rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- virsh now does a setexeccon call 

- Additional rules required by openshift domains
- Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-serv
- Allow spamd_update_t to search spamc_home_t
- Avcs discovered by mounting an isci device under /mnt
- Allow lspci running as logrotate to read pci.ids
- Additional fix for networkmanager_read_pid_files()
- Fix networkmanager_read_pid_files() interface
- Allow all svirt domains to connect to svirt_socket_t
- Allow virsh to set SELinux context for a process.
- Allow tuned to create netlink_kobject_uevent_socket
- Allow systemd-timestamp to set SELinux context
- Add support for /var/lib/systemd/linger
- Fix ssh_sysadm_login to be working on MLS as expected
This commit is contained in:
Miroslav Grepl 2013-02-14 19:06:59 +01:00
parent 79355670f4
commit 2599f2f590
3 changed files with 296 additions and 130 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

140
policy-rawhide-base.patch
View File

@ -220921,7 +220921,7 @@ index fe0c682..da12170 100644
+ allow $1 sshd_devpts_t:chr_file rw_inherited_chr_file_perms; + allow $1 sshd_devpts_t:chr_file rw_inherited_chr_file_perms;
+') +')
diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te
index 5fc0391..94900fb 100644 index 5fc0391..386c48c 100644
--- a/policy/modules/services/ssh.te --- a/policy/modules/services/ssh.te
+++ b/policy/modules/services/ssh.te +++ b/policy/modules/services/ssh.te
@@ -6,44 +6,51 @@ policy_module(ssh, 2.3.3) @@ -6,44 +6,51 @@ policy_module(ssh, 2.3.3)
@ -221187,7 +221187,6 @@ index 5fc0391..94900fb 100644
+userdom_spec_domtrans_unpriv_users(sshd_t) +userdom_spec_domtrans_unpriv_users(sshd_t)
+userdom_signal_unpriv_users(sshd_t) +userdom_signal_unpriv_users(sshd_t)
+userdom_dyntransition_unpriv_users(sshd_t) +userdom_dyntransition_unpriv_users(sshd_t)
+userdom_dyntransition_admin_users(sshd_t)
+ +
tunable_policy(`ssh_sysadm_login',` tunable_policy(`ssh_sysadm_login',`
# Relabel and access ptys created by sshd # Relabel and access ptys created by sshd
@ -221200,6 +221199,7 @@ index 5fc0391..94900fb 100644
- userdom_spec_domtrans_unpriv_users(sshd_t) - userdom_spec_domtrans_unpriv_users(sshd_t)
- userdom_signal_unpriv_users(sshd_t) - userdom_signal_unpriv_users(sshd_t)
+ userdom_spec_domtrans_all_users(sshd_t) + userdom_spec_domtrans_all_users(sshd_t)
+ userdom_dyntransition_admin_users(sshd_t)
+') +')
+ +
+optional_policy(` +optional_policy(`
@ -226158,7 +226158,7 @@ index bb5c4a6..7ebb938 100644
') ')
diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
index 9a4d3a7..b7b205c 100644 index 9a4d3a7..9d960bb 100644
--- a/policy/modules/system/init.fc --- a/policy/modules/system/init.fc
+++ b/policy/modules/system/init.fc +++ b/policy/modules/system/init.fc
@@ -1,6 +1,9 @@ @@ -1,6 +1,9 @@
@ -226183,7 +226183,7 @@ index 9a4d3a7..b7b205c 100644
/sbin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0) /sbin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0)
# because nowadays, /sbin/init is often a symlink to /sbin/upstart # because nowadays, /sbin/init is often a symlink to /sbin/upstart
/sbin/upstart -- gen_context(system_u:object_r:init_exec_t,s0) /sbin/upstart -- gen_context(system_u:object_r:init_exec_t,s0)
@@ -42,11 +50,23 @@ ifdef(`distro_gentoo', ` @@ -42,19 +50,33 @@ ifdef(`distro_gentoo', `
# #
/usr/bin/sepg_ctl -- gen_context(system_u:object_r:initrc_exec_t,s0) /usr/bin/sepg_ctl -- gen_context(system_u:object_r:initrc_exec_t,s0)
@ -226207,7 +226207,9 @@ index 9a4d3a7..b7b205c 100644
# #
# /var # /var
@@ -55,6 +75,7 @@ ifdef(`distro_gentoo', ` #
+/var/lib/systemd(/.*)? gen_context(system_u:object_r:init_var_lib_t,s0)
/var/run/utmp -- gen_context(system_u:object_r:initrc_var_run_t,s0)
/var/run/runlevel\.dir gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/runlevel\.dir gen_context(system_u:object_r:initrc_var_run_t,s0)
/var/run/random-seed -- gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/random-seed -- gen_context(system_u:object_r:initrc_var_run_t,s0)
/var/run/setmixer_flag -- gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/setmixer_flag -- gen_context(system_u:object_r:initrc_var_run_t,s0)
@ -226215,13 +226217,13 @@ index 9a4d3a7..b7b205c 100644
ifdef(`distro_debian',` ifdef(`distro_debian',`
/var/run/hotkey-setup -- gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/hotkey-setup -- gen_context(system_u:object_r:initrc_var_run_t,s0)
@@ -73,3 +94,4 @@ ifdef(`distro_suse', ` @@ -73,3 +95,4 @@ ifdef(`distro_suse', `
/var/run/setleds-on -- gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/setleds-on -- gen_context(system_u:object_r:initrc_var_run_t,s0)
/var/run/sysconfig(/.*)? gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/sysconfig(/.*)? gen_context(system_u:object_r:initrc_var_run_t,s0)
') ')
+/var/run/systemd(/.*)? gen_context(system_u:object_r:init_var_run_t,s0) +/var/run/systemd(/.*)? gen_context(system_u:object_r:init_var_run_t,s0)
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 24e7804..386109d 100644 index 24e7804..c0ec978 100644
--- a/policy/modules/system/init.if --- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if +++ b/policy/modules/system/init.if
@@ -106,6 +106,8 @@ interface(`init_domain',` @@ -106,6 +106,8 @@ interface(`init_domain',`
@ -226458,7 +226460,7 @@ index 24e7804..386109d 100644
') ')
######################################## ########################################
@@ -566,6 +622,24 @@ interface(`init_sigchld',` @@ -566,6 +622,58 @@ interface(`init_sigchld',`
######################################## ########################################
## <summary> ## <summary>
@ -226479,11 +226481,45 @@ index 24e7804..386109d 100644
+') +')
+ +
+######################################## +########################################
+## <summary>
+## Create objects in the init_var_lib_t directories
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="file_type">
+## <summary>
+## The type of the object to be created
+## </summary>
+## </param>
+## <param name="object_class">
+## <summary>
+## The object class.
+## </summary>
+## </param>
+## <param name="name" optional="true">
+## <summary>
+## The name of the object being created.
