
+')
diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te
index 5fc0391..8d190be 100644
index 5fc0391..ab68072 100644
--- a/policy/modules/services/ssh.te
+++ b/policy/modules/services/ssh.te
@@ -6,44 +6,52 @@ policy_module(ssh, 2.3.3)
@ -18651,7 +18661,7 @@ index 5fc0391..8d190be 100644
rpm_use_script_fds(sshd_t)
')
@@ -279,6 +335,32 @@ optional_policy(`
@@ -279,13 +335,68 @@ optional_policy(`
')
optional_policy(`
@ -18684,7 +18694,13 @@ index 5fc0391..8d190be 100644
unconfined_shell_domtrans(sshd_t)
')
@@ -286,6 +368,29 @@ optional_policy(`
optional_policy(`
+ kernel_write_proc_files(sshd_t)
+ virt_transition_svirt_lxc(sshd_t, system_r)
+ virt_stream_connect(sshd_t)
+')
+
+optional_policy(`
xserver_domtrans_xauth(sshd_t)
')
@ -18714,7 +18730,7 @@ index 5fc0391..8d190be 100644
########################################
#
# ssh_keygen local policy
@@ -294,19 +399,26 @@ optional_policy(`
@@ -294,19 +405,26 @@ optional_policy(`
# ssh_keygen_t is the type of the ssh-keygen program when run at install time
# and by sysadm_t
@ -18742,7 +18758,7 @@ index 5fc0391..8d190be 100644
dev_read_urand(ssh_keygen_t)
term_dontaudit_use_console(ssh_keygen_t)
@@ -323,6 +435,12 @@ auth_use_nsswitch(ssh_keygen_t)
@@ -323,6 +441,12 @@ auth_use_nsswitch(ssh_keygen_t)
logging_send_syslog_msg(ssh_keygen_t)
userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t)
@ -18755,7 +18771,7 @@ index 5fc0391..8d190be 100644
optional_policy(`
seutil_sigchld_newrole(ssh_keygen_t)
@@ -331,3 +449,138 @@ optional_policy(`
@@ -331,3 +455,138 @@ optional_policy(`
optional_policy(`
udev_read_db(ssh_keygen_t)
')
@ -26319,10 +26335,10 @@ index 9e54bf9..35992c7 100644
+userdom_read_user_tmp_files(setkey_t)
diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index 1b93eb7..5effebe 100644
index 1b93eb7..b2532aa 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -1,7 +1,8 @@
@@ -1,21 +1,27 @@
/etc/rc\.d/init\.d/ip6?tables -- gen_context(system_u:object_r:iptables_initrc_exec_t,s0)
-/etc/rc\.d/init\.d/ebtables -- gen_context(system_u:object_r:iptables_initrc_exec_t,s0)
-/etc/sysconfig/ip6?tables.* -- gen_context(system_u:object_r:iptables_conf_t,s0)
@ -26334,7 +26350,15 @@ index 1b93eb7..5effebe 100644
/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0)
/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
@@ -14,8 +15,13 @@
/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ip6?tables -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ip6?tables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ip6?tables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/sbin/ip6?tables-restore.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/sbin/ip6?tables-multi.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
/sbin/ipvsadm -- gen_context(system_u:object_r:iptables_exec_t,s0)
/sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
/sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
/sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
@ -26345,9 +26369,9 @@ index 1b93eb7..5effebe 100644
-/usr/sbin/iptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/usr/sbin/iptables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/usr/sbin/iptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ip6?tables -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ip6?tables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ip6?tables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ip6?tables-restore.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ip6?tables-multi.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ipvsadm -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
@ -29642,7 +29666,7 @@ index 4584457..300c3f7 100644
+ domtrans_pattern($1, mount_ecryptfs_exec_t, mount_ecryptfs_t)
')
diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
index 6a50270..b78f6a9 100644
index 6a50270..bfb146f 100644
--- a/policy/modules/system/mount.te
+++ b/policy/modules/system/mount.te
@@ -10,35 +10,60 @@ policy_module(mount, 1.15.1)
@ -29839,7 +29863,7 @@ index 6a50270..b78f6a9 100644
term_dontaudit_manage_pty_dirs(mount_t)
auth_use_nsswitch(mount_t)
@@ -121,16 +187,20 @@ auth_use_nsswitch(mount_t)
@@ -121,16 +187,19 @@ auth_use_nsswitch(mount_t)
init_use_fds(mount_t)
init_use_script_ptys(mount_t)
init_dontaudit_getattr_initctl(mount_t)
@ -29849,7 +29873,7 @@ index 6a50270..b78f6a9 100644
logging_send_syslog_msg(mount_t)
-miscfiles_read_localization(mount_t)
-
sysnet_use_portmap(mount_t)
seutil_read_config(mount_t)
@ -29861,7 +29885,7 @@ index 6a50270..b78f6a9 100644
ifdef(`distro_redhat',`
optional_policy(`
@@ -146,26 +216,27 @@ ifdef(`distro_ubuntu',`
@@ -146,26 +215,27 @@ ifdef(`distro_ubuntu',`
')
')
@ -29901,7 +29925,7 @@ index 6a50270..b78f6a9 100644
corenet_tcp_bind_generic_port(mount_t)
corenet_udp_bind_generic_port(mount_t)
corenet_tcp_bind_reserved_port(mount_t)
@@ -179,6 +250,8 @@ optional_policy(`
@@ -179,6 +249,8 @@ optional_policy(`
fs_search_rpc(mount_t)
rpc_stub(mount_t)
@ -29910,7 +29934,7 @@ index 6a50270..b78f6a9 100644
')
optional_policy(`
@@ -186,6 +259,32 @@ optional_policy(`
@@ -186,6 +258,36 @@ optional_policy(`
')
optional_policy(`
@ -29934,6 +29958,10 @@ index 6a50270..b78f6a9 100644
+')
+
+optional_policy(`
+ glusterd_domtrans(mount_t)
+')
+
+optional_policy(`
+ hal_write_log(mount_t)
+ hal_use_fds(mount_t)
+ hal_dontaudit_rw_pipes(mount_t)
@ -29943,7 +29971,7 @@ index 6a50270..b78f6a9 100644
ifdef(`hide_broken_symptoms',`
# for a bug in the X server
rhgb_dontaudit_rw_stream_sockets(mount_t)
@@ -194,24 +293,124 @@ optional_policy(`
@@ -194,24 +296,124 @@ optional_policy(`
')
optional_policy(`
@ -30002,22 +30030,22 @@ index 6a50270..b78f6a9 100644
+
+optional_policy(`
+ usbmuxd_stream_connect(mount_t)
+')
+
+optional_policy(`
+ userhelper_exec_console(mount_t)
+')
+
+optional_policy(`
+ virt_read_blk_images(mount_t)
+')
optional_policy(`
- files_etc_filetrans_etc_runtime(unconfined_mount_t, file)
- unconfined_domain(unconfined_mount_t)
+ vmware_exec_host(mount_t)
+ userhelper_exec_console(mount_t)
')
+
+optional_policy(`
+ virt_read_blk_images(mount_t)
+')
+
+optional_policy(`
+ vmware_exec_host(mount_t)
+')
+
+######################################
+#
+# showmount local policy
@ -30147,7 +30175,7 @@ index d43f3b1..c4182e8 100644
+/etc/share/selinux/targeted(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
