rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Thu Feb 09 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-238 

- Allow shiftfs to use xattr SELinux labels
- Fix ssh_server_template by add sshd_t to require section.
This commit is contained in:
Lukas Vrabec 2017-02-09 23:34:30 +01:00
parent b4648c484e
commit 67dffb1bc1
4 changed files with 46 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
container-selinux.tgz
View File

Binary file not shown.

67
policy-rawhide-base.patch
View File

@ -21474,10 +21474,10 @@ index 8416beb..b38387e 100644
+ allow $1 tracefs_t:filesystem unmount;
+')
diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
index e7d1738..59c1cb8 100644
index e7d1738..b3e6523 100644
--- a/policy/modules/kernel/filesystem.te
+++ b/policy/modules/kernel/filesystem.te
@@ -26,14 +26,19 @@ fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0);
@@ -26,14 +26,20 @@ fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0);
fs_use_xattr ext3 gen_context(system_u:object_r:fs_t,s0);
fs_use_xattr ext4 gen_context(system_u:object_r:fs_t,s0);
fs_use_xattr ext4dev gen_context(system_u:object_r:fs_t,s0);
@ -21494,10 +21494,11 @@ index e7d1738..59c1cb8 100644
+fs_use_xattr squashfs gen_context(system_u:object_r:fs_t,s0);
fs_use_xattr zfs gen_context(system_u:object_r:fs_t,s0);
+fs_use_xattr fuse.glusterfs gen_context(system_u:object_r:fs_t,s0);
+fs_use_xattr shiftfs gen_context(system_u:object_r:fs_t,s0);
# Use the allocating task SID to label inodes in the following filesystem
# types, and label the filesystem itself with the specified context.
@@ -53,6 +58,7 @@ type anon_inodefs_t;
@@ -53,6 +59,7 @@ type anon_inodefs_t;
fs_type(anon_inodefs_t)
files_mountpoint(anon_inodefs_t)
genfscon anon_inodefs / gen_context(system_u:object_r:anon_inodefs_t,s0)
@ -21505,7 +21506,7 @@ index e7d1738..59c1cb8 100644
type bdev_t;
fs_type(bdev_t)
@@ -63,16 +69,28 @@ fs_type(binfmt_misc_fs_t)
@@ -63,16 +70,28 @@ fs_type(binfmt_misc_fs_t)
files_mountpoint(binfmt_misc_fs_t)
genfscon binfmt_misc / gen_context(system_u:object_r:binfmt_misc_fs_t,s0)
@ -21535,7 +21536,7 @@ index e7d1738..59c1cb8 100644
type configfs_t;
fs_type(configfs_t)
@@ -88,6 +106,11 @@ fs_noxattr_type(ecryptfs_t)
@@ -88,6 +107,11 @@ fs_noxattr_type(ecryptfs_t)
files_mountpoint(ecryptfs_t)
genfscon ecryptfs / gen_context(system_u:object_r:ecryptfs_t,s0)
@ -21547,7 +21548,7 @@ index e7d1738..59c1cb8 100644
type futexfs_t;
fs_type(futexfs_t)
genfscon futexfs / gen_context(system_u:object_r:futexfs_t,s0)
@@ -96,6 +119,7 @@ type hugetlbfs_t;
@@ -96,6 +120,7 @@ type hugetlbfs_t;
fs_type(hugetlbfs_t)
files_mountpoint(hugetlbfs_t)
fs_use_trans hugetlbfs gen_context(system_u:object_r:hugetlbfs_t,s0);
@ -21555,7 +21556,7 @@ index e7d1738..59c1cb8 100644
type ibmasmfs_t;
fs_type(ibmasmfs_t)
@@ -111,6 +135,12 @@ type inotifyfs_t;
@@ -111,6 +136,12 @@ type inotifyfs_t;
fs_type(inotifyfs_t)
genfscon inotifyfs / gen_context(system_u:object_r:inotifyfs_t,s0)
@ -21568,7 +21569,7 @@ index e7d1738..59c1cb8 100644
type mvfs_t;
fs_noxattr_type(mvfs_t)
allow mvfs_t self:filesystem associate;
@@ -118,13 +148,23 @@ genfscon mvfs / gen_context(system_u:object_r:mvfs_t,s0)
@@ -118,13 +149,23 @@ genfscon mvfs / gen_context(system_u:object_r:mvfs_t,s0)
type nfsd_fs_t;
fs_type(nfsd_fs_t)
@ -21593,7 +21594,7 @@ index e7d1738..59c1cb8 100644
fs_type(pstore_t)
files_mountpoint(pstore_t)
dev_associate_sysfs(pstore_t)
@@ -150,17 +190,16 @@ fs_type(spufs_t)
@@ -150,17 +191,16 @@ fs_type(spufs_t)
genfscon spufs / gen_context(system_u:object_r:spufs_t,s0)
files_mountpoint(spufs_t)
@ -21615,7 +21616,7 @@ index e7d1738..59c1cb8 100644
type vmblock_t;
fs_noxattr_type(vmblock_t)
files_mountpoint(vmblock_t)
@@ -172,6 +211,8 @@ type vxfs_t;
@@ -172,6 +212,8 @@ type vxfs_t;
fs_noxattr_type(vxfs_t)
files_mountpoint(vxfs_t)
genfscon vxfs / gen_context(system_u:object_r:vxfs_t,s0)
@ -21624,7 +21625,7 @@ index e7d1738..59c1cb8 100644
#
# tmpfs_t is the type for tmpfs filesystems
@@ -182,6 +223,8 @@ fs_type(tmpfs_t)
@@ -182,6 +224,8 @@ fs_type(tmpfs_t)
files_type(tmpfs_t)
files_mountpoint(tmpfs_t)
files_poly_parent(tmpfs_t)
@ -21633,7 +21634,7 @@ index e7d1738..59c1cb8 100644
# Use a transition SID based on the allocating task SID and the
# filesystem SID to label inodes in the following filesystem types,
@@ -261,6 +304,8 @@ genfscon udf / gen_context(system_u:object_r:iso9660_t,s0)
@@ -261,6 +305,8 @@ genfscon udf / gen_context(system_u:object_r:iso9660_t,s0)
type removable_t;
allow removable_t noxattrfs:filesystem associate;
fs_noxattr_type(removable_t)
@ -21642,7 +21643,7 @@ index e7d1738..59c1cb8 100644
files_mountpoint(removable_t)
#
@@ -280,6 +325,7 @@ genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
@@ -280,6 +326,7 @@ genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon panfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon gadgetfs / gen_context(system_u:object_r:nfs_t,s0)
@ -21650,7 +21651,7 @@ index e7d1738..59c1cb8 100644
