From 233534cc519e693dd4703b9cb8c9b8b454231a98 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 27 Sep 2017 13:16:05 +0200 Subject: [PATCH] * Wed Sep 27 2017 Lukas Vrabec - 3.13.1-289 - Allow tlp_t domain stream connect to sssd_t domain - Add missing dac_override capability - Add systemd_tmpfiles_t dac_override capability --- container-selinux.tgz | Bin 7007 -> 7009 bytes policy-rawhide-base.patch | 20 +++++++++++--------- policy-rawhide-contrib.patch | 8 ++++++-- selinux-policy.spec | 7 ++++++- 4 files changed, 23 insertions(+), 12 deletions(-) diff --git a/container-selinux.tgz b/container-selinux.tgz index 1eb1b31beeef84370964c2498ad25c083b8c42d3..c35637b8ae532588228f70333da916df5c8aa252 100644 GIT binary patch literal 7009 zcmbu;g*zOM;{af6VxQ?YdD?Ier%p57(;X*HGfYlQ_jGs1On07%sbTtb=jpER?|=9` z&-*XDw9!~7l3}CzC~r=T9pjhz6DQ^mOaTk1B18+kx#xqZB8#FNiRef%D*R)h3oX!- zx~UjB7q?1ZvA2VL>fBSg8O<71%-S?~gQh}f8?SZ!gClXkqE24MYAVb&VJ7Y1Cd)?A z8PFB*iuu&_vhmn*$W`olx@K$|;P#Ascpk@dUNi0q-8&n?TMHoS{8ocjaWL6vPW^Vx z^46nOfu4P3;W1#U(dVA$u1;v%TTlG?;PjD^wW`?bUvfA^@q2A$J@`LFBgc1n_hdS@ zuV=pZTPbFSs1c@zI~W1k&pX_axQ>PSWipeEI37EC{uB;IYN z#q|On-mvi@2+`LOV|1NNl{5^ONwO$W&esk3@71J4CTj)(Qk)1#D$$=0FI2g-#JMM! zsG9HjIq_AYt|n;>&lab#s-fYg;||y9_1oWBuv*WgdSrr$Ag7mDiMPD0squ8D{T~#B zB|pFPwahbT;;H`)-0Byf*Z#bR19JMuVf$$?I}>sbZ|Iw6w);?&r#VTQ1GrCBC;R5A z`On`~GU-e2htICok%%R^zgXE_{8hM-*A$kk$NiA|%wkpai!@<|+aEru{G2zAS(8FP zHWJj5V%=;8Rvg~GV$gzb^K56fl9#mdkxfdGg(H+^L#VxhgHLchJVHUUEv%-%2J-&O7aX z1B+A%8(o@-n+RZ3dI=efkA=r6->Om+Xt#DxV`eAUuAXsO1?d{{`*Fd`UmiB5R5$pU z{A?;iNt><3(gReGUqG0UTxvPsHLpR+AIrqgVlX_qLolL*FmyH3s6f-SsAZb-f>bZ&jO?*z4Wqu4 z2_24T(uvykNK9!3p(~V3=IyKWCYkMyw{uc>p-1fi1`|P4!KX58e=wikS^oX8nnnOL z$q!UBds6FrrZ7$h$Mnj&Rzc8kNcod6*$Su}=0-yi!BYZG`Nk&*^COu3@=#wgT((hH3ne>3p-ICurXU-T_ z4=w8Q0q?s1Van?usj5eeUt!rLv6P)SW+0fkCGO0}k1(G05Fu zaBmk)GFIM%vZBt!6xq_Qjsyr&!^KvCWyd!nCv)6-|Wa{c1i-k}`z$fR*=^^afa z&9slBIsXKE1n+MyRCqvl8!esXDp=944H#N_Pzd_IW-aV zX_=woyeL@|MGs2XQoGCaIuV_tySC0qwWss&r`1#SZc&{RJKF)i(NiVo}!M9GEfJ42SR+-CJkKTE;(?