+/etc/share/selinux/mls(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
index 3822072..2639601 100644
index 3822072..1029e3b 100644
--- a/policy/modules/system/selinuxutil.if
+++ b/policy/modules/system/selinuxutil.if
@@ -192,11 +192,22 @@ interface(`seutil_domtrans_newrole',`
@ -30516,7 +30544,17 @@ index 3822072..2639601 100644
########################################
## <summary>
## Create, read, write, and delete the default_contexts files.
@@ -999,6 +1270,26 @@ interface(`seutil_domtrans_semanage',`
@@ -784,7 +1055,9 @@ interface(`seutil_read_file_contexts',`
files_search_etc($1)
allow $1 { selinux_config_t default_context_t }:dir search_dir_perms;
+ list_dirs_pattern($1, file_context_t, file_context_t)
read_files_pattern($1, file_context_t, file_context_t)
+ read_lnk_files_pattern($1, file_context_t, file_context_t)
')
########################################
@@ -999,6 +1272,26 @@ interface(`seutil_domtrans_semanage',`
########################################
## <summary>
@ -30543,7 +30581,7 @@ index 3822072..2639601 100644
## Execute semanage in the semanage domain, and
## allow the specified role the semanage domain,
## and use the caller's terminal.
@@ -1017,11 +1308,66 @@ interface(`seutil_domtrans_semanage',`
@@ -1017,11 +1310,66 @@ interface(`seutil_domtrans_semanage',`
#
interface(`seutil_run_semanage',`
gen_require(`
@ -30612,7 +30650,7 @@ index 3822072..2639601 100644
')
########################################
@@ -1044,6 +1390,9 @@ interface(`seutil_manage_module_store',`
@@ -1044,6 +1392,9 @@ interface(`seutil_manage_module_store',`
manage_dirs_pattern($1, selinux_config_t, semanage_store_t)
manage_files_pattern($1, semanage_store_t, semanage_store_t)
filetrans_pattern($1, selinux_config_t, semanage_store_t, dir, "modules")
@ -30622,7 +30660,7 @@ index 3822072..2639601 100644
')
#######################################
@@ -1137,3 +1486,98 @@ interface(`seutil_dontaudit_libselinux_linked',`
@@ -1137,3 +1488,98 @@ interface(`seutil_dontaudit_libselinux_linked',`
selinux_dontaudit_get_fs_mount($1)
seutil_dontaudit_read_config($1)
')
@ -32229,10 +32267,13 @@ index b7686d5..9a50b11 100644
+')
diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
new file mode 100644
index 0000000..595f756
index 0000000..4e12420
--- /dev/null
+++ b/policy/modules/system/systemd.fc
@@ -0,0 +1,39 @@
@@ -0,0 +1,42 @@
+/etc/hostname -- gen_context(system_u:object_r:hostname_etc_t,s0)
+/etc/machine-info -- gen_context(system_u:object_r:hostname_etc_t,s0)
+
+/bin/systemd-notify -- gen_context(system_u:object_r:systemd_notify_exec_t,s0)
+/bin/systemctl -- gen_context(system_u:object_r:systemd_systemctl_exec_t,s0)
+/bin/systemd-tty-ask-password-agent -- gen_context(system_u:object_r:systemd_passwd_agent_exec_t,s0)
@ -32274,10 +32315,10 @@ index 0000000..595f756
+/var/run/initramfs(/.*)? <<none>>
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
new file mode 100644
index 0000000..2961157
index 0000000..fc080a1
--- /dev/null
+++ b/policy/modules/system/systemd.if
@@ -0,0 +1,1042 @@
@@ -0,0 +1,1064 @@
+## <summary>SELinux policy for systemd components</summary>
+
+#######################################
@ -33068,6 +33109,25 @@ index 0000000..2961157
+ files_var_lib_filetrans($1, random_seed_t, file, "random_seed")
+')
+
+########################################
+## <summary>
+## Allow process to read hostname config file.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`systemd_hostnamed_read_config',`
+ gen_require(`
+ type hostname_etc_t;
+ ')
+
+ files_search_etc($1)
+ allow $1 hostname_etc_t:file read_file_perms;
+')
+
+########################################
+## <summary>
@ -33083,11 +33143,14 @@ index 0000000..2961157
+ gen_require(`
+ type systemd_passwd_var_run_t;
+ type systemd_logind_var_run_t;
+ type hostname_etc_t;
+ ')
+
+ files_pid_filetrans($1, systemd_logind_var_run_t, file, "nologin")
+ init_named_pid_filetrans($1, systemd_passwd_var_run_t, dir, "ask-password-block")
+ init_named_pid_filetrans($1, systemd_passwd_var_run_t, dir, "ask-password")
+ files_etc_filetrans($1, hostname_etc_t, file, "hostname" )
+ files_etc_filetrans($1, hostname_etc_t, file, "machine-info" )
+')
+
+########################################
@ -33322,10 +33385,10 @@ index 0000000..2961157
+')
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644
index 0000000..ac0a395
index 0000000..90e063a
--- /dev/null
+++ b/policy/modules/system/systemd.te
@@ -0,0 +1,624 @@
@@ -0,0 +1,632 @@
+policy_module(systemd, 1.0.0)
+
+#######################################
@ -33400,6 +33463,9 @@ index 0000000..ac0a395
+type systemd_hostnamed_exec_t;
+init_daemon_domain(systemd_hostnamed_t, systemd_hostnamed_exec_t)
+
+type hostname_etc_t;
