* Mon Aug 28 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-277

- Allow cupsd_t to execute ld_so_cache - Add cgroup_seclabel policycap. - Allow xdm_t to read systemd hwdb - Add new interface systemd_hwdb_mmap_config() - Allow auditd_t domain to mmap conf files labeled as auditd_etc_t BZ(1485050)
2017-08-28 18:08:50 +02:00 · 2017-08-28 18:08:50 +02:00 · 0c6eef95d3
parent 2b14b695c4
commit 0c6eef95d3
4 changed files with 101 additions and 61 deletions
--- a/container-selinux.tgz
+++ b/container-selinux.tgz
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@ -31132,7 +31132,7 @@ index 6bf0ecc2d..29db5fd25 100644
 +')
 +
 diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
-index 8b403774f..fc04c66d5 100644
+index 8b403774f..a03fa4661 100644
 --- a/policy/modules/services/xserver.te
 +++ b/policy/modules/services/xserver.te
@@ -26,28 +26,66 @@ gen_require(`
@ -31733,7 +31733,7 @@ index 8b403774f..fc04c66d5 100644
 
 storage_dontaudit_read_fixed_disk(xdm_t)
 storage_dontaudit_write_fixed_disk(xdm_t)
-@@ -442,28 +650,48 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
+@@ -442,28 +650,50 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
 storage_dontaudit_raw_write_removable_device(xdm_t)
 storage_dontaudit_setattr_removable_dev(xdm_t)
 storage_dontaudit_rw_scsi_generic(xdm_t)
@ -31773,20 +31773,23 @@ index 8b403774f..fc04c66d5 100644
 -miscfiles_read_localization(xdm_t)
 +miscfiles_search_man_pages(xdm_t)
 miscfiles_read_fonts(xdm_t)
+-
+-sysnet_read_config(xdm_t)
 +miscfiles_manage_fonts_cache(xdm_t)
 +miscfiles_manage_localization(xdm_t)
 +miscfiles_read_hwdata(xdm_t)
- 
-sysnet_read_config(xdm_t)
+
 +systemd_write_inhibit_pipes(xdm_t)
 +systemd_dbus_chat_localed(xdm_t)
 +systemd_dbus_chat_hostnamed(xdm_t)
 +systemd_start_power_services(xdm_t)
 +systemd_status_power_services(xdm_t)
+systemd_hwdb_mmap_config(xdm_t)
+systemd_hwdb_read_config(xdm_t)
 
 userdom_dontaudit_use_unpriv_user_fds(xdm_t)
 userdom_create_all_users_keys(xdm_t)
-@@ -472,24 +700,167 @@ userdom_read_user_home_content_files(xdm_t)
+@@ -472,24 +702,167 @@ userdom_read_user_home_content_files(xdm_t)
 # Search /proc for any user domain processes.
 userdom_read_all_users_state(xdm_t)
 userdom_signal_all_users(xdm_t)
@ -31960,7 +31963,7 @@ index 8b403774f..fc04c66d5 100644
 tunable_policy(`xdm_sysadm_login',`
 	userdom_xsession_spec_domtrans_all_users(xdm_t)
 	# FIXME:
-@@ -502,12 +873,31 @@ tunable_policy(`xdm_sysadm_login',`
+@@ -502,12 +875,31 @@ tunable_policy(`xdm_sysadm_login',`
 #	allow xserver_t xdm_tmpfs_t:file rw_file_perms;
 ')
 
@ -31992,7 +31995,7 @@ index 8b403774f..fc04c66d5 100644
 ')
 
 optional_policy(`
-@@ -518,8 +908,36 @@ optional_policy(`
+@@ -518,8 +910,36 @@ optional_policy(`
 	dbus_system_bus_client(xdm_t)
 	dbus_connect_system_bus(xdm_t)
 
@ -32016,12 +32019,12 @@ index 8b403774f..fc04c66d5 100644
 +		devicekit_dbus_chat_power(xdm_t)
 +	')
 +
- 	optional_policy(`
-		accountsd_dbus_chat(xdm_t)
+	optional_policy(`
 +		hal_dbus_chat(xdm_t)
 +	')
 +
-+	optional_policy(`
+ 	optional_policy(`
+-		accountsd_dbus_chat(xdm_t)
 +		gnomeclock_dbus_chat(xdm_t)
 +	')
 +
@ -32030,7 +32033,7 @@ index 8b403774f..fc04c66d5 100644
 	')
 ')
 
