rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Tue Oct 17 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-296 

- Merge pull request #19 from RodrigoQuesadaDev/snapper-fix-1
- Allow httpd_t domain to mmap httpd_user_content_t files. BZ(1494852)
- Add nnp transition rule for services using NoNewPrivileges systemd feature
- Add map permission into dev_rw_infiniband_dev() interface to allow caller domain mmap infiniband chr device BZ(1500923)
- Add init_nnp_daemon_domain interface
- Allow nnp transition capability
- Merge pull request #204 from konradwilk/rhbz1484908
- Label postgresql-check-db-dir as postgresql_exec_t
This commit is contained in:
Lukas Vrabec 2017-10-17 15:29:08 +02:00
parent 67f96cfe2c
commit 107eb82b3e
4 changed files with 516 additions and 225 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
container-selinux.tgz
View File

Binary file not shown.

337
policy-rawhide-base.patch
View File

@ -6690,7 +6690,7 @@ index 3f6e16889..abd046c56 100644
+ifelse(`$2',`',`',`declare_ibendportcons($1_ibendport_t,shift($*))')dnl
+')
diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
index b31c05491..b15a7aa05 100644
index b31c05491..c3fd31813 100644
--- a/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@ -15,15 +15,18 @@
@ -6814,7 +6814,7 @@ index b31c05491..b15a7aa05 100644
/dev/card.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/cmx.* -c gen_context(system_u:object_r:smartcard_device_t,s0)
@@ -169,18 +200,26 @@ ifdef(`distro_suse', `
@@ -169,18 +200,27 @@ ifdef(`distro_suse', `
/dev/s(ou)?nd/.* -c gen_context(system_u:object_r:sound_device_t,s0)
@ -6838,10 +6838,11 @@ index b31c05491..b15a7aa05 100644
/dev/xen/gntdev -c gen_context(system_u:object_r:xen_device_t,s0)
/dev/xen/gntalloc -c gen_context(system_u:object_r:xen_device_t,s0)
+/dev/xen/privcmd -c gen_context(system_u:object_r:xen_device_t,s0)
+/dev/xen/xenbus -c gen_context(system_u:object_r:xen_device_t,s0)
ifdef(`distro_debian',`
# this is a static /dev dir "backup mount"
@@ -198,12 +237,27 @@ ifdef(`distro_debian',`
@@ -198,12 +238,27 @@ ifdef(`distro_debian',`
/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
@ -6872,7 +6873,7 @@ index b31c05491..b15a7aa05 100644
+/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
+/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index 76f285ea6..f0bb3da0c 100644
index 76f285ea6..1de2a51f0 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',`
@ -7440,7 +7441,7 @@ index 76f285ea6..f0bb3da0c 100644
## The name of the object being created.
## </summary>
## </param>
@@ -2017,6 +2277,180 @@ interface(`dev_rw_input_dev',`
@@ -2017,6 +2277,181 @@ interface(`dev_rw_input_dev',`
########################################
## <summary>
@ -7576,6 +7577,7 @@ index 76f285ea6..f0bb3da0c 100644
+
+ rw_chr_files_pattern($1, device_t, infiniband_device_t)
+ rw_blk_files_pattern($1, device_t, infiniband_device_t)
+ allow $1 infiniband_device_t:chr_file map;
+')
+
+########################################
@ -7621,7 +7623,7 @@ index 76f285ea6..f0bb3da0c 100644
## Get the attributes of the framebuffer device node.
## </summary>
## <param name="domain">
@@ -2402,7 +2836,7 @@ interface(`dev_filetrans_lirc',`
@@ -2402,7 +2837,7 @@ interface(`dev_filetrans_lirc',`
########################################
## <summary>
@ -7630,7 +7632,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -2410,17 +2844,17 @@ interface(`dev_filetrans_lirc',`
@@ -2410,17 +2845,17 @@ interface(`dev_filetrans_lirc',`
## </summary>
## </param>
#
@ -7652,7 +7654,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -2428,17 +2862,17 @@ interface(`dev_getattr_lvm_control',`
@@ -2428,17 +2863,17 @@ interface(`dev_getattr_lvm_control',`
## </summary>
## </param>
#
@ -7674,7 +7676,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -2446,17 +2880,17 @@ interface(`dev_read_lvm_control',`
@@ -2446,17 +2881,17 @@ interface(`dev_read_lvm_control',`
## </summary>
## </param>
#
@ -7696,7 +7698,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -2464,17 +2898,17 @@ interface(`dev_rw_lvm_control',`
@@ -2464,17 +2899,17 @@ interface(`dev_rw_lvm_control',`
## </summary>
## </param>
#
@ -7718,7 +7720,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -2482,35 +2916,35 @@ interface(`dev_dontaudit_rw_lvm_control',`
@@ -2482,35 +2917,35 @@ interface(`dev_dontaudit_rw_lvm_control',`
## </summary>
## </param>
#
@ -7763,7 +7765,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -2518,62 +2952,53 @@ interface(`dev_dontaudit_getattr_memory_dev',`
@@ -2518,62 +2953,53 @@ interface(`dev_dontaudit_getattr_memory_dev',`
## </summary>
## </param>
#
@ -7840,7 +7842,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -2581,32 +3006,168 @@ interface(`dev_write_raw_memory',`
@@ -2581,32 +3007,168 @@ interface(`dev_write_raw_memory',`
## </summary>
## </param>
#
@ -8018,7 +8020,7 @@ index 76f285ea6..f0bb3da0c 100644
')