+files_config_file(hostname_etc_t)
+
+type systemd_timedated_t, systemd_domain;
+type systemd_timedated_exec_t;
+init_daemon_domain(systemd_timedated_t, systemd_timedated_exec_t)
@ -33538,10 +33604,6 @@ index 0000000..ac0a395
+')
+
+optional_policy(`
+ policykit_dbus_chat(systemd_logind_t)
+')
+
+optional_policy(`
+ rpm_dbus_chat(systemd_logind_t)
+')
+
@ -33556,7 +33618,7 @@ index 0000000..ac0a395
+#
+
+allow systemd_passwd_agent_t self:capability { chown sys_tty_config dac_override };
+allow systemd_passwd_agent_t self:process { setfscreate setsockcreate signal };
+allow systemd_passwd_agent_t self:process { setsockcreate };
+allow systemd_passwd_agent_t self:unix_dgram_socket create_socket_perms;
+
+manage_dirs_pattern(systemd_passwd_agent_t, systemd_passwd_var_run_t, systemd_passwd_var_run_t);
@ -33671,9 +33733,6 @@ index 0000000..ac0a395
+miscfiles_relabel_man_pages(systemd_tmpfiles_t)
+miscfiles_delete_man_pages(systemd_tmpfiles_t)
+
+seutil_read_config(systemd_tmpfiles_t)
+seutil_read_file_contexts(systemd_tmpfiles_t)
+
+ifdef(`distro_redhat',`
+ userdom_list_user_home_content(systemd_tmpfiles_t)
+ userdom_delete_all_user_home_content_dirs(systemd_tmpfiles_t)
@ -33799,10 +33858,8 @@ index 0000000..ac0a395
+
+dev_write_kmsg(systemd_localed_t)
+
+seutil_read_config(systemd_localed_t)
+seutil_read_file_contexts(systemd_localed_t)
+
+logging_stream_connect_syslog(systemd_localed_t)
+logging_send_syslog_msg(systemd_localed_t)
+
+miscfiles_manage_localization(systemd_localed_t)
+miscfiles_etc_filetrans_localization(systemd_localed_t)
@ -33818,12 +33875,17 @@ index 0000000..ac0a395
+#
+# Hostnamed policy
+#
+dontaudit systemd_hostnamed_t self:capability sys_ptrace;
+dontaudit systemd_hostnamed_t self:capability { sys_admin sys_ptrace };
+
+allow systemd_hostnamed_t self:fifo_file rw_fifo_file_perms;
+allow systemd_hostnamed_t self:unix_stream_socket create_stream_socket_perms;
+allow systemd_hostnamed_t self:unix_dgram_socket create_socket_perms;
+
+manage_files_pattern(systemd_hostnamed_t, hostname_etc_t, hostname_etc_t)
+manage_lnk_files_pattern(systemd_hostnamed_t, hostname_etc_t, hostname_etc_t)
+files_etc_filetrans(systemd_hostnamed_t, hostname_etc_t, file, "hostname" )
+files_etc_filetrans(systemd_hostnamed_t, hostname_etc_t, file, "machine-info" )
+
+kernel_dgram_send(systemd_hostnamed_t)
+
+dev_write_kmsg(systemd_hostnamed_t)
@ -33835,6 +33897,9 @@ index 0000000..ac0a395
+
+logging_send_syslog_msg(systemd_hostnamed_t)
+
+userdom_read_all_users_state(systemd_hostnamed_t)
+userdom_dbus_send_all_users(systemd_hostnamed_t)
+
+optional_policy(`
+ dbus_system_bus_client(systemd_hostnamed_t)
+ dbus_connect_system_bus(systemd_hostnamed_t)
@ -33845,7 +33910,7 @@ index 0000000..ac0a395
+# Timedated policy
+#
+allow systemd_timedated_t self:capability { sys_nice sys_time dac_override };
+allow systemd_timedated_t self:process { getattr getsched signal setfscreate };
+allow systemd_timedated_t self:process { getattr getsched setfscreate };
+allow systemd_timedated_t self:fifo_file rw_fifo_file_perms;
+allow systemd_timedated_t self:unix_stream_socket create_stream_socket_perms;
+allow systemd_timedated_t self:unix_dgram_socket create_socket_perms;
@ -33875,8 +33940,6 @@ index 0000000..ac0a395
+miscfiles_manage_localization(systemd_timedated_t)
+miscfiles_etc_filetrans_localization(systemd_timedated_t)
+
+seutil_read_file_contexts(systemd_timedated_t)
+
+userdom_read_all_users_state(systemd_timedated_t)
+
+optional_policy(`
@ -33915,7 +33978,6 @@ index 0000000..ac0a395
+')
+
+optional_policy(`
+ policykit_dbus_chat(systemd_timedated_t)
+ policykit_domtrans_auth(systemd_timedated_t)
+ policykit_read_lib(systemd_timedated_t)
+ policykit_read_reload(systemd_timedated_t)
@ -33943,13 +34005,22 @@ index 0000000..ac0a395
+#
+# Common rules for systemd domains
+#
+
+allow systemd_domain self:process { setfscreate signal_perms };
+files_read_etc_files(systemd_domain)
+files_read_etc_runtime_files(systemd_domain)
+files_read_usr_files(systemd_domain)
+
+init_search_pid_dirs(systemd_domain)
+
+logging_stream_connect_syslog(systemd_domain)
+
+seutil_read_config(systemd_domain)
+seutil_read_file_contexts(systemd_domain)
+
+optional_policy(`
+ policykit_dbus_chat(systemd_domain)
+')
+
diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc
index 40928d8..49fd32e 100644
--- a/policy/modules/system/udev.fc
@ -35321,7 +35392,7 @@ index db75976..65191bd 100644
+
+/var/run/user(/.*)? gen_context(system_u:object_r:user_tmp_t,s0)
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 3c5dba7..ba7a400 100644
index 3c5dba7..05bc969 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -30,9 +30,11 @@ template(`userdom_base_user_template',`
