rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Fix bogus line in logrotate.fc.

Browse Source
This commit is contained in:
Miroslav Grepl 2015-06-23 15:44:47 +02:00
parent 1bee2ddf1b
commit 4e49e36893
2 changed files with 87 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
policy-rawhide-base.patch
View File

@ -8862,7 +8862,7 @@ index 0b1a871..f260e6f 100644
+allow devices_unconfined_type device_node:{ file chr_file } ~{ execmod entrypoint }; +allow devices_unconfined_type device_node:{ file chr_file } ~{ execmod entrypoint };
+allow devices_unconfined_type mtrr_device_t:file ~{ execmod entrypoint }; +allow devices_unconfined_type mtrr_device_t:file ~{ execmod entrypoint };
diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if
index 6a1e4d1..549967a 100644 index 6a1e4d1..26e5558 100644
--- a/policy/modules/kernel/domain.if --- a/policy/modules/kernel/domain.if
+++ b/policy/modules/kernel/domain.if +++ b/policy/modules/kernel/domain.if
@@ -76,33 +76,8 @@ interface(`domain_type',` @@ -76,33 +76,8 @@ interface(`domain_type',`
@ -8963,7 +8963,50 @@ index 6a1e4d1..549967a 100644
## Search the process state directory (/proc/pid) of all domains. ## Search the process state directory (/proc/pid) of all domains.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -631,7 +645,7 @@ interface(`domain_read_all_domains_state',` @@ -590,6 +604,42 @@ interface(`domain_search_all_domains_state',`
########################################
## <summary>
+## Dontaudit search of process kernel keyrings
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain to dontaudit.
+## </summary>
+## </param>
+#
+interface(`domain_dontaudit_search_all_domains_keyrings',`
+ gen_require(`
+ attribute domain;
+ ')
+
+ dontaudit $1 domain:key search;
+')
+
+########################################
+## <summary>
+## Dontaudit link of process kernel keyrings
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain to dontaudit.
+## </summary>
+## </param>
+#
+interface(`domain_dontaudit_link_all_domains_keyrings',`
+ gen_require(`
+ attribute domain;
+ ')
+
+ dontaudit $1 domain:key link;
+')
+
+########################################
+## <summary>
## Do not audit attempts to search the process
## state directory (/proc/pid) of all domains.
## </summary>
@@ -631,7 +681,7 @@ interface(`domain_read_all_domains_state',`
######################################## ########################################
## <summary> ## <summary>
@ -8972,7 +9015,7 @@ index 6a1e4d1..549967a 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -655,7 +669,7 @@ interface(`domain_getattr_all_domains',` @@ -655,7 +705,7 @@ interface(`domain_getattr_all_domains',`
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@ -8981,7 +9024,7 @@ index 6a1e4d1..549967a 100644
## </summary> ## </summary>
## </param> ## </param>
# #
@@ -1356,6 +1370,24 @@ interface(`domain_manage_all_entry_files',` @@ -1356,6 +1406,24 @@ interface(`domain_manage_all_entry_files',`
######################################## ########################################
## <summary> ## <summary>
@ -9006,7 +9049,7 @@ index 6a1e4d1..549967a 100644
## Relabel to and from all entry point ## Relabel to and from all entry point
## file types. ## file types.
## </summary> ## </summary>
@@ -1421,7 +1453,7 @@ interface(`domain_entry_file_spec_domtrans',` @@ -1421,7 +1489,7 @@ interface(`domain_entry_file_spec_domtrans',`
## <summary> ## <summary>
## Ability to mmap a low area of the address ## Ability to mmap a low area of the address
## space conditionally, as configured by ## space conditionally, as configured by
@ -9015,7 +9058,7 @@ index 6a1e4d1..549967a 100644
## Preventing such mappings helps protect against ## Preventing such mappings helps protect against
## exploiting null deref bugs in the kernel. ## exploiting null deref bugs in the kernel.
## </summary> ## </summary>
@@ -1448,7 +1480,7 @@ interface(`domain_mmap_low',` @@ -1448,7 +1516,7 @@ interface(`domain_mmap_low',`
