rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Mon Aug 28 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-277 

- Allow cupsd_t to execute ld_so_cache
- Add cgroup_seclabel policycap.
- Allow xdm_t to read systemd hwdb
- Add new interface systemd_hwdb_mmap_config()
- Allow auditd_t domain to mmap conf files labeled as auditd_etc_t BZ(1485050)
This commit is contained in:
Lukas Vrabec 2017-08-28 18:08:50 +02:00
parent 2b14b695c4
commit 0c6eef95d3
4 changed files with 101 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
container-selinux.tgz
View File

Binary file not shown.

104
policy-rawhide-base.patch
View File

@ -31132,7 +31132,7 @@ index 6bf0ecc2d..29db5fd25 100644
+') +')
+ +
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index 8b403774f..fc04c66d5 100644 index 8b403774f..a03fa4661 100644
--- a/policy/modules/services/xserver.te --- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te
@@ -26,28 +26,66 @@ gen_require(` @@ -26,28 +26,66 @@ gen_require(`
@ -31733,7 +31733,7 @@ index 8b403774f..fc04c66d5 100644
storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_read_fixed_disk(xdm_t)
storage_dontaudit_write_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t)
@@ -442,28 +650,48 @@ storage_dontaudit_raw_read_removable_device(xdm_t) @@ -442,28 +650,50 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_raw_write_removable_device(xdm_t)
storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t)
storage_dontaudit_rw_scsi_generic(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t)
@ -31773,20 +31773,23 @@ index 8b403774f..fc04c66d5 100644
-miscfiles_read_localization(xdm_t) -miscfiles_read_localization(xdm_t)
+miscfiles_search_man_pages(xdm_t) +miscfiles_search_man_pages(xdm_t)
miscfiles_read_fonts(xdm_t) miscfiles_read_fonts(xdm_t)
-
-sysnet_read_config(xdm_t)
+miscfiles_manage_fonts_cache(xdm_t) +miscfiles_manage_fonts_cache(xdm_t)
+miscfiles_manage_localization(xdm_t) +miscfiles_manage_localization(xdm_t)
+miscfiles_read_hwdata(xdm_t) +miscfiles_read_hwdata(xdm_t)
+
-sysnet_read_config(xdm_t)
+systemd_write_inhibit_pipes(xdm_t) +systemd_write_inhibit_pipes(xdm_t)
+systemd_dbus_chat_localed(xdm_t) +systemd_dbus_chat_localed(xdm_t)
+systemd_dbus_chat_hostnamed(xdm_t) +systemd_dbus_chat_hostnamed(xdm_t)
+systemd_start_power_services(xdm_t) +systemd_start_power_services(xdm_t)
+systemd_status_power_services(xdm_t) +systemd_status_power_services(xdm_t)
+systemd_hwdb_mmap_config(xdm_t)
+systemd_hwdb_read_config(xdm_t)
userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t) userdom_create_all_users_keys(xdm_t)
@@ -472,24 +700,167 @@ userdom_read_user_home_content_files(xdm_t) @@ -472,24 +702,167 @@ userdom_read_user_home_content_files(xdm_t)
# Search /proc for any user domain processes. # Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t) userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t) userdom_signal_all_users(xdm_t)
@ -31960,7 +31963,7 @@ index 8b403774f..fc04c66d5 100644
tunable_policy(`xdm_sysadm_login',` tunable_policy(`xdm_sysadm_login',`
userdom_xsession_spec_domtrans_all_users(xdm_t) userdom_xsession_spec_domtrans_all_users(xdm_t)
# FIXME: # FIXME:
@@ -502,12 +873,31 @@ tunable_policy(`xdm_sysadm_login',` @@ -502,12 +875,31 @@ tunable_policy(`xdm_sysadm_login',`