+## </summary>
+## </param>
+#
+interface(`init_var_lib_filetrans',`
+ gen_require(`
+ type init_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ filetrans_pattern($1, init_var_lib_t, $2, $3, $4)
+')
+
+########################################
+## <summary> +## <summary>
## Connect to init with a unix socket. ## Connect to init with a unix socket.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -576,10 +650,66 @@ interface(`init_sigchld',` @@ -576,10 +684,66 @@ interface(`init_sigchld',`
# #
interface(`init_stream_connect',` interface(`init_stream_connect',`
gen_require(` gen_require(`
@ -226552,7 +226588,7 @@ index 24e7804..386109d 100644
') ')
######################################## ########################################
@@ -743,22 +873,23 @@ interface(`init_write_initctl',` @@ -743,22 +907,23 @@ interface(`init_write_initctl',`
interface(`init_telinit',` interface(`init_telinit',`
gen_require(` gen_require(`
type initctl_t; type initctl_t;
@ -226585,7 +226621,7 @@ index 24e7804..386109d 100644
') ')
######################################## ########################################
@@ -787,7 +918,7 @@ interface(`init_rw_initctl',` @@ -787,7 +952,7 @@ interface(`init_rw_initctl',`
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@ -226594,7 +226630,7 @@ index 24e7804..386109d 100644
## </summary> ## </summary>
## </param> ## </param>
# #
@@ -830,11 +961,12 @@ interface(`init_script_file_entry_type',` @@ -830,11 +995,12 @@ interface(`init_script_file_entry_type',`
# #
interface(`init_spec_domtrans_script',` interface(`init_spec_domtrans_script',`
gen_require(` gen_require(`
@ -226609,7 +226645,7 @@ index 24e7804..386109d 100644
ifdef(`distro_gentoo',` ifdef(`distro_gentoo',`
gen_require(` gen_require(`
@@ -845,11 +977,11 @@ interface(`init_spec_domtrans_script',` @@ -845,11 +1011,11 @@ interface(`init_spec_domtrans_script',`
') ')
ifdef(`enable_mcs',` ifdef(`enable_mcs',`
@ -226623,7 +226659,7 @@ index 24e7804..386109d 100644
') ')
') ')
@@ -865,19 +997,41 @@ interface(`init_spec_domtrans_script',` @@ -865,19 +1031,41 @@ interface(`init_spec_domtrans_script',`
# #
interface(`init_domtrans_script',` interface(`init_domtrans_script',`
gen_require(` gen_require(`
@ -226669,7 +226705,7 @@ index 24e7804..386109d 100644
') ')
######################################## ########################################
@@ -933,9 +1087,14 @@ interface(`init_script_file_domtrans',` @@ -933,9 +1121,14 @@ interface(`init_script_file_domtrans',`
interface(`init_labeled_script_domtrans',` interface(`init_labeled_script_domtrans',`
gen_require(` gen_require(`
type initrc_t; type initrc_t;
@ -226684,7 +226720,7 @@ index 24e7804..386109d 100644
files_search_etc($1) files_search_etc($1)
') ')
@@ -1026,7 +1185,9 @@ interface(`init_ptrace',` @@ -1026,7 +1219,9 @@ interface(`init_ptrace',`
type init_t; type init_t;
') ')
@ -226695,7 +226731,7 @@ index 24e7804..386109d 100644
') ')
######################################## ########################################
@@ -1125,6 +1286,25 @@ interface(`init_getattr_all_script_files',` @@ -1125,6 +1320,25 @@ interface(`init_getattr_all_script_files',`
######################################## ########################################
## <summary> ## <summary>
@ -226721,7 +226757,7 @@ index 24e7804..386109d 100644
## Read all init script files. ## Read all init script files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -1144,6 +1324,24 @@ interface(`init_read_all_script_files',` @@ -1144,6 +1358,24 @@ interface(`init_read_all_script_files',`
####################################### #######################################
## <summary> ## <summary>
@ -226746,7 +226782,7 @@ index 24e7804..386109d 100644
## Dontaudit read all init script files. ## Dontaudit read all init script files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -1195,12 +1393,7 @@ interface(`init_read_script_state',` @@ -1195,12 +1427,7 @@ interface(`init_read_script_state',`
') ')
kernel_search_proc($1) kernel_search_proc($1)
@ -226760,7 +226796,7 @@ index 24e7804..386109d 100644
') ')
######################################## ########################################
@@ -1440,6 +1633,27 @@ interface(`init_dbus_send_script',` @@ -1440,6 +1667,27 @@ interface(`init_dbus_send_script',`
######################################## ########################################
## <summary> ## <summary>
## Send and receive messages from ## Send and receive messages from
@ -226788,7 +226824,7 @@ index 24e7804..386109d 100644
## init scripts over dbus. ## init scripts over dbus.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -1526,6 +1740,25 @@ interface(`init_getattr_script_status_files',` @@ -1526,6 +1774,25 @@ interface(`init_getattr_script_status_files',`
######################################## ########################################
## <summary> ## <summary>
@ -226814,7 +226850,7 @@ index 24e7804..386109d 100644
## Do not audit attempts to read init script ## Do not audit attempts to read init script
## status files. ## status files.
## </summary> ## </summary>
@@ -1584,6 +1817,24 @@ interface(`init_rw_script_tmp_files',` @@ -1584,6 +1851,24 @@ interface(`init_rw_script_tmp_files',`
######################################## ########################################
## <summary> ## <summary>
@ -226839,14 +226875,16 @@ index 24e7804..386109d 100644
## Create files in a init script ## Create files in a init script
## temporary data directory. ## temporary data directory.
## </summary> ## </summary>
@@ -1656,6 +1907,43 @@ interface(`init_read_utmp',` @@ -1656,11 +1941,48 @@ interface(`init_read_utmp',`
######################################## ########################################
## <summary> ## <summary>
-## Do not audit attempts to write utmp.
+## Read utmp. +## Read utmp.
+## </summary> ## </summary>
+## <param name="domain"> ## <param name="domain">
+## <summary> ## <summary>
-## Domain to not audit.
+## Domain allowed access. +## Domain allowed access.
+## </summary> +## </summary>
+## </param> +## </param>
@ -226880,10 +226918,15 @@ index 24e7804..386109d 100644
+ +
+######################################## +########################################
+## <summary> +## <summary>
## Do not audit attempts to write utmp. +## Do not audit attempts to write utmp.
## </summary> +## </summary>
## <param name="domain"> +## <param name="domain">
@@ -1744,7 +2032,7 @@ interface(`init_dontaudit_rw_utmp',` +## <summary>
+## Domain to not audit.
## </summary>
## </param>
#
@@ -1744,7 +2066,7 @@ interface(`init_dontaudit_rw_utmp',`
type initrc_var_run_t; type initrc_var_run_t;
') ')
@ -226892,11 +226935,10 @@ index 24e7804..386109d 100644
') ')
######################################## ########################################
@@ -1785,7 +2073,134 @@ interface(`init_pid_filetrans_utmp',` @@ -1785,6 +2107,133 @@ interface(`init_pid_filetrans_utmp',`
files_pid_filetrans($1, initrc_var_run_t, file, "utmp") files_pid_filetrans($1, initrc_var_run_t, file, "utmp")
') ')
-########################################
+###################################### +######################################
+## <summary> +## <summary>
+## Allow search directory in the /run/systemd directory. +## Allow search directory in the /run/systemd directory.
@ -227024,11 +227066,10 @@ index 24e7804..386109d 100644
+ filetrans_pattern($1, init_var_run_t, $2, $3, $4) + filetrans_pattern($1, init_var_run_t, $2, $3, $4)
+') +')
+ +
+######################################## ########################################
## <summary> ## <summary>
## Allow the specified domain to connect to daemon with a tcp socket ## Allow the specified domain to connect to daemon with a tcp socket
## </summary> @@ -1819,3 +2268,283 @@ interface(`init_udp_recvfrom_all_daemons',`
@@ -1819,3 +2234,283 @@ interface(`init_udp_recvfrom_all_daemons',`
') ')
corenet_udp_recvfrom_labeled($1, daemon) corenet_udp_recvfrom_labeled($1, daemon)
') ')
@ -227313,7 +227354,7 @@ index 24e7804..386109d 100644
+ allow $1 init_t:system undefined; + allow $1 init_t:system undefined;
+') +')
