rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Tue Aug 02 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-206 

- collectd: update policy for 5.5
- Allow puppet_t transtition to shorewall_t
- Grant certmonger "chown" capability
- Boinc updates from Russell Coker.
- Allow sshd setcap capability. This is needed due to latest changes in sshd.
- Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd"
- Revert "Fix typo in ssh policy"
- Get attributes of generic ptys, from Russell Coker.
This commit is contained in:
Lukas Vrabec 2016-08-02 10:30:29 +02:00
parent 247a84c954
commit 4d7576addc
4 changed files with 157 additions and 97 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
docker-selinux.tgz
View File

Binary file not shown.

103
policy-rawhide-base.patch
View File

@ -24184,7 +24184,7 @@ index 0ea25b6..37069ae 100644
+ +
+/usr/lib/udev/devices/pts -d gen_context(system_u:object_r:devpts_t,s0-mls_systemhigh) +/usr/lib/udev/devices/pts -d gen_context(system_u:object_r:devpts_t,s0-mls_systemhigh)
diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
index cbb729b..f118b2a 100644 index cbb729b..ce0291e 100644
--- a/policy/modules/kernel/terminal.if --- a/policy/modules/kernel/terminal.if
+++ b/policy/modules/kernel/terminal.if +++ b/policy/modules/kernel/terminal.if
@@ -124,7 +124,7 @@ interface(`term_user_tty',` @@ -124,7 +124,7 @@ interface(`term_user_tty',`
@ -24340,7 +24340,31 @@ index cbb729b..f118b2a 100644
## Do not audit attempts to read the ## Do not audit attempts to read the
## /dev/pts directory. ## /dev/pts directory.
## </summary> ## </summary>
@@ -620,7 +716,7 @@ interface(`term_use_generic_ptys',` @@ -519,6 +615,23 @@ interface(`term_dontaudit_manage_pty_dirs',`
########################################
## <summary>
+## Get the attributes of generic pty devices.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain to allow
+## </summary>
+## </param>
+#
+interface(`term_getattr_generic_ptys',`
+ gen_require(`
+ type devpts_t;
+ ')
+
+ allow $1 devpts_t:chr_file getattr;
+')
+########################################
+## <summary>
## Do not audit attempts to get the attributes
## of generic pty devices.
## </summary>
@@ -620,7 +733,7 @@ interface(`term_use_generic_ptys',`
######################################## ########################################
## <summary> ## <summary>
@ -24349,7 +24373,7 @@ index cbb729b..f118b2a 100644
## write the generic pty type. This is ## write the generic pty type. This is
## generally only used in the targeted policy. ## generally only used in the targeted policy.
## </summary> ## </summary>
@@ -635,6 +731,7 @@ interface(`term_dontaudit_use_generic_ptys',` @@ -635,6 +748,7 @@ interface(`term_dontaudit_use_generic_ptys',`
type devpts_t; type devpts_t;
') ')
@ -24357,7 +24381,7 @@ index cbb729b..f118b2a 100644
dontaudit $1 devpts_t:chr_file { getattr read write ioctl }; dontaudit $1 devpts_t:chr_file { getattr read write ioctl };
') ')
@@ -879,6 +976,26 @@ interface(`term_use_all_ptys',` @@ -879,6 +993,26 @@ interface(`term_use_all_ptys',`
######################################## ########################################
## <summary> ## <summary>
@ -24384,7 +24408,7 @@ index cbb729b..f118b2a 100644
## Do not audit attempts to read or write any ptys. ## Do not audit attempts to read or write any ptys.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -892,7 +1009,7 @@ interface(`term_dontaudit_use_all_ptys',` @@ -892,7 +1026,7 @@ interface(`term_dontaudit_use_all_ptys',`
attribute ptynode; attribute ptynode;
') ')
@ -24393,7 +24417,7 @@ index cbb729b..f118b2a 100644
') ')
######################################## ########################################
@@ -912,7 +1029,7 @@ interface(`term_relabel_all_ptys',` @@ -912,7 +1046,7 @@ interface(`term_relabel_all_ptys',`
') ')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
@ -24402,7 +24426,7 @@ index cbb729b..f118b2a 100644
') ')
######################################## ########################################
@@ -940,7 +1057,7 @@ interface(`term_getattr_all_user_ptys',` @@ -940,7 +1074,7 @@ interface(`term_getattr_all_user_ptys',`
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@ -24411,7 +24435,7 @@ index cbb729b..f118b2a 100644
## </summary> ## </summary>
## </param> ## </param>
# #
@@ -1067,6 +1184,28 @@ interface(`term_getattr_unallocated_ttys',` @@ -1067,6 +1201,28 @@ interface(`term_getattr_unallocated_ttys',`
######################################## ########################################
## <summary> ## <summary>
@ -24440,7 +24464,7 @@ index cbb729b..f118b2a 100644
## Do not audit attempts to get the attributes ## Do not audit attempts to get the attributes
## of all unallocated tty device nodes. ## of all unallocated tty device nodes.
## </summary> ## </summary>
@@ -1165,6 +1304,25 @@ interface(`term_relabel_unallocated_ttys',` @@ -1165,6 +1321,25 @@ interface(`term_relabel_unallocated_ttys',`
######################################## ########################################