########################################
@@ -2725,7 +3286,7 @@ interface(`dev_write_misc',`
@@ -2725,7 +3287,7 @@ interface(`dev_write_misc',`
## </summary>
## <param name="domain">
## <summary>
@ -8027,7 +8029,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## </param>
#
@@ -2811,6 +3372,78 @@ interface(`dev_rw_modem',`
@@ -2811,6 +3373,78 @@ interface(`dev_rw_modem',`
########################################
## <summary>
@ -8106,7 +8108,7 @@ index 76f285ea6..f0bb3da0c 100644
## Get the attributes of the mouse devices.
## </summary>
## <param name="domain">
@@ -2903,20 +3536,20 @@ interface(`dev_getattr_mtrr_dev',`
@@ -2903,20 +3537,20 @@ interface(`dev_getattr_mtrr_dev',`
########################################
## <summary>
@ -8131,7 +8133,7 @@ index 76f285ea6..f0bb3da0c 100644
## </p>
## </desc>
## <param name="domain">
@@ -2925,43 +3558,34 @@ interface(`dev_getattr_mtrr_dev',`
@@ -2925,43 +3559,34 @@ interface(`dev_getattr_mtrr_dev',`
## </summary>
## </param>
#
@ -8187,7 +8189,7 @@ index 76f285ea6..f0bb3da0c 100644
## range registers (MTRR).
## </summary>
## <param name="domain">
@@ -2970,13 +3594,32 @@ interface(`dev_write_mtrr',`
@@ -2970,13 +3595,32 @@ interface(`dev_write_mtrr',`
## </summary>
## </param>
#
@ -8223,7 +8225,7 @@ index 76f285ea6..f0bb3da0c 100644
')
########################################
@@ -3144,44 +3787,43 @@ interface(`dev_create_null_dev',`
@@ -3144,44 +3788,43 @@ interface(`dev_create_null_dev',`
########################################
## <summary>
@ -8279,7 +8281,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -3189,12 +3831,105 @@ interface(`dev_rw_nvram',`
@@ -3189,12 +3832,105 @@ interface(`dev_rw_nvram',`
## </summary>
## </param>
#
@ -8388,7 +8390,7 @@ index 76f285ea6..f0bb3da0c 100644
')
########################################
@@ -3254,7 +3989,25 @@ interface(`dev_rw_printer',`
@@ -3254,7 +3990,25 @@ interface(`dev_rw_printer',`
########################################
## <summary>
@ -8415,7 +8417,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -3262,12 +4015,13 @@ interface(`dev_rw_printer',`
@@ -3262,12 +4016,13 @@ interface(`dev_rw_printer',`
## </summary>
## </param>
#
@ -8432,7 +8434,7 @@ index 76f285ea6..f0bb3da0c 100644
')
########################################
@@ -3399,7 +4153,7 @@ interface(`dev_dontaudit_read_rand',`
@@ -3399,7 +4154,7 @@ interface(`dev_dontaudit_read_rand',`
########################################
## <summary>
@ -8441,7 +8443,7 @@ index 76f285ea6..f0bb3da0c 100644
## number generator devices (e.g., /dev/random)
## </summary>
## <param name="domain">
@@ -3413,7 +4167,7 @@ interface(`dev_dontaudit_append_rand',`
@@ -3413,7 +4168,7 @@ interface(`dev_dontaudit_append_rand',`
type random_device_t;
')
@ -8450,7 +8452,7 @@ index 76f285ea6..f0bb3da0c 100644
')
########################################
@@ -3633,6 +4387,7 @@ interface(`dev_read_sound',`
@@ -3633,6 +4388,7 @@ interface(`dev_read_sound',`
')
read_chr_files_pattern($1, device_t, sound_device_t)
@ -8458,7 +8460,7 @@ index 76f285ea6..f0bb3da0c 100644
')
########################################
@@ -3669,6 +4424,7 @@ interface(`dev_read_sound_mixer',`
@@ -3669,6 +4425,7 @@ interface(`dev_read_sound_mixer',`
')
read_chr_files_pattern($1, device_t, sound_device_t)
@ -8466,7 +8468,7 @@ index 76f285ea6..f0bb3da0c 100644
')
########################################
@@ -3855,7 +4611,7 @@ interface(`dev_getattr_sysfs_dirs',`
@@ -3855,7 +4612,7 @@ interface(`dev_getattr_sysfs_dirs',`
########################################
## <summary>
@ -8475,7 +8477,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -3863,91 +4619,89 @@ interface(`dev_getattr_sysfs_dirs',`
@@ -3863,91 +4620,89 @@ interface(`dev_getattr_sysfs_dirs',`
## </summary>
## </param>
#
@ -8586,7 +8588,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -3955,68 +4709,53 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
@@ -3955,68 +4710,53 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
## </summary>
## </param>
#
@ -8665,7 +8667,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4024,114 +4763,97 @@ interface(`dev_rw_sysfs',`
@@ -4024,114 +4764,97 @@ interface(`dev_rw_sysfs',`
## </summary>
## </param>
#
@ -8810,7 +8812,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4139,35 +4861,50 @@ interface(`dev_getattr_generic_usb_dev',`
@@ -4139,35 +4862,50 @@ interface(`dev_getattr_generic_usb_dev',`
## </summary>
## </param>
#
@ -8869,7 +8871,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4175,12 +4912,278 @@ interface(`dev_read_generic_usb_dev',`
@@ -4175,12 +4913,278 @@ interface(`dev_read_generic_usb_dev',`
## </summary>
## </param>
#
@ -9151,7 +9153,7 @@ index 76f285ea6..f0bb3da0c 100644
')
########################################
@@ -4249,33 +5252,462 @@ interface(`dev_write_usbmon_dev',`
@@ -4249,33 +5253,462 @@ interface(`dev_write_usbmon_dev',`
#
interface(`dev_mount_usbfs',`
gen_require(`
@ -9623,7 +9625,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4283,36 +5715,35 @@ interface(`dev_associate_usbfs',`
@@ -4283,36 +5716,35 @@ interface(`dev_associate_usbfs',`
## </summary>
## </param>
#
@ -9669,7 +9671,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4320,17 +5751,18 @@ interface(`dev_dontaudit_getattr_usbfs_dirs',`
@@ -4320,17 +5752,18 @@ interface(`dev_dontaudit_getattr_usbfs_dirs',`
## </summary>
## </param>
#
@ -9692,7 +9694,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4338,20 +5770,17 @@ interface(`dev_search_usbfs',`
@@ -4338,20 +5771,17 @@ interface(`dev_search_usbfs',`
## </summary>
## </param>
#
@ -9717,7 +9719,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4359,19 +5788,17 @@ interface(`dev_list_usbfs',`
@@ -4359,19 +5789,17 @@ interface(`dev_list_usbfs',`
## </summary>
## </param>
#
@ -9741,7 +9743,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4379,19 +5806,17 @@ interface(`dev_setattr_usbfs_files',`
@@ -4379,19 +5807,17 @@ interface(`dev_setattr_usbfs_files',`
## </summary>
## </param>
#
@ -9765,7 +9767,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4399,19 +5824,17 @@ interface(`dev_read_usbfs',`
@@ -4399,19 +5825,17 @@ interface(`dev_read_usbfs',`
## </summary>
## </param>
#
@ -9789,7 +9791,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4419,17 +5842,17 @@ interface(`dev_rw_usbfs',`
@@ -4419,17 +5843,18 @@ interface(`dev_rw_usbfs',`
## </summary>
## </param>
#
@ -9802,6 +9804,7 @@ index 76f285ea6..f0bb3da0c 100644
- getattr_chr_files_pattern($1, device_t, v4l_device_t)
+ rw_chr_files_pattern($1, device_t, xen_device_t)
+ allow $1 xen_device_t:chr_file map;
')
-######################################
@ -9812,7 +9815,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4437,36 +5860,41 @@ interface(`dev_getattr_video_dev',`
@@ -4437,36 +5862,41 @@ interface(`dev_getattr_video_dev',`
## </summary>
## </param>
#
@ -9864,7 +9867,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4474,36 +5902,35 @@ interface(`dev_dontaudit_getattr_video_dev',`
@@ -4474,36 +5904,35 @@ interface(`dev_dontaudit_getattr_video_dev',`
## </summary>
## </param>
#
@ -9910,7 +9913,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4511,35 +5938,36 @@ interface(`dev_dontaudit_setattr_video_dev',`
@@ -4511,35 +5940,36 @@ interface(`dev_dontaudit_setattr_video_dev',`
## </summary>
## </param>
#
@ -9956,7 +9959,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4547,17 +5975,19 @@ interface(`dev_write_video_dev',`
@@ -4547,17 +5977,19 @@ interface(`dev_write_video_dev',`
## </summary>
## </param>
#
@ -9980,7 +9983,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4565,17 +5995,17 @@ interface(`dev_rw_vhost',`
@@ -4565,17 +5997,17 @@ interface(`dev_rw_vhost',`
## </summary>
## </param>
#
@ -10002,7 +10005,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4583,18 +6013,18 @@ interface(`dev_rw_vmware',`
@@ -4583,18 +6015,18 @@ interface(`dev_rw_vmware',`
## </summary>
## </param>
#
@ -10026,7 +10029,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4602,17 +6032,18 @@ interface(`dev_rwx_vmware',`
@@ -4602,17 +6034,18 @@ interface(`dev_rwx_vmware',`
## </summary>
## </param>
#
@ -10049,7 +10052,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4620,17 +6051,17 @@ interface(`dev_read_watchdog',`
@@ -4620,17 +6053,17 @@ interface(`dev_read_watchdog',`
## </summary>
## </param>
#
@ -10071,7 +10074,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4638,35 +6069,36 @@ interface(`dev_write_watchdog',`
@@ -4638,35 +6071,36 @@ interface(`dev_write_watchdog',`
## </summary>
## </param>
#
@ -10117,7 +10120,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4674,41 +6106,35 @@ interface(`dev_rw_xen',`
@@ -4674,41 +6108,35 @@ interface(`dev_rw_xen',`