# allow xserver_t xdm_tmpfs_t:file rw_file_perms; # allow xserver_t xdm_tmpfs_t:file rw_file_perms;
') ')
@ -31992,7 +31995,7 @@ index 8b403774f..fc04c66d5 100644
') ')
optional_policy(` optional_policy(`
@@ -518,8 +908,36 @@ optional_policy(` @@ -518,8 +910,36 @@ optional_policy(`
dbus_system_bus_client(xdm_t) dbus_system_bus_client(xdm_t)
dbus_connect_system_bus(xdm_t) dbus_connect_system_bus(xdm_t)
@ -32016,12 +32019,12 @@ index 8b403774f..fc04c66d5 100644
+ devicekit_dbus_chat_power(xdm_t) + devicekit_dbus_chat_power(xdm_t)
+ ') + ')
+ +
optional_policy(` + optional_policy(`
- accountsd_dbus_chat(xdm_t)
+ hal_dbus_chat(xdm_t) + hal_dbus_chat(xdm_t)
+ ') + ')
+ +
+ optional_policy(` optional_policy(`
- accountsd_dbus_chat(xdm_t)
+ gnomeclock_dbus_chat(xdm_t) + gnomeclock_dbus_chat(xdm_t)
+ ') + ')
+ +
@ -32030,7 +32033,7 @@ index 8b403774f..fc04c66d5 100644
') ')
') ')
@@ -530,6 +948,20 @@ optional_policy(` @@ -530,6 +950,20 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -32051,7 +32054,7 @@ index 8b403774f..fc04c66d5 100644
hostname_exec(xdm_t) hostname_exec(xdm_t)
') ')
@@ -547,28 +979,78 @@ optional_policy(` @@ -547,28 +981,78 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -32139,7 +32142,7 @@ index 8b403774f..fc04c66d5 100644
') ')
optional_policy(` optional_policy(`
@@ -580,6 +1062,14 @@ optional_policy(` @@ -580,6 +1064,14 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -32154,7 +32157,7 @@ index 8b403774f..fc04c66d5 100644
xfs_stream_connect(xdm_t) xfs_stream_connect(xdm_t)
') ')
@@ -594,7 +1084,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t; @@ -594,7 +1086,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t; type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t;
allow xserver_t { root_xdrawable_t x_domain }:x_drawable send; allow xserver_t { root_xdrawable_t x_domain }:x_drawable send;
@ -32163,7 +32166,7 @@ index 8b403774f..fc04c66d5 100644
# setuid/setgid for the wrapper program to change UID # setuid/setgid for the wrapper program to change UID
# sys_rawio is for iopl access - should not be needed for frame-buffer # sys_rawio is for iopl access - should not be needed for frame-buffer
@@ -604,8 +1094,11 @@ allow xserver_t input_xevent_t:x_event send; @@ -604,8 +1096,11 @@ allow xserver_t input_xevent_t:x_event send;
# execheap needed until the X module loader is fixed. # execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack # NVIDIA Needs execstack
@ -32176,7 +32179,7 @@ index 8b403774f..fc04c66d5 100644
allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow xserver_t self:fd use; allow xserver_t self:fd use;
allow xserver_t self:fifo_file rw_fifo_file_perms; allow xserver_t self:fifo_file rw_fifo_file_perms;
@@ -618,8 +1111,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; @@ -618,8 +1113,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms; allow xserver_t self:udp_socket create_socket_perms;
@ -32192,7 +32195,7 @@ index 8b403774f..fc04c66d5 100644
manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
@@ -627,6 +1127,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) @@ -627,6 +1129,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file) filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file)
@ -32203,7 +32206,7 @@ index 8b403774f..fc04c66d5 100644
manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