-@@ -530,6 +948,20 @@ optional_policy(`
+@@ -530,6 +950,20 @@ optional_policy(`
 ')
 
 optional_policy(`
@ -32051,7 +32054,7 @@ index 8b403774f..fc04c66d5 100644
 	hostname_exec(xdm_t)
 ')
 
-@@ -547,28 +979,78 @@ optional_policy(`
+@@ -547,28 +981,78 @@ optional_policy(`
 ')
 
 optional_policy(`
@ -32139,7 +32142,7 @@ index 8b403774f..fc04c66d5 100644
 ')
 
 optional_policy(`
-@@ -580,6 +1062,14 @@ optional_policy(`
+@@ -580,6 +1064,14 @@ optional_policy(`
 ')
 
 optional_policy(`
@ -32154,7 +32157,7 @@ index 8b403774f..fc04c66d5 100644
 	xfs_stream_connect(xdm_t)
 ')
 
-@@ -594,7 +1084,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
+@@ -594,7 +1086,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
 type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t;
 
 allow xserver_t { root_xdrawable_t x_domain }:x_drawable send;
@ -32163,7 +32166,7 @@ index 8b403774f..fc04c66d5 100644
 
 # setuid/setgid for the wrapper program to change UID
 # sys_rawio is for iopl access - should not be needed for frame-buffer
-@@ -604,8 +1094,11 @@ allow xserver_t input_xevent_t:x_event send;
+@@ -604,8 +1096,11 @@ allow xserver_t input_xevent_t:x_event send;
 # execheap needed until the X module loader is fixed.
 # NVIDIA Needs execstack
 
@ -32176,7 +32179,7 @@ index 8b403774f..fc04c66d5 100644
 allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 allow xserver_t self:fd use;
 allow xserver_t self:fifo_file rw_fifo_file_perms;
-@@ -618,8 +1111,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
+@@ -618,8 +1113,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
 allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
 allow xserver_t self:tcp_socket create_stream_socket_perms;
 allow xserver_t self:udp_socket create_socket_perms;
@ -32192,7 +32195,7 @@ index 8b403774f..fc04c66d5 100644
 manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
 manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
 manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
-@@ -627,6 +1127,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
+@@ -627,6 +1129,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
 
 filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file)
 
@ -32203,7 +32206,7 @@ index 8b403774f..fc04c66d5 100644
 manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
 manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
 manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
-@@ -638,25 +1142,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
+@@ -638,25 +1144,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
 manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
 files_search_var_lib(xserver_t)
 
@ -32245,7 +32248,7 @@ index 8b403774f..fc04c66d5 100644
 corenet_all_recvfrom_netlabel(xserver_t)
 corenet_tcp_sendrecv_generic_if(xserver_t)
 corenet_udp_sendrecv_generic_if(xserver_t)
-@@ -677,23 +1193,28 @@ dev_rw_apm_bios(xserver_t)
+@@ -677,23 +1195,28 @@ dev_rw_apm_bios(xserver_t)
 dev_rw_agp(xserver_t)
 dev_rw_framebuffer(xserver_t)
 dev_manage_dri_dev(xserver_t)
@ -32277,7 +32280,7 @@ index 8b403774f..fc04c66d5 100644
 
 # brought on by rhgb
 files_search_mnt(xserver_t)
-@@ -705,6 +1226,14 @@ fs_search_nfs(xserver_t)
+@@ -705,6 +1228,14 @@ fs_search_nfs(xserver_t)
 fs_search_auto_mountpoints(xserver_t)
 fs_search_ramfs(xserver_t)
 
@ -32292,7 +32295,7 @@ index 8b403774f..fc04c66d5 100644
 mls_xwin_read_to_clearance(xserver_t)
 
 selinux_validate_context(xserver_t)
-@@ -718,20 +1247,18 @@ init_getpgid(xserver_t)
+@@ -718,20 +1249,18 @@ init_getpgid(xserver_t)
 term_setattr_unallocated_ttys(xserver_t)
 term_use_unallocated_ttys(xserver_t)
 
