rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Wed Nov 02 2016 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-222 

- Allow abrt_dump_oops_t to drop capabilities. bz(1391040)
- Add named_t domain net_raw capability bz(1389240)
- Allow geoclue to read system info. bz(1389320)
- Make openfortivpn_t as init_deamon_domain. bz(1159899)
- Allow nfsd domain to create nfsd_unit_file_t files. bz(1382487)
- Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib
- Add interace lldpad_relabel_tmpfs
- Merge pull request #155 from rhatdan/sandbox_nfs
- Add pscsd_t wake_alarm capability2
- Allow sandbox domains to mount fuse file systems
- Add boolean to allow sandbox domains to mount nfs
- Allow hypervvssd_t to read all dirs.
- Allow isnsd_t to connect to isns_port_t
- Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib
- Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device.
- Make tor_var_lib_t and tor_var_log_t as mountpoints.
- Allow systemd-rfkill to write to /proc/kmsg bz(1388669)
- Allow init_t to relabel /dev/shm/lldpad.state
- Merge pull request #168 from rhatdan/docker
- Label tcp 51954 as isns_port_t
- Lots of new domains like OCID and RKT are user container processes
This commit is contained in:
Lukas Vrabec 2016-11-02 18:02:58 +01:00
parent cb85251274
commit 2bb5c83b3d
4 changed files with 189 additions and 113 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
container-selinux.tgz
View File

Binary file not shown.

145
policy-rawhide-base.patch
View File

@ -5946,7 +5946,7 @@ index 8e0f9cd..b9f45b9 100644
define(`create_packet_interfaces',`` define(`create_packet_interfaces',``
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
index b191055..25a5cfe 100644 index b191055..9729941 100644
--- a/policy/modules/kernel/corenetwork.te.in --- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in
@@ -5,6 +5,7 @@ policy_module(corenetwork, 1.19.2) @@ -5,6 +5,7 @@ policy_module(corenetwork, 1.19.2)
@ -6134,7 +6134,8 @@ index b191055..25a5cfe 100644
+network_port(ircd, tcp,6667,s0, tcp,6697,s0) +network_port(ircd, tcp,6667,s0, tcp,6697,s0)
network_port(isakmp, udp,500,s0) network_port(isakmp, udp,500,s0)
network_port(iscsi, tcp,3260,s0) network_port(iscsi, tcp,3260,s0)
network_port(isns, tcp,3205,s0, udp,3205,s0) -network_port(isns, tcp,3205,s0, udp,3205,s0)
+network_port(isns, tcp,3205,s0, udp,3205,s0, tcp,51954,s0)
network_port(jabber_client, tcp,5222,s0, tcp,5223,s0) network_port(jabber_client, tcp,5222,s0, tcp,5223,s0)
-network_port(jabber_interserver, tcp,5269,s0) -network_port(jabber_interserver, tcp,5269,s0)
-network_port(jboss_iiop, tcp,3528,s0, udp,3528,s0) -network_port(jboss_iiop, tcp,3528,s0, udp,3528,s0)
@ -37458,7 +37459,7 @@ index 79a45f6..d092e6e 100644
+ allow $1 init_var_lib_t:dir search_dir_perms; + allow $1 init_var_lib_t:dir search_dir_perms;
+') +')
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 17eda24..e33db3f 100644 index 17eda24..e59e001 100644
--- a/policy/modules/system/init.te --- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te +++ b/policy/modules/system/init.te
@@ -11,10 +11,31 @@ gen_require(` @@ -11,10 +11,31 @@ gen_require(`
@ -37768,7 +37769,7 @@ index 17eda24..e33db3f 100644
ifdef(`distro_gentoo',` ifdef(`distro_gentoo',`
allow init_t self:process { getcap setcap }; allow init_t self:process { getcap setcap };
@@ -186,29 +337,271 @@ ifdef(`distro_gentoo',` @@ -186,29 +337,275 @@ ifdef(`distro_gentoo',`
') ')
ifdef(`distro_redhat',` ifdef(`distro_redhat',`
@ -38011,10 +38012,14 @@ index 17eda24..e33db3f 100644
optional_policy(` optional_policy(`
- auth_rw_login_records(init_t) - auth_rw_login_records(init_t)
+ consolekit_manage_log(init_t) + lldpad_relabel_tmpfs(init_t)
') ')
optional_policy(` optional_policy(`
+ consolekit_manage_log(init_t)
+')
+
+optional_policy(`
+ dbus_connect_system_bus(init_t) + dbus_connect_system_bus(init_t)
dbus_system_bus_client(init_t) dbus_system_bus_client(init_t)
+ dbus_delete_pid_files(init_t) + dbus_delete_pid_files(init_t)
@ -38049,7 +38054,7 @@ index 17eda24..e33db3f 100644
') ')
optional_policy(` optional_policy(`
@@ -216,7 +609,30 @@ optional_policy(` @@ -216,7 +613,30 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -38081,7 +38086,7 @@ index 17eda24..e33db3f 100644
') ')
######################################## ########################################
@@ -225,9 +641,9 @@ optional_policy(` @@ -225,9 +645,9 @@ optional_policy(`
# #
allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@ -38093,7 +38098,7 @@ index 17eda24..e33db3f 100644
allow initrc_t self:passwd rootok; allow initrc_t self:passwd rootok;
allow initrc_t self:key manage_key_perms; allow initrc_t self:key manage_key_perms;
@@ -258,12 +674,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) @@ -258,12 +678,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
allow initrc_t initrc_var_run_t:file manage_file_perms; allow initrc_t initrc_var_run_t:file manage_file_perms;
files_pid_filetrans(initrc_t, initrc_var_run_t, file) files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@ -38110,7 +38115,7 @@ index 17eda24..e33db3f 100644
manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
@@ -279,23 +699,36 @@ kernel_change_ring_buffer_level(initrc_t) @@ -279,23 +703,36 @@ kernel_change_ring_buffer_level(initrc_t)
kernel_clear_ring_buffer(initrc_t) kernel_clear_ring_buffer(initrc_t)
kernel_get_sysvipc_info(initrc_t) kernel_get_sysvipc_info(initrc_t)
kernel_read_all_sysctls(initrc_t) kernel_read_all_sysctls(initrc_t)
@ -38153,7 +38158,7 @@ index 17eda24..e33db3f 100644
corenet_tcp_sendrecv_all_ports(initrc_t) corenet_tcp_sendrecv_all_ports(initrc_t)
corenet_udp_sendrecv_all_ports(initrc_t) corenet_udp_sendrecv_all_ports(initrc_t)
corenet_tcp_connect_all_ports(initrc_t) corenet_tcp_connect_all_ports(initrc_t)
@@ -303,9 +736,11 @@ corenet_sendrecv_all_client_packets(initrc_t) @@ -303,9 +740,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
dev_read_rand(initrc_t) dev_read_rand(initrc_t)
dev_read_urand(initrc_t) dev_read_urand(initrc_t)
@ -38165,7 +38170,7 @@ index 17eda24..e33db3f 100644
dev_rw_sysfs(initrc_t) dev_rw_sysfs(initrc_t)
dev_list_usbfs(initrc_t) dev_list_usbfs(initrc_t)
dev_read_framebuffer(initrc_t) dev_read_framebuffer(initrc_t)
@@ -313,8 +748,10 @@ dev_write_framebuffer(initrc_t) @@ -313,8 +752,10 @@ dev_write_framebuffer(initrc_t)