@@ -638,25 +1142,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) @@ -638,25 +1144,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t) files_search_var_lib(xserver_t)
@ -32245,7 +32248,7 @@ index 8b403774f..fc04c66d5 100644
corenet_all_recvfrom_netlabel(xserver_t) corenet_all_recvfrom_netlabel(xserver_t)
corenet_tcp_sendrecv_generic_if(xserver_t) corenet_tcp_sendrecv_generic_if(xserver_t)
corenet_udp_sendrecv_generic_if(xserver_t) corenet_udp_sendrecv_generic_if(xserver_t)
@@ -677,23 +1193,28 @@ dev_rw_apm_bios(xserver_t) @@ -677,23 +1195,28 @@ dev_rw_apm_bios(xserver_t)
dev_rw_agp(xserver_t) dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t) dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t) dev_manage_dri_dev(xserver_t)
@ -32277,7 +32280,7 @@ index 8b403774f..fc04c66d5 100644
# brought on by rhgb # brought on by rhgb
files_search_mnt(xserver_t) files_search_mnt(xserver_t)
@@ -705,6 +1226,14 @@ fs_search_nfs(xserver_t) @@ -705,6 +1228,14 @@ fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t) fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t) fs_search_ramfs(xserver_t)
@ -32292,7 +32295,7 @@ index 8b403774f..fc04c66d5 100644
mls_xwin_read_to_clearance(xserver_t) mls_xwin_read_to_clearance(xserver_t)
selinux_validate_context(xserver_t) selinux_validate_context(xserver_t)
@@ -718,20 +1247,18 @@ init_getpgid(xserver_t) @@ -718,20 +1249,18 @@ init_getpgid(xserver_t)
term_setattr_unallocated_ttys(xserver_t) term_setattr_unallocated_ttys(xserver_t)
term_use_unallocated_ttys(xserver_t) term_use_unallocated_ttys(xserver_t)
@ -32316,7 +32319,7 @@ index 8b403774f..fc04c66d5 100644
userdom_search_user_home_dirs(xserver_t) userdom_search_user_home_dirs(xserver_t)
userdom_use_user_ttys(xserver_t) userdom_use_user_ttys(xserver_t)
@@ -739,8 +1266,6 @@ userdom_setattr_user_ttys(xserver_t) @@ -739,8 +1268,6 @@ userdom_setattr_user_ttys(xserver_t)
userdom_read_user_tmp_files(xserver_t) userdom_read_user_tmp_files(xserver_t)
userdom_rw_user_tmpfs_files(xserver_t) userdom_rw_user_tmpfs_files(xserver_t)
@ -32325,7 +32328,7 @@ index 8b403774f..fc04c66d5 100644
ifndef(`distro_redhat',` ifndef(`distro_redhat',`
allow xserver_t self:process { execmem execheap execstack }; allow xserver_t self:process { execmem execheap execstack };
domain_mmap_low_uncond(xserver_t) domain_mmap_low_uncond(xserver_t)
@@ -785,17 +1310,54 @@ optional_policy(` @@ -785,17 +1312,54 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -32382,7 +32385,7 @@ index 8b403774f..fc04c66d5 100644
') ')
optional_policy(` optional_policy(`
@@ -803,6 +1365,10 @@ optional_policy(` @@ -803,6 +1367,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -32393,7 +32396,7 @@ index 8b403774f..fc04c66d5 100644
xfs_stream_connect(xserver_t) xfs_stream_connect(xserver_t)
') ')
@@ -818,18 +1384,17 @@ allow xserver_t xdm_t:shm rw_shm_perms; @@ -818,18 +1386,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
# NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open
# handle of a file inside the dir!!! # handle of a file inside the dir!!!
@ -32418,7 +32421,7 @@ index 8b403774f..fc04c66d5 100644
can_exec(xserver_t, xkb_var_lib_t) can_exec(xserver_t, xkb_var_lib_t)
# VNC v4 module in X server # VNC v4 module in X server
@@ -842,26 +1407,21 @@ init_use_fds(xserver_t) @@ -842,26 +1409,21 @@ init_use_fds(xserver_t)