## <summary> ## <summary>
@ -24466,7 +24490,7 @@ index cbb729b..f118b2a 100644
## Relabel from all user tty types to ## Relabel from all user tty types to
## the unallocated tty type. ## the unallocated tty type.
## </summary> ## </summary>
@@ -1259,7 +1417,47 @@ interface(`term_dontaudit_use_unallocated_ttys',` @@ -1259,7 +1434,47 @@ interface(`term_dontaudit_use_unallocated_ttys',`
type tty_device_t; type tty_device_t;
') ')
@ -24515,7 +24539,7 @@ index cbb729b..f118b2a 100644
') ')
######################################## ########################################
@@ -1275,11 +1473,13 @@ interface(`term_dontaudit_use_unallocated_ttys',` @@ -1275,11 +1490,13 @@ interface(`term_dontaudit_use_unallocated_ttys',`
# #
interface(`term_getattr_all_ttys',` interface(`term_getattr_all_ttys',`
gen_require(` gen_require(`
@ -24529,7 +24553,7 @@ index cbb729b..f118b2a 100644
') ')
######################################## ########################################
@@ -1296,10 +1496,12 @@ interface(`term_getattr_all_ttys',` @@ -1296,10 +1513,12 @@ interface(`term_getattr_all_ttys',`
interface(`term_dontaudit_getattr_all_ttys',` interface(`term_dontaudit_getattr_all_ttys',`
gen_require(` gen_require(`
attribute ttynode; attribute ttynode;
@ -24542,7 +24566,7 @@ index cbb729b..f118b2a 100644
') ')
######################################## ########################################
@@ -1377,7 +1579,27 @@ interface(`term_use_all_ttys',` @@ -1377,7 +1596,27 @@ interface(`term_use_all_ttys',`
') ')
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
@ -24571,7 +24595,7 @@ index cbb729b..f118b2a 100644
') ')
######################################## ########################################
@@ -1396,7 +1618,7 @@ interface(`term_dontaudit_use_all_ttys',` @@ -1396,7 +1635,7 @@ interface(`term_dontaudit_use_all_ttys',`
attribute ttynode; attribute ttynode;
') ')
@ -24580,7 +24604,7 @@ index cbb729b..f118b2a 100644
') ')
######################################## ########################################
@@ -1504,7 +1726,7 @@ interface(`term_use_all_user_ttys',` @@ -1504,7 +1743,7 @@ interface(`term_use_all_user_ttys',`
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@ -24589,7 +24613,7 @@ index cbb729b..f118b2a 100644
## </summary> ## </summary>
## </param> ## </param>
# #
@@ -1513,21 +1735,435 @@ interface(`term_dontaudit_use_all_user_ttys',` @@ -1513,21 +1752,435 @@ interface(`term_dontaudit_use_all_user_ttys',`
term_dontaudit_use_all_ttys($1) term_dontaudit_use_all_ttys($1)
') ')
@ -28261,7 +28285,7 @@ index 76d9f66..7528851 100644
+/root/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0) +/root/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+/root/\.shosts gen_context(system_u:object_r:ssh_home_t,s0) +/root/\.shosts gen_context(system_u:object_r:ssh_home_t,s0)
diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index fe0c682..60003bc 100644 index fe0c682..0ac21a6 100644
--- a/policy/modules/services/ssh.if --- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if +++ b/policy/modules/services/ssh.if
@@ -32,10 +32,11 @@ @@ -32,10 +32,11 @@
@ -28383,16 +28407,15 @@ index fe0c682..60003bc 100644
type $1_t, ssh_server; type $1_t, ssh_server;
auth_login_pgm_domain($1_t) auth_login_pgm_domain($1_t)
@@ -181,20 +205,23 @@ template(`ssh_server_template', ` @@ -181,20 +205,22 @@ template(`ssh_server_template', `
type $1_var_run_t; type $1_var_run_t;
files_pid_file($1_var_run_t) files_pid_file($1_var_run_t)
- allow $1_t self:capability { kill sys_chroot sys_nice sys_resource chown dac_override fowner fsetid setgid setuid sys_tty_config }; - allow $1_t self:capability { kill sys_chroot sys_nice sys_resource chown dac_override fowner fsetid setgid setuid sys_tty_config };
+ allow $1_t self:capability { kill sys_admin sys_chroot sys_nice sys_resource chown dac_override fowner fsetid net_admin setgid setuid sys_tty_config }; + allow $1_t self:capability { setpcap kill sys_admin sys_chroot sys_nice sys_resource chown dac_override fowner fsetid net_admin setgid setuid sys_tty_config };
allow $1_t self:fifo_file rw_fifo_file_perms; allow $1_t self:fifo_file rw_fifo_file_perms;
- allow $1_t self:process { signal getsched setsched setrlimit setexec setkeycreate }; - allow $1_t self:process { signal getsched setsched setrlimit setexec setkeycreate };
+ allow $1_t self:process { getcap signal getsched setsched setrlimit setexec }; + allow $1_t self:process { setcap getcap signal getsched setsched setrlimit setexec };
+ allow $1_t self:process { signal getcap getsched setsched setrlimit setexec };
