From 449da6b4280dec1126e7065ba1dc834a4f84131e Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 13 Jul 2016 08:55:29 +0200 Subject: [PATCH] * Wed Jul 13 2016 Lukas Vrabec 3.13.1-202 - Allow systemd_logind_t to start init_t BZ(1355861) - Add init_start() interface - Allow sysadm user to run systemd-tmpfiles - Add interface systemd_tmpfiles_run --- docker-selinux.tgz | Bin 4315 -> 4315 bytes policy-rawhide-base.patch | 71 +++++++++++++++++++++++++++++++------- selinux-policy.spec | 6 ++++ 3 files changed, 64 insertions(+), 13 deletions(-) diff --git a/docker-selinux.tgz b/docker-selinux.tgz index 192c2eccb57c624f9a267b4881c8ab24b0cdf034..486f14cf54171d546fe65c8d5057577342351eff 100644 GIT binary patch delta 2743 zcmV;o3P|yO(u67N_0uMm;~**zq?o6QT@v^^Z!`*0r) zD6aijK$RuhR#&eRsrCAT{O>ozmne$VW9?10cNUP?7H57Whoj-laI{Go-;(+wU4Qd< z*A-mv-@nDr*B{nl_%iQJcRnc{`hlHl{M4n8I?3O0vZhmYl>*4 zN3Si!sQY{=+C$o`{s_|~jJHv-A=sMp z2ud?*O0!oJY~E`Di2USz3LJ5AqW;%4`pqV9_uJiyN=hvia+tRp%p0-u($pQ&NS%Ga?aj{qEC~$mdt-uSvZro zUkN%DVDvQ14`iK*O`C@@!;akVG$9TE2u{M{q2U|+-Q(G5;};u3FaJAj>>g%o@9_*= zF@M5=^W)Iqvp$@jI{1zKYx>artP`})$?iUd_wgF@RviYP&+P}=kd8rpkYCh;@Pto$OtY!XrV+>5<^%d85B!|DG}TLH23$9~pt% zoescIWlIM@tg?sC#I4M-nZG(_Xz$0RPE7lH0R1q1N56WA;h3gnY%sdOD=(XZmBrNO z$NQenG(8$)pP)xx2=|0#^IT)%UmM-ub9uv4A?9!}hDAI04#IQ=p8|g~LCL4U906j& zf)B#D7rpbo=8R?c6^IRu=^(Q_SS3DP%3~0^B=10+iL2#>aTWg!A-H6#=fb7zUjKd_ ztF`Dm{Uo(f6^2^&?awljmBEM+(6-|>LRkdY53v) zp2jSr4vHOO_}gJtG~R!bWB?nZP197#gcep9^P_+$X6YR$VPe8dq6AMjn}k>0OE}R& zdsAAf(^;OTS{Vtu^KKK}k}R_sagrES^1yooKkGCOAucBtilU5krcKvVDd(VK zveQG$N6O`k2~iJ`N`Gz{tA@Z7U0mjQm67|9OW(u5L+DBKcT#_P=HHA z0+WV7CkP}?WQi9s^6__7Jd}n=UH0ZS_JYqH|ppy z-0$?;>6EgvM*CVvyO1Yp?!k{pQhI9=@gxR5mj$J}l*L=4QC6G(e>jg2Mc$+`4Dk)2rQzNjw1=?I84 zER|L(A?v8gnDDdiJ9=Z13BBon>?vwqB0aTGR4JP>kQCeyrRzR|qv)!x@~)$JF7An; zuI$?u=?gdL8Wf_;s7n+cj#% zh{YUrnh@MtH)(<&73N3bv%#NxDl@A1ZB>?xe}Vm1eU+t(=#7u2NhPrSKq2$~WWRh5 z?A1IvQDOPKOMU+6Ba;PEZirOWO4cS9%( z`8$H0lT?F94lv9?y}&9v{3=D^aG)F%UiYjixJwGQp4UTkP7!+~y$4&DVlBY~H8&U2 zQ8QX#7??<)Rx>wL4In43hU|`81y+|fEWUAvi2Z-tSy@(oCO4woq}5nc3NZqT!@ZZw zaAYo(+lT0pxps9or4Gl(Np;BGBNe+1RqrSFp`cof;vE3!yu3%kvQ% zaL+%1mZtEx)x_5}IDRc8>1x?)Xtz6EF&)!|_gr!MV{0k6&o-&cALJl!GlRyk--tCD9^pvjH#j|zmW+xHSp8+bykI{@~O z!cEH^;^(`<=i{rVPj)*_RZCa1Q2$adSR07yG|KBuXaeCOd#eNtQXN_1jecC&k_nNu zkoGj3lq&N+iO^C|mru2++O>u6_%^_(AC`Zt8mh7d_*J~>XgZFf5QMjFqkfB67*Y0) z75})3<~Rr670|GF=#q9e0T)po#oM&#Y`&s?($&X0t;r77E^!b3g;ykv-hVnCw2!*r zo_ZlR$*7ZCFdN$v&vDGVv}T?