# to read ROLE_home_t - examine this in more detail # to read ROLE_home_t - examine this in more detail
# (xauth?) # (xauth?)
userdom_read_user_home_content_files(xserver_t) userdom_read_user_home_content_files(xserver_t)
@ -32453,7 +32456,7 @@ index 8b403774f..fc04c66d5 100644
') ')
optional_policy(` optional_policy(`
@@ -912,7 +1472,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy @@ -912,7 +1474,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show }; allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show };
# operations allowed on my windows # operations allowed on my windows
allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@ -32462,7 +32465,7 @@ index 8b403774f..fc04c66d5 100644
# operations allowed on all windows # operations allowed on all windows
allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child }; allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child };
@@ -966,11 +1526,31 @@ allow x_domain self:x_resource { read write }; @@ -966,11 +1528,31 @@ allow x_domain self:x_resource { read write };
# can mess with the screensaver # can mess with the screensaver
allow x_domain xserver_t:x_screen { getattr saver_getattr }; allow x_domain xserver_t:x_screen { getattr saver_getattr };
@ -32494,7 +32497,7 @@ index 8b403774f..fc04c66d5 100644
tunable_policy(`! xserver_object_manager',` tunable_policy(`! xserver_object_manager',`
# should be xserver_unconfined(x_domain), # should be xserver_unconfined(x_domain),
# but typeattribute doesnt work in conditionals # but typeattribute doesnt work in conditionals
@@ -992,18 +1572,148 @@ tunable_policy(`! xserver_object_manager',` @@ -992,18 +1574,148 @@ tunable_policy(`! xserver_object_manager',`
allow x_domain xevent_type:{ x_event x_synthetic_event } *; allow x_domain xevent_type:{ x_event x_synthetic_event } *;
') ')
@ -41166,7 +41169,7 @@ index 4e9488463..e7d5f42a5 100644
+') +')
+ +
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 59b04c1a2..483fb780e 100644 index 59b04c1a2..370f8a825 100644
--- a/policy/modules/system/logging.te --- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te
@@ -4,6 +4,29 @@ policy_module(logging, 1.20.1) @@ -4,6 +4,29 @@ policy_module(logging, 1.20.1)
@ -41269,9 +41272,12 @@ index 59b04c1a2..483fb780e 100644
init_dontaudit_use_fds(auditctl_t) init_dontaudit_use_fds(auditctl_t)
@@ -136,9 +175,10 @@ allow auditd_t self:tcp_socket create_stream_socket_perms; @@ -134,11 +173,12 @@ allow auditd_t self:fifo_file rw_fifo_file_perms;
allow auditd_t self:tcp_socket create_stream_socket_perms;
allow auditd_t auditd_etc_t:dir list_dir_perms; allow auditd_t auditd_etc_t:dir list_dir_perms;
allow auditd_t auditd_etc_t:file read_file_perms; -allow auditd_t auditd_etc_t:file read_file_perms;
+allow auditd_t auditd_etc_t:file { read_file_perms map };
+manage_dirs_pattern(auditd_t, auditd_log_t, auditd_log_t) +manage_dirs_pattern(auditd_t, auditd_log_t, auditd_log_t)
manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t) manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
@ -47157,10 +47163,10 @@ index 000000000..121b42208
+/var/run/initramfs(/.*)? <<none>> +/var/run/initramfs(/.*)? <<none>>
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
new file mode 100644 new file mode 100644
index 000000000..278a1f69b index 000000000..634d9596a
--- /dev/null --- /dev/null
+++ b/policy/modules/system/systemd.if +++ b/policy/modules/system/systemd.if
@@ -0,0 +1,1843 @@ @@ -0,0 +1,1862 @@
+## <summary>SELinux policy for systemd components</summary> +## <summary>SELinux policy for systemd components</summary>
+ +
+###################################### +######################################
@ -48944,6 +48950,25 @@ index 000000000..278a1f69b
+ +
+######################################## +########################################
+## <summary> +## <summary>
+## Allow process to mmap hwdb config file.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`systemd_hwdb_mmap_config',`
+ gen_require(`
+ type systemd_hwdb_etc_t;
+ ')
+
+ allow $1 systemd_hwdb_etc_t:file map;
+')
+
+########################################
+## <summary>
+## Allow process to manage hwdb config file. +## Allow process to manage hwdb config file.
+## </summary> +## </summary>
+## <param name="domain"> +## <param name="domain">
@ -57067,15 +57092,22 @@ index f4ac38dc7..1589d6065 100644
+ ssh_signal(confined_admindomain) + ssh_signal(confined_admindomain)
+') +')
diff --git a/policy/policy_capabilities b/policy/policy_capabilities diff --git a/policy/policy_capabilities b/policy/policy_capabilities
index db3cbca45..710bd7cd2 100644 index db3cbca45..0728639e8 100644
--- a/policy/policy_capabilities --- a/policy/policy_capabilities
+++ b/policy/policy_capabilities +++ b/policy/policy_capabilities
@@ -31,3 +31,14 @@ policycap network_peer_controls; @@ -31,3 +31,21 @@ policycap network_peer_controls;
# blk_file: open # blk_file: open
# #
policycap open_perms; policycap open_perms;
+ +
+ +
+# Enable fine-grained labeling of cgroup and cgroup2 filesystems.
+# Requires Linux v4.11 and later.