_e)K zqnNn1f;b#)f95V=@%jptoD2&)))2DcLyRNy-mm%Hf+aP9j_{)V5!`%>u2=vUgWk~9 zH-T@xb5@pk&tQ^q$uz@7h z+`kmcq-I~>Av)sPOj>FBm9`DXZRw%$HSPmBzSVH62X07n_OuD*yuNZodK=7nQv_QGr*&<3xVU*=KJOr+Q%bq?(pfHR-g@Xa@2qHP zdSCP0387|Z0!agfY-B1qR5K&O7qmoLnfvfbSXIwz)g;x6$ck9lGk^}@szxTXe zDXFJ;utQxw*04}ObV@~uH)MZS8D$2wy+9Vi^plKWGMh{mI-+Z`TB6TCd?()YczSr3 ze|JNswyzs36%jA9LQ#x`9M~z!ojz=SlGZ`rmnhp3`YlVVBn#jH zY%_r=+H@x{V=yH9t0DMYq8-KswC(Z+506GReQn^C!9O=oEg`#|eCfBX#NK}x;I3#9 z@fl%eKX3WHh}J8E6aw;)H=xUDw9Y)Y!MW#XtC&%8zQ2D`)orE%U$7bi7olfS_ruCW z0ZEn!JPp0jEU*%yY#oY!G8#_bs?>+F1n)Tuu}W&RrP}tCp}<@KHwMYQE)|Ey^ps(G zVDYO=JE0P?bn;=CPF<_zISnbI>clM6z79+K->>VP(}bW`O4;}7>6pg0LlU(u=eNQ zKvm=LN^Qw`0vwB9{$t6SDE-ATpIJMHA__;SHMSV^BuPq?8Y#+~I5?4Wo=@wWfVQF9 zAO=Nd`~tuxc-dBc^MpfQw_{NdqIy9!+B{6QuVv}F!<$Ac2@qj3?V9%r8C*4K!EzOjLgr1wFrc*-0o z2So{9ba*CTt`gKv5$$6s6*RF$oiXNvrW9NX1Ht0q7nj28XZRFyjaYwq?y=f{SW4z^q;RgV)`=4o$L z4cZCATuR|>u-XOoMCS++8*f)X9wsOwB(t4qq$+Fy2{k zVm)vh$@%j!$eCdP9JX^&e>Akd`c%Xgt>kqN*A9x8)m@zwII|_UI_J4_qiWFW7wJ^; z36gkZY=2KP@_-~9e(9=CJOPa6P7>e|4v+d?Oq2CV6CO+7F<|q*`;QJbavYdzy#BzY z8YtqbV3>s2?myANd8Z>o zlu?U{KJfxT*lJMdZBW5lpS9c=dAF!Q?)5uKf>jWShK zi-in(rg2W%rccnfr>2<5d#?%Q->$cNW6*jTaVESxTSX}Ss8L3q(@KX;&2mfSuYg04 zxrgRSs`qSyE~z_B8%5EW2gCOA#Ac9Co12#zFjm03u>M6dj{rNwbL&A z1QYD#`3Bea5ThPB1Mq7_ZZDM}9p+~Rdn-YtB z<{84duFIBt-*#BoHc#9@E9>ZkC(YFia(N(Mqqb3zS)OO$ zO3mKKkt6XH!-<90k+lE+R zHng;`E=-?bmu7g|qN}jWp)KsX&UEX{(_{IdYyg)eTc2x;O z4SgNbQpaP!Gi}{a4J4^gsK_CjY|ihTxFcIkkmu))e%!tX^x3Dy~Pz~jZZio>PHK&8liy z@)Q`v{uwW(F!7K{Zg-VlRY;Akn*%jd^Fx+i=)2BPmOy;8Fli512@^Bd$g?z6a{-hp zAp?k!(}ltn3}`Cap&G>)WaqNep_*kc<=QU8;S6RMYGe~|+p?sjsZVXQq;aIz5YoGC zkQC<=9QeIF+hBc*Z-9Zr!mP=<0&&G5Lx9J-h20&teXOjjtCkNjyUc!N!1!_h6AomW z=fr;Dv6o#MglFrFNo5bknihB2*iEs|L|N1p^jOCe2-ifjj6L;Nyxu1i=4bp|Cupw5 z@IrH@k+r{SoU_fIq~*9+dLO>&6J@PR;6!ZVOW-G6D~Z1wnnFYqasl%l< z8r`A1#QG>P2*Geb6~WHGip%#~p7ZHE(;&z&lBC6xKOZ}26{vV|6gyYe)2KdS0P3nk3LW*Sp#-lyI_sX+H&UXXnL9ptF2=IB z`V<+TW{$OJI@&dXf$Cu&p~a7;Qb((dJu)(o_ef2c)y>_6(2KZ0;s3ifSjiWz&) zrLtE1A_{&S-8%D&0vc41?