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index dd3be8d..b8592b4 100644 index dd3be8d..4d9b509 100644
--- a/policy/modules/system/init.te --- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te +++ b/policy/modules/system/init.te
@@ -11,10 +11,24 @@ gen_require(` @@ -11,10 +11,24 @@ gen_require(`
@ -227380,10 +227421,10 @@ index dd3be8d..b8592b4 100644
files_pid_file(init_var_run_t) files_pid_file(init_var_run_t)
# #
+# init_var_lib_t is the type for /var/lib/random-seed +# init_var_lib_t is the type for /var/lib/systemd
+# +#
+type init_var_lib_t; +type init_var_lib_t;
+files_pid_file(init_var_lib_t) +files_type(init_var_lib_t)
+ +
+type machineid_t; +type machineid_t;
+files_config_file(machineid_t) +files_config_file(machineid_t)
@ -234737,10 +234778,10 @@ index b7686d5..9a50b11 100644
+') +')
diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
new file mode 100644 new file mode 100644
index 0000000..4221a94 index 0000000..595f756
--- /dev/null --- /dev/null
+++ b/policy/modules/system/systemd.fc +++ b/policy/modules/system/systemd.fc
@@ -0,0 +1,38 @@ @@ -0,0 +1,39 @@
+/bin/systemd-notify -- gen_context(system_u:object_r:systemd_notify_exec_t,s0) +/bin/systemd-notify -- gen_context(system_u:object_r:systemd_notify_exec_t,s0)
+/bin/systemctl -- gen_context(system_u:object_r:systemd_systemctl_exec_t,s0) +/bin/systemctl -- gen_context(system_u:object_r:systemd_systemctl_exec_t,s0)
+/bin/systemd-tty-ask-password-agent -- gen_context(system_u:object_r:systemd_passwd_agent_exec_t,s0) +/bin/systemd-tty-ask-password-agent -- gen_context(system_u:object_r:systemd_passwd_agent_exec_t,s0)
@ -234768,6 +234809,7 @@ index 0000000..4221a94
+/usr/lib/systemd/systemd-logger -- gen_context(system_u:object_r:systemd_logger_exec_t,s0) +/usr/lib/systemd/systemd-logger -- gen_context(system_u:object_r:systemd_logger_exec_t,s0)
+/usr/lib/systemd/systemd-tmpfiles -- gen_context(system_u:object_r:systemd_tmpfiles_exec_t,s0) +/usr/lib/systemd/systemd-tmpfiles -- gen_context(system_u:object_r:systemd_tmpfiles_exec_t,s0)
+ +
+/var/lib/systemd/linger(/.*)? gen_context(system_u:object_r:systemd_logind_var_lib_t,mls_systemhigh)
+/var/lib/random-seed gen_context(system_u:object_r:random_seed_t,mls_systemhigh) +/var/lib/random-seed gen_context(system_u:object_r:random_seed_t,mls_systemhigh)
+/usr/var/lib/random-seed gen_context(system_u:object_r:random_seed_t,mls_systemhigh) +/usr/var/lib/random-seed gen_context(system_u:object_r:random_seed_t,mls_systemhigh)
+ +
@ -235828,10 +235870,10 @@ index 0000000..a4b0917
+ +
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644 new file mode 100644
index 0000000..1131866 index 0000000..c0a85ab
--- /dev/null --- /dev/null
+++ b/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te
@@ -0,0 +1,616 @@ @@ -0,0 +1,624 @@
+policy_module(systemd, 1.0.0) +policy_module(systemd, 1.0.0)
+ +
+####################################### +#######################################
@ -235855,6 +235897,9 @@ index 0000000..1131866
+type systemd_logind_sessions_t; +type systemd_logind_sessions_t;
+files_pid_file(systemd_logind_sessions_t) +files_pid_file(systemd_logind_sessions_t)
+ +
+type systemd_logind_var_lib_t;
+files_type(systemd_logind_var_lib_t)
+
+# /run/systemd/{seats, users} +# /run/systemd/{seats, users}
+type systemd_logind_var_run_t; +type systemd_logind_var_run_t;
+files_pid_file(systemd_logind_var_run_t) +files_pid_file(systemd_logind_var_run_t)
@ -235918,13 +235963,17 @@ index 0000000..1131866
+ +
+# dac_override is for /run/user/$USER ($USER ownership is $USER:$USER) +# dac_override is for /run/user/$USER ($USER ownership is $USER:$USER)
+allow systemd_logind_t self:capability { chown kill dac_override fowner sys_tty_config }; +allow systemd_logind_t self:capability { chown kill dac_override fowner sys_tty_config };
+allow systemd_logind_t self:process getcap; +allow systemd_logind_t self:process { getcap };
+allow systemd_logind_t self:netlink_kobject_uevent_socket create_socket_perms; +allow systemd_logind_t self:netlink_kobject_uevent_socket create_socket_perms;
+allow systemd_logind_t self:unix_dgram_socket create_socket_perms; +allow systemd_logind_t self:unix_dgram_socket create_socket_perms;
+ +
+mls_file_read_all_levels(systemd_logind_t) +mls_file_read_all_levels(systemd_logind_t)
+mls_file_write_all_levels(systemd_logind_t) +mls_file_write_all_levels(systemd_logind_t)
+ +
+manage_dirs_pattern(systemd_logind_t, systemd_logind_var_lib_t, systemd_logind_var_lib_t)
+manage_files_pattern(systemd_logind_t, systemd_logind_var_lib_t, systemd_logind_var_lib_t)
+init_var_lib_filetrans(systemd_logind_t, systemd_logind_var_lib_t, dir, "linger")
+
+manage_dirs_pattern(systemd_logind_t, { systemd_logind_sessions_t systemd_logind_var_run_t }, { systemd_logind_sessions_t systemd_logind_var_run_t }) +manage_dirs_pattern(systemd_logind_t, { systemd_logind_sessions_t systemd_logind_var_run_t }, { systemd_logind_sessions_t systemd_logind_var_run_t })
+manage_files_pattern(systemd_logind_t, { systemd_logind_sessions_t systemd_logind_var_run_t }, { systemd_logind_var_run_t systemd_logind_sessions_t }) +manage_files_pattern(systemd_logind_t, { systemd_logind_sessions_t systemd_logind_var_run_t }, { systemd_logind_var_run_t systemd_logind_sessions_t })
+manage_fifo_files_pattern(systemd_logind_t, systemd_logind_sessions_t, { systemd_logind_sessions_t systemd_logind_var_run_t }) +manage_fifo_files_pattern(systemd_logind_t, systemd_logind_sessions_t, { systemd_logind_sessions_t systemd_logind_var_run_t })
@ -236002,7 +236051,6 @@ index 0000000..1131866
+logging_send_syslog_msg(systemd_logind_t) +logging_send_syslog_msg(systemd_logind_t)
+logging_stream_connect_syslog(systemd_logind_t) +logging_stream_connect_syslog(systemd_logind_t)
+ +
+
+udev_read_db(systemd_logind_t) +udev_read_db(systemd_logind_t)
+udev_manage_rules_files(systemd_logind_t) +udev_manage_rules_files(systemd_logind_t)
+ +
@ -236350,7 +236398,7 @@ index 0000000..1131866
+# Timedated policy +# Timedated policy
+# +#
+allow systemd_timedated_t self:capability { sys_nice sys_time dac_override }; +allow systemd_timedated_t self:capability { sys_nice sys_time dac_override };
+allow systemd_timedated_t self:process { getattr getsched signal }; +allow systemd_timedated_t self:process { getattr getsched signal setfscreate };
+allow systemd_timedated_t self:fifo_file rw_fifo_file_perms; +allow systemd_timedated_t self:fifo_file rw_fifo_file_perms;
+allow systemd_timedated_t self:unix_stream_socket create_stream_socket_perms; +allow systemd_timedated_t self:unix_stream_socket create_stream_socket_perms;
+allow systemd_timedated_t self:unix_dgram_socket create_socket_perms; +allow systemd_timedated_t self:unix_dgram_socket create_socket_perms;
@ -236383,6 +236431,8 @@ index 0000000..1131866
+miscfiles_manage_localization(systemd_timedated_t) +miscfiles_manage_localization(systemd_timedated_t)
+miscfiles_etc_filetrans_localization(systemd_timedated_t) +miscfiles_etc_filetrans_localization(systemd_timedated_t)
+ +
+seutil_read_file_contexts(systemd_timedated_t)
+
+userdom_read_all_users_state(systemd_timedated_t) +userdom_read_all_users_state(systemd_timedated_t)
+ +
+optional_policy(` +optional_policy(`

268
policy-rawhide-contrib.patch
View File

@ -25955,7 +25955,7 @@ index d03fd43..f73c152 100644
+ type_transition $1 gkeyringd_exec_t:process $2; + type_transition $1 gkeyringd_exec_t:process $2;
') ')
diff --git a/gnome.te b/gnome.te diff --git a/gnome.te b/gnome.te
index 20f726b..ac1375b 100644 index 20f726b..eb0d80a 100644
--- a/gnome.te --- a/gnome.te
+++ b/gnome.te +++ b/gnome.te
@@ -1,18 +1,36 @@ @@ -1,18 +1,36 @@
@ -25999,7 +25999,7 @@ index 20f726b..ac1375b 100644
typealias gconf_home_t alias { user_gconf_home_t staff_gconf_home_t sysadm_gconf_home_t }; typealias gconf_home_t alias { user_gconf_home_t staff_gconf_home_t sysadm_gconf_home_t };
typealias gconf_home_t alias { auditadm_gconf_home_t secadm_gconf_home_t }; typealias gconf_home_t alias { auditadm_gconf_home_t secadm_gconf_home_t };