+#
+# Added checks:
+# (none)
+#policycap cgroup_seclabel;
+
+# Enable NoNewPrivileges support. Requires libsepol 2.7+ +# Enable NoNewPrivileges support. Requires libsepol 2.7+
+# and kernel 4.14 (estimated). +# and kernel 4.14 (estimated).
+# +#

49
policy-rawhide-contrib.patch
View File

@ -21269,7 +21269,7 @@ index 3023be7f6..5afde8039 100644
+ files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups") + files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups")
') ')
diff --git a/cups.te b/cups.te diff --git a/cups.te b/cups.te
index c91813ccb..8c014f781 100644 index c91813ccb..e0ba2f7d9 100644
--- a/cups.te --- a/cups.te
+++ b/cups.te +++ b/cups.te
@@ -5,19 +5,31 @@ policy_module(cups, 1.16.2) @@ -5,19 +5,31 @@ policy_module(cups, 1.16.2)
@ -21546,7 +21546,7 @@ index c91813ccb..8c014f781 100644
selinux_compute_access_vector(cupsd_t) selinux_compute_access_vector(cupsd_t)
selinux_validate_context(cupsd_t) selinux_validate_context(cupsd_t)
@@ -244,22 +289,28 @@ auth_dontaudit_read_pam_pid(cupsd_t) @@ -244,22 +289,29 @@ auth_dontaudit_read_pam_pid(cupsd_t)
auth_rw_faillog(cupsd_t) auth_rw_faillog(cupsd_t)
auth_use_nsswitch(cupsd_t) auth_use_nsswitch(cupsd_t)
@ -21554,6 +21554,7 @@ index c91813ccb..8c014f781 100644
libs_exec_lib_files(cupsd_t) libs_exec_lib_files(cupsd_t)
+libs_exec_ldconfig(cupsd_t) +libs_exec_ldconfig(cupsd_t)
+libs_exec_ld_so(cupsd_t) +libs_exec_ld_so(cupsd_t)
+libs_use_ld_so(cupsd_t)
logging_send_audit_msgs(cupsd_t) logging_send_audit_msgs(cupsd_t)
logging_send_syslog_msg(cupsd_t) logging_send_syslog_msg(cupsd_t)
@ -21580,7 +21581,7 @@ index c91813ccb..8c014f781 100644
optional_policy(` optional_policy(`
apm_domtrans_client(cupsd_t) apm_domtrans_client(cupsd_t)
@@ -272,6 +323,8 @@ optional_policy(` @@ -272,6 +324,8 @@ optional_policy(`
optional_policy(` optional_policy(`
dbus_system_bus_client(cupsd_t) dbus_system_bus_client(cupsd_t)
@ -21589,7 +21590,7 @@ index c91813ccb..8c014f781 100644
userdom_dbus_send_all_users(cupsd_t) userdom_dbus_send_all_users(cupsd_t)
optional_policy(` optional_policy(`
@@ -279,11 +332,17 @@ optional_policy(` @@ -279,11 +333,17 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -21607,7 +21608,7 @@ index c91813ccb..8c014f781 100644
') ')
') ')
@@ -296,8 +355,8 @@ optional_policy(` @@ -296,8 +356,8 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -21617,7 +21618,7 @@ index c91813ccb..8c014f781 100644
') ')
optional_policy(` optional_policy(`
@@ -306,7 +365,6 @@ optional_policy(` @@ -306,7 +366,6 @@ optional_policy(`
optional_policy(` optional_policy(`
lpd_exec_lpr(cupsd_t) lpd_exec_lpr(cupsd_t)
@ -21625,7 +21626,7 @@ index c91813ccb..8c014f781 100644
lpd_read_config(cupsd_t) lpd_read_config(cupsd_t)
lpd_relabel_spool(cupsd_t) lpd_relabel_spool(cupsd_t)
') ')
@@ -316,6 +374,10 @@ optional_policy(` @@ -316,6 +375,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -21636,7 +21637,7 @@ index c91813ccb..8c014f781 100644
samba_read_config(cupsd_t) samba_read_config(cupsd_t)
samba_rw_var_files(cupsd_t) samba_rw_var_files(cupsd_t)
samba_stream_connect_nmbd(cupsd_t) samba_stream_connect_nmbd(cupsd_t)
@@ -326,7 +388,7 @@ optional_policy(` @@ -326,7 +389,7 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -21645,7 +21646,7 @@ index c91813ccb..8c014f781 100644
') ')
optional_policy(` optional_policy(`
@@ -334,7 +396,11 @@ optional_policy(` @@ -334,7 +397,11 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -21658,7 +21659,7 @@ index c91813ccb..8c014f781 100644
') ')