_+IUW=nG-+jx~vaa=2p)3Fi$9kUn5L#7!hDUXpb%pUD- z*OGY&NXWNJ`&QQJiDpM10*Y#t3^ofJIFrs0)9#n%VO}?VqgHbn1m%pxgo>UdTcO+X zWj<4j@oWaqnR8WeA6)gHNIZ5SMP4_BH5*q)r2;tyklxzW9bp2i&@1KJlezQPiHH=# zoGJ|+|27Ep1@CmK9Bre@DvKCQ>FN}0e(_JeeWjbfZ^pr)gc59|DhCPwn(HtI>Tqep zk*y2G)iBl=B#@hDXby)`gGQ$)@-y~8UFXgZ50$Y`oKk>q2cduFq4}z?4Ic%v?Eedo zxi98ii?k(c_^Y=(&U~6gGqszjJt%u__g_;fF=9?T0`*EU!cZfd=CoJgfZi}#w!!xb z2VLja%)v=)?sY^*Q5cfu%R;qe_uhmBoo$TeF4wtV@o8Ngk~1B<2-s5IVWE*O!wWP~ zUwlZAE$Anl;k}I2$n;AiS}k$t9Ee2Xi0m5G9Pz;W()eSFtbW9H(s_UEA^bE!KqZVbYO)kD09nj^#2jzsVsre?2iHULH}ZM<&WIM`}X;U=?%@v zQVyHvE)!zmH9Gn+5GZ@vM5QB@jmND*F2eo|Zk866xkt`BsxsMg32HsTt7v>#0TqYv zRBRH#hv8jv?iN~7mM=Zek97<&SnY&H`{A|hK}eDZ zRmb|Fi`;;Nr%48ODpdTqJ3QUx@Y39BIc9_Y116mUf7t2Su0lV~pcG*d(BlgIYo6rn zCG7`+#Fsf4&hN}5cKD)A2v%l!=;=PJ1TO9n-H~cEN!dvL z73Rr48Ksa5gxWI?$RY#O8jFO#ajG-3{Tw}M_=cExe(pIs%DSC@xP7e&db)b<`TL`0 za<~2AI`P|7csFj8F}=6LJ4n%)yXBd!$MFuZ7rwE zdn=ZiwBe}=5@CmCB|a(x}R8r~S?DtdtBR9*~5XwQ#_0yf;-UN$d5w zNB8xT+HIW+vF<#1z1$d`l3sM7M#_m}n0#yXbvQ}jpG<)tS#7YB{IG`sa89E_mlO9< zWWX=(bE?J%uF(1Nz)@I2_l;4fIGYfMfQ2xuJA0?+Qmgr5Q8X^M(c-fZ=8n&~v(2hr z!rjf=clrGriaTC{$2oEZ)ip?IX5pA83;AvdV+XtxIh5;9O<1H7#&w@xqizR$f}_@% zh>DBt@SiU_OwX0xy+~QE8Ifa>>P|i|Jd$NPv zZ?`H7XfH82jEdwy5@SeoCGK%Fl%i(i{9_`RL?#qRhe;D^S`l;^OD4O!;)?Ht`ACNR zFhZGrjQbqHnykW1wR{&F^kgI7J%xH?1R5Ka*!B+D^Mhi;G95qnSOYZbtKSOt!)qnR z8wwnD2;aKR#5B3|nCRGw{4t^mlAh;V=Nnz`+9-=ob%~Iwy+2if)O4t7 zzx2FslKax%M1hfR=>0!wTD^Yl{a78+)Gwd@{P%t2ChY?6%UEf-`(qdZ?#hZ)O>MY31 zC`iL~75QbbUvJ{<{M+k`)tM;Jy6|f#H$F9Ir+ZUhtT2Nao020dO}gv6VXfxgv}dE5 z_RQ3@oeau6i8Szkg~t-y4}z$whENeH@QbU#?gPK0dQQ{&;+1G`*7}$+w0jwEunE4s z(PJRQDaI-Y>BSCI?C@hmEytsEv;}@fl-5ypn0nE`;%SDj) zeu<=wASr+E+iM-oC#a{#@!_BAA}Z4g7`Jf}RU%_fO`Uw^+2Ey#n#Smt6tqESNWMAL zMO)m|v|nA&q#Uq@RGdlTHuljo0%x!FszYLZ0hw2Ozl>gz)Tu!3a%bcYQcvQl#=dP5 zItS7`a%r+*?j*aLjNsnjz2^Q4je4Att0D^GZ43>>8WPQwsHgHM&yaNp+<+XRtog#Mp?=I^=_$;%jHDHZKxx{bphqum6?(11Cqmh83Qi)uaRmSggh?dH%r zoI~@-y=80|^R~)MGS0YgaEh7UG?oeK%SrX6nZ1h6a+U6Qm1U9qNj1$+U>)ERdGkBS zyF&kjuQUbZ(rS(;WO<0|z2^hrp#}-pao|zy8{Y#=?MUYSV&1mE7ke;?q#@8?