allow $1_t self:tcp_socket create_stream_socket_perms; allow $1_t self:tcp_socket create_stream_socket_perms;
allow $1_t self:udp_socket create_socket_perms; allow $1_t self:udp_socket create_socket_perms;
+ allow $1_t self:tun_socket { create_socket_perms relabelfrom relabelto }; + allow $1_t self:tun_socket { create_socket_perms relabelfrom relabelto };
@ -28412,7 +28435,7 @@ index fe0c682..60003bc 100644
allow $1_t $1_var_run_t:file manage_file_perms; allow $1_t $1_var_run_t:file manage_file_perms;
files_pid_filetrans($1_t, $1_var_run_t, file) files_pid_filetrans($1_t, $1_var_run_t, file)
@@ -206,6 +233,7 @@ template(`ssh_server_template', ` @@ -206,6 +232,7 @@ template(`ssh_server_template', `
kernel_read_kernel_sysctls($1_t) kernel_read_kernel_sysctls($1_t)
kernel_read_network_state($1_t) kernel_read_network_state($1_t)
@ -28420,7 +28443,7 @@ index fe0c682..60003bc 100644
corenet_all_recvfrom_unlabeled($1_t) corenet_all_recvfrom_unlabeled($1_t)
corenet_all_recvfrom_netlabel($1_t) corenet_all_recvfrom_netlabel($1_t)
@@ -220,10 +248,13 @@ template(`ssh_server_template', ` @@ -220,10 +247,13 @@ template(`ssh_server_template', `
corenet_tcp_bind_generic_node($1_t) corenet_tcp_bind_generic_node($1_t)
corenet_udp_bind_generic_node($1_t) corenet_udp_bind_generic_node($1_t)
corenet_tcp_bind_ssh_port($1_t) corenet_tcp_bind_ssh_port($1_t)
@ -28436,7 +28459,7 @@ index fe0c682..60003bc 100644
auth_rw_login_records($1_t) auth_rw_login_records($1_t)
auth_rw_faillog($1_t) auth_rw_faillog($1_t)
@@ -234,6 +265,7 @@ template(`ssh_server_template', ` @@ -234,6 +264,7 @@ template(`ssh_server_template', `
corecmd_getattr_bin_files($1_t) corecmd_getattr_bin_files($1_t)
domain_interactive_fd($1_t) domain_interactive_fd($1_t)
@ -28444,7 +28467,7 @@ index fe0c682..60003bc 100644
files_read_etc_files($1_t) files_read_etc_files($1_t)
files_read_etc_runtime_files($1_t) files_read_etc_runtime_files($1_t)
@@ -241,35 +273,33 @@ template(`ssh_server_template', ` @@ -241,35 +272,33 @@ template(`ssh_server_template', `
logging_search_logs($1_t) logging_search_logs($1_t)
@ -28491,7 +28514,7 @@ index fe0c682..60003bc 100644
') ')
######################################## ########################################
@@ -292,14 +322,15 @@ template(`ssh_server_template', ` @@ -292,14 +321,15 @@ template(`ssh_server_template', `
## User domain for the role ## User domain for the role
## </summary> ## </summary>
## </param> ## </param>
@ -28508,7 +28531,7 @@ index fe0c682..60003bc 100644
') ')
############################## ##############################
@@ -328,103 +359,56 @@ template(`ssh_role_template',` @@ -328,103 +358,56 @@ template(`ssh_role_template',`
# allow ps to show ssh # allow ps to show ssh
ps_process_pattern($3, ssh_t) ps_process_pattern($3, ssh_t)
@ -28622,7 +28645,7 @@ index fe0c682..60003bc 100644
') ')
######################################## ########################################
@@ -496,8 +480,27 @@ interface(`ssh_read_pipes',` @@ -496,8 +479,27 @@ interface(`ssh_read_pipes',`
type sshd_t; type sshd_t;
') ')
@ -28651,7 +28674,7 @@ index fe0c682..60003bc 100644
######################################## ########################################
## <summary> ## <summary>
## Read and write a ssh server unnamed pipe. ## Read and write a ssh server unnamed pipe.
@@ -513,7 +516,7 @@ interface(`ssh_rw_pipes',` @@ -513,7 +515,7 @@ interface(`ssh_rw_pipes',`
type sshd_t; type sshd_t;
') ')
@ -28660,7 +28683,7 @@ index fe0c682..60003bc 100644
') ')
######################################## ########################################
@@ -605,6 +608,24 @@ interface(`ssh_domtrans',` @@ -605,6 +607,24 @@ interface(`ssh_domtrans',`
######################################## ########################################
## <summary> ## <summary>
@ -28685,7 +28708,7 @@ index fe0c682..60003bc 100644
## Execute the ssh client in the caller domain. ## Execute the ssh client in the caller domain.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -637,7 +658,7 @@ interface(`ssh_setattr_key_files',` @@ -637,7 +657,7 @@ interface(`ssh_setattr_key_files',`
type sshd_key_t; type sshd_key_t;
') ')
@ -28694,7 +28717,7 @@ index fe0c682..60003bc 100644
files_search_pids($1) files_search_pids($1)
') ')
@@ -662,6 +683,42 @@ interface(`ssh_agent_exec',` @@ -662,6 +682,42 @@ interface(`ssh_agent_exec',`
######################################## ########################################
## <summary> ## <summary>
@ -28737,7 +28760,7 @@ index fe0c682..60003bc 100644