@ -32316,7 +32319,7 @@ index 8b403774f..fc04c66d5 100644
 
 userdom_search_user_home_dirs(xserver_t)
 userdom_use_user_ttys(xserver_t)
-@@ -739,8 +1266,6 @@ userdom_setattr_user_ttys(xserver_t)
+@@ -739,8 +1268,6 @@ userdom_setattr_user_ttys(xserver_t)
 userdom_read_user_tmp_files(xserver_t)
 userdom_rw_user_tmpfs_files(xserver_t)
 
@ -32325,7 +32328,7 @@ index 8b403774f..fc04c66d5 100644
 ifndef(`distro_redhat',`
 	allow xserver_t self:process { execmem execheap execstack };
 	domain_mmap_low_uncond(xserver_t)
-@@ -785,17 +1310,54 @@ optional_policy(`
+@@ -785,17 +1312,54 @@ optional_policy(`
 ')
 
 optional_policy(`
@ -32382,7 +32385,7 @@ index 8b403774f..fc04c66d5 100644
 ')
 
 optional_policy(`
-@@ -803,6 +1365,10 @@ optional_policy(`
+@@ -803,6 +1367,10 @@ optional_policy(`
 ')
 
 optional_policy(`
@ -32393,7 +32396,7 @@ index 8b403774f..fc04c66d5 100644
 	xfs_stream_connect(xserver_t)
 ')
 
-@@ -818,18 +1384,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
+@@ -818,18 +1386,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
 
 # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open
 # handle of a file inside the dir!!!
@ -32418,7 +32421,7 @@ index 8b403774f..fc04c66d5 100644
 can_exec(xserver_t, xkb_var_lib_t)
 
 # VNC v4 module in X server
-@@ -842,26 +1407,21 @@ init_use_fds(xserver_t)
+@@ -842,26 +1409,21 @@ init_use_fds(xserver_t)
 # to read ROLE_home_t - examine this in more detail
 # (xauth?)
 userdom_read_user_home_content_files(xserver_t)
@ -32453,7 +32456,7 @@ index 8b403774f..fc04c66d5 100644
 ')
 
 optional_policy(`
-@@ -912,7 +1472,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
+@@ -912,7 +1474,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
 allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show };
 # operations allowed on my windows
 allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@ -32462,7 +32465,7 @@ index 8b403774f..fc04c66d5 100644
 # operations allowed on all windows
 allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child };
 
-@@ -966,11 +1526,31 @@ allow x_domain self:x_resource { read write };
+@@ -966,11 +1528,31 @@ allow x_domain self:x_resource { read write };
 # can mess with the screensaver
 allow x_domain xserver_t:x_screen { getattr saver_getattr };
 
@ -32494,7 +32497,7 @@ index 8b403774f..fc04c66d5 100644
 tunable_policy(`! xserver_object_manager',`
 	# should be xserver_unconfined(x_domain),
 	# but typeattribute doesnt work in conditionals
-@@ -992,18 +1572,148 @@ tunable_policy(`! xserver_object_manager',`
+@@ -992,18 +1574,148 @@ tunable_policy(`! xserver_object_manager',`
 	allow x_domain xevent_type:{ x_event x_synthetic_event } *;
 ')
 
@ -41166,7 +41169,7 @@ index 4e9488463..e7d5f42a5 100644
 +')
 +
 diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 59b04c1a2..483fb780e 100644
+index 59b04c1a2..370f8a825 100644
 --- a/policy/modules/system/logging.te
 +++ b/policy/modules/system/logging.te
@@ -4,6 +4,29 @@ policy_module(logging, 1.20.1)
@ -41269,9 +41272,12 @@ index 59b04c1a2..483fb780e 100644
 
 init_dontaudit_use_fds(auditctl_t)
 
