rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Thu Feb 09 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-238 

- Allow shiftfs to use xattr SELinux labels
- Fix ssh_server_template by add sshd_t to require section.
This commit is contained in:
Lukas Vrabec 2017-02-09 23:34:30 +01:00
parent b4648c484e
commit 67dffb1bc1
4 changed files with 46 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
container-selinux.tgz
View File

Binary file not shown.

67
policy-rawhide-base.patch
View File

@ -21474,10 +21474,10 @@ index 8416beb..b38387e 100644
+ allow $1 tracefs_t:filesystem unmount; + allow $1 tracefs_t:filesystem unmount;
+') +')
diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
index e7d1738..59c1cb8 100644 index e7d1738..b3e6523 100644
--- a/policy/modules/kernel/filesystem.te --- a/policy/modules/kernel/filesystem.te
+++ b/policy/modules/kernel/filesystem.te +++ b/policy/modules/kernel/filesystem.te
@@ -26,14 +26,19 @@ fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0); @@ -26,14 +26,20 @@ fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0);
fs_use_xattr ext3 gen_context(system_u:object_r:fs_t,s0); fs_use_xattr ext3 gen_context(system_u:object_r:fs_t,s0);
fs_use_xattr ext4 gen_context(system_u:object_r:fs_t,s0); fs_use_xattr ext4 gen_context(system_u:object_r:fs_t,s0);
fs_use_xattr ext4dev gen_context(system_u:object_r:fs_t,s0); fs_use_xattr ext4dev gen_context(system_u:object_r:fs_t,s0);
@ -21494,10 +21494,11 @@ index e7d1738..59c1cb8 100644
+fs_use_xattr squashfs gen_context(system_u:object_r:fs_t,s0); +fs_use_xattr squashfs gen_context(system_u:object_r:fs_t,s0);
fs_use_xattr zfs gen_context(system_u:object_r:fs_t,s0); fs_use_xattr zfs gen_context(system_u:object_r:fs_t,s0);
+fs_use_xattr fuse.glusterfs gen_context(system_u:object_r:fs_t,s0); +fs_use_xattr fuse.glusterfs gen_context(system_u:object_r:fs_t,s0);
+fs_use_xattr shiftfs gen_context(system_u:object_r:fs_t,s0);
# Use the allocating task SID to label inodes in the following filesystem # Use the allocating task SID to label inodes in the following filesystem
# types, and label the filesystem itself with the specified context. # types, and label the filesystem itself with the specified context.
@@ -53,6 +58,7 @@ type anon_inodefs_t; @@ -53,6 +59,7 @@ type anon_inodefs_t;
fs_type(anon_inodefs_t) fs_type(anon_inodefs_t)
files_mountpoint(anon_inodefs_t) files_mountpoint(anon_inodefs_t)
genfscon anon_inodefs / gen_context(system_u:object_r:anon_inodefs_t,s0) genfscon anon_inodefs / gen_context(system_u:object_r:anon_inodefs_t,s0)
@ -21505,7 +21506,7 @@ index e7d1738..59c1cb8 100644
type bdev_t; type bdev_t;
fs_type(bdev_t) fs_type(bdev_t)
@@ -63,16 +69,28 @@ fs_type(binfmt_misc_fs_t) @@ -63,16 +70,28 @@ fs_type(binfmt_misc_fs_t)
files_mountpoint(binfmt_misc_fs_t) files_mountpoint(binfmt_misc_fs_t)
genfscon binfmt_misc / gen_context(system_u:object_r:binfmt_misc_fs_t,s0) genfscon binfmt_misc / gen_context(system_u:object_r:binfmt_misc_fs_t,s0)
@ -21535,7 +21536,7 @@ index e7d1738..59c1cb8 100644
type configfs_t; type configfs_t;
fs_type(configfs_t) fs_type(configfs_t)
@@ -88,6 +106,11 @@ fs_noxattr_type(ecryptfs_t) @@ -88,6 +107,11 @@ fs_noxattr_type(ecryptfs_t)