@ -37987,10 +38058,12 @@ index 3c5dba7..ba7a400 100644
## Create keys for all user domains.
## </summary>
## <param name="domain">
@@ -3439,3 +4197,1355 @@ interface(`userdom_dbus_send_all_users',`
@@ -3438,4 +4196,1357 @@ interface(`userdom_dbus_send_all_users',`
')
allow $1 userdomain:dbus send_msg;
')
+ ps_process_pattern($1, userdomain)
+')
+
+########################################
+## <summary>
@ -39342,7 +39415,7 @@ index 3c5dba7..ba7a400 100644
+ ')
+
+ filetrans_pattern($1, user_tmpfs_t, $2, $3, $4)
+')
')
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index e2b538b..6371ed6 100644
--- a/policy/modules/system/userdomain.te

239
policy-rawhide-contrib.patch
View File

@ -10091,10 +10091,10 @@ index 0000000..efebae7
+')
diff --git a/chrome.te b/chrome.te
new file mode 100644
index 0000000..2cce501
index 0000000..a54bf63
--- /dev/null
+++ b/chrome.te
@@ -0,0 +1,203 @@
@@ -0,0 +1,204 @@
+policy_module(chrome,1.0.0)
+
+########################################
@ -10293,6 +10293,7 @@ index 0000000..2cce501
+userdom_execute_user_tmpfs_files(chrome_sandbox_nacl_t)
+userdom_rw_inherited_user_tmp_files(chrome_sandbox_nacl_t)
+userdom_dontaudit_read_user_home_content_files(chrome_sandbox_nacl_t)
+userdom_dontaudit_use_user_terminals(chrome_sandbox_nacl_t)
+
+optional_policy(`
+ gnome_dontaudit_append_config_files(chrome_sandbox_nacl_t)
@ -11596,10 +11597,10 @@ index 954309e..f4db2ca 100644
')
+
diff --git a/collectd.te b/collectd.te
index 6471fa8..45f1622 100644
index 6471fa8..afeb58c 100644
--- a/collectd.te
+++ b/collectd.te
@@ -26,6 +26,9 @@ files_type(collectd_var_lib_t)
@@ -26,8 +26,14 @@ files_type(collectd_var_lib_t)
type collectd_var_run_t;
files_pid_file(collectd_var_run_t)
@ -11608,8 +11609,21 @@ index 6471fa8..45f1622 100644
+
apache_content_template(collectd)
+type httpd_collectd_script_tmp_t;
+files_tmp_file(httpd_collectd_script_tmp_t)
+
########################################
@@ -48,21 +51,18 @@ files_pid_filetrans(collectd_t, collectd_var_run_t, file)
#
# Local policy
@@ -38,6 +44,7 @@ allow collectd_t self:process { getsched setsched signal };
allow collectd_t self:fifo_file rw_fifo_file_perms;
allow collectd_t self:packet_socket create_socket_perms;
allow collectd_t self:unix_stream_socket { accept listen };
+allow collectd_t self:netlink_tcpdiag_socket create_socket_perms;
manage_dirs_pattern(collectd_t, collectd_var_lib_t, collectd_var_lib_t)
manage_files_pattern(collectd_t, collectd_var_lib_t, collectd_var_lib_t)
@@ -48,21 +55,18 @@ files_pid_filetrans(collectd_t, collectd_var_run_t, file)
domain_use_interactive_fds(collectd_t)
@ -11634,14 +11648,30 @@ index 6471fa8..45f1622 100644
logging_send_syslog_msg(collectd_t)
@@ -87,4 +87,7 @@ optional_policy(`
read_files_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
list_dirs_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
miscfiles_setattr_fonts_cache_dirs(httpd_collectd_script_t)
+
+ auth_read_passwd(httpd_collectd_script_t)
')
@@ -80,11 +84,17 @@ optional_policy(`
########################################
#
-# Web local policy
+# Web collectd local policy
#
-optional_policy(`
- read_files_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
- list_dirs_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
- miscfiles_setattr_fonts_cache_dirs(httpd_collectd_script_t)
-')
+
+files_search_var_lib(httpd_collectd_script_t)
+read_files_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+list_dirs_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+miscfiles_setattr_fonts_cache_dirs(httpd_collectd_script_t)
+
+manage_dirs_pattern(httpd_collectd_script_t, httpd_collectd_script_tmp_t, httpd_collectd_script_tmp_t)
+manage_files_pattern(httpd_collectd_script_t, httpd_collectd_script_tmp_t, httpd_collectd_script_tmp_t)
+files_tmp_filetrans(httpd_collectd_script_t, httpd_collectd_script_tmp_t, { file dir })
+
+auth_read_passwd(httpd_collectd_script_t)
diff --git a/colord.fc b/colord.fc
index 717ea0b..22e0385 100644
--- a/colord.fc
@ -15640,10 +15670,10 @@ index 6ce66e7..1d0337a 100644
optional_policy(`
diff --git a/cups.fc b/cups.fc
index 949011e..85b210b 100644
index 949011e..0332f88 100644
--- a/cups.fc
+++ b/cups.fc
@@ -1,77 +1,85 @@
@@ -1,77 +1,86 @@
-/etc/alchemist/namespace/printconf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-/etc/cups(/.*)? gen_context(system_u:object_r:cupsd_etc_t,s0)
@ -15760,6 +15790,7 @@ index 949011e..85b210b 100644
+/var/ccpd(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,s0)
+/var/ekpd(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,s0)
+/var/run/cups(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,mls_systemhigh)
+/var/run/hplip(/.*) gen_context(system_u:object_r:cupsd_var_run_t,s0)
+/var/run/hp.*\.pid -- gen_context(system_u:object_r:cupsd_var_run_t,s0)
+/var/run/hp.*\.port -- gen_context(system_u:object_r:cupsd_var_run_t,s0)
/var/run/ptal-printd(/.*)? gen_context(system_u:object_r:ptal_var_run_t,s0)
@ -23526,7 +23557,7 @@ index 9eacb2c..229782f 100644
init_labeled_script_domtrans($1, { glance_api_initrc_exec_t glance_registry_initrc_exec_t })
