diff --git a/container-selinux.tgz b/container-selinux.tgz index af9d4ac8..38614726 100644 Binary files a/container-selinux.tgz and b/container-selinux.tgz differ diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index de2489e1..ecefc649 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -3855,7 +3855,7 @@ index 759016583..1b9a61d18 100644 + fs_mounton_fusefs(seunshare_domain) ') diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc -index 33e0f8dad..1eb3faaa3 100644 +index 33e0f8dad..6fd767031 100644 --- a/policy/modules/kernel/corecommands.fc +++ b/policy/modules/kernel/corecommands.fc @@ -1,9 +1,10 @@ @@ -3912,19 +3912,23 @@ index 33e0f8dad..1eb3faaa3 100644 /etc/netplug\.d(/.*)? gen_context(system_u:object_r:bin_t,s0) -@@ -101,11 +118,8 @@ ifdef(`distro_redhat',` +@@ -99,13 +116,12 @@ ifdef(`distro_redhat',` - /etc/rc\.d/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0) + /etc/racoon/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0) + +-/etc/rc\.d/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0) ++/etc/init\.d/vboxdrv.* gen_context(system_u:object_r:bin_t,s0) -/etc/security/namespace.init -- gen_context(system_u:object_r:bin_t,s0) -- ++/etc/rc\.d/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0) + /etc/sysconfig/crond -- gen_context(system_u:object_r:bin_t,s0) /etc/sysconfig/init -- gen_context(system_u:object_r:bin_t,s0) -/etc/sysconfig/libvirtd -- gen_context(system_u:object_r:bin_t,s0) /etc/sysconfig/netconsole -- gen_context(system_u:object_r:bin_t,s0) /etc/sysconfig/readonly-root -- gen_context(system_u:object_r:bin_t,s0) -@@ -116,6 +130,9 @@ ifdef(`distro_redhat',` +@@ -116,6 +132,9 @@ ifdef(`distro_redhat',` /etc/vmware-tools(/.*)? gen_context(system_u:object_r:bin_t,s0) @@ -3934,7 +3938,7 @@ index 33e0f8dad..1eb3faaa3 100644 /etc/X11/xdm/GiveConsole -- gen_context(system_u:object_r:bin_t,s0) /etc/X11/xdm/TakeConsole -- gen_context(system_u:object_r:bin_t,s0) /etc/X11/xdm/Xsetup_0 -- gen_context(system_u:object_r:bin_t,s0) -@@ -128,6 +145,8 @@ ifdef(`distro_debian',` +@@ -128,6 +147,8 @@ ifdef(`distro_debian',` /etc/mysql/debian-start -- gen_context(system_u:object_r:bin_t,s0) ') @@ -3943,7 +3947,7 @@ index 33e0f8dad..1eb3faaa3 100644 # # /lib # -@@ -135,10 +154,12 @@ ifdef(`distro_debian',` +@@ -135,10 +156,12 @@ ifdef(`distro_debian',` /lib/nut/.* -- gen_context(system_u:object_r:bin_t,s0) /lib/readahead(/.*)? gen_context(system_u:object_r:bin_t,s0) /lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0) @@ -3957,7 +3961,7 @@ index 33e0f8dad..1eb3faaa3 100644 ifdef(`distro_gentoo',` /lib/dhcpcd/dhcpcd-run-hooks -- gen_context(system_u:object_r:bin_t,s0) -@@ -149,10 +170,12 @@ ifdef(`distro_gentoo',` +@@ -149,10 +172,12 @@ ifdef(`distro_gentoo',` /lib/rcscripts/net\.modules\.d/helpers\.d/udhcpc-.* -- gen_context(system_u:object_r:bin_t,s0) ') @@ -3971,7 +3975,7 @@ index 33e0f8dad..1eb3faaa3 100644 /sbin/.* gen_context(system_u:object_r:bin_t,s0) /sbin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0) /sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0) -@@ -168,6 +191,7 @@ ifdef(`distro_gentoo',` +@@ -168,6 +193,7 @@ ifdef(`distro_gentoo',` /opt/(.*/)?sbin(/.*)? gen_context(system_u:object_r:bin_t,s0) /opt/google/talkplugin(/.*)? gen_context(system_u:object_r:bin_t,s0) @@ -3979,7 +3983,7 @@ index 33e0f8dad..1eb3faaa3 100644 /opt/gutenprint/cups/lib/filter(/.*)? gen_context(system_u:object_r:bin_t,s0) -@@ -179,34 +203,50 @@ ifdef(`distro_gentoo',` +@@ -179,34 +205,50 @@ ifdef(`distro_gentoo',` /opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0) ') @@ -4039,7 +4043,7 @@ index 33e0f8dad..1eb3faaa3 100644 /usr/lib/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0) /usr/lib/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0) -@@ -218,19 +258,32 @@ ifdef(`distro_gentoo',` +@@ -218,19 +260,32 @@ ifdef(`distro_gentoo',` /usr/lib/mailman/mail(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/mediawiki/math/texvc.* gen_context(system_u:object_r:bin_t,s0) /usr/lib/misc/sftp-server -- gen_context(system_u:object_r:bin_t,s0) @@ -4079,7 +4083,7 @@ index 33e0f8dad..1eb3faaa3 100644 /usr/lib/xfce4/exo-1/exo-compose-mail-1 -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/xfce4/exo-1/exo-helper-1 -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/xfce4/panel/migrate -- gen_context(system_u:object_r:bin_t,s0) -@@ -245,26 +298,41 @@ ifdef(`distro_gentoo',` +@@ -245,26 +300,41 @@ ifdef(`distro_gentoo',` /usr/lib/debug/sbin(/.*)? -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/debug/usr/bin(/.*)? -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/debug/usr/sbin(/.*)? -- gen_context(system_u:object_r:bin_t,s0) @@ -4126,7 +4130,7 @@ index 33e0f8dad..1eb3faaa3 100644 /usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/sbin/smrsh -- gen_context(system_u:object_r:shell_exec_t,s0) -@@ -280,10 +348,14 @@ ifdef(`distro_gentoo',` +@@ -280,10 +350,14 @@ ifdef(`distro_gentoo',` /usr/share/cluster/.*\.sh gen_context(system_u:object_r:bin_t,s0) /usr/share/cluster/ocf-shellfuncs -- gen_context(system_u:object_r:bin_t,s0) /usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0) @@ -4141,7 +4145,7 @@ index 33e0f8dad..1eb3faaa3 100644 /usr/share/gnucash/finance-quote-check -- gen_context(system_u:object_r:bin_t,s0) /usr/share/gnucash/finance-quote-helper -- gen_context(system_u:object_r:bin_t,s0) /usr/share/hal/device-manager/hal-device-manager -- gen_context(system_u:object_r:bin_t,s0) -@@ -298,16 +370,22 @@ ifdef(`distro_gentoo',` +@@ -298,16 +372,22 @@ ifdef(`distro_gentoo',` /usr/share/selinux/devel/policygentool -- gen_context(system_u:object_r:bin_t,s0) /usr/share/smolt/client(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall/compiler\.pl -- gen_context(system_u:object_r:bin_t,s0) @@ -4166,7 +4170,7 @@ index 33e0f8dad..1eb3faaa3 100644 ifdef(`distro_debian',` /usr/lib/ConsoleKit/.* -- gen_context(system_u:object_r:bin_t,s0) -@@ -325,20 +403,27 @@ ifdef(`distro_redhat', ` +@@ -325,20 +405,27 @@ ifdef(`distro_redhat', ` /etc/gdm/[^/]+ -d gen_context(system_u:object_r:bin_t,s0) /etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0) @@ -4195,7 +4199,7 @@ index 33e0f8dad..1eb3faaa3 100644 /usr/share/pwlib/make/ptlib-config -- gen_context(system_u:object_r:bin_t,s0) /usr/share/pydict/pydict\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/rhn/rhn_applet/applet\.py -- gen_context(system_u:object_r:bin_t,s0) -@@ -346,6 +431,7 @@ ifdef(`distro_redhat', ` +@@ -346,6 +433,7 @@ ifdef(`distro_redhat', ` /usr/share/ssl/misc(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/switchdesk/switchdesk-gui\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-date/system-config-date\.py -- gen_context(system_u:object_r:bin_t,s0) @@ -4203,7 +4207,7 @@ index 33e0f8dad..1eb3faaa3 100644 /usr/share/system-config-selinux/polgen\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-selinux/system-config-selinux\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-display/system-config-display -- gen_context(system_u:object_r:bin_t,s0) -@@ -387,17 +473,36 @@ ifdef(`distro_suse', ` +@@ -387,17 +475,36 @@ ifdef(`distro_suse', ` # # /var # @@ -11422,7 +11426,7 @@ index 0b1a8715a..849b00191 100644 +dev_getattr_all(devices_unconfined_type) + diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if -index 6a1e4d156..4b87be8e4 100644 +index 6a1e4d156..452a80549 100644 --- a/policy/modules/kernel/domain.if +++ b/policy/modules/kernel/domain.if @@ -76,33 +76,8 @@ interface(`domain_type',` @@ -11670,7 +11674,7 @@ index 6a1e4d156..4b87be8e4 100644 ## Unconfined access to domains. ## ## -@@ -1530,4 +1636,101 @@ interface(`domain_unconfined',` +@@ -1530,4 +1636,102 @@ interface(`domain_unconfined',` typeattribute $1 can_change_object_identity; typeattribute $1 set_curr_context; typeattribute $1 process_uncond_exempt; @@ -11678,6 +11682,7 @@ index 6a1e4d156..4b87be8e4 100644 + mcs_process_set_categories($1) + + userdom_filetrans_home_content($1) ++ domain_named_filetrans($1) +') + +######################################## @@ -12608,7 +12613,7 @@ index b876c48ad..2e591a538 100644 + +/sysroot/ostree/deploy/.*-atomic/deploy(/.*)? gen_context(system_u:object_r:root_t,s0) diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if -index f962f76ad..bb8b58852 100644 +index f962f76ad..74a6d0a54 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -19,6 +19,136 @@ @@ -13442,37 +13447,44 @@ index f962f76ad..bb8b58852 100644 ## Do not audit attempts to set the attributes on all mount points. ## ## -@@ -1691,44 +2139,44 @@ interface(`files_dontaudit_list_all_mountpoints',` +@@ -1691,6 +2139,24 @@ interface(`files_dontaudit_list_all_mountpoints',` ######################################## ## --## Do not audit attempts to write to mount points. +## Write all mount points. - ## - ## - ## --## Domain to not audit. ++## ++## ++## +## Domain allowed access. - ## - ## - # --interface(`files_dontaudit_write_all_mountpoints',` -- gen_require(` -- attribute mountpoint; -- ') ++## ++## ++# +interface(`files_write_all_mountpoints',` + gen_require(` + attribute mountpoint; + ') - -- dontaudit $1 mountpoint:dir write; ++ + allow $1 mountpoint:dir write; ++') ++ ++######################################## ++## + ## Do not audit attempts to write to mount points. + ## + ## +@@ -1703,104 +2169,233 @@ interface(`files_dontaudit_write_all_mountpoints',` + gen_require(` + attribute mountpoint; + ') ++ dontaudit $1 self:capability { dac_read_search }; + + dontaudit $1 mountpoint:dir write; ') ######################################## ## -## List the contents of the root directory. -+## Do not audit attempts to write to mount points. ++## Do not audit attempts to unmount all mount points. ## ## ## @@ -13482,45 +13494,20 @@ index f962f76ad..bb8b58852 100644 ## # -interface(`files_list_root',` -+interface(`files_dontaudit_write_all_mountpoints',` - gen_require(` -- type root_t; -+ attribute mountpoint; - ') -+ dontaudit $1 self:capability { dac_read_search }; - -- allow $1 root_t:dir list_dir_perms; -- allow $1 root_t:lnk_file { read_lnk_file_perms ioctl lock }; -+ dontaudit $1 mountpoint:dir write; - ') - - ######################################## - ## --## Do not audit attempts to write to / dirs. -+## Do not audit attempts to unmount all mount points. - ## - ## - ## -@@ -1736,79 +2184,208 @@ interface(`files_list_root',` - ## - ## - # --interface(`files_dontaudit_write_root_dirs',` +interface(`files_dontaudit_unmount_all_mountpoints',` gen_require(` - type root_t; + attribute mountpoint; ') -- dontaudit $1 root_t:dir write; +- allow $1 root_t:dir list_dir_perms; +- allow $1 root_t:lnk_file { read_lnk_file_perms ioctl lock }; + dontaudit $1 mountpoint:filesystem unmount; ') --################### -+######################################## + ######################################## ## --## Do not audit attempts to write --## files in the root directory. +-## Do not audit attempts to write to / dirs. +## Read all mountpoint symbolic links. ## ## @@ -13530,23 +13517,48 @@ index f962f76ad..bb8b58852 100644 ## ## # --interface(`files_dontaudit_rw_root_dir',` +-interface(`files_dontaudit_write_root_dirs',` +interface(`files_read_all_mountpoint_symlinks',` gen_require(` - type root_t; + attribute mountpoint; ') -- dontaudit $1 root_t:dir rw_dir_perms; +- dontaudit $1 root_t:dir write; + allow $1 mountpoint:lnk_file read_lnk_file_perms; ') +-################### + ++######################################## + ## +-## Do not audit attempts to write +-## files in the root directory. ++## Make all mountpoint as entrypoint. + ## + ## + ## +-## Domain to not audit. ++## Domain allowed access. + ## + ## + # +-interface(`files_dontaudit_rw_root_dir',` ++interface(`files_entrypoint_all_mountpoint',` + gen_require(` +- type root_t; ++ attribute mountpoint; + ') + +- dontaudit $1 root_t:dir rw_dir_perms; ++ allow $1 mountpoint:file entrypoint; + ') + ######################################## ## -## Create an object in the root directory, with a private -## type using a type transition. -+## Make all mountpoint as entrypoint. ++## Remove all file type directories. ## ## ## @@ -13570,14 +13582,14 @@ index f962f76ad..bb8b58852 100644 -## # -interface(`files_root_filetrans',` -+interface(`files_entrypoint_all_mountpoint',` ++interface(`files_rmdir_all_dirs',` gen_require(` - type root_t; -+ attribute mountpoint; ++ attribute file_type; ') - filetrans_pattern($1, root_t, $2, $3, $4) -+ allow $1 mountpoint:file entrypoint; ++ allow $1 file_type:dir rmdir; ') ######################################## @@ -13585,15 +13597,13 @@ index f962f76ad..bb8b58852 100644 -## Do not audit attempts to read files in -## the root directory. +## Write all file type directories. - ## - ## - ## --## Domain to not audit. ++## ++## ++## +## Domain allowed access. - ## - ## - # --interface(`files_dontaudit_read_root_files',` ++## ++## ++# +interface(`files_write_all_dirs',` + gen_require(` + attribute file_type; @@ -13733,18 +13743,10 @@ index f962f76ad..bb8b58852 100644 +## +## Do not audit attempts to read files in +## the root directory. -+## -+## -+## -+## Domain to not audit. -+## -+## -+# -+interface(`files_dontaudit_read_root_files',` - gen_require(` - type root_t; - ') -@@ -1892,25 +2469,25 @@ interface(`files_delete_root_dir_entry',` + ## + ## + ## +@@ -1892,25 +2487,25 @@ interface(`files_delete_root_dir_entry',` ######################################## ## @@ -13776,7 +13778,7 @@ index f962f76ad..bb8b58852 100644 ## ## ## -@@ -1923,7 +2500,7 @@ interface(`files_relabel_rootfs',` +@@ -1923,7 +2518,7 @@ interface(`files_relabel_rootfs',` type root_t; ') @@ -13785,7 +13787,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -1946,6 +2523,42 @@ interface(`files_unmount_rootfs',` +@@ -1946,6 +2541,42 @@ interface(`files_unmount_rootfs',` ######################################## ## @@ -13828,7 +13830,7 @@ index f962f76ad..bb8b58852 100644 ## Get attributes of the /boot directory. ## ## -@@ -2181,6 +2794,24 @@ interface(`files_relabelfrom_boot_files',` +@@ -2181,6 +2812,24 @@ interface(`files_relabelfrom_boot_files',` relabelfrom_files_pattern($1, boot_t, boot_t) ') @@ -13853,7 +13855,7 @@ index f962f76ad..bb8b58852 100644 ###################################### ## ## Read symbolic links in the /boot directory. -@@ -2557,6 +3188,24 @@ interface(`files_read_default_pipes',` +@@ -2557,6 +3206,24 @@ interface(`files_read_default_pipes',` ######################################## ## @@ -13878,7 +13880,7 @@ index f962f76ad..bb8b58852 100644 ## Search the contents of /etc directories. ## ## -@@ -2645,6 +3294,24 @@ interface(`files_rw_etc_dirs',` +@@ -2645,6 +3312,24 @@ interface(`files_rw_etc_dirs',` allow $1 etc_t:dir rw_dir_perms; ') @@ -13903,7 +13905,7 @@ index f962f76ad..bb8b58852 100644 ########################################## ## ## Manage generic directories in /etc -@@ -2716,6 +3383,7 @@ interface(`files_read_etc_files',` +@@ -2716,6 +3401,7 @@ interface(`files_read_etc_files',` allow $1 etc_t:dir list_dir_perms; read_files_pattern($1, etc_t, etc_t) read_lnk_files_pattern($1, etc_t, etc_t) @@ -13911,7 +13913,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -2724,7 +3392,7 @@ interface(`files_read_etc_files',` +@@ -2724,7 +3410,7 @@ interface(`files_read_etc_files',` ## ## ## @@ -13920,7 +13922,7 @@ index f962f76ad..bb8b58852 100644 ## ## # -@@ -2780,6 +3448,25 @@ interface(`files_manage_etc_files',` +@@ -2780,6 +3466,25 @@ interface(`files_manage_etc_files',` ######################################## ## @@ -13946,7 +13948,7 @@ index f962f76ad..bb8b58852 100644 ## Delete system configuration files in /etc. ## ## -@@ -2798,6 +3485,24 @@ interface(`files_delete_etc_files',` +@@ -2798,6 +3503,24 @@ interface(`files_delete_etc_files',` ######################################## ## @@ -13971,7 +13973,7 @@ index f962f76ad..bb8b58852 100644 ## Execute generic files in /etc. ## ## -@@ -2963,26 +3668,8 @@ interface(`files_delete_boot_flag',` +@@ -2963,26 +3686,8 @@ interface(`files_delete_boot_flag',` ######################################## ## @@ -14000,7 +14002,7 @@ index f962f76ad..bb8b58852 100644 ## ## ##

-@@ -3021,9 +3708,7 @@ interface(`files_read_etc_runtime_files',` +@@ -3021,9 +3726,7 @@ interface(`files_read_etc_runtime_files',` ######################################## ##

@@ -14011,7 +14013,7 @@ index f962f76ad..bb8b58852 100644 ## ## ## -@@ -3031,18 +3716,17 @@ interface(`files_read_etc_runtime_files',` +@@ -3031,18 +3734,17 @@ interface(`files_read_etc_runtime_files',` ## ## # @@ -14033,7 +14035,7 @@ index f962f76ad..bb8b58852 100644 ## ## ## -@@ -3060,6 +3744,26 @@ interface(`files_dontaudit_write_etc_runtime_files',` +@@ -3060,6 +3762,26 @@ interface(`files_dontaudit_write_etc_runtime_files',` ######################################## ## @@ -14060,7 +14062,7 @@ index f962f76ad..bb8b58852 100644 ## Read and write files in /etc that are dynamically ## created on boot, such as mtab. ## -@@ -3077,6 +3781,7 @@ interface(`files_rw_etc_runtime_files',` +@@ -3077,6 +3799,7 @@ interface(`files_rw_etc_runtime_files',` allow $1 etc_t:dir list_dir_perms; rw_files_pattern($1, etc_t, etc_runtime_t) @@ -14068,7 +14070,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3098,6 +3803,7 @@ interface(`files_manage_etc_runtime_files',` +@@ -3098,6 +3821,7 @@ interface(`files_manage_etc_runtime_files',` ') manage_files_pattern($1, { etc_t etc_runtime_t }, etc_runtime_t) @@ -14076,7 +14078,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3142,10 +3848,48 @@ interface(`files_etc_filetrans_etc_runtime',` +@@ -3142,10 +3866,48 @@ interface(`files_etc_filetrans_etc_runtime',` # interface(`files_getattr_isid_type_dirs',` gen_require(` @@ -14127,7 +14129,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3161,10 +3905,10 @@ interface(`files_getattr_isid_type_dirs',` +@@ -3161,10 +3923,10 @@ interface(`files_getattr_isid_type_dirs',` # interface(`files_dontaudit_search_isid_type_dirs',` gen_require(` @@ -14140,7 +14142,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3180,10 +3924,10 @@ interface(`files_dontaudit_search_isid_type_dirs',` +@@ -3180,10 +3942,10 @@ interface(`files_dontaudit_search_isid_type_dirs',` # interface(`files_list_isid_type_dirs',` gen_require(` @@ -14153,7 +14155,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3199,10 +3943,10 @@ interface(`files_list_isid_type_dirs',` +@@ -3199,10 +3961,10 @@ interface(`files_list_isid_type_dirs',` # interface(`files_rw_isid_type_dirs',` gen_require(` @@ -14166,7 +14168,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3218,10 +3962,66 @@ interface(`files_rw_isid_type_dirs',` +@@ -3218,10 +3980,66 @@ interface(`files_rw_isid_type_dirs',` # interface(`files_delete_isid_type_dirs',` gen_require(` @@ -14235,7 +14237,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3237,10 +4037,10 @@ interface(`files_delete_isid_type_dirs',` +@@ -3237,10 +4055,10 @@ interface(`files_delete_isid_type_dirs',` # interface(`files_manage_isid_type_dirs',` gen_require(` @@ -14248,7 +14250,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3256,10 +4056,29 @@ interface(`files_manage_isid_type_dirs',` +@@ -3256,10 +4074,29 @@ interface(`files_manage_isid_type_dirs',` # interface(`files_mounton_isid_type_dirs',` gen_require(` @@ -14280,7 +14282,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3275,10 +4094,10 @@ interface(`files_mounton_isid_type_dirs',` +@@ -3275,10 +4112,10 @@ interface(`files_mounton_isid_type_dirs',` # interface(`files_read_isid_type_files',` gen_require(` @@ -14293,7 +14295,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3294,10 +4113,10 @@ interface(`files_read_isid_type_files',` +@@ -3294,10 +4131,10 @@ interface(`files_read_isid_type_files',` # interface(`files_delete_isid_type_files',` gen_require(` @@ -14306,7 +14308,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3313,10 +4132,10 @@ interface(`files_delete_isid_type_files',` +@@ -3313,10 +4150,10 @@ interface(`files_delete_isid_type_files',` # interface(`files_delete_isid_type_symlinks',` gen_require(` @@ -14319,7 +14321,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3332,10 +4151,10 @@ interface(`files_delete_isid_type_symlinks',` +@@ -3332,10 +4169,10 @@ interface(`files_delete_isid_type_symlinks',` # interface(`files_delete_isid_type_fifo_files',` gen_require(` @@ -14332,7 +14334,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3351,10 +4170,10 @@ interface(`files_delete_isid_type_fifo_files',` +@@ -3351,10 +4188,10 @@ interface(`files_delete_isid_type_fifo_files',` # interface(`files_delete_isid_type_sock_files',` gen_require(` @@ -14345,7 +14347,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3370,10 +4189,10 @@ interface(`files_delete_isid_type_sock_files',` +@@ -3370,10 +4207,10 @@ interface(`files_delete_isid_type_sock_files',` # interface(`files_delete_isid_type_blk_files',` gen_require(` @@ -14358,7 +14360,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3389,10 +4208,10 @@ interface(`files_delete_isid_type_blk_files',` +@@ -3389,10 +4226,10 @@ interface(`files_delete_isid_type_blk_files',` # interface(`files_dontaudit_write_isid_chr_files',` gen_require(` @@ -14371,7 +14373,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3408,10 +4227,10 @@ interface(`files_dontaudit_write_isid_chr_files',` +@@ -3408,10 +4245,10 @@ interface(`files_dontaudit_write_isid_chr_files',` # interface(`files_delete_isid_type_chr_files',` gen_require(` @@ -14384,7 +14386,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3427,10 +4246,10 @@ interface(`files_delete_isid_type_chr_files',` +@@ -3427,10 +4264,10 @@ interface(`files_delete_isid_type_chr_files',` # interface(`files_manage_isid_type_files',` gen_require(` @@ -14397,7 +14399,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3446,10 +4265,10 @@ interface(`files_manage_isid_type_files',` +@@ -3446,10 +4283,10 @@ interface(`files_manage_isid_type_files',` # interface(`files_manage_isid_type_symlinks',` gen_require(` @@ -14410,7 +14412,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3465,10 +4284,29 @@ interface(`files_manage_isid_type_symlinks',` +@@ -3465,10 +4302,29 @@ interface(`files_manage_isid_type_symlinks',` # interface(`files_rw_isid_type_blk_files',` gen_require(` @@ -14442,7 +14444,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3484,10 +4322,10 @@ interface(`files_rw_isid_type_blk_files',` +@@ -3484,10 +4340,10 @@ interface(`files_rw_isid_type_blk_files',` # interface(`files_manage_isid_type_blk_files',` gen_require(` @@ -14455,7 +14457,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3503,10 +4341,29 @@ interface(`files_manage_isid_type_blk_files',` +@@ -3503,10 +4359,29 @@ interface(`files_manage_isid_type_blk_files',` # interface(`files_manage_isid_type_chr_files',` gen_require(` @@ -14487,7 +14489,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3552,6 +4409,27 @@ interface(`files_dontaudit_getattr_home_dir',` +@@ -3552,6 +4427,27 @@ interface(`files_dontaudit_getattr_home_dir',` ######################################## ## @@ -14515,7 +14517,7 @@ index f962f76ad..bb8b58852 100644 ## Search home directories root (/home). ## ## -@@ -3814,20 +4692,38 @@ interface(`files_list_mnt',` +@@ -3814,20 +4710,38 @@ interface(`files_list_mnt',` ###################################### ## @@ -14559,7 +14561,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -3921,6 +4817,45 @@ interface(`files_read_mnt_symlinks',` +@@ -3921,6 +4835,45 @@ interface(`files_read_mnt_symlinks',` read_lnk_files_pattern($1, mnt_t, mnt_t) ') @@ -14605,7 +14607,7 @@ index f962f76ad..bb8b58852 100644 ######################################## ## ## Create, read, write, and delete symbolic links in /mnt. -@@ -4012,6 +4947,7 @@ interface(`files_read_kernel_modules',` +@@ -4012,6 +4965,7 @@ interface(`files_read_kernel_modules',` allow $1 modules_object_t:dir list_dir_perms; read_files_pattern($1, modules_object_t, modules_object_t) read_lnk_files_pattern($1, modules_object_t, modules_object_t) @@ -14613,7 +14615,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -4217,48 +5153,218 @@ interface(`files_read_world_readable_sockets',` +@@ -4217,48 +5171,235 @@ interface(`files_read_world_readable_sockets',` allow $1 readable_t:sock_file read_sock_file_perms; ') @@ -14793,6 +14795,23 @@ index f962f76ad..bb8b58852 100644 + files_filetrans_system_db_named_files($1) +') + ++###################################### ++## ++## Map manageable system db files in /var/lib. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_map_system_db_files',` ++ gen_require(` ++ type system_db_t; ++ ') ++ allow $1 system_db_t:file map; ++') ++ +##################################### +## +## File name transition for system db files in /var/lib. @@ -14858,7 +14877,7 @@ index f962f76ad..bb8b58852 100644 ## ## ## -@@ -4266,6 +5372,45 @@ interface(`files_getattr_tmp_dirs',` +@@ -4266,6 +5407,45 @@ interface(`files_getattr_tmp_dirs',` ## ## # @@ -14904,7 +14923,7 @@ index f962f76ad..bb8b58852 100644 interface(`files_dontaudit_getattr_tmp_dirs',` gen_require(` type tmp_t; -@@ -4289,6 +5434,8 @@ interface(`files_search_tmp',` +@@ -4289,6 +5469,8 @@ interface(`files_search_tmp',` type tmp_t; ') @@ -14913,7 +14932,7 @@ index f962f76ad..bb8b58852 100644 allow $1 tmp_t:dir search_dir_perms; ') -@@ -4325,6 +5472,7 @@ interface(`files_list_tmp',` +@@ -4325,6 +5507,7 @@ interface(`files_list_tmp',` type tmp_t; ') @@ -14921,7 +14940,7 @@ index f962f76ad..bb8b58852 100644 allow $1 tmp_t:dir list_dir_perms; ') -@@ -4334,7 +5482,7 @@ interface(`files_list_tmp',` +@@ -4334,7 +5517,7 @@ interface(`files_list_tmp',` ## ## ## @@ -14930,7 +14949,7 @@ index f962f76ad..bb8b58852 100644 ## ## # -@@ -4346,6 +5494,25 @@ interface(`files_dontaudit_list_tmp',` +@@ -4346,6 +5529,25 @@ interface(`files_dontaudit_list_tmp',` dontaudit $1 tmp_t:dir list_dir_perms; ') @@ -14956,7 +14975,7 @@ index f962f76ad..bb8b58852 100644 ######################################## ## ## Remove entries from the tmp directory. -@@ -4361,6 +5528,7 @@ interface(`files_delete_tmp_dir_entry',` +@@ -4361,6 +5563,7 @@ interface(`files_delete_tmp_dir_entry',` type tmp_t; ') @@ -14964,7 +14983,7 @@ index f962f76ad..bb8b58852 100644 allow $1 tmp_t:dir del_entry_dir_perms; ') -@@ -4402,6 +5570,32 @@ interface(`files_manage_generic_tmp_dirs',` +@@ -4402,6 +5605,32 @@ interface(`files_manage_generic_tmp_dirs',` ######################################## ## @@ -14997,7 +15016,7 @@ index f962f76ad..bb8b58852 100644 ## Manage temporary files and directories in /tmp. ## ## -@@ -4456,6 +5650,42 @@ interface(`files_rw_generic_tmp_sockets',` +@@ -4456,6 +5685,42 @@ interface(`files_rw_generic_tmp_sockets',` ######################################## ## @@ -15040,7 +15059,7 @@ index f962f76ad..bb8b58852 100644 ## Set the attributes of all tmp directories. ## ## -@@ -4474,6 +5704,60 @@ interface(`files_setattr_all_tmp_dirs',` +@@ -4474,6 +5739,60 @@ interface(`files_setattr_all_tmp_dirs',` ######################################## ## @@ -15101,7 +15120,7 @@ index f962f76ad..bb8b58852 100644 ## List all tmp directories. ## ## -@@ -4519,7 +5803,7 @@ interface(`files_relabel_all_tmp_dirs',` +@@ -4519,7 +5838,7 @@ interface(`files_relabel_all_tmp_dirs',` ## ## ## @@ -15110,7 +15129,7 @@ index f962f76ad..bb8b58852 100644 ## ## # -@@ -4579,7 +5863,7 @@ interface(`files_relabel_all_tmp_files',` +@@ -4579,7 +5898,7 @@ interface(`files_relabel_all_tmp_files',` ## ## ## @@ -15119,7 +15138,7 @@ index f962f76ad..bb8b58852 100644 ## ## # -@@ -4611,17 +5895,55 @@ interface(`files_read_all_tmp_files',` +@@ -4611,20 +5930,58 @@ interface(`files_read_all_tmp_files',` ######################################## ## @@ -15131,10 +15150,15 @@ index f962f76ad..bb8b58852 100644 ## ## -## Domain allowed access. +-## +-## +-## +-## +-## The type of the object to be created. +## Domain to not audit. ## ## --## +-## +# +interface(`files_dontaudit_tmp_file_leaks',` + gen_require(` @@ -15150,8 +15174,7 @@ index f962f76ad..bb8b58852 100644 +## all leaked tmpfiles files. +## +## - ## --## The type of the object to be created. ++## +## Domain to not audit. +## +## @@ -15177,10 +15200,13 @@ index f962f76ad..bb8b58852 100644 +## +## +## The type of the object to be created. ++## ++## ++## + ## + ## The object class of the object being created. ## - ## - ## -@@ -4664,6 +5986,16 @@ interface(`files_purge_tmp',` +@@ -4664,6 +6021,16 @@ interface(`files_purge_tmp',` delete_lnk_files_pattern($1, tmpfile, tmpfile) delete_fifo_files_pattern($1, tmpfile, tmpfile) delete_sock_files_pattern($1, tmpfile, tmpfile) @@ -15197,7 +15223,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -4814,6 +6146,24 @@ interface(`files_delete_usr_files',` +@@ -4814,6 +6181,24 @@ interface(`files_delete_usr_files',` ######################################## ## @@ -15222,7 +15248,7 @@ index f962f76ad..bb8b58852 100644 ## Get the attributes of files in /usr. ## ## -@@ -5112,6 +6462,24 @@ interface(`files_create_kernel_symbol_table',` +@@ -5112,6 +6497,24 @@ interface(`files_create_kernel_symbol_table',` ######################################## ## @@ -15247,7 +15273,7 @@ index f962f76ad..bb8b58852 100644 ## Read system.map in the /boot directory. ## ## -@@ -5241,6 +6609,24 @@ interface(`files_list_var',` +@@ -5241,6 +6644,24 @@ interface(`files_list_var',` ######################################## ## @@ -15272,7 +15298,7 @@ index f962f76ad..bb8b58852 100644 ## Create, read, write, and delete directories ## in the /var directory. ## -@@ -5328,7 +6714,7 @@ interface(`files_dontaudit_rw_var_files',` +@@ -5328,7 +6749,7 @@ interface(`files_dontaudit_rw_var_files',` type var_t; ') @@ -15281,7 +15307,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -5419,6 +6805,24 @@ interface(`files_var_filetrans',` +@@ -5419,6 +6840,24 @@ interface(`files_var_filetrans',` filetrans_pattern($1, var_t, $2, $3, $4) ') @@ -15306,7 +15332,7 @@ index f962f76ad..bb8b58852 100644 ######################################## ## ## Get the attributes of the /var/lib directory. -@@ -5527,6 +6931,25 @@ interface(`files_rw_var_lib_dirs',` +@@ -5527,6 +6966,25 @@ interface(`files_rw_var_lib_dirs',` ######################################## ## @@ -15332,7 +15358,7 @@ index f962f76ad..bb8b58852 100644 ## Create objects in the /var/lib directory ## ## -@@ -5596,6 +7019,25 @@ interface(`files_read_var_lib_symlinks',` +@@ -5596,6 +7054,25 @@ interface(`files_read_var_lib_symlinks',` read_lnk_files_pattern($1, { var_t var_lib_t }, var_lib_t) ') @@ -15358,7 +15384,7 @@ index f962f76ad..bb8b58852 100644 # cjp: the next two interfaces really need to be fixed # in some way. They really neeed their own types. -@@ -5619,6 +7061,42 @@ interface(`files_manage_urandom_seed',` +@@ -5619,6 +7096,42 @@ interface(`files_manage_urandom_seed',` manage_files_pattern($1, var_lib_t, var_lib_t) ') @@ -15401,7 +15427,7 @@ index f962f76ad..bb8b58852 100644 ######################################## ## ## Allow domain to manage mount tables -@@ -5641,7 +7119,7 @@ interface(`files_manage_mounttab',` +@@ -5641,7 +7154,7 @@ interface(`files_manage_mounttab',` ######################################## ## @@ -15410,7 +15436,7 @@ index f962f76ad..bb8b58852 100644 ## ## ## -@@ -5649,12 +7127,13 @@ interface(`files_manage_mounttab',` +@@ -5649,12 +7162,13 @@ interface(`files_manage_mounttab',` ## ## # @@ -15426,7 +15452,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -5672,6 +7151,7 @@ interface(`files_search_locks',` +@@ -5672,6 +7186,7 @@ interface(`files_search_locks',` type var_t, var_lock_t; ') @@ -15434,7 +15460,7 @@ index f962f76ad..bb8b58852 100644 allow $1 var_lock_t:lnk_file read_lnk_file_perms; search_dirs_pattern($1, var_t, var_lock_t) ') -@@ -5698,7 +7178,26 @@ interface(`files_dontaudit_search_locks',` +@@ -5698,7 +7213,26 @@ interface(`files_dontaudit_search_locks',` ######################################## ## @@ -15462,7 +15488,7 @@ index f962f76ad..bb8b58852 100644 ## ## ## -@@ -5706,13 +7205,12 @@ interface(`files_dontaudit_search_locks',` +@@ -5706,13 +7240,12 @@ interface(`files_dontaudit_search_locks',` ## ## # @@ -15479,7 +15505,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -5731,7 +7229,7 @@ interface(`files_rw_lock_dirs',` +@@ -5731,7 +7264,7 @@ interface(`files_rw_lock_dirs',` type var_t, var_lock_t; ') @@ -15488,7 +15514,7 @@ index f962f76ad..bb8b58852 100644 rw_dirs_pattern($1, var_t, var_lock_t) ') -@@ -5764,7 +7262,6 @@ interface(`files_create_lock_dirs',` +@@ -5764,7 +7297,6 @@ interface(`files_create_lock_dirs',` ## Domain allowed access. ## ## @@ -15496,7 +15522,7 @@ index f962f76ad..bb8b58852 100644 # interface(`files_relabel_all_lock_dirs',` gen_require(` -@@ -5779,7 +7276,7 @@ interface(`files_relabel_all_lock_dirs',` +@@ -5779,7 +7311,7 @@ interface(`files_relabel_all_lock_dirs',` ######################################## ## @@ -15505,7 +15531,7 @@ index f962f76ad..bb8b58852 100644 ## ## ## -@@ -5787,13 +7284,33 @@ interface(`files_relabel_all_lock_dirs',` +@@ -5787,13 +7319,33 @@ interface(`files_relabel_all_lock_dirs',` ## ## # @@ -15540,7 +15566,7 @@ index f962f76ad..bb8b58852 100644 allow $1 var_lock_t:dir list_dir_perms; getattr_files_pattern($1, var_lock_t, var_lock_t) ') -@@ -5809,13 +7326,12 @@ interface(`files_getattr_generic_locks',` +@@ -5809,13 +7361,12 @@ interface(`files_getattr_generic_locks',` ## # interface(`files_delete_generic_locks',` @@ -15558,7 +15584,7 @@ index f962f76ad..bb8b58852 100644 ') ######################################## -@@ -5834,9 +7350,7 @@ interface(`files_manage_generic_locks',` +@@ -5834,9 +7385,7 @@ interface(`files_manage_generic_locks',` type var_t, var_lock_t; ') @@ -15569,7 +15595,7 @@ index f962f76ad..bb8b58852 100644 manage_files_pattern($1, var_lock_t, var_lock_t) ') -@@ -5878,8 +7392,7 @@ interface(`files_read_all_locks',` +@@ -5878,8 +7427,7 @@ interface(`files_read_all_locks',` type var_t, var_lock_t; ') @@ -15579,7 +15605,7 @@ index f962f76ad..bb8b58852 100644 allow $1 lockfile:dir list_dir_perms; read_files_pattern($1, lockfile, lockfile) read_lnk_files_pattern($1, lockfile, lockfile) -@@ -5901,8 +7414,7 @@ interface(`files_manage_all_locks',` +@@ -5901,8 +7449,7 @@ interface(`files_manage_all_locks',` type var_t, var_lock_t; ') @@ -15589,7 +15615,7 @@ index f962f76ad..bb8b58852 100644 manage_dirs_pattern($1, lockfile, lockfile) manage_files_pattern($1, lockfile, lockfile) manage_lnk_files_pattern($1, lockfile, lockfile) -@@ -5939,8 +7451,7 @@ interface(`files_lock_filetrans',` +@@ -5939,8 +7486,7 @@ interface(`files_lock_filetrans',` type var_t, var_lock_t; ') @@ -15599,7 +15625,7 @@ index f962f76ad..bb8b58852 100644 filetrans_pattern($1, var_lock_t, $2, $3, $4) ') -@@ -5979,7 +7490,7 @@ interface(`files_setattr_pid_dirs',` +@@ -5979,7 +7525,7 @@ interface(`files_setattr_pid_dirs',` type var_run_t; ') @@ -15608,7 +15634,7 @@ index f962f76ad..bb8b58852 100644 allow $1 var_run_t:dir setattr; ') -@@ -5999,10 +7510,48 @@ interface(`files_search_pids',` +@@ -5999,10 +7545,48 @@ interface(`files_search_pids',` type var_t, var_run_t; ') @@ -15657,69 +15683,101 @@ index f962f76ad..bb8b58852 100644 ######################################## ## ## Do not audit attempts to search -@@ -6025,6 +7574,43 @@ interface(`files_dontaudit_search_pids',` +@@ -6025,42 +7609,79 @@ interface(`files_dontaudit_search_pids',` ######################################## ## +-## List the contents of the runtime process +-## ID directories (/var/run). +## Do not audit attempts to search +## the all /var/run directory. -+## -+## -+## + ## + ## + ## +-## Domain allowed access. +## Domain to not audit. -+## -+## -+# + ## + ## + # +-interface(`files_list_pids',` +interface(`files_dontaudit_search_all_pids',` -+ gen_require(` + gen_require(` +- type var_t, var_run_t; + attribute pidfile; -+ ') -+ + ') + +- allow $1 var_run_t:lnk_file read_lnk_file_perms; +- list_dirs_pattern($1, var_t, var_run_t) + dontaudit $1 pidfile:dir search_dir_perms; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Read generic process ID files. +## Allow search the all /var/run directory. -+## -+## -+## + ## + ## + ## +-## Domain allowed access. +## Domain to not audit. -+## -+## -+# + ## + ## + # +-interface(`files_read_generic_pids',` +interface(`files_search_all_pids',` -+ gen_require(` + gen_require(` +- type var_t, var_run_t; + attribute pidfile; -+ ') -+ + ') + +- allow $1 var_run_t:lnk_file read_lnk_file_perms; +- list_dirs_pattern($1, var_t, var_run_t) +- read_files_pattern($1, var_run_t, var_run_t) + allow $1 pidfile:dir search_dir_perms; +') + +######################################## +## - ## List the contents of the runtime process - ## ID directories (/var/run). - ## -@@ -6039,7 +7625,7 @@ interface(`files_list_pids',` - type var_t, var_run_t; - ') - -- allow $1 var_run_t:lnk_file read_lnk_file_perms; ++## List the contents of the runtime process ++## ID directories (/var/run). ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_list_pids',` ++ gen_require(` ++ type var_t, var_run_t; ++ ') ++ + files_search_pids($1) - list_dirs_pattern($1, var_t, var_run_t) ++ list_dirs_pattern($1, var_t, var_run_t) ++') ++ ++######################################## ++## ++## Read generic process ID files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_read_generic_pids',` ++ gen_require(` ++ type var_t, var_run_t; ++ ') ++ ++ files_search_pids($1) ++ list_dirs_pattern($1, var_t, var_run_t) ++ read_files_pattern($1, var_run_t, var_run_t) ') -@@ -6058,7 +7644,7 @@ interface(`files_read_generic_pids',` - type var_t, var_run_t; - ') - -- allow $1 var_run_t:lnk_file read_lnk_file_perms; -+ files_search_pids($1) - list_dirs_pattern($1, var_t, var_run_t) - read_files_pattern($1, var_run_t, var_run_t) - ') -@@ -6078,7 +7664,7 @@ interface(`files_write_generic_pid_pipes',` + ######################################## +@@ -6078,7 +7699,7 @@ interface(`files_write_generic_pid_pipes',` type var_run_t; ') @@ -15728,7 +15786,7 @@ index f962f76ad..bb8b58852 100644 allow $1 var_run_t:fifo_file write; ') -@@ -6140,7 +7726,6 @@ interface(`files_pid_filetrans',` +@@ -6140,7 +7761,6 @@ interface(`files_pid_filetrans',` ') allow $1 var_t:dir search_dir_perms; @@ -15736,7 +15794,7 @@ index f962f76ad..bb8b58852 100644 filetrans_pattern($1, var_run_t, $2, $3, $4) ') -@@ -6169,6 +7754,24 @@ interface(`files_pid_filetrans_lock_dir',` +@@ -6169,6 +7789,24 @@ interface(`files_pid_filetrans_lock_dir',` ######################################## ## @@ -15761,7 +15819,7 @@ index f962f76ad..bb8b58852 100644 ## Read and write generic process ID files. ## ## -@@ -6182,7 +7785,7 @@ interface(`files_rw_generic_pids',` +@@ -6182,7 +7820,7 @@ interface(`files_rw_generic_pids',` type var_t, var_run_t; ') @@ -15770,221 +15828,307 @@ index f962f76ad..bb8b58852 100644 list_dirs_pattern($1, var_t, var_run_t) rw_files_pattern($1, var_run_t, var_run_t) ') -@@ -6249,6 +7852,116 @@ interface(`files_dontaudit_ioctl_all_pids',` +@@ -6249,55 +7887,43 @@ interface(`files_dontaudit_ioctl_all_pids',` ######################################## ## +-## Read all process ID files. +## Relable all pid directories -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`files_relabel_all_pid_dirs',` -+ gen_require(` -+ attribute pidfile; -+ ') -+ -+ relabel_dirs_pattern($1, pidfile, pidfile) -+') -+ -+######################################## -+## -+## Delete all pid sockets -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`files_delete_all_pid_sockets',` -+ gen_require(` -+ attribute pidfile; -+ ') -+ -+ allow $1 pidfile:sock_file delete_sock_file_perms; -+') -+ -+######################################## -+## -+## Create all pid sockets -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`files_create_all_pid_sockets',` -+ gen_require(` -+ attribute pidfile; -+ ') -+ -+ allow $1 pidfile:sock_file create_sock_file_perms; -+') -+ -+######################################## -+## -+## Create all pid named pipes -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`files_create_all_pid_pipes',` -+ gen_require(` -+ attribute pidfile; -+ ') -+ -+ allow $1 pidfile:fifo_file create_fifo_file_perms; -+') -+ -+######################################## -+## -+## Delete all pid named pipes -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`files_delete_all_pid_pipes',` -+ gen_require(` -+ attribute pidfile; -+ ') -+ -+ allow $1 pidfile:fifo_file delete_fifo_file_perms; -+') -+ -+######################################## -+## -+## manage all pidfile directories -+## in the /var/run directory. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`files_manage_all_pid_dirs',` -+ gen_require(` -+ attribute pidfile; -+ ') -+ -+ manage_dirs_pattern($1,pidfile,pidfile) -+') -+ -+ -+######################################## -+## - ## Read all process ID files. ## ## -@@ -6261,12 +7974,105 @@ interface(`files_dontaudit_ioctl_all_pids',` - interface(`files_read_all_pids',` + ## + ## Domain allowed access. + ## + ## +-## + # +-interface(`files_read_all_pids',` ++interface(`files_relabel_all_pid_dirs',` gen_require(` attribute pidfile; - type var_t, var_run_t; -+ type var_t; ') - allow $1 var_run_t:lnk_file read_lnk_file_perms; - list_dirs_pattern($1, var_t, pidfile) - read_files_pattern($1, pidfile, pidfile) -+ read_lnk_files_pattern($1, pidfile, pidfile) -+') -+ -+######################################## -+## -+## Relable all pid files -+## -+## -+## +- list_dirs_pattern($1, var_t, pidfile) +- read_files_pattern($1, pidfile, pidfile) ++ relabel_dirs_pattern($1, pidfile, pidfile) + ') + + ######################################## + ## +-## Delete all process IDs. ++## Delete all pid sockets + ## + ## + ## + ## Domain allowed access. + ## + ## +-## + # +-interface(`files_delete_all_pids',` ++interface(`files_delete_all_pid_sockets',` + gen_require(` + attribute pidfile; +- type var_t, var_run_t; + ') + +- allow $1 var_t:dir search_dir_perms; +- allow $1 var_run_t:lnk_file read_lnk_file_perms; +- allow $1 var_run_t:dir rmdir; +- allow $1 var_run_t:lnk_file delete_lnk_file_perms; +- delete_files_pattern($1, pidfile, pidfile) +- delete_fifo_files_pattern($1, pidfile, pidfile) +- delete_sock_files_pattern($1, pidfile, { pidfile var_run_t }) ++ allow $1 pidfile:sock_file delete_sock_file_perms; + ') + + ######################################## + ## +-## Delete all process ID directories. ++## Create all pid sockets + ## + ## + ## +@@ -6305,42 +7931,35 @@ interface(`files_delete_all_pids',` + ## + ## + # +-interface(`files_delete_all_pid_dirs',` ++interface(`files_create_all_pid_sockets',` + gen_require(` + attribute pidfile; +- type var_t, var_run_t; + ') + +- allow $1 var_t:dir search_dir_perms; +- allow $1 var_run_t:lnk_file read_lnk_file_perms; +- delete_dirs_pattern($1, pidfile, pidfile) ++ allow $1 pidfile:sock_file create_sock_file_perms; + ') + + ######################################## + ## +-## Create, read, write and delete all +-## var_run (pid) content ++## Create all pid named pipes + ## + ## + ## +-## Domain alloed access. +## Domain allowed access. -+## -+## -+# -+interface(`files_relabel_all_pid_files',` -+ gen_require(` + ## + ## + # +-interface(`files_manage_all_pids',` ++interface(`files_create_all_pid_pipes',` + gen_require(` + attribute pidfile; + ') + +- manage_dirs_pattern($1, pidfile, pidfile) +- manage_files_pattern($1, pidfile, pidfile) +- manage_lnk_files_pattern($1, pidfile, pidfile) ++ allow $1 pidfile:fifo_file create_fifo_file_perms; + ') + + ######################################## + ## +-## Mount filesystems on all polyinstantiation +-## member directories. ++## Delete all pid named pipes + ## + ## + ## +@@ -6348,18 +7967,18 @@ interface(`files_manage_all_pids',` + ## + ## + # +-interface(`files_mounton_all_poly_members',` ++interface(`files_delete_all_pid_pipes',` + gen_require(` +- attribute polymember; + attribute pidfile; -+ ') + ') + +- allow $1 polymember:dir mounton; ++ allow $1 pidfile:fifo_file delete_fifo_file_perms; + ') + + ######################################## + ## +-## Search the contents of generic spool +-## directories (/var/spool). ++## manage all pidfile directories ++## in the /var/run directory. + ## + ## + ## +@@ -6367,37 +7986,40 @@ interface(`files_mounton_all_poly_members',` + ## + ## + # +-interface(`files_search_spool',` ++interface(`files_manage_all_pid_dirs',` + gen_require(` +- type var_t, var_spool_t; ++ attribute pidfile; + ') + +- search_dirs_pattern($1, var_t, var_spool_t) ++ manage_dirs_pattern($1,pidfile,pidfile) + ') + + -+ relabel_files_pattern($1, pidfile, pidfile) -+') -+ -+######################################## -+## -+## Execute generic programs in /var/run in the caller domain. -+## -+## -+## + ######################################## + ## +-## Do not audit attempts to search generic +-## spool directories. ++## Read all process ID files. + ## + ## + ## +-## Domain to not audit. +## Domain allowed access. -+## -+## -+# + ## + ## ++## + # +-interface(`files_dontaudit_search_spool',` ++interface(`files_read_all_pids',` + gen_require(` +- type var_spool_t; ++ attribute pidfile; ++ type var_t; + ') + +- dontaudit $1 var_spool_t:dir search_dir_perms; ++ list_dirs_pattern($1, var_t, pidfile) ++ read_files_pattern($1, pidfile, pidfile) ++ read_lnk_files_pattern($1, pidfile, pidfile) + ') + + ######################################## + ## +-## List the contents of generic spool +-## (/var/spool) directories. ++## Relable all pid files + ## + ## + ## +@@ -6405,18 +8027,17 @@ interface(`files_dontaudit_search_spool',` + ## + ## + # +-interface(`files_list_spool',` ++interface(`files_relabel_all_pid_files',` + gen_require(` +- type var_t, var_spool_t; ++ attribute pidfile; + ') + +- list_dirs_pattern($1, var_t, var_spool_t) ++ relabel_files_pattern($1, pidfile, pidfile) + ') + + ######################################## + ## +-## Create, read, write, and delete generic +-## spool directories (/var/spool). ++## Execute generic programs in /var/run in the caller domain. + ## + ## + ## +@@ -6424,18 +8045,18 @@ interface(`files_list_spool',` + ## + ## + # +-interface(`files_manage_generic_spool_dirs',` +interface(`files_exec_generic_pid_files',` -+ gen_require(` + gen_require(` +- type var_t, var_spool_t; + type var_run_t; -+ ') -+ + ') + +- allow $1 var_t:dir search_dir_perms; +- manage_dirs_pattern($1, var_spool_t, var_spool_t) + exec_files_pattern($1, var_run_t, var_run_t) -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Read generic spool files. +## Write all sockets +## in the /var/run directory. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -6443,19 +8064,18 @@ interface(`files_manage_generic_spool_dirs',` + ## + ## + # +-interface(`files_read_generic_spool',` +interface(`files_write_all_pid_sockets',` -+ gen_require(` + gen_require(` +- type var_t, var_spool_t; + attribute pidfile; -+ ') -+ + ') + +- list_dirs_pattern($1, var_t, var_spool_t) +- read_files_pattern($1, var_spool_t, var_spool_t) + allow $1 pidfile:sock_file write_sock_file_perms; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Create, read, write, and delete generic +-## spool files. +## manage all pidfiles +## in the /var/run directory. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -6463,55 +8083,62 @@ interface(`files_read_generic_spool',` + ## + ## + # +-interface(`files_manage_generic_spool',` +interface(`files_manage_all_pids',` -+ gen_require(` + gen_require(` +- type var_t, var_spool_t; + attribute pidfile; -+ ') -+ + ') + +- allow $1 var_t:dir search_dir_perms; +- manage_files_pattern($1, var_spool_t, var_spool_t) + manage_files_pattern($1,pidfile,pidfile) -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Create objects in the spool directory +-## with a private type with a type transition. +## Mount filesystems on all polyinstantiation +## member directories. -+## -+## -+## -+## Domain allowed access. -+## -+## + ## + ## + ## + ## Domain allowed access. + ## + ## +-## +-## +-## Type to which the created node will be transitioned. +-## +-## +-## +-## +-## Object class(es) (single or set including {}) for which this +-## the transition will occur. +-## +-## +-## +# +interface(`files_mounton_all_poly_members',` + gen_require(` @@ -15992,36 +16136,107 @@ index f962f76ad..bb8b58852 100644 + ') + + allow $1 polymember:dir mounton; - ') - - ######################################## -@@ -6286,8 +8092,8 @@ interface(`files_delete_all_pids',` - type var_t, var_run_t; ++') ++ ++######################################## ++## ++## Delete all process IDs. ++## ++## + ## +-## The name of the object being created. ++## Domain allowed access. + ## + ## ++## + # +-interface(`files_spool_filetrans',` ++interface(`files_delete_all_pids',` + gen_require(` +- type var_t, var_spool_t; ++ attribute pidfile; ++ type var_t, var_run_t; ') + files_search_pids($1) allow $1 var_t:dir search_dir_perms; -- allow $1 var_run_t:lnk_file read_lnk_file_perms; - allow $1 var_run_t:dir rmdir; - allow $1 var_run_t:lnk_file delete_lnk_file_perms; - delete_files_pattern($1, pidfile, pidfile) -@@ -6311,36 +8117,80 @@ interface(`files_delete_all_pid_dirs',` - type var_t, var_run_t; - ') - -+ files_search_pids($1) - allow $1 var_t:dir search_dir_perms; -- allow $1 var_run_t:lnk_file read_lnk_file_perms; - delete_dirs_pattern($1, pidfile, pidfile) +- filetrans_pattern($1, var_spool_t, $2, $3, $4) ++ allow $1 var_run_t:dir rmdir; ++ allow $1 var_run_t:lnk_file delete_lnk_file_perms; ++ delete_files_pattern($1, pidfile, pidfile) ++ delete_fifo_files_pattern($1, pidfile, pidfile) ++ delete_sock_files_pattern($1, pidfile, { pidfile var_run_t }) ') ######################################## ## --## Create, read, write and delete all --## var_run (pid) content +-## Allow access to manage all polyinstantiated +-## directories on the system. ++## Delete all process ID directories. + ## + ## + ## +@@ -6519,64 +8146,963 @@ interface(`files_spool_filetrans',` + ## + ## + # +-interface(`files_polyinstantiate_all',` ++interface(`files_delete_all_pid_dirs',` + gen_require(` +- attribute polydir, polymember, polyparent; +- type poly_t; ++ attribute pidfile; ++ type var_t, var_run_t; + ') + +- # Need to give access to /selinux/member +- selinux_compute_member($1) +- +- # Need sys_admin capability for mounting +- allow $1 self:capability { chown fsetid sys_admin fowner }; +- +- # Need to give access to the directories to be polyinstantiated +- allow $1 polydir:dir { create open getattr search write add_name setattr mounton rmdir }; +- +- # Need to give access to the polyinstantiated subdirectories +- allow $1 polymember:dir search_dir_perms; +- +- # Need to give access to parent directories where original +- # is remounted for polyinstantiation aware programs (like gdm) +- allow $1 polyparent:dir { getattr mounton }; +- +- # Need to give permission to create directories where applicable +- allow $1 self:process setfscreate; +- allow $1 polymember: dir { create setattr relabelto }; +- allow $1 polydir: dir { write add_name open }; +- allow $1 polyparent:dir { open read write remove_name add_name relabelfrom relabelto }; +- +- # Default type for mountpoints +- allow $1 poly_t:dir { create mounton }; +- fs_unmount_xattr_fs($1) +- +- fs_mount_tmpfs($1) +- fs_unmount_tmpfs($1) +- +- ifdef(`distro_redhat',` +- # namespace.init +- files_search_tmp($1) +- files_search_home($1) +- corecmd_exec_bin($1) +- seutil_domtrans_setfiles($1) +- ') ++ files_search_pids($1) ++ allow $1 var_t:dir search_dir_perms; ++ delete_dirs_pattern($1, pidfile, pidfile) + ') + + ######################################## + ## +-## Unconfined access to files. +## Make the specified type a file +## used for spool files. -+## + ## +-## +## +##

+## Make the specified type usable for spool files. @@ -16049,18 +16264,22 @@ index f962f76ad..bb8b58852 100644 +##

+## +## -+## + ## +-## Domain allowed access. +## Type of the file to be used as a +## spool file. -+## -+## + ## + ## +## -+# + # +-interface(`files_unconfined',` +interface(`files_spool_file',` -+ gen_require(` + gen_require(` +- attribute files_unconfined_type; + attribute spoolfile; -+ ') -+ + ') + +- typeattribute $1 files_unconfined_type; + files_type($1) + typeattribute $1 spoolfile; +') @@ -16068,47 +16287,36 @@ index f962f76ad..bb8b58852 100644 +######################################## +## +## Create all spool sockets - ## - ## - ## --## Domain alloed access. ++## ++## ++## +## Domain allowed access. - ## - ## - # --interface(`files_manage_all_pids',` ++## ++## ++# +interface(`files_create_all_spool_sockets',` - gen_require(` -- attribute pidfile; ++ gen_require(` + attribute spoolfile; - ') - -- manage_dirs_pattern($1, pidfile, pidfile) -- manage_files_pattern($1, pidfile, pidfile) -- manage_lnk_files_pattern($1, pidfile, pidfile) ++ ') ++ + allow $1 spoolfile:sock_file create_sock_file_perms; - ') - - ######################################## - ## --## Mount filesystems on all polyinstantiation --## member directories. ++') ++ ++######################################## ++## +## Delete all spool sockets - ## - ## - ## -@@ -6348,12 +8198,33 @@ interface(`files_manage_all_pids',` - ## - ## - # --interface(`files_mounton_all_poly_members',` ++## ++## ++## ++## Domain allowed access. ++## ++## ++# +interface(`files_delete_all_spool_sockets',` - gen_require(` -- attribute polymember; ++ gen_require(` + attribute spoolfile; - ') - -- allow $1 polymember:dir mounton; ++ ') ++ + allow $1 spoolfile:sock_file delete_sock_file_perms; +') + @@ -16131,13 +16339,232 @@ index f962f76ad..bb8b58852 100644 + ') + + relabel_dirs_pattern($1, spoolfile, spoolfile) - ') - - ######################################## -@@ -6580,3 +8451,623 @@ interface(`files_unconfined',` - - typeattribute $1 files_unconfined_type; - ') ++') ++ ++######################################## ++## ++## Search the contents of generic spool ++## directories (/var/spool). ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_search_spool',` ++ gen_require(` ++ type var_t, var_spool_t; ++ ') ++ ++ search_dirs_pattern($1, var_t, var_spool_t) ++') ++ ++######################################## ++## ++## Do not audit attempts to search generic ++## spool directories. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`files_dontaudit_search_spool',` ++ gen_require(` ++ type var_spool_t; ++ ') ++ ++ dontaudit $1 var_spool_t:dir search_dir_perms; ++') ++ ++######################################## ++## ++## List the contents of generic spool ++## (/var/spool) directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_list_spool',` ++ gen_require(` ++ type var_t, var_spool_t; ++ ') ++ ++ list_dirs_pattern($1, var_t, var_spool_t) ++') ++ ++######################################## ++## ++## Create, read, write, and delete generic ++## spool directories (/var/spool). ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_manage_generic_spool_dirs',` ++ gen_require(` ++ type var_t, var_spool_t; ++ ') ++ ++ allow $1 var_t:dir search_dir_perms; ++ manage_dirs_pattern($1, var_spool_t, var_spool_t) ++') ++ ++######################################## ++## ++## Read generic spool files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_read_generic_spool',` ++ gen_require(` ++ type var_t, var_spool_t; ++ ') ++ ++ list_dirs_pattern($1, var_t, var_spool_t) ++ read_files_pattern($1, var_spool_t, var_spool_t) ++') ++ ++######################################## ++## ++## Create, read, write, and delete generic ++## spool files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_manage_generic_spool',` ++ gen_require(` ++ type var_t, var_spool_t; ++ ') ++ ++ allow $1 var_t:dir search_dir_perms; ++ manage_files_pattern($1, var_spool_t, var_spool_t) ++') ++ ++######################################## ++## ++## Create objects in the spool directory ++## with a private type with a type transition. ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++## ++## Type to which the created node will be transitioned. ++## ++## ++## ++## ++## Object class(es) (single or set including {}) for which this ++## the transition will occur. ++## ++## ++## ++## ++## The name of the object being created. ++## ++## ++# ++interface(`files_spool_filetrans',` ++ gen_require(` ++ type var_t, var_spool_t; ++ ') ++ ++ allow $1 var_t:dir search_dir_perms; ++ filetrans_pattern($1, var_spool_t, $2, $3, $4) ++') ++ ++######################################## ++## ++## Allow access to manage all polyinstantiated ++## directories on the system. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_polyinstantiate_all',` ++ gen_require(` ++ attribute polydir, polymember, polyparent; ++ type poly_t; ++ ') ++ ++ # Need to give access to /selinux/member ++ selinux_compute_member($1) ++ ++ # Need sys_admin capability for mounting ++ allow $1 self:capability { chown fsetid sys_admin fowner }; ++ ++ # Need to give access to the directories to be polyinstantiated ++ allow $1 polydir:dir { create open getattr search write add_name setattr mounton rmdir }; ++ ++ # Need to give access to the polyinstantiated subdirectories ++ allow $1 polymember:dir search_dir_perms; ++ ++ # Need to give access to parent directories where original ++ # is remounted for polyinstantiation aware programs (like gdm) ++ allow $1 polyparent:dir { getattr mounton }; ++ ++ # Need to give permission to create directories where applicable ++ allow $1 self:process setfscreate; ++ allow $1 polymember: dir { create setattr relabelto }; ++ allow $1 polydir: dir { write add_name open }; ++ allow $1 polyparent:dir { open read write remove_name add_name relabelfrom relabelto }; ++ ++ # Default type for mountpoints ++ allow $1 poly_t:dir { create mounton }; ++ fs_unmount_xattr_fs($1) ++ ++ fs_mount_tmpfs($1) ++ fs_unmount_tmpfs($1) ++ ++ ifdef(`distro_redhat',` ++ # namespace.init ++ files_search_tmp($1) ++ files_search_home($1) ++ corecmd_exec_bin($1) ++ seutil_domtrans_setfiles($1) ++ ') ++') ++ ++######################################## ++## ++## Unconfined access to files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_unconfined',` ++ gen_require(` ++ attribute files_unconfined_type; ++ ') ++ ++ typeattribute $1 files_unconfined_type; ++') + +######################################## +## @@ -16757,7 +17184,7 @@ index f962f76ad..bb8b58852 100644 + ') + + allow $1 modules_object_t:dir mounton; -+') + ') diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te index 1a03abdd7..3221f8018 100644 --- a/policy/modules/kernel/files.te @@ -22775,7 +23202,7 @@ index e100d886b..355a67b18 100644 +') + diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te -index 8dbab4c5e..2d283007a 100644 +index 8dbab4c5e..4818adb52 100644 --- a/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te @@ -25,6 +25,9 @@ attribute kern_unconfined; @@ -22866,8 +23293,11 @@ index 8dbab4c5e..2d283007a 100644 # /proc/sys/net directory and files type sysctl_net_t, sysctl_type; genfscon proc /sys/net gen_context(system_u:object_r:sysctl_net_t,s0) -@@ -153,6 +176,10 @@ genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0) +@@ -151,8 +174,13 @@ genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0) + + # /proc/sys/vm directory and files type sysctl_vm_t, sysctl_type; ++fs_associate(sysctl_vm_t) genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0) +# /proc/sys/vm/overcommit_memory @@ -22877,7 +23307,7 @@ index 8dbab4c5e..2d283007a 100644 # /proc/sys/dev directory and files type sysctl_dev_t, sysctl_type; genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0) -@@ -165,6 +192,14 @@ genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0) +@@ -165,6 +193,14 @@ genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0) type unlabeled_t; fs_associate(unlabeled_t) sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) @@ -22892,7 +23322,7 @@ index 8dbab4c5e..2d283007a 100644 # These initial sids are no longer used, and can be removed: sid any_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) -@@ -189,6 +224,7 @@ sid tcp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) +@@ -189,6 +225,7 @@ sid tcp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) # kernel local policy # @@ -22900,7 +23330,7 @@ index 8dbab4c5e..2d283007a 100644 allow kernel_t self:capability ~sys_module; allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow kernel_t self:shm create_shm_perms; -@@ -233,7 +269,6 @@ allow unlabeled_t unlabeled_t:packet { forward_in forward_out }; +@@ -233,7 +270,6 @@ allow unlabeled_t unlabeled_t:packet { forward_in forward_out }; corenet_in_generic_if(unlabeled_t) corenet_in_generic_node(unlabeled_t) @@ -22908,7 +23338,7 @@ index 8dbab4c5e..2d283007a 100644 corenet_all_recvfrom_netlabel(kernel_t) # Kernel-generated traffic e.g., ICMP replies: corenet_raw_sendrecv_all_if(kernel_t) -@@ -244,17 +279,26 @@ corenet_tcp_sendrecv_all_if(kernel_t) +@@ -244,17 +280,26 @@ corenet_tcp_sendrecv_all_if(kernel_t) corenet_tcp_sendrecv_all_nodes(kernel_t) corenet_raw_send_generic_node(kernel_t) corenet_send_all_packets(kernel_t) @@ -22939,7 +23369,7 @@ index 8dbab4c5e..2d283007a 100644 # Mount root file system. Used when loading a policy # from initrd, then mounting the root filesystem -@@ -263,7 +307,8 @@ fs_unmount_all_fs(kernel_t) +@@ -263,7 +308,8 @@ fs_unmount_all_fs(kernel_t) selinux_load_policy(kernel_t) @@ -22949,7 +23379,7 @@ index 8dbab4c5e..2d283007a 100644 corecmd_exec_shell(kernel_t) corecmd_list_bin(kernel_t) -@@ -277,13 +322,23 @@ files_list_root(kernel_t) +@@ -277,13 +323,23 @@ files_list_root(kernel_t) files_list_etc(kernel_t) files_list_home(kernel_t) files_read_usr_files(kernel_t) @@ -22973,7 +23403,7 @@ index 8dbab4c5e..2d283007a 100644 ifdef(`distro_redhat',` # Bugzilla 222337 -@@ -291,11 +346,29 @@ ifdef(`distro_redhat',` +@@ -291,11 +347,29 @@ ifdef(`distro_redhat',` ') optional_policy(` @@ -23003,7 +23433,7 @@ index 8dbab4c5e..2d283007a 100644 ') optional_policy(` -@@ -305,6 +378,19 @@ optional_policy(` +@@ -305,6 +379,19 @@ optional_policy(` optional_policy(` logging_send_syslog_msg(kernel_t) @@ -23023,7 +23453,7 @@ index 8dbab4c5e..2d283007a 100644 ') optional_policy(` -@@ -312,6 +398,11 @@ optional_policy(` +@@ -312,6 +399,11 @@ optional_policy(` ') optional_policy(` @@ -23035,7 +23465,7 @@ index 8dbab4c5e..2d283007a 100644 # nfs kernel server needs kernel UDP access. It is less risky and painful # to just give it everything. allow kernel_t self:tcp_socket create_stream_socket_perms; -@@ -332,9 +423,6 @@ optional_policy(` +@@ -332,9 +424,6 @@ optional_policy(` sysnet_read_config(kernel_t) @@ -23045,7 +23475,7 @@ index 8dbab4c5e..2d283007a 100644 rpc_udp_rw_nfs_sockets(kernel_t) tunable_policy(`nfs_export_all_ro',` -@@ -343,9 +431,7 @@ optional_policy(` +@@ -343,9 +432,7 @@ optional_policy(` fs_read_noxattr_fs_files(kernel_t) fs_read_noxattr_fs_symlinks(kernel_t) @@ -23056,7 +23486,7 @@ index 8dbab4c5e..2d283007a 100644 ') tunable_policy(`nfs_export_all_rw',` -@@ -354,7 +440,7 @@ optional_policy(` +@@ -354,7 +441,7 @@ optional_policy(` fs_read_noxattr_fs_files(kernel_t) fs_read_noxattr_fs_symlinks(kernel_t) @@ -23065,7 +23495,7 @@ index 8dbab4c5e..2d283007a 100644 ') ') -@@ -364,9 +450,22 @@ optional_policy(` +@@ -364,9 +451,22 @@ optional_policy(` ') optional_policy(` @@ -23088,7 +23518,7 @@ index 8dbab4c5e..2d283007a 100644 ######################################## # # Unlabeled process local policy -@@ -388,6 +487,8 @@ optional_policy(` +@@ -388,6 +488,8 @@ optional_policy(` if( ! secure_mode_insmod ) { allow can_load_kernmodule self:capability sys_module; @@ -23097,7 +23527,7 @@ index 8dbab4c5e..2d283007a 100644 # load_module() calls stop_machine() which # calls sched_setscheduler() allow can_load_kernmodule self:capability sys_nice; -@@ -399,14 +500,38 @@ if( ! secure_mode_insmod ) { +@@ -399,14 +501,38 @@ if( ! secure_mode_insmod ) { # Rules for unconfined acccess to this module # @@ -32046,7 +32476,7 @@ index 6bf0ecc2d..75b2f31f9 100644 +') + diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te -index 8b403774f..0bdea37e9 100644 +index 8b403774f..f17b76dec 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -26,28 +26,66 @@ gen_require(` @@ -32405,7 +32835,7 @@ index 8b403774f..0bdea37e9 100644 ssh_sigchld(xauth_t) ssh_read_pipes(xauth_t) ssh_dontaudit_rw_tcp_sockets(xauth_t) -@@ -300,64 +420,108 @@ optional_policy(` +@@ -300,64 +420,110 @@ optional_policy(` # XDM Local policy # @@ -32438,11 +32868,13 @@ index 8b403774f..0bdea37e9 100644 + +allow xdm_t xauth_home_t:file manage_file_perms; + ++allow xdm_t xserver_unconfined_type:process { signull }; + +-allow xdm_t xconsole_device_t:fifo_file { getattr setattr }; +allow xdm_t xconsole_device_t:fifo_file { getattr_fifo_file_perms setattr_fifo_file_perms }; +manage_dirs_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t) +manage_files_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t) - --allow xdm_t xconsole_device_t:fifo_file { getattr setattr }; ++ +manage_dirs_pattern(xdm_t, xdm_home_t, xdm_home_t) +manage_files_pattern(xdm_t, xdm_home_t, xdm_home_t) +xserver_filetrans_home_content(xdm_t) @@ -32499,12 +32931,12 @@ index 8b403774f..0bdea37e9 100644 manage_dirs_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t) manage_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t) ++exec_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t) +manage_lnk_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t) manage_fifo_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t) -files_pid_filetrans(xdm_t, xdm_var_run_t, { dir file fifo_file }) +manage_sock_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t) +files_pid_filetrans(xdm_t, xdm_var_run_t, { dir file fifo_file sock_file }) -+allow xdm_t xdm_var_run_t:file map; -allow xdm_t xserver_t:process signal; +allow xdm_t xserver_t:process { signal signull }; @@ -32527,7 +32959,7 @@ index 8b403774f..0bdea37e9 100644 # connect to xdm xserver over stream socket stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) -@@ -366,20 +530,31 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) +@@ -366,20 +532,32 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) @@ -32552,6 +32984,7 @@ index 8b403774f..0bdea37e9 100644 +kernel_request_load_module(xdm_t) +kernel_stream_connect(xdm_t) +kernel_view_key(xdm_t) ++kernel_read_usermodehelper_state(xdm_t) corecmd_exec_shell(xdm_t) corecmd_exec_bin(xdm_t) @@ -32561,7 +32994,7 @@ index 8b403774f..0bdea37e9 100644 corenet_all_recvfrom_netlabel(xdm_t) corenet_tcp_sendrecv_generic_if(xdm_t) corenet_udp_sendrecv_generic_if(xdm_t) -@@ -389,38 +564,51 @@ corenet_tcp_sendrecv_all_ports(xdm_t) +@@ -389,38 +567,51 @@ corenet_tcp_sendrecv_all_ports(xdm_t) corenet_udp_sendrecv_all_ports(xdm_t) corenet_tcp_bind_generic_node(xdm_t) corenet_udp_bind_generic_node(xdm_t) @@ -32617,7 +33050,7 @@ index 8b403774f..0bdea37e9 100644 files_read_etc_files(xdm_t) files_read_var_files(xdm_t) -@@ -431,9 +619,30 @@ files_list_mnt(xdm_t) +@@ -431,9 +622,30 @@ files_list_mnt(xdm_t) files_read_usr_files(xdm_t) # Poweroff wants to create the /poweroff file when run from xdm files_create_boot_flag(xdm_t) @@ -32648,7 +33081,7 @@ index 8b403774f..0bdea37e9 100644 storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t) -@@ -442,28 +651,50 @@ storage_dontaudit_raw_read_removable_device(xdm_t) +@@ -442,28 +654,50 @@ storage_dontaudit_raw_read_removable_device(xdm_t) storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t) @@ -32704,7 +33137,7 @@ index 8b403774f..0bdea37e9 100644 userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_create_all_users_keys(xdm_t) -@@ -472,24 +703,171 @@ userdom_read_user_home_content_files(xdm_t) +@@ -472,24 +706,171 @@ userdom_read_user_home_content_files(xdm_t) # Search /proc for any user domain processes. userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) @@ -32882,7 +33315,7 @@ index 8b403774f..0bdea37e9 100644 tunable_policy(`xdm_sysadm_login',` userdom_xsession_spec_domtrans_all_users(xdm_t) # FIXME: -@@ -502,12 +880,31 @@ tunable_policy(`xdm_sysadm_login',` +@@ -502,12 +883,31 @@ tunable_policy(`xdm_sysadm_login',` # allow xserver_t xdm_tmpfs_t:file rw_file_perms; ') @@ -32914,7 +33347,7 @@ index 8b403774f..0bdea37e9 100644 ') optional_policy(` -@@ -518,8 +915,36 @@ optional_policy(` +@@ -518,8 +918,36 @@ optional_policy(` dbus_system_bus_client(xdm_t) dbus_connect_system_bus(xdm_t) @@ -32933,7 +33366,8 @@ index 8b403774f..0bdea37e9 100644 + cpufreqselector_dbus_chat(xdm_t) + ') + -+ optional_policy(` + optional_policy(` +- accountsd_dbus_chat(xdm_t) + devicekit_dbus_chat_disk(xdm_t) + devicekit_dbus_chat_power(xdm_t) + ') @@ -32942,8 +33376,7 @@ index 8b403774f..0bdea37e9 100644 + hal_dbus_chat(xdm_t) + ') + - optional_policy(` -- accountsd_dbus_chat(xdm_t) ++ optional_policy(` + gnomeclock_dbus_chat(xdm_t) + ') + @@ -32952,7 +33385,7 @@ index 8b403774f..0bdea37e9 100644 ') ') -@@ -530,6 +955,20 @@ optional_policy(` +@@ -530,6 +958,20 @@ optional_policy(` ') optional_policy(` @@ -32973,7 +33406,7 @@ index 8b403774f..0bdea37e9 100644 hostname_exec(xdm_t) ') -@@ -547,28 +986,78 @@ optional_policy(` +@@ -547,28 +989,78 @@ optional_policy(` ') optional_policy(` @@ -33061,7 +33494,7 @@ index 8b403774f..0bdea37e9 100644 ') optional_policy(` -@@ -580,6 +1069,14 @@ optional_policy(` +@@ -580,6 +1072,14 @@ optional_policy(` ') optional_policy(` @@ -33076,7 +33509,7 @@ index 8b403774f..0bdea37e9 100644 xfs_stream_connect(xdm_t) ') -@@ -594,7 +1091,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t; +@@ -594,7 +1094,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t; type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t; allow xserver_t { root_xdrawable_t x_domain }:x_drawable send; @@ -33085,7 +33518,7 @@ index 8b403774f..0bdea37e9 100644 # setuid/setgid for the wrapper program to change UID # sys_rawio is for iopl access - should not be needed for frame-buffer -@@ -604,8 +1101,11 @@ allow xserver_t input_xevent_t:x_event send; +@@ -604,8 +1104,11 @@ allow xserver_t input_xevent_t:x_event send; # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack @@ -33098,7 +33531,7 @@ index 8b403774f..0bdea37e9 100644 allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow xserver_t self:fd use; allow xserver_t self:fifo_file rw_fifo_file_perms; -@@ -618,8 +1118,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; +@@ -618,8 +1121,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:udp_socket create_socket_perms; @@ -33114,7 +33547,7 @@ index 8b403774f..0bdea37e9 100644 manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) -@@ -627,36 +1134,53 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) +@@ -627,36 +1137,53 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file) @@ -33172,7 +33605,7 @@ index 8b403774f..0bdea37e9 100644 corenet_all_recvfrom_netlabel(xserver_t) corenet_tcp_sendrecv_generic_if(xserver_t) corenet_udp_sendrecv_generic_if(xserver_t) -@@ -677,23 +1201,29 @@ dev_rw_apm_bios(xserver_t) +@@ -677,23 +1204,29 @@ dev_rw_apm_bios(xserver_t) dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) @@ -33205,7 +33638,7 @@ index 8b403774f..0bdea37e9 100644 # brought on by rhgb files_search_mnt(xserver_t) -@@ -705,6 +1235,14 @@ fs_search_nfs(xserver_t) +@@ -705,6 +1238,14 @@ fs_search_nfs(xserver_t) fs_search_auto_mountpoints(xserver_t) fs_search_ramfs(xserver_t) @@ -33220,7 +33653,7 @@ index 8b403774f..0bdea37e9 100644 mls_xwin_read_to_clearance(xserver_t) selinux_validate_context(xserver_t) -@@ -718,28 +1256,25 @@ init_getpgid(xserver_t) +@@ -718,28 +1259,25 @@ init_getpgid(xserver_t) term_setattr_unallocated_ttys(xserver_t) term_use_unallocated_ttys(xserver_t) @@ -33253,7 +33686,7 @@ index 8b403774f..0bdea37e9 100644 ifndef(`distro_redhat',` allow xserver_t self:process { execmem execheap execstack }; -@@ -785,17 +1320,54 @@ optional_policy(` +@@ -785,17 +1323,54 @@ optional_policy(` ') optional_policy(` @@ -33310,7 +33743,7 @@ index 8b403774f..0bdea37e9 100644 ') optional_policy(` -@@ -803,6 +1375,10 @@ optional_policy(` +@@ -803,6 +1378,10 @@ optional_policy(` ') optional_policy(` @@ -33321,7 +33754,7 @@ index 8b403774f..0bdea37e9 100644 xfs_stream_connect(xserver_t) ') -@@ -818,18 +1394,17 @@ allow xserver_t xdm_t:shm rw_shm_perms; +@@ -818,18 +1397,17 @@ allow xserver_t xdm_t:shm rw_shm_perms; # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open # handle of a file inside the dir!!! @@ -33346,7 +33779,7 @@ index 8b403774f..0bdea37e9 100644 can_exec(xserver_t, xkb_var_lib_t) # VNC v4 module in X server -@@ -842,26 +1417,21 @@ init_use_fds(xserver_t) +@@ -842,26 +1420,21 @@ init_use_fds(xserver_t) # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_user_home_content_files(xserver_t) @@ -33381,7 +33814,7 @@ index 8b403774f..0bdea37e9 100644 ') optional_policy(` -@@ -912,7 +1482,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy +@@ -912,7 +1485,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show }; # operations allowed on my windows allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; @@ -33390,7 +33823,7 @@ index 8b403774f..0bdea37e9 100644 # operations allowed on all windows allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child }; -@@ -966,11 +1536,31 @@ allow x_domain self:x_resource { read write }; +@@ -966,11 +1539,31 @@ allow x_domain self:x_resource { read write }; # can mess with the screensaver allow x_domain xserver_t:x_screen { getattr saver_getattr }; @@ -33422,7 +33855,7 @@ index 8b403774f..0bdea37e9 100644 tunable_policy(`! xserver_object_manager',` # should be xserver_unconfined(x_domain), # but typeattribute doesnt work in conditionals -@@ -992,18 +1582,148 @@ tunable_policy(`! xserver_object_manager',` +@@ -992,18 +1585,148 @@ tunable_policy(`! xserver_object_manager',` allow x_domain xevent_type:{ x_event x_synthetic_event } *; ') @@ -34801,7 +35234,7 @@ index 3efd5b669..a8cb6df3d 100644 + allow $1 login_pgm:key manage_key_perms; +') diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te -index 09b791dcc..78d158ca9 100644 +index 09b791dcc..498375fcf 100644 --- a/policy/modules/system/authlogin.te +++ b/policy/modules/system/authlogin.te @@ -5,6 +5,19 @@ policy_module(authlogin, 2.5.1) @@ -34894,16 +35327,17 @@ index 09b791dcc..78d158ca9 100644 dontaudit chkpwd_t self:capability sys_tty_config; allow chkpwd_t self:process { getattr signal }; -@@ -109,6 +131,8 @@ dev_read_urand(chkpwd_t) +@@ -109,6 +131,9 @@ dev_read_urand(chkpwd_t) files_read_etc_files(chkpwd_t) # for nscd files_dontaudit_search_var(chkpwd_t) +files_read_usr_symlinks(chkpwd_t) +files_list_tmp(chkpwd_t) ++files_map_system_db_files(chkpwd_t) fs_dontaudit_getattr_xattr_fs(chkpwd_t) -@@ -122,12 +146,11 @@ auth_use_nsswitch(chkpwd_t) +@@ -122,12 +147,11 @@ auth_use_nsswitch(chkpwd_t) logging_send_audit_msgs(chkpwd_t) logging_send_syslog_msg(chkpwd_t) @@ -34917,7 +35351,18 @@ index 09b791dcc..78d158ca9 100644 ifdef(`distro_ubuntu',` optional_policy(` -@@ -153,53 +176,52 @@ optional_policy(` +@@ -141,6 +165,10 @@ optional_policy(` + ') + + optional_policy(` ++ dbus_system_bus_client(chkpwd_t) ++') ++ ++optional_policy(` + kerberos_use(chkpwd_t) + ') + +@@ -153,53 +181,52 @@ optional_policy(` # PAM local policy # @@ -34999,7 +35444,7 @@ index 09b791dcc..78d158ca9 100644 ') ######################################## -@@ -289,7 +311,6 @@ init_use_script_ptys(pam_console_t) +@@ -289,7 +316,6 @@ init_use_script_ptys(pam_console_t) logging_send_syslog_msg(pam_console_t) @@ -35007,7 +35452,7 @@ index 09b791dcc..78d158ca9 100644 miscfiles_read_generic_certs(pam_console_t) seutil_read_file_contexts(pam_console_t) -@@ -330,7 +351,7 @@ optional_policy(` +@@ -330,7 +356,7 @@ optional_policy(` # updpwd local policy # @@ -35016,7 +35461,7 @@ index 09b791dcc..78d158ca9 100644 allow updpwd_t self:process setfscreate; allow updpwd_t self:fifo_file rw_fifo_file_perms; allow updpwd_t self:unix_stream_socket create_stream_socket_perms; -@@ -341,6 +362,11 @@ kernel_read_system_state(updpwd_t) +@@ -341,6 +367,11 @@ kernel_read_system_state(updpwd_t) dev_read_urand(updpwd_t) files_manage_etc_files(updpwd_t) @@ -35028,7 +35473,7 @@ index 09b791dcc..78d158ca9 100644 term_dontaudit_use_console(updpwd_t) term_dontaudit_use_unallocated_ttys(updpwd_t) -@@ -350,9 +376,7 @@ auth_use_nsswitch(updpwd_t) +@@ -350,9 +381,7 @@ auth_use_nsswitch(updpwd_t) logging_send_syslog_msg(updpwd_t) @@ -35039,7 +35484,7 @@ index 09b791dcc..78d158ca9 100644 ifdef(`distro_ubuntu',` optional_policy(` -@@ -380,13 +404,15 @@ term_dontaudit_use_all_ttys(utempter_t) +@@ -380,13 +409,15 @@ term_dontaudit_use_all_ttys(utempter_t) term_dontaudit_use_all_ptys(utempter_t) term_dontaudit_use_ptmx(utempter_t) @@ -35056,7 +35501,7 @@ index 09b791dcc..78d158ca9 100644 # Allow utemper to write to /tmp/.xses-* userdom_write_user_tmp_files(utempter_t) -@@ -397,19 +423,29 @@ ifdef(`distro_ubuntu',` +@@ -397,19 +428,29 @@ ifdef(`distro_ubuntu',` ') optional_policy(` @@ -35090,7 +35535,7 @@ index 09b791dcc..78d158ca9 100644 files_list_var_lib(nsswitch_domain) # read /etc/nsswitch.conf -@@ -417,15 +453,42 @@ files_read_etc_files(nsswitch_domain) +@@ -417,15 +458,42 @@ files_read_etc_files(nsswitch_domain) sysnet_dns_name_resolve(nsswitch_domain) @@ -35135,7 +35580,7 @@ index 09b791dcc..78d158ca9 100644 ldap_stream_connect(nsswitch_domain) ') ') -@@ -438,6 +501,7 @@ optional_policy(` +@@ -438,6 +506,7 @@ optional_policy(` likewise_stream_connect_lsassd(nsswitch_domain) ') @@ -35143,7 +35588,7 @@ index 09b791dcc..78d158ca9 100644 optional_policy(` kerberos_use(nsswitch_domain) ') -@@ -456,10 +520,163 @@ optional_policy(` +@@ -456,10 +525,163 @@ optional_policy(` optional_policy(` sssd_stream_connect(nsswitch_domain) @@ -36088,7 +36533,7 @@ index bc0ffc84e..37b8ea5ec 100644 ') +/var/run/systemd(/.*)? gen_context(system_u:object_r:init_var_run_t,s0) diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if -index 79a45f62e..b25993d41 100644 +index 79a45f62e..0244681f0 100644 --- a/policy/modules/system/init.if +++ b/policy/modules/system/init.if @@ -1,5 +1,21 @@ @@ -36319,10 +36764,13 @@ index 79a45f62e..b25993d41 100644 ######################################## ## ## Mark the file type as a daemon run dir, allowing initrc_t -@@ -460,6 +512,25 @@ interface(`init_domtrans',` - domtrans_pattern($1, init_exec_t, init_t) - ') +@@ -458,6 +510,26 @@ interface(`init_domtrans',` + ') + domtrans_pattern($1, init_exec_t, init_t) ++ allow $1 init_exec_t:file map; ++') ++ + +######################################## +## @@ -36340,12 +36788,10 @@ index 79a45f62e..b25993d41 100644 + ') + + allow $1 init_exec_t:file entrypoint; -+') -+ + ') + ######################################## - ## - ## Execute the init program in the caller domain. -@@ -469,7 +540,6 @@ interface(`init_domtrans',` +@@ -469,7 +541,6 @@ interface(`init_domtrans',` ## Domain allowed access. ## ## @@ -36353,7 +36799,7 @@ index 79a45f62e..b25993d41 100644 # interface(`init_exec',` gen_require(` -@@ -478,6 +548,48 @@ interface(`init_exec',` +@@ -478,6 +549,48 @@ interface(`init_exec',` corecmd_search_bin($1) can_exec($1, init_exec_t) @@ -36402,7 +36848,7 @@ index 79a45f62e..b25993d41 100644 ') ######################################## -@@ -566,6 +678,58 @@ interface(`init_sigchld',` +@@ -566,6 +679,58 @@ interface(`init_sigchld',` ######################################## ## @@ -36461,7 +36907,7 @@ index 79a45f62e..b25993d41 100644 ## Connect to init with a unix socket. ## ## -@@ -576,12 +740,87 @@ interface(`init_sigchld',` +@@ -576,12 +741,87 @@ interface(`init_sigchld',` # interface(`init_stream_connect',` gen_require(` @@ -36549,7 +36995,7 @@ index 79a45f62e..b25993d41 100644 ######################################## ## ## Inherit and use file descriptors from init. -@@ -743,22 +982,24 @@ interface(`init_write_initctl',` +@@ -743,22 +983,24 @@ interface(`init_write_initctl',` interface(`init_telinit',` gen_require(` type initctl_t; @@ -36583,7 +37029,7 @@ index 79a45f62e..b25993d41 100644 ') ######################################## -@@ -787,7 +1028,7 @@ interface(`init_rw_initctl',` +@@ -787,7 +1029,7 @@ interface(`init_rw_initctl',` ## ## ## @@ -36592,7 +37038,7 @@ index 79a45f62e..b25993d41 100644 ## ## # -@@ -830,11 +1071,12 @@ interface(`init_script_file_entry_type',` +@@ -830,11 +1072,12 @@ interface(`init_script_file_entry_type',` # interface(`init_spec_domtrans_script',` gen_require(` @@ -36607,7 +37053,7 @@ index 79a45f62e..b25993d41 100644 ifdef(`distro_gentoo',` gen_require(` -@@ -845,11 +1087,11 @@ interface(`init_spec_domtrans_script',` +@@ -845,11 +1088,11 @@ interface(`init_spec_domtrans_script',` ') ifdef(`enable_mcs',` @@ -36621,7 +37067,7 @@ index 79a45f62e..b25993d41 100644 ') ') -@@ -865,23 +1107,45 @@ interface(`init_spec_domtrans_script',` +@@ -865,23 +1108,45 @@ interface(`init_spec_domtrans_script',` # interface(`init_domtrans_script',` gen_require(` @@ -36671,7 +37117,7 @@ index 79a45f62e..b25993d41 100644 ## Execute a init script in a specified domain. ## ## -@@ -933,9 +1197,14 @@ interface(`init_script_file_domtrans',` +@@ -933,9 +1198,14 @@ interface(`init_script_file_domtrans',` interface(`init_labeled_script_domtrans',` gen_require(` type initrc_t; @@ -36686,7 +37132,7 @@ index 79a45f62e..b25993d41 100644 files_search_etc($1) ') -@@ -992,7 +1261,7 @@ interface(`init_run_daemon',` +@@ -992,7 +1262,7 @@ interface(`init_run_daemon',` ######################################## ## @@ -36695,7 +37141,7 @@ index 79a45f62e..b25993d41 