## </summary>
## </param>
#
@ -10167,7 +10170,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4716,17 +6142,17 @@ interface(`dev_filetrans_xen',`
@@ -4716,17 +6144,17 @@ interface(`dev_filetrans_xen',`
## </summary>
## </param>
#
@ -10189,7 +10192,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4734,17 +6160,18 @@ interface(`dev_getattr_xserver_misc_dev',`
@@ -4734,17 +6162,18 @@ interface(`dev_getattr_xserver_misc_dev',`
## </summary>
## </param>
#
@ -10212,7 +10215,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4752,17 +6179,17 @@ interface(`dev_setattr_xserver_misc_dev',`
@@ -4752,17 +6181,17 @@ interface(`dev_setattr_xserver_misc_dev',`
## </summary>
## </param>
#
@ -10234,7 +10237,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4770,17 +6197,17 @@ interface(`dev_rw_xserver_misc',`
@@ -4770,17 +6199,17 @@ interface(`dev_rw_xserver_misc',`
## </summary>
## </param>
#
@ -10256,7 +10259,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4788,18 +6215,17 @@ interface(`dev_rw_zero',`
@@ -4788,18 +6217,17 @@ interface(`dev_rw_zero',`
## </summary>
## </param>
#
@ -10279,7 +10282,7 @@ index 76f285ea6..f0bb3da0c 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4807,47 +6233,911 @@ interface(`dev_rwx_zero',`
@@ -4807,47 +6235,912 @@ interface(`dev_rwx_zero',`
## </summary>
## </param>
#
@ -11088,6 +11091,7 @@ index 76f285ea6..f0bb3da0c 100644
+ filetrans_pattern($1, device_t, xen_device_t, chr_file, "gntdev")
+ filetrans_pattern($1, device_t, xen_device_t, chr_file, "gntalloc")
+ filetrans_pattern($1, device_t, xen_device_t, chr_file, "privcmd")
+ filetrans_pattern($1, device_t, xen_device_t, chr_file, "xenbus")
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC0")
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC1")
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC2")
@ -27977,14 +27981,15 @@ index 6d77e81c5..74de33345 100644
+ ')
')
diff --git a/policy/modules/services/postgresql.fc b/policy/modules/services/postgresql.fc
index a26f84f40..f4a44ebc6 100644
index a26f84f40..225d6961d 100644
--- a/policy/modules/services/postgresql.fc
+++ b/policy/modules/services/postgresql.fc
@@ -10,11 +10,16 @@
@@ -10,11 +10,17 @@
#
/usr/bin/initdb(\.sepgsql)? -- gen_context(system_u:object_r:postgresql_exec_t,s0)
/usr/bin/(se)?postgres -- gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/bin/pg_ctl -- gen_context(system_u:object_r:postgresql_exec_t,s0)
+/usr/bin/postgresql-check-db-dir -- gen_context(system_u:object_r:postgresql_exec_t,s0)
+
+/usr/libexec/postgresql-ctl -- gen_context(system_u:object_r:postgresql_exec_t,s0)
@ -27997,7 +28002,7 @@ index a26f84f40..f4a44ebc6 100644
ifdef(`distro_debian', `
/usr/lib/postgresql/.*/bin/.* -- gen_context(system_u:object_r:postgresql_exec_t,s0)
')
@@ -28,9 +33,10 @@ ifdef(`distro_redhat', `
@@ -28,9 +34,10 @@ ifdef(`distro_redhat', `
#
/var/lib/postgres(ql)?(/.*)? gen_context(system_u:object_r:postgresql_db_t,s0)
@ -28010,7 +28015,7 @@ index a26f84f40..f4a44ebc6 100644
/var/lib/sepgsql(/.*)? gen_context(system_u:object_r:postgresql_db_t,s0)
/var/lib/sepgsql/pgstartup\.log -- gen_context(system_u:object_r:postgresql_log_t,s0)
@@ -45,4 +51,4 @@ ifdef(`distro_redhat', `
@@ -45,4 +52,4 @@ ifdef(`distro_redhat', `
/var/run/postgresql(/.*)? gen_context(system_u:object_r:postgresql_var_run_t,s0)
@ -36073,7 +36078,7 @@ index bc0ffc84e..37b8ea5ec 100644
')
+/var/run/systemd(/.*)? gen_context(system_u:object_r:init_var_run_t,s0)
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 79a45f62e..6ed0c399a 100644
index 79a45f62e..b25993d41 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -1,5 +1,21 @@
@ -36110,7 +36115,33 @@ index 79a45f62e..6ed0c399a 100644
ifdef(`hide_broken_symptoms',`
# RHEL4 systems seem to have a stray
# fds open from the initrd
@@ -192,50 +212,43 @@ interface(`init_ranged_domain',`
@@ -115,6 +135,25 @@ interface(`init_domain',`
')
')
')
+########################################
+## <summary>
+## Allow SELinux Domain trasition from sytemd
+## into confined domain with NoNewPrivileges
+## Systemd Security feature.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`init_nnp_daemon_domain',`
+ gen_require(`
+ type init_t;
+ ')
+
+ allow init_t $1:process2 { nnp_transition nosuid_transition };
+')
########################################
## <summary>
@@ -192,50 +231,43 @@ interface(`init_ranged_domain',`
interface(`init_daemon_domain',`
gen_require(`
attribute direct_run_init, direct_init, direct_init_entry;
@ -36183,7 +36214,7 @@ index 79a45f62e..6ed0c399a 100644
')
########################################
@@ -283,17 +296,20 @@ interface(`init_daemon_domain',`
@@ -283,17 +315,20 @@ interface(`init_daemon_domain',`
interface(`init_ranged_daemon_domain',`
gen_require(`
type initrc_t;
@ -36205,7 +36236,7 @@ index 79a45f62e..6ed0c399a 100644
')
')
@@ -336,23 +352,19 @@ interface(`init_ranged_daemon_domain',`
@@ -336,23 +371,19 @@ interface(`init_ranged_daemon_domain',`
#
interface(`init_system_domain',`
gen_require(`
@ -36236,7 +36267,7 @@ index 79a45f62e..6ed0c399a 100644
')
########################################
@@ -401,20 +413,41 @@ interface(`init_system_domain',`
@@ -401,20 +432,41 @@ interface(`init_system_domain',`
interface(`init_ranged_system_domain',`
gen_require(`
type initrc_t;
@ -36278,7 +36309,7 @@ index 79a45f62e..6ed0c399a 100644
########################################
## <summary>
## Mark the file type as a daemon run dir, allowing initrc_t
@@ -460,6 +493,25 @@ interface(`init_domtrans',`
@@ -460,6 +512,25 @@ interface(`init_domtrans',`
domtrans_pattern($1, init_exec_t, init_t)
')
@ -36304,7 +36335,7 @@ index 79a45f62e..6ed0c399a 100644
########################################
## <summary>
## Execute the init program in the caller domain.
@@ -469,7 +521,6 @@ interface(`init_domtrans',`
@@ -469,7 +540,6 @@ interface(`init_domtrans',`
## Domain allowed access.
## </summary>
## </param>
@ -36312,7 +36343,7 @@ index 79a45f62e..6ed0c399a 100644
#
interface(`init_exec',`
gen_require(`
@@ -478,6 +529,48 @@ interface(`init_exec',`
@@ -478,6 +548,48 @@ interface(`init_exec',`
corecmd_search_bin($1)
can_exec($1, init_exec_t)
@ -36361,7 +36392,7 @@ index 79a45f62e..6ed0c399a 100644
')
########################################
@@ -566,6 +659,58 @@ interface(`init_sigchld',`
@@ -566,6 +678,58 @@ interface(`init_sigchld',`
########################################
## <summary>
@ -36420,7 +36451,7 @@ index 79a45f62e..6ed0c399a 100644
## Connect to init with a unix socket.
## </summary>
## <param name="domain">
@@ -576,12 +721,87 @@ interface(`init_sigchld',`
@@ -576,12 +740,87 @@ interface(`init_sigchld',`
#
interface(`init_stream_connect',`
gen_require(`
@ -36508,7 +36539,7 @@ index 79a45f62e..6ed0c399a 100644
########################################
## <summary>
## Inherit and use file descriptors from init.
@@ -743,22 +963,24 @@ interface(`init_write_initctl',`
@@ -743,22 +982,24 @@ interface(`init_write_initctl',`
interface(`init_telinit',`
gen_require(`
type initctl_t;
@ -36542,7 +36573,7 @@ index 79a45f62e..6ed0c399a 100644
')
########################################
@@ -787,7 +1009,7 @@ interface(`init_rw_initctl',`
@@ -787,7 +1028,7 @@ interface(`init_rw_initctl',`
## </summary>
## <param name="domain">
## <summary>
@ -36551,7 +36582,7 @@ index 79a45f62e..6ed0c399a 100644
## </summary>
## </param>
#
@@ -830,11 +1052,12 @@ interface(`init_script_file_entry_type',`
@@ -830,11 +1071,12 @@ interface(`init_script_file_entry_type',`
#
interface(`init_spec_domtrans_script',`
gen_require(`
@ -36566,7 +36597,7 @@ index 79a45f62e..6ed0c399a 100644
ifdef(`distro_gentoo',`
gen_require(`
@@ -845,11 +1068,11 @@ interface(`init_spec_domtrans_script',`
@@ -845,11 +1087,11 @@ interface(`init_spec_domtrans_script',`
')
ifdef(`enable_mcs',`
@ -36580,7 +36611,7 @@ index 79a45f62e..6ed0c399a 100644
')
')
@@ -865,19 +1088,41 @@ interface(`init_spec_domtrans_script',`
@@ -865,23 +1107,45 @@ interface(`init_spec_domtrans_script',`
#
interface(`init_domtrans_script',`
gen_require(`
@ -36603,11 +36634,11 @@ index 79a45f62e..6ed0c399a 100644
ifdef(`enable_mls',`
- range_transition $1 initrc_exec_t:process s0 - mls_systemhigh;
+ range_transition $1 init_script_file_type:process s0 - mls_systemhigh;
+ ')
+')
+
+########################################
+## <summary>
')
')
########################################
## <summary>
+## Execute a file in a bin directory
+## in the initrc_t domain
+## </summary>
@ -36620,13 +36651,17 @@ index 79a45f62e..6ed0c399a 100644
+interface(`init_bin_domtrans_spec',`
+ gen_require(`
+ type initrc_t;
')
+ ')
+
+ corecmd_bin_domtrans($1, initrc_t)
')
########################################
@@ -933,9 +1178,14 @@ interface(`init_script_file_domtrans',`
+')