## <summary> ## <summary>
## Ability to mmap a low area of the address ## Ability to mmap a low area of the address
## space unconditionally, as configured ## space unconditionally, as configured
@ -9024,7 +9067,7 @@ index 6a1e4d1..549967a 100644
## Preventing such mappings helps protect against ## Preventing such mappings helps protect against
## exploiting null deref bugs in the kernel. ## exploiting null deref bugs in the kernel.
## </summary> ## </summary>
@@ -1508,6 +1540,40 @@ interface(`domain_unconfined_signal',` @@ -1508,6 +1576,40 @@ interface(`domain_unconfined_signal',`
######################################## ########################################
## <summary> ## <summary>
@ -9065,7 +9108,7 @@ index 6a1e4d1..549967a 100644
## Unconfined access to domains. ## Unconfined access to domains.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -1530,4 +1596,63 @@ interface(`domain_unconfined',` @@ -1530,4 +1632,63 @@ interface(`domain_unconfined',`
typeattribute $1 can_change_object_identity; typeattribute $1 can_change_object_identity;
typeattribute $1 set_curr_context; typeattribute $1 set_curr_context;
typeattribute $1 process_uncond_exempt; typeattribute $1 process_uncond_exempt;
@ -30058,7 +30101,7 @@ index 187f04f..cf0af09 100644
interface(`hostname_exec',` interface(`hostname_exec',`
gen_require(` gen_require(`
diff --git a/policy/modules/system/hostname.te b/policy/modules/system/hostname.te diff --git a/policy/modules/system/hostname.te b/policy/modules/system/hostname.te
index 24a7889..d97f6d5 100644 index 24a7889..a3d8f1a 100644
--- a/policy/modules/system/hostname.te --- a/policy/modules/system/hostname.te
+++ b/policy/modules/system/hostname.te +++ b/policy/modules/system/hostname.te
@@ -23,33 +23,36 @@ dontaudit hostname_t self:capability sys_tty_config; @@ -23,33 +23,36 @@ dontaudit hostname_t self:capability sys_tty_config;
@ -30101,10 +30144,14 @@ index 24a7889..d97f6d5 100644
sysnet_dontaudit_rw_dhcpc_udp_sockets(hostname_t) sysnet_dontaudit_rw_dhcpc_udp_sockets(hostname_t)
sysnet_dontaudit_rw_dhcpc_unix_stream_sockets(hostname_t) sysnet_dontaudit_rw_dhcpc_unix_stream_sockets(hostname_t)
@@ -57,6 +60,10 @@ sysnet_read_config(hostname_t) @@ -57,6 +60,14 @@ sysnet_read_config(hostname_t)
sysnet_dns_name_resolve(hostname_t) sysnet_dns_name_resolve(hostname_t)
optional_policy(` optional_policy(`
+ kdump_dontaudit_inherited_kdumpctl_tmp_pipes(hostname_t)
+')
+
+optional_policy(`
+ mock_dontaudit_write_lib_chr_files(hostname_t) + mock_dontaudit_write_lib_chr_files(hostname_t)
+') +')
+ +
@ -37021,10 +37068,10 @@ index 1361961..be6b7fc 100644
# #
# Base type for the tests directory. # Base type for the tests directory.
diff --git a/policy/modules/system/modutils.fc b/policy/modules/system/modutils.fc diff --git a/policy/modules/system/modutils.fc b/policy/modules/system/modutils.fc
index 9933677..ca14c17 100644 index 9933677..0b9c20a 100644
--- a/policy/modules/system/modutils.fc --- a/policy/modules/system/modutils.fc
+++ b/policy/modules/system/modutils.fc +++ b/policy/modules/system/modutils.fc
@@ -23,3 +23,15 @@ ifdef(`distro_gentoo',` @@ -23,3 +23,17 @@ ifdef(`distro_gentoo',`
/sbin/update-modules -- gen_context(system_u:object_r:update_modules_exec_t,s0) /sbin/update-modules -- gen_context(system_u:object_r:update_modules_exec_t,s0)
/usr/bin/kmod -- gen_context(system_u:object_r:insmod_exec_t,s0) /usr/bin/kmod -- gen_context(system_u:object_r:insmod_exec_t,s0)
@ -37037,6 +37084,8 @@ index 9933677..ca14c17 100644
+/usr/sbin/rmmod.* -- gen_context(system_u:object_r:insmod_exec_t,s0) +/usr/sbin/rmmod.* -- gen_context(system_u:object_r:insmod_exec_t,s0)
+/usr/sbin/update-modules -- gen_context(system_u:object_r:update_modules_exec_t,s0) +/usr/sbin/update-modules -- gen_context(system_u:object_r:update_modules_exec_t,s0)
+ +
+/usr/lib/modules/[^/]+/modules\..+ -- gen_context(system_u:object_r:modules_dep_t,s0)
+
+/usr/lib/modules/modprobe\.conf -- gen_context(system_u:object_r:modules_conf_t,s0) +/usr/lib/modules/modprobe\.conf -- gen_context(system_u:object_r:modules_conf_t,s0)
+ +
+/var/run/tmpfiles.d/kmod.conf -- gen_context(system_u:object_r:insmod_var_run_t,s0) +/var/run/tmpfiles.d/kmod.conf -- gen_context(system_u:object_r:insmod_var_run_t,s0)
@ -44727,7 +44776,7 @@ index db75976..c54480a 100644
+/var/tmp/hsperfdata_root gen_context(system_u:object_r:user_tmp_t,s0) +/var/tmp/hsperfdata_root gen_context(system_u:object_r:user_tmp_t,s0)
+ +
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 9dc60c6..f01932f 100644 index 9dc60c6..769ce74 100644
--- a/policy/modules/system/userdomain.if --- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if
@@ -30,9 +30,11 @@ template(`userdom_base_user_template',` @@ -30,9 +30,11 @@ template(`userdom_base_user_template',`
@ -49209,8 +49258,8 @@ index 9dc60c6..f01932f 100644
+## </param> +## </param>
+# +#
+interface(`userdom_delete_user_tmpfs_files',` +interface(`userdom_delete_user_tmpfs_files',`
+ refpolicywarn(`$0($*) has been deprecated, use userdom_delete_user_tmpfs_files instead.') + refpolicywarn(`$0($*) has been deprecated, use userdom_delete_user_tmp_files instead.')