100644 ## ## ## -@@ -1000,38 +1269,37 @@ interface(`init_run_daemon',` +@@ -1000,38 +1270,37 @@ interface(`init_run_daemon',` ## ## # @@ -36743,7 +37189,7 @@ index 79a45f62e..b25993d41 100644 ## ## ## -@@ -1039,17 +1307,19 @@ interface(`init_ptrace',` +@@ -1039,17 +1308,19 @@ interface(`init_ptrace',` ## ## # @@ -36767,7 +37213,7 @@ index 79a45f62e..b25993d41 100644 ## ## ## -@@ -1057,18 +1327,17 @@ interface(`init_write_script_pipes',` +@@ -1057,18 +1328,17 @@ interface(`init_write_script_pipes',` ## ## # @@ -36790,7 +37236,7 @@ index 79a45f62e..b25993d41 100644 ## ## ## -@@ -1076,18 +1345,94 @@ interface(`init_getattr_script_files',` +@@ -1076,18 +1346,94 @@ interface(`init_getattr_script_files',` ## ## # @@ -36890,7 +37336,7 @@ index 79a45f62e..b25993d41 100644 ## ## ## -@@ -1125,6 +1470,63 @@ interface(`init_getattr_all_script_files',` +@@ -1125,6 +1471,63 @@ interface(`init_getattr_all_script_files',` ######################################## ## @@ -36954,7 +37400,7 @@ index 79a45f62e..b25993d41 100644 ## Read all init script files. ## ## -@@ -1144,6 +1546,24 @@ interface(`init_read_all_script_files',` +@@ -1144,6 +1547,24 @@ interface(`init_read_all_script_files',` ####################################### ## @@ -36979,7 +37425,7 @@ index 79a45f62e..b25993d41 100644 ## Dontaudit read all init script files. ## ## -@@ -1195,12 +1615,7 @@ interface(`init_read_script_state',` +@@ -1195,12 +1616,7 @@ interface(`init_read_script_state',` ') kernel_search_proc($1) @@ -36993,7 +37439,7 @@ index 79a45f62e..b25993d41 100644 ') ######################################## -@@ -1314,6 +1729,24 @@ interface(`init_signal_script',` +@@ -1314,6 +1730,24 @@ interface(`init_signal_script',` ######################################## ## @@ -37018,7 +37464,7 @@ index 79a45f62e..b25993d41 100644 ## Send null signals to init scripts. ## ## -@@ -1440,6 +1873,27 @@ interface(`init_dbus_send_script',` +@@ -1440,6 +1874,27 @@ interface(`init_dbus_send_script',` ######################################## ## ## Send and receive messages from @@ -37046,7 +37492,7 @@ index 79a45f62e..b25993d41 100644 ## init scripts over dbus. ## ## -@@ -1547,6 +2001,25 @@ interface(`init_getattr_script_status_files',` +@@ -1547,6 +2002,25 @@ interface(`init_getattr_script_status_files',` ######################################## ## @@ -37072,7 +37518,7 @@ index 79a45f62e..b25993d41 100644 ## Do not audit attempts to read init script ## status files. ## -@@ -1605,6 +2078,42 @@ interface(`init_rw_script_tmp_files',` +@@ -1605,6 +2079,42 @@ interface(`init_rw_script_tmp_files',` ######################################## ## @@ -37115,7 +37561,7 @@ index 79a45f62e..b25993d41 100644 ## Create files in a init script ## temporary data directory. ## -@@ -1677,6 +2186,43 @@ interface(`init_read_utmp',` +@@ -1677,6 +2187,43 @@ interface(`init_read_utmp',` ######################################## ## @@ -37159,7 +37605,7 @@ index 79a45f62e..b25993d41 100644 ## Do not audit attempts to write utmp. ## ## -@@ -1765,7 +2311,7 @@ interface(`init_dontaudit_rw_utmp',` +@@ -1765,7 +2312,7 @@ interface(`init_dontaudit_rw_utmp',` type initrc_var_run_t; ') @@ -37168,7 +37614,7 @@ index 79a45f62e..b25993d41 100644 ') ######################################## -@@ -1806,30 +2352,157 @@ interface(`init_pid_filetrans_utmp',` +@@ -1806,30 +2353,157 @@ interface(`init_pid_filetrans_utmp',` files_pid_filetrans($1, initrc_var_run_t, file, "utmp") ') @@ -37339,7 +37785,7 @@ index 79a45f62e..b25993d41 100644 ## Domain allowed access. ## ## -@@ -1840,3 +2513,584 @@ interface(`init_udp_recvfrom_all_daemons',` +@@ -1840,3 +2514,584 @@ interface(`init_udp_recvfrom_all_daemons',` ') corenet_udp_recvfrom_labeled($1, daemon) ') @@ -37925,7 +38371,7 @@ index 79a45f62e..b25993d41 100644 +') + diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te -index 17eda2480..cc1720cf2 100644 +index 17eda2480..09d9144cb 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -11,10 +11,31 @@ gen_require(` @@ -38248,7 +38694,7 @@ index 17eda2480..cc1720cf2 100644 ifdef(`distro_gentoo',` allow init_t self:process { getcap setcap }; -@@ -186,29 +348,294 @@ ifdef(`distro_gentoo',` +@@ -186,29 +348,295 @@ ifdef(`distro_gentoo',` ') ifdef(`distro_redhat',` @@ -38413,6 +38859,7 @@ index 17eda2480..cc1720cf2 100644 +files_relabel_var_dirs(init_t) +files_relabel_var_lib_dirs(init_t) +files_read_kernel_modules(init_t) ++files_map_kernel_modules(init_t) +files_dontaudit_mounton_isid(init_t) +fs_getattr_all_fs(init_t) +fs_manage_cgroup_dirs(init_t) @@ -38552,7 +38999,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -216,7 +643,35 @@ optional_policy(` +@@ -216,7 +644,35 @@ optional_policy(` ') optional_policy(` @@ -38589,7 +39036,7 @@ index 17eda2480..cc1720cf2 100644 ') ######################################## -@@ -225,9 +680,9 @@ optional_policy(` +@@ -225,9 +681,9 @@ optional_policy(` # allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; @@ -38601,7 +39048,7 @@ index 17eda2480..cc1720cf2 100644 allow initrc_t self:passwd rootok; allow initrc_t self:key manage_key_perms; -@@ -258,12 +713,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) +@@ -258,12 +714,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) allow initrc_t initrc_var_run_t:file manage_file_perms; files_pid_filetrans(initrc_t, initrc_var_run_t, file) @@ -38618,7 +39065,7 @@ index 17eda2480..cc1720cf2 100644 manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) -@@ -279,23 +738,36 @@ kernel_change_ring_buffer_level(initrc_t) +@@ -279,23 +739,36 @@ kernel_change_ring_buffer_level(initrc_t) kernel_clear_ring_buffer(initrc_t) kernel_get_sysvipc_info(initrc_t) kernel_read_all_sysctls(initrc_t) @@ -38661,7 +39108,7 @@ index 17eda2480..cc1720cf2 100644 corenet_tcp_sendrecv_all_ports(initrc_t) corenet_udp_sendrecv_all_ports(initrc_t) corenet_tcp_connect_all_ports(initrc_t) -@@ -303,9 +775,11 @@ corenet_sendrecv_all_client_packets(initrc_t) +@@ -303,9 +776,11 @@ corenet_sendrecv_all_client_packets(initrc_t) dev_read_rand(initrc_t) dev_read_urand(initrc_t) @@ -38673,7 +39120,7 @@ index 17eda2480..cc1720cf2 100644 dev_rw_sysfs(initrc_t) dev_list_usbfs(initrc_t) dev_read_framebuffer(initrc_t) -@@ -313,8 +787,10 @@ dev_write_framebuffer(initrc_t) +@@ -313,8 +788,10 @@ dev_write_framebuffer(initrc_t) dev_read_realtime_clock(initrc_t) dev_read_sound_mixer(initrc_t) dev_write_sound_mixer(initrc_t) @@ -38684,7 +39131,7 @@ index 17eda2480..cc1720cf2 100644 dev_delete_lvm_control_dev(initrc_t) dev_manage_generic_symlinks(initrc_t) dev_manage_generic_files(initrc_t) -@@ -322,8 +798,7 @@ dev_manage_generic_files(initrc_t) +@@ -322,8 +799,7 @@ dev_manage_generic_files(initrc_t) dev_delete_generic_symlinks(initrc_t) dev_getattr_all_blk_files(initrc_t) dev_getattr_all_chr_files(initrc_t) @@ -38694,7 +39141,7 @@ index 17eda2480..cc1720cf2 100644 domain_kill_all_domains(initrc_t) domain_signal_all_domains(initrc_t) -@@ -332,7 +807,6 @@ domain_sigstop_all_domains(initrc_t) +@@ -332,7 +808,6 @@ domain_sigstop_all_domains(initrc_t) domain_sigchld_all_domains(initrc_t) domain_read_all_domains_state(initrc_t) domain_getattr_all_domains(initrc_t) @@ -38702,7 +39149,7 @@ index 17eda2480..cc1720cf2 100644 domain_getsession_all_domains(initrc_t) domain_use_interactive_fds(initrc_t) # for lsof which is used by alsa shutdown: -@@ -340,6 +814,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) +@@ -340,6 +815,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) domain_dontaudit_getattr_all_tcp_sockets(initrc_t) domain_dontaudit_getattr_all_dgram_sockets(initrc_t) domain_dontaudit_getattr_all_pipes(initrc_t) @@ -38710,7 +39157,7 @@ index 17eda2480..cc1720cf2 100644 files_getattr_all_dirs(initrc_t) files_getattr_all_files(initrc_t) -@@ -347,14 +822,15 @@ files_getattr_all_symlinks(initrc_t) +@@ -347,14 +823,15 @@ files_getattr_all_symlinks(initrc_t) files_getattr_all_pipes(initrc_t) files_getattr_all_sockets(initrc_t) files_purge_tmp(initrc_t) @@ -38728,7 +39175,7 @@ index 17eda2480..cc1720cf2 100644 files_read_usr_files(initrc_t) files_manage_urandom_seed(initrc_t) files_manage_generic_spool(initrc_t) -@@ -364,8 +840,12 @@ files_list_isid_type_dirs(initrc_t) +@@ -364,8 +841,12 @@ files_list_isid_type_dirs(initrc_t) files_mounton_isid_type_dirs(initrc_t) files_list_default(initrc_t) files_mounton_default(initrc_t) @@ -38742,7 +39189,7 @@ index 17eda2480..cc1720cf2 100644 fs_list_inotifyfs(initrc_t) fs_register_binary_executable_type(initrc_t) # rhgb-console writes to ramfs -@@ -375,10 +855,11 @@ fs_mount_all_fs(initrc_t) +@@ -375,10 +856,11 @@ fs_mount_all_fs(initrc_t) fs_unmount_all_fs(initrc_t) fs_remount_all_fs(initrc_t) fs_getattr_all_fs(initrc_t) @@ -38756,7 +39203,7 @@ index 17eda2480..cc1720cf2 100644 mcs_process_set_categories(initrc_t) mls_file_read_all_levels(initrc_t) -@@ -387,8 +868,10 @@ mls_process_read_up(initrc_t) +@@ -387,8 +869,10 @@ mls_process_read_up(initrc_t) mls_process_write_down(initrc_t) mls_rangetrans_source(initrc_t) mls_fd_share_all_levels(initrc_t) @@ -38767,7 +39214,7 @@ index 17eda2480..cc1720cf2 100644 storage_getattr_fixed_disk_dev(initrc_t) storage_setattr_fixed_disk_dev(initrc_t) -@@ -398,6 +881,7 @@ term_use_all_terms(initrc_t) +@@ -398,6 +882,7 @@ term_use_all_terms(initrc_t) term_reset_tty_labels(initrc_t) auth_rw_login_records(initrc_t) @@ -38775,7 +39222,7 @@ index 17eda2480..cc1720cf2 100644 auth_setattr_login_records(initrc_t) auth_rw_lastlog(initrc_t) auth_read_pam_pid(initrc_t) -@@ -416,20 +900,18 @@ logging_read_all_logs(initrc_t) +@@ -416,20 +901,18 @@ logging_read_all_logs(initrc_t) logging_append_all_logs(initrc_t) logging_read_audit_config(initrc_t) @@ -38799,7 +39246,7 @@ index 17eda2480..cc1720cf2 100644 ifdef(`distro_debian',` dev_setattr_generic_dirs(initrc_t) -@@ -451,7 +933,6 @@ ifdef(`distro_gentoo',` +@@ -451,7 +934,6 @@ ifdef(`distro_gentoo',` allow initrc_t self:process setfscreate; dev_create_null_dev(initrc_t) dev_create_zero_dev(initrc_t) @@ -38807,7 +39254,7 @@ index 17eda2480..cc1720cf2 100644 term_create_console_dev(initrc_t) # unfortunately /sbin/rc does stupid tricks -@@ -486,6 +967,10 @@ ifdef(`distro_gentoo',` +@@ -486,6 +968,10 @@ ifdef(`distro_gentoo',` sysnet_setattr_config(initrc_t) optional_policy(` @@ -38818,7 +39265,7 @@ index 17eda2480..cc1720cf2 100644 alsa_read_lib(initrc_t) ') -@@ -506,7 +991,7 @@ ifdef(`distro_redhat',` +@@ -506,7 +992,7 @@ ifdef(`distro_redhat',` # Red Hat systems seem to have a stray # fd open from the initrd @@ -38827,7 +39274,7 @@ index 17eda2480..cc1720cf2 100644 files_dontaudit_read_root_files(initrc_t) # These seem to be from the initrd -@@ -521,6 +1006,7 @@ ifdef(`distro_redhat',` +@@ -521,6 +1007,7 @@ ifdef(`distro_redhat',` files_create_boot_dirs(initrc_t) files_create_boot_flag(initrc_t) files_rw_boot_symlinks(initrc_t) @@ -38835,7 +39282,7 @@ index 17eda2480..cc1720cf2 100644 # wants to read /.fonts directory files_read_default_files(initrc_t) files_mountpoint(initrc_tmp_t) -@@ -541,6 +1027,7 @@ ifdef(`distro_redhat',` +@@ -541,6 +1028,7 @@ ifdef(`distro_redhat',` miscfiles_rw_localization(initrc_t) miscfiles_setattr_localization(initrc_t) miscfiles_relabel_localization(initrc_t) @@ -38843,7 +39290,7 @@ index 17eda2480..cc1720cf2 100644 miscfiles_read_fonts(initrc_t) miscfiles_read_hwdata(initrc_t) -@@ -550,8 +1037,44 @@ ifdef(`distro_redhat',` +@@ -550,8 +1038,44 @@ ifdef(`distro_redhat',` ') optional_policy(` @@ -38888,7 +39335,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -559,14 +1082,31 @@ ifdef(`distro_redhat',` +@@ -559,14 +1083,31 @@ ifdef(`distro_redhat',` rpc_write_exports(initrc_t) rpc_manage_nfs_state_data(initrc_t) ') @@ -38920,7 +39367,7 @@ index 17eda2480..cc1720cf2 100644 ') ') -@@ -577,6 +1117,39 @@ ifdef(`distro_suse',` +@@ -577,6 +1118,39 @@ ifdef(`distro_suse',` ') ') @@ -38960,7 +39407,7 @@ index 17eda2480..cc1720cf2 100644 optional_policy(` amavis_search_lib(initrc_t) amavis_setattr_pid_files(initrc_t) -@@ -589,6 +1162,8 @@ optional_policy(` +@@ -589,6 +1163,8 @@ optional_policy(` optional_policy(` apache_read_config(initrc_t) apache_list_modules(initrc_t) @@ -38969,7 +39416,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -610,6 +1185,7 @@ optional_policy(` +@@ -610,6 +1186,7 @@ optional_policy(` optional_policy(` cgroup_stream_connect_cgred(initrc_t) @@ -38977,7 +39424,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -626,6 +1202,17 @@ optional_policy(` +@@ -626,6 +1203,17 @@ optional_policy(` ') optional_policy(` @@ -38995,7 +39442,7 @@ index 17eda2480..cc1720cf2 100644 dev_getattr_printer_dev(initrc_t) cups_read_log(initrc_t) -@@ -642,9 +1229,13 @@ optional_policy(` +@@ -642,9 +1230,13 @@ optional_policy(` dbus_connect_system_bus(initrc_t) dbus_system_bus_client(initrc_t) dbus_read_config(initrc_t) @@ -39009,7 +39456,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -657,15 +1248,11 @@ optional_policy(` +@@ -657,15 +1249,11 @@ optional_policy(` ') optional_policy(` @@ -39027,7 +39474,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -686,6 +1273,15 @@ optional_policy(` +@@ -686,6 +1274,15 @@ optional_policy(` ') optional_policy(` @@ -39043,7 +39490,7 @@ index 17eda2480..cc1720cf2 100644 inn_exec_config(initrc_t) ') -@@ -726,6 +1322,7 @@ optional_policy(` +@@ -726,6 +1323,7 @@ optional_policy(` lpd_list_spool(initrc_t) lpd_read_config(initrc_t) @@ -39051,7 +39498,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -743,7 +1340,13 @@ optional_policy(` +@@ -743,7 +1341,13 @@ optional_policy(` ') optional_policy(` @@ -39066,7 +39513,7 @@ index 17eda2480..cc1720cf2 100644 mta_dontaudit_read_spool_symlinks(initrc_t) ') -@@ -766,6 +1369,10 @@ optional_policy(` +@@ -766,6 +1370,10 @@ optional_policy(` ') optional_policy(` @@ -39077,7 +39524,7 @@ index 17eda2480..cc1720cf2 100644 postgresql_manage_db(initrc_t) postgresql_read_config(initrc_t) ') -@@ -775,10 +1382,20 @@ optional_policy(` +@@ -775,10 +1383,20 @@ optional_policy(` ') optional_policy(` @@ -39098,7 +39545,7 @@ index 17eda2480..cc1720cf2 100644 quota_manage_flags(initrc_t) ') -@@ -787,6 +1404,10 @@ optional_policy(` +@@ -787,6 +1405,10 @@ optional_policy(` ') optional_policy(` @@ -39109,7 +39556,7 @@ index 17eda2480..cc1720cf2 100644 fs_write_ramfs_sockets(initrc_t) fs_search_ramfs(initrc_t) -@@ -808,8 +1429,6 @@ optional_policy(` +@@ -808,8 +1430,6 @@ optional_policy(` # bash tries ioctl for some reason files_dontaudit_ioctl_all_pids(initrc_t) @@ -39118,7 +39565,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -818,6 +1437,10 @@ optional_policy(` +@@ -818,6 +1438,10 @@ optional_policy(` ') optional_policy(` @@ -39129,7 +39576,7 @@ index 17eda2480..cc1720cf2 100644 # shorewall-init script run /var/lib/shorewall/firewall shorewall_lib_domtrans(initrc_t) ') -@@ -827,10 +1450,12 @@ optional_policy(` +@@ -827,10 +1451,12 @@ optional_policy(` squid_manage_logs(initrc_t) ') @@ -39142,7 +39589,7 @@ index 17eda2480..cc1720cf2 100644 optional_policy(` ssh_dontaudit_read_server_keys(initrc_t) -@@ -857,21 +1482,62 @@ optional_policy(` +@@ -857,21 +1483,62 @@ optional_policy(` ') optional_policy(` @@ -39206,7 +39653,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -887,6 +1553,10 @@ optional_policy(` +@@ -887,6 +1554,10 @@ optional_policy(` ') optional_policy(` @@ -39217,7 +39664,7 @@ index 17eda2480..cc1720cf2 100644 # Set device ownerships/modes. xserver_setattr_console_pipes(initrc_t) -@@ -897,3 +1567,218 @@ optional_policy(` +@@ -897,3 +1568,218 @@ optional_policy(` optional_policy(` zebra_read_config(initrc_t) ') @@ -40226,10 +40673,10 @@ index c42fbc329..bf211dbee 100644 + files_pid_filetrans($1, iptables_var_run_t, file, "xtables.lock") +') diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te -index be8ed1e6c..697c2cf05 100644 +index be8ed1e6c..5a5a54d66 100644 --- a/policy/modules/system/iptables.te +++ b/policy/modules/system/iptables.te -@@ -16,44 +16,61 @@ role iptables_roles types iptables_t; +@@ -16,44 +16,62 @@ role iptables_roles types iptables_t; type iptables_initrc_exec_t; init_script_file(iptables_initrc_exec_t) @@ -40258,6 +40705,7 @@ index be8ed1e6c..697c2cf05 100644 -allow iptables_t self:capability { dac_read_search dac_override net_admin net_raw }; +allow iptables_t self:capability { dac_read_search net_admin net_raw }; ++allow iptables_t self:cap_userns { dac_read_search net_admin net_raw }; dontaudit iptables_t self:capability sys_tty_config; allow iptables_t self:fifo_file rw_fifo_file_perms; allow iptables_t self:process { sigchld sigkill sigstop signull signal }; @@ -40298,7 +40746,7 @@ index be8ed1e6c..697c2cf05 100644 kernel_use_fds(iptables_t) # needed by ipvsadm -@@ -64,19 +81,24 @@ corenet_relabelto_all_packets(iptables_t) +@@ -64,19 +82,24 @@ corenet_relabelto_all_packets(iptables_t) corenet_dontaudit_rw_tun_tap_dev(iptables_t) dev_read_sysfs(iptables_t) @@ -40325,7 +40773,7 @@ index be8ed1e6c..697c2cf05 100644 auth_use_nsswitch(iptables_t) -@@ -85,15 +107,14 @@ init_use_script_ptys(iptables_t) +@@ -85,15 +108,14 @@ init_use_script_ptys(iptables_t) # to allow rules to be saved on reboot: init_rw_script_tmp_files(iptables_t) init_rw_script_stream_sockets(iptables_t) @@ -40343,7 +40791,7 @@ index be8ed1e6c..697c2cf05 100644 userdom_use_all_users_fds(iptables_t) ifdef(`hide_broken_symptoms',` -@@ -101,7 +122,14 @@ ifdef(`hide_broken_symptoms',` +@@ -101,7 +123,14 @@ ifdef(`hide_broken_symptoms',` ') optional_policy(` @@ -40358,7 +40806,7 @@ index be8ed1e6c..697c2cf05 100644 ') optional_policy(` -@@ -110,7 +138,16 @@ optional_policy(` +@@ -110,7 +139,16 @@ optional_policy(` ') optional_policy(` @@ -40375,7 +40823,7 @@ index be8ed1e6c..697c2cf05 100644 ') optional_policy(` -@@ -119,11 +156,25 @@ optional_policy(` +@@ -119,11 +157,25 @@ optional_policy(` ') optional_policy(` @@ -40401,7 +40849,7 @@ index be8ed1e6c..697c2cf05 100644 ') optional_policy(` -@@ -132,12 +183,13 @@ optional_policy(` +@@ -132,12 +184,13 @@ optional_policy(` optional_policy(` seutil_sigchld_newrole(iptables_t) @@ -47802,7 +48250,7 @@ index 2cea692c0..853ddefe4 100644 + files_pid_filetrans($1, net_conf_t, dir, "cloud-init") +') diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te -index a392fc4bc..a61ba7d4e 100644 +index a392fc4bc..4870f76fd 100644 --- a/policy/modules/system/sysnetwork.te +++ b/policy/modules/system/sysnetwork.te @@ -5,6 +5,13 @@ policy_module(sysnetwork, 1.15.4) @@ -47930,7 +48378,7 @@ index a392fc4bc..a61ba7d4e 100644 fs_getattr_all_fs(dhcpc_t) fs_search_auto_mountpoints(dhcpc_t) -@@ -137,11 +158,17 @@ term_dontaudit_use_all_ptys(dhcpc_t) +@@ -137,16 +158,23 @@ term_dontaudit_use_all_ptys(dhcpc_t) term_dontaudit_use_unallocated_ttys(dhcpc_t) term_dontaudit_use_generic_ptys(dhcpc_t) @@ -47949,7 +48397,13 @@ index a392fc4bc..a61ba7d4e 100644 modutils_run_insmod(dhcpc_t, dhcpc_roles) -@@ -161,7 +188,21 @@ ifdef(`distro_ubuntu',` + sysnet_run_ifconfig(dhcpc_t, dhcpc_roles) + ++userdom_stream_connect(dhcpc_t) + userdom_use_user_terminals(dhcpc_t) + userdom_dontaudit_search_user_home_dirs(dhcpc_t) + +@@ -161,7 +189,21 @@ ifdef(`distro_ubuntu',` ') optional_policy(` @@ -47972,7 +48426,7 @@ index a392fc4bc..a61ba7d4e 100644 ') optional_policy(` -@@ -179,10 +220,6 @@ optional_policy(` +@@ -179,10 +221,6 @@ optional_policy(` ') optional_policy(` @@ -47983,7 +48437,7 @@ index a392fc4bc..a61ba7d4e 100644 hotplug_getattr_config_dirs(dhcpc_t) hotplug_search_config(dhcpc_t) -@@ -195,23 +232,31 @@ optional_policy(` +@@ -195,23 +233,31 @@ optional_policy(` optional_policy(` netutils_run_ping(dhcpc_t, dhcpc_roles) netutils_run(dhcpc_t, dhcpc_roles) @@ -48018,7 +48472,7 @@ index a392fc4bc..a61ba7d4e 100644 ') optional_policy(` -@@ -221,7 +266,16 @@ optional_policy(` +@@ -221,7 +267,16 @@ optional_policy(` optional_policy(` seutil_sigchld_newrole(dhcpc_t) @@ -48036,7 +48490,7 @@ index a392fc4bc..a61ba7d4e 100644 ') optional_policy(` -@@ -233,6 +287,10 @@ optional_policy(` +@@ -233,6 +288,10 @@ optional_policy(` ') optional_policy(` @@ -48047,7 +48501,7 @@ index a392fc4bc..a61ba7d4e 100644 vmware_append_log(dhcpc_t) ') -@@ -264,32 +322,73 @@ allow ifconfig_t self:msgq create_msgq_perms; +@@ -264,32 +323,73 @@ allow ifconfig_t self:msgq create_msgq_perms; allow ifconfig_t self:msg { send receive }; # Create UDP sockets, necessary when called from dhcpc allow ifconfig_t self:udp_socket create_socket_perms; @@ -48121,7 +48575,7 @@ index a392fc4bc..a61ba7d4e 100644 selinux_dontaudit_getattr_fs(ifconfig_t) -@@ -299,33 +398,51 @@ term_dontaudit_use_all_ptys(ifconfig_t) +@@ -299,33 +399,51 @@ term_dontaudit_use_all_ptys(ifconfig_t) term_dontaudit_use_ptmx(ifconfig_t) term_dontaudit_use_generic_ptys(ifconfig_t) @@ -48179,7 +48633,7 @@ index a392fc4bc..a61ba7d4e 100644 optional_policy(` dev_dontaudit_rw_cardmgr(ifconfig_t) ') -@@ -336,7 +453,11 @@ ifdef(`hide_broken_symptoms',` +@@ -336,7 +454,11 @@ ifdef(`hide_broken_symptoms',` ') optional_policy(` @@ -48192,7 +48646,7 @@ index a392fc4bc..a61ba7d4e 100644 ') optional_policy(` -@@ -350,7 +471,16 @@ optional_policy(` +@@ -350,7 +472,16 @@ optional_policy(` ') optional_policy(` @@ -48210,7 +48664,7 @@ index a392fc4bc..a61ba7d4e 100644 ') optional_policy(` -@@ -371,3 +501,17 @@ optional_policy(` +@@ -371,3 +502,17 @@ optional_policy(` xen_append_log(ifconfig_t) xen_dontaudit_rw_unix_stream_sockets(ifconfig_t) ') @@ -57836,7 +58290,7 @@ index 9dc60c6c0..562afbe9a 100644 + ') ') diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te -index f4ac38dc7..1589d6065 100644 +index f4ac38dc7..e4733e828 100644 --- a/policy/modules/system/userdomain.te +++ b/policy/modules/system/userdomain.te @@ -7,48 +7,43 @@ policy_module(userdomain, 4.9.1) @@ -57986,7 +58440,7 @@ index f4ac38dc7..1589d6065 100644 +') + +allow userdomain userdomain:process signull; -+allow userdomain userdomain:fifo_file rw_inherited_fifo_file_perms; ++allow userdomain userdomain:fifo_file { map rw_inherited_fifo_file_perms }; +dontaudit unpriv_userdomain self:rawip_socket create_socket_perms; + +# Nautilus causes this avc diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index c4b24493..b4a2b26d 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -1813,7 +1813,7 @@ index 01cbb67df..94a4a2406 100644 files_list_etc($1) diff --git a/aide.te b/aide.te -index 03831e6e5..d97de5ad7 100644 +index 03831e6e5..93a15b5de 100644 --- a/aide.te +++ b/aide.te @@ -10,6 +10,7 @@ attribute_role aide_roles; @@ -1824,7 +1824,7 @@ index 03831e6e5..d97de5ad7 100644 role aide_roles types aide_t; type aide_log_t; -@@ -23,22 +24,34 @@ files_type(aide_db_t) +@@ -23,23 +24,39 @@ files_type(aide_db_t) # Local policy # @@ -1864,6 +1864,11 @@ index 03831e6e5..d97de5ad7 100644 optional_policy(` seutil_use_newrole_fds(aide_t) + ') ++ ++optional_policy(` ++ sssd_stream_connect(aide_t) ++') diff --git a/aisexec.if b/aisexec.if index a2997fa57..861cebdf9 100644 --- a/aisexec.if @@ -5626,7 +5631,7 @@ index f6eb4851f..3628a384f 100644 + allow $1 httpd_t:process { noatsecure }; ') diff --git a/apache.te b/apache.te -index 6649962b6..3db9df9f9 100644 +index 6649962b6..0a7b49bbb 100644 --- a/apache.te +++ b/apache.te @@ -5,280 +5,346 @@ policy_module(apache, 2.7.2) @@ -6337,7 +6342,15 @@ index 6649962b6..3db9df9f9 100644 allow httpd_t httpd_sys_script_t:unix_stream_socket connectto; -@@ -438,6 +558,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi +@@ -428,6 +548,7 @@ manage_sock_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) + manage_lnk_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) + files_tmp_filetrans(httpd_t, httpd_tmp_t, { file dir lnk_file sock_file }) + userdom_user_tmp_filetrans(httpd_t, httpd_tmp_t, dir) ++allow httpd_t httpd_tmp_t:file map; + + manage_dirs_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t) + manage_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t) +@@ -438,6 +559,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi manage_dirs_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) @@ -6345,7 +6358,7 @@ index 6649962b6..3db9df9f9 100644 files_var_lib_filetrans(httpd_t, httpd_var_lib_t, { dir file }) setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) -@@ -450,140 +571,179 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) +@@ -450,140 +572,179 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) manage_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) @@ -6589,7 +6602,7 @@ index 6649962b6..3db9df9f9 100644 ') tunable_policy(`httpd_enable_cgi && httpd_use_nfs',` -@@ -594,28 +754,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',` +@@ -594,28 +755,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',` fs_cifs_domtrans(httpd_t, httpd_sys_script_t) ') @@ -6649,7 +6662,7 @@ index 6649962b6..3db9df9f9 100644 ') tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` -@@ -624,68 +806,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` +@@ -624,68 +807,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` fs_read_nfs_symlinks(httpd_t) ') @@ -6752,7 +6765,7 @@ index 6649962b6..3db9df9f9 100644 ') tunable_policy(`httpd_setrlimit',` -@@ -695,49 +865,48 @@ tunable_policy(`httpd_setrlimit',` +@@ -695,49 +866,48 @@ tunable_policy(`httpd_setrlimit',` tunable_policy(`httpd_ssi_exec',` corecmd_shell_domtrans(httpd_t, httpd_sys_script_t) @@ -6833,7 +6846,7 @@ index 6649962b6..3db9df9f9 100644 ') optional_policy(` -@@ -749,24 +918,32 @@ optional_policy(` +@@ -749,24 +919,32 @@ optional_policy(` ') optional_policy(` @@ -6872,7 +6885,7 @@ index 6649962b6..3db9df9f9 100644 ') optional_policy(` -@@ -775,6 +952,10 @@ optional_policy(` +@@ -775,6 +953,10 @@ optional_policy(` tunable_policy(`httpd_dbus_avahi',` avahi_dbus_chat(httpd_t) ') @@ -6883,7 +6896,7 @@ index 6649962b6..3db9df9f9 100644 ') optional_policy(` -@@ -786,35 +967,62 @@ optional_policy(` +@@ -786,35 +968,62 @@ optional_policy(` ') optional_policy(` @@ -6959,7 +6972,7 @@ index 6649962b6..3db9df9f9 100644 tunable_policy(`httpd_manage_ipa',` memcached_manage_pid_files(httpd_t) -@@ -822,8 +1030,31 @@ optional_policy(` +@@ -822,8 +1031,31 @@ optional_policy(` ') optional_policy(` @@ -6991,7 +7004,7 @@ index 6649962b6..3db9df9f9 100644 tunable_policy(`httpd_can_network_connect_db',` mysql_tcp_connect(httpd_t) -@@ -832,6 +1063,8 @@ optional_policy(` +@@ -832,6 +1064,8 @@ optional_policy(` optional_policy(` nagios_read_config(httpd_t) @@ -7000,7 +7013,7 @@ index 6649962b6..3db9df9f9 100644 ') optional_policy(` -@@ -842,20 +1075,48 @@ optional_policy(` +@@ -842,20 +1076,48 @@ optional_policy(` ') optional_policy(` @@ -7055,7 +7068,7 @@ index 6649962b6..3db9df9f9 100644 ') optional_policy(` -@@ -863,16 +1124,31 @@ optional_policy(` +@@ -863,16 +1125,31 @@ optional_policy(` ') optional_policy(` @@ -7089,7 +7102,7 @@ index 6649962b6..3db9df9f9 100644 ') optional_policy(` -@@ -883,65 +1159,189 @@ optional_policy(` +@@ -883,65 +1160,189 @@ optional_policy(` yam_read_content(httpd_t) ') @@ -7301,7 +7314,7 @@ index 6649962b6..3db9df9f9 100644 files_dontaudit_search_pids(httpd_suexec_t) files_search_home(httpd_suexec_t) -@@ -950,123 +1350,75 @@ auth_use_nsswitch(httpd_suexec_t) +@@ -950,123 +1351,75 @@ auth_use_nsswitch(httpd_suexec_t) logging_search_logs(httpd_suexec_t) logging_send_syslog_msg(httpd_suexec_t) @@ -7455,7 +7468,7 @@ index 6649962b6..3db9df9f9 100644 mysql_read_config(httpd_suexec_t) tunable_policy(`httpd_can_network_connect_db',` -@@ -1083,172 +1435,107 @@ optional_policy(` +@@ -1083,172 +1436,107 @@ optional_policy(` ') ') @@ -7693,7 +7706,7 @@ index 6649962b6..3db9df9f9 100644 ') tunable_policy(`httpd_read_user_content',` -@@ -1256,64 +1543,74 @@ tunable_policy(`httpd_read_user_content',` +@@ -1256,64 +1544,74 @@ tunable_policy(`httpd_read_user_content',` ') tunable_policy(`httpd_use_cifs',` @@ -7791,7 +7804,7 @@ index 6649962b6..3db9df9f9 100644 ######################################## # -@@ -1321,8 +1618,15 @@ miscfiles_read_localization(httpd_rotatelogs_t) +@@ -1321,8 +1619,15 @@ miscfiles_read_localization(httpd_rotatelogs_t) # optional_policy(` @@ -7808,7 +7821,7 @@ index 6649962b6..3db9df9f9 100644 ') ######################################## -@@ -1330,49 +1634,43 @@ optional_policy(` +@@ -1330,49 +1635,43 @@ optional_policy(` # User content local policy # @@ -7877,7 +7890,7 @@ index 6649962b6..3db9df9f9 100644 kernel_read_system_state(httpd_passwd_t) corecmd_exec_bin(httpd_passwd_t) -@@ -1382,38 +1680,109 @@ dev_read_urand(httpd_passwd_t) +@@ -1382,38 +1681,109 @@ dev_read_urand(httpd_passwd_t) domain_use_interactive_fds(httpd_passwd_t) @@ -21731,7 +21744,7 @@ index 3023be7f6..5afde8039 100644 + files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups") ') diff --git a/cups.te b/cups.te -index c91813ccb..774431956 100644 +index c91813ccb..0ea3e3d6a 100644 --- a/cups.te +++ b/cups.te @@ -5,19 +5,31 @@ policy_module(cups, 1.16.2) @@ -22008,7 +22021,7 @@ index c91813ccb..774431956 100644 selinux_compute_access_vector(cupsd_t) selinux_validate_context(cupsd_t) -@@ -244,22 +289,30 @@ auth_dontaudit_read_pam_pid(cupsd_t) +@@ -244,23 +289,31 @@ auth_dontaudit_read_pam_pid(cupsd_t) auth_rw_faillog(cupsd_t) auth_use_nsswitch(cupsd_t) @@ -22033,17 +22046,18 @@ index c91813ccb..774431956 100644 userdom_dontaudit_use_unpriv_user_fds(cupsd_t) +userdom_dontaudit_search_user_home_dirs(cupsd_t) - userdom_dontaudit_search_user_home_content(cupsd_t) -+userdom_dontaudit_use_unpriv_user_fds(cupsd_t) +userdom_dontaudit_search_user_home_content(cupsd_t) -+ ++userdom_dontaudit_use_unpriv_user_fds(cupsd_t) + userdom_dontaudit_search_user_home_content(cupsd_t) + +tunable_policy(`cups_execmem',` + allow cupsd_t self:process { execmem execstack }; +') + - ++ optional_policy(` apm_domtrans_client(cupsd_t) + ') @@ -272,6 +325,8 @@ optional_policy(` optional_policy(` dbus_system_bus_client(cupsd_t) @@ -22187,7 +22201,7 @@ index c91813ccb..774431956 100644 fs_search_auto_mountpoints(cupsd_config_t) domain_use_interactive_fds(cupsd_config_t) -@@ -417,11 +476,6 @@ auth_use_nsswitch(cupsd_config_t) +@@ -417,17 +476,16 @@ auth_use_nsswitch(cupsd_config_t) logging_send_syslog_msg(cupsd_config_t) @@ -22199,7 +22213,17 @@ index c91813ccb..774431956 100644 userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t) userdom_dontaudit_search_user_home_dirs(cupsd_config_t) userdom_read_all_users_state(cupsd_config_t) -@@ -449,9 +503,12 @@ optional_policy(` + userdom_read_user_tmp_symlinks(cupsd_config_t) + userdom_rw_user_tmp_files(cupsd_config_t) + ++tunable_policy(`cups_execmem',` ++ allow cupsd_config_t self:process { execmem execstack }; ++') ++ + optional_policy(` + term_use_generic_ptys(cupsd_config_t) + ') +@@ -449,9 +507,12 @@ optional_policy(` ') optional_policy(` @@ -22213,7 +22237,7 @@ index c91813ccb..774431956 100644 ') optional_policy(` -@@ -467,6 +524,10 @@ optional_policy(` +@@ -467,6 +528,10 @@ optional_policy(` ') optional_policy(` @@ -22224,7 +22248,7 @@ index c91813ccb..774431956 100644 rpm_read_db(cupsd_config_t) ') -@@ -487,10 +548,6 @@ optional_policy(` +@@ -487,10 +552,6 @@ optional_policy(` # Lpd local policy # @@ -22235,7 +22259,7 @@ index c91813ccb..774431956 100644 allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms; allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms; -@@ -508,15 +565,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t) +@@ -508,15 +569,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t) kernel_read_kernel_sysctls(cupsd_lpd_t) kernel_read_system_state(cupsd_lpd_t) @@ -22253,7 +22277,7 @@ index c91813ccb..774431956 100644 corenet_tcp_sendrecv_ipp_port(cupsd_lpd_t) corenet_sendrecv_printer_server_packets(cupsd_lpd_t) -@@ -537,9 +594,6 @@ auth_use_nsswitch(cupsd_lpd_t) +@@ -537,9 +598,6 @@ auth_use_nsswitch(cupsd_lpd_t) logging_send_syslog_msg(cupsd_lpd_t) @@ -22263,7 +22287,7 @@ index c91813ccb..774431956 100644 optional_policy(` inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t) ') -@@ -549,9 +603,9 @@ optional_policy(` +@@ -549,9 +607,9 @@ optional_policy(` # Pdf local policy # @@ -22275,7 +22299,7 @@ index c91813ccb..774431956 100644 append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t) create_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t) -@@ -566,148 +620,23 @@ fs_search_auto_mountpoints(cups_pdf_t) +@@ -566,148 +624,23 @@ fs_search_auto_mountpoints(cups_pdf_t) kernel_read_system_state(cups_pdf_t) @@ -22304,13 +22328,11 @@ index c91813ccb..774431956 100644 - fs_manage_cifs_dirs(cups_pdf_t) - fs_manage_cifs_files(cups_pdf_t) -') -+userdom_home_manager(cups_pdf_t) - - optional_policy(` +- +-optional_policy(` - lpd_manage_spool(cups_pdf_t) -+ gnome_read_config(cups_pdf_t) - ') - +-') +- -######################################## -# -# HPLIP local policy @@ -22412,11 +22434,13 @@ index c91813ccb..774431956 100644 - lpd_read_config(hplip_t) - lpd_manage_spool(hplip_t) -') -- --optional_policy(` ++userdom_home_manager(cups_pdf_t) + + optional_policy(` - seutil_sigchld_newrole(hplip_t) --') -- ++ gnome_read_config(cups_pdf_t) + ') + -optional_policy(` - snmp_read_snmp_var_lib_files(hplip_t) -') @@ -22427,7 +22451,7 @@ index c91813ccb..774431956 100644 ######################################## # -@@ -735,7 +664,6 @@ kernel_read_kernel_sysctls(ptal_t) +@@ -735,7 +668,6 @@ kernel_read_kernel_sysctls(ptal_t) kernel_list_proc(ptal_t) kernel_read_proc_symlinks(ptal_t) @@ -22435,7 +22459,7 @@ index c91813ccb..774431956 100644 corenet_all_recvfrom_netlabel(ptal_t) corenet_tcp_sendrecv_generic_if(ptal_t) corenet_tcp_sendrecv_generic_node(ptal_t) -@@ -745,13 +673,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t) +@@ -745,13 +677,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t) corenet_tcp_bind_ptal_port(ptal_t) corenet_tcp_sendrecv_ptal_port(ptal_t) @@ -22449,7 +22473,7 @@ index c91813ccb..774431956 100644 files_read_etc_runtime_files(ptal_t) fs_getattr_all_fs(ptal_t) -@@ -759,8 +685,6 @@ fs_search_auto_mountpoints(ptal_t) +@@ -759,8 +689,6 @@ fs_search_auto_mountpoints(ptal_t) logging_send_syslog_msg(ptal_t) @@ -22458,7 +22482,7 @@ index c91813ccb..774431956 100644 sysnet_read_config(ptal_t) userdom_dontaudit_use_unpriv_user_fds(ptal_t) -@@ -773,3 +697,4 @@ optional_policy(` +@@ -773,3 +701,4 @@ optional_policy(` optional_policy(` udev_read_db(ptal_t) ') @@ -25467,7 +25491,7 @@ index c697edbcd..954c090bd 100644 + allow $1 dhcpd_unit_file_t:service all_service_perms; ') diff --git a/dhcp.te b/dhcp.te -index 98a24b989..9ded26309 100644 +index 98a24b989..c9162e646 100644 --- a/dhcp.te +++ b/dhcp.te @@ -20,6 +20,9 @@ init_daemon_domain(dhcpd_t, dhcpd_exec_t) @@ -25485,7 +25509,7 @@ index 98a24b989..9ded26309 100644 # -allow dhcpd_t self:capability { chown dac_override sys_chroot net_raw setgid setuid sys_resource }; -+allow dhcpd_t self:capability { chown dac_read_search fowner sys_chroot net_raw kill setgid setuid setpcap sys_resource }; ++allow dhcpd_t self:capability { chown dac_read_search dac_override fowner sys_chroot net_raw kill setgid setuid setpcap sys_resource }; dontaudit dhcpd_t self:capability { net_admin sys_tty_config }; allow dhcpd_t self:process { getcap setcap signal_perms }; allow dhcpd_t self:fifo_file rw_fifo_file_perms; @@ -32113,10 +32137,10 @@ index 000000000..d9ba5fa27 +') diff --git a/ganesha.te b/ganesha.te new file mode 100644 -index 000000000..0fdeecfd6 +index 000000000..f25a3f34d --- /dev/null +++ b/ganesha.te -@@ -0,0 +1,110 @@ +@@ -0,0 +1,111 @@ +policy_module(ganesha, 1.0.0) + +######################################## @@ -32153,6 +32177,7 @@ index 000000000..0fdeecfd6 +# +dontaudit ganesha_t self:capability net_admin; + ++allow ganesha_t self:capability { dac_read_search dac_override }; +allow ganesha_t self:capability2 block_suspend; +allow ganesha_t self:process { setcap setrlimit }; +allow ganesha_t self:fifo_file rw_fifo_file_perms; @@ -44078,7 +44103,7 @@ index 4fe75fd63..3504a9bf7 100644 +/var/tmp/ldap_487 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/tmp/ldap_55 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) diff --git a/kerberos.if b/kerberos.if -index f6c00d8e6..79ea4d8d2 100644 +index f6c00d8e6..1233a5ba2 100644 --- a/kerberos.if +++ b/kerberos.if @@ -1,27 +1,29 @@ @@ -44217,7 +44242,16 @@ index f6c00d8e6..79ea4d8d2 100644 pcscd_stream_connect($1) ') ') -@@ -119,7 +119,7 @@ interface(`kerberos_use',` +@@ -115,11 +115,16 @@ interface(`kerberos_use',` + optional_policy(` + sssd_read_public_files($1) + ') ++ ++ # Allow to use kerberos KCM daemon (sssd-kcm) ++ optional_policy(` ++ sssd_run_stream_connect($1) ++ ') + ') ######################################## ## @@ -44226,7 +44260,7 @@ index f6c00d8e6..79ea4d8d2 100644 ## ## ## -@@ -135,15 +135,13 @@ interface(`kerberos_read_config',` +@@ -135,15 +140,13 @@ interface(`kerberos_read_config',` files_search_etc($1) allow $1 krb5_conf_t:file read_file_perms; @@ -44244,7 +44278,7 @@ index f6c00d8e6..79ea4d8d2 100644 ## ## ## -@@ -156,13 +154,12 @@ interface(`kerberos_dontaudit_write_config',` +@@ -156,13 +159,12 @@ interface(`kerberos_dontaudit_write_config',` type krb5_conf_t; ') @@ -44260,7 +44294,7 @@ index f6c00d8e6..79ea4d8d2 100644 ## ## ## -@@ -182,27 +179,27 @@ interface(`kerberos_rw_config',` +@@ -182,27 +184,27 @@ interface(`kerberos_rw_config',` ######################################## ## @@ -44295,7 +44329,7 @@ index f6c00d8e6..79ea4d8d2 100644 ## ## ## -@@ -210,220 +207,252 @@ interface(`kerberos_manage_krb5_home_files',` +@@ -210,220 +212,252 @@ interface(`kerberos_manage_krb5_home_files',` ## ## # @@ -44638,7 +44672,7 @@ index f6c00d8e6..79ea4d8d2 100644 ## ## ## -@@ -432,17 +461,18 @@ interface(`kerberos_manage_host_rcache',` +@@ -432,17 +466,18 @@ interface(`kerberos_manage_host_rcache',` ## ## # @@ -44661,7 +44695,7 @@ index f6c00d8e6..79ea4d8d2 100644 ## ## ## -@@ -450,82 +480,109 @@ interface(`kerberos_tmp_filetrans_host_rcache',` +@@ -450,82 +485,109 @@ interface(`kerberos_tmp_filetrans_host_rcache',` ## ## # @@ -46992,7 +47026,7 @@ index 3602712d0..af83a5b6b 100644 + allow $1 slapd_unit_file_t:service all_service_perms; ') diff --git a/ldap.te b/ldap.te -index 4c2b1110e..4baf7a041 100644 +index 4c2b1110e..a9444566a 100644 --- a/ldap.te +++ b/ldap.te @@ -21,6 +21,9 @@ files_config_file(slapd_etc_t) @@ -47037,7 +47071,17 @@ index 4c2b1110e..4baf7a041 100644 logging_log_filetrans(slapd_t, slapd_log_t, { file dir }) manage_dirs_pattern(slapd_t, slapd_replog_t, slapd_replog_t) -@@ -93,7 +96,6 @@ files_pid_filetrans(slapd_t, slapd_var_run_t, { dir file sock_file }) +@@ -80,7 +83,8 @@ manage_lnk_files_pattern(slapd_t, slapd_replog_t, slapd_replog_t) + + manage_dirs_pattern(slapd_t, slapd_tmp_t, slapd_tmp_t) + manage_files_pattern(slapd_t, slapd_tmp_t, slapd_tmp_t) +-files_tmp_filetrans(slapd_t, slapd_tmp_t, { file dir }) ++manage_lnk_files_pattern(slapd_t, slapd_tmp_t, slapd_tmp_t) ++files_tmp_filetrans(slapd_t, slapd_tmp_t, { file lnk_file dir }) + + manage_files_pattern(slapd_t, slapd_tmpfs_t, slapd_tmpfs_t) + fs_tmpfs_filetrans(slapd_t, slapd_tmpfs_t, file) +@@ -93,7 +97,6 @@ files_pid_filetrans(slapd_t, slapd_var_run_t, { dir file sock_file }) kernel_read_system_state(slapd_t) kernel_read_kernel_sysctls(slapd_t) @@ -47045,7 +47089,7 @@ index 4c2b1110e..4baf7a041 100644 corenet_all_recvfrom_netlabel(slapd_t) corenet_tcp_sendrecv_generic_if(slapd_t) corenet_tcp_sendrecv_generic_node(slapd_t) -@@ -115,25 +117,26 @@ fs_getattr_all_fs(slapd_t) +@@ -115,25 +118,26 @@ fs_getattr_all_fs(slapd_t) fs_search_auto_mountpoints(slapd_t) files_read_etc_runtime_files(slapd_t) @@ -47735,7 +47779,7 @@ index dff21a7c4..b6981c846 100644 init_labeled_script_domtrans($1, lircd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/lircd.te b/lircd.te -index 483c87bb6..5c41c7557 100644 +index 483c87bb6..1bfb75c34 100644 --- a/lircd.te +++ b/lircd.te @@ -13,7 +13,7 @@ type lircd_initrc_exec_t; @@ -47760,15 +47804,16 @@ index 483c87bb6..5c41c7557 100644 read_files_pattern(lircd_t, lircd_etc_t, lircd_etc_t) -@@ -39,6 +40,7 @@ dev_filetrans(lircd_t, lircd_var_run_t, sock_file) +@@ -39,6 +40,8 @@ dev_filetrans(lircd_t, lircd_var_run_t, sock_file) kernel_request_load_module(lircd_t) ++corecmd_exec_shell(lircd_t) + corenet_all_recvfrom_unlabeled(lircd_t) corenet_all_recvfrom_netlabel(lircd_t) corenet_tcp_sendrecv_generic_if(lircd_t) -@@ -56,7 +58,7 @@ dev_read_mouse(lircd_t) +@@ -56,7 +59,7 @@ dev_read_mouse(lircd_t) dev_filetrans_lirc(lircd_t) dev_rw_lirc(lircd_t) dev_rw_input_dev(lircd_t) @@ -47777,7 +47822,7 @@ index 483c87bb6..5c41c7557 100644 files_read_config_files(lircd_t) files_list_var(lircd_t) -@@ -64,9 +66,11 @@ files_manage_generic_locks(lircd_t) +@@ -64,9 +67,11 @@ files_manage_generic_locks(lircd_t) files_read_all_locks(lircd_t) term_use_ptmx(lircd_t) @@ -56955,7 +57000,7 @@ index ed81cac5a..cd52baf59 100644 + mta_filetrans_admin_home_content($1) +') diff --git a/mta.te b/mta.te -index ff1d68c6a..28ff27c22 100644 +index ff1d68c6a..ee540eafd 100644 --- a/mta.te +++ b/mta.te @@ -14,8 +14,6 @@ attribute mailserver_sender; @@ -57103,14 +57148,14 @@ index ff1d68c6a..28ff27c22 100644 init_use_script_ptys(system_mail_t) +init_dontaudit_rw_stream_socket(system_mail_t) -+ + +-userdom_use_user_terminals(system_mail_t) +userdom_use_inherited_user_terminals(system_mail_t) +userdom_dontaudit_list_user_home_dirs(system_mail_t) +userdom_dontaudit_list_admin_dir(system_mail_t) +userdom_dontaudit_list_user_tmp(system_mail_t) +userdom_dontaudit_read_inherited_admin_home_files(system_mail_t) - --userdom_use_user_terminals(system_mail_t) ++ +manage_dirs_pattern(system_mail_t, mail_home_rw_t, mail_home_rw_t) +manage_files_pattern(system_mail_t, mail_home_rw_t, mail_home_rw_t) + @@ -57177,13 +57222,17 @@ index ff1d68c6a..28ff27c22 100644 courier_stream_connect_authdaemon(system_mail_t) ') -@@ -244,9 +270,10 @@ optional_policy(` +@@ -244,9 +270,14 @@ optional_policy(` ') optional_policy(` - fail2ban_dontaudit_rw_stream_sockets(system_mail_t) - fail2ban_append_log(system_mail_t) - fail2ban_rw_inherited_tmp_files(system_mail_t) ++ dbus_system_bus_client(system_mail_t) ++') ++ ++optional_policy(` + fail2ban_append_log(user_mail_domain) + fail2ban_dontaudit_leaks(user_mail_domain) + fail2ban_rw_inherited_tmp_files(mta_user_agent) @@ -57191,7 +57240,7 @@ index ff1d68c6a..28ff27c22 100644 ') optional_policy(` -@@ -258,10 +285,17 @@ optional_policy(` +@@ -258,10 +289,17 @@ optional_policy(` ') optional_policy(` @@ -57209,7 +57258,7 @@ index ff1d68c6a..28ff27c22 100644 nagios_read_tmp_files(system_mail_t) ') -@@ -272,6 +306,19 @@ optional_policy(` +@@ -272,6 +310,19 @@ optional_policy(` manage_fifo_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t) manage_sock_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t) files_etc_filetrans(system_mail_t, etc_aliases_t, { file lnk_file sock_file fifo_file }) @@ -57229,7 +57278,7 @@ index ff1d68c6a..28ff27c22 100644 ') optional_policy(` -@@ -279,6 +326,10 @@ optional_policy(` +@@ -279,6 +330,10 @@ optional_policy(` ') optional_policy(` @@ -57240,7 +57289,7 @@ index ff1d68c6a..28ff27c22 100644 userdom_dontaudit_use_user_ptys(system_mail_t) optional_policy(` -@@ -287,42 +338,36 @@ optional_policy(` +@@ -287,42 +342,36 @@ optional_policy(` ') optional_policy(` @@ -57293,7 +57342,7 @@ index ff1d68c6a..28ff27c22 100644 allow mailserver_delivery mail_spool_t:dir list_dir_perms; create_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) -@@ -331,44 +376,48 @@ append_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) +@@ -331,44 +380,48 @@ append_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) create_lnk_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) read_lnk_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) @@ -57363,7 +57412,7 @@ index ff1d68c6a..28ff27c22 100644 ') optional_policy(` -@@ -381,24 +430,49 @@ optional_policy(` +@@ -381,24 +434,49 @@ optional_policy(` ######################################## # @@ -63626,7 +63675,7 @@ index a9c60ff87..ad4f14ad6 100644 + refpolicywarn(`$0($*) has been deprecated.') ') diff --git a/nsd.te b/nsd.te -index 47bb1d204..56874943b 100644 +index 47bb1d204..bd2b122ae 100644 --- a/nsd.te +++ b/nsd.te @@ -9,9 +9,7 @@ type nsd_t; @@ -63640,7 +63689,7 @@ index 47bb1d204..56874943b 100644 type nsd_conf_t; files_type(nsd_conf_t) -@@ -20,41 +18,50 @@ domain_type(nsd_crond_t) +@@ -20,40 +18,51 @@ domain_type(nsd_crond_t) domain_entry_file(nsd_crond_t, nsd_exec_t) role system_r types nsd_crond_t; @@ -63695,15 +63744,16 @@ index 47bb1d204..56874943b 100644 manage_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t) manage_lnk_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t) files_var_lib_filetrans(nsd_t, nsd_zone_t, dir) - ++allow nsd_t nsd_zone_t:file { map } ; ++ +manage_dirs_pattern(nsd_t, nsd_tmp_t, nsd_tmp_t) +manage_files_pattern(nsd_t, nsd_tmp_t, nsd_tmp_t) +files_tmp_filetrans(nsd_t, nsd_tmp_t, { file dir }) -+ ++allow nsd_t nsd_tmp_t:file { map } ; + can_exec(nsd_t, nsd_exec_t) - kernel_read_system_state(nsd_t) -@@ -62,7 +69,6 @@ kernel_read_kernel_sysctls(nsd_t) +@@ -62,7 +71,6 @@ kernel_read_kernel_sysctls(nsd_t) corecmd_exec_bin(nsd_t) @@ -63711,7 +63761,7 @@ index 47bb1d204..56874943b 100644 corenet_all_recvfrom_netlabel(nsd_t) corenet_tcp_sendrecv_generic_if(nsd_t) corenet_udp_sendrecv_generic_if(nsd_t) -@@ -72,16 +78,20 @@ corenet_tcp_sendrecv_all_ports(nsd_t) +@@ -72,16 +80,20 @@ corenet_tcp_sendrecv_all_ports(nsd_t) corenet_udp_sendrecv_all_ports(nsd_t) corenet_tcp_bind_generic_node(nsd_t) corenet_udp_bind_generic_node(nsd_t) @@ -63734,7 +63784,7 @@ index 47bb1d204..56874943b 100644 fs_getattr_all_fs(nsd_t) fs_search_auto_mountpoints(nsd_t) -@@ -90,8 +100,6 @@ auth_use_nsswitch(nsd_t) +@@ -90,8 +102,6 @@ auth_use_nsswitch(nsd_t) logging_send_syslog_msg(nsd_t) @@ -63743,7 +63793,7 @@ index 47bb1d204..56874943b 100644 userdom_dontaudit_use_unpriv_user_fds(nsd_t) userdom_dontaudit_search_user_home_dirs(nsd_t) -@@ -105,23 +113,24 @@ optional_policy(` +@@ -105,23 +115,24 @@ optional_policy(` ######################################## # @@ -63777,7 +63827,7 @@ index 47bb1d204..56874943b 100644 manage_files_pattern(nsd_crond_t, nsd_zone_t, nsd_zone_t) filetrans_pattern(nsd_crond_t, nsd_conf_t, nsd_zone_t, file) -@@ -133,29 +142,33 @@ kernel_read_system_state(nsd_crond_t) +@@ -133,29 +144,33 @@ kernel_read_system_state(nsd_crond_t) corecmd_exec_bin(nsd_crond_t) corecmd_exec_shell(nsd_crond_t) @@ -71346,10 +71396,10 @@ index 000000000..abb250dba +') diff --git a/pcp.te b/pcp.te new file mode 100644 -index 000000000..140ec0d3a +index 000000000..89e89b240 --- /dev/null +++ b/pcp.te -@@ -0,0 +1,313 @@ +@@ -0,0 +1,315 @@ +policy_module(pcp, 1.0.0) + +######################################## @@ -71656,6 +71706,8 @@ index 000000000..140ec0d3a +init_read_utmp(pcp_pmlogger_t) +init_status(pcp_pmlogger_t) + ++logging_send_syslog_msg(pcp_pmlogger_t) ++ +systemd_exec_systemctl(pcp_pmlogger_t) +systemd_getattr_unit_files(pcp_pmlogger_t) + @@ -88679,7 +88731,7 @@ index 16c8ecbe3..4e021eca7 100644 + ') ') diff --git a/redis.te b/redis.te -index 25cd4175f..84c02e325 100644 +index 25cd4175f..cf565276c 100644 --- a/redis.te +++ b/redis.te @@ -12,6 +12,9 @@ init_daemon_domain(redis_t, redis_exec_t) @@ -88692,17 +88744,20 @@ index 25cd4175f..84c02e325 100644 type redis_log_t; logging_log_file(redis_log_t) -@@ -21,6 +24,9 @@ files_type(redis_var_lib_t) +@@ -21,6 +24,12 @@ files_type(redis_var_lib_t) type redis_var_run_t; files_pid_file(redis_var_run_t) ++type redis_tmp_t; ++files_tmp_file(redis_tmp_t) ++ +type redis_unit_file_t; +systemd_unit_file(redis_unit_file_t) + ######################################## # # Local policy -@@ -31,6 +37,8 @@ allow redis_t self:fifo_file rw_fifo_file_perms; +@@ -31,6 +40,8 @@ allow redis_t self:fifo_file rw_fifo_file_perms; allow redis_t self:unix_stream_socket create_stream_socket_perms; allow redis_t self:tcp_socket create_stream_socket_perms; @@ -88711,11 +88766,16 @@ index 25cd4175f..84c02e325 100644 manage_dirs_pattern(redis_t, redis_log_t, redis_log_t) manage_files_pattern(redis_t, redis_log_t, redis_log_t) manage_lnk_files_pattern(redis_t, redis_log_t, redis_log_t) -@@ -42,24 +50,27 @@ manage_lnk_files_pattern(redis_t, redis_var_lib_t, redis_var_lib_t) +@@ -42,24 +53,32 @@ manage_lnk_files_pattern(redis_t, redis_var_lib_t, redis_var_lib_t) manage_dirs_pattern(redis_t, redis_var_run_t, redis_var_run_t) manage_files_pattern(redis_t, redis_var_run_t, redis_var_run_t) manage_lnk_files_pattern(redis_t, redis_var_run_t, redis_var_run_t) +manage_sock_files_pattern(redis_t, redis_var_run_t, redis_var_run_t) ++ ++ ++manage_dirs_pattern(redis_t, redis_tmp_t, redis_tmp_t) ++manage_files_pattern(redis_t, redis_tmp_t, redis_tmp_t) ++files_tmp_filetrans(redis_t, redis_tmp_t, { dir file }) kernel_read_system_state(redis_t) +kernel_read_net_sysctls(redis_t) @@ -89543,7 +89603,7 @@ index 47de2d681..6baf5cdae 100644 +/var/log/pacemaker\.log.* -- gen_context(system_u:object_r:cluster_var_log_t,s0) +/var/log/pcsd(/.*)? gen_context(system_u:object_r:cluster_var_log_t,s0) diff --git a/rhcs.if b/rhcs.if -index c8bdea28d..beb2872e3 100644 +index c8bdea28d..96da15f8a 100644 --- a/rhcs.if +++ b/rhcs.if @@ -1,19 +1,19 @@ @@ -89872,8 +89932,10 @@ index c8bdea28d..beb2872e3 100644 + manage_files_pattern($1, groupd_tmpfs_t, groupd_tmpfs_t) +') + -+######################################## -+## + ######################################## + ## +-## Read and write all cluster domains +-## shared memory. +## Read and write to group shared memory. +## +## @@ -89893,10 +89955,8 @@ index c8bdea28d..beb2872e3 100644 + manage_files_pattern($1, groupd_tmpfs_t, groupd_tmpfs_t) +') + - ######################################## - ## --## Read and write all cluster domains --## shared memory. ++######################################## ++## +## Read and write to group shared memory. ## ## @@ -89994,7 +90054,7 @@ index c8bdea28d..beb2872e3 100644 ') ###################################### -@@ -446,52 +577,404 @@ interface(`rhcs_domtrans_qdiskd',` +@@ -446,52 +577,423 @@ interface(`rhcs_domtrans_qdiskd',` ######################################## ## @@ -90032,10 +90092,16 @@ index c8bdea28d..beb2872e3 100644 # -interface(`rhcs_admin',` +interface(`rhcs_read_cluster_lib_files',` -+ gen_require(` + gen_require(` +- attribute cluster_domain, cluster_pid, cluster_tmpfs; +- attribute cluster_log; +- type dlm_controld_initrc_exec_t, foghorn_initrc_exec_t, fenced_lock_t; +- type fenced_tmp_t, qdiskd_var_lib_t; + type cluster_var_lib_t; -+ ') -+ + ') + +- allow $1 cluster_domain:process { ptrace signal_perms }; +- ps_process_pattern($1, cluster_domain) + files_search_var_lib($1) + read_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) +') @@ -90054,11 +90120,17 @@ index c8bdea28d..beb2872e3 100644 + gen_require(` + type cluster_var_lib_t; + ') -+ + +- init_labeled_script_domtrans($1, { dlm_controld_initrc_exec_t foghorn_initrc_exec_t }) +- domain_system_change_exemption($1) +- role_transition $2 { dlm_controld_initrc_exec_t foghorn_initrc_exec_t } system_r; +- allow $2 system_r; + files_search_var_lib($1) + manage_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) +') -+ + +- files_search_pids($1) +- admin_pattern($1, cluster_pid) +#################################### +## +## Allow domain to relabel cluster lib files @@ -90078,7 +90150,9 @@ index c8bdea28d..beb2872e3 100644 + relabelto_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) + relabelfrom_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) +') -+ + +- files_search_locks($1) +- admin_pattern($1, fenced_lock_t) +###################################### +## +## Execute a domain transition to run cluster administrative domain. @@ -90093,11 +90167,15 @@ index c8bdea28d..beb2872e3 100644 + gen_require(` + type cluster_t, cluster_exec_t; + ') -+ + +- files_search_tmp($1) +- admin_pattern($1, fenced_tmp_t) + corecmd_search_bin($1) + domtrans_pattern($1, cluster_exec_t, cluster_t) +') -+ + +- files_search_var_lib($1) +- admin_pattern($1, qdiskd_var_lib_t) +####################################### +## +## Execute cluster init scripts in @@ -90113,7 +90191,9 @@ index c8bdea28d..beb2872e3 100644 + gen_require(` + type cluster_initrc_exec_t; + ') -+ + +- fs_search_tmpfs($1) +- admin_pattern($1, cluster_tmpfs) + init_labeled_script_domtrans($1, cluster_initrc_exec_t) +') + @@ -90324,31 +90404,17 @@ index c8bdea28d..beb2872e3 100644 +## +# +interface(`rhcs_dbus_chat_cluster',` - gen_require(` -- attribute cluster_domain, cluster_pid, cluster_tmpfs; -- attribute cluster_log; -- type dlm_controld_initrc_exec_t, foghorn_initrc_exec_t, fenced_lock_t; -- type fenced_tmp_t, qdiskd_var_lib_t; ++ gen_require(` + type cluster_t; + class dbus send_msg; - ') - -- allow $1 cluster_domain:process { ptrace signal_perms }; -- ps_process_pattern($1, cluster_domain) ++ ') ++ + allow $1 cluster_t:dbus send_msg; + allow cluster_t $1:dbus send_msg; +') - -- init_labeled_script_domtrans($1, { dlm_controld_initrc_exec_t foghorn_initrc_exec_t }) -- domain_system_change_exemption($1) -- role_transition $2 { dlm_controld_initrc_exec_t foghorn_initrc_exec_t } system_r; -- allow $2 system_r; - -- files_search_pids($1) -- admin_pattern($1, cluster_pid) - -- files_search_locks($1) -- admin_pattern($1, fenced_lock_t) ++ ++ ++ +##################################### +## +## All of the rules required to administrate @@ -90372,20 +90438,14 @@ index c8bdea28d..beb2872e3 100644 + type cluster_tmpfs_t, cluster_var_log_t, cluster_var_run_t; + type cluster_unit_file_t; + ') - -- files_search_tmp($1) -- admin_pattern($1, fenced_tmp_t) ++ + allow $1 cluster_t:process signal_perms; + ps_process_pattern($1, cluster_t) - -- files_search_var_lib($1) -- admin_pattern($1, qdiskd_var_lib_t) ++ + tunable_policy(`deny_ptrace',`',` + allow $1 cluster_t:process ptrace; + ') - -- fs_search_tmpfs($1) -- admin_pattern($1, cluster_tmpfs) ++ + init_labeled_script_domtrans($1, cluster_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 cluster_initrc_exec_t system_r; @@ -90421,14 +90481,33 @@ index c8bdea28d..beb2872e3 100644 + gen_require(` + type haproxy_unit_file_t; + ') ++ ++ systemd_exec_systemctl($1) ++ allow $1 haproxy_unit_file_t:service {status start}; ++') ++ ++######################################## ++## ++## Create log files with a named file ++## type transition. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`rhcs_named_filetrans_log_dir',` ++ gen_require(` ++ type var_log_t; ++ ') - logging_search_logs($1) - admin_pattern($1, cluster_log) -+ systemd_exec_systemctl($1) -+ allow $1 haproxy_unit_file_t:service {status start}; ++ logging_log_named_filetrans($1, var_log_t, dir, "bundles") ') diff --git a/rhcs.te b/rhcs.te -index 6cf79c449..7b0fd415b 100644 +index 6cf79c449..5c0bfd05d 100644 --- a/rhcs.te +++ b/rhcs.te @@ -20,6 +20,35 @@ gen_tunable(fenced_can_network_connect, false) @@ -90467,7 +90546,7 @@ index 6cf79c449..7b0fd415b 100644 attribute cluster_domain; attribute cluster_log; attribute cluster_pid; -@@ -44,34 +73,291 @@ type foghorn_initrc_exec_t; +@@ -44,34 +73,295 @@ type foghorn_initrc_exec_t; init_script_file(foghorn_initrc_exec_t) rhcs_domain_template(gfs_controld) @@ -90722,6 +90801,10 @@ index 6cf79c449..7b0fd415b 100644 +') + +optional_policy(` ++ rhcs_named_filetrans_log_dir(cluster_t) ++') ++ ++optional_policy(` + rpc_systemctl_nfsd(cluster_t) + rpc_systemctl_rpcd(cluster_t) + @@ -90763,7 +90846,7 @@ index 6cf79c449..7b0fd415b 100644 ') ##################################### -@@ -79,13 +365,14 @@ optional_policy(` +@@ -79,13 +369,14 @@ optional_policy(` # dlm_controld local policy # @@ -90780,7 +90863,7 @@ index 6cf79c449..7b0fd415b 100644 kernel_rw_net_sysctls(dlm_controld_t) corecmd_exec_bin(dlm_controld_t) -@@ -98,16 +385,30 @@ fs_manage_configfs_dirs(dlm_controld_t) +@@ -98,16 +389,30 @@ fs_manage_configfs_dirs(dlm_controld_t) init_rw_script_tmp_files(dlm_controld_t) @@ -90814,7 +90897,7 @@ index 6cf79c449..7b0fd415b 100644 manage_files_pattern(fenced_t, fenced_lock_t, fenced_lock_t) files_lock_filetrans(fenced_t, fenced_lock_t, file) -@@ -118,9 +419,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir }) +@@ -118,9 +423,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir }) stream_connect_pattern(fenced_t, groupd_var_run_t, groupd_var_run_t, groupd_t) @@ -90826,7 +90909,7 @@ index 6cf79c449..7b0fd415b 100644 corecmd_exec_bin(fenced_t) corecmd_exec_shell(fenced_t) -@@ -140,6 +440,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t) +@@ -140,6 +444,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t) corenet_sendrecv_zented_server_packets(fenced_t) corenet_tcp_bind_zented_port(fenced_t) @@ -90835,7 +90918,7 @@ index 6cf79c449..7b0fd415b 100644 corenet_tcp_sendrecv_zented_port(fenced_t) corenet_sendrecv_http_client_packets(fenced_t) -@@ -148,9 +450,8 @@ corenet_tcp_sendrecv_http_port(fenced_t) +@@ -148,9 +454,8 @@ corenet_tcp_sendrecv_http_port(fenced_t) dev_read_sysfs(fenced_t) dev_read_urand(fenced_t) @@ -90847,7 +90930,7 @@ index 6cf79c449..7b0fd415b 100644 storage_raw_read_fixed_disk(fenced_t) storage_raw_write_fixed_disk(fenced_t) -@@ -160,7 +461,7 @@ term_getattr_pty_fs(fenced_t) +@@ -160,7 +465,7 @@ term_getattr_pty_fs(fenced_t) term_use_generic_ptys(fenced_t) term_use_ptmx(fenced_t) @@ -90856,7 +90939,7 @@ index 6cf79c449..7b0fd415b 100644 tunable_policy(`fenced_can_network_connect',` corenet_sendrecv_all_client_packets(fenced_t) -@@ -182,7 +483,8 @@ optional_policy(` +@@ -182,7 +487,8 @@ optional_policy(` ') optional_policy(` @@ -90866,7 +90949,7 @@ index 6cf79c449..7b0fd415b 100644 ') optional_policy(` -@@ -190,12 +492,17 @@ optional_policy(` +@@ -190,12 +496,17 @@ optional_policy(` ') optional_policy(` @@ -90885,7 +90968,7 @@ index 6cf79c449..7b0fd415b 100644 ') optional_policy(` -@@ -203,6 +510,21 @@ optional_policy(` +@@ -203,6 +514,21 @@ optional_policy(` snmp_manage_var_lib_dirs(fenced_t) ') @@ -90907,7 +90990,7 @@ index 6cf79c449..7b0fd415b 100644 ####################################### # # foghorn local policy -@@ -221,16 +543,22 @@ corenet_sendrecv_agentx_client_packets(foghorn_t) +@@ -221,16 +547,22 @@ corenet_sendrecv_agentx_client_packets(foghorn_t) corenet_tcp_connect_agentx_port(foghorn_t) corenet_tcp_sendrecv_agentx_port(foghorn_t) @@ -90932,7 +91015,7 @@ index 6cf79c449..7b0fd415b 100644 snmp_stream_connect(foghorn_t) ') -@@ -247,16 +575,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_ +@@ -247,16 +579,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_ stream_connect_pattern(gfs_controld_t, fenced_var_run_t, fenced_var_run_t, fenced_t) stream_connect_pattern(gfs_controld_t, groupd_var_run_t, groupd_var_run_t, groupd_t) @@ -90954,7 +91037,7 @@ index 6cf79c449..7b0fd415b 100644 optional_policy(` lvm_exec(gfs_controld_t) dev_rw_lvm_control(gfs_controld_t) -@@ -275,10 +607,59 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) +@@ -275,10 +611,59 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) dev_list_sysfs(groupd_t) @@ -91016,7 +91099,7 @@ index 6cf79c449..7b0fd415b 100644 ###################################### # # qdiskd local policy -@@ -292,7 +673,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) +@@ -292,7 +677,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) manage_sock_files_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) files_var_lib_filetrans(qdiskd_t, qdiskd_var_lib_t, { file dir sock_file }) @@ -91024,7 +91107,7 @@ index 6cf79c449..7b0fd415b 100644 kernel_read_software_raid_state(qdiskd_t) kernel_getattr_core_if(qdiskd_t) -@@ -321,6 +701,8 @@ storage_raw_write_fixed_disk(qdiskd_t) +@@ -321,6 +705,8 @@ storage_raw_write_fixed_disk(qdiskd_t) auth_use_nsswitch(qdiskd_t) @@ -96921,7 +97004,7 @@ index b8b66ff4d..a93346efe 100644 +/var/lib/samba/scripts(/.