## Read ssh home directory content ## Read ssh home directory content
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -701,6 +758,68 @@ interface(`ssh_domtrans_keygen',` @@ -701,6 +757,68 @@ interface(`ssh_domtrans_keygen',`
######################################## ########################################
## <summary> ## <summary>
@ -28806,7 +28829,7 @@ index fe0c682..60003bc 100644
## Read ssh server keys ## Read ssh server keys
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -714,7 +833,26 @@ interface(`ssh_dontaudit_read_server_keys',` @@ -714,7 +832,26 @@ interface(`ssh_dontaudit_read_server_keys',`
type sshd_key_t; type sshd_key_t;
') ')
@ -28834,7 +28857,7 @@ index fe0c682..60003bc 100644
') ')
###################################### ######################################
@@ -754,3 +892,151 @@ interface(`ssh_delete_tmp',` @@ -754,3 +891,151 @@ interface(`ssh_delete_tmp',`
files_search_tmp($1) files_search_tmp($1)
delete_files_pattern($1, sshd_tmp_t, sshd_tmp_t) delete_files_pattern($1, sshd_tmp_t, sshd_tmp_t)
') ')
@ -28987,7 +29010,7 @@ index fe0c682..60003bc 100644
+ ps_process_pattern($1, sshd_t) + ps_process_pattern($1, sshd_t)
+') +')
diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te
index cc877c7..4d56aea 100644 index cc877c7..b8e6e98 100644
--- a/policy/modules/services/ssh.te --- a/policy/modules/services/ssh.te
+++ b/policy/modules/services/ssh.te +++ b/policy/modules/services/ssh.te
@@ -6,43 +6,69 @@ policy_module(ssh, 2.4.2) @@ -6,43 +6,69 @@ policy_module(ssh, 2.4.2)
@ -29074,7 +29097,7 @@ index cc877c7..4d56aea 100644
type ssh_t; type ssh_t;
type ssh_exec_t; type ssh_exec_t;
@@ -67,25 +93,28 @@ userdom_user_application_domain(ssh_keysign_t, ssh_keysign_exec_t) @@ -67,15 +93,17 @@ userdom_user_application_domain(ssh_keysign_t, ssh_keysign_exec_t)
type ssh_tmpfs_t; type ssh_tmpfs_t;
typealias ssh_tmpfs_t alias { user_ssh_tmpfs_t staff_ssh_tmpfs_t sysadm_ssh_tmpfs_t }; typealias ssh_tmpfs_t alias { user_ssh_tmpfs_t staff_ssh_tmpfs_t sysadm_ssh_tmpfs_t };
typealias ssh_tmpfs_t alias { auditadm_ssh_tmpfs_t secadm_ssh_tmpfs_t }; typealias ssh_tmpfs_t alias { auditadm_ssh_tmpfs_t secadm_ssh_tmpfs_t };
@ -29095,11 +29118,7 @@ index cc877c7..4d56aea 100644
############################## ##############################
# #
# SSH client local policy @@ -86,6 +114,7 @@ allow ssh_t self:capability { setuid setgid dac_override dac_read_search };
#
-allow ssh_t self:capability { setuid setgid dac_override dac_read_search };
+allow ssh_t self:capability { setpcap setuid setgid dac_override dac_read_search };
allow ssh_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow ssh_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow ssh_t self:fd use; allow ssh_t self:fd use;
allow ssh_t self:fifo_file rw_fifo_file_perms; allow ssh_t self:fifo_file rw_fifo_file_perms;

139
policy-rawhide-contrib.patch
View File

@ -10560,28 +10560,31 @@ index 851769e..3dc3f36 100644
term_dontaudit_use_all_ttys(bluetooth_helper_t) term_dontaudit_use_all_ttys(bluetooth_helper_t)
diff --git a/boinc.fc b/boinc.fc diff --git a/boinc.fc b/boinc.fc
index 6d3ccad..bda740a 100644 index 6d3ccad..9c69f28 100644
--- a/boinc.fc --- a/boinc.fc
+++ b/boinc.fc +++ b/boinc.fc
@@ -1,9 +1,12 @@ @@ -1,9 +1,15 @@
-/etc/rc\.d/init\.d/boinc-client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0) -/etc/rc\.d/init\.d/boinc-client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0)
+/etc/boinc-client/global_prefs_override.xml -- gen_context(system_u:object_r:boinc_var_lib_t,s0)
+/etc/rc\.d/init\.d/boinc-client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0)
-/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0) -/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0)
+/etc/rc\.d/init\.d/boinc-client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0) +/usr/bin/boinc -- gen_context(system_u:object_r:boinc_exec_t,s0)
+/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0)
-/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0) -/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0)
-/var/lib/boinc/projects(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0) -/var/lib/boinc/projects(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
-/var/lib/boinc/slots(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0) -/var/lib/boinc/slots(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
+/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0) +/usr/lib/systemd/system/boinc-client\.service -- gen_context(system_u:object_r:boinc_unit_file_t,s0)
-/var/log/boinc\.log.* -- gen_context(system_u:object_r:boinc_log_t,s0) -/var/log/boinc\.log.* -- gen_context(system_u:object_r:boinc_log_t,s0)