########################################
#
@@ -301,9 +347,10 @@ fs_associate_noxattr(noxattrfs)
@@ -301,9 +348,10 @@ fs_associate_noxattr(noxattrfs)
# Unconfined access to this module
#
@ -28793,7 +28794,7 @@ index 76d9f66..7528851 100644
+/root/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+/root/\.shosts gen_context(system_u:object_r:ssh_home_t,s0)
diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index fe0c682..d55811f 100644
index fe0c682..5f4da9d 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -32,10 +32,11 @@
@ -28906,16 +28907,20 @@ index fe0c682..d55811f 100644
#######################################
## <summary>
## The template to define a ssh server.
@@ -168,7 +192,7 @@ template(`ssh_basic_client_template',`
@@ -168,7 +192,11 @@ template(`ssh_basic_client_template',`
## </summary>
## </param>
#
-template(`ssh_server_template', `
+template(`ssh_server_template',`
+ gen_require(`
+ type sshd_t;
+ ')
+
type $1_t, ssh_server;
auth_login_pgm_domain($1_t)
@@ -181,20 +205,22 @@ template(`ssh_server_template', `
@@ -181,20 +209,22 @@ template(`ssh_server_template', `
type $1_var_run_t;
files_pid_file($1_var_run_t)
@ -28943,7 +28948,7 @@ index fe0c682..d55811f 100644
allow $1_t $1_var_run_t:file manage_file_perms;
files_pid_filetrans($1_t, $1_var_run_t, file)
@@ -206,6 +232,7 @@ template(`ssh_server_template', `
@@ -206,6 +236,7 @@ template(`ssh_server_template', `
kernel_read_kernel_sysctls($1_t)
kernel_read_network_state($1_t)
@ -28951,7 +28956,7 @@ index fe0c682..d55811f 100644
corenet_all_recvfrom_unlabeled($1_t)
corenet_all_recvfrom_netlabel($1_t)
@@ -220,10 +247,13 @@ template(`ssh_server_template', `
@@ -220,10 +251,13 @@ template(`ssh_server_template', `
corenet_tcp_bind_generic_node($1_t)
corenet_udp_bind_generic_node($1_t)
corenet_tcp_bind_ssh_port($1_t)
@ -28967,7 +28972,7 @@ index fe0c682..d55811f 100644
auth_rw_login_records($1_t)
auth_rw_faillog($1_t)
@@ -233,7 +263,10 @@ template(`ssh_server_template', `
@@ -233,7 +267,10 @@ template(`ssh_server_template', `
# for sshd subsystems, such as sftp-server.
corecmd_getattr_bin_files($1_t)
@ -28978,7 +28983,7 @@ index fe0c682..d55811f 100644
files_read_etc_files($1_t)
files_read_etc_runtime_files($1_t)
@@ -241,35 +274,33 @@ template(`ssh_server_template', `
@@ -241,35 +278,33 @@ template(`ssh_server_template', `
logging_search_logs($1_t)
@ -29025,7 +29030,7 @@ index fe0c682..d55811f 100644
')
########################################
@@ -292,14 +323,15 @@ template(`ssh_server_template', `
@@ -292,14 +327,15 @@ template(`ssh_server_template', `
## User domain for the role
## </summary>
## </param>
@ -29042,7 +29047,7 @@ index fe0c682..d55811f 100644
')
##############################
@@ -328,103 +360,56 @@ template(`ssh_role_template',`
@@ -328,103 +364,56 @@ template(`ssh_role_template',`
# allow ps to show ssh
ps_process_pattern($3, ssh_t)
@ -29156,7 +29161,7 @@ index fe0c682..d55811f 100644
')
########################################
@@ -496,8 +481,27 @@ interface(`ssh_read_pipes',`
@@ -496,8 +485,27 @@ interface(`ssh_read_pipes',`
type sshd_t;
')
@ -29185,7 +29190,7 @@ index fe0c682..d55811f 100644
########################################
## <summary>
## Read and write a ssh server unnamed pipe.
@@ -513,7 +517,7 @@ interface(`ssh_rw_pipes',`
@@ -513,7 +521,7 @@ interface(`ssh_rw_pipes',`
type sshd_t;
')
@ -29194,7 +29199,7 @@ index fe0c682..d55811f 100644
')
########################################
@@ -605,6 +609,24 @@ interface(`ssh_domtrans',`
@@ -605,6 +613,24 @@ interface(`ssh_domtrans',`
########################################
## <summary>
@ -29219,7 +29224,7 @@ index fe0c682..d55811f 100644
## Execute the ssh client in the caller domain.
## </summary>
## <param name="domain">
@@ -637,7 +659,7 @@ interface(`ssh_setattr_key_files',`
@@ -637,7 +663,7 @@ interface(`ssh_setattr_key_files',`
type sshd_key_t;
')
@ -29228,7 +29233,7 @@ index fe0c682..d55811f 100644
files_search_pids($1)
')
@@ -662,6 +684,42 @@ interface(`ssh_agent_exec',`
@@ -662,6 +688,42 @@ interface(`ssh_agent_exec',`
########################################
## <summary>
@ -29271,7 +29276,7 @@ index fe0c682..d55811f 100644
## Read ssh home directory content
## </summary>
## <param name="domain">
@@ -701,6 +759,68 @@ interface(`ssh_domtrans_keygen',`
@@ -701,6 +763,68 @@ interface(`ssh_domtrans_keygen',`
########################################
## <summary>
@ -29340,7 +29345,7 @@ index fe0c682..d55811f 100644
## Read ssh server keys
## </summary>
## <param name="domain">
@@ -714,7 +834,26 @@ interface(`ssh_dontaudit_read_server_keys',`
@@ -714,7 +838,26 @@ interface(`ssh_dontaudit_read_server_keys',`
type sshd_key_t;
')
@ -29368,7 +29373,7 @@ index fe0c682..d55811f 100644
')
######################################
@@ -754,3 +893,151 @@ interface(`ssh_delete_tmp',`
@@ -754,3 +897,151 @@ interface(`ssh_delete_tmp',`
files_search_tmp($1)
delete_files_pattern($1, sshd_tmp_t, sshd_tmp_t)
')