files_mountpoint(ecryptfs_t) files_mountpoint(ecryptfs_t)
genfscon ecryptfs / gen_context(system_u:object_r:ecryptfs_t,s0) genfscon ecryptfs / gen_context(system_u:object_r:ecryptfs_t,s0)
@ -21547,7 +21548,7 @@ index e7d1738..59c1cb8 100644
type futexfs_t; type futexfs_t;
fs_type(futexfs_t) fs_type(futexfs_t)
genfscon futexfs / gen_context(system_u:object_r:futexfs_t,s0) genfscon futexfs / gen_context(system_u:object_r:futexfs_t,s0)
@@ -96,6 +119,7 @@ type hugetlbfs_t; @@ -96,6 +120,7 @@ type hugetlbfs_t;
fs_type(hugetlbfs_t) fs_type(hugetlbfs_t)
files_mountpoint(hugetlbfs_t) files_mountpoint(hugetlbfs_t)
fs_use_trans hugetlbfs gen_context(system_u:object_r:hugetlbfs_t,s0); fs_use_trans hugetlbfs gen_context(system_u:object_r:hugetlbfs_t,s0);
@ -21555,7 +21556,7 @@ index e7d1738..59c1cb8 100644
type ibmasmfs_t; type ibmasmfs_t;
fs_type(ibmasmfs_t) fs_type(ibmasmfs_t)
@@ -111,6 +135,12 @@ type inotifyfs_t; @@ -111,6 +136,12 @@ type inotifyfs_t;
fs_type(inotifyfs_t) fs_type(inotifyfs_t)
genfscon inotifyfs / gen_context(system_u:object_r:inotifyfs_t,s0) genfscon inotifyfs / gen_context(system_u:object_r:inotifyfs_t,s0)
@ -21568,7 +21569,7 @@ index e7d1738..59c1cb8 100644
type mvfs_t; type mvfs_t;
fs_noxattr_type(mvfs_t) fs_noxattr_type(mvfs_t)
allow mvfs_t self:filesystem associate; allow mvfs_t self:filesystem associate;
@@ -118,13 +148,23 @@ genfscon mvfs / gen_context(system_u:object_r:mvfs_t,s0) @@ -118,13 +149,23 @@ genfscon mvfs / gen_context(system_u:object_r:mvfs_t,s0)
type nfsd_fs_t; type nfsd_fs_t;
fs_type(nfsd_fs_t) fs_type(nfsd_fs_t)
@ -21593,7 +21594,7 @@ index e7d1738..59c1cb8 100644
fs_type(pstore_t) fs_type(pstore_t)
files_mountpoint(pstore_t) files_mountpoint(pstore_t)
dev_associate_sysfs(pstore_t) dev_associate_sysfs(pstore_t)
@@ -150,17 +190,16 @@ fs_type(spufs_t) @@ -150,17 +191,16 @@ fs_type(spufs_t)
genfscon spufs / gen_context(system_u:object_r:spufs_t,s0) genfscon spufs / gen_context(system_u:object_r:spufs_t,s0)
files_mountpoint(spufs_t) files_mountpoint(spufs_t)
@ -21615,7 +21616,7 @@ index e7d1738..59c1cb8 100644
type vmblock_t; type vmblock_t;
fs_noxattr_type(vmblock_t) fs_noxattr_type(vmblock_t)
files_mountpoint(vmblock_t) files_mountpoint(vmblock_t)
@@ -172,6 +211,8 @@ type vxfs_t; @@ -172,6 +212,8 @@ type vxfs_t;
fs_noxattr_type(vxfs_t) fs_noxattr_type(vxfs_t)
files_mountpoint(vxfs_t) files_mountpoint(vxfs_t)
genfscon vxfs / gen_context(system_u:object_r:vxfs_t,s0) genfscon vxfs / gen_context(system_u:object_r:vxfs_t,s0)
@ -21624,7 +21625,7 @@ index e7d1738..59c1cb8 100644
# #
# tmpfs_t is the type for tmpfs filesystems # tmpfs_t is the type for tmpfs filesystems
@@ -182,6 +223,8 @@ fs_type(tmpfs_t) @@ -182,6 +224,8 @@ fs_type(tmpfs_t)
files_type(tmpfs_t) files_type(tmpfs_t)
files_mountpoint(tmpfs_t) files_mountpoint(tmpfs_t)
files_poly_parent(tmpfs_t) files_poly_parent(tmpfs_t)
@ -21633,7 +21634,7 @@ index e7d1738..59c1cb8 100644
# Use a transition SID based on the allocating task SID and the # Use a transition SID based on the allocating task SID and the
# filesystem SID to label inodes in the following filesystem types, # filesystem SID to label inodes in the following filesystem types,
@@ -261,6 +304,8 @@ genfscon udf / gen_context(system_u:object_r:iso9660_t,s0) @@ -261,6 +305,8 @@ genfscon udf / gen_context(system_u:object_r:iso9660_t,s0)