+
+########################################
+## <summary>
## Execute a init script in a specified domain.
## </summary>
## <desc>
@@ -933,9 +1197,14 @@ interface(`init_script_file_domtrans',`
interface(`init_labeled_script_domtrans',`
gen_require(`
type initrc_t;
@ -36641,7 +36676,7 @@ index 79a45f62e..6ed0c399a 100644
files_search_etc($1)
')
@@ -992,7 +1242,7 @@ interface(`init_run_daemon',`
@@ -992,7 +1261,7 @@ interface(`init_run_daemon',`
########################################
## <summary>
@ -36650,7 +36685,7 @@ index 79a45f62e..6ed0c399a 100644
## </summary>
## <param name="domain">
## <summary>
@@ -1000,38 +1250,37 @@ interface(`init_run_daemon',`
@@ -1000,38 +1269,37 @@ interface(`init_run_daemon',`
## </summary>
## </param>
#
@ -36698,7 +36733,7 @@ index 79a45f62e..6ed0c399a 100644
## </summary>
## <param name="domain">
## <summary>
@@ -1039,17 +1288,19 @@ interface(`init_ptrace',`
@@ -1039,17 +1307,19 @@ interface(`init_ptrace',`
## </summary>
## </param>
#
@ -36722,7 +36757,7 @@ index 79a45f62e..6ed0c399a 100644
## </summary>
## <param name="domain">
## <summary>
@@ -1057,18 +1308,17 @@ interface(`init_write_script_pipes',`
@@ -1057,18 +1327,17 @@ interface(`init_write_script_pipes',`
## </summary>
## </param>
#
@ -36745,7 +36780,7 @@ index 79a45f62e..6ed0c399a 100644
## </summary>
## <param name="domain">
## <summary>
@@ -1076,37 +1326,38 @@ interface(`init_getattr_script_files',`
@@ -1076,18 +1345,94 @@ interface(`init_getattr_script_files',`
## </summary>
## </param>
#
@ -36765,40 +36800,34 @@ index 79a45f62e..6ed0c399a 100644
## <summary>
-## Execute init scripts in the caller domain.
+## Ptrace init
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
#
-interface(`init_exec_script_files',`
+#
+interface(`init_ptrace',`
gen_require(`
- type initrc_exec_t;
+ gen_require(`
+ type init_t;
')
- files_list_etc($1)
- can_exec($1, initrc_exec_t)
+ ')
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 init_t:process ptrace;
+ ')
')
########################################
## <summary>
-## Get the attribute of all init script entrypoint files.
+')
+
+########################################
+## <summary>
+## Write an init script unnamed pipe.
## </summary>
## <param name="domain">
## <summary>
@@ -1114,7 +1365,82 @@ interface(`init_exec_script_files',`
## </summary>
## </param>
#
-interface(`init_getattr_all_script_files',`
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`init_write_script_pipes',`
+ gen_require(`
+ type initrc_t;
@ -36848,37 +36877,10 @@ index 79a45f62e..6ed0c399a 100644
+########################################
+## <summary>
+## Execute init scripts in the caller domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`init_exec_script_files',`
+ gen_require(`
+ type initrc_exec_t;
+ ')
+
+ files_list_etc($1)
+ can_exec($1, initrc_exec_t)
+')
+
+########################################
+## <summary>
+## Get the attribute of all init script entrypoint files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`init_getattr_all_script_files',`
gen_require(`
attribute init_script_file_type;
')
@@ -1125,6 +1451,63 @@ interface(`init_getattr_all_script_files',`
## </summary>
## <param name="domain">
## <summary>
@@ -1125,6 +1470,63 @@ interface(`init_getattr_all_script_files',`
########################################
## <summary>
@ -36942,7 +36944,7 @@ index 79a45f62e..6ed0c399a 100644
## Read all init script files.
## </summary>
## <param name="domain">
@@ -1144,6 +1527,24 @@ interface(`init_read_all_script_files',`
@@ -1144,6 +1546,24 @@ interface(`init_read_all_script_files',`
#######################################
## <summary>
@ -36967,7 +36969,7 @@ index 79a45f62e..6ed0c399a 100644
## Dontaudit read all init script files.
## </summary>
## <param name="domain">
@@ -1195,12 +1596,7 @@ interface(`init_read_script_state',`
@@ -1195,12 +1615,7 @@ interface(`init_read_script_state',`
')
kernel_search_proc($1)
@ -36981,7 +36983,7 @@ index 79a45f62e..6ed0c399a 100644
')
########################################
@@ -1314,6 +1710,24 @@ interface(`init_signal_script',`
@@ -1314,6 +1729,24 @@ interface(`init_signal_script',`
########################################
## <summary>
@ -37006,7 +37008,7 @@ index 79a45f62e..6ed0c399a 100644
## Send null signals to init scripts.
## </summary>
## <param name="domain">
@@ -1440,6 +1854,27 @@ interface(`init_dbus_send_script',`
@@ -1440,6 +1873,27 @@ interface(`init_dbus_send_script',`
########################################
## <summary>
## Send and receive messages from
@ -37034,7 +37036,7 @@ index 79a45f62e..6ed0c399a 100644
## init scripts over dbus.
## </summary>
## <param name="domain">
@@ -1547,6 +1982,25 @@ interface(`init_getattr_script_status_files',`
@@ -1547,6 +2001,25 @@ interface(`init_getattr_script_status_files',`
########################################
## <summary>
@ -37060,7 +37062,7 @@ index 79a45f62e..6ed0c399a 100644
## Do not audit attempts to read init script
## status files.
## </summary>
@@ -1605,6 +2059,42 @@ interface(`init_rw_script_tmp_files',`
@@ -1605,6 +2078,42 @@ interface(`init_rw_script_tmp_files',`
########################################
## <summary>
@ -37103,7 +37105,7 @@ index 79a45f62e..6ed0c399a 100644
## Create files in a init script
## temporary data directory.
## </summary>
@@ -1677,6 +2167,43 @@ interface(`init_read_utmp',`
@@ -1677,6 +2186,43 @@ interface(`init_read_utmp',`
########################################
## <summary>
@ -37147,7 +37149,7 @@ index 79a45f62e..6ed0c399a 100644
## Do not audit attempts to write utmp.
## </summary>
## <param name="domain">
@@ -1765,7 +2292,7 @@ interface(`init_dontaudit_rw_utmp',`
@@ -1765,7 +2311,7 @@ interface(`init_dontaudit_rw_utmp',`
type initrc_var_run_t;
')
@ -37156,7 +37158,7 @@ index 79a45f62e..6ed0c399a 100644
')
########################################
@@ -1806,27 +2333,154 @@ interface(`init_pid_filetrans_utmp',`
@@ -1806,30 +2352,157 @@ interface(`init_pid_filetrans_utmp',`
files_pid_filetrans($1, initrc_var_run_t, file, "utmp")
')
@ -37193,8 +37195,9 @@ index 79a45f62e..6ed0c399a 100644
## <summary>
-## Allow the specified domain to connect to daemon with a udp socket
+## Allow listing of the /run/systemd directory.
+## </summary>
+## <param name="domain">
## </summary>
## <param name="domain">
-## <summary>
+## <summary>
+## Domain allowed access.