dev_read_realtime_clock(initrc_t) dev_read_realtime_clock(initrc_t)
dev_read_sound_mixer(initrc_t) dev_read_sound_mixer(initrc_t)
dev_write_sound_mixer(initrc_t) dev_write_sound_mixer(initrc_t)
@ -38176,7 +38181,7 @@ index 17eda24..e33db3f 100644
dev_delete_lvm_control_dev(initrc_t) dev_delete_lvm_control_dev(initrc_t)
dev_manage_generic_symlinks(initrc_t) dev_manage_generic_symlinks(initrc_t)
dev_manage_generic_files(initrc_t) dev_manage_generic_files(initrc_t)
@@ -322,8 +759,7 @@ dev_manage_generic_files(initrc_t) @@ -322,8 +763,7 @@ dev_manage_generic_files(initrc_t)
dev_delete_generic_symlinks(initrc_t) dev_delete_generic_symlinks(initrc_t)
dev_getattr_all_blk_files(initrc_t) dev_getattr_all_blk_files(initrc_t)
dev_getattr_all_chr_files(initrc_t) dev_getattr_all_chr_files(initrc_t)
@ -38186,7 +38191,7 @@ index 17eda24..e33db3f 100644
domain_kill_all_domains(initrc_t) domain_kill_all_domains(initrc_t)
domain_signal_all_domains(initrc_t) domain_signal_all_domains(initrc_t)
@@ -332,7 +768,6 @@ domain_sigstop_all_domains(initrc_t) @@ -332,7 +772,6 @@ domain_sigstop_all_domains(initrc_t)
domain_sigchld_all_domains(initrc_t) domain_sigchld_all_domains(initrc_t)
domain_read_all_domains_state(initrc_t) domain_read_all_domains_state(initrc_t)
domain_getattr_all_domains(initrc_t) domain_getattr_all_domains(initrc_t)
@ -38194,7 +38199,7 @@ index 17eda24..e33db3f 100644
domain_getsession_all_domains(initrc_t) domain_getsession_all_domains(initrc_t)
domain_use_interactive_fds(initrc_t) domain_use_interactive_fds(initrc_t)
# for lsof which is used by alsa shutdown: # for lsof which is used by alsa shutdown:
@@ -340,6 +775,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) @@ -340,6 +779,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
domain_dontaudit_getattr_all_tcp_sockets(initrc_t) domain_dontaudit_getattr_all_tcp_sockets(initrc_t)
domain_dontaudit_getattr_all_dgram_sockets(initrc_t) domain_dontaudit_getattr_all_dgram_sockets(initrc_t)
domain_dontaudit_getattr_all_pipes(initrc_t) domain_dontaudit_getattr_all_pipes(initrc_t)
@ -38202,7 +38207,7 @@ index 17eda24..e33db3f 100644
files_getattr_all_dirs(initrc_t) files_getattr_all_dirs(initrc_t)
files_getattr_all_files(initrc_t) files_getattr_all_files(initrc_t)
@@ -347,14 +783,15 @@ files_getattr_all_symlinks(initrc_t) @@ -347,14 +787,15 @@ files_getattr_all_symlinks(initrc_t)
files_getattr_all_pipes(initrc_t) files_getattr_all_pipes(initrc_t)
files_getattr_all_sockets(initrc_t) files_getattr_all_sockets(initrc_t)
files_purge_tmp(initrc_t) files_purge_tmp(initrc_t)
@ -38220,7 +38225,7 @@ index 17eda24..e33db3f 100644
files_read_usr_files(initrc_t) files_read_usr_files(initrc_t)
files_manage_urandom_seed(initrc_t) files_manage_urandom_seed(initrc_t)
files_manage_generic_spool(initrc_t) files_manage_generic_spool(initrc_t)
@@ -364,8 +801,12 @@ files_list_isid_type_dirs(initrc_t) @@ -364,8 +805,12 @@ files_list_isid_type_dirs(initrc_t)
files_mounton_isid_type_dirs(initrc_t) files_mounton_isid_type_dirs(initrc_t)
files_list_default(initrc_t) files_list_default(initrc_t)
files_mounton_default(initrc_t) files_mounton_default(initrc_t)
@ -38234,7 +38239,7 @@ index 17eda24..e33db3f 100644
fs_list_inotifyfs(initrc_t) fs_list_inotifyfs(initrc_t)
fs_register_binary_executable_type(initrc_t) fs_register_binary_executable_type(initrc_t)
# rhgb-console writes to ramfs # rhgb-console writes to ramfs
@@ -375,10 +816,11 @@ fs_mount_all_fs(initrc_t) @@ -375,10 +820,11 @@ fs_mount_all_fs(initrc_t)
fs_unmount_all_fs(initrc_t) fs_unmount_all_fs(initrc_t)
fs_remount_all_fs(initrc_t) fs_remount_all_fs(initrc_t)
fs_getattr_all_fs(initrc_t) fs_getattr_all_fs(initrc_t)
@ -38248,7 +38253,7 @@ index 17eda24..e33db3f 100644
mcs_process_set_categories(initrc_t) mcs_process_set_categories(initrc_t)
mls_file_read_all_levels(initrc_t) mls_file_read_all_levels(initrc_t)
@@ -387,8 +829,10 @@ mls_process_read_up(initrc_t) @@ -387,8 +833,10 @@ mls_process_read_up(initrc_t)
mls_process_write_down(initrc_t) mls_process_write_down(initrc_t)
mls_rangetrans_source(initrc_t) mls_rangetrans_source(initrc_t)
mls_fd_share_all_levels(initrc_t) mls_fd_share_all_levels(initrc_t)
@ -38259,7 +38264,7 @@ index 17eda24..e33db3f 100644
storage_getattr_fixed_disk_dev(initrc_t) storage_getattr_fixed_disk_dev(initrc_t)
storage_setattr_fixed_disk_dev(initrc_t) storage_setattr_fixed_disk_dev(initrc_t)
@@ -398,6 +842,7 @@ term_use_all_terms(initrc_t) @@ -398,6 +846,7 @@ term_use_all_terms(initrc_t)
term_reset_tty_labels(initrc_t) term_reset_tty_labels(initrc_t)
auth_rw_login_records(initrc_t) auth_rw_login_records(initrc_t)
@ -38267,7 +38272,7 @@ index 17eda24..e33db3f 100644
auth_setattr_login_records(initrc_t) auth_setattr_login_records(initrc_t)
auth_rw_lastlog(initrc_t) auth_rw_lastlog(initrc_t)
auth_read_pam_pid(initrc_t) auth_read_pam_pid(initrc_t)
@@ -416,20 +861,18 @@ logging_read_all_logs(initrc_t) @@ -416,20 +865,18 @@ logging_read_all_logs(initrc_t)
logging_append_all_logs(initrc_t) logging_append_all_logs(initrc_t)
logging_read_audit_config(initrc_t) logging_read_audit_config(initrc_t)
@ -38291,7 +38296,7 @@ index 17eda24..e33db3f 100644
ifdef(`distro_debian',` ifdef(`distro_debian',`
dev_setattr_generic_dirs(initrc_t) dev_setattr_generic_dirs(initrc_t)
@@ -451,7 +894,6 @@ ifdef(`distro_gentoo',` @@ -451,7 +898,6 @@ ifdef(`distro_gentoo',`
allow initrc_t self:process setfscreate; allow initrc_t self:process setfscreate;
dev_create_null_dev(initrc_t) dev_create_null_dev(initrc_t)
dev_create_zero_dev(initrc_t) dev_create_zero_dev(initrc_t)
@ -38299,7 +38304,7 @@ index 17eda24..e33db3f 100644
term_create_console_dev(initrc_t) term_create_console_dev(initrc_t)
# unfortunately /sbin/rc does stupid tricks # unfortunately /sbin/rc does stupid tricks
@@ -486,6 +928,10 @@ ifdef(`distro_gentoo',` @@ -486,6 +932,10 @@ ifdef(`distro_gentoo',`
sysnet_setattr_config(initrc_t) sysnet_setattr_config(initrc_t)
optional_policy(` optional_policy(`
@ -38310,7 +38315,7 @@ index 17eda24..e33db3f 100644
alsa_read_lib(initrc_t) alsa_read_lib(initrc_t)
') ')
@@ -506,7 +952,7 @@ ifdef(`distro_redhat',` @@ -506,7 +956,7 @@ ifdef(`distro_redhat',`
# Red Hat systems seem to have a stray # Red Hat systems seem to have a stray
# fd open from the initrd # fd open from the initrd
@ -38319,7 +38324,7 @@ index 17eda24..e33db3f 100644