type removable_t; type removable_t;
allow removable_t noxattrfs:filesystem associate; allow removable_t noxattrfs:filesystem associate;
fs_noxattr_type(removable_t) fs_noxattr_type(removable_t)
@ -21642,7 +21643,7 @@ index e7d1738..59c1cb8 100644
files_mountpoint(removable_t) files_mountpoint(removable_t)
# #
@@ -280,6 +325,7 @@ genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0) @@ -280,6 +326,7 @@ genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0) genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon panfs / gen_context(system_u:object_r:nfs_t,s0) genfscon panfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon gadgetfs / gen_context(system_u:object_r:nfs_t,s0) genfscon gadgetfs / gen_context(system_u:object_r:nfs_t,s0)
@ -21650,7 +21651,7 @@ index e7d1738..59c1cb8 100644
######################################## ########################################
# #
@@ -301,9 +347,10 @@ fs_associate_noxattr(noxattrfs) @@ -301,9 +348,10 @@ fs_associate_noxattr(noxattrfs)
# Unconfined access to this module # Unconfined access to this module
# #
@ -28793,7 +28794,7 @@ index 76d9f66..7528851 100644
+/root/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0) +/root/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+/root/\.shosts gen_context(system_u:object_r:ssh_home_t,s0) +/root/\.shosts gen_context(system_u:object_r:ssh_home_t,s0)
diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index fe0c682..d55811f 100644 index fe0c682..5f4da9d 100644
--- a/policy/modules/services/ssh.if --- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if +++ b/policy/modules/services/ssh.if
@@ -32,10 +32,11 @@ @@ -32,10 +32,11 @@
@ -28906,16 +28907,20 @@ index fe0c682..d55811f 100644
####################################### #######################################
## <summary> ## <summary>
## The template to define a ssh server. ## The template to define a ssh server.
@@ -168,7 +192,7 @@ template(`ssh_basic_client_template',` @@ -168,7 +192,11 @@ template(`ssh_basic_client_template',`
## </summary> ## </summary>
## </param> ## </param>
# #
-template(`ssh_server_template', ` -template(`ssh_server_template', `
+template(`ssh_server_template',` +template(`ssh_server_template',`
+ gen_require(`
+ type sshd_t;
+ ')
+
type $1_t, ssh_server; type $1_t, ssh_server;
auth_login_pgm_domain($1_t) auth_login_pgm_domain($1_t)
@@ -181,20 +205,22 @@ template(`ssh_server_template', ` @@ -181,20 +209,22 @@ template(`ssh_server_template', `
type $1_var_run_t; type $1_var_run_t;
files_pid_file($1_var_run_t) files_pid_file($1_var_run_t)
@ -28943,7 +28948,7 @@ index fe0c682..d55811f 100644
allow $1_t $1_var_run_t:file manage_file_perms; allow $1_t $1_var_run_t:file manage_file_perms;
files_pid_filetrans($1_t, $1_var_run_t, file) files_pid_filetrans($1_t, $1_var_run_t, file)
@@ -206,6 +232,7 @@ template(`ssh_server_template', ` @@ -206,6 +236,7 @@ template(`ssh_server_template', `
kernel_read_kernel_sysctls($1_t) kernel_read_kernel_sysctls($1_t)
kernel_read_network_state($1_t) kernel_read_network_state($1_t)
@ -28951,7 +28956,7 @@ index fe0c682..d55811f 100644
corenet_all_recvfrom_unlabeled($1_t) corenet_all_recvfrom_unlabeled($1_t)