+## </summary>
@ -37320,10 +37323,13 @@ index 79a45f62e..6ed0c399a 100644
+########################################
+## <summary>
+## Allow the specified domain to connect to daemon with a udp socket
## </summary>
## <param name="domain">
## <summary>
@@ -1840,3 +2494,583 @@ interface(`init_udp_recvfrom_all_daemons',`
+## </summary>
+## <param name="domain">
+## <summary>
## Domain allowed access.
## </summary>
## </param>
@@ -1840,3 +2513,584 @@ interface(`init_udp_recvfrom_all_daemons',`
')
corenet_udp_recvfrom_labeled($1, daemon)
')
@ -37907,6 +37913,7 @@ index 79a45f62e..6ed0c399a 100644
+ files_search_var_lib($1)
+ allow $1 init_var_lib_t:dir search_dir_perms;
+')
+
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 17eda2480..cc1720cf2 100644
--- a/policy/modules/system/init.te
@ -58272,7 +58279,7 @@ index f4ac38dc7..1589d6065 100644
+ ssh_signal(confined_admindomain)
+')
diff --git a/policy/policy_capabilities b/policy/policy_capabilities
index db3cbca45..40fd5a518 100644
index db3cbca45..3cc5cf448 100644
--- a/policy/policy_capabilities
+++ b/policy/policy_capabilities
@@ -31,3 +31,21 @@ policycap network_peer_controls;
@ -58294,7 +58301,7 @@ index db3cbca45..40fd5a518 100644
+# Checks enabled;
+# process2: nnp_transition, nosuid_transition
+#
+#policycap nnp_nosuid_transition;
+policycap nnp_nosuid_transition;
+
+
diff --git a/policy/support/misc_patterns.spt b/policy/support/misc_patterns.spt

392
policy-rawhide-contrib.patch
View File

@ -5615,7 +5615,7 @@ index f6eb4851f..3628a384f 100644
+ allow $1 httpd_t:process { noatsecure };
')
diff --git a/apache.te b/apache.te
index 6649962b6..513f68674 100644
index 6649962b6..1362c1bc9 100644
--- a/apache.te
+++ b/apache.te
@@ -5,280 +5,346 @@ policy_module(apache, 2.7.2)
@ -7796,7 +7796,7 @@ index 6649962b6..513f68674 100644
')
########################################
@@ -1330,49 +1633,41 @@ optional_policy(`
@@ -1330,49 +1633,42 @@ optional_policy(`
# User content local policy
#
@ -7836,6 +7836,7 @@ index 6649962b6..513f68674 100644
- fs_exec_nfs_files(httpd_user_script_t)
+ read_files_pattern(httpd_t, httpd_user_content_type, httpd_user_content_type)
+ read_lnk_files_pattern(httpd_t, httpd_user_content_type, httpd_user_content_type)
+ allow httpd_t httpd_sys_content_type:file map;
')
tunable_policy(`httpd_read_user_content',`
@ -7863,7 +7864,7 @@ index 6649962b6..513f68674 100644
kernel_read_system_state(httpd_passwd_t)
corecmd_exec_bin(httpd_passwd_t)
@@ -1382,38 +1677,109 @@ dev_read_urand(httpd_passwd_t)
@@ -1382,38 +1678,109 @@ dev_read_urand(httpd_passwd_t)
domain_use_interactive_fds(httpd_passwd_t)
@ -10711,10 +10712,18 @@ index c723a0ae0..1c29d21e7 100644
+ allow $1 bluetooth_unit_file_t:service all_service_perms;
')
diff --git a/bluetooth.te b/bluetooth.te
index 851769e55..45de12d70 100644
index 851769e55..53e2283cb 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -49,12 +49,15 @@ files_type(bluetooth_var_lib_t)
@@ -10,6 +10,7 @@ attribute_role bluetooth_helper_roles;
type bluetooth_t;
type bluetooth_exec_t;
init_daemon_domain(bluetooth_t, bluetooth_exec_t)
+init_nnp_daemon_domain(bluetooth_t)
type bluetooth_conf_t;
files_config_file(bluetooth_conf_t)
@@ -49,12 +50,15 @@ files_type(bluetooth_var_lib_t)
type bluetooth_var_run_t;
files_pid_file(bluetooth_var_run_t)
@ -10731,7 +10740,7 @@ index 851769e55..45de12d70 100644
dontaudit bluetooth_t self:capability sys_tty_config;
allow bluetooth_t self:process { getcap setcap getsched signal_perms };
allow bluetooth_t self:fifo_file rw_fifo_file_perms;
@@ -78,10 +81,12 @@ files_lock_filetrans(bluetooth_t, bluetooth_lock_t, file)
@@ -78,10 +82,12 @@ files_lock_filetrans(bluetooth_t, bluetooth_lock_t, file)
manage_dirs_pattern(bluetooth_t, bluetooth_tmp_t, bluetooth_tmp_t)
manage_files_pattern(bluetooth_t, bluetooth_tmp_t, bluetooth_tmp_t)
@ -10745,7 +10754,7 @@ index 851769e55..45de12d70 100644
files_var_lib_filetrans(bluetooth_t, bluetooth_var_lib_t, { dir file } )
manage_files_pattern(bluetooth_t, bluetooth_var_run_t, bluetooth_var_run_t)
@@ -90,27 +95,37 @@ files_pid_filetrans(bluetooth_t, bluetooth_var_run_t, { file sock_file })
@@ -90,27 +96,37 @@ files_pid_filetrans(bluetooth_t, bluetooth_var_run_t, { file sock_file })
can_exec(bluetooth_t, bluetooth_helper_exec_t)
@ -10788,7 +10797,7 @@ index 851769e55..45de12d70 100644
fs_getattr_all_fs(bluetooth_t)
fs_search_auto_mountpoints(bluetooth_t)
@@ -122,7 +137,6 @@ auth_use_nsswitch(bluetooth_t)
@@ -122,7 +138,6 @@ auth_use_nsswitch(bluetooth_t)
logging_send_syslog_msg(bluetooth_t)
@ -10796,7 +10805,7 @@ index 851769e55..45de12d70 100644
miscfiles_read_fonts(bluetooth_t)
miscfiles_read_hwdata(bluetooth_t)
@@ -130,6 +144,10 @@ userdom_dontaudit_use_unpriv_user_fds(bluetooth_t)
@@ -130,6 +145,10 @@ userdom_dontaudit_use_unpriv_user_fds(bluetooth_t)
userdom_dontaudit_use_user_terminals(bluetooth_t)
userdom_dontaudit_search_user_home_dirs(bluetooth_t)
@ -10807,7 +10816,7 @@ index 851769e55..45de12d70 100644
optional_policy(`
dbus_system_bus_client(bluetooth_t)
dbus_connect_system_bus(bluetooth_t)
@@ -200,7 +218,6 @@ dev_read_urand(bluetooth_helper_t)
@@ -200,7 +219,6 @@ dev_read_urand(bluetooth_helper_t)
domain_read_all_domains_state(bluetooth_helper_t)
files_read_etc_runtime_files(bluetooth_helper_t)
@ -17226,6 +17235,222 @@ index 000000000..2357f3ba8
+optional_policy(`
+ unconfined_domain(conman_unconfined_script_t)
+')
diff --git a/conntrackd.fc b/conntrackd.fc
new file mode 100644
index 000000000..c743543cc
--- /dev/null
+++ b/conntrackd.fc
@@ -0,0 +1,11 @@
+/usr/lib/systemd/system/conntrackd.* -- gen_context(system_u:object_r:conntrackd_unit_file_t,s0)
+
+/usr/sbin/conntrackd -- gen_context(system_u:object_r:conntrackd_exec_t,s0)
+
+/etc/conntrackd(/.*)? gen_context(system_u:object_r:conntrackd_conf_t,s0)
+
+/var/log/conntrackd.log gen_context(system_u:object_r:conntrackd_log_t,s0)
+
+/var/lock/conntrack.lock gen_context(system_u:object_r:conntrackd_var_lock_t,s0)
+
+/run/conntrackd.ctl -s gen_context(system_u:object_r:conntrackd_var_run_t,s0)
diff --git a/conntrackd.if b/conntrackd.if
new file mode 100644
index 000000000..601b56a46
--- /dev/null
+++ b/conntrackd.if
@@ -0,0 +1,118 @@
+## <summary>Conntrackd connection tracking service</summary>
+
+########################################
+## <summary>
+## Read the configuration files for conntrackd.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`conntrackd_read_config',`
+ gen_require(`
+ type conntrackd_conf_t;
+ ')
+
+ files_search_etc($1)
+ allow $1 conntrackd_conf_t:dir list_dir_perms;
+ read_files_pattern($1, conntrackd_conf_t, conntrackd_conf_t)
+ read_lnk_files_pattern($1, conntrackd_conf_t, conntrackd_conf_t)
+')
+
+########################################
+## <summary>
+## Connect to conntrackd over an unix stream socket.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`conntrackd_stream_connect',`
+ gen_require(`
+ type conntrackd_t, conntrackd_var_run_t;
+ ')
+
+ files_search_pids($1)
+ stream_connect_pattern($1, conntrackd_var_run_t, conntrackd_var_run_t, conntrackd_t)
+')
+
+#######################################
+## <summary>
+## Execute conntrackd services in the conntrackd domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`conntrackd_systemctl',`
+ gen_require(`
+ type conntrackd_t;
+ type conntrackd_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ init_reload_services($1)
+ allow $1 conntrackd_unit_file_t:file read_file_perms;
+ allow $1 conntrackd_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, conntrackd_t)
+')
+
+########################################
+## <summary>
+## All of the rules required to administrate
+## an conntrackd environment
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role to be allowed to manage the conntrackd domain.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`conntrackd_admin',`