typealias gconf_home_t alias unconfined_gconf_home_t; typealias gconf_home_t alias unconfined_gconf_home_t;
@@ -29,107 +47,227 @@ type gconfd_exec_t; @@ -29,107 +47,228 @@ type gconfd_exec_t;
typealias gconfd_t alias { user_gconfd_t staff_gconfd_t sysadm_gconfd_t }; typealias gconfd_t alias { user_gconfd_t staff_gconfd_t sysadm_gconfd_t };
typealias gconfd_t alias { auditadm_gconfd_t secadm_gconfd_t }; typealias gconfd_t alias { auditadm_gconfd_t secadm_gconfd_t };
userdom_user_application_domain(gconfd_t, gconfd_exec_t) userdom_user_application_domain(gconfd_t, gconfd_exec_t)
@ -26210,6 +26210,7 @@ index 20f726b..ac1375b 100644
-allow gkeyringd_domain gnome_home_t:dir create_dir_perms; -allow gkeyringd_domain gnome_home_t:dir create_dir_perms;
-gnome_home_filetrans_gnome_home(gkeyringd_domain, dir, ".gnome2") -gnome_home_filetrans_gnome_home(gkeyringd_domain, dir, ".gnome2")
+allow gkeyringd_domain config_home_t:dir add_entry_dir_perms;
+allow gkeyringd_domain config_home_t:file write; +allow gkeyringd_domain config_home_t:file write;
-manage_dirs_pattern(gkeyringd_domain, gnome_keyring_home_t, gnome_keyring_home_t) -manage_dirs_pattern(gkeyringd_domain, gnome_keyring_home_t, gnome_keyring_home_t)
@ -32457,7 +32458,7 @@ index dd8e01a..9cd6b0b 100644
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
diff --git a/logrotate.te b/logrotate.te diff --git a/logrotate.te b/logrotate.te
index 7bab8e5..5c6ac99 100644 index 7bab8e5..3124cab 100644
--- a/logrotate.te --- a/logrotate.te
+++ b/logrotate.te +++ b/logrotate.te
@@ -1,20 +1,18 @@ @@ -1,20 +1,18 @@
@ -32519,7 +32520,7 @@ index 7bab8e5..5c6ac99 100644
allow logrotate_t self:shm create_shm_perms; allow logrotate_t self:shm create_shm_perms;
allow logrotate_t self:sem create_sem_perms; allow logrotate_t self:sem create_sem_perms;
allow logrotate_t self:msgq create_msgq_perms; allow logrotate_t self:msgq create_msgq_perms;
@@ -48,79 +52,91 @@ allow logrotate_t self:msg { send receive }; @@ -48,79 +52,93 @@ allow logrotate_t self:msg { send receive };
allow logrotate_t logrotate_lock_t:file manage_file_perms; allow logrotate_t logrotate_lock_t:file manage_file_perms;
files_lock_filetrans(logrotate_t, logrotate_lock_t, file) files_lock_filetrans(logrotate_t, logrotate_lock_t, file)
@ -32606,8 +32607,6 @@ index 7bab8e5..5c6ac99 100644
logging_exec_all_logs(logrotate_t) logging_exec_all_logs(logrotate_t)
-miscfiles_read_localization(logrotate_t) -miscfiles_read_localization(logrotate_t)
-
-seutil_dontaudit_read_config(logrotate_t)
+systemd_exec_systemctl(logrotate_t) +systemd_exec_systemctl(logrotate_t)
+systemd_getattr_unit_files(logrotate_t) +systemd_getattr_unit_files(logrotate_t)
+systemd_start_all_unit_files(logrotate_t) +systemd_start_all_unit_files(logrotate_t)
@ -32615,6 +32614,9 @@ index 7bab8e5..5c6ac99 100644
+systemd_status_all_unit_files(logrotate_t) +systemd_status_all_unit_files(logrotate_t)
+init_stream_connect(logrotate_t) +init_stream_connect(logrotate_t)
-seutil_dontaudit_read_config(logrotate_t)
+miscfiles_read_hwdata(logrotate_t)
-userdom_use_user_terminals(logrotate_t) -userdom_use_user_terminals(logrotate_t)
+userdom_use_inherited_user_terminals(logrotate_t) +userdom_use_inherited_user_terminals(logrotate_t)
userdom_list_user_home_dirs(logrotate_t) userdom_list_user_home_dirs(logrotate_t)
@ -32639,7 +32641,7 @@ index 7bab8e5..5c6ac99 100644
') ')
optional_policy(` optional_policy(`
@@ -140,11 +156,11 @@ optional_policy(` @@ -140,11 +158,11 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -32653,7 +32655,7 @@ index 7bab8e5..5c6ac99 100644
') ')
optional_policy(` optional_policy(`
@@ -178,7 +194,7 @@ optional_policy(` @@ -178,7 +196,7 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -32662,7 +32664,7 @@ index 7bab8e5..5c6ac99 100644
') ')
optional_policy(` optional_policy(`
@@ -198,21 +214,22 @@ optional_policy(` @@ -198,21 +216,22 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -32689,7 +32691,7 @@ index 7bab8e5..5c6ac99 100644
') ')
optional_policy(` optional_policy(`
@@ -228,10 +245,20 @@ optional_policy(` @@ -228,10 +247,20 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -32710,7 +32712,7 @@ index 7bab8e5..5c6ac99 100644
su_exec(logrotate_t) su_exec(logrotate_t)
') ')
@@ -241,13 +268,11 @@ optional_policy(` @@ -241,13 +270,11 @@ optional_policy(`
####################################### #######################################
# #
@ -41731,7 +41733,7 @@ index a1fb3c3..8fe1d63 100644
+/var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) +/var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
/var/run/wpa_supplicant-global -s gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/wpa_supplicant-global -s gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
diff --git a/networkmanager.if b/networkmanager.if diff --git a/networkmanager.if b/networkmanager.if
index 0e8508c..96dbf6f 100644 index 0e8508c..163b870 100644
--- a/networkmanager.if --- a/networkmanager.if
+++ b/networkmanager.if +++ b/networkmanager.if
@@ -2,7 +2,7 @@ @@ -2,7 +2,7 @@
@ -41936,7 +41938,13 @@ index 0e8508c..96dbf6f 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -212,12 +258,12 @@ interface(`networkmanager_read_pid_files',` @@ -207,17 +253,17 @@ interface(`networkmanager_read_pid_files',`
')
files_search_pids($1)
- allow $1 NetworkManager_var_run_t:file read_file_perms;
+ read_files_pattern($1, NetworkManager_var_run_t, NetworkManager_var_run_t)
')
######################################## ########################################
## <summary> ## <summary>
@ -47641,10 +47649,10 @@ index 0000000..1a26cd5
+') +')
diff --git a/openshift.te b/openshift.te diff --git a/openshift.te b/openshift.te
new file mode 100644 new file mode 100644
index 0000000..b89f7fc index 0000000..30757e2
--- /dev/null --- /dev/null
+++ b/openshift.te +++ b/openshift.te
@@ -0,0 +1,463 @@ @@ -0,0 +1,467 @@
+policy_module(openshift,1.0.0) +policy_module(openshift,1.0.0)
+ +
+gen_require(` +gen_require(`
@ -47955,6 +47963,10 @@ index 0000000..b89f7fc
+ ssh_dontaudit_search_user_home_dir(openshift_domain) + ssh_dontaudit_search_user_home_dir(openshift_domain)
+') +')
+ +
+optional_policy(`
+ udev_read_pid_files(openshift_domain)
+')
+
+####################################################### +#######################################################
+# +#
+# Policy for openshift user domain process +# Policy for openshift user domain process
@ -48035,7 +48047,7 @@ index 0000000..b89f7fc
+fs_read_cgroup_files(openshift_cgroup_read_t) +fs_read_cgroup_files(openshift_cgroup_read_t)
+ +
+allow openshift_cgroup_read_t openshift_var_lib_t:dir list_dir_perms; +allow openshift_cgroup_read_t openshift_var_lib_t:dir list_dir_perms;
+read_files_pattern(openshift_cgroup_read_t, openshift_var_lib_t, openshift_var_lib_t) +manage_files_pattern(openshift_cgroup_read_t, openshift_var_lib_t, openshift_var_lib_t)
+ +
+######################################## +########################################
+# +#
@ -49384,29 +49396,36 @@ index dfd46e4..9515043 100644
/usr/share/Pegasus/mof(/.*)?/.*\.mof gen_context(system_u:object_r:pegasus_mof_t,s0) /usr/share/Pegasus/mof(/.*)?/.*\.mof gen_context(system_u:object_r:pegasus_mof_t,s0)
diff --git a/pegasus.if b/pegasus.if diff --git a/pegasus.if b/pegasus.if
index d2fc677..920b13f 100644 index d2fc677..22b745a 100644
--- a/pegasus.if --- a/pegasus.if
+++ b/pegasus.if +++ b/pegasus.if
@@ -1,52 +1 @@ @@ -1,52 +1,37 @@
## <summary>The Open Group Pegasus CIM/WBEM Server.</summary> ## <summary>The Open Group Pegasus CIM/WBEM Server.</summary>
-
-######################################## -########################################
-## <summary> +######################################
## <summary>
-## All of the rules required to -## All of the rules required to
-## administrate an pegasus environment. -## administrate an pegasus environment.
-## </summary> +## Creates types and rules for a basic
+## openlmi init daemon domain.
## </summary>
-## <param name="domain"> -## <param name="domain">
-## <summary> -## <summary>
-## Domain allowed access. -## Domain allowed access.