~M{PG_^zmR#BEcPM} z$Jt2bAu}i(fT~6;{s>6>aCR3*6_xk1Y+=mg=QjA5o~k-ZgE|@OtLwfyWN}U6ZyJhW zhkQ{XGGeV2BY7DmIW9~=QZe)=dgJjVn0d2qa|T|3VtEL$Bn(I6dr?aA34c7+28d2ar)Z$=j=G2}uL(ka`ST$bN)0 zyTbImjx^iDvZ$ZNPT^h$-zZLRq-HR_#Q248n zuOR#s?3tm9GKNyjBVHPSdk*zBta8~+t$^%zlO>gQw;IWde9doxjE{^6RJ5?jH& z8I-0NP6@aYsZF!fcOcR>>7$N5vM1J(FmI6oQUx*0d-fYJS}I4TCdHBSw>Z!++U&uW`SibRe>R}$seP6s?RXdsGSimhxJ3^Kh2MLGb5y5=V>f- z02nSM%-U-|Oyi8rMY!o{8a`~Y5=fWw1)v@2`pL6Q_&21{ftB}s4-EZBud2Z$NojtG z>aT7;v(liwfu)`tMW$Wg8Y0IGi|BSqCM~25>mWDiPHD%!(k}=*oS%f3-D_pHM=gJdDoc#j5io zTL;!9!aGewta-`5b7JS!*Ek7>xs`r0?41*SHdG5eC!28iuZuj1gD2|Y z!YRnTfIf_XS_B(hDDMZHhHvI}_OAUyz2||RJ&!NFd|?5xRNgUR>%`E~7D|^`f;*k*Emxi$~ge!SV;9|c8n02S+O3^^IW zT};<^;|GkUHM<*CFap26J|j_ zd(y!3IfKapOiq~4%BLcS>M~0;uI4=#GxO1vrnpm&RoF~FM#nbsnw(f`D8*tb{mpb|@L;qea5EmLl~-Arz~z=OyjN zG8n|(js@rlUB0xGs=b44GFtV#>PDNwDjwT%?av)1e~t}Bzx1}P&5u8gVLnO(xhXD- zuRTX&-CfQSk=tP4^bpa^5>Hmqj8)M-GIJtqb2M@`eiaAp2~^0}ZMrPVXd6FjHasMW$ODMZk?2A`LeDU&zm!&W z>)J1OQ7vfFq*{aC*l}lc=Vee~-$%y`WEP6YI7RUwk#))21YgnY@U;(8|C1)!qL+1a zsyyuH|37~GaQ#E?{Qu3z<^2DbNX*l+PV*2H+qvuwZ@rt#o9{2*U#vR%f`xf9?}}IE zd7a;lHI-Mdy`Lk%Dd}PXm~&R7%EG7$c!*8GgKHuTQGw!k5Bmu8V5x?a_+%anKQVc8 zlf?V`PrrCYUe+=Or{H>$p<`w0L*{SPy2_;)nCox7t)EoUMW;x-M9iw^+lZ>CA97E5 z;PX^VZvbACvCvb`g~@Cw^7}#ijRxYeSUU za3X9;Y#@`lKo5}*)_&(*{ywg7-M5jOod#A;{x?-!>-N`fZL~4Pb_YXDM3B;XmrIA% zDHkEmkWsZkYD4*+#NNhd<5u+sf3dsKfPpmA;qi z_eVOYUFTREyzinr-YR#FK?<)=%esmOdDd z*l1(PC`2ZNG>0Z5_sV&XQ6p%WReR#4XSXZ#LuXM%I5hdAMp|(%;9sJ*FhBol% zUz<3S@%Qwg^ueZy>McOxgtx}vE4u#a^X*V6z={zY_Rl=zm;cRoYRf1At2qJtXc$ba zo&N!a2@WN6sd|{FZHNv~Z$k`M8YV;MBaMz64TV8!zUPQB)yf7W+thSsR*sW8@}|{} zwo&2NkpqM4MJqJ{_CrkjhH3B01ZDa|aN)ll*>r&*JZtr#BU&94GoT#89?BT@W}x19 z8?q6qLsdjsXyfeaP_-)PI-)`B)Q_2R@?eu5JVf^xHgH7A1R^v<82h^plz2M{(pD-twPFV#%?*pksEmU(D0Z#+bs<@>?1jtk;gU_^p`tm`OM#7`myQ5C%c`^V>Uit*JY2tTlJ0T;0gHo~ zi~T1T0#P2Am;us7Bk@2UyyWPaPw(3@PnD@2jiWRVVa8u+FG(0Eo(K`{FaLC>%Z~-? z-@h;!aWE9x5m^%(EueX!ZEIysryCH}T^B(f@?h?rUJujl|AxWOl5f2hb^Lz5rXWm2P?S1&e_cjp< zz^n4)fSz68`Y%p^JYh~-o7)`g0gd~XMZP@bha}{gM79BYMa&)V@;vXY;_d0OT$0;)r$K6kv$7qXwOdc-NRELQyb7g+I zweOzUa^I@H{;|V^)lIcqrd3B?S5W`2C#f%Vg5p&T|pT?TkQeD%7aX>w{^5;C7rH*_c7 