domain_system_change_exemption($1)
diff --git a/glance.te b/glance.te
index e0a4f46..70277e8 100644
index e0a4f46..0a1aec6 100644
--- a/glance.te
+++ b/glance.te
@@ -7,8 +7,7 @@ policy_module(glance, 1.0.2)
@ -23560,7 +23591,7 @@ index e0a4f46..70277e8 100644
allow glance_domain self:fifo_file rw_fifo_file_perms;
allow glance_domain self:unix_stream_socket create_stream_socket_perms;
allow glance_domain self:tcp_socket { accept listen };
@@ -56,10 +58,6 @@ manage_files_pattern(glance_domain, glance_var_lib_t, glance_var_lib_t)
@@ -56,27 +58,21 @@ manage_files_pattern(glance_domain, glance_var_lib_t, glance_var_lib_t)
manage_dirs_pattern(glance_domain, glance_var_run_t, glance_var_run_t)
manage_files_pattern(glance_domain, glance_var_run_t, glance_var_run_t)
@ -23571,7 +23602,11 @@ index e0a4f46..70277e8 100644
corenet_tcp_sendrecv_generic_if(glance_domain)
corenet_tcp_sendrecv_generic_node(glance_domain)
corenet_tcp_sendrecv_all_ports(glance_domain)
@@ -70,13 +68,10 @@ corecmd_exec_shell(glance_domain)
corenet_tcp_bind_generic_node(glance_domain)
+corenet_tcp_connect_mysqld_port(glance_domain)
corecmd_exec_bin(glance_domain)
corecmd_exec_shell(glance_domain)
dev_read_urand(glance_domain)
@ -23586,7 +23621,7 @@ index e0a4f46..70277e8 100644
sysnet_dns_name_resolve(glance_domain)
########################################
@@ -88,8 +83,15 @@ manage_dirs_pattern(glance_registry_t, glance_registry_tmp_t, glance_registry_tm
@@ -88,8 +84,14 @@ manage_dirs_pattern(glance_registry_t, glance_registry_tmp_t, glance_registry_tm
manage_files_pattern(glance_registry_t, glance_registry_tmp_t, glance_registry_tmp_t)
files_tmp_filetrans(glance_registry_t, glance_registry_tmp_t, { dir file })
@ -23597,12 +23632,11 @@ index e0a4f46..70277e8 100644
+corenet_tcp_bind_generic_node(glance_registry_t)
corenet_sendrecv_glance_registry_server_packets(glance_registry_t)
corenet_tcp_bind_glance_registry_port(glance_registry_t)
+corenet_tcp_connect_mysqld_port(glance_registry_t)
+corenet_tcp_connect_all_ephemeral_ports(glance_registry_t)
logging_send_syslog_msg(glance_registry_t)
@@ -108,13 +110,19 @@ manage_files_pattern(glance_api_t, glance_tmp_t, glance_tmp_t)
@@ -108,13 +110,20 @@ manage_files_pattern(glance_api_t, glance_tmp_t, glance_tmp_t)
files_tmp_filetrans(glance_api_t, glance_tmp_t, { dir file })
can_exec(glance_api_t, glance_tmp_t)
@ -23616,12 +23650,13 @@ index e0a4f46..70277e8 100644
+corenet_tcp_bind_glance_port(glance_api_t)
corenet_sendrecv_glance_registry_client_packets(glance_api_t)
corenet_tcp_connect_glance_registry_port(glance_api_t)
+corenet_tcp_connect_mysqld_port(glance_api_t)
+
+corenet_tcp_connect_all_ephemeral_ports(glance_api_t)
+
+corenet_sendrecv_hplip_server_packets(glance_api_t)
+corenet_tcp_bind_hplip_port(glance_api_t)
+
fs_getattr_xattr_fs(glance_api_t)
+
+optional_policy(`
@ -23807,7 +23842,7 @@ index 0000000..1ed97fe
+
diff --git a/glusterd.te b/glusterd.te
new file mode 100644
index 0000000..643f4bd
index 0000000..190dcb1
--- /dev/null
+++ b/glusterd.te
@@ -0,0 +1,146 @@
@ -23954,9 +23989,9 @@ index 0000000..643f4bd
+
+tunable_policy(`gluster_export_all_rw',`
+ fs_manage_noxattr_fs_files(glusterd_t)
+ files_manage_non_security_dirs(glusterd_t)
+ files_manage_non_security_files(glusterd_t)
+')
+
diff --git a/glusterfs.fc b/glusterfs.fc
deleted file mode 100644
index 4bd6ade..0000000
@ -31400,7 +31435,7 @@ index d3e7fc9..f20248c 100644
+ ')
')
diff --git a/keystone.te b/keystone.te
index 3494d9b..343535a 100644
index 3494d9b..124a2ab 100644
--- a/keystone.te
+++ b/keystone.te
@@ -21,10 +21,14 @@ files_type(keystone_var_lib_t)
@ -31418,7 +31453,15 @@ index 3494d9b..343535a 100644
allow keystone_t self:fifo_file rw_fifo_file_perms;
allow keystone_t self:unix_stream_socket { accept listen };
@@ -62,15 +66,17 @@ corenet_sendrecv_commplex_main_server_packets(keystone_t)
@@ -57,20 +61,25 @@ corenet_all_recvfrom_netlabel(keystone_t)
corenet_tcp_sendrecv_generic_if(keystone_t)
corenet_tcp_sendrecv_generic_node(keystone_t)
corenet_tcp_bind_generic_node(keystone_t)
+corenet_tcp_connect_mysqld_port(keystone_t)
+
+corenet_tcp_connect_mysqld_port(keystone_t)
corenet_sendrecv_commplex_main_server_packets(keystone_t)
corenet_tcp_bind_commplex_main_port(keystone_t)
corenet_tcp_sendrecv_commplex_main_port(keystone_t)
@ -39948,7 +39991,7 @@ index b744fe3..4c1b6a8 100644
init_labeled_script_domtrans($1, munin_initrc_exec_t)
domain_system_change_exemption($1)
diff --git a/munin.te b/munin.te
index 97370e4..f076c38 100644
index 97370e4..27d3100 100644
--- a/munin.te
+++ b/munin.te
@@ -40,12 +40,15 @@ munin_plugin_template(services)
@ -39968,7 +40011,7 @@ index 97370e4..f076c38 100644
allow munin_plugin_domain self:fifo_file rw_fifo_file_perms;
allow munin_plugin_domain munin_t:tcp_socket rw_socket_perms;
@@ -58,24 +61,16 @@ allow munin_plugin_domain munin_var_lib_t:dir search_dir_perms;
@@ -58,23 +61,17 @@ allow munin_plugin_domain munin_var_lib_t:dir search_dir_perms;
manage_files_pattern(munin_plugin_domain, munin_plugin_state_t, munin_plugin_state_t)
@ -39989,11 +40032,11 @@ index 97370e4..f076c38 100644