######################################## ########################################
@@ -342,12 +408,11 @@ optional_policy(` @@ -342,12 +409,11 @@ optional_policy(`
# Configuration daemon local policy # Configuration daemon local policy
# #
@ -21674,7 +21675,7 @@ index c91813ccb..8c014f781 100644
allow cupsd_config_t cupsd_t:process signal; allow cupsd_config_t cupsd_t:process signal;
ps_process_pattern(cupsd_config_t, cupsd_t) ps_process_pattern(cupsd_config_t, cupsd_t)
@@ -367,23 +432,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t) @@ -367,23 +433,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t)
files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir }) files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir })
allow cupsd_config_t cupsd_var_run_t:file read_file_perms; allow cupsd_config_t cupsd_var_run_t:file read_file_perms;
@ -21702,7 +21703,7 @@ index c91813ccb..8c014f781 100644
corenet_all_recvfrom_netlabel(cupsd_config_t) corenet_all_recvfrom_netlabel(cupsd_config_t)
corenet_tcp_sendrecv_generic_if(cupsd_config_t) corenet_tcp_sendrecv_generic_if(cupsd_config_t)
corenet_tcp_sendrecv_generic_node(cupsd_config_t) corenet_tcp_sendrecv_generic_node(cupsd_config_t)
@@ -392,20 +457,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t) @@ -392,20 +458,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
corenet_sendrecv_all_client_packets(cupsd_config_t) corenet_sendrecv_all_client_packets(cupsd_config_t)
corenet_tcp_connect_all_ports(cupsd_config_t) corenet_tcp_connect_all_ports(cupsd_config_t)
@ -21723,7 +21724,7 @@ index c91813ccb..8c014f781 100644
fs_search_auto_mountpoints(cupsd_config_t) fs_search_auto_mountpoints(cupsd_config_t)
domain_use_interactive_fds(cupsd_config_t) domain_use_interactive_fds(cupsd_config_t)
@@ -417,11 +474,6 @@ auth_use_nsswitch(cupsd_config_t) @@ -417,11 +475,6 @@ auth_use_nsswitch(cupsd_config_t)
logging_send_syslog_msg(cupsd_config_t) logging_send_syslog_msg(cupsd_config_t)
@ -21735,7 +21736,7 @@ index c91813ccb..8c014f781 100644
userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t) userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
userdom_dontaudit_search_user_home_dirs(cupsd_config_t) userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
userdom_read_all_users_state(cupsd_config_t) userdom_read_all_users_state(cupsd_config_t)
@@ -449,9 +501,12 @@ optional_policy(` @@ -449,9 +502,12 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -21749,7 +21750,7 @@ index c91813ccb..8c014f781 100644
') ')
optional_policy(` optional_policy(`
@@ -467,6 +522,10 @@ optional_policy(` @@ -467,6 +523,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -21760,7 +21761,7 @@ index c91813ccb..8c014f781 100644
rpm_read_db(cupsd_config_t) rpm_read_db(cupsd_config_t)
') ')
@@ -487,10 +546,6 @@ optional_policy(` @@ -487,10 +547,6 @@ optional_policy(`
# Lpd local policy # Lpd local policy
# #
@ -21771,7 +21772,7 @@ index c91813ccb..8c014f781 100644
allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms; allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms; allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms;
@@ -508,15 +563,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t) @@ -508,15 +564,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
kernel_read_kernel_sysctls(cupsd_lpd_t) kernel_read_kernel_sysctls(cupsd_lpd_t)
kernel_read_system_state(cupsd_lpd_t) kernel_read_system_state(cupsd_lpd_t)
@ -21789,7 +21790,7 @@ index c91813ccb..8c014f781 100644
corenet_tcp_sendrecv_ipp_port(cupsd_lpd_t) corenet_tcp_sendrecv_ipp_port(cupsd_lpd_t)