+/usr/lib/systemd/system/boinc-client\.service -- gen_context(system_u:object_r:boinc_unit_file_t,s0)
+
+/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0) +/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0)
+/var/lib/boinc-client(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0)
+/var/lib/boinc/projects(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0) +/var/lib/boinc/projects(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
+/var/lib/boinc/slots(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0) +/var/lib/boinc/slots(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
+ +
+/var/log/boinc\.log.* -- gen_context(system_u:object_r:boinc_log_t,s0) +/var/log/boinc\.log.* -- gen_context(system_u:object_r:boinc_log_t,s0)
+/var/log/boincerr\.log.* -- gen_context(system_u:object_r:boinc_log_t,s0)
diff --git a/boinc.if b/boinc.if diff --git a/boinc.if b/boinc.if
index 02fefaa..308616e 100644 index 02fefaa..308616e 100644
--- a/boinc.if --- a/boinc.if
@ -10803,9 +10806,15 @@ index 02fefaa..308616e 100644
+ ') + ')
') ')
diff --git a/boinc.te b/boinc.te diff --git a/boinc.te b/boinc.te
index 687d4c4..f668033 100644 index 687d4c4..bce6267 100644
--- a/boinc.te --- a/boinc.te
+++ b/boinc.te +++ b/boinc.te
@@ -1,4 +1,4 @@
-policy_module(boinc, 1.1.1)
+policy_module(boinc, 1.3.1)
########################################
#
@@ -12,7 +12,9 @@ policy_module(boinc, 1.1.1) @@ -12,7 +12,9 @@ policy_module(boinc, 1.1.1)
## </desc> ## </desc>
gen_tunable(boinc_execmem, true) gen_tunable(boinc_execmem, true)
@ -10817,7 +10826,7 @@ index 687d4c4..f668033 100644
type boinc_exec_t; type boinc_exec_t;
init_daemon_domain(boinc_t, boinc_exec_t) init_daemon_domain(boinc_t, boinc_exec_t)
@@ -28,31 +30,69 @@ files_tmpfs_file(boinc_tmpfs_t) @@ -28,31 +30,71 @@ files_tmpfs_file(boinc_tmpfs_t)
type boinc_var_lib_t; type boinc_var_lib_t;
files_type(boinc_var_lib_t) files_type(boinc_var_lib_t)
@ -10893,10 +10902,12 @@ index 687d4c4..f668033 100644
allow boinc_t self:shm create_shm_perms; allow boinc_t self:shm create_shm_perms;
-allow boinc_t self:fifo_file rw_fifo_file_perms; -allow boinc_t self:fifo_file rw_fifo_file_perms;
-allow boinc_t self:sem create_sem_perms; -allow boinc_t self:sem create_sem_perms;
+
+can_exec(boinc_t, boinc_exec_t)
manage_dirs_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t) manage_dirs_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t)
manage_files_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t) manage_files_pattern(boinc_t, boinc_tmp_t, boinc_tmp_t)
@@ -61,74 +101,49 @@ files_tmp_filetrans(boinc_t, boinc_tmp_t, { dir file }) @@ -61,84 +103,62 @@ files_tmp_filetrans(boinc_t, boinc_tmp_t, { dir file })
manage_files_pattern(boinc_t, boinc_tmpfs_t, boinc_tmpfs_t) manage_files_pattern(boinc_t, boinc_tmpfs_t, boinc_tmpfs_t)
fs_tmpfs_filetrans(boinc_t, boinc_tmpfs_t, file) fs_tmpfs_filetrans(boinc_t, boinc_tmpfs_t, file)
@ -10918,11 +10929,11 @@ index 687d4c4..f668033 100644
-create_files_pattern(boinc_t, boinc_log_t, boinc_log_t) -create_files_pattern(boinc_t, boinc_log_t, boinc_log_t)
-setattr_files_pattern(boinc_t, boinc_log_t, boinc_log_t) -setattr_files_pattern(boinc_t, boinc_log_t, boinc_log_t)
-logging_log_filetrans(boinc_t, boinc_log_t, file) -logging_log_filetrans(boinc_t, boinc_log_t, file)
-
-can_exec(boinc_t, boinc_var_lib_t)
+manage_dirs_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t) +manage_dirs_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+manage_files_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t) +manage_files_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
-can_exec(boinc_t, boinc_var_lib_t)
-
-domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t) -domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t)
+manage_files_pattern(boinc_t, boinc_log_t, boinc_log_t) +manage_files_pattern(boinc_t, boinc_log_t, boinc_log_t)
+logging_log_filetrans(boinc_t, boinc_log_t, { file }) +logging_log_filetrans(boinc_t, boinc_log_t, { file })
@ -10994,8 +11005,11 @@ index 687d4c4..f668033 100644
term_getattr_all_ptys(boinc_t) term_getattr_all_ptys(boinc_t)
term_getattr_unallocated_ttys(boinc_t) term_getattr_unallocated_ttys(boinc_t)
@@ -137,8 +152,9 @@ init_read_utmp(boinc_t)
init_read_utmp(boinc_t)
+libs_exec_lib_files(boinc_t)
+
logging_send_syslog_msg(boinc_t) logging_send_syslog_msg(boinc_t)
-miscfiles_read_fonts(boinc_t) -miscfiles_read_fonts(boinc_t)
@ -11006,7 +11020,7 @@ index 687d4c4..f668033 100644
tunable_policy(`boinc_execmem',` tunable_policy(`boinc_execmem',`