files_dontaudit_read_root_files(initrc_t) files_dontaudit_read_root_files(initrc_t)
# These seem to be from the initrd # These seem to be from the initrd
@@ -521,6 +967,7 @@ ifdef(`distro_redhat',` @@ -521,6 +971,7 @@ ifdef(`distro_redhat',`
files_create_boot_dirs(initrc_t) files_create_boot_dirs(initrc_t)
files_create_boot_flag(initrc_t) files_create_boot_flag(initrc_t)
files_rw_boot_symlinks(initrc_t) files_rw_boot_symlinks(initrc_t)
@ -38327,7 +38332,7 @@ index 17eda24..e33db3f 100644
# wants to read /.fonts directory # wants to read /.fonts directory
files_read_default_files(initrc_t) files_read_default_files(initrc_t)
files_mountpoint(initrc_tmp_t) files_mountpoint(initrc_tmp_t)
@@ -541,6 +988,7 @@ ifdef(`distro_redhat',` @@ -541,6 +992,7 @@ ifdef(`distro_redhat',`
miscfiles_rw_localization(initrc_t) miscfiles_rw_localization(initrc_t)
miscfiles_setattr_localization(initrc_t) miscfiles_setattr_localization(initrc_t)
miscfiles_relabel_localization(initrc_t) miscfiles_relabel_localization(initrc_t)
@ -38335,7 +38340,7 @@ index 17eda24..e33db3f 100644
miscfiles_read_fonts(initrc_t) miscfiles_read_fonts(initrc_t)
miscfiles_read_hwdata(initrc_t) miscfiles_read_hwdata(initrc_t)
@@ -550,8 +998,44 @@ ifdef(`distro_redhat',` @@ -550,8 +1002,44 @@ ifdef(`distro_redhat',`
') ')
optional_policy(` optional_policy(`
@ -38380,7 +38385,7 @@ index 17eda24..e33db3f 100644
') ')
optional_policy(` optional_policy(`
@@ -559,14 +1043,31 @@ ifdef(`distro_redhat',` @@ -559,14 +1047,31 @@ ifdef(`distro_redhat',`
rpc_write_exports(initrc_t) rpc_write_exports(initrc_t)
rpc_manage_nfs_state_data(initrc_t) rpc_manage_nfs_state_data(initrc_t)
') ')
@ -38412,7 +38417,7 @@ index 17eda24..e33db3f 100644
') ')
') ')
@@ -577,6 +1078,39 @@ ifdef(`distro_suse',` @@ -577,6 +1082,39 @@ ifdef(`distro_suse',`
') ')
') ')
@ -38452,7 +38457,7 @@ index 17eda24..e33db3f 100644
optional_policy(` optional_policy(`
amavis_search_lib(initrc_t) amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t) amavis_setattr_pid_files(initrc_t)
@@ -589,6 +1123,8 @@ optional_policy(` @@ -589,6 +1127,8 @@ optional_policy(`
optional_policy(` optional_policy(`
apache_read_config(initrc_t) apache_read_config(initrc_t)
apache_list_modules(initrc_t) apache_list_modules(initrc_t)
@ -38461,7 +38466,7 @@ index 17eda24..e33db3f 100644
') ')
optional_policy(` optional_policy(`
@@ -610,6 +1146,7 @@ optional_policy(` @@ -610,6 +1150,7 @@ optional_policy(`
optional_policy(` optional_policy(`
cgroup_stream_connect_cgred(initrc_t) cgroup_stream_connect_cgred(initrc_t)
@ -38469,7 +38474,7 @@ index 17eda24..e33db3f 100644
') ')
optional_policy(` optional_policy(`
@@ -626,6 +1163,17 @@ optional_policy(` @@ -626,6 +1167,17 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -38487,7 +38492,7 @@ index 17eda24..e33db3f 100644
dev_getattr_printer_dev(initrc_t) dev_getattr_printer_dev(initrc_t)
cups_read_log(initrc_t) cups_read_log(initrc_t)
@@ -642,9 +1190,13 @@ optional_policy(` @@ -642,9 +1194,13 @@ optional_policy(`
dbus_connect_system_bus(initrc_t) dbus_connect_system_bus(initrc_t)
dbus_system_bus_client(initrc_t) dbus_system_bus_client(initrc_t)
dbus_read_config(initrc_t) dbus_read_config(initrc_t)
@ -38501,7 +38506,7 @@ index 17eda24..e33db3f 100644
') ')
optional_policy(` optional_policy(`
@@ -657,15 +1209,11 @@ optional_policy(` @@ -657,15 +1213,11 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -38519,7 +38524,7 @@ index 17eda24..e33db3f 100644
') ')
optional_policy(` optional_policy(`
@@ -686,6 +1234,15 @@ optional_policy(` @@ -686,6 +1238,15 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -38535,7 +38540,7 @@ index 17eda24..e33db3f 100644
inn_exec_config(initrc_t) inn_exec_config(initrc_t)
') ')
@@ -726,6 +1283,7 @@ optional_policy(` @@ -726,6 +1287,7 @@ optional_policy(`
lpd_list_spool(initrc_t) lpd_list_spool(initrc_t)
lpd_read_config(initrc_t) lpd_read_config(initrc_t)
@ -38543,7 +38548,7 @@ index 17eda24..e33db3f 100644
') ')
optional_policy(` optional_policy(`
@@ -743,7 +1301,13 @@ optional_policy(` @@ -743,7 +1305,13 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -38558,7 +38563,7 @@ index 17eda24..e33db3f 100644
mta_dontaudit_read_spool_symlinks(initrc_t) mta_dontaudit_read_spool_symlinks(initrc_t)
') ')
@@ -766,6 +1330,10 @@ optional_policy(` @@ -766,6 +1334,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -38569,7 +38574,7 @@ index 17eda24..e33db3f 100644
postgresql_manage_db(initrc_t) postgresql_manage_db(initrc_t)
postgresql_read_config(initrc_t) postgresql_read_config(initrc_t)
') ')
@@ -775,10 +1343,20 @@ optional_policy(` @@ -775,10 +1347,20 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -38590,7 +38595,7 @@ index 17eda24..e33db3f 100644
quota_manage_flags(initrc_t) quota_manage_flags(initrc_t)
') ')
@@ -787,6 +1365,10 @@ optional_policy(` @@ -787,6 +1369,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -38601,7 +38606,7 @@ index 17eda24..e33db3f 100644
fs_write_ramfs_sockets(initrc_t) fs_write_ramfs_sockets(initrc_t)
fs_search_ramfs(initrc_t) fs_search_ramfs(initrc_t)
@@ -808,8 +1390,6 @@ optional_policy(` @@ -808,8 +1394,6 @@ optional_policy(`
# bash tries ioctl for some reason # bash tries ioctl for some reason
files_dontaudit_ioctl_all_pids(initrc_t) files_dontaudit_ioctl_all_pids(initrc_t)
@ -38610,7 +38615,7 @@ index 17eda24..e33db3f 100644
') ')
optional_policy(` optional_policy(`
@@ -818,6 +1398,10 @@ optional_policy(` @@ -818,6 +1402,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -38621,7 +38626,7 @@ index 17eda24..e33db3f 100644
# shorewall-init script run /var/lib/shorewall/firewall # shorewall-init script run /var/lib/shorewall/firewall
shorewall_lib_domtrans(initrc_t) shorewall_lib_domtrans(initrc_t)
') ')
@@ -827,10 +1411,12 @@ optional_policy(` @@ -827,10 +1415,12 @@ optional_policy(`
squid_manage_logs(initrc_t) squid_manage_logs(initrc_t)
') ')
@ -38634,7 +38639,7 @@ index 17eda24..e33db3f 100644
optional_policy(` optional_policy(`
ssh_dontaudit_read_server_keys(initrc_t) ssh_dontaudit_read_server_keys(initrc_t)
@@ -857,21 +1443,62 @@ optional_policy(` @@ -857,21 +1447,62 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -38698,7 +38703,7 @@ index 17eda24..e33db3f 100644
') ')
optional_policy(` optional_policy(`
@@ -887,6 +1514,10 @@ optional_policy(` @@ -887,6 +1518,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -38709,7 +38714,7 @@ index 17eda24..e33db3f 100644