-## </summary> -## </summary>
-## </param> +## <param name="prefix">
+## <summary>
+## Prefix for the domain.
+## </summary>
## </param>
-## <param name="role"> -## <param name="role">
-## <summary> -## <summary>
-## Role allowed access. -## Role allowed access.
-## </summary> -## </summary>
-## </param> -## </param>
-## <rolecap/> -## <rolecap/>
-# #
-interface(`pegasus_admin',` -interface(`pegasus_admin',`
- gen_require(` - gen_require(`
- type pegasus_t, pegasus_initrc_exec_t, pegasus_tmp_t; - type pegasus_t, pegasus_initrc_exec_t, pegasus_tmp_t;
@ -49439,18 +49458,46 @@ index d2fc677..920b13f 100644
- -
- files_search_pids($1) - files_search_pids($1)
- admin_pattern($1, pegasus_var_run_t) - admin_pattern($1, pegasus_var_run_t)
-') +template(`pegasus_openlmi_domain_template',`
+ gen_require(`
+ attribute pegasus_openlmi_domain;
+ ')
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ type pegasus_openlmi_$1_t, pegasus_openlmi_domain;
+ type $1_exec_t;
+ init_daemon_domain(pegasus_openlmi_$1_t, pegasus_openlmi_$1_exec_t)
+
+ ##############################
+ #
+ # Local policy
+ #
+
+ domtrans_pattern(pegasus_t, pegasus_openlmi_$1_exec_t, pegasus_openlmi_$1_t)
+
+ kernel_read_system_state(pegasus_openlmi_$1_t)
+ logging_send_syslog_msg(pegasus_openlmi_$1_t)
')
diff --git a/pegasus.te b/pegasus.te diff --git a/pegasus.te b/pegasus.te
index 7bcf327..e440d35 100644 index 7bcf327..0ff4cb5 100644
--- a/pegasus.te --- a/pegasus.te
+++ b/pegasus.te +++ b/pegasus.te
@@ -1,4 +1,4 @@ @@ -1,17 +1,16 @@
-policy_module(pegasus, 1.8.3) -policy_module(pegasus, 1.8.3)
+policy_module(pegasus, 1.8.0) +policy_module(pegasus, 1.8.0)
######################################## ########################################
# #
@@ -9,9 +9,6 @@ type pegasus_t; # Declarations
#
+attribute pegasus_openlmi_domain;
+
type pegasus_t;
type pegasus_exec_t; type pegasus_exec_t;
init_daemon_domain(pegasus_t, pegasus_exec_t) init_daemon_domain(pegasus_t, pegasus_exec_t)
@ -49460,7 +49507,29 @@ index 7bcf327..e440d35 100644
type pegasus_cache_t; type pegasus_cache_t;
files_type(pegasus_cache_t) files_type(pegasus_cache_t)
@@ -39,11 +36,12 @@ allow pegasus_t self:capability { chown kill ipc_lock sys_nice setuid setgid dac @@ -30,20 +29,33 @@ files_type(pegasus_mof_t)
type pegasus_var_run_t;
files_pid_file(pegasus_var_run_t)
+# pegasus openlmi providers
+#pegasus_openlmi_domain_template(account)
+
+#######################################
+#
+# pegasus openlmi providers local policy
+#
+
+corecmd_exec_bin(pegasus_openlmi_domain)
+
+sysnet_read_config(pegasus_openlmi_domain)
+
########################################
#
-# Local policy
+# pegasus local policy
#
allow pegasus_t self:capability { chown kill ipc_lock sys_nice setuid setgid dac_override net_admin net_bind_service };
dontaudit pegasus_t self:capability sys_tty_config; dontaudit pegasus_t self:capability sys_tty_config;
allow pegasus_t self:process signal; allow pegasus_t self:process signal;
allow pegasus_t self:fifo_file rw_fifo_file_perms; allow pegasus_t self:fifo_file rw_fifo_file_perms;
@ -49476,7 +49545,7 @@ index 7bcf327..e440d35 100644
allow pegasus_t pegasus_conf_t:lnk_file read_lnk_file_perms; allow pegasus_t pegasus_conf_t:lnk_file read_lnk_file_perms;
manage_dirs_pattern(pegasus_t, pegasus_cache_t, pegasus_cache_t) manage_dirs_pattern(pegasus_t, pegasus_cache_t, pegasus_cache_t)
@@ -54,22 +52,22 @@ files_var_filetrans(pegasus_t, pegasus_cache_t, { dir file lnk_file }) @@ -54,22 +66,22 @@ files_var_filetrans(pegasus_t, pegasus_cache_t, { dir file lnk_file })
manage_dirs_pattern(pegasus_t, pegasus_data_t, pegasus_data_t) manage_dirs_pattern(pegasus_t, pegasus_data_t, pegasus_data_t)
manage_files_pattern(pegasus_t, pegasus_data_t, pegasus_data_t) manage_files_pattern(pegasus_t, pegasus_data_t, pegasus_data_t)
manage_lnk_files_pattern(pegasus_t, pegasus_data_t, pegasus_data_t) manage_lnk_files_pattern(pegasus_t, pegasus_data_t, pegasus_data_t)
@ -49507,7 +49576,7 @@ index 7bcf327..e440d35 100644
kernel_read_network_state(pegasus_t) kernel_read_network_state(pegasus_t)
kernel_read_kernel_sysctls(pegasus_t) kernel_read_kernel_sysctls(pegasus_t)
@@ -80,27 +78,21 @@ kernel_read_net_sysctls(pegasus_t) @@ -80,27 +92,21 @@ kernel_read_net_sysctls(pegasus_t)
kernel_read_xen_state(pegasus_t) kernel_read_xen_state(pegasus_t)
kernel_write_xen_state(pegasus_t) kernel_write_xen_state(pegasus_t)
@ -49540,7 +49609,7 @@ index 7bcf327..e440d35 100644
corecmd_exec_bin(pegasus_t) corecmd_exec_bin(pegasus_t)
corecmd_exec_shell(pegasus_t) corecmd_exec_shell(pegasus_t)
@@ -114,6 +106,7 @@ files_getattr_all_dirs(pegasus_t) @@ -114,6 +120,7 @@ files_getattr_all_dirs(pegasus_t)
auth_use_nsswitch(pegasus_t) auth_use_nsswitch(pegasus_t)
auth_domtrans_chk_passwd(pegasus_t) auth_domtrans_chk_passwd(pegasus_t)
@ -49548,7 +49617,7 @@ index 7bcf327..e440d35 100644
domain_use_interactive_fds(pegasus_t) domain_use_interactive_fds(pegasus_t)
domain_read_all_domains_state(pegasus_t) domain_read_all_domains_state(pegasus_t)
@@ -128,18 +121,23 @@ init_stream_connect_script(pegasus_t) @@ -128,18 +135,23 @@ init_stream_connect_script(pegasus_t)
logging_send_audit_msgs(pegasus_t) logging_send_audit_msgs(pegasus_t)
logging_send_syslog_msg(pegasus_t) logging_send_syslog_msg(pegasus_t)
@ -49578,7 +49647,7 @@ index 7bcf327..e440d35 100644
') ')
optional_policy(` optional_policy(`
@@ -151,16 +149,15 @@ optional_policy(` @@ -151,16 +163,15 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -49598,7 +49667,7 @@ index 7bcf327..e440d35 100644
') ')
optional_policy(` optional_policy(`
@@ -168,7 +165,7 @@ optional_policy(` @@ -168,7 +179,7 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -75467,7 +75536,7 @@ index 1499b0b..82fc7f6 100644
- spamassassin_role($2, $1) - spamassassin_role($2, $1)
') ')
diff --git a/spamassassin.te b/spamassassin.te diff --git a/spamassassin.te b/spamassassin.te
index 4faa7e0..9e4d192 100644 index 4faa7e0..3a3ac18 100644
--- a/spamassassin.te --- a/spamassassin.te
+++ b/spamassassin.te +++ b/spamassassin.te
@@ -1,4 +1,4 @@ @@ -1,4 +1,4 @@
@ -75955,17 +76024,17 @@ index 4faa7e0..9e4d192 100644
allow spamd_t self:unix_dgram_socket sendto; allow spamd_t self:unix_dgram_socket sendto;
-allow spamd_t self:unix_stream_socket { accept connectto listen }; -allow spamd_t self:unix_stream_socket { accept connectto listen };
-allow spamd_t self:tcp_socket { accept listen }; -allow spamd_t self:tcp_socket { accept listen };
+allow spamd_t self:unix_stream_socket connectto; -
+allow spamd_t self:tcp_socket create_stream_socket_perms;
+allow spamd_t self:udp_socket create_socket_perms;
-manage_dirs_pattern(spamd_t, spamd_home_t, spamd_home_t) -manage_dirs_pattern(spamd_t, spamd_home_t, spamd_home_t)
-manage_files_pattern(spamd_t, spamd_home_t, spamd_home_t) -manage_files_pattern(spamd_t, spamd_home_t, spamd_home_t)
-manage_lnk_files_pattern(spamd_t, spamd_home_t, spamd_home_t) -manage_lnk_files_pattern(spamd_t, spamd_home_t, spamd_home_t)
-manage_fifo_files_pattern(spamd_t, spamd_home_t, spamd_home_t) -manage_fifo_files_pattern(spamd_t, spamd_home_t, spamd_home_t)
-manage_sock_files_pattern(spamd_t, spamd_home_t, spamd_home_t) -manage_sock_files_pattern(spamd_t, spamd_home_t, spamd_home_t)
-userdom_user_home_dir_filetrans(spamd_t, spamd_home_t, dir, ".spamd") -userdom_user_home_dir_filetrans(spamd_t, spamd_home_t, dir, ".spamd")
- +allow spamd_t self:unix_stream_socket connectto;
+allow spamd_t self:tcp_socket create_stream_socket_perms;
+allow spamd_t self:udp_socket create_socket_perms;
-manage_dirs_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t) -manage_dirs_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
-manage_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t) -manage_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
-manage_lnk_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t) -manage_lnk_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
@ -76170,7 +76239,7 @@ index 4faa7e0..9e4d192 100644
') ')
optional_policy(` optional_policy(`