zl!5PvIa=vC;*M5)j=1BEPDkL;T5t&0MH9B}3?I45)Lm8KUgQ}K*r7|-ruJSZ%&|tK zBk;6t<^VjYo7r&N0S(UGfJ5rKfvh`q2$yc$zh0`-cORsl;rqhSzcDzg`}i{tbKrX+ z?Pv#WU78RGV#F|hTzl6T%CFbYcOdjA;bG=1zKf#G_2epb7S-tga3!ZBu1{4^Cx)U3 z;s-=_A_cKk!9EJzGRF<|p_~T`xoV=h*A%nw2X%Z8LoYNiaQYD69YVVDkC%tNsciBS z@r3a%*e5M6EB)BQO(@ci_t?QAbt7h*AVd**_{KV{7}eyk0>REh9UA8pI=eRd2$zdC zRke?j#DUJu$#ujIW@~Rzu*KU6OcV3!1T-1grfxIt>$-5vLa+pRnifg)xTZci%-h;& zb(Nr&$!))R@~-ZLZSA35S~fG%Q0MxNMY$X374o177_|~NIpWu@*z)Ua^mVD~yhLjc<0(jeKVqO^T-_PyDU1Lov8<{d;yT#t>G%~6-R=Wx z*f4)EK=WI7#hE%i6%pb4gP}&8ATR9vCUr#b#fp>f-qKwb7?opb=v8x_2@ZIwbz1EV z)GcB#YH$|~s7>qixC)eEK;f71|M})a2n|Ei1ni{anl{JQL1e1Gj#ZezTX+HpK44f> zN2j#Jsf(j3YAB#h^16;I-GMwzQmO*}!<^Ma_z%dd2jG{IsEAa7BkY=4Ngf zZT&-1GndSxNhB%<>wYHarwXT-kh^-;>>fhHpy9-13dLJ1uI6H!s@gY)j@^e3#zJ8RFyy+0!JjA9K-(CYR*O#tR=6k;xVG@qiT19PY{{ zoLL_xk2982jJzg5`q>gF>jmN(y@AFtxFnlBw{fifJv-Ok8}$$wx7u4%=CJ!?$9yUG zaRF*M+vWqll0ObnRjmGvD(DVANQy3*+%-Fp(g4oFyqY}Hgg6I=`ZeE@fIirA- zbw>wUwGGJ_7Y;4rb!2TBTZ7f^TUy9svsvtnX49z0$8Nqvg$!LP+D8ctMw|J)T7}WQ zx&|?Lq7)(!9PZ1T++09O%?^{TVYEn+g9A-+PjhZv=9Z%2XB)6oR*EFg3nwVIEU|E4 zQj}H~fRI^S#UVw84KC67QsoGS!4-Os!(|QLW0KopP4@eF6cbr({*&}Hx+ z#q`B`2fq%tU0+jsbDp7fyy}^-E%ze_GFJ&y?GygCF4ZL+aD{-%u6U4+tuAt*wSHs^ zPd8$6vdrR#p($&BfZ>>IERc@A7($D)ypFd|c9%_@?IYC4p%TqBP$OB&`Q14!fQ>lT%n`8dzt_1ZE|o8GNWZjWJJUvzYR4Yyz+R zbmMnK9>mU~BvPm5A)m{ap^$g)->h0fW}Dm>9j4w@n`S2F&d|Nr#Hq4lGHm

zF=hd7$z-_mYP{R!V)a@jY>tbK%8G`<;O-J5vuxe45#?Yt>L|rf9Lie`S=+=+)FKqp zm0p;9Ee7g@2Cmn1!D;dsaDe9X2J4n~(ff?W-E8tc=>csnS!HY#uclCIO0i8{g&07u z__!6t>G2Mnm@cw4Xf(4&UsGW9N}bl;=vj-nIcjL{A&1QxGMv_uA*_@P;-Z~e$cz+$or`#mL7Vm8kvkew=;$FEVO&} z<|&nPnP+L`I%<>6LFA3$Au*MgARtta%3IgjZ=L02#x{;^-E zA$R?lV@2Zx=XMf6_Vv!O4vphWlGVUq*eo@AZfb`MW< zE+J)C{S%<(YUkFGB!1Sy>G;x=6BoAi#cV)>_f_^QAE&NfCn_gXWr z9gl#O7b)_+*_KOGP-;6d4|`?Df232R8!=%CY_P<2*y1@l>dAN%qSl;BVijtK?DlVz z)Z9!gBr)hJM;~AFdDCwGed9*b-`c1}Fr-4QJ9MRsdgLZH`Fkr^=-)BVZ8Ft-Hr^?gtFCc=N|d6u^rl=ood$; zV72?XpxXV;%6i0ImGy|zOuEtz&{+?Q)$Vsu>W1pX+iH)yDz|?P^q5Sw!N8-!ZKvN^ zJK?U{WACV)?{3<;!k_!