# Set device ownerships/modes. # Set device ownerships/modes.
xserver_setattr_console_pipes(initrc_t) xserver_setattr_console_pipes(initrc_t)
@@ -897,3 +1528,218 @@ optional_policy(` @@ -897,3 +1532,218 @@ optional_policy(`
optional_policy(` optional_policy(`
zebra_read_config(initrc_t) zebra_read_config(initrc_t)
') ')
@ -49137,10 +49142,10 @@ index 0000000..86e3d01
+') +')
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644 new file mode 100644
index 0000000..eff9e73 index 0000000..2800431
--- /dev/null --- /dev/null
+++ b/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te
@@ -0,0 +1,972 @@ @@ -0,0 +1,973 @@
+policy_module(systemd, 1.0.0) +policy_module(systemd, 1.0.0)
+ +
+####################################### +#######################################
@ -49868,6 +49873,7 @@ index 0000000..eff9e73
+ +
+dev_read_sysfs(systemd_rfkill_t) +dev_read_sysfs(systemd_rfkill_t)
+dev_rw_wireless(systemd_rfkill_t) +dev_rw_wireless(systemd_rfkill_t)
+dev_write_kmsg(systemd_rfkill_t)
+ +
+init_search_var_lib_dirs(systemd_rfkill_t) +init_search_var_lib_dirs(systemd_rfkill_t)
+ +
@ -51261,10 +51267,10 @@ index 5ca20a9..5454d16 100644
+ allow $1 unconfined_service_t:process signull; + allow $1 unconfined_service_t:process signull;
') ')
diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
index 5fe902d..a349d18 100644 index 5fe902d..b31eeba 100644
--- a/policy/modules/system/unconfined.te --- a/policy/modules/system/unconfined.te
+++ b/policy/modules/system/unconfined.te +++ b/policy/modules/system/unconfined.te
@@ -1,207 +1,28 @@ @@ -1,207 +1,32 @@
-policy_module(unconfined, 3.5.1) -policy_module(unconfined, 3.5.1)
+policy_module(unconfined, 3.5.0) +policy_module(unconfined, 3.5.0)
@ -51352,8 +51358,7 @@ index 5fe902d..a349d18 100644
-optional_policy(` -optional_policy(`
- firstboot_run(unconfined_t, unconfined_r) - firstboot_run(unconfined_t, unconfined_r)
-') -')
+role unconfined_r types unconfined_service_t; -
-optional_policy(` -optional_policy(`
- ftp_run_ftpdctl(unconfined_t, unconfined_r) - ftp_run_ftpdctl(unconfined_t, unconfined_r)
-') -')
@ -51369,15 +51374,12 @@ index 5fe902d..a349d18 100644
-optional_policy(` -optional_policy(`
- java_run_unconfined(unconfined_t, unconfined_r) - java_run_unconfined(unconfined_t, unconfined_r)
-') -')
+corecmd_bin_entry_type(unconfined_service_t) -
+corecmd_shell_entry_type(unconfined_service_t) -optional_policy(`
optional_policy(`
- lpd_run_checkpc(unconfined_t, unconfined_r) - lpd_run_checkpc(unconfined_t, unconfined_r)
+ rpm_transition_script(unconfined_service_t, system_r) -')
') -
-optional_policy(`
optional_policy(`
- modutils_run_update_mods(unconfined_t, unconfined_r) - modutils_run_update_mods(unconfined_t, unconfined_r)
-') -')
- -
@ -51429,7 +51431,8 @@ index 5fe902d..a349d18 100644
-optional_policy(` -optional_policy(`
- rpm_run(unconfined_t, unconfined_r) - rpm_run(unconfined_t, unconfined_r)
-') -')
- +role unconfined_r types unconfined_service_t;
-optional_policy(` -optional_policy(`
- samba_run_net(unconfined_t, unconfined_r) - samba_run_net(unconfined_t, unconfined_r)
- samba_run_winbind_helper(unconfined_t, unconfined_r) - samba_run_winbind_helper(unconfined_t, unconfined_r)
@ -51451,16 +51454,20 @@ index 5fe902d..a349d18 100644
-optional_policy(` -optional_policy(`
- unconfined_dbus_chat(unconfined_t) - unconfined_dbus_chat(unconfined_t)
-') -')
- +corecmd_bin_entry_type(unconfined_service_t)
-optional_policy(` +corecmd_shell_entry_type(unconfined_service_t)
optional_policy(`
- usermanage_run_admin_passwd(unconfined_t, unconfined_r) - usermanage_run_admin_passwd(unconfined_t, unconfined_r)
-') + rpm_transition_script(unconfined_service_t, system_r)
- ')
-optional_policy(`
optional_policy(`
- vpn_run(unconfined_t, unconfined_r) - vpn_run(unconfined_t, unconfined_r)
-') + dbus_chat_system_bus(unconfined_service_t)
- ')
-optional_policy(`
optional_policy(`
- webalizer_run(unconfined_t, unconfined_r) - webalizer_run(unconfined_t, unconfined_r)
-') -')
- -
@ -51482,7 +51489,7 @@ index 5fe902d..a349d18 100644
- -
-optional_policy(` -optional_policy(`
- unconfined_dbus_chat(unconfined_execmem_t) - unconfined_dbus_chat(unconfined_execmem_t)
+ dbus_chat_system_bus(unconfined_service_t) + virt_transition_svirt(unconfined_service_t, system_r)
') ')
diff --git a/policy/modules/system/userdomain.fc b/policy/modules/system/userdomain.fc diff --git a/policy/modules/system/userdomain.fc b/policy/modules/system/userdomain.fc
index db75976..c54480a 100644 index db75976..c54480a 100644

132
policy-rawhide-contrib.patch
View File

@ -9774,7 +9774,7 @@ index 531a8f2..3fcf187 100644
+ allow $1 named_unit_file_t:service all_service_perms; + allow $1 named_unit_file_t:service all_service_perms;
') ')
diff --git a/bind.te b/bind.te diff --git a/bind.te b/bind.te
index 1241123..ab9ec30 100644 index 1241123..f726b13 100644
--- a/bind.te --- a/bind.te
+++ b/bind.te +++ b/bind.te
@@ -34,7 +34,7 @@ type named_checkconf_exec_t; @@ -34,7 +34,7 @@ type named_checkconf_exec_t;
@ -9801,7 +9801,7 @@ index 1241123..ab9ec30 100644
# #
-allow named_t self:capability { chown dac_override fowner setgid setuid sys_chroot sys_nice sys_resource }; -allow named_t self:capability { chown dac_override fowner setgid setuid sys_chroot sys_nice sys_resource };
+allow named_t self:capability { chown dac_override fowner net_admin setgid setuid sys_chroot sys_nice sys_resource }; +allow named_t self:capability { chown dac_override fowner net_admin net_raw setgid setuid sys_chroot sys_nice sys_resource };
dontaudit named_t self:capability sys_tty_config; dontaudit named_t self:capability sys_tty_config;
+allow named_t self:capability2 block_suspend; +allow named_t self:capability2 block_suspend;