-LbTaFKfmc!d{=WwVb5Ka_fBZl*waoyqVjr!L`r{w zJ5+o{P15JVx~$Q^mt5`Z6Co9&wubpq7dPqANQ-24WOVUdP{BhHVW=UAuplDkg{H<} zY#-JffLvThC51RnS#*fo3ey&U!B<<>py|by%|w89-oU=8@%*!Sor~QV~TA7%FGc{+Zhp4H#kLT@2sG z!Wr7#WrU??O2M(@QP&9Hu;oy1v1+q1Td}3w_*)`FrCp*ha(3;L$u_e9O2>btE-WJ{ zqASSSswDSrq2ALNIzSqEyTscte5Q0Ts{fejU}*2j)5DPm4x>gv#}B5)&r$S3-*%6L z?0kWy^Co~bg^^=bbyR(r3CUPZJCZV0bYHtP{{P|z{JuH8D1ac;K*5*e3VZ{1IKA^JNlj0j9mkq5iS7~u60Tzo_ zuco2M*O3v$0(n)GcV*V(I!m$X>#?;+zu_Oqnyxb=Sm;0i7(D`*{Cio)o9U&{TRID| z=QkNT2NajteLM?K)=--$n+JgSwEq&bX|u3Y9OqKo_SJttyySnX>rqhAFFOJ-pb69P x8~%N=`FLM@cRXFE>vSKTuG4k8PS@!=U8n1Govzb$y8bt={{qBq?G6BV000fLX!-yE delta 2743 zcmV;o3P|yO(u67N_0uMm;~**zq?n`|DyrtRU--iP~e zKymHI0;(+0wz_(qNUhfwH3?; zyRP7R|Nbq0zW(s;%KU`u&AaRC>u+Aa`SAAY!}ZlWqr&PSvG3=(?{GssXPIX<{{Mo^~axss;rql�uS5zuHjSW`qR zJ$k*tfrWe-tfPz)n2BYcUG{~a^d%9=%OZaircfc;McwC1(H_!f^+%W{VZ4os4Z+r& zM^KtkQ=&B-B3qiSlH|c#XVNo5etFaw)_fDAih9|15kB_sjnC2_dYHpAyp3+w{jAe! ziQG7@5L|q2j#%Aw=Ag2(_$hA6^OCa;p~c-MFhq~?Hy>(0$KcA62)<06Je+l!dpv)< zEBg@P%xt#RFs}@Gzz>swH})CUw8H{FEhZ#z$lkqTj&z5~*!M5p{5G8h)5%AvY=ORc z)~B-g+fznyXvp?wR*S`;55M}Vrb`p&nKo&nVCADM5GE7uNAlQFI(C#~>l^TRqE(uu zY#)3I;%&Jrg4-0#*c!e8!kQA6CP9CGTa-yq5GK-r{2PRpy260psG}WVvNb?rHqF%= zSU#0rtw{#^Q-5{6N;3*tB^lGwjIyP7~q)fZ!x79vZ&E-#wn4Hh!@o^zy&c#_nOZ_8!l` z74s(?I6n>zKI_Bjse|9xzork}&pJW-ob2vXcptAZZ`EP&`P_b>O`aR2$)e5^3@!r{ zX*}0;nYV@%&EGT`^3A&YYpQUA7r04|B(^M z-RS@fRkm~h#43CEOx(&WoB69_hW373>cq6K2hb1Gcl4`=7>;RL#s;Gcyz;UsSXoSc ze!TDLOw*$=_6d6Ag>X+;HqSLC{Y&&mhQA$VMdN=hNd~Yn+B8j-OlV<+F+U23VwT>45+)|RBuemfvq^Z>y@V4j zv^S-tI-TWds+EzjJMT8pEy*&Q5hsaJB@ete@Uu?i5aM!Tp(r{E(H~&mY1(u>m2wU$ zCObW}e572ym=N_4sr2WTv1$lR(Zyw+R~fkvx%52@JcOP!eGULB|-_o=1wHFVbS9f-EQi#sruc@X5mNCeV(PotwkV@bEA$P z!~IUbolYq$YqYO*v>^b6HTjOIf@%8fE2*JwxzSl5%H)$aiE^ zDS*+$TkvMn8Cri^7=>%a(Q~>nNjel@iZFNsl8*nA(%4v1o}5en6WNJ%?u+UIoQ{A< z!%}Ir60(k(j0r#MzN0rLnb4aK$eyC+CDKz1MU}EC14+RRQM&FUIEt?7D(^aq=i;6i z>dL-tk-l()u0bKnjJibO;Ycfn2P<<}@XrU`2~G0n#`u5n_wsp=-N&Ma6OW5Vv#CiG zhgi%}rwPHWb(1FeQDJ@*J{$bGr!u38-&SSG_!roJ)mK@nh~D^Unp6VI4-_)*Pxj0A zz+TOx6BU*ppXd-Cew};_#5T+CchZsWe54{34@)4fp;VUtbWreQz1QlbGqb;5a_ zn9cn(kd%LID}P-Aayi#+{5VG3k2w7?mU+x19hTO(`JI}L@P+Qu3Lf8LUAo+!e>a4( zkiR3?IY~8$>{l4hPCX;dRfNg1e+(>v=sy=M=F=(tEIVDb^A^P;+xJ z9W|o`hJlF$YBh61)c|thYRK-mRbX{#!{Qrvh}eI>ot0(fXL2LTOaINW== z3`gctxqXNpnQK>fQ|fShoK%P0JyNmTQ1yOtA4;kcl6V^n_(w_H)Tt4oxDdJnw>%%Q z0r&h9XlV+6TTOgzgX7milCGA$hIYHt71J?Yc+VB5Kem>F`)o6PIsS)owhicIw(9z9 zJT8AkcT7hEY;O|i_KM~A_I;)2z|$QvZ`s-Y@dfM3O{j;7-%3PE_=HtM&Cg%M@% zSn-dmXpVF6T>%Y?hc0Pn6L1mbQM^ry&gLuXCtZE4)0*sH?GpFkUwB2*=>4bTLHno+ z?x`1IlZ-mK1+%d&@f^pzOKawdBSf3+^Yfct#dkG_6!zRzdGCZ)jXmuYBr2~rNTh!h zxI@KP)Fgc#tjikxd&$+lJ`qweYHOG;b#ap(jkHK+M@ARV1rypP- z3jW$+8~%9%JjV+RJ>S`hEkh#5kpTooW*%7{8BCv%EfrD3fT400?Vq_#(SQ*)-o@~3 zES#a;T}D`XrW71Y9(9fI4OnQSu)pmcv+>cTRT zBD#XCtx9t57V15Xp#!9mw@bVY!)Hndqxz4T4uvo<&K4f