allow boinc_t self:process { execstack execmem }; allow boinc_t self:process { execstack execmem };
@@ -148,48 +164,61 @@ optional_policy(` @@ -148,48 +168,69 @@ optional_policy(`
mta_send_mail(boinc_t) mta_send_mail(boinc_t)
') ')
@ -11067,9 +11081,17 @@ index 687d4c4..f668033 100644
-corenet_sendrecv_boinc_client_packets(boinc_project_t) -corenet_sendrecv_boinc_client_packets(boinc_project_t)
corenet_tcp_connect_boinc_port(boinc_project_t) corenet_tcp_connect_boinc_port(boinc_project_t)
-corenet_tcp_sendrecv_boinc_port(boinc_project_t) -corenet_tcp_sendrecv_boinc_port(boinc_project_t)
+
+dev_getattr_input_dev(boinc_t)
+dev_getattr_mouse_dev(boinc_t)
files_dontaudit_search_home(boinc_project_t) files_dontaudit_search_home(boinc_project_t)
+term_getattr_ptmx(boinc_t)
+term_getattr_generic_ptys(boinc_t)
+
+userdom_getattr_user_ttys(boinc_t)
+
+# needed by java +# needed by java
+fs_read_hugetlbfs_files(boinc_project_t) +fs_read_hugetlbfs_files(boinc_project_t)
+ +
@ -12256,10 +12278,10 @@ index 008f8ef..144c074 100644
admin_pattern($1, certmonger_var_run_t) admin_pattern($1, certmonger_var_run_t)
') ')
diff --git a/certmonger.te b/certmonger.te diff --git a/certmonger.te b/certmonger.te
index 550b287..f37b9b0 100644 index 550b287..b824421 100644
--- a/certmonger.te --- a/certmonger.te
+++ b/certmonger.te +++ b/certmonger.te
@@ -18,6 +18,9 @@ files_type(certmonger_var_lib_t) @@ -18,18 +18,23 @@ files_type(certmonger_var_lib_t)
type certmonger_var_run_t; type certmonger_var_run_t;
files_pid_file(certmonger_var_run_t) files_pid_file(certmonger_var_run_t)
@ -12269,8 +12291,10 @@ index 550b287..f37b9b0 100644
######################################## ########################################
# #
# Local policy # Local policy
@@ -26,10 +29,12 @@ files_pid_file(certmonger_var_run_t) #
allow certmonger_t self:capability { dac_override dac_read_search setgid setuid kill sys_nice };
-allow certmonger_t self:capability { dac_override dac_read_search setgid setuid kill sys_nice };
+allow certmonger_t self:capability { chown dac_override dac_read_search setgid setuid kill sys_nice };
dontaudit certmonger_t self:capability sys_tty_config; dontaudit certmonger_t self:capability sys_tty_config;
allow certmonger_t self:capability2 block_suspend; allow certmonger_t self:capability2 block_suspend;
+ +
@ -15268,10 +15292,10 @@ index 0000000..77cdd5e
+ unconfined_domtrans(cockpit_session_t) + unconfined_domtrans(cockpit_session_t)
+') +')
diff --git a/collectd.fc b/collectd.fc diff --git a/collectd.fc b/collectd.fc
index 79a3abe..3237fb0 100644 index 79a3abe..3ee73d1 100644
--- a/collectd.fc --- a/collectd.fc
+++ b/collectd.fc +++ b/collectd.fc
@@ -1,9 +1,12 @@ @@ -1,9 +1,13 @@
/etc/rc\.d/init\.d/collectd -- gen_context(system_u:object_r:collectd_initrc_exec_t,s0) /etc/rc\.d/init\.d/collectd -- gen_context(system_u:object_r:collectd_initrc_exec_t,s0)
+/usr/lib/systemd/system/collectd.* -- gen_context(system_u:object_r:collectd_unit_file_t,s0) +/usr/lib/systemd/system/collectd.* -- gen_context(system_u:object_r:collectd_unit_file_t,s0)
@ -15281,6 +15305,7 @@ index 79a3abe..3237fb0 100644
/var/lib/collectd(/.*)? gen_context(system_u:object_r:collectd_var_lib_t,s0) /var/lib/collectd(/.*)? gen_context(system_u:object_r:collectd_var_lib_t,s0)
/var/run/collectd\.pid -- gen_context(system_u:object_r:collectd_var_run_t,s0) /var/run/collectd\.pid -- gen_context(system_u:object_r:collectd_var_run_t,s0)
+/var/run/collectd(/.*)? gen_context(system_u:object_r:collectd_var_run_t,s0)
+/var/run/collectd-unixsock -s gen_context(system_u:object_r:collectd_var_run_t,s0) +/var/run/collectd-unixsock -s gen_context(system_u:object_r:collectd_var_run_t,s0)
-/usr/share/collectd/collection3/bin/.*\.cgi -- gen_context(system_u:object_r:httpd_collectd_script_exec_t,s0) -/usr/share/collectd/collection3/bin/.*\.cgi -- gen_context(system_u:object_r:httpd_collectd_script_exec_t,s0)
@ -15469,10 +15494,10 @@ index 954309e..6780142 100644
') ')
+ +
diff --git a/collectd.te b/collectd.te diff --git a/collectd.te b/collectd.te
index 6471fa8..de0fd11 100644 index 6471fa8..b82bae6 100644
--- a/collectd.te --- a/collectd.te
+++ b/collectd.te +++ b/collectd.te
@@ -26,43 +26,59 @@ files_type(collectd_var_lib_t) @@ -26,43 +26,61 @@ files_type(collectd_var_lib_t)
type collectd_var_run_t; type collectd_var_run_t;
files_pid_file(collectd_var_run_t) files_pid_file(collectd_var_run_t)
@ -15495,6 +15520,7 @@ index 6471fa8..de0fd11 100644
allow collectd_t self:process { getsched setsched signal }; allow collectd_t self:process { getsched setsched signal };