allow named_t self:process { setsched getcap setcap setrlimit signal_perms }; allow named_t self:process { setsched getcap setcap setrlimit signal_perms };
@ -31429,10 +31429,10 @@ index 0000000..cf9f7bf
+') +')
diff --git a/geoclue.te b/geoclue.te diff --git a/geoclue.te b/geoclue.te
new file mode 100644 new file mode 100644
index 0000000..efd838f index 0000000..fb8be0d
--- /dev/null --- /dev/null
+++ b/geoclue.te +++ b/geoclue.te
@@ -0,0 +1,71 @@ @@ -0,0 +1,72 @@
+policy_module(geoclue, 1.0.0) +policy_module(geoclue, 1.0.0)
+ +
+######################################## +########################################
@ -31466,6 +31466,7 @@ index 0000000..efd838f
+manage_dirs_pattern(geoclue_t, geoclue_tmp_t, geoclue_tmp_t) +manage_dirs_pattern(geoclue_t, geoclue_tmp_t, geoclue_tmp_t)
+files_tmp_filetrans(geoclue_t, geoclue_tmp_t, { dir file }) +files_tmp_filetrans(geoclue_t, geoclue_tmp_t, { dir file })
+ +
+kernel_read_system_state(geoclue_t)
+kernel_read_network_state(geoclue_t) +kernel_read_network_state(geoclue_t)
+ +
+auth_read_passwd(geoclue_t) +auth_read_passwd(geoclue_t)
@ -32381,10 +32382,10 @@ index 0000000..764ae00
+ +
diff --git a/glusterd.te b/glusterd.te diff --git a/glusterd.te b/glusterd.te
new file mode 100644 new file mode 100644
index 0000000..3ba328e index 0000000..0a33da3
--- /dev/null --- /dev/null
+++ b/glusterd.te +++ b/glusterd.te
@@ -0,0 +1,303 @@ @@ -0,0 +1,305 @@
+policy_module(glusterd, 1.1.3) +policy_module(glusterd, 1.1.3)
+ +
+## <desc> +## <desc>
@ -32446,7 +32447,7 @@ index 0000000..3ba328e
+# Local policy +# Local policy
+# +#
+ +
+allow glusterd_t self:capability { sys_admin sys_resource sys_ptrace dac_override chown dac_read_search fowner fsetid kill setgid setuid net_admin mknod net_raw }; +allow glusterd_t self:capability { sys_admin sys_resource sys_ptrace dac_override chown dac_read_search fowner fsetid ipc_lock kill setgid setuid net_admin mknod net_raw };
+ +
+allow glusterd_t self:capability2 block_suspend; +allow glusterd_t self:capability2 block_suspend;
+allow glusterd_t self:process { getcap setcap setrlimit signal_perms setsched getsched setfscreate}; +allow glusterd_t self:process { getcap setcap setrlimit signal_perms setsched getsched setfscreate};
@ -32542,6 +32543,7 @@ index 0000000..3ba328e
+dev_read_sysfs(glusterd_t) +dev_read_sysfs(glusterd_t)
+dev_read_urand(glusterd_t) +dev_read_urand(glusterd_t)
+dev_read_rand(glusterd_t) +dev_read_rand(glusterd_t)
+dev_rw_infiniband_dev(glusterd_t)
+ +
+domain_read_all_domains_state(glusterd_t) +domain_read_all_domains_state(glusterd_t)
+domain_getattr_all_sockets(glusterd_t) +domain_getattr_all_sockets(glusterd_t)
@ -32551,6 +32553,7 @@ index 0000000..3ba328e
+fs_mount_all_fs(glusterd_t) +fs_mount_all_fs(glusterd_t)
+fs_unmount_all_fs(glusterd_t) +fs_unmount_all_fs(glusterd_t)
+fs_getattr_all_fs(glusterd_t) +fs_getattr_all_fs(glusterd_t)
+fs_getattr_all_dirs(glusterd_t)
+ +
+files_mounton_non_security(glusterd_t) +files_mounton_non_security(glusterd_t)
+ +
@ -37724,10 +37727,10 @@ index 6517fad..f183748 100644
+ allow $1 hypervkvp_unit_file_t:service all_service_perms; + allow $1 hypervkvp_unit_file_t:service all_service_perms;
') ')
diff --git a/hypervkvp.te b/hypervkvp.te diff --git a/hypervkvp.te b/hypervkvp.te
index 4eb7041..de9cd55 100644 index 4eb7041..b205df0 100644
--- a/hypervkvp.te --- a/hypervkvp.te
+++ b/hypervkvp.te +++ b/hypervkvp.te
@@ -5,24 +5,153 @@ policy_module(hypervkvp, 1.0.0) @@ -5,24 +5,154 @@ policy_module(hypervkvp, 1.0.0)
# Declarations # Declarations
# #
@ -37889,6 +37892,7 @@ index 4eb7041..de9cd55 100644
-miscfiles_read_localization(hypervkvpd_t) -miscfiles_read_localization(hypervkvpd_t)
+files_list_all_mountpoints(hypervvssd_t) +files_list_all_mountpoints(hypervvssd_t)
+files_write_all_mountpoints(hypervvssd_t) +files_write_all_mountpoints(hypervvssd_t)
+files_list_non_auth_dirs(hypervvssd_t)
-sysnet_dns_name_resolve(hypervkvpd_t) -sysnet_dns_name_resolve(hypervkvpd_t)
+logging_send_syslog_msg(hypervvssd_t) +logging_send_syslog_msg(hypervvssd_t)
@ -39918,7 +39922,7 @@ index ca020fa..d546e07 100644
+ kdump_rw_inherited_kdumpctl_tmp_pipes(iscsid_t) + kdump_rw_inherited_kdumpctl_tmp_pipes(iscsid_t)
+') +')
diff --git a/isns.te b/isns.te diff --git a/isns.te b/isns.te
index bc11034..183c526 100644 index bc11034..20a7f39 100644
--- a/isns.te --- a/isns.te
+++ b/isns.te +++ b/isns.te
@@ -26,6 +26,7 @@ files_pid_file(isnsd_var_run_t) @@ -26,6 +26,7 @@ files_pid_file(isnsd_var_run_t)
@ -39939,9 +39943,11 @@ index bc11034..183c526 100644
corenet_all_recvfrom_unlabeled(isnsd_t) corenet_all_recvfrom_unlabeled(isnsd_t)
corenet_all_recvfrom_netlabel(isnsd_t) corenet_all_recvfrom_netlabel(isnsd_t)
corenet_tcp_sendrecv_generic_if(isnsd_t) corenet_tcp_sendrecv_generic_if(isnsd_t)
@@ -46,10 +50,6 @@ corenet_tcp_bind_generic_node(isnsd_t) @@ -45,11 +49,8 @@ corenet_tcp_sendrecv_isns_port(isnsd_t)
corenet_tcp_bind_generic_node(isnsd_t)
corenet_sendrecv_isns_server_packets(isnsd_t) corenet_sendrecv_isns_server_packets(isnsd_t)
corenet_tcp_bind_isns_port(isnsd_t) corenet_tcp_bind_isns_port(isnsd_t)
+corenet_tcp_connect_isns_port(isnsd_t)
-files_read_etc_files(isnsd_t) -files_read_etc_files(isnsd_t)
+auth_use_nsswitch(isnsd_t) +auth_use_nsswitch(isnsd_t)
@ -46051,7 +46057,7 @@ index 8031a78..72e56ac 100644
+ +
+/dev/shm/lldpad.* -- gen_context(system_u:object_r:lldpad_tmpfs_t,s0) +/dev/shm/lldpad.* -- gen_context(system_u:object_r:lldpad_tmpfs_t,s0)
diff --git a/lldpad.if b/lldpad.if diff --git a/lldpad.if b/lldpad.if
index d18c960..fb5b674 100644 index d18c960..b7bd752 100644
--- a/lldpad.if --- a/lldpad.if
+++ b/lldpad.if +++ b/lldpad.if
@@ -2,6 +2,25 @@ @@ -2,6 +2,25 @@
@ -46095,6 +46101,29 @@ index d18c960..fb5b674 100644