#nq)zC&XtK?CkN)HL8{N+(#9f7vpBPi^KMh zVSBnEXhoHEH|w=gX`PL9qmnE{ZEv^jZdZ};acVPuT&{^8;vI8q z^$^wwz4hj;_gnKxay72nbehjqZp2Jd8$KcEj0rO>sH4i!673z*8Ri){Amm`sj>**R zNRX3gNOwERg=n2B!zthN?@XW-lRP!X)=Y|x-2P5zL$`bdaCDMVz1*Jc+jjQv|6O0- ze7x>{|L^*To8|j|Um{(hZFcqRCHtZeeH|3LMD$qmPuQ&wpSZ#=KQ%*;UsYbchp~Hg zsLHD(-r#(A#c-}JzdL*P&KXTCdihs%5LE}te&&G&Yqi0f3ov;M-XYwabqCC=nTklB zUMeV11hdtefz5>`ss8(aum0yd=IEcd!QY{ax~gX@F-PT}ESeiO%kT5#kVfyui$eJ> zU;|x|kjprqt)o(}njQ8u#XLnR^B@lA!mCukd9+Add(PgUlpN+8u?;j|_VV9pDqH#N z9!HOAF{zw`a=rN1GiR(oe0zcf(BN>Tay%UN&ZAIPSNA@X9Y%gJBv+s&wuj0ifLfxO z1q-0ASgC)-`(m9zMevdiQc_ije)-+6_@xAQA+m2S3$i%3`8 zy%3FUFMabLrG%}TiesKYVF_ft-a1-s>EUP9Ugj+3QDOprW?d#=XIE(*;NvwLm_~ig zHmYB<&?#9~0-RuB7@(%vP^NMTf+=doSh!y=i#Qx*E)Kw ## diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te -index 1d732f1e7..9823c5a68 100644 +index 1d732f1e7..ae2fa67f8 100644 --- a/policy/modules/admin/usermanage.te +++ b/policy/modules/admin/usermanage.te @@ -26,6 +26,7 @@ type chfn_exec_t; @@ -3376,7 +3376,7 @@ index 1d732f1e7..9823c5a68 100644 # -allow passwd_t self:capability { chown dac_override fsetid setuid setgid sys_nice sys_resource }; -+allow passwd_t self:capability { chown dac_read_search dac_read_search ipc_lock fsetid setuid setgid sys_nice sys_resource sys_admin }; ++allow passwd_t self:capability { chown dac_read_search dac_override ipc_lock fsetid setuid setgid sys_nice sys_resource sys_admin }; dontaudit passwd_t self:capability sys_tty_config; allow passwd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow passwd_t self:process { setrlimit setfscreate }; @@ -35722,7 +35722,7 @@ index e4376aa98..2c98c5647 100644 + allow $1 getty_unit_file_t:service start; +') diff --git a/policy/modules/system/getty.te b/policy/modules/system/getty.te -index f6743ea19..abcc39a8c 100644 +index f6743ea19..8c64a7e19 100644 --- a/policy/modules/system/getty.te +++ b/policy/modules/system/getty.te @@ -27,13 +27,24 @@ files_tmp_file(getty_tmp_t) @@ -35747,7 +35747,7 @@ index f6743ea19..abcc39a8c 100644 # Use capabilities. -allow getty_t self:capability { dac_override chown setgid sys_resource