allow collectd_t self:fifo_file rw_fifo_file_perms; allow collectd_t self:fifo_file rw_fifo_file_perms;
allow collectd_t self:packet_socket create_socket_perms; allow collectd_t self:packet_socket create_socket_perms;
+allow collectd_t self:rawip_socket create_socket_perms;
allow collectd_t self:unix_stream_socket { accept listen }; allow collectd_t self:unix_stream_socket { accept listen };
+allow collectd_t self:netlink_tcpdiag_socket create_netlink_socket_perms; +allow collectd_t self:netlink_tcpdiag_socket create_netlink_socket_perms;
+allow collectd_t self:udp_socket create_socket_perms; +allow collectd_t self:udp_socket create_socket_perms;
@ -15506,8 +15532,9 @@ index 6471fa8..de0fd11 100644
manage_files_pattern(collectd_t, collectd_var_run_t, collectd_var_run_t) manage_files_pattern(collectd_t, collectd_var_run_t, collectd_var_run_t)
-files_pid_filetrans(collectd_t, collectd_var_run_t, file) -files_pid_filetrans(collectd_t, collectd_var_run_t, file)
+manage_dirs_pattern(collectd_t, collectd_var_run_t, collectd_var_run_t)
+manage_sock_files_pattern(collectd_t, collectd_var_run_t, collectd_var_run_t) +manage_sock_files_pattern(collectd_t, collectd_var_run_t, collectd_var_run_t)
+files_pid_filetrans(collectd_t, collectd_var_run_t, { file sock_file }) +files_pid_filetrans(collectd_t, collectd_var_run_t, { dir file sock_file})
-domain_use_interactive_fds(collectd_t) -domain_use_interactive_fds(collectd_t)
+kernel_read_all_sysctls(collectd_t) +kernel_read_all_sysctls(collectd_t)
@ -15541,7 +15568,7 @@ index 6471fa8..de0fd11 100644
logging_send_syslog_msg(collectd_t) logging_send_syslog_msg(collectd_t)
@@ -74,17 +90,45 @@ tunable_policy(`collectd_tcp_network_connect',` @@ -74,17 +92,45 @@ tunable_policy(`collectd_tcp_network_connect',`
corenet_tcp_sendrecv_all_ports(collectd_t) corenet_tcp_sendrecv_all_ports(collectd_t)
') ')
@ -79180,7 +79207,7 @@ index 7cb8b1f..bef7217 100644
+ allow $1 puppet_var_run_t:dir search_dir_perms; + allow $1 puppet_var_run_t:dir search_dir_perms;
') ')
diff --git a/puppet.te b/puppet.te diff --git a/puppet.te b/puppet.te
index 618dcfe..67d166c 100644 index 618dcfe..8e08251 100644
--- a/puppet.te --- a/puppet.te
+++ b/puppet.te +++ b/puppet.te
@@ -6,25 +6,32 @@ policy_module(puppet, 1.4.0) @@ -6,25 +6,32 @@ policy_module(puppet, 1.4.0)
@ -79242,7 +79269,7 @@ index 618dcfe..67d166c 100644
type puppetmaster_t; type puppetmaster_t;
type puppetmaster_exec_t; type puppetmaster_exec_t;
@@ -56,161 +62,166 @@ files_tmp_file(puppetmaster_tmp_t) @@ -56,161 +62,170 @@ files_tmp_file(puppetmaster_tmp_t)
######################################## ########################################
# #
@ -79441,71 +79468,75 @@ index 618dcfe..67d166c 100644
+ +
+optional_policy(` +optional_policy(`
+ mysql_stream_connect(puppetagent_t) + mysql_stream_connect(puppetagent_t)
+')
+
+optional_policy(`
+ postgresql_stream_connect(puppetagent_t)
+')
+
+optional_policy(`
+ cfengine_read_lib_files(puppetagent_t)
') ')
optional_policy(` optional_policy(`
- cfengine_read_lib_files(puppet_t) - cfengine_read_lib_files(puppet_t)
+ consoletype_exec(puppetagent_t) + postgresql_stream_connect(puppetagent_t)
') ')
optional_policy(` optional_policy(`
- consoletype_exec(puppet_t) - consoletype_exec(puppet_t)
+ hostname_exec(puppetagent_t) + cfengine_read_lib_files(puppetagent_t)
') ')
optional_policy(` optional_policy(`
- hostname_exec(puppet_t) - hostname_exec(puppet_t)
+ mount_domtrans(puppetagent_t) + consoletype_exec(puppetagent_t)
') ')
optional_policy(` optional_policy(`
- mount_domtrans(puppet_t) - mount_domtrans(puppet_t)
+ mta_send_mail(puppetagent_t) + hostname_exec(puppetagent_t)
') ')
optional_policy(` optional_policy(`
- mta_send_mail(puppet_t) - mta_send_mail(puppet_t)
+ firewalld_dbus_chat(puppetagent_t) + mount_domtrans(puppetagent_t)
') ')
optional_policy(` optional_policy(`
- portage_domtrans(puppet_t) - portage_domtrans(puppet_t)
- portage_domtrans_fetch(puppet_t) - portage_domtrans_fetch(puppet_t)
- portage_domtrans_gcc_config(puppet_t) - portage_domtrans_gcc_config(puppet_t)
+ mta_send_mail(puppetagent_t)
')
optional_policy(`
- files_rw_var_files(puppet_t)
+ firewalld_dbus_chat(puppetagent_t)
+')
- rpm_domtrans(puppet_t)
- rpm_manage_db(puppet_t)
- rpm_manage_log(puppet_t)
+optional_policy(`
+ portage_domtrans(puppetagent_t) + portage_domtrans(puppetagent_t)
+ portage_domtrans_fetch(puppetagent_t) + portage_domtrans_fetch(puppetagent_t)
+ portage_domtrans_gcc_config(puppetagent_t) + portage_domtrans_gcc_config(puppetagent_t)
') ')
optional_policy(` optional_policy(`
- files_rw_var_files(puppet_t) - unconfined_domain(puppet_t)