corenet_sendrecv_printer_server_packets(cupsd_lpd_t) corenet_sendrecv_printer_server_packets(cupsd_lpd_t)
@@ -537,9 +592,6 @@ auth_use_nsswitch(cupsd_lpd_t) @@ -537,9 +593,6 @@ auth_use_nsswitch(cupsd_lpd_t)
logging_send_syslog_msg(cupsd_lpd_t) logging_send_syslog_msg(cupsd_lpd_t)
@ -21799,7 +21800,7 @@ index c91813ccb..8c014f781 100644
optional_policy(` optional_policy(`
inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t) inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t)
') ')
@@ -549,9 +601,9 @@ optional_policy(` @@ -549,9 +602,9 @@ optional_policy(`
# Pdf local policy # Pdf local policy
# #
@ -21811,7 +21812,7 @@ index c91813ccb..8c014f781 100644
append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t) append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
create_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t) create_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
@@ -566,148 +618,23 @@ fs_search_auto_mountpoints(cups_pdf_t) @@ -566,148 +619,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
kernel_read_system_state(cups_pdf_t) kernel_read_system_state(cups_pdf_t)
@ -21963,7 +21964,7 @@ index c91813ccb..8c014f781 100644
######################################## ########################################
# #
@@ -735,7 +662,6 @@ kernel_read_kernel_sysctls(ptal_t) @@ -735,7 +663,6 @@ kernel_read_kernel_sysctls(ptal_t)
kernel_list_proc(ptal_t) kernel_list_proc(ptal_t)
kernel_read_proc_symlinks(ptal_t) kernel_read_proc_symlinks(ptal_t)
@ -21971,7 +21972,7 @@ index c91813ccb..8c014f781 100644
corenet_all_recvfrom_netlabel(ptal_t) corenet_all_recvfrom_netlabel(ptal_t)
corenet_tcp_sendrecv_generic_if(ptal_t) corenet_tcp_sendrecv_generic_if(ptal_t)
corenet_tcp_sendrecv_generic_node(ptal_t) corenet_tcp_sendrecv_generic_node(ptal_t)
@@ -745,13 +671,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t) @@ -745,13 +672,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
corenet_tcp_bind_ptal_port(ptal_t) corenet_tcp_bind_ptal_port(ptal_t)
corenet_tcp_sendrecv_ptal_port(ptal_t) corenet_tcp_sendrecv_ptal_port(ptal_t)
@ -21985,7 +21986,7 @@ index c91813ccb..8c014f781 100644
files_read_etc_runtime_files(ptal_t) files_read_etc_runtime_files(ptal_t)
fs_getattr_all_fs(ptal_t) fs_getattr_all_fs(ptal_t)
@@ -759,8 +683,6 @@ fs_search_auto_mountpoints(ptal_t) @@ -759,8 +684,6 @@ fs_search_auto_mountpoints(ptal_t)
logging_send_syslog_msg(ptal_t) logging_send_syslog_msg(ptal_t)
@ -21994,7 +21995,7 @@ index c91813ccb..8c014f781 100644
sysnet_read_config(ptal_t) sysnet_read_config(ptal_t)
userdom_dontaudit_use_unpriv_user_fds(ptal_t) userdom_dontaudit_use_unpriv_user_fds(ptal_t)
@@ -773,3 +695,4 @@ optional_policy(` @@ -773,3 +696,4 @@ optional_policy(`
optional_policy(` optional_policy(`
udev_read_db(ptal_t) udev_read_db(ptal_t)
') ')

9
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.13.1 Version: 3.13.1
Release: 276%{?dist} Release: 277%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -681,6 +681,13 @@ exit 0
%endif %endif
%changelog %changelog
* Mon Aug 28 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-277
- Allow cupsd_t to execute ld_so_cache
- Add cgroup_seclabel policycap.
- Allow xdm_t to read systemd hwdb
- Add new interface systemd_hwdb_mmap_config()
- Allow auditd_t domain to mmap conf files labeled as auditd_etc_t BZ(1485050)
* Sat Aug 26 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-276 * Sat Aug 26 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-276
- Allow couple map rules - Allow couple map rules