+ userdom_delete_user_tmpfs_files($1) + userdom_delete_user_tmp_files($1)
+') +')
+ +
+######################################## +########################################

28
policy-rawhide-contrib.patch
View File

@ -38243,7 +38243,7 @@ index a49ae4e..0c0e987 100644
+ +
+/var/lock/kdump(/.*)? gen_context(system_u:object_r:kdump_lock_t,s0) +/var/lock/kdump(/.*)? gen_context(system_u:object_r:kdump_lock_t,s0)
diff --git a/kdump.if b/kdump.if diff --git a/kdump.if b/kdump.if
index 3a00b3a..160c575 100644 index 3a00b3a..92f125f 100644
--- a/kdump.if --- a/kdump.if
+++ b/kdump.if +++ b/kdump.if
@@ -1,4 +1,4 @@ @@ -1,4 +1,4 @@
@ -38506,7 +38506,7 @@ index 3a00b3a..160c575 100644
init_labeled_script_domtrans($1, kdump_initrc_exec_t) init_labeled_script_domtrans($1, kdump_initrc_exec_t)
domain_system_change_exemption($1) domain_system_change_exemption($1)
@@ -110,6 +295,10 @@ interface(`kdump_admin',` @@ -110,6 +295,29 @@ interface(`kdump_admin',`
files_search_etc($1) files_search_etc($1)
admin_pattern($1, kdump_etc_t) admin_pattern($1, kdump_etc_t)
@ -38519,6 +38519,25 @@ index 3a00b3a..160c575 100644
+ admin_pattern($1, kdump_unit_file_t) + admin_pattern($1, kdump_unit_file_t)
+ allow $1 kdump_unit_file_t:service all_service_perms; + allow $1 kdump_unit_file_t:service all_service_perms;
') ')
+
+###################################
+## <summary>
+## Dontaudit Read/write inherited kdump /var/tmp named pipes.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain to not audit
+## </summary>
+## </param>
+#
+interface(`kdump_dontaudit_inherited_kdumpctl_tmp_pipes',`
+ gen_require(`
+ type kdumpctl_tmp_t;
+ ')
+
+ dontaudit $1 kdumpctl_tmp_t:fifo_file rw_inherited_fifo_file_perms;
+')
+
diff --git a/kdump.te b/kdump.te diff --git a/kdump.te b/kdump.te
index 715fc21..8bcd248 100644 index 715fc21..8bcd248 100644
--- a/kdump.te --- a/kdump.te
@ -42926,10 +42945,10 @@ index 61db5a0..9d5d255 100644
+userdom_use_inherited_user_terminals(lockdev_t) +userdom_use_inherited_user_terminals(lockdev_t)
+ +
diff --git a/logrotate.fc b/logrotate.fc diff --git a/logrotate.fc b/logrotate.fc
index a11d5be..5fc9001 100644 index a11d5be..60f83c5 100644
--- a/logrotate.fc --- a/logrotate.fc
+++ b/logrotate.fc +++ b/logrotate.fc
@@ -1,6 +1,7 @@ @@ -1,6 +1,6 @@
-/etc/cron\.(daily|weekly)/sysklogd -- gen_context(system_u:object_r:logrotate_exec_t,s0) -/etc/cron\.(daily|weekly)/sysklogd -- gen_context(system_u:object_r:logrotate_exec_t,s0)
+/etc/cron\.(daily|weekly)/sysklogd -- gen_context(system_u:object_r:logrotate_exec_t,s0) +/etc/cron\.(daily|weekly)/sysklogd -- gen_context(system_u:object_r:logrotate_exec_t,s0)
@ -42938,7 +42957,6 @@ index a11d5be..5fc9001 100644
/var/lib/logrotate(/.*)? gen_context(system_u:object_r:logrotate_var_lib_t,s0) /var/lib/logrotate(/.*)? gen_context(system_u:object_r:logrotate_var_lib_t,s0)
-/var/lib/logrotate\.status -- gen_context(system_u:object_r:logrotate_var_lib_t,s0) -/var/lib/logrotate\.status -- gen_context(system_u:object_r:logrotate_var_lib_t,s0)
+/var/lib/logrotate\.status.* -- gen_context(system_u:object_r:logrotate_var_lib_t,s0) +/var/lib/logrotate\.status.* -- gen_context(system_u:object_r:logrotate_var_lib_t,s0)
+')
diff --git a/logrotate.if b/logrotate.if diff --git a/logrotate.if b/logrotate.if
index dd8e01a..9cd6b0b 100644 index dd8e01a..9cd6b0b 100644
--- a/logrotate.if --- a/logrotate.if