+ files_rw_var_files(puppetagent_t) + files_rw_var_files(puppetagent_t)
+
- rpm_domtrans(puppet_t)
- rpm_manage_db(puppet_t)
- rpm_manage_log(puppet_t)
+ rpm_domtrans(puppetagent_t) + rpm_domtrans(puppetagent_t)
+ rpm_manage_db(puppetagent_t) + rpm_manage_db(puppetagent_t)
+ rpm_manage_log(puppetagent_t) + rpm_manage_log(puppetagent_t)
') ')
optional_policy(`
- unconfined_domain(puppet_t)
+ shorewall_domtrans(puppetagent_t)
')
optional_policy(` optional_policy(`
- usermanage_domtrans_groupadd(puppet_t) - usermanage_domtrans_groupadd(puppet_t)
- usermanage_domtrans_useradd(puppet_t) - usermanage_domtrans_useradd(puppet_t)
+ shorewall_domtrans(puppetagent_t)
+')
+
+optional_policy(`
+ unconfined_domain_noaudit(puppetagent_t) + unconfined_domain_noaudit(puppetagent_t)
+')
+
+optional_policy(`
+ shorewall_domtrans(puppet_t)
') ')
######################################## ########################################
@ -79525,7 +79556,7 @@ index 618dcfe..67d166c 100644
allow puppetca_t puppet_var_lib_t:dir list_dir_perms; allow puppetca_t puppet_var_lib_t:dir list_dir_perms;
manage_files_pattern(puppetca_t, puppet_var_lib_t, puppet_var_lib_t) manage_files_pattern(puppetca_t, puppet_var_lib_t, puppet_var_lib_t)
@@ -221,6 +232,7 @@ allow puppetca_t puppet_log_t:dir search_dir_perms; @@ -221,6 +236,7 @@ allow puppetca_t puppet_log_t:dir search_dir_perms;
allow puppetca_t puppet_var_run_t:dir search_dir_perms; allow puppetca_t puppet_var_run_t:dir search_dir_perms;
kernel_read_system_state(puppetca_t) kernel_read_system_state(puppetca_t)
@ -79533,7 +79564,7 @@ index 618dcfe..67d166c 100644
kernel_read_kernel_sysctls(puppetca_t) kernel_read_kernel_sysctls(puppetca_t)
corecmd_exec_bin(puppetca_t) corecmd_exec_bin(puppetca_t)
@@ -229,15 +241,12 @@ corecmd_exec_shell(puppetca_t) @@ -229,15 +245,12 @@ corecmd_exec_shell(puppetca_t)
dev_read_urand(puppetca_t) dev_read_urand(puppetca_t)
dev_search_sysfs(puppetca_t) dev_search_sysfs(puppetca_t)
@ -79549,7 +79580,7 @@ index 618dcfe..67d166c 100644
miscfiles_read_generic_certs(puppetca_t) miscfiles_read_generic_certs(puppetca_t)
seutil_read_file_contexts(puppetca_t) seutil_read_file_contexts(puppetca_t)
@@ -246,38 +255,48 @@ optional_policy(` @@ -246,38 +259,48 @@ optional_policy(`
hostname_exec(puppetca_t) hostname_exec(puppetca_t)
') ')
@ -79614,7 +79645,7 @@ index 618dcfe..67d166c 100644
kernel_dontaudit_search_kernel_sysctl(puppetmaster_t) kernel_dontaudit_search_kernel_sysctl(puppetmaster_t)
kernel_read_network_state(puppetmaster_t) kernel_read_network_state(puppetmaster_t)
@@ -289,23 +308,24 @@ corecmd_exec_bin(puppetmaster_t) @@ -289,23 +312,24 @@ corecmd_exec_bin(puppetmaster_t)
corecmd_exec_shell(puppetmaster_t) corecmd_exec_shell(puppetmaster_t)
corenet_all_recvfrom_netlabel(puppetmaster_t) corenet_all_recvfrom_netlabel(puppetmaster_t)
@ -79645,7 +79676,7 @@ index 618dcfe..67d166c 100644
selinux_validate_context(puppetmaster_t) selinux_validate_context(puppetmaster_t)
@@ -314,26 +334,31 @@ auth_use_nsswitch(puppetmaster_t) @@ -314,26 +338,31 @@ auth_use_nsswitch(puppetmaster_t)
logging_send_syslog_msg(puppetmaster_t) logging_send_syslog_msg(puppetmaster_t)
miscfiles_read_generic_certs(puppetmaster_t) miscfiles_read_generic_certs(puppetmaster_t)
@ -79682,7 +79713,7 @@ index 618dcfe..67d166c 100644
') ')
optional_policy(` optional_policy(`
@@ -342,3 +367,9 @@ optional_policy(` @@ -342,3 +371,9 @@ optional_policy(`
rpm_exec(puppetmaster_t) rpm_exec(puppetmaster_t)
rpm_read_db(puppetmaster_t) rpm_read_db(puppetmaster_t)
') ')

12
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.13.1 Version: 3.13.1
Release: 205%{?dist} Release: 206%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -648,6 +648,16 @@ exit 0
%endif %endif
%changelog %changelog
* Tue Aug 02 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-206
- collectd: update policy for 5.5
- Allow puppet_t transtition to shorewall_t
- Grant certmonger "chown" capability
- Boinc updates from Russell Coker.
- Allow sshd setcap capability. This is needed due to latest changes in sshd.
- Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd"
- Revert "Fix typo in ssh policy"
- Get attributes of generic ptys, from Russell Coker.
* Fri Jul 29 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-205 * Fri Jul 29 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-205
- Dontaudit mock_build_t can list all ptys. - Dontaudit mock_build_t can list all ptys.
- Allow ftpd_t to mamange userhome data without any boolean. - Allow ftpd_t to mamange userhome data without any boolean.