-@@ -136,9 +175,10 @@ allow auditd_t self:tcp_socket create_stream_socket_perms;
+@@ -134,11 +173,12 @@ allow auditd_t self:fifo_file rw_fifo_file_perms;
+ allow auditd_t self:tcp_socket create_stream_socket_perms;
+ 
 allow auditd_t auditd_etc_t:dir list_dir_perms;
- allow auditd_t auditd_etc_t:file read_file_perms;
+-allow auditd_t auditd_etc_t:file read_file_perms;
+allow auditd_t auditd_etc_t:file { read_file_perms map };
 
 +manage_dirs_pattern(auditd_t, auditd_log_t, auditd_log_t)
 manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
@ -47157,10 +47163,10 @@ index 000000000..121b42208
 +/var/run/initramfs(/.*)?	<<none>>
 diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
 new file mode 100644
-index 000000000..278a1f69b
+index 000000000..634d9596a
 --- /dev/null
 +++ b/policy/modules/system/systemd.if
-@@ -0,0 +1,1843 @@
+@@ -0,0 +1,1862 @@
 +## <summary>SELinux policy for systemd components</summary>
 +
 +######################################
@ -48944,6 +48950,25 @@ index 000000000..278a1f69b
 +
 +########################################
 +## <summary>
+##	Allow process to mmap hwdb config file.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`systemd_hwdb_mmap_config',`
+	gen_require(`
+		type systemd_hwdb_etc_t;
+	')
+
+	allow $1 systemd_hwdb_etc_t:file map;
+')
+
+########################################
+## <summary>
 +##	Allow process to manage hwdb config file.
 +## </summary>
 +## <param name="domain">
@ -57067,15 +57092,22 @@ index f4ac38dc7..1589d6065 100644
 +	ssh_signal(confined_admindomain)
 +')
 diff --git a/policy/policy_capabilities b/policy/policy_capabilities
-index db3cbca45..710bd7cd2 100644
+index db3cbca45..0728639e8 100644
 --- a/policy/policy_capabilities
 +++ b/policy/policy_capabilities
-@@ -31,3 +31,14 @@ policycap network_peer_controls;
+@@ -31,3 +31,21 @@ policycap network_peer_controls;
 # blk_file: open
 #
 policycap open_perms;
 +
 +
+# Enable fine-grained labeling of cgroup and cgroup2 filesystems.
+# Requires Linux v4.11 and later.
+#
+# Added checks:
+# (none)
+#policycap cgroup_seclabel;
+
 +# Enable NoNewPrivileges support.  Requires libsepol 2.7+
 +# and kernel 4.14 (estimated).
 +#
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@ -21269,7 +21269,7 @@ index 3023be7f6..5afde8039 100644
 +	files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups")
 ')
 diff --git a/cups.te b/cups.te
-index c91813ccb..8c014f781 100644
+index c91813ccb..e0ba2f7d9 100644
 --- a/cups.te
 +++ b/cups.te
@@ -5,19 +5,31 @@ policy_module(cups, 1.16.2)
@ -21546,7 +21546,7 @@ index c91813ccb..8c014f781 100644
 
 selinux_compute_access_vector(cupsd_t)
 selinux_validate_context(cupsd_t)
-@@ -244,22 +289,28 @@ auth_dontaudit_read_pam_pid(cupsd_t)
+@@ -244,22 +289,29 @@ auth_dontaudit_read_pam_pid(cupsd_t)
 auth_rw_faillog(cupsd_t)
 auth_use_nsswitch(cupsd_t)
 
@ -21554,6 +21554,7 @@ index c91813ccb..8c014f781 100644
 libs_exec_lib_files(cupsd_t)
 +libs_exec_ldconfig(cupsd_t)
 +libs_exec_ld_so(cupsd_t)
+libs_use_ld_so(cupsd_t)
 
 logging_send_audit_msgs(cupsd_t)
 logging_send_syslog_msg(cupsd_t)
@ -21580,7 +21581,7 @@ index c91813ccb..8c014f781 100644
 
 optional_policy(`
 	apm_domtrans_client(cupsd_t)
-@@ -272,6 +323,8 @@ optional_policy(`
+@@ -272,6 +324,8 @@ optional_policy(`
 optional_policy(`
 	dbus_system_bus_client(cupsd_t)
 