z!rhumv|+Gru-K6mBEru7&{>L2UyrRt`VId;)^wd2!9oWDz~~XcvWy2)Ahe`{TBemQC|Rf0001hbxi;O diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index 671a9491..097cf35c 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -25374,7 +25374,7 @@ index ff92430..36740ea 100644 ## ## Execute a generic bin program in the sysadm domain. diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te -index 2522ca6..fe03d6d 100644 +index 2522ca6..a23a472 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -5,39 +5,88 @@ policy_module(sysadm, 2.6.1) @@ -25807,7 +25807,7 @@ index 2522ca6..fe03d6d 100644 ') optional_policy(` -@@ -345,30 +490,37 @@ optional_policy(` +@@ -345,30 +490,38 @@ optional_policy(` ') optional_policy(` @@ -25820,6 +25820,7 @@ index 2522ca6..fe03d6d 100644 + systemd_login_reboot(sysadm_t) + systemd_login_halt(sysadm_t) + systemd_login_undefined(sysadm_t) ++ systemd_tmpfiles_run(sysadm_t, sysadm_r) ') optional_policy(` @@ -25854,7 +25855,7 @@ index 2522ca6..fe03d6d 100644 ') optional_policy(` -@@ -380,10 +532,6 @@ optional_policy(` +@@ -380,10 +533,6 @@ optional_policy(` ') optional_policy(` @@ -25865,7 +25866,7 @@ index 2522ca6..fe03d6d 100644 usermanage_run_admin_passwd(sysadm_t, sysadm_r) usermanage_run_groupadd(sysadm_t, sysadm_r) usermanage_run_useradd(sysadm_t, sysadm_r) -@@ -391,6 +539,9 @@ optional_policy(` +@@ -391,6 +540,9 @@ optional_policy(` optional_policy(` virt_stream_connect(sysadm_t) @@ -25875,7 +25876,7 @@ index 2522ca6..fe03d6d 100644 ') optional_policy(` -@@ -398,31 +549,34 @@ optional_policy(` +@@ -398,31 +550,34 @@ optional_policy(` ') optional_policy(` @@ -25916,7 +25917,7 @@ index 2522ca6..fe03d6d 100644 auth_role(sysadm_r, sysadm_t) ') -@@ -435,10 +589,6 @@ ifndef(`distro_redhat',` +@@ -435,10 +590,6 @@ ifndef(`distro_redhat',` ') optional_policy(` @@ -25927,7 +25928,7 @@ index 2522ca6..fe03d6d 100644 dbus_role_template(sysadm, sysadm_r, sysadm_t) optional_policy(` -@@ -459,15 +609,79 @@ ifndef(`distro_redhat',` +@@ -459,15 +610,79 @@ ifndef(`distro_redhat',` ') optional_policy(` @@ -35258,7 +35259,7 @@ index bc0ffc8..37b8ea5 100644 ') +/var/run/systemd(/.*)? gen_context(system_u:object_r:init_var_run_t,s0) diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if -index 79a45f6..e176b9f 100644 +index 79a45f6..9926eaf 100644 --- a/policy/modules/system/init.if +++ b/policy/modules/system/init.if @@ -1,5 +1,21 @@ @@ -36301,7 +36302,7 @@ index 79a45f6..e176b9f 100644 ') ######################################## -@@ -1806,37 +2294,672 @@ interface(`init_pid_filetrans_utmp',` +@@ -1806,37 +2294,690 @@ interface(`init_pid_filetrans_utmp',` files_pid_filetrans($1, initrc_var_run_t, file, "utmp") ') @@ -36729,6 +36730,24 @@ index 79a45f6..e176b9f 100644 + +######################################## +## ++## Start system from init ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`init_start',` ++ gen_require(` ++ type init_t; ++ ') ++ ++ allow $1 init_t:system start; ++') ++ ++######################################## ++## +## Tell init to reboot the system. +## +## @@ -46795,10 +46814,10 @@ index 0000000..8b77d7a +/var/run/initramfs(/.*)? <> diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if new file mode 100644 -index 0000000..513b97b +index 0000000..16cd1ac --- /dev/null +++ b/policy/modules/system/systemd.if -@@ -0,0 +1,1738 @@ +@@ -0,0 +1,1763 @@ +## SELinux policy for systemd components + +###################################### @@ -47405,6 +47424,31 @@ index 0000000..513b97b + +######################################## +## ++## Execute systemd-tmpfiles in the systemd_tmpfiles_t domain, and ++## allow the specified role the systemd_tmpfiles domain. ++## ++## ++## ++## Domain allowed access ++## ++## ++## ++## ++## The role to be allowed the systemd_tmpfiles domain. ++## ++## ++# ++interface(`systemd_tmpfiles_run',` ++ gen_require(` ++ type systemd_tmpfiles_t; ++ ') ++ ++ systemd_passwd_agent_domtrans($1) ++ role $2 types systemd_tmpfiles_t; ++') ++ ++######################################## ++## +## Role access for systemd_passwd_agent +## +## @@ -48539,10 +48583,10 @@ index 0000000..513b97b +') diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te new file mode 100644 -index 0000000..7877160 +index 0000000..180e701 --- /dev/null +++ b/policy/modules/system/systemd.te -@@ -0,0 +1,957 @@ +@@ -0,0 +1,958 @@ +policy_module(systemd, 1.0.0) + +####################################### @@ -48770,6 +48814,7 @@ index 0000000..7877160 +init_named_pid_filetrans(systemd_logind_t, systemd_logind_inhibit_var_run_t, dir, "inhibit") + +init_status(systemd_logind_t) ++init_start(systemd_logind_t) +init_signal(systemd_logind_t) +init_reboot(systemd_logind_t) +init_halt(systemd_logind_t) diff --git a/selinux-policy.spec b/selinux-policy.spec index 2a756761..7b0f931c 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -648,6 +648,12 @@ exit 0 %endif %changelog +* Wed Jul 13 2016 Lukas Vrabec 3.13.1-202 +- Allow systemd_logind_t to start init_t BZ(1355861) +- Add init_start() interface +- Allow sysadm user to run systemd-tmpfiles +- Add interface systemd_tmpfiles_run + * Mon Jul 11 2016 Lukas Vrabec 3.13.1-201 - Allow lttng tools to block suspending - Allow creation of vpnaas in openstack