@@ -474,32 +552,30 @@ optional_policy(` @@ -474,32 +552,32 @@ optional_policy(`
######################################## ########################################
# #
@ -76202,16 +76271,18 @@ index 4faa7e0..9e4d192 100644
-corenet_tcp_sendrecv_generic_if(spamd_update_t) -corenet_tcp_sendrecv_generic_if(spamd_update_t)
-corenet_tcp_sendrecv_generic_node(spamd_update_t) -corenet_tcp_sendrecv_generic_node(spamd_update_t)
-corenet_tcp_sendrecv_all_ports(spamd_update_t) -corenet_tcp_sendrecv_all_ports(spamd_update_t)
+kernel_read_system_state(spamd_update_t) +allow spamd_update_t spamc_home_t:dir search_dir_perms;
-corenet_sendrecv_http_client_packets(spamd_update_t) -corenet_sendrecv_http_client_packets(spamd_update_t)
+kernel_read_system_state(spamd_update_t)
+
+# for updating rules +# for updating rules
corenet_tcp_connect_http_port(spamd_update_t) corenet_tcp_connect_http_port(spamd_update_t)
-corenet_tcp_sendrecv_http_port(spamd_update_t) -corenet_tcp_sendrecv_http_port(spamd_update_t)
corecmd_exec_bin(spamd_update_t) corecmd_exec_bin(spamd_update_t)
corecmd_exec_shell(spamd_update_t) corecmd_exec_shell(spamd_update_t)
@@ -508,25 +584,21 @@ dev_read_urand(spamd_update_t) @@ -508,25 +586,21 @@ dev_read_urand(spamd_update_t)
domain_use_interactive_fds(spamd_update_t) domain_use_interactive_fds(spamd_update_t)
@ -79437,9 +79508,18 @@ index 38389e6..4847b43 100644
+/var/lib/tgtd(/.*)? gen_context(system_u:object_r:tgtd_var_lib_t,s0) +/var/lib/tgtd(/.*)? gen_context(system_u:object_r:tgtd_var_lib_t,s0)
+/var/run/tgtd.* -s gen_context(system_u:object_r:tgtd_var_run_t,s0) +/var/run/tgtd.* -s gen_context(system_u:object_r:tgtd_var_run_t,s0)
diff --git a/tgtd.te b/tgtd.te diff --git a/tgtd.te b/tgtd.te
index c93c973..0eff459 100644 index c93c973..08aef1e 100644
--- a/tgtd.te --- a/tgtd.te
+++ b/tgtd.te +++ b/tgtd.te
@@ -29,7 +29,7 @@ files_pid_file(tgtd_var_run_t)
# Local policy
#
-allow tgtd_t self:capability sys_resource;
+allow tgtd_t self:capability { dac_override sys_resource };
allow tgtd_t self:capability2 block_suspend;
allow tgtd_t self:process { setrlimit signal };
allow tgtd_t self:fifo_file rw_fifo_file_perms;
@@ -58,7 +58,6 @@ kernel_read_system_state(tgtd_t) @@ -58,7 +58,6 @@ kernel_read_system_state(tgtd_t)
kernel_read_fs_sysctls(tgtd_t) kernel_read_fs_sysctls(tgtd_t)
@ -79448,15 +79528,16 @@ index c93c973..0eff459 100644
corenet_tcp_sendrecv_generic_if(tgtd_t) corenet_tcp_sendrecv_generic_if(tgtd_t)
corenet_tcp_sendrecv_generic_node(tgtd_t) corenet_tcp_sendrecv_generic_node(tgtd_t)
corenet_tcp_bind_generic_node(tgtd_t) corenet_tcp_bind_generic_node(tgtd_t)
@@ -69,16 +68,12 @@ corenet_tcp_sendrecv_iscsi_port(tgtd_t) @@ -69,7 +68,7 @@ corenet_tcp_sendrecv_iscsi_port(tgtd_t)
dev_read_sysfs(tgtd_t) dev_read_sysfs(tgtd_t)
-files_read_etc_files(tgtd_t) -files_read_etc_files(tgtd_t)
- +files_list_mnt(tgtd_t)
fs_read_anon_inodefs_files(tgtd_t) fs_read_anon_inodefs_files(tgtd_t)
storage_manage_fixed_disk(tgtd_t) @@ -77,8 +76,6 @@ storage_manage_fixed_disk(tgtd_t)
logging_send_syslog_msg(tgtd_t) logging_send_syslog_msg(tgtd_t)
@ -80827,30 +80908,45 @@ index e29db63..061fb98 100644
domain_system_change_exemption($1) domain_system_change_exemption($1)
role_transition $2 tuned_initrc_exec_t system_r; role_transition $2 tuned_initrc_exec_t system_r;
diff --git a/tuned.te b/tuned.te diff --git a/tuned.te b/tuned.te
index 7116181..ffc2e44 100644 index 7116181..9815e42 100644
--- a/tuned.te --- a/tuned.te
+++ b/tuned.te +++ b/tuned.te
@@ -31,8 +31,9 @@ files_pid_file(tuned_var_run_t) @@ -21,6 +21,9 @@ files_config_file(tuned_rw_etc_t)
type tuned_log_t;
logging_log_file(tuned_log_t)
+type tuned_tmp_t;
+files_tmp_file(tuned_tmp_t)
+
type tuned_var_run_t;
files_pid_file(tuned_var_run_t)
@@ -31,8 +34,10 @@ files_pid_file(tuned_var_run_t)
allow tuned_t self:capability { sys_admin sys_nice }; allow tuned_t self:capability { sys_admin sys_nice };
dontaudit tuned_t self:capability { dac_override sys_tty_config }; dontaudit tuned_t self:capability { dac_override sys_tty_config };
-allow tuned_t self:process { setsched signal }; -allow tuned_t self:process { setsched signal };
+allow tuned_t self:process { setsched signal }; +allow tuned_t self:process { setsched signal };
allow tuned_t self:fifo_file rw_fifo_file_perms; allow tuned_t self:fifo_file rw_fifo_file_perms;
+allow tuned_t self:netlink_kobject_uevent_socket create_socket_perms;
+allow tuned_t self:udp_socket create_socket_perms; +allow tuned_t self:udp_socket create_socket_perms;
read_files_pattern(tuned_t, tuned_etc_t, tuned_etc_t) read_files_pattern(tuned_t, tuned_etc_t, tuned_etc_t)
exec_files_pattern(tuned_t, tuned_etc_t, tuned_etc_t) exec_files_pattern(tuned_t, tuned_etc_t, tuned_etc_t)
@@ -44,7 +45,7 @@ manage_dirs_pattern(tuned_t, tuned_log_t, tuned_log_t) @@ -44,7 +49,11 @@ manage_dirs_pattern(tuned_t, tuned_log_t, tuned_log_t)
append_files_pattern(tuned_t, tuned_log_t, tuned_log_t) append_files_pattern(tuned_t, tuned_log_t, tuned_log_t)
create_files_pattern(tuned_t, tuned_log_t, tuned_log_t) create_files_pattern(tuned_t, tuned_log_t, tuned_log_t)
setattr_files_pattern(tuned_t, tuned_log_t, tuned_log_t) setattr_files_pattern(tuned_t, tuned_log_t, tuned_log_t)
-logging_log_filetrans(tuned_t, tuned_log_t, file) -logging_log_filetrans(tuned_t, tuned_log_t, file)
+logging_log_filetrans(tuned_t, tuned_log_t, file, "tuned.log") +logging_log_filetrans(tuned_t, tuned_log_t, file, "tuned.log")
+
+manage_dirs_pattern(tuned_t, tuned_tmp_t, tuned_tmp_t)
+manage_files_pattern(tuned_t, tuned_tmp_t, tuned_tmp_t)
+files_tmp_filetrans(tuned_t, tuned_tmp_t, { file dir })
manage_files_pattern(tuned_t, tuned_var_run_t, tuned_var_run_t) manage_files_pattern(tuned_t, tuned_var_run_t, tuned_var_run_t)
manage_dirs_pattern(tuned_t, tuned_var_run_t, tuned_var_run_t) manage_dirs_pattern(tuned_t, tuned_var_run_t, tuned_var_run_t)
@@ -57,6 +58,7 @@ kernel_request_load_module(tuned_t) @@ -57,6 +66,7 @@ kernel_request_load_module(tuned_t)
kernel_rw_kernel_sysctl(tuned_t) kernel_rw_kernel_sysctl(tuned_t)
kernel_rw_hotplug_sysctls(tuned_t) kernel_rw_hotplug_sysctls(tuned_t)
kernel_rw_vm_sysctls(tuned_t) kernel_rw_vm_sysctls(tuned_t)
@ -80858,7 +80954,7 @@ index 7116181..ffc2e44 100644
corecmd_exec_bin(tuned_t) corecmd_exec_bin(tuned_t)
corecmd_exec_shell(tuned_t) corecmd_exec_shell(tuned_t)
@@ -67,28 +69,44 @@ dev_read_urand(tuned_t) @@ -67,28 +77,44 @@ dev_read_urand(tuned_t)
dev_rw_sysfs(tuned_t) dev_rw_sysfs(tuned_t)
dev_rw_netcontrol(tuned_t) dev_rw_netcontrol(tuned_t)
@ -80866,10 +80962,10 @@ index 7116181..ffc2e44 100644
files_dontaudit_search_home(tuned_t) files_dontaudit_search_home(tuned_t)
-files_dontaudit_list_tmp(tuned_t) -files_dontaudit_list_tmp(tuned_t)
+files_list_tmp(tuned_t) +files_list_tmp(tuned_t)
+
+fs_getattr_all_fs(tuned_t)
-fs_getattr_xattr_fs(tuned_t) -fs_getattr_xattr_fs(tuned_t)
+fs_getattr_all_fs(tuned_t)
+
+auth_use_nsswitch(tuned_t) +auth_use_nsswitch(tuned_t)
logging_send_syslog_msg(tuned_t) logging_send_syslog_msg(tuned_t)
@ -84048,7 +84144,7 @@ index 9dec06c..d8a2b54 100644
+ allow svirt_lxc_domain $1:process sigchld; + allow svirt_lxc_domain $1:process sigchld;
') ')
diff --git a/virt.te b/virt.te diff --git a/virt.te b/virt.te
index 1f22fba..def6a6b 100644 index 1f22fba..64b70d6 100644
--- a/virt.te --- a/virt.te
+++ b/virt.te +++ b/virt.te
@@ -1,94 +1,98 @@ @@ -1,94 +1,98 @@
@ -84510,9 +84606,7 @@ index 1f22fba..def6a6b 100644
- -
-dontaudit svirt_t virt_content_t:file write_file_perms; -dontaudit svirt_t virt_content_t:file write_file_perms;
-dontaudit svirt_t virt_content_t:dir rw_dir_perms; -dontaudit svirt_t virt_content_t:dir rw_dir_perms;
+allow svirt_tcg_t self:process { execmem execstack }; -
+allow svirt_tcg_t self:netlink_route_socket r_netlink_socket_perms;
-append_files_pattern(svirt_t, virt_home_t, virt_home_t) -append_files_pattern(svirt_t, virt_home_t, virt_home_t)
-manage_dirs_pattern(svirt_t, svirt_home_t, svirt_home_t) -manage_dirs_pattern(svirt_t, svirt_home_t, svirt_home_t)
-manage_files_pattern(svirt_t, svirt_home_t, svirt_home_t) -manage_files_pattern(svirt_t, svirt_home_t, svirt_home_t)