@ -21589,7 +21590,7 @@ index c91813ccb..8c014f781 100644
 	userdom_dbus_send_all_users(cupsd_t)
 
 	optional_policy(`
-@@ -279,11 +332,17 @@ optional_policy(`
+@@ -279,11 +333,17 @@ optional_policy(`
 	')
 
 	optional_policy(`
@ -21607,7 +21608,7 @@ index c91813ccb..8c014f781 100644
 	')
 ')
 
-@@ -296,8 +355,8 @@ optional_policy(`
+@@ -296,8 +356,8 @@ optional_policy(`
 ')
 
 optional_policy(`
@ -21617,7 +21618,7 @@ index c91813ccb..8c014f781 100644
 ')
 
 optional_policy(`
-@@ -306,7 +365,6 @@ optional_policy(`
+@@ -306,7 +366,6 @@ optional_policy(`
 
 optional_policy(`
 	lpd_exec_lpr(cupsd_t)
@ -21625,7 +21626,7 @@ index c91813ccb..8c014f781 100644
 	lpd_read_config(cupsd_t)
 	lpd_relabel_spool(cupsd_t)
 ')
-@@ -316,6 +374,10 @@ optional_policy(`
+@@ -316,6 +375,10 @@ optional_policy(`
 ')
 
 optional_policy(`
@ -21636,7 +21637,7 @@ index c91813ccb..8c014f781 100644
 	samba_read_config(cupsd_t)
 	samba_rw_var_files(cupsd_t)
 	samba_stream_connect_nmbd(cupsd_t)
-@@ -326,7 +388,7 @@ optional_policy(`
+@@ -326,7 +389,7 @@ optional_policy(`
 ')
 
 optional_policy(`
@ -21645,7 +21646,7 @@ index c91813ccb..8c014f781 100644
 ')
 
 optional_policy(`
-@@ -334,7 +396,11 @@ optional_policy(`
+@@ -334,7 +397,11 @@ optional_policy(`
 ')
 
 optional_policy(`
@ -21658,7 +21659,7 @@ index c91813ccb..8c014f781 100644
 ')
 
 ########################################
-@@ -342,12 +408,11 @@ optional_policy(`
+@@ -342,12 +409,11 @@ optional_policy(`
 # Configuration daemon local policy
 #
 
@ -21674,7 +21675,7 @@ index c91813ccb..8c014f781 100644
 allow cupsd_config_t cupsd_t:process signal;
 ps_process_pattern(cupsd_config_t, cupsd_t)
 
-@@ -367,23 +432,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
+@@ -367,23 +433,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
 files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir })
 
 allow cupsd_config_t cupsd_var_run_t:file read_file_perms;
@ -21702,7 +21703,7 @@ index c91813ccb..8c014f781 100644
 corenet_all_recvfrom_netlabel(cupsd_config_t)
 corenet_tcp_sendrecv_generic_if(cupsd_config_t)
 corenet_tcp_sendrecv_generic_node(cupsd_config_t)
-@@ -392,20 +457,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
+@@ -392,20 +458,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
 corenet_sendrecv_all_client_packets(cupsd_config_t)
 corenet_tcp_connect_all_ports(cupsd_config_t)
 
@ -21723,7 +21724,7 @@ index c91813ccb..8c014f781 100644
 fs_search_auto_mountpoints(cupsd_config_t)
 
 domain_use_interactive_fds(cupsd_config_t)
-@@ -417,11 +474,6 @@ auth_use_nsswitch(cupsd_config_t)
+@@ -417,11 +475,6 @@ auth_use_nsswitch(cupsd_config_t)
 
 logging_send_syslog_msg(cupsd_config_t)
 
@ -21735,7 +21736,7 @@ index c91813ccb..8c014f781 100644
 userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
 userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
 userdom_read_all_users_state(cupsd_config_t)
-@@ -449,9 +501,12 @@ optional_policy(`
+@@ -449,9 +502,12 @@ optional_policy(`
 ')
 
 optional_policy(`
@ -21749,7 +21750,7 @@ index c91813ccb..8c014f781 100644
 ')
 
 optional_policy(`
-@@ -467,6 +522,10 @@ optional_policy(`
+@@ -467,6 +523,10 @@ optional_policy(`
 ')
 
 optional_policy(`
@ -21760,7 +21761,7 @@ index c91813ccb..8c014f781 100644
 	rpm_read_db(cupsd_config_t)
 ')
 