fs_getattr_all_fs(munin_plugin_domain)
-miscfiles_read_localization(munin_plugin_domain)
-
+auth_read_passwd(munin_plugin_domain)
optional_policy(`
nscd_use(munin_plugin_domain)
')
@@ -114,7 +109,7 @@ manage_dirs_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
@@ -114,7 +111,7 @@ manage_dirs_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
manage_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
manage_lnk_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
@ -40002,7 +40045,7 @@ index 97370e4..f076c38 100644
manage_dirs_pattern(munin_t, munin_var_run_t, munin_var_run_t)
manage_files_pattern(munin_t, munin_var_run_t, munin_var_run_t)
@@ -130,7 +125,6 @@ kernel_read_all_sysctls(munin_t)
@@ -130,7 +127,6 @@ kernel_read_all_sysctls(munin_t)
corecmd_exec_bin(munin_t)
corecmd_exec_shell(munin_t)
@ -40010,7 +40053,7 @@ index 97370e4..f076c38 100644
corenet_all_recvfrom_netlabel(munin_t)
corenet_tcp_sendrecv_generic_if(munin_t)
corenet_tcp_sendrecv_generic_node(munin_t)
@@ -153,7 +147,6 @@ domain_use_interactive_fds(munin_t)
@@ -153,7 +149,6 @@ domain_use_interactive_fds(munin_t)
domain_read_all_domains_state(munin_t)
files_read_etc_runtime_files(munin_t)
@ -40018,7 +40061,7 @@ index 97370e4..f076c38 100644
files_list_spool(munin_t)
fs_getattr_all_fs(munin_t)
@@ -165,7 +158,6 @@ logging_send_syslog_msg(munin_t)
@@ -165,7 +160,6 @@ logging_send_syslog_msg(munin_t)
logging_read_all_logs(munin_t)
miscfiles_read_fonts(munin_t)
@ -40026,7 +40069,7 @@ index 97370e4..f076c38 100644
miscfiles_setattr_fonts_cache_dirs(munin_t)
sysnet_exec_ifconfig(munin_t)
@@ -173,13 +165,6 @@ sysnet_exec_ifconfig(munin_t)
@@ -173,13 +167,6 @@ sysnet_exec_ifconfig(munin_t)
userdom_dontaudit_use_unpriv_user_fds(munin_t)
userdom_dontaudit_search_user_home_dirs(munin_t)
@ -40040,7 +40083,7 @@ index 97370e4..f076c38 100644
optional_policy(`
cron_system_entry(munin_t, munin_exec_t)
@@ -213,7 +198,6 @@ optional_policy(`
@@ -213,7 +200,6 @@ optional_policy(`
optional_policy(`
postfix_list_spool(munin_t)
@ -40048,7 +40091,7 @@ index 97370e4..f076c38 100644
')
optional_policy(`
@@ -246,17 +230,17 @@ corenet_sendrecv_hddtemp_client_packets(disk_munin_plugin_t)
@@ -246,17 +232,17 @@ corenet_sendrecv_hddtemp_client_packets(disk_munin_plugin_t)
corenet_tcp_connect_hddtemp_port(disk_munin_plugin_t)
corenet_tcp_sendrecv_hddtemp_port(disk_munin_plugin_t)
@ -40070,7 +40113,7 @@ index 97370e4..f076c38 100644
sysnet_read_config(disk_munin_plugin_t)
@@ -275,27 +259,36 @@ optional_policy(`
@@ -275,27 +261,36 @@ optional_policy(`
allow mail_munin_plugin_t self:capability dac_override;
@ -40111,7 +40154,7 @@ index 97370e4..f076c38 100644
')
optional_policy(`
@@ -353,7 +346,11 @@ optional_policy(`
@@ -353,7 +348,11 @@ optional_policy(`
')
optional_policy(`
@ -40124,7 +40167,15 @@ index 97370e4..f076c38 100644
')
optional_policy(`
@@ -413,3 +410,30 @@ optional_policy(`
@@ -385,6 +384,7 @@ read_files_pattern(system_munin_plugin_t, munin_log_t, munin_log_t)
kernel_read_network_state(system_munin_plugin_t)
kernel_read_all_sysctls(system_munin_plugin_t)
+kernel_read_fs_sysctls(system_munin_plugin_t)
dev_read_sysfs(system_munin_plugin_t)
dev_read_urand(system_munin_plugin_t)
@@ -413,3 +413,31 @@ optional_policy(`
optional_policy(`
unconfined_domain(unconfined_munin_plugin_t)
')
@ -40146,7 +40197,8 @@ index 97370e4..f076c38 100644
+read_files_pattern(httpd_munin_script_t, munin_var_lib_t, munin_var_lib_t)
+read_files_pattern(httpd_munin_script_t, munin_etc_t, munin_etc_t)
+
+allow httpd_munin_script_t munin_log_t:file read_file_perms;
+read_files_pattern(httpd_munin_script_t, munin_log_t, munin_log_t)
+append_files_pattern(httpd_munin_script_t, munin_log_t, munin_log_t)
+
+files_search_var_lib(httpd_munin_script_t)
+
@ -42462,7 +42514,7 @@ index 0e8508c..b9c69d2 100644
+ files_etc_filetrans($1, NetworkManager_var_lib_t, file, "wireed-settings.conf")
')
diff --git a/networkmanager.te b/networkmanager.te
index 0b48a30..da4eebb 100644
index 0b48a30..0c6cd41 100644
--- a/networkmanager.te
+++ b/networkmanager.te
@@ -1,4 +1,4 @@
@ -42786,7 +42838,7 @@ index 0b48a30..da4eebb 100644
')
optional_policy(`
@@ -320,13 +342,14 @@ optional_policy(`
@@ -320,13 +342,15 @@ optional_policy(`
')
optional_policy(`
@ -42795,6 +42847,7 @@ index 0b48a30..da4eebb 100644
+ systemd_write_inhibit_pipes(NetworkManager_t)
+ systemd_read_logind_sessions_files(NetworkManager_t)
+ systemd_dbus_chat_logind(NetworkManager_t)
+ systemd_hostnamed_read_config(NetworkManager_t)
')
optional_policy(`
@ -42805,7 +42858,7 @@ index 0b48a30..da4eebb 100644
')
optional_policy(`
@@ -356,6 +379,5 @@ rw_sock_files_pattern(wpa_cli_t, NetworkManager_var_run_t, NetworkManager_var_ru
@@ -356,6 +380,5 @@ rw_sock_files_pattern(wpa_cli_t, NetworkManager_var_run_t, NetworkManager_var_ru
init_dontaudit_use_fds(wpa_cli_t)
init_use_script_ptys(wpa_cli_t)
@ -43499,10 +43552,10 @@ index 0000000..7d11148
+')
diff --git a/nova.te b/nova.te
new file mode 100644
index 0000000..7ce9e62
index 0000000..c3a9a89
--- /dev/null
+++ b/nova.te
@@ -0,0 +1,326 @@