init_labeled_script_domtrans($1, lldpad_initrc_exec_t) init_labeled_script_domtrans($1, lldpad_initrc_exec_t)
domain_system_change_exemption($1) domain_system_change_exemption($1)
role_transition $2 lldpad_initrc_exec_t system_r; role_transition $2 lldpad_initrc_exec_t system_r;
@@ -56,3 +79,22 @@ interface(`lldpad_admin',`
files_search_pids($1)
admin_pattern($1, lldpad_var_run_t)
')
+
+########################################
+## <summary>
+## Allow relabel lldpad_tmpfs_t
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`lldpad_relabel_tmpfs',`
+ gen_require(`
+ type lldpad_tmpfs_t;
+ ')
+
+ allow $1 lldpad_tmpfs_t:file relabelfrom;
+ allow $1 lldpad_tmpfs_t:file relabelto;
+')
diff --git a/lldpad.te b/lldpad.te diff --git a/lldpad.te b/lldpad.te
index 2a491d9..42e5578 100644 index 2a491d9..42e5578 100644
--- a/lldpad.te --- a/lldpad.te
@ -64805,10 +64834,10 @@ index 0000000..7581b52
+') +')
diff --git a/openfortivpn.te b/openfortivpn.te diff --git a/openfortivpn.te b/openfortivpn.te
new file mode 100644 new file mode 100644
index 0000000..0d22f83 index 0000000..3142896
--- /dev/null --- /dev/null
+++ b/openfortivpn.te +++ b/openfortivpn.te
@@ -0,0 +1,69 @@ @@ -0,0 +1,67 @@
+policy_module(openfortivpn, 1.0.0) +policy_module(openfortivpn, 1.0.0)
+ +
+######################################## +########################################
@ -64817,11 +64846,9 @@ index 0000000..0d22f83
+# +#
+ +
+type openfortivpn_t; +type openfortivpn_t;
+domain_type(openfortivpn_t);
+role system_r types openfortivpn_t; +role system_r types openfortivpn_t;
+
+type openfortivpn_exec_t; +type openfortivpn_exec_t;
+domain_entry_file(openfortivpn_t, openfortivpn_exec_t) +init_daemon_domain(openfortivpn_t, openfortivpn_exec_t)
+ +
+type openfortivpn_var_lib_t; +type openfortivpn_var_lib_t;
+files_type(openfortivpn_var_lib_t) +files_type(openfortivpn_var_lib_t)
@ -69440,14 +69467,15 @@ index 43d50f9..6b1544f 100644
######################################## ########################################
diff --git a/pcscd.te b/pcscd.te diff --git a/pcscd.te b/pcscd.te
index 1fb1964..5212cd2 100644 index 1fb1964..a8026bd 100644
--- a/pcscd.te --- a/pcscd.te
+++ b/pcscd.te +++ b/pcscd.te
@@ -22,10 +22,11 @@ init_daemon_run_dir(pcscd_var_run_t, "pcscd") @@ -22,10 +22,12 @@ init_daemon_run_dir(pcscd_var_run_t, "pcscd")
# #
allow pcscd_t self:capability { dac_override dac_read_search fsetid }; allow pcscd_t self:capability { dac_override dac_read_search fsetid };
-allow pcscd_t self:process signal; -allow pcscd_t self:process signal;
+allow pcscd_t self:capability2 { wake_alarm };
+allow pcscd_t self:process { signal signull }; +allow pcscd_t self:process { signal signull };
allow pcscd_t self:fifo_file rw_fifo_file_perms; allow pcscd_t self:fifo_file rw_fifo_file_perms;
-allow pcscd_t self:unix_stream_socket { accept listen }; -allow pcscd_t self:unix_stream_socket { accept listen };
@ -69458,7 +69486,7 @@ index 1fb1964..5212cd2 100644
allow pcscd_t self:netlink_kobject_uevent_socket create_socket_perms; allow pcscd_t self:netlink_kobject_uevent_socket create_socket_perms;
manage_dirs_pattern(pcscd_t, pcscd_var_run_t, pcscd_var_run_t) manage_dirs_pattern(pcscd_t, pcscd_var_run_t, pcscd_var_run_t)
@@ -36,7 +37,6 @@ files_pid_filetrans(pcscd_t, pcscd_var_run_t, { file sock_file dir }) @@ -36,7 +38,6 @@ files_pid_filetrans(pcscd_t, pcscd_var_run_t, { file sock_file dir })
kernel_read_system_state(pcscd_t) kernel_read_system_state(pcscd_t)
@ -69466,7 +69494,7 @@ index 1fb1964..5212cd2 100644
corenet_all_recvfrom_netlabel(pcscd_t) corenet_all_recvfrom_netlabel(pcscd_t)
corenet_tcp_sendrecv_generic_if(pcscd_t) corenet_tcp_sendrecv_generic_if(pcscd_t)
corenet_tcp_sendrecv_generic_node(pcscd_t) corenet_tcp_sendrecv_generic_node(pcscd_t)
@@ -45,12 +45,13 @@ corenet_sendrecv_http_client_packets(pcscd_t) @@ -45,12 +46,13 @@ corenet_sendrecv_http_client_packets(pcscd_t)
corenet_tcp_connect_http_port(pcscd_t) corenet_tcp_connect_http_port(pcscd_t)
corenet_tcp_sendrecv_http_port(pcscd_t) corenet_tcp_sendrecv_http_port(pcscd_t)
@ -69481,7 +69509,7 @@ index 1fb1964..5212cd2 100644
files_read_etc_runtime_files(pcscd_t) files_read_etc_runtime_files(pcscd_t)
term_use_unallocated_ttys(pcscd_t) term_use_unallocated_ttys(pcscd_t)
@@ -60,16 +61,26 @@ locallogin_use_fds(pcscd_t) @@ -60,16 +62,26 @@ locallogin_use_fds(pcscd_t)
logging_send_syslog_msg(pcscd_t) logging_send_syslog_msg(pcscd_t)
@ -69510,7 +69538,7 @@ index 1fb1964..5212cd2 100644
') ')
optional_policy(` optional_policy(`
@@ -85,3 +96,8 @@ optional_policy(` @@ -85,3 +97,8 @@ optional_policy(`
optional_policy(` optional_policy(`
udev_read_db(pcscd_t) udev_read_db(pcscd_t)
') ')
@ -90925,7 +90953,7 @@ index 0bf13c2..ed393a0 100644
files_list_tmp($1) files_list_tmp($1)
admin_pattern($1, gssd_tmp_t) admin_pattern($1, gssd_tmp_t)
diff --git a/rpc.te b/rpc.te diff --git a/rpc.te b/rpc.te
index 2da9fca..7f491b0 100644 index 2da9fca..23bddad 100644
--- a/rpc.te --- a/rpc.te
+++ b/rpc.te +++ b/rpc.te
@@ -6,22 +6,27 @@ policy_module(rpc, 1.15.1) @@ -6,22 +6,27 @@ policy_module(rpc, 1.15.1)
@ -91123,7 +91151,7 @@ index 2da9fca..7f491b0 100644
') ')
######################################## ########################################
@@ -202,41 +226,56 @@ optional_policy(` @@ -202,41 +226,61 @@ optional_policy(`
# #
allow nfsd_t self:capability { dac_override dac_read_search sys_admin sys_resource }; allow nfsd_t self:capability { dac_override dac_read_search sys_admin sys_resource };
@ -91177,6 +91205,11 @@ index 2da9fca..7f491b0 100644
storage_dontaudit_read_fixed_disk(nfsd_t) storage_dontaudit_read_fixed_disk(nfsd_t)
storage_raw_read_removable_device(nfsd_t) storage_raw_read_removable_device(nfsd_t)
+allow nfsd_t nfsd_unit_file_t:file manage_file_perms;