-@@ -487,10 +546,6 @@ optional_policy(`
+@@ -487,10 +547,6 @@ optional_policy(`
 # Lpd local policy
 #
 
@ -21771,7 +21772,7 @@ index c91813ccb..8c014f781 100644
 allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
 
 allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms;
-@@ -508,15 +563,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
+@@ -508,15 +564,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
 
 kernel_read_kernel_sysctls(cupsd_lpd_t)
 kernel_read_system_state(cupsd_lpd_t)
@ -21789,7 +21790,7 @@ index c91813ccb..8c014f781 100644
 corenet_tcp_sendrecv_ipp_port(cupsd_lpd_t)
 
 corenet_sendrecv_printer_server_packets(cupsd_lpd_t)
-@@ -537,9 +592,6 @@ auth_use_nsswitch(cupsd_lpd_t)
+@@ -537,9 +593,6 @@ auth_use_nsswitch(cupsd_lpd_t)
 
 logging_send_syslog_msg(cupsd_lpd_t)
 
@ -21799,7 +21800,7 @@ index c91813ccb..8c014f781 100644
 optional_policy(`
 	inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t)
 ')
-@@ -549,9 +601,9 @@ optional_policy(`
+@@ -549,9 +602,9 @@ optional_policy(`
 # Pdf local policy
 #
 
@ -21811,7 +21812,7 @@ index c91813ccb..8c014f781 100644
 
 append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
 create_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
-@@ -566,148 +618,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
+@@ -566,148 +619,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
 
 kernel_read_system_state(cups_pdf_t)
 
@ -21963,7 +21964,7 @@ index c91813ccb..8c014f781 100644
 
 ########################################
 #
-@@ -735,7 +662,6 @@ kernel_read_kernel_sysctls(ptal_t)
+@@ -735,7 +663,6 @@ kernel_read_kernel_sysctls(ptal_t)
 kernel_list_proc(ptal_t)
 kernel_read_proc_symlinks(ptal_t)
 
@ -21971,7 +21972,7 @@ index c91813ccb..8c014f781 100644
 corenet_all_recvfrom_netlabel(ptal_t)
 corenet_tcp_sendrecv_generic_if(ptal_t)
 corenet_tcp_sendrecv_generic_node(ptal_t)
-@@ -745,13 +671,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
+@@ -745,13 +672,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
 corenet_tcp_bind_ptal_port(ptal_t)
 corenet_tcp_sendrecv_ptal_port(ptal_t)
 
@ -21985,7 +21986,7 @@ index c91813ccb..8c014f781 100644
 files_read_etc_runtime_files(ptal_t)
 
 fs_getattr_all_fs(ptal_t)
-@@ -759,8 +683,6 @@ fs_search_auto_mountpoints(ptal_t)
+@@ -759,8 +684,6 @@ fs_search_auto_mountpoints(ptal_t)
 
 logging_send_syslog_msg(ptal_t)
 
@ -21994,7 +21995,7 @@ index c91813ccb..8c014f781 100644
 sysnet_read_config(ptal_t)
 
 userdom_dontaudit_use_unpriv_user_fds(ptal_t)
-@@ -773,3 +695,4 @@ optional_policy(`
+@@ -773,3 +696,4 @@ optional_policy(`
 optional_policy(`
 	udev_read_db(ptal_t)
 ')
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 276%{?dist}
+Release: 277%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@ -681,6 +681,13 @@ exit 0
 %endif

 %changelog
+* Mon Aug 28 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-277
+- Allow cupsd_t to execute ld_so_cache
+- Add cgroup_seclabel policycap.
+- Allow xdm_t to read systemd hwdb
+- Add new interface systemd_hwdb_mmap_config()
+- Allow auditd_t domain to mmap conf files labeled as auditd_etc_t BZ(1485050)
+
 * Sat Aug 26 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-276
 - Allow couple map rules