@ -84541,7 +84635,9 @@ index 1f22fba..def6a6b 100644
-corenet_sendrecv_all_server_packets(svirt_t) -corenet_sendrecv_all_server_packets(svirt_t)
-corenet_udp_bind_all_ports(svirt_t) -corenet_udp_bind_all_ports(svirt_t)
-corenet_tcp_bind_all_ports(svirt_t) -corenet_tcp_bind_all_ports(svirt_t)
- +allow svirt_tcg_t self:process { execmem execstack };
+allow svirt_tcg_t self:netlink_route_socket r_netlink_socket_perms;
-corenet_sendrecv_all_client_packets(svirt_t) -corenet_sendrecv_all_client_packets(svirt_t)
-corenet_tcp_connect_all_ports(svirt_t) -corenet_tcp_connect_all_ports(svirt_t)
+corenet_udp_sendrecv_generic_if(svirt_tcg_t) +corenet_udp_sendrecv_generic_if(svirt_tcg_t)
@ -85172,8 +85268,9 @@ index 1f22fba..def6a6b 100644
+typealias virsh_exec_t alias xm_exec_t; +typealias virsh_exec_t alias xm_exec_t;
-allow virsh_t self:capability { setpcap dac_override ipc_lock sys_nice sys_tty_config }; -allow virsh_t self:capability { setpcap dac_override ipc_lock sys_nice sys_tty_config };
-allow virsh_t self:process { getcap getsched setsched setcap signal };
+allow virsh_t self:capability { setpcap dac_override ipc_lock sys_chroot sys_nice sys_tty_config }; +allow virsh_t self:capability { setpcap dac_override ipc_lock sys_chroot sys_nice sys_tty_config };
allow virsh_t self:process { getcap getsched setsched setcap signal }; +allow virsh_t self:process { getcap getsched setsched setcap setexec signal };
allow virsh_t self:fifo_file rw_fifo_file_perms; allow virsh_t self:fifo_file rw_fifo_file_perms;
-allow virsh_t self:unix_stream_socket { accept connectto listen }; -allow virsh_t self:unix_stream_socket { accept connectto listen };
-allow virsh_t self:tcp_socket { accept listen }; -allow virsh_t self:tcp_socket { accept listen };
@ -85190,7 +85287,7 @@ index 1f22fba..def6a6b 100644
manage_files_pattern(virsh_t, virt_image_type, virt_image_type) manage_files_pattern(virsh_t, virt_image_type, virt_image_type)
manage_blk_files_pattern(virsh_t, virt_image_type, virt_image_type) manage_blk_files_pattern(virsh_t, virt_image_type, virt_image_type)
@@ -758,23 +802,14 @@ manage_chr_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) @@ -758,23 +802,15 @@ manage_chr_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t)
manage_lnk_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) manage_lnk_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t)
manage_sock_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) manage_sock_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t)
manage_fifo_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t) manage_fifo_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t)
@ -85203,12 +85300,12 @@ index 1f22fba..def6a6b 100644
-dontaudit virsh_t virt_var_lib_t:file read_file_perms; -dontaudit virsh_t virt_var_lib_t:file read_file_perms;
- -
-allow virsh_t svirt_lxc_domain:process transition; -allow virsh_t svirt_lxc_domain:process transition;
-
-can_exec(virsh_t, virsh_exec_t)
+manage_dirs_pattern(virsh_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +manage_dirs_pattern(virsh_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
+manage_files_pattern(virsh_t, virt_lxc_var_run_t, virt_lxc_var_run_t) +manage_files_pattern(virsh_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
+virt_filetrans_named_content(virsh_t) +virt_filetrans_named_content(virsh_t)
-can_exec(virsh_t, virsh_exec_t)
-
-virt_domtrans(virsh_t) -virt_domtrans(virsh_t)
-virt_manage_images(virsh_t) -virt_manage_images(virsh_t)
-virt_manage_config(virsh_t) -virt_manage_config(virsh_t)
@ -85216,10 +85313,11 @@ index 1f22fba..def6a6b 100644
+dontaudit virsh_t virt_var_lib_t:file read_inherited_file_perms; +dontaudit virsh_t virt_var_lib_t:file read_inherited_file_perms;
-kernel_read_crypto_sysctls(virsh_t) -kernel_read_crypto_sysctls(virsh_t)
+kernel_write_proc_files(virsh_t)
kernel_read_system_state(virsh_t) kernel_read_system_state(virsh_t)
kernel_read_network_state(virsh_t) kernel_read_network_state(virsh_t)
kernel_read_kernel_sysctls(virsh_t) kernel_read_kernel_sysctls(virsh_t)
@@ -785,25 +820,18 @@ kernel_write_xen_state(virsh_t) @@ -785,25 +821,18 @@ kernel_write_xen_state(virsh_t)
corecmd_exec_bin(virsh_t) corecmd_exec_bin(virsh_t)
corecmd_exec_shell(virsh_t) corecmd_exec_shell(virsh_t)
@ -85246,7 +85344,7 @@ index 1f22fba..def6a6b 100644
fs_getattr_all_fs(virsh_t) fs_getattr_all_fs(virsh_t)
fs_manage_xenfs_dirs(virsh_t) fs_manage_xenfs_dirs(virsh_t)
@@ -812,24 +840,21 @@ fs_search_auto_mountpoints(virsh_t) @@ -812,24 +841,21 @@ fs_search_auto_mountpoints(virsh_t)
storage_raw_read_fixed_disk(virsh_t) storage_raw_read_fixed_disk(virsh_t)
@ -85277,7 +85375,7 @@ index 1f22fba..def6a6b 100644
tunable_policy(`virt_use_nfs',` tunable_policy(`virt_use_nfs',`
fs_manage_nfs_dirs(virsh_t) fs_manage_nfs_dirs(virsh_t)
fs_manage_nfs_files(virsh_t) fs_manage_nfs_files(virsh_t)
@@ -847,6 +872,10 @@ optional_policy(` @@ -847,6 +873,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -85288,7 +85386,7 @@ index 1f22fba..def6a6b 100644
rpm_exec(virsh_t) rpm_exec(virsh_t)
') ')
@@ -854,7 +883,7 @@ optional_policy(` @@ -854,7 +884,7 @@ optional_policy(`
xen_manage_image_dirs(virsh_t) xen_manage_image_dirs(virsh_t)
xen_append_log(virsh_t) xen_append_log(virsh_t)
xen_domtrans(virsh_t) xen_domtrans(virsh_t)
@ -85297,7 +85395,7 @@ index 1f22fba..def6a6b 100644
xen_stream_connect(virsh_t) xen_stream_connect(virsh_t)
xen_stream_connect_xenstore(virsh_t) xen_stream_connect_xenstore(virsh_t)
') ')
@@ -879,34 +908,40 @@ optional_policy(` @@ -879,34 +909,40 @@ optional_policy(`
kernel_read_xen_state(virsh_ssh_t) kernel_read_xen_state(virsh_ssh_t)
kernel_write_xen_state(virsh_ssh_t) kernel_write_xen_state(virsh_ssh_t)
@ -85348,7 +85446,7 @@ index 1f22fba..def6a6b 100644
manage_dirs_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) manage_dirs_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t)
manage_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) manage_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t)
@@ -916,12 +951,15 @@ manage_sock_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) @@ -916,12 +952,15 @@ manage_sock_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t)
manage_fifo_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t) manage_fifo_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t)
allow virtd_lxc_t svirt_lxc_file_t:dir_file_class_set { relabelto relabelfrom }; allow virtd_lxc_t svirt_lxc_file_t:dir_file_class_set { relabelto relabelfrom };
allow virtd_lxc_t svirt_lxc_file_t:filesystem { relabelto relabelfrom }; allow virtd_lxc_t svirt_lxc_file_t:filesystem { relabelto relabelfrom };
@ -85364,7 +85462,7 @@ index 1f22fba..def6a6b 100644
corecmd_exec_bin(virtd_lxc_t) corecmd_exec_bin(virtd_lxc_t)
corecmd_exec_shell(virtd_lxc_t) corecmd_exec_shell(virtd_lxc_t)
@@ -933,10 +971,8 @@ dev_read_urand(virtd_lxc_t) @@ -933,10 +972,8 @@ dev_read_urand(virtd_lxc_t)
domain_use_interactive_fds(virtd_lxc_t) domain_use_interactive_fds(virtd_lxc_t)
@ -85375,7 +85473,7 @@ index 1f22fba..def6a6b 100644
files_relabel_rootfs(virtd_lxc_t) files_relabel_rootfs(virtd_lxc_t)
files_mounton_non_security(virtd_lxc_t) files_mounton_non_security(virtd_lxc_t)
files_mount_all_file_type_fs(virtd_lxc_t) files_mount_all_file_type_fs(virtd_lxc_t)
@@ -944,6 +980,7 @@ files_unmount_all_file_type_fs(virtd_lxc_t) @@ -944,6 +981,7 @@ files_unmount_all_file_type_fs(virtd_lxc_t)
files_list_isid_type_dirs(virtd_lxc_t) files_list_isid_type_dirs(virtd_lxc_t)
files_root_filetrans(virtd_lxc_t, svirt_lxc_file_t, dir_file_class_set) files_root_filetrans(virtd_lxc_t, svirt_lxc_file_t, dir_file_class_set)
@ -85383,7 +85481,7 @@ index 1f22fba..def6a6b 100644
fs_getattr_all_fs(virtd_lxc_t) fs_getattr_all_fs(virtd_lxc_t)
fs_manage_tmpfs_dirs(virtd_lxc_t) fs_manage_tmpfs_dirs(virtd_lxc_t)
fs_manage_tmpfs_chr_files(virtd_lxc_t) fs_manage_tmpfs_chr_files(virtd_lxc_t)
@@ -955,15 +992,11 @@ fs_rw_cgroup_files(virtd_lxc_t) @@ -955,15 +993,11 @@ fs_rw_cgroup_files(virtd_lxc_t)