+systemd_unit_file_filetrans(nfsd_t, nfsd_unit_file_t, file)
+systemd_create_unit_file_dirs(nfsd_t)
+systemd_create_unit_file_lnk(nfsd_t)
+
+# Read access to public_content_t and public_content_rw_t +# Read access to public_content_t and public_content_rw_t
miscfiles_read_public_files(nfsd_t) miscfiles_read_public_files(nfsd_t)
@ -91189,7 +91222,7 @@ index 2da9fca..7f491b0 100644
miscfiles_manage_public_files(nfsd_t) miscfiles_manage_public_files(nfsd_t)
') ')
@@ -245,7 +284,6 @@ tunable_policy(`nfs_export_all_rw',` @@ -245,7 +289,6 @@ tunable_policy(`nfs_export_all_rw',`
dev_getattr_all_chr_files(nfsd_t) dev_getattr_all_chr_files(nfsd_t)
fs_read_noxattr_fs_files(nfsd_t) fs_read_noxattr_fs_files(nfsd_t)
@ -91197,7 +91230,7 @@ index 2da9fca..7f491b0 100644
') ')
tunable_policy(`nfs_export_all_ro',` tunable_policy(`nfs_export_all_ro',`
@@ -257,12 +295,12 @@ tunable_policy(`nfs_export_all_ro',` @@ -257,12 +300,12 @@ tunable_policy(`nfs_export_all_ro',`
fs_read_noxattr_fs_files(nfsd_t) fs_read_noxattr_fs_files(nfsd_t)
@ -91212,7 +91245,7 @@ index 2da9fca..7f491b0 100644
') ')
######################################## ########################################
@@ -270,7 +308,7 @@ optional_policy(` @@ -270,7 +313,7 @@ optional_policy(`
# GSSD local policy # GSSD local policy
# #
@ -91221,7 +91254,7 @@ index 2da9fca..7f491b0 100644
allow gssd_t self:process { getsched setsched }; allow gssd_t self:process { getsched setsched };
allow gssd_t self:fifo_file rw_fifo_file_perms; allow gssd_t self:fifo_file rw_fifo_file_perms;
@@ -280,6 +318,7 @@ manage_dirs_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t) @@ -280,6 +323,7 @@ manage_dirs_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t)
manage_files_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t) manage_files_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t)
files_tmp_filetrans(gssd_t, gssd_tmp_t, { file dir }) files_tmp_filetrans(gssd_t, gssd_tmp_t, { file dir })
@ -91229,7 +91262,7 @@ index 2da9fca..7f491b0 100644
kernel_read_network_state(gssd_t) kernel_read_network_state(gssd_t)
kernel_read_network_state_symlinks(gssd_t) kernel_read_network_state_symlinks(gssd_t)
kernel_request_load_module(gssd_t) kernel_request_load_module(gssd_t)
@@ -288,25 +327,31 @@ kernel_signal(gssd_t) @@ -288,25 +332,31 @@ kernel_signal(gssd_t)
corecmd_exec_bin(gssd_t) corecmd_exec_bin(gssd_t)
@ -91264,7 +91297,7 @@ index 2da9fca..7f491b0 100644
') ')
optional_policy(` optional_policy(`
@@ -314,9 +359,12 @@ optional_policy(` @@ -314,9 +364,12 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -109696,7 +109729,7 @@ index 61c2e07..3b86095 100644
+ ') + ')
') ')
diff --git a/tor.te b/tor.te diff --git a/tor.te b/tor.te
index 5ceacde..f24416b 100644 index 5ceacde..c919a2d 100644
--- a/tor.te --- a/tor.te
+++ b/tor.te +++ b/tor.te
@@ -13,6 +13,13 @@ policy_module(tor, 1.9.0) @@ -13,6 +13,13 @@ policy_module(tor, 1.9.0)
@ -109713,7 +109746,16 @@ index 5ceacde..f24416b 100644
type tor_t; type tor_t;
type tor_exec_t; type tor_exec_t;
init_daemon_domain(tor_t, tor_exec_t) init_daemon_domain(tor_t, tor_exec_t)
@@ -32,6 +39,10 @@ logging_log_file(tor_var_log_t) @@ -25,13 +32,19 @@ init_script_file(tor_initrc_exec_t)
type tor_var_lib_t;
files_type(tor_var_lib_t)
+files_mountpoint(tor_var_lib_t)
type tor_var_log_t;
logging_log_file(tor_var_log_t)
+files_mountpoint(tor_var_log_t)
type tor_var_run_t; type tor_var_run_t;
files_pid_file(tor_var_run_t) files_pid_file(tor_var_run_t)
init_daemon_run_dir(tor_var_run_t, "tor") init_daemon_run_dir(tor_var_run_t, "tor")
@ -109724,7 +109766,7 @@ index 5ceacde..f24416b 100644
######################################## ########################################
# #
@@ -48,6 +59,8 @@ allow tor_t tor_etc_t:dir list_dir_perms; @@ -48,6 +61,8 @@ allow tor_t tor_etc_t:dir list_dir_perms;
allow tor_t tor_etc_t:file read_file_perms; allow tor_t tor_etc_t:file read_file_perms;
allow tor_t tor_etc_t:lnk_file read_lnk_file_perms; allow tor_t tor_etc_t:lnk_file read_lnk_file_perms;
@ -109733,7 +109775,7 @@ index 5ceacde..f24416b 100644
manage_dirs_pattern(tor_t, tor_var_lib_t, tor_var_lib_t) manage_dirs_pattern(tor_t, tor_var_lib_t, tor_var_lib_t)
manage_files_pattern(tor_t, tor_var_lib_t, tor_var_lib_t) manage_files_pattern(tor_t, tor_var_lib_t, tor_var_lib_t)
manage_sock_files_pattern(tor_t, tor_var_lib_t, tor_var_lib_t) manage_sock_files_pattern(tor_t, tor_var_lib_t, tor_var_lib_t)
@@ -77,7 +90,6 @@ corenet_tcp_sendrecv_generic_node(tor_t) @@ -77,7 +92,6 @@ corenet_tcp_sendrecv_generic_node(tor_t)
corenet_udp_sendrecv_generic_node(tor_t) corenet_udp_sendrecv_generic_node(tor_t)
corenet_tcp_bind_generic_node(tor_t) corenet_tcp_bind_generic_node(tor_t)
corenet_udp_bind_generic_node(tor_t) corenet_udp_bind_generic_node(tor_t)
@ -109741,7 +109783,7 @@ index 5ceacde..f24416b 100644
corenet_sendrecv_dns_server_packets(tor_t) corenet_sendrecv_dns_server_packets(tor_t)
corenet_udp_bind_dns_port(tor_t) corenet_udp_bind_dns_port(tor_t)
corenet_udp_sendrecv_dns_port(tor_t) corenet_udp_sendrecv_dns_port(tor_t)
@@ -85,6 +97,7 @@ corenet_udp_sendrecv_dns_port(tor_t) @@ -85,6 +99,7 @@ corenet_udp_sendrecv_dns_port(tor_t)
corenet_sendrecv_tor_server_packets(tor_t) corenet_sendrecv_tor_server_packets(tor_t)
corenet_tcp_bind_tor_port(tor_t) corenet_tcp_bind_tor_port(tor_t)
corenet_tcp_sendrecv_tor_port(tor_t) corenet_tcp_sendrecv_tor_port(tor_t)
@ -109749,7 +109791,7 @@ index 5ceacde..f24416b 100644
corenet_sendrecv_all_client_packets(tor_t) corenet_sendrecv_all_client_packets(tor_t)
corenet_tcp_connect_all_ports(tor_t) corenet_tcp_connect_all_ports(tor_t)
@@ -98,19 +111,22 @@ dev_read_urand(tor_t) @@ -98,19 +113,22 @@ dev_read_urand(tor_t)
domain_use_interactive_fds(tor_t) domain_use_interactive_fds(tor_t)