@@ -0,0 +1,325 @@
+policy_module(nova, 1.0.0)
+
+########################################
@ -43558,19 +43611,18 @@ index 0000000..7ce9e62
+manage_files_pattern(nova_domain, nova_var_run_t, nova_var_run_t)
+
+corenet_tcp_connect_amqp_port(nova_domain)
+corenet_tcp_connect_mysqld_port(nova_domain)
+
+corecmd_exec_bin(nova_domain)
+corecmd_exec_shell(nova_domain)
+corenet_tcp_connect_mysqld_port(nova_domain)
+
+dev_read_urand(nova_domain)
+
+fs_getattr_xattr_fs(nova_domain)
+
+
+libs_exec_ldconfig(nova_domain)
+
+
+
+optional_policy(`
+ sysnet_read_config(nova_domain)
+')
@ -48042,10 +48094,10 @@ index 0000000..407386d
+')
diff --git a/openshift.te b/openshift.te
new file mode 100644
index 0000000..a23c70a
index 0000000..d859b72
--- /dev/null
+++ b/openshift.te
@@ -0,0 +1,472 @@
@@ -0,0 +1,481 @@
+policy_module(openshift,1.0.0)
+
+gen_require(`
@ -48112,6 +48164,9 @@ index 0000000..a23c70a
+type openshift_cgroup_read_exec_t;
+application_domain(openshift_cgroup_read_t, openshift_cgroup_read_exec_t)
+
+type openshift_cgroup_read_tmp_t, openshift_file_type;
+files_tmp_file(openshift_cgroup_read_tmp_t)
+
+type openshift_cron_t;
+type openshift_cron_exec_t;
+domain_type(openshift_cron_t)
@ -48281,6 +48336,7 @@ index 0000000..a23c70a
+files_dontaudit_getattr_non_security_sockets(openshift_domain)
+files_dontaudit_setattr_non_security_dirs(openshift_domain)
+files_dontaudit_setattr_non_security_files(openshift_domain)
+files_dontaudit_rw_inherited_locks(openshift_domain)
+
+libs_exec_lib_files(openshift_domain)
+libs_exec_ld_so(openshift_domain)
@ -48416,6 +48472,10 @@ index 0000000..a23c70a
+allow openshift_cgroup_read_t self:unix_stream_socket create_stream_socket_perms;
+allow openshift_cgroup_read_t openshift_initrc_t:fifo_file rw_inherited_fifo_file_perms;
+
+manage_dirs_pattern(openshift_cgroup_read_t, openshift_cgroup_read_tmp_t, openshift_cgroup_read_tmp_t)
+manage_files_pattern(openshift_cgroup_read_t, openshift_cgroup_read_tmp_t, openshift_cgroup_read_tmp_t)
+files_tmp_filetrans(openshift_cgroup_read_t, openshift_cgroup_read_tmp_t, { file dir })
+
+kernel_read_system_state(openshift_cgroup_read_t)
+
+miscfiles_read_localization(openshift_cgroup_read_t)
@ -48425,12 +48485,12 @@ index 0000000..a23c70a
+')
+
+corecmd_exec_bin(openshift_cgroup_read_t)
+corecmd_exec_shell(openshift_cgroup_read_t)
+
+dev_read_urand(openshift_cgroup_read_t)
+
+domain_use_interactive_fds(openshift_cgroup_read_t)
+
+
+fs_dontaudit_rw_anon_inodefs_files(openshift_cgroup_read_t)
+
+userdom_use_inherited_user_ptys(openshift_cgroup_read_t)
@ -48442,6 +48502,7 @@ index 0000000..a23c70a
+
+allow openshift_domain openshift_cgroup_read_t:process { getattr signal signull sigkill };
+
+fs_list_cgroup_dirs(openshift_cgroup_read_t)
+fs_read_cgroup_files(openshift_cgroup_read_t)
+
+allow openshift_cgroup_read_t openshift_var_lib_t:dir list_dir_perms;
@ -63284,7 +63345,7 @@ index 5421af0..91e69b8 100644
+/var/run/heartbeat(/.*)? gen_context(system_u:object_r:rgmanager_var_run_t,s0)
+/var/run/rgmanager\.pid -- gen_context(system_u:object_r:rgmanager_var_run_t,s0)
diff --git a/rgmanager.if b/rgmanager.if
index 1c2f9aa..7d70a46 100644
index 1c2f9aa..8af1f78 100644
--- a/rgmanager.if
+++ b/rgmanager.if
@@ -1,13 +1,13 @@
@ -63314,8 +63375,29 @@ index 1c2f9aa..7d70a46 100644
## </summary>
## <param name="domain">
## <summary>
@@ -41,8 +40,7 @@ interface(`rgmanager_stream_connect',`
@@ -39,10 +38,28 @@ interface(`rgmanager_stream_connect',`
stream_connect_pattern($1, rgmanager_var_run_t, rgmanager_var_run_t, rgmanager_t)
')
+########################################
+## <summary>
+## Manage rgmanager pid files
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`rgmanager_manage_pid_files',`
+ gen_require(`
+ type rgmanager_var_run_t;
+ ')
+
+ files_search_pids($1)
+ manage_files_pattern($1, rgmanager_var_run_t, rgmanager_var_run_t)
+')
+
######################################
## <summary>
-## Create, read, write, and delete
@ -63324,7 +63406,7 @@ index 1c2f9aa..7d70a46 100644
## </summary>
## <param name="domain">
## <summary>
@@ -61,8 +59,7 @@ interface(`rgmanager_manage_tmp_files',`
@@ -61,8 +78,7 @@ interface(`rgmanager_manage_tmp_files',`
######################################
## <summary>
@ -63334,7 +63416,7 @@ index 1c2f9aa..7d70a46 100644
## </summary>
## <param name="domain">
## <summary>
@@ -79,10 +76,28 @@ interface(`rgmanager_manage_tmpfs_files',`
@@ -79,10 +95,28 @@ interface(`rgmanager_manage_tmpfs_files',`
manage_files_pattern($1, rgmanager_tmpfs_t, rgmanager_tmpfs_t)
')
@ -63365,7 +63447,7 @@ index 1c2f9aa..7d70a46 100644
## </summary>
## <param name="domain">
## <summary>
@@ -91,7 +106,7 @@ interface(`rgmanager_manage_tmpfs_files',`
@@ -91,7 +125,7 @@ interface(`rgmanager_manage_tmpfs_files',`
## </param>
## <param name="role">
## <summary>
@ -63374,7 +63456,7 @@ index 1c2f9aa..7d70a46 100644
## </summary>
## </param>
## <rolecap/>
@@ -102,8 +117,11 @@ interface(`rgmanager_admin',`
@@ -102,8 +136,11 @@ interface(`rgmanager_admin',`
type rgmanager_tmpfs_t, rgmanager_var_log_t, rgmanager_var_run_t;
')