fs_unmount_all_fs(virtd_lxc_t) fs_unmount_all_fs(virtd_lxc_t)
fs_relabelfrom_tmpfs(virtd_lxc_t) fs_relabelfrom_tmpfs(virtd_lxc_t)
@ -85402,7 +85500,7 @@ index 1f22fba..def6a6b 100644
term_use_generic_ptys(virtd_lxc_t) term_use_generic_ptys(virtd_lxc_t)
term_use_ptmx(virtd_lxc_t) term_use_ptmx(virtd_lxc_t)
@@ -973,20 +1006,38 @@ auth_use_nsswitch(virtd_lxc_t) @@ -973,20 +1007,38 @@ auth_use_nsswitch(virtd_lxc_t)
logging_send_syslog_msg(virtd_lxc_t) logging_send_syslog_msg(virtd_lxc_t)
@ -85447,7 +85545,7 @@ index 1f22fba..def6a6b 100644
allow svirt_lxc_domain self:process { execstack execmem getattr signal_perms getsched setsched setcap setpgid }; allow svirt_lxc_domain self:process { execstack execmem getattr signal_perms getsched setsched setcap setpgid };
allow svirt_lxc_domain self:fifo_file manage_file_perms; allow svirt_lxc_domain self:fifo_file manage_file_perms;
allow svirt_lxc_domain self:sem create_sem_perms; allow svirt_lxc_domain self:sem create_sem_perms;
@@ -995,19 +1046,6 @@ allow svirt_lxc_domain self:msgq create_msgq_perms; @@ -995,19 +1047,6 @@ allow svirt_lxc_domain self:msgq create_msgq_perms;
allow svirt_lxc_domain self:unix_stream_socket { create_stream_socket_perms connectto }; allow svirt_lxc_domain self:unix_stream_socket { create_stream_socket_perms connectto };
allow svirt_lxc_domain self:unix_dgram_socket { sendto create_socket_perms }; allow svirt_lxc_domain self:unix_dgram_socket { sendto create_socket_perms };
@ -85467,7 +85565,7 @@ index 1f22fba..def6a6b 100644
manage_dirs_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) manage_dirs_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
manage_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) manage_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
manage_lnk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) manage_lnk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
@@ -1015,17 +1053,14 @@ manage_sock_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) @@ -1015,17 +1054,14 @@ manage_sock_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
manage_fifo_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) manage_fifo_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
rw_chr_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) rw_chr_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
rw_blk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) rw_blk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
@ -85486,7 +85584,7 @@ index 1f22fba..def6a6b 100644
kernel_dontaudit_search_kernel_sysctl(svirt_lxc_domain) kernel_dontaudit_search_kernel_sysctl(svirt_lxc_domain)
corecmd_exec_all_executables(svirt_lxc_domain) corecmd_exec_all_executables(svirt_lxc_domain)
@@ -1037,21 +1072,20 @@ files_dontaudit_getattr_all_pipes(svirt_lxc_domain) @@ -1037,21 +1073,20 @@ files_dontaudit_getattr_all_pipes(svirt_lxc_domain)
files_dontaudit_getattr_all_sockets(svirt_lxc_domain) files_dontaudit_getattr_all_sockets(svirt_lxc_domain)
files_dontaudit_list_all_mountpoints(svirt_lxc_domain) files_dontaudit_list_all_mountpoints(svirt_lxc_domain)
files_dontaudit_write_etc_runtime_files(svirt_lxc_domain) files_dontaudit_write_etc_runtime_files(svirt_lxc_domain)
@ -85513,7 +85611,7 @@ index 1f22fba..def6a6b 100644
auth_dontaudit_read_login_records(svirt_lxc_domain) auth_dontaudit_read_login_records(svirt_lxc_domain)
auth_dontaudit_write_login_records(svirt_lxc_domain) auth_dontaudit_write_login_records(svirt_lxc_domain)
auth_search_pam_console_data(svirt_lxc_domain) auth_search_pam_console_data(svirt_lxc_domain)
@@ -1063,11 +1097,14 @@ init_dontaudit_write_utmp(svirt_lxc_domain) @@ -1063,11 +1098,16 @@ init_dontaudit_write_utmp(svirt_lxc_domain)
libs_dontaudit_setattr_lib_files(svirt_lxc_domain) libs_dontaudit_setattr_lib_files(svirt_lxc_domain)
@ -85522,15 +85620,17 @@ index 1f22fba..def6a6b 100644
miscfiles_read_fonts(svirt_lxc_domain) miscfiles_read_fonts(svirt_lxc_domain)
-mta_dontaudit_read_spool_symlinks(svirt_lxc_domain) -mta_dontaudit_read_spool_symlinks(svirt_lxc_domain)
+systemd_read_unit_files(svirt_lxc_domain)
+
+userdom_use_inherited_user_terminals(svirt_lxc_domain)
+
+optional_policy(` +optional_policy(`
+ mta_dontaudit_read_spool_symlinks(svirt_lxc_domain) + mta_dontaudit_read_spool_symlinks(svirt_lxc_domain)
+') +')
+
+systemd_read_unit_files(svirt_lxc_domain)
optional_policy(` optional_policy(`
udev_read_pid_files(svirt_lxc_domain) udev_read_pid_files(svirt_lxc_domain)
@@ -1078,81 +1115,67 @@ optional_policy(` @@ -1078,81 +1118,67 @@ optional_policy(`
apache_read_sys_content(svirt_lxc_domain) apache_read_sys_content(svirt_lxc_domain)
') ')
@ -85638,7 +85738,7 @@ index 1f22fba..def6a6b 100644
allow virt_qmf_t self:tcp_socket create_stream_socket_perms; allow virt_qmf_t self:tcp_socket create_stream_socket_perms;
allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms; allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms;
@@ -1165,12 +1188,12 @@ dev_read_sysfs(virt_qmf_t) @@ -1165,12 +1191,12 @@ dev_read_sysfs(virt_qmf_t)
dev_read_rand(virt_qmf_t) dev_read_rand(virt_qmf_t)
dev_read_urand(virt_qmf_t) dev_read_urand(virt_qmf_t)
@ -85653,7 +85753,7 @@ index 1f22fba..def6a6b 100644
sysnet_read_config(virt_qmf_t) sysnet_read_config(virt_qmf_t)
optional_policy(` optional_policy(`
@@ -1183,9 +1206,8 @@ optional_policy(` @@ -1183,9 +1209,8 @@ optional_policy(`
######################################## ########################################
# #
@ -85664,7 +85764,7 @@ index 1f22fba..def6a6b 100644
allow virt_bridgehelper_t self:process { setcap getcap }; allow virt_bridgehelper_t self:process { setcap getcap };
allow virt_bridgehelper_t self:capability { setpcap setgid setuid net_admin }; allow virt_bridgehelper_t self:capability { setpcap setgid setuid net_admin };
allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms; allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
@@ -1198,5 +1220,65 @@ kernel_read_network_state(virt_bridgehelper_t) @@ -1198,5 +1223,65 @@ kernel_read_network_state(virt_bridgehelper_t)
corenet_rw_tun_tap_dev(virt_bridgehelper_t) corenet_rw_tun_tap_dev(virt_bridgehelper_t)
@ -85731,7 +85831,7 @@ index 1f22fba..def6a6b 100644
+ +
+type svirt_socket_t; +type svirt_socket_t;
+role system_r types svirt_socket_t; +role system_r types svirt_socket_t;
+allow svirt_t svirt_socket_t:unix_stream_socket { connectto create_stream_socket_perms }; +allow virt_domain svirt_socket_t:unix_stream_socket { connectto create_stream_socket_perms };
diff --git a/vlock.te b/vlock.te diff --git a/vlock.te b/vlock.te
index 9ead775..b5285e7 100644 index 9ead775..b5285e7 100644
--- a/vlock.te --- a/vlock.te

18
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.12.1 Version: 3.12.1
Release: 12%{?dist} Release: 13%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -521,6 +521,22 @@ SELinux Reference policy mls base module.
%endif %endif
%changelog %changelog
* Thu Feb 14 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-13
- virsh now does a setexeccon call
- Additional rules required by openshift domains
- Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work
- Allow spamd_update_t to search spamc_home_t
- Avcs discovered by mounting an isci device under /mnt
- Allow lspci running as logrotate to read pci.ids
- Additional fix for networkmanager_read_pid_files()
- Fix networkmanager_read_pid_files() interface
- Allow all svirt domains to connect to svirt_socket_t
- Allow virsh to set SELinux context for a process.
- Allow tuned to create netlink_kobject_uevent_socket
- Allow systemd-timestamp to set SELinux context
- Add support for /var/lib/systemd/linger
- Fix ssh_sysadm_login to be working on MLS as expected
* Mon Feb 11 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-12 * Mon Feb 11 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-12
- Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file - Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file
- Add missing files_rw_inherited_tmp_files interface - Add missing files_rw_inherited_tmp_files interface