files_read_etc_runtime_files(tor_t) files_read_etc_runtime_files(tor_t)
@ -114182,7 +114224,7 @@ index facdee8..2cff369 100644
+ domtrans_pattern($1,container_file_t, $2) + domtrans_pattern($1,container_file_t, $2)
') ')
diff --git a/virt.te b/virt.te diff --git a/virt.te b/virt.te
index f03dcf5..923fbbe 100644 index f03dcf5..af39887 100644
--- a/virt.te --- a/virt.te
+++ b/virt.te +++ b/virt.te
@@ -1,451 +1,403 @@ @@ -1,451 +1,403 @@
@ -115766,7 +115808,7 @@ index f03dcf5..923fbbe 100644
selinux_get_enforce_mode(virtd_lxc_t) selinux_get_enforce_mode(virtd_lxc_t)
selinux_get_fs_mount(virtd_lxc_t) selinux_get_fs_mount(virtd_lxc_t)
selinux_validate_context(virtd_lxc_t) selinux_validate_context(virtd_lxc_t)
@@ -974,194 +1260,360 @@ selinux_compute_create_context(virtd_lxc_t) @@ -974,194 +1260,364 @@ selinux_compute_create_context(virtd_lxc_t)
selinux_compute_relabel_context(virtd_lxc_t) selinux_compute_relabel_context(virtd_lxc_t)
selinux_compute_user_contexts(virtd_lxc_t) selinux_compute_user_contexts(virtd_lxc_t)
@ -116051,6 +116093,9 @@ index f03dcf5..923fbbe 100644
+ fs_manage_nfs_files(svirt_sandbox_domain) + fs_manage_nfs_files(svirt_sandbox_domain)
+ fs_manage_nfs_named_sockets(svirt_sandbox_domain) + fs_manage_nfs_named_sockets(svirt_sandbox_domain)
+ fs_manage_nfs_symlinks(svirt_sandbox_domain) + fs_manage_nfs_symlinks(svirt_sandbox_domain)
+ fs_mount_nfs(svirt_sandbox_domain)
+ fs_unmount_nfs(svirt_sandbox_domain)
+ kernel_rw_fs_sysctls(svirt_sandbox_domain)
+') +')
+ +
+tunable_policy(`virt_use_samba',` +tunable_policy(`virt_use_samba',`
@ -116064,6 +116109,8 @@ index f03dcf5..923fbbe 100644
+ fs_manage_fusefs_dirs(svirt_sandbox_domain) + fs_manage_fusefs_dirs(svirt_sandbox_domain)
+ fs_manage_fusefs_files(svirt_sandbox_domain) + fs_manage_fusefs_files(svirt_sandbox_domain)
+ fs_manage_fusefs_symlinks(svirt_sandbox_domain) + fs_manage_fusefs_symlinks(svirt_sandbox_domain)
+ fs_mount_fusefs(svirt_sandbox_domain)
+ fs_unmount_fusefs(svirt_sandbox_domain)
') ')
optional_policy(` optional_policy(`
@ -116091,7 +116138,6 @@ index f03dcf5..923fbbe 100644
+dontaudit container_t self:capability2 block_suspend ; +dontaudit container_t self:capability2 block_suspend ;
+allow container_t self:process { execstack execmem }; +allow container_t self:process { execstack execmem };
+manage_chr_files_pattern(container_t, container_file_t, container_file_t) +manage_chr_files_pattern(container_t, container_file_t, container_file_t)
+kernel_load_module(container_t)
+ +
+tunable_policy(`virt_sandbox_use_sys_admin',` +tunable_policy(`virt_sandbox_use_sys_admin',`
+ allow container_t self:capability sys_admin; + allow container_t self:capability sys_admin;
@ -116271,7 +116317,7 @@ index f03dcf5..923fbbe 100644
allow virt_qmf_t self:tcp_socket create_stream_socket_perms; allow virt_qmf_t self:tcp_socket create_stream_socket_perms;
allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms; allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms;
@@ -1174,12 +1626,12 @@ dev_read_sysfs(virt_qmf_t) @@ -1174,12 +1630,12 @@ dev_read_sysfs(virt_qmf_t)
dev_read_rand(virt_qmf_t) dev_read_rand(virt_qmf_t)
dev_read_urand(virt_qmf_t) dev_read_urand(virt_qmf_t)
@ -116286,7 +116332,7 @@ index f03dcf5..923fbbe 100644
sysnet_read_config(virt_qmf_t) sysnet_read_config(virt_qmf_t)
optional_policy(` optional_policy(`
@@ -1192,7 +1644,7 @@ optional_policy(` @@ -1192,7 +1648,7 @@ optional_policy(`
######################################## ########################################
# #
@ -116295,7 +116341,7 @@ index f03dcf5..923fbbe 100644
# #
allow virt_bridgehelper_t self:process { setcap getcap }; allow virt_bridgehelper_t self:process { setcap getcap };
@@ -1201,11 +1653,262 @@ allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms; @@ -1201,11 +1657,262 @@ allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
allow virt_bridgehelper_t self:tun_socket create_socket_perms; allow virt_bridgehelper_t self:tun_socket create_socket_perms;
allow virt_bridgehelper_t self:unix_dgram_socket create_socket_perms; allow virt_bridgehelper_t self:unix_dgram_socket create_socket_perms;

25
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.13.1 Version: 3.13.1
Release: 221%{?dist} Release: 222%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -675,6 +675,29 @@ exit 0
%endif %endif
%changelog %changelog
* Wed Nov 02 2016 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-222
- Allow abrt_dump_oops_t to drop capabilities. bz(1391040)
- Add named_t domain net_raw capability bz(1389240)
- Allow geoclue to read system info. bz(1389320)
- Make openfortivpn_t as init_deamon_domain. bz(1159899)
- Allow nfsd domain to create nfsd_unit_file_t files. bz(1382487)
- Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib
- Add interace lldpad_relabel_tmpfs
- Merge pull request #155 from rhatdan/sandbox_nfs
- Add pscsd_t wake_alarm capability2
- Allow sandbox domains to mount fuse file systems
- Add boolean to allow sandbox domains to mount nfs
- Allow hypervvssd_t to read all dirs.
- Allow isnsd_t to connect to isns_port_t
- Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib
- Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device.
- Make tor_var_lib_t and tor_var_log_t as mountpoints.
- Allow systemd-rfkill to write to /proc/kmsg bz(1388669)
- Allow init_t to relabel /dev/shm/lldpad.state
- Merge pull request #168 from rhatdan/docker
- Label tcp 51954 as isns_port_t
- Lots of new domains like OCID and RKT are user container processes
* Mon Oct 17 2016 Miroslav Grepl <mgrepl@redhat.com> - 3.13.1-221 * Mon Oct 17 2016 Miroslav Grepl <mgrepl@redhat.com> - 3.13.1-221
- Add container_file_t into contexts/customizable_types. - Add container_file_t into contexts/customizable_types.