sys_tty_config fowner fsetid }; -+allow getty_t self:capability { dac_read_search chown setgid sys_resource sys_tty_config fowner fsetid }; ++allow getty_t self:capability { dac_read_search dac_override chown setgid sys_resource sys_tty_config fowner fsetid }; dontaudit getty_t self:capability sys_tty_config; allow getty_t self:process { getpgid setpgid getsession signal_perms }; allow getty_t self:fifo_file rw_fifo_file_perms; @@ -41173,7 +41173,7 @@ index 0e3c2a977..ea9bd57dc 100644 + userdom_admin_home_dir_filetrans($1, local_login_home_t, file, ".hushlogin") +') diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te -index 446fa9908..a0d1b1ff7 100644 +index 446fa9908..31ffd73ab 100644 --- a/policy/modules/system/locallogin.te +++ b/policy/modules/system/locallogin.te @@ -13,9 +13,8 @@ auth_login_entry_type(local_login_t) @@ -41208,7 +41208,7 @@ index 446fa9908..a0d1b1ff7 100644 -allow local_login_t self:capability { dac_override chown fowner fsetid kill setgid setuid sys_nice sys_resource sys_tty_config }; -allow local_login_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; -allow local_login_t self:process { setrlimit setexec }; -+allow local_login_t self:capability { dac_read_search chown fowner fsetid kill setgid setuid sys_admin sys_nice sys_resource sys_tty_config }; ++allow local_login_t self:capability { dac_read_search dac_override chown fowner fsetid kill setgid setuid sys_admin sys_nice sys_resource sys_tty_config }; +allow local_login_t self:process ~{ ptrace setcurrent setfscreate execmem execstack execheap }; allow local_login_t self:fd use; allow local_login_t self:fifo_file rw_fifo_file_perms; @@ -50091,10 +50091,10 @@ index 000000000..634d9596a +') diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te new file mode 100644 -index 000000000..3660fe1c4 +index 000000000..e83a61cca --- /dev/null +++ b/policy/modules/system/systemd.te -@@ -0,0 +1,1025 @@ +@@ -0,0 +1,1027 @@ +policy_module(systemd, 1.0.0) + +####################################### @@ -50582,7 +50582,7 @@ index 000000000..3660fe1c4 +# Local policy +# + -+allow systemd_tmpfiles_t self:capability { chown dac_read_search fsetid fowner mknod sys_admin }; ++allow systemd_tmpfiles_t self:capability { chown dac_read_search dac_override fsetid fowner mknod sys_admin }; +allow systemd_tmpfiles_t self:process { setfscreate }; + +allow systemd_tmpfiles_t self:unix_dgram_socket create_socket_perms; @@ -51029,6 +51029,8 @@ index 000000000..3660fe1c4 +dev_read_sysfs(systemd_resolved_t) + +sysnet_manage_config(systemd_resolved_t) ++sysnet_filetrans_config_fromdir(systemd_resolved_t,systemd_resolved_var_run_t, file, "resolv.conf") ++sysnet_filetrans_config_fromdir(systemd_resolved_t,systemd_resolved_var_run_t, file, "resolv.conf.tmp") + +userdom_dbus_send_all_users(systemd_resolved_t) + diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index a5dfd76c..55371764 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -111760,10 +111760,10 @@ index 000000000..368e18842 +') diff --git a/tlp.te b/tlp.te new file mode 100644 -index 000000000..761cc35b0 +index 000000000..1ef713150 --- /dev/null +++ b/tlp.te -@@ -0,0 +1,80 @@ +@@ -0,0 +1,84 @@ +policy_module(tlp, 1.0.0) + +######################################## @@ -111844,6 +111844,10 @@ index 000000000..761cc35b0 +optional_policy(` + mount_domtrans(tlp_t) +') ++ ++optional_policy(` ++ sssd_stream_connect(tlp_t) ++') diff --git a/tmpreaper.te b/tmpreaper.te index 585a77f95..9858c8b8d 100644 --- a/tmpreaper.te diff --git a/selinux-policy.spec b/selinux-policy.spec index bad78440..bbbab847 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 288%{?dist} +Release: 289%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -682,6 +682,11 @@ exit 0 %endif %changelog +* Wed Sep 27 2017 Lukas Vrabec - 3.13.1-289 +- Allow tlp_t domain stream connect to sssd_t domain +- Add missing dac_override capability +- Add systemd_tmpfiles_t dac_override capability + * Fri Sep 22 2017 Lukas Vrabec - 3.13.1-288 - Remove all unnecessary dac_override capability in SELinux modules