+ gen_require(`
+ type conntrackd_t, conntrackd_tmp_t, conntrackd_log_t;
+ type conntrackd_conf_t, conntrackd_var_run_t, conntrackd_initrc_exec_t;
+ ')
+
+ allow $1 conntrackd_t:process signal_perms;
+ ps_process_pattern($1, conntrackd_t)
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 conntrackd_t:process ptrace;
+ ')
+
+ init_labeled_script_domtrans($1, conntrackd_initrc_exec_t)
+ domain_system_change_exemption($1)
+ role_transition $2 conntrackd_initrc_exec_t system_r;
+ allow $2 system_r;
+
+ files_list_etc($1)
+ admin_pattern($1, conntrackd_conf_t)
+
+ logging_list_logs($1)
+ admin_pattern($1, conntrackd_log_t)
+
+ files_list_tmp($1)
+ admin_pattern($1, conntrackd_tmp_t)
+
+ files_list_pids($1)
+ admin_pattern($1, conntrackd_var_run_t)
+
+ conntrackd_systemctl($1)
+ admin_pattern($1, conntrackd_unit_file_t)
+ allow $1 conntrackd_unit_file_t:service all_service_perms;
+')
diff --git a/conntrackd.te b/conntrackd.te
new file mode 100644
index 000000000..72e0d23db
--- /dev/null
+++ b/conntrackd.te
@@ -0,0 +1,69 @@
+policy_module(conntrackd, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type conntrackd_t;
+type conntrackd_exec_t;
+init_daemon_domain(conntrackd_t, conntrackd_exec_t)
+
+type conntrackd_conf_t;
+files_config_file(conntrackd_conf_t)
+
+type conntrackd_initrc_exec_t;
+init_script_file(conntrackd_initrc_exec_t)
+
+type conntrackd_unit_file_t;
+systemd_unit_file(conntrackd_unit_file_t)
+
+type conntrackd_log_t;
+logging_log_file(conntrackd_log_t)
+
+type conntrackd_var_run_t;
+files_pid_file(conntrackd_var_run_t)
+
+type conntrackd_var_lock_t;
+files_lock_file(conntrackd_var_lock_t)
+
+########################################
+#
+# Local policy
+#
+#
+
+allow conntrackd_t self:capability { sys_nice };
+allow conntrackd_t self:netlink_route_socket rw_netlink_socket_perms;
+allow conntrackd_t self:netlink_netfilter_socket create_socket_perms;
+allow conntrackd_t self:udp_socket create_socket_perms;
+allow conntrackd_t self:unix_dgram_socket create_socket_perms;
+allow conntrackd_t self:process { setsched signal };
+
+allow conntrackd_t conntrackd_conf_t:dir list_dir_perms;
+read_files_pattern(conntrackd_t, conntrackd_conf_t, conntrackd_conf_t)
+read_lnk_files_pattern(conntrackd_t, conntrackd_conf_t, conntrackd_conf_t)
+
+allow conntrackd_t conntrackd_log_t:dir setattr_dir_perms;
+manage_files_pattern(conntrackd_t, conntrackd_log_t, conntrackd_log_t)
+manage_sock_files_pattern(conntrackd_t, conntrackd_log_t, conntrackd_log_t)
+logging_log_filetrans(conntrackd_t, conntrackd_log_t, { sock_file file dir })
+
+manage_dirs_pattern(conntrackd_t, conntrackd_var_run_t, conntrackd_var_run_t)
+manage_files_pattern(conntrackd_t, conntrackd_var_run_t, conntrackd_var_run_t)
+manage_sock_files_pattern(conntrackd_t, conntrackd_var_run_t, conntrackd_var_run_t)
+files_pid_filetrans(conntrackd_t, conntrackd_var_run_t, { dir file sock_file })
+
+manage_dirs_pattern(conntrackd_t, conntrackd_var_lock_t, conntrackd_var_lock_t)
+manage_files_pattern(conntrackd_t, conntrackd_var_lock_t, conntrackd_var_lock_t)
+
+files_lock_filetrans(conntrackd_t, conntrackd_var_lock_t, { dir file sock_file })
+
+kernel_read_network_state(conntrackd_t)
+corenet_udp_sendrecv_generic_if(conntrackd_t)
+corenet_udp_sendrecv_generic_node(conntrackd_t)
+corenet_udp_sendrecv_all_ports(conntrackd_t)
+corenet_udp_bind_generic_node(conntrackd_t)
+
+corenet_udp_bind_conntrackd_port(conntrackd_t)
+corenet_udp_sendrecv_conntrackd_port(conntrackd_t)
diff --git a/consolekit.fc b/consolekit.fc
index 23c95582f..29e5fd38d 100644
--- a/consolekit.fc
@ -30223,10 +30448,18 @@ index 8081132cd..4fb5a13bc 100644
+ allow $1 fprintd_var_lib_t:dir mounton;
+')
diff --git a/fprintd.te b/fprintd.te
index 92a6479a2..f064c940d 100644
index 92a6479a2..f0ef28ef4 100644
--- a/fprintd.te
+++ b/fprintd.te
@@ -18,25 +18,29 @@ files_type(fprintd_var_lib_t)
@@ -8,6 +8,7 @@ policy_module(fprintd, 1.2.0)
type fprintd_t;
type fprintd_exec_t;
init_daemon_domain(fprintd_t, fprintd_exec_t)
+init_nnp_daemon_domain(fprintd_t)
type fprintd_var_lib_t;
files_type(fprintd_var_lib_t)
@@ -18,25 +19,29 @@ files_type(fprintd_var_lib_t)
#
allow fprintd_t self:capability sys_nice;
@ -30259,7 +30492,7 @@ index 92a6479a2..f064c940d 100644
userdom_use_user_ptys(fprintd_t)
userdom_read_all_users_state(fprintd_t)
@@ -54,8 +58,21 @@ optional_policy(`
@@ -54,8 +59,21 @@ optional_policy(`
')
')
@ -69170,7 +69403,7 @@ index 9b157305b..cb00f200a 100644
+ ')
')
diff --git a/openvswitch.te b/openvswitch.te
index 44dbc99ab..9e70db7ef 100644
index 44dbc99ab..d11c99a93 100644
--- a/openvswitch.te
+++ b/openvswitch.te
@@ -9,11 +9,8 @@ type openvswitch_t;
@ -69202,7 +69435,7 @@ index 44dbc99ab..9e70db7ef 100644
-allow openvswitch_t self:capability { net_admin sys_nice sys_resource ipc_lock };
-allow openvswitch_t self:process { setrlimit setsched signal };
+allow openvswitch_t self:capability { net_admin ipc_lock sys_module sys_nice sys_rawio sys_resource chown setgid setpcap setuid };
+allow openvswitch_t self:capability { dac_override net_admin ipc_lock sys_module sys_nice sys_rawio sys_resource chown setgid setpcap setuid };
+allow openvswitch_t self:capability2 block_suspend;
+allow openvswitch_t self:process { fork setsched setrlimit signal setcap };
allow openvswitch_t self:fifo_file rw_fifo_file_perms;
@ -69236,7 +69469,7 @@ index 44dbc99ab..9e70db7ef 100644
manage_lnk_files_pattern(openvswitch_t, openvswitch_log_t, openvswitch_log_t)
logging_log_filetrans(openvswitch_t, openvswitch_log_t, { dir file lnk_file })
@@ -63,35 +67,59 @@ manage_dirs_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
@@ -63,35 +67,63 @@ manage_dirs_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
manage_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
manage_sock_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
manage_lnk_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
@ -69294,11 +69527,15 @@ index 44dbc99ab..9e70db7ef 100644
sysnet_dns_name_resolve(openvswitch_t)
optional_policy(`
+logging_send_audit_msgs(openvswitch_t)
+
+write_sock_files_pattern(init_t, openvswitch_var_run_t, openvswitch_var_run_t)
+
+optional_policy(`
+ hostname_exec(openvswitch_t)
+')
+
+optional_policy(`
optional_policy(`
iptables_domtrans(openvswitch_t)
')
+
@ -76903,7 +77140,7 @@ index ded95ec3a..210018ce4 100644
+ postfix_config_filetrans($1, postfix_prng_t, file, "prng_exch")
')
diff --git a/postfix.te b/postfix.te
index 5cfb83eca..6835f1e58 100644
index 5cfb83eca..657a4346e 100644
--- a/postfix.te
+++ b/postfix.te
@@ -6,27 +6,23 @@ policy_module(postfix, 1.15.1)
@ -77180,12 +77417,13 @@ index 5cfb83eca..6835f1e58 100644
corenet_all_recvfrom_netlabel(postfix_master_t)
corenet_tcp_sendrecv_generic_if(postfix_master_t)
corenet_udp_sendrecv_generic_if(postfix_master_t)
@@ -270,50 +175,44 @@ corenet_tcp_sendrecv_generic_node(postfix_master_t)
@@ -270,50 +175,45 @@ corenet_tcp_sendrecv_generic_node(postfix_master_t)
corenet_udp_sendrecv_generic_node(postfix_master_t)
corenet_tcp_sendrecv_all_ports(postfix_master_t)
corenet_udp_sendrecv_all_ports(postfix_master_t)
+corenet_udp_bind_generic_node(postfix_master_t)
+corenet_udp_bind_all_unreserved_ports(postfix_master_t)
+corenet_tcp_bind_all_unreserved_ports(postfix_master_t)
+corenet_dontaudit_udp_bind_all_ports(postfix_master_t)
corenet_tcp_bind_generic_node(postfix_master_t)
-
@ -77249,7 +77487,7 @@ index 5cfb83eca..6835f1e58 100644
optional_policy(`
cyrus_stream_connect(postfix_master_t)
')
@@ -324,14 +223,6 @@ optional_policy(`
@@ -324,14 +224,6 @@ optional_policy(`
')
optional_policy(`
@ -77264,7 +77502,7 @@ index 5cfb83eca..6835f1e58 100644
postgrey_search_spool(postfix_master_t)
')
@@ -341,12 +232,14 @@ optional_policy(`
@@ -341,12 +233,14 @@ optional_policy(`
########################################