*)? gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0) +') diff --git a/samba.if b/samba.if -index 50d07fb2e..a34db489c 100644 +index 50d07fb2e..e1474fde7 100644 --- a/samba.if +++ b/samba.if @@ -1,8 +1,12 @@ @@ -97282,13 +97365,14 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -400,14 +515,15 @@ interface(`samba_rw_var_files',` +@@ -400,14 +515,16 @@ interface(`samba_rw_var_files',` type samba_var_t; ') + files_search_var($1) files_search_var_lib($1) rw_files_pattern($1, samba_var_t, samba_var_t) ++ allow $1 samba_var_t:file { map}; ') ######################################## @@ -97300,7 +97384,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -421,33 +537,55 @@ interface(`samba_manage_var_files',` +@@ -421,33 +538,55 @@ interface(`samba_manage_var_files',` ') files_search_var_lib($1) @@ -97363,7 +97447,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -462,16 +600,16 @@ interface(`samba_domtrans_smbcontrol',` +@@ -462,16 +601,16 @@ interface(`samba_domtrans_smbcontrol',` # interface(`samba_run_smbcontrol',` gen_require(` @@ -97383,7 +97467,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -488,9 +626,27 @@ interface(`samba_domtrans_smbd',` +@@ -488,9 +627,27 @@ interface(`samba_domtrans_smbd',` domtrans_pattern($1, smbd_exec_t, smbd_t) ') @@ -97412,7 +97496,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -505,10 +661,26 @@ interface(`samba_signal_smbd',` +@@ -505,10 +662,26 @@ interface(`samba_signal_smbd',` allow $1 smbd_t:process signal; ') @@ -97441,7 +97525,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -526,7 +698,7 @@ interface(`samba_dontaudit_use_fds',` +@@ -526,7 +699,7 @@ interface(`samba_dontaudit_use_fds',` ######################################## ## @@ -97450,7 +97534,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -544,7 +716,7 @@ interface(`samba_write_smbmount_tcp_sockets',` +@@ -544,7 +717,7 @@ interface(`samba_write_smbmount_tcp_sockets',` ######################################## ## @@ -97459,7 +97543,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -560,49 +732,47 @@ interface(`samba_rw_smbmount_tcp_sockets',` +@@ -560,49 +733,47 @@ interface(`samba_rw_smbmount_tcp_sockets',` allow $1 smbmount_t:tcp_socket { read write }; ') @@ -97528,7 +97612,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -618,16 +788,16 @@ interface(`samba_getattr_winbind_exec',` +@@ -618,16 +789,16 @@ interface(`samba_getattr_winbind_exec',` # interface(`samba_run_winbind_helper',` gen_require(` @@ -97548,7 +97632,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -637,17 +807,71 @@ interface(`samba_run_winbind_helper',` +@@ -637,17 +808,71 @@ interface(`samba_run_winbind_helper',` # interface(`samba_read_winbind_pid',` gen_require(` @@ -97624,7 +97708,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -657,17 +881,61 @@ interface(`samba_read_winbind_pid',` +@@ -657,17 +882,61 @@ interface(`samba_read_winbind_pid',` # interface(`samba_stream_connect_winbind',` gen_require(` @@ -97649,12 +97733,10 @@ index 50d07fb2e..a34db489c 100644 + files_search_tmp($1) + stream_connect_pattern($1, winbind_tmp_t, winbind_tmp_t, winbind_t) + ') - ') - - ######################################## - ## --## All of the rules required to --## administrate an samba environment. ++') ++ ++######################################## ++## +## Create a set of derived types for apache +## web content. +## @@ -97682,16 +97764,18 @@ index 50d07fb2e..a34db489c 100644 + + domtrans_pattern(smbd_t, samba_$1_script_exec_t, samba_$1_script_t) + allow smbd_t samba_$1_script_exec_t:file ioctl; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## All of the rules required to +-## administrate an samba environment. +## All of the rules required to administrate +## an samba environment ## ## ## -@@ -676,7 +944,7 @@ interface(`samba_stream_connect_winbind',` +@@ -676,7 +945,7 @@ interface(`samba_stream_connect_winbind',` ## ## ## @@ -97700,7 +97784,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -689,11 +957,30 @@ interface(`samba_admin',` +@@ -689,11 +958,30 @@ interface(`samba_admin',` type samba_etc_t, samba_share_t, samba_initrc_exec_t; type swat_var_run_t, swat_tmp_t, winbind_log_t; type winbind_var_run_t, winbind_tmp_t; @@ -97734,7 +97818,7 @@ index 50d07fb2e..a34db489c 100644 init_labeled_script_domtrans($1, samba_initrc_exec_t) domain_system_change_exemption($1) -@@ -703,23 +990,34 @@ interface(`samba_admin',` +@@ -703,23 +991,34 @@ interface(`samba_admin',` files_list_etc($1) admin_pattern($1, { samba_etc_t smbd_keytab_t }) @@ -97781,7 +97865,7 @@ index 50d07fb2e..a34db489c 100644 + allow $1 samba_unit_file_t:service all_service_perms; ') diff --git a/samba.te b/samba.te -index 2b7c441e7..7443a9ded 100644 +index 2b7c441e7..0f95635dd 100644 --- a/samba.te +++ b/samba.te @@ -6,99 +6,86 @@ policy_module(samba, 1.16.3) @@ -98021,12 +98105,13 @@ index 2b7c441e7..7443a9ded 100644 allow samba_net_t samba_etc_t:file read_file_perms; -@@ -208,19 +206,25 @@ files_tmp_filetrans(samba_net_t, samba_net_tmp_t, { file dir }) +@@ -208,19 +206,26 @@ files_tmp_filetrans(samba_net_t, samba_net_tmp_t, { file dir }) manage_dirs_pattern(samba_net_t, samba_var_t, samba_var_t) manage_files_pattern(samba_net_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(samba_net_t, samba_var_t, samba_var_t) +manage_sock_files_pattern(samba_net_t, samba_var_t, samba_var_t) files_var_filetrans(samba_net_t, samba_var_t, dir, "samba") ++allow samba_net_t samba_var_t:file { map } ; +kernel_read_proc_symlinks(samba_net_t) kernel_read_system_state(samba_net_t) @@ -98051,7 +98136,7 @@ index 2b7c441e7..7443a9ded 100644 dev_read_urand(samba_net_t) -@@ -233,15 +237,22 @@ auth_manage_cache(samba_net_t) +@@ -233,15 +238,22 @@ auth_manage_cache(samba_net_t) logging_send_syslog_msg(samba_net_t) @@ -98078,7 +98163,7 @@ index 2b7c441e7..7443a9ded 100644 ') optional_policy(` -@@ -249,46 +260,59 @@ optional_policy(` +@@ -249,46 +261,59 @@ optional_policy(` ') optional_policy(` @@ -98151,7 +98236,7 @@ index 2b7c441e7..7443a9ded 100644 manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t) allow smbd_t samba_share_t:filesystem { getattr quotaget }; -@@ -297,66 +321,74 @@ manage_files_pattern(smbd_t, samba_var_t, samba_var_t) +@@ -297,66 +322,74 @@ manage_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_sock_files_pattern(smbd_t, samba_var_t, samba_var_t) files_var_filetrans(smbd_t, samba_var_t, dir, "samba") @@ -98250,7 +98335,7 @@ index 2b7c441e7..7443a9ded 100644 fs_getattr_all_fs(smbd_t) fs_getattr_all_dirs(smbd_t) -@@ -366,44 +398,53 @@ fs_getattr_rpc_dirs(smbd_t) +@@ -366,44 +399,53 @@ fs_getattr_rpc_dirs(smbd_t) fs_list_inotifyfs(smbd_t) fs_get_all_fs_quotas(smbd_t) @@ -98316,7 +98401,7 @@ index 2b7c441e7..7443a9ded 100644 ') tunable_policy(`samba_domain_controller',` -@@ -419,20 +460,16 @@ tunable_policy(`samba_domain_controller',` +@@ -419,20 +461,16 @@ tunable_policy(`samba_domain_controller',` ') tunable_policy(`samba_enable_home_dirs',` @@ -98343,7 +98428,7 @@ index 2b7c441e7..7443a9ded 100644 tunable_policy(`samba_share_nfs',` fs_manage_nfs_dirs(smbd_t) fs_manage_nfs_files(smbd_t) -@@ -441,6 +478,7 @@ tunable_policy(`samba_share_nfs',` +@@ -441,6 +479,7 @@ tunable_policy(`samba_share_nfs',` fs_manage_nfs_named_sockets(smbd_t) ') @@ -98351,7 +98436,7 @@ index 2b7c441e7..7443a9ded 100644 tunable_policy(`samba_share_fusefs',` fs_manage_fusefs_dirs(smbd_t) fs_manage_fusefs_files(smbd_t) -@@ -448,15 +486,10 @@ tunable_policy(`samba_share_fusefs',` +@@ -448,15 +487,10 @@ tunable_policy(`samba_share_fusefs',` fs_search_fusefs(smbd_t) ') @@ -98371,7 +98456,7 @@ index 2b7c441e7..7443a9ded 100644 ') optional_policy(` -@@ -466,6 +499,7 @@ optional_policy(` +@@ -466,6 +500,7 @@ optional_policy(` optional_policy(` ctdbd_stream_connect(smbd_t) ctdbd_manage_lib_files(smbd_t) @@ -98379,7 +98464,7 @@ index 2b7c441e7..7443a9ded 100644 ') optional_policy(` -@@ -474,11 +508,31 @@ optional_policy(` +@@ -474,11 +509,31 @@ optional_policy(` ') optional_policy(` @@ -98411,7 +98496,7 @@ index 2b7c441e7..7443a9ded 100644 lpd_exec_lpr(smbd_t) ') -@@ -488,6 +542,10 @@ optional_policy(` +@@ -488,6 +543,10 @@ optional_policy(` ') optional_policy(` @@ -98422,7 +98507,7 @@ index 2b7c441e7..7443a9ded 100644 rpc_search_nfs_state_data(smbd_t) ') -@@ -499,12 +557,53 @@ optional_policy(` +@@ -499,12 +558,53 @@ optional_policy(` udev_read_db(smbd_t) ') @@ -98477,7 +98562,7 @@ index 2b7c441e7..7443a9ded 100644 allow nmbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow nmbd_t self:fd use; allow nmbd_t self:fifo_file rw_fifo_file_perms; -@@ -512,9 +611,11 @@ allow nmbd_t self:msg { send receive }; +@@ -512,9 +612,11 @@ allow nmbd_t self:msg { send receive }; allow nmbd_t self:msgq create_msgq_perms; allow nmbd_t self:sem create_sem_perms; allow nmbd_t self:shm create_shm_perms; @@ -98492,7 +98577,7 @@ index 2b7c441e7..7443a9ded 100644 manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t) manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t) -@@ -526,20 +627,17 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) +@@ -526,20 +628,17 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t) @@ -98518,7 +98603,7 @@ index 2b7c441e7..7443a9ded 100644 kernel_getattr_core_if(nmbd_t) kernel_getattr_message_if(nmbd_t) -@@ -547,53 +645,44 @@ kernel_read_kernel_sysctls(nmbd_t) +@@ -547,53 +646,44 @@ kernel_read_kernel_sysctls(nmbd_t) kernel_read_network_state(nmbd_t) kernel_read_software_raid_state(nmbd_t) kernel_read_system_state(nmbd_t) @@ -98587,7 +98672,7 @@ index 2b7c441e7..7443a9ded 100644 ') optional_policy(` -@@ -606,18 +695,29 @@ optional_policy(` +@@ -606,18 +696,29 @@ optional_policy(` ######################################## # @@ -98623,7 +98708,7 @@ index 2b7c441e7..7443a9ded 100644 samba_read_config(smbcontrol_t) samba_search_var(smbcontrol_t) -@@ -627,39 +727,38 @@ domain_use_interactive_fds(smbcontrol_t) +@@ -627,39 +728,38 @@ domain_use_interactive_fds(smbcontrol_t) dev_read_urand(smbcontrol_t) @@ -98675,7 +98760,7 @@ index 2b7c441e7..7443a9ded 100644 allow smbmount_t samba_secrets_t:file manage_file_perms; -@@ -668,26 +767,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) +@@ -668,26 +768,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t) files_var_filetrans(smbmount_t, samba_var_t, dir, "samba") @@ -98711,7 +98796,7 @@ index 2b7c441e7..7443a9ded 100644 fs_getattr_cifs(smbmount_t) fs_mount_cifs(smbmount_t) -@@ -699,58 +794,77 @@ fs_read_cifs_files(smbmount_t) +@@ -699,58 +795,77 @@ fs_read_cifs_files(smbmount_t) storage_raw_read_fixed_disk(smbmount_t) storage_raw_write_fixed_disk(smbmount_t) @@ -98804,7 +98889,7 @@ index 2b7c441e7..7443a9ded 100644 manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t) manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t) -@@ -759,17 +873,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) +@@ -759,17 +874,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t) files_pid_filetrans(swat_t, swat_var_run_t, file) @@ -98828,7 +98913,7 @@ index 2b7c441e7..7443a9ded 100644 kernel_read_kernel_sysctls(swat_t) kernel_read_system_state(swat_t) -@@ -777,36 +887,25 @@ kernel_read_network_state(swat_t) +@@ -777,36 +888,25 @@ kernel_read_network_state(swat_t) corecmd_search_bin(swat_t) @@ -98871,7 +98956,7 @@ index 2b7c441e7..7443a9ded 100644 auth_domtrans_chk_passwd(swat_t) auth_use_nsswitch(swat_t) -@@ -818,10 +917,11 @@ logging_send_syslog_msg(swat_t) +@@ -818,10 +918,11 @@ logging_send_syslog_msg(swat_t) logging_send_audit_msgs(swat_t) logging_search_logs(swat_t) @@ -98885,7 +98970,7 @@ index 2b7c441e7..7443a9ded 100644 optional_policy(` cups_read_rw_config(swat_t) cups_stream_connect(swat_t) -@@ -840,17 +940,20 @@ optional_policy(` +@@ -840,17 +941,20 @@ optional_policy(` # Winbind local policy # @@ -98912,7 +98997,7 @@ index 2b7c441e7..7443a9ded 100644 allow winbind_t samba_etc_t:dir list_dir_perms; read_files_pattern(winbind_t, samba_etc_t, samba_etc_t) -@@ -860,9 +963,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) +@@ -860,9 +964,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file) manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t) @@ -98923,7 +99008,7 @@ index 2b7c441e7..7443a9ded 100644 manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t) manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t) -@@ -870,41 +971,46 @@ manage_files_pattern(winbind_t, samba_var_t, samba_var_t) +@@ -870,41 +972,46 @@ manage_files_pattern(winbind_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(winbind_t, samba_var_t, samba_var_t) manage_sock_files_pattern(winbind_t, samba_var_t, samba_var_t) files_var_filetrans(winbind_t, samba_var_t, dir, "samba") @@ -98982,7 +99067,7 @@ index 2b7c441e7..7443a9ded 100644 corenet_tcp_connect_smbd_port(winbind_t) corenet_tcp_connect_epmap_port(winbind_t) corenet_tcp_connect_all_unreserved_ports(winbind_t) -@@ -912,38 +1018,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) +@@ -912,38 +1019,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) dev_read_sysfs(winbind_t) dev_read_urand(winbind_t) @@ -99041,7 +99126,7 @@ index 2b7c441e7..7443a9ded 100644 ') optional_policy(` -@@ -959,31 +1079,36 @@ optional_policy(` +@@ -959,31 +1080,36 @@ optional_policy(` # Winbind helper local policy # @@ -99085,7 +99170,7 @@ index 2b7c441e7..7443a9ded 100644 optional_policy(` apache_append_log(winbind_helper_t) -@@ -997,25 +1122,38 @@ optional_policy(` +@@ -997,25 +1123,38 @@ optional_policy(` ######################################## # @@ -104736,10 +104821,10 @@ index 000000000..88490d5c6 + diff --git a/snapper.te b/snapper.te new file mode 100644 -index 000000000..11b39923c +index 000000000..6631a6500 --- /dev/null +++ b/snapper.te -@@ -0,0 +1,83 @@ +@@ -0,0 +1,85 @@ +policy_module(snapper, 1.0.0) + +######################################## @@ -104782,6 +104867,7 @@ index 000000000..11b39923c +manage_dirs_pattern(snapperd_t, snapperd_data_t, snapperd_data_t) +manage_lnk_files_pattern(snapperd_t, snapperd_data_t, snapperd_data_t) +allow snapperd_t snapperd_data_t:dir mounton; ++allow snapperd_t snapperd_data_t:file relabelfrom; +snapper_filetrans_named_content(snapperd_t) + +domain_read_all_domains_state(snapperd_t) @@ -104795,6 +104881,7 @@ index 000000000..11b39923c +files_relabelfrom_isid_type(snapperd_t) +files_read_all_files(snapperd_t) +files_list_all(snapperd_t) ++files_rmdir_all_dirs(snapperd_t) + +fs_getattr_all_fs(snapperd_t) + @@ -107180,7 +107267,7 @@ index 5e1f0534c..e7820bce3 100644 domain_system_change_exemption($1) role_transition $2 squid_initrc_exec_t system_r; diff --git a/squid.te b/squid.te -index 03472ed9b..deade60a1 100644 +index 03472ed9b..87af88795 100644 --- a/squid.te +++ b/squid.te @@ -29,7 +29,7 @@ type squid_cache_t; @@ -107232,13 +107319,14 @@ index 03472ed9b..deade60a1 100644 allow squid_t squid_conf_t:dir list_dir_perms; allow squid_t squid_conf_t:file read_file_perms; -@@ -78,15 +86,18 @@ manage_files_pattern(squid_t, squid_log_t, squid_log_t) +@@ -78,15 +86,19 @@ manage_files_pattern(squid_t, squid_log_t, squid_log_t) manage_lnk_files_pattern(squid_t, squid_log_t, squid_log_t) logging_log_filetrans(squid_t, squid_log_t, { file dir }) +manage_files_pattern(squid_t, squid_tmpfs_t, squid_tmpfs_t) +manage_dirs_pattern(squid_t, squid_tmpfs_t, squid_tmpfs_t) +fs_tmpfs_filetrans(squid_t, squid_tmpfs_t, { dir file }) ++allow squid_t squid_tmpfs_t:file map; + manage_dirs_pattern(squid_t, squid_tmp_t, squid_tmp_t) manage_files_pattern(squid_t, squid_tmp_t, squid_tmp_t) @@ -107255,7 +107343,7 @@ index 03472ed9b..deade60a1 100644 can_exec(squid_t, squid_exec_t) -@@ -94,7 +105,6 @@ kernel_read_kernel_sysctls(squid_t) +@@ -94,7 +106,6 @@ kernel_read_kernel_sysctls(squid_t) kernel_read_system_state(squid_t) kernel_read_network_state(squid_t) @@ -107263,7 +107351,7 @@ index 03472ed9b..deade60a1 100644 corenet_all_recvfrom_netlabel(squid_t) corenet_tcp_sendrecv_generic_if(squid_t) corenet_udp_sendrecv_generic_if(squid_t) -@@ -132,6 +142,7 @@ corenet_tcp_sendrecv_gopher_port(squid_t) +@@ -132,6 +143,7 @@ corenet_tcp_sendrecv_gopher_port(squid_t) corenet_udp_sendrecv_gopher_port(squid_t) corenet_sendrecv_squid_server_packets(squid_t) @@ -107271,7 +107359,7 @@ index 03472ed9b..deade60a1 100644 corenet_tcp_bind_squid_port(squid_t) corenet_udp_bind_squid_port(squid_t) corenet_tcp_sendrecv_squid_port(squid_t) -@@ -154,7 +165,6 @@ dev_read_urand(squid_t) +@@ -154,7 +166,6 @@ dev_read_urand(squid_t) domain_use_interactive_fds(squid_t) files_read_etc_runtime_files(squid_t) @@ -107279,7 +107367,7 @@ index 03472ed9b..deade60a1 100644 files_search_spool(squid_t) files_dontaudit_getattr_tmp_dirs(squid_t) files_getattr_home_dir(squid_t) -@@ -176,7 +186,6 @@ libs_exec_lib_files(squid_t) +@@ -176,7 +187,6 @@ libs_exec_lib_files(squid_t) logging_send_syslog_msg(squid_t) miscfiles_read_generic_certs(squid_t) @@ -107287,7 +107375,7 @@ index 03472ed9b..deade60a1 100644 userdom_use_unpriv_users_fds(squid_t) userdom_dontaudit_search_user_home_dirs(squid_t) -@@ -197,28 +206,31 @@ tunable_policy(`squid_use_tproxy',` +@@ -197,28 +207,31 @@ tunable_policy(`squid_use_tproxy',` optional_policy(` apache_content_template(squid) @@ -107333,7 +107421,7 @@ index 03472ed9b..deade60a1 100644 ') optional_policy(` -@@ -236,3 +248,24 @@ optional_policy(` +@@ -236,3 +249,24 @@ optional_policy(` optional_policy(` udev_read_db(squid_t) ') @@ -111773,10 +111861,10 @@ index 000000000..115bf6c42 +/usr/lib/tumbler-?[^/]*/tumblerd -- gen_context(system_u:object_r:thumb_exec_t,s0) diff --git a/thumb.if b/thumb.if new file mode 100644 -index 000000000..9524b50aa +index 000000000..d371f62f6 --- /dev/null +++ b/thumb.if -@@ -0,0 +1,134 @@ +@@ -0,0 +1,153 @@ + +## policy for thumb + @@ -111800,6 +111888,24 @@ index 000000000..9524b50aa + dontaudit thumb_t $1:unix_stream_socket { getattr read write }; +') + ++######################################## ++## ++## NNP Transition to thumb. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`thumb_nnp_domtrans',` ++ gen_require(` ++ type thumb_t; ++ ') ++ ++ allow $1 thumb_t:process2 { nnp_transition nosuid_transition }; ++ ++') + +######################################## +## @@ -111823,6 +111929,7 @@ index 000000000..9524b50aa + ') + + thumb_domtrans($1) ++ thumb_nnp_domtrans($1) + role $2 types thumb_t; + + allow $1 thumb_t:process signal_perms; @@ -111913,10 +112020,10 @@ index 000000000..9524b50aa +') diff --git a/thumb.te b/thumb.te new file mode 100644 -index 000000000..d6affa561 +index 000000000..a34bf9b9f --- /dev/null +++ b/thumb.te -@@ -0,0 +1,173 @@ +@@ -0,0 +1,174 @@ +policy_module(thumb, 1.0.0) + +######################################## @@ -112066,6 +112173,7 @@ index 000000000..d6affa561 + gnome_manage_gstreamer_home_dirs(thumb_t) + gnome_exec_gstreamer_home_files(thumb_t) + gnome_create_generic_cache_dir(thumb_t) ++ gnome_setattr_cache_home_dir(thumb_t) + gnome_cache_filetrans(thumb_t, thumb_home_t, dir, "thumbnails") + gnome_cache_filetrans(thumb_t, thumb_home_t, file) +') diff --git a/selinux-policy.spec b/selinux-policy.spec index 232fd613..413882a3 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 302%{?dist} +Release: 303%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -717,6 +717,43 @@ exit 0 %endif %changelog +* Thu Nov 16 2017 Lukas Vrabec - 3.13.1-303 +- Allow pcp_pmlogger to send logs to journal BZ(1512367) +- Merge pull request #40 from lslebodn/kcm_kerberos +- Allow services to use kerberos KCM BZ(1512128) +- Allow system_mail_t domain to be system_dbus_client BZ(1512476) +- Allow aide domain to stream connect to sssd_t BZ(1512500) +- Allow squid_t domain to mmap files with label squid_tmpfs_t BZ(1498809) +- Allow nsd_t domain to mmap files with labels nsd_tmp_t and nsd_zone_t BZ(1511269) +- Include cupsd_config_t domain into cups_execmem boolean. BZ(1417584) +- Allow samba_net_t domain to mmap samba_var_t files BZ(1512227) +- Allow lircd_t domain to execute shell BZ(1512787) +- Allow thumb_t domain to setattr on cache_home_t dirs BZ(1487814) +- Allow redis to creating tmp files with own label BZ(1513518) +- Create new interface thumb_nnp_domtrans allowing domaintransition with NoNewPrivs. This interface added to thumb_run() BZ(1509502) +- Allow httpd_t to mmap httpd_tmp_t files BZ(1502303) +- Add map permission to samba_rw_var_files interface. BZ(1513908) +- Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t +- Add dac_read_search and dac_override capabilities to ganesha +- Allow ldap_t domain to manage also slapd_tmp_t lnk files +- Allow snapperd_t domain to relabeling from snapperd_data_t BZ(1510584) +- Add dac_override capability to dhcpd_t doamin BZ(1510030) +- Allow snapperd_t to remove old snaps BZ(1510862) +- Allow chkpwd_t domain to mmap system_db_t files and be dbus system client BZ(1513704) +- Allow xdm_t send signull to all xserver unconfined types BZ(1499390) +- Allow fs associate for sysctl_vm_t BZ(1447301) +- Label /etc/init.d/vboxdrv as bin_t to run virtualbox as unconfined_service_t BZ(1451479) +- Allow xdm_t domain to read usermodehelper_t state BZ(1412609) +- Allow dhcpc_t domain to stream connect to userdomain domains BZ(1511948) +- Allow systemd to mmap kernel modules BZ(1513399) +- Allow userdomains to mmap fifo_files BZ(1512242) +- Merge pull request #205 from rhatdan/labels +- Add map permission to init_domtrans() interface BZ(1513832) +- Allow xdm_t domain to mmap and execute files in xdm_var_run_t BZ(1513883) +- Unconfined domains, need to create content with the correct labels +- Container runtimes are running iptables within a different user namespace +- Add interface files_rmdir_all_dirs() + * Mon Nov 06 2017 Lukas Vrabec - 3.13.1-302 - Allow jabber domains to connect to postgresql ports - Dontaudit slapd_t to block suspend system