9
policy-rawhide-contrib.patch
View File

@ -589,7 +589,7 @@ index 058d908..ee0c559 100644
+')
+
diff --git a/abrt.te b/abrt.te
index eb50f07..d53d1e0 100644
index eb50f07..def23ab 100644
--- a/abrt.te
+++ b/abrt.te
@@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1)
@ -1048,7 +1048,7 @@ index eb50f07..d53d1e0 100644
allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms;
domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t)
@@ -365,38 +470,79 @@ corecmd_exec_shell(abrt_retrace_worker_t)
@@ -365,38 +470,80 @@ corecmd_exec_shell(abrt_retrace_worker_t)
dev_read_urand(abrt_retrace_worker_t)
@ -1100,6 +1100,7 @@ index eb50f07..d53d1e0 100644
+auth_read_passwd(abrt_dump_oops_t)
+
+corecmd_getattr_all_executables(abrt_dump_oops_t)
+corecmd_exec_bin(abrt_dump_oops_t)
+
+dev_read_urand(abrt_dump_oops_t)
+dev_read_rand(abrt_dump_oops_t)
@ -1132,7 +1133,7 @@ index eb50f07..d53d1e0 100644
#######################################
#
@@ -404,25 +550,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
@@ -404,25 +551,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
#
allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms;
@ -1195,7 +1196,7 @@ index eb50f07..d53d1e0 100644
')
#######################################
@@ -430,10 +611,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
@@ -430,10 +612,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
# Global local policy
#

6
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
Release: 237%{?dist}
Release: 238%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@ -675,6 +675,10 @@ exit 0
%endif
%changelog
* Thu Feb 09 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-238
- Allow shiftfs to use xattr SELinux labels
- Fix ssh_server_template by add sshd_t to require section.
* Wed Feb 08 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-237
- Merge pull request #187 from rhatdan/container-selinux
- Allow rhsmcertd domain signull kernel.