#
@ -77281,7 +77519,7 @@ index 5cfb83eca..6835f1e58 100644
manage_dirs_pattern(postfix_bounce_t, postfix_spool_t, postfix_spool_t)
manage_files_pattern(postfix_bounce_t, postfix_spool_t, postfix_spool_t)
@@ -363,74 +256,89 @@ manage_lnk_files_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool
@@ -363,74 +257,89 @@ manage_lnk_files_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool
########################################
#
@ -77392,7 +77630,7 @@ index 5cfb83eca..6835f1e58 100644
')
optional_policy(`
@@ -442,16 +350,25 @@ optional_policy(`
@@ -442,16 +351,25 @@ optional_policy(`
')
optional_policy(`
@ -77418,7 +77656,7 @@ index 5cfb83eca..6835f1e58 100644
procmail_domtrans(postfix_local_t)
')
@@ -466,15 +383,17 @@ optional_policy(`
@@ -466,15 +384,17 @@ optional_policy(`
########################################
#
@ -77443,7 +77681,7 @@ index 5cfb83eca..6835f1e58 100644
manage_dirs_pattern(postfix_map_t, postfix_map_tmp_t, postfix_map_tmp_t)
manage_files_pattern(postfix_map_t, postfix_map_tmp_t, postfix_map_tmp_t)
@@ -484,14 +403,15 @@ kernel_read_kernel_sysctls(postfix_map_t)
@@ -484,14 +404,15 @@ kernel_read_kernel_sysctls(postfix_map_t)
kernel_dontaudit_list_proc(postfix_map_t)
kernel_dontaudit_read_system_state(postfix_map_t)
@ -77463,7 +77701,7 @@ index 5cfb83eca..6835f1e58 100644
corecmd_list_bin(postfix_map_t)
corecmd_read_bin_symlinks(postfix_map_t)
@@ -500,7 +420,6 @@ corecmd_read_bin_pipes(postfix_map_t)
@@ -500,7 +421,6 @@ corecmd_read_bin_pipes(postfix_map_t)
corecmd_read_bin_sockets(postfix_map_t)
files_list_home(postfix_map_t)
@ -77471,7 +77709,7 @@ index 5cfb83eca..6835f1e58 100644
files_read_etc_runtime_files(postfix_map_t)
files_dontaudit_search_var(postfix_map_t)
@@ -508,21 +427,24 @@ auth_use_nsswitch(postfix_map_t)
@@ -508,21 +428,24 @@ auth_use_nsswitch(postfix_map_t)
logging_send_syslog_msg(postfix_map_t)
@ -77499,7 +77737,7 @@ index 5cfb83eca..6835f1e58 100644
stream_connect_pattern(postfix_pickup_t, postfix_private_t, postfix_private_t, postfix_master_t)
rw_fifo_files_pattern(postfix_pickup_t, postfix_public_t, postfix_public_t)
@@ -532,21 +454,21 @@ allow postfix_pickup_t postfix_spool_t:dir list_dir_perms;
@@ -532,21 +455,21 @@ allow postfix_pickup_t postfix_spool_t:dir list_dir_perms;
read_files_pattern(postfix_pickup_t, postfix_spool_t, postfix_spool_t)
delete_files_pattern(postfix_pickup_t, postfix_spool_t, postfix_spool_t)
@ -77525,7 +77763,7 @@ index 5cfb83eca..6835f1e58 100644
write_fifo_files_pattern(postfix_pipe_t, postfix_public_t, postfix_public_t)
@@ -557,6 +479,10 @@ domtrans_pattern(postfix_pipe_t, postfix_postdrop_exec_t, postfix_postdrop_t)
@@ -557,6 +480,10 @@ domtrans_pattern(postfix_pipe_t, postfix_postdrop_exec_t, postfix_postdrop_t)
corecmd_exec_bin(postfix_pipe_t)
optional_policy(`
@ -77536,7 +77774,7 @@ index 5cfb83eca..6835f1e58 100644
dovecot_domtrans_deliver(postfix_pipe_t)
')
@@ -584,19 +510,28 @@ optional_policy(`
@@ -584,19 +511,28 @@ optional_policy(`
########################################
#
@ -77570,7 +77808,7 @@ index 5cfb83eca..6835f1e58 100644
term_dontaudit_use_all_ptys(postfix_postdrop_t)
term_dontaudit_use_all_ttys(postfix_postdrop_t)
@@ -611,10 +546,7 @@ optional_policy(`
@@ -611,10 +547,7 @@ optional_policy(`
cron_system_entry(postfix_postdrop_t, postfix_postdrop_exec_t)
')
@ -77582,7 +77820,7 @@ index 5cfb83eca..6835f1e58 100644
optional_policy(`
fstools_read_pipes(postfix_postdrop_t)
')
@@ -629,17 +561,24 @@ optional_policy(`
@@ -629,17 +562,24 @@ optional_policy(`
#######################################
#
@ -77610,7 +77848,7 @@ index 5cfb83eca..6835f1e58 100644
init_sigchld_script(postfix_postqueue_t)
init_use_script_fds(postfix_postqueue_t)
@@ -655,69 +594,80 @@ optional_policy(`
@@ -655,69 +595,80 @@ optional_policy(`
########################################
#
@ -77708,7 +77946,7 @@ index 5cfb83eca..6835f1e58 100644
')
optional_policy(`
@@ -730,28 +680,32 @@ optional_policy(`
@@ -730,28 +681,32 @@ optional_policy(`
########################################
#
@ -77749,7 +77987,7 @@ index 5cfb83eca..6835f1e58 100644
optional_policy(`
dovecot_stream_connect_auth(postfix_smtpd_t)
@@ -764,6 +718,7 @@ optional_policy(`
@@ -764,6 +719,7 @@ optional_policy(`
optional_policy(`
milter_stream_connect_all(postfix_smtpd_t)
@ -77757,7 +77995,7 @@ index 5cfb83eca..6835f1e58 100644
')
optional_policy(`
@@ -774,31 +729,101 @@ optional_policy(`
@@ -774,31 +730,101 @@ optional_policy(`
sasl_connect(postfix_smtpd_t)
')
@ -91351,7 +91589,7 @@ index 6dbc905b3..42e4306c8 100644
- admin_pattern($1, rhsmcertd_lock_t)
')
diff --git a/rhsmcertd.te b/rhsmcertd.te
index d32e1a279..b79ae3194 100644
index d32e1a279..795cd3890 100644
--- a/rhsmcertd.te
+++ b/rhsmcertd.te
@@ -18,6 +18,9 @@ logging_log_file(rhsmcertd_log_t)
@ -91392,7 +91630,7 @@ index d32e1a279..b79ae3194 100644
manage_dirs_pattern(rhsmcertd_t, rhsmcertd_var_lib_t, rhsmcertd_var_lib_t)
manage_files_pattern(rhsmcertd_t, rhsmcertd_var_lib_t, rhsmcertd_var_lib_t)
@@ -50,25 +56,94 @@ manage_files_pattern(rhsmcertd_t, rhsmcertd_var_run_t, rhsmcertd_var_run_t)
@@ -50,25 +56,98 @@ manage_files_pattern(rhsmcertd_t, rhsmcertd_var_run_t, rhsmcertd_var_run_t)
files_pid_filetrans(rhsmcertd_t, rhsmcertd_var_run_t, { file dir })
kernel_read_network_state(rhsmcertd_t)
@ -91468,6 +91706,10 @@ index d32e1a279..b79ae3194 100644
+')
+
+optional_policy(`
+ snmp_signull(rhsmcertd_t)
+')
+
+optional_policy(`
+ sosreport_signull(rhsmcertd_t)
+')
+
@ -92393,7 +92635,7 @@ index 13f788fd5..10e203301 100644
+ allow $1 rngd_unit_file_t:service all_service_perms;
')
diff --git a/rngd.te b/rngd.te
index a7b7717b7..41bca3bb8 100644
index a7b7717b7..cdf68a3ae 100644
--- a/rngd.te
+++ b/rngd.te
@@ -12,6 +12,9 @@ init_daemon_domain(rngd_t, rngd_exec_t)
@ -92406,7 +92648,7 @@ index a7b7717b7..41bca3bb8 100644
type rngd_var_run_t;
files_pid_file(rngd_var_run_t)
@@ -34,9 +37,7 @@ dev_read_rand(rngd_t)
@@ -34,9 +37,8 @@ dev_read_rand(rngd_t)
dev_read_urand(rngd_t)
dev_rw_tpm(rngd_t)
dev_write_rand(rngd_t)
@ -92417,6 +92659,7 @@ index a7b7717b7..41bca3bb8 100644
logging_send_syslog_msg(rngd_t)
-miscfiles_read_localization(rngd_t)
+term_use_usb_ttys(rngd_t)
diff --git a/rolekit.fc b/rolekit.fc
new file mode 100644
index 000000000..504b6e13e
@ -104054,10 +104297,10 @@ index cbfe369a6..6594af373 100644
files_search_var_lib($1)
diff --git a/snapper.fc b/snapper.fc
new file mode 100644
index 000000000..34f7846b3
index 000000000..b4e0699bc
--- /dev/null
+++ b/snapper.fc
@@ -0,0 +1,16 @@
@@ -0,0 +1,15 @@
+/usr/sbin/snapperd -- gen_context(system_u:object_r:snapperd_exec_t,s0)
+
+/usr/lib/snapper/systemd-helper -- gen_context(system_u:object_r:snapperd_exec_t,s0)
@ -104072,8 +104315,7 @@ index 000000000..34f7846b3
+/usr/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
+/var/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
+/etc/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
+/home/\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
+/home/(.*/)?\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
+HOME_ROOT/(.*/)?\.snapshots(/.*)? gen_context(system_u:object_r:snapperd_data_t,s0)
diff --git a/snapper.if b/snapper.if
new file mode 100644
index 000000000..88490d5c6
@ -104296,10 +104538,35 @@ index 2f0a2f205..1569e3369 100644
+/var/run/snmpd(/.*)? gen_context(system_u:object_r:snmpd_var_run_t,s0)
/var/run/snmpd\.pid -- gen_context(system_u:object_r:snmpd_var_run_t,s0)
diff --git a/snmp.if b/snmp.if
index 7a9cc9df7..23cb6589e 100644
index 7a9cc9df7..6085a4160 100644
--- a/snmp.if
+++ b/snmp.if
@@ -57,8 +57,7 @@ interface(`snmp_udp_chat',`
@@ -2,6 +2,24 @@
########################################
## <summary>
+## Send null signals to snmp.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`snmp_signull',`
+ gen_require(`
+ type snmpd_t;
+ ')
+
+ allow $1 snmpd_t:process signull;
+')