@ -63387,7 +63469,7 @@ index 1c2f9aa..7d70a46 100644
init_labeled_script_domtrans($1, rgmanager_initrc_exec_t)
domain_system_change_exemption($1)
@@ -121,3 +139,47 @@ interface(`rgmanager_admin',`
@@ -121,3 +158,47 @@ interface(`rgmanager_admin',`
files_list_pids($1)
admin_pattern($1, rgmanager_var_run_t)
')
@ -78776,10 +78858,21 @@ index c9824cb..1973f71 100644
userdom_dontaudit_use_unpriv_user_fds(sxid_t)
diff --git a/sysstat.te b/sysstat.te
index c8b80b2..e6b8ab8 100644
index c8b80b2..f041061 100644
--- a/sysstat.te
+++ b/sysstat.te
@@ -38,6 +38,7 @@ kernel_read_kernel_sysctls(sysstat_t)
@@ -24,9 +24,7 @@ allow sysstat_t self:capability { dac_override sys_admin sys_resource sys_tty_co
allow sysstat_t self:fifo_file rw_fifo_file_perms;
manage_dirs_pattern(sysstat_t,sysstat_log_t,sysstat_log_t)
-append_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
-create_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
-setattr_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
+manage_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
manage_lnk_files_pattern(sysstat_t,sysstat_log_t,sysstat_log_t)
logging_log_filetrans(sysstat_t, sysstat_log_t, { file dir })
@@ -38,6 +36,7 @@ kernel_read_kernel_sysctls(sysstat_t)
kernel_read_fs_sysctls(sysstat_t)
kernel_read_rpc_sysctls(sysstat_t)
@ -78787,7 +78880,7 @@ index c8b80b2..e6b8ab8 100644
corecmd_exec_bin(sysstat_t)
dev_read_sysfs(sysstat_t)
@@ -49,8 +50,10 @@ files_read_etc_runtime_files(sysstat_t)
@@ -49,8 +48,10 @@ files_read_etc_runtime_files(sysstat_t)
fs_getattr_xattr_fs(sysstat_t)
fs_list_inotifyfs(sysstat_t)
@ -78799,7 +78892,7 @@ index c8b80b2..e6b8ab8 100644
auth_use_nsswitch(sysstat_t)
@@ -60,10 +63,9 @@ locallogin_use_fds(sysstat_t)
@@ -60,10 +61,9 @@ locallogin_use_fds(sysstat_t)
logging_send_syslog_msg(sysstat_t)
@ -81954,7 +82047,7 @@ index e29db63..061fb98 100644
domain_system_change_exemption($1)
role_transition $2 tuned_initrc_exec_t system_r;
diff --git a/tuned.te b/tuned.te
index 7116181..9815e42 100644
index 7116181..0bd0be9 100644
--- a/tuned.te
+++ b/tuned.te
@@ -21,6 +21,9 @@ files_config_file(tuned_rw_etc_t)
@ -82000,7 +82093,11 @@ index 7116181..9815e42 100644
corecmd_exec_bin(tuned_t)
corecmd_exec_shell(tuned_t)
@@ -67,28 +77,44 @@ dev_read_urand(tuned_t)
@@ -64,31 +74,48 @@ corecmd_exec_shell(tuned_t)
dev_getattr_all_blk_files(tuned_t)
dev_getattr_all_chr_files(tuned_t)
dev_read_urand(tuned_t)
+dev_read_cpuid(tuned_t)
dev_rw_sysfs(tuned_t)
dev_rw_netcontrol(tuned_t)
@ -85228,7 +85325,7 @@ index 9dec06c..d8a2b54 100644
+ allow svirt_lxc_domain $1:process sigchld;
')
diff --git a/virt.te b/virt.te
index 1f22fba..d984f26 100644
index 1f22fba..12f4354 100644
--- a/virt.te
+++ b/virt.te
@@ -1,94 +1,98 @@
@ -85524,9 +85621,7 @@ index 1f22fba..d984f26 100644
-append_files_pattern(virt_domain, virt_var_lib_t, virt_var_lib_t)
-
-kernel_read_system_state(virt_domain)
+# it was a part of auth_use_nsswitch
+allow svirt_t self:netlink_route_socket r_netlink_socket_perms;
-
-fs_getattr_xattr_fs(virt_domain)
-
-corecmd_exec_bin(virt_domain)
@ -85644,7 +85739,9 @@ index 1f22fba..d984f26 100644
- fs_manage_dos_dirs(virt_domain)
- fs_manage_dos_files(virt_domain)
-')
-
+# it was a part of auth_use_nsswitch
+allow svirt_t self:netlink_route_socket r_netlink_socket_perms;
-optional_policy(`
- tunable_policy(`virt_use_xserver',`
- xserver_read_xdm_pid(virt_domain)
@ -86097,7 +86194,7 @@ index 1f22fba..d984f26 100644
+# virtual domains common policy
+#
+allow virt_domain self:capability2 compromise_kernel;
+allow virt_domain self:process { signal getsched signull };
+allow virt_domain self:process { setrlimit signal_perms getsched };
+allow virt_domain self:fifo_file rw_fifo_file_perms;
+allow virt_domain self:shm create_shm_perms;
+allow virt_domain self:unix_stream_socket create_stream_socket_perms;

20
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.12.1
Release: 18%{?dist}
Release: 19%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@ -526,6 +526,24 @@ SELinux Reference policy mls base module.
%endif
%changelog
* Thu Mar 7 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-19
- Allow postgresql to manage rgmanager pid files
- Allow postgresql to read ccs data
- Allow systemd_domain to send dbus messages to policykit
- Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them
- All systemd domains that create content are reading the file_context file and setfscreate
- Systemd domains need to search through init_var_run_t
- Allow sshd to communicate with libvirt to set containers labels
- Add interface to manage pid files
- Allow NetworkManger_t to read /etc/hostname
- Dontaudit leaked locked files into openshift_domains
- Add fixes for oo-cgroup-read - it nows creates tmp files
- Allow gluster to manage all directories as well as files
- Dontaudit chrome_sandbox_nacl_t using user terminals
- Allow sysstat to manage its own log files
- Allow virtual machines to setrlimit and send itself signals.
- Add labeling for /var/run/hplip
* Mon Mar 4 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-18
- Fix POSTIN scriptlet