+
+########################################
+## <summary>
## Connect to snmpd with a unix
## domain stream socket.
## </summary>
@@ -57,8 +75,7 @@ interface(`snmp_udp_chat',`
########################################
## <summary>
@ -104309,7 +104576,7 @@ index 7a9cc9df7..23cb6589e 100644
## </summary>
## <param name="domain">
## <summary>
@@ -66,19 +65,57 @@ interface(`snmp_udp_chat',`
@@ -66,19 +83,57 @@ interface(`snmp_udp_chat',`
## </summary>
## </param>
#
@ -104370,7 +104637,7 @@ index 7a9cc9df7..23cb6589e 100644
## </summary>
## <param name="domain">
## <summary>
@@ -98,7 +135,7 @@ interface(`snmp_manage_var_lib_files',`
@@ -98,7 +153,7 @@ interface(`snmp_manage_var_lib_files',`
########################################
## <summary>
@ -104379,7 +104646,7 @@ index 7a9cc9df7..23cb6589e 100644
## </summary>
## <param name="domain">
## <summary>
@@ -106,14 +143,35 @@ interface(`snmp_manage_var_lib_files',`
@@ -106,14 +161,35 @@ interface(`snmp_manage_var_lib_files',`
## </summary>
## </param>
#
@ -104418,7 +104685,7 @@ index 7a9cc9df7..23cb6589e 100644
')
########################################
@@ -179,8 +237,12 @@ interface(`snmp_admin',`
@@ -179,8 +255,12 @@ interface(`snmp_admin',`
type snmpd_var_lib_t, snmpd_var_run_t;
')
@ -112448,10 +112715,10 @@ index 000000000..e5cec8fda
+')
diff --git a/tomcat.te b/tomcat.te
new file mode 100644
index 000000000..d503f1b51
index 000000000..6db6edad3
--- /dev/null
+++ b/tomcat.te
@@ -0,0 +1,124 @@
@@ -0,0 +1,126 @@
+policy_module(tomcat, 1.0.0)
+
+########################################
@ -112509,7 +112776,7 @@ index 000000000..d503f1b51
+# tomcat domain local policy
+#
+
+allow tomcat_t self:capability { setuid kill };
+allow tomcat_t self:capability { setuid kill };
+
+allow tomcat_t self:process { execmem setcap setsched signal signull };
+
@ -112523,6 +112790,7 @@ index 000000000..d503f1b51
+
+kernel_read_network_state(tomcat_domain)
+kernel_read_net_sysctls(tomcat_domain)
+kernel_read_usermodehelper_state(tomcat_domain)
+
+corecmd_exec_bin(tomcat_domain)
+corecmd_exec_shell(tomcat_domain)
@ -112544,6 +112812,7 @@ index 000000000..d503f1b51
+corenet_tcp_connect_unreserved_ports(tomcat_domain)
+corenet_tcp_connect_mssql_port(tomcat_domain)
+corenet_tcp_connect_mysqld_port(tomcat_domain)
+corenet_tcp_bind_jboss_management_port(tomcat_domain)
+
+dev_read_rand(tomcat_domain)
+dev_read_urand(tomcat_domain)
@ -112660,7 +112929,7 @@ index 61c2e07d6..3b860953c 100644
+ ')
')
diff --git a/tor.te b/tor.te
index 5ceacde8c..363931dc2 100644
index 5ceacde8c..792523bdb 100644
--- a/tor.te
+++ b/tor.te
@@ -13,6 +13,20 @@ policy_module(tor, 1.9.0)
@ -112704,7 +112973,7 @@ index 5ceacde8c..363931dc2 100644
########################################
#
@@ -48,6 +68,8 @@ allow tor_t tor_etc_t:dir list_dir_perms;
@@ -48,10 +68,13 @@ allow tor_t tor_etc_t:dir list_dir_perms;
allow tor_t tor_etc_t:file read_file_perms;
allow tor_t tor_etc_t:lnk_file read_lnk_file_perms;
@ -112713,7 +112982,12 @@ index 5ceacde8c..363931dc2 100644
manage_dirs_pattern(tor_t, tor_var_lib_t, tor_var_lib_t)
manage_files_pattern(tor_t, tor_var_lib_t, tor_var_lib_t)
manage_sock_files_pattern(tor_t, tor_var_lib_t, tor_var_lib_t)
@@ -77,7 +99,6 @@ corenet_tcp_sendrecv_generic_node(tor_t)
files_var_lib_filetrans(tor_t, tor_var_lib_t, dir)
+allow tor_t tor_var_lib_t:file map;
allow tor_t tor_var_log_t:dir setattr_dir_perms;
append_files_pattern(tor_t, tor_var_log_t, tor_var_log_t)
@@ -77,7 +100,6 @@ corenet_tcp_sendrecv_generic_node(tor_t)
corenet_udp_sendrecv_generic_node(tor_t)
corenet_tcp_bind_generic_node(tor_t)
corenet_udp_bind_generic_node(tor_t)
@ -112721,7 +112995,7 @@ index 5ceacde8c..363931dc2 100644
corenet_sendrecv_dns_server_packets(tor_t)
corenet_udp_bind_dns_port(tor_t)
corenet_udp_sendrecv_dns_port(tor_t)
@@ -85,6 +106,7 @@ corenet_udp_sendrecv_dns_port(tor_t)
@@ -85,6 +107,7 @@ corenet_udp_sendrecv_dns_port(tor_t)
corenet_sendrecv_tor_server_packets(tor_t)
corenet_tcp_bind_tor_port(tor_t)
corenet_tcp_sendrecv_tor_port(tor_t)
@ -112729,7 +113003,7 @@ index 5ceacde8c..363931dc2 100644
corenet_sendrecv_all_client_packets(tor_t)
corenet_tcp_connect_all_ports(tor_t)
@@ -98,19 +120,26 @@ dev_read_urand(tor_t)
@@ -98,19 +121,26 @@ dev_read_urand(tor_t)
domain_use_interactive_fds(tor_t)
files_read_etc_runtime_files(tor_t)

12
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
Release: 295%{?dist}
Release: 296%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@ -722,6 +722,16 @@ exit 0
%endif
%changelog
* Tue Oct 17 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-296
- Merge pull request #19 from RodrigoQuesadaDev/snapper-fix-1
- Allow httpd_t domain to mmap httpd_user_content_t files. BZ(1494852)
- Add nnp transition rule for services using NoNewPrivileges systemd feature
- Add map permission into dev_rw_infiniband_dev() interface to allow caller domain mmap infiniband chr device BZ(1500923)
- Add init_nnp_daemon_domain interface
- Allow nnp transition capability
- Merge pull request #204 from konradwilk/rhbz1484908
- Label postgresql-check-db-dir as postgresql_exec_t
* Tue Oct 10 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-295
- Allow boinc_t to mmap files with label boinc_project_var_lib_t BZ(1500088)
- Allow fail2ban_t domain to mmap journals. BZ(1500089)