corenet_all_recvfrom_netlabel($1_t) corenet_all_recvfrom_netlabel($1_t)
@@ -220,10 +247,13 @@ template(`ssh_server_template', ` @@ -220,10 +251,13 @@ template(`ssh_server_template', `
corenet_tcp_bind_generic_node($1_t) corenet_tcp_bind_generic_node($1_t)
corenet_udp_bind_generic_node($1_t) corenet_udp_bind_generic_node($1_t)
corenet_tcp_bind_ssh_port($1_t) corenet_tcp_bind_ssh_port($1_t)
@ -28967,7 +28972,7 @@ index fe0c682..d55811f 100644
auth_rw_login_records($1_t) auth_rw_login_records($1_t)
auth_rw_faillog($1_t) auth_rw_faillog($1_t)
@@ -233,7 +263,10 @@ template(`ssh_server_template', ` @@ -233,7 +267,10 @@ template(`ssh_server_template', `
# for sshd subsystems, such as sftp-server. # for sshd subsystems, such as sftp-server.
corecmd_getattr_bin_files($1_t) corecmd_getattr_bin_files($1_t)
@ -28978,7 +28983,7 @@ index fe0c682..d55811f 100644
files_read_etc_files($1_t) files_read_etc_files($1_t)
files_read_etc_runtime_files($1_t) files_read_etc_runtime_files($1_t)
@@ -241,35 +274,33 @@ template(`ssh_server_template', ` @@ -241,35 +278,33 @@ template(`ssh_server_template', `
logging_search_logs($1_t) logging_search_logs($1_t)
@ -29025,7 +29030,7 @@ index fe0c682..d55811f 100644
') ')
######################################## ########################################
@@ -292,14 +323,15 @@ template(`ssh_server_template', ` @@ -292,14 +327,15 @@ template(`ssh_server_template', `
## User domain for the role ## User domain for the role
## </summary> ## </summary>
## </param> ## </param>
@ -29042,7 +29047,7 @@ index fe0c682..d55811f 100644
') ')
############################## ##############################
@@ -328,103 +360,56 @@ template(`ssh_role_template',` @@ -328,103 +364,56 @@ template(`ssh_role_template',`
# allow ps to show ssh # allow ps to show ssh
ps_process_pattern($3, ssh_t) ps_process_pattern($3, ssh_t)
@ -29156,7 +29161,7 @@ index fe0c682..d55811f 100644
') ')
######################################## ########################################
@@ -496,8 +481,27 @@ interface(`ssh_read_pipes',` @@ -496,8 +485,27 @@ interface(`ssh_read_pipes',`
type sshd_t; type sshd_t;
') ')
@ -29185,7 +29190,7 @@ index fe0c682..d55811f 100644
######################################## ########################################
## <summary> ## <summary>
## Read and write a ssh server unnamed pipe. ## Read and write a ssh server unnamed pipe.
@@ -513,7 +517,7 @@ interface(`ssh_rw_pipes',` @@ -513,7 +521,7 @@ interface(`ssh_rw_pipes',`
type sshd_t; type sshd_t;
') ')
@ -29194,7 +29199,7 @@ index fe0c682..d55811f 100644
') ')
######################################## ########################################
@@ -605,6 +609,24 @@ interface(`ssh_domtrans',` @@ -605,6 +613,24 @@ interface(`ssh_domtrans',`
######################################## ########################################
## <summary> ## <summary>
@ -29219,7 +29224,7 @@ index fe0c682..d55811f 100644
## Execute the ssh client in the caller domain. ## Execute the ssh client in the caller domain.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -637,7 +659,7 @@ interface(`ssh_setattr_key_files',` @@ -637,7 +663,7 @@ interface(`ssh_setattr_key_files',`
type sshd_key_t; type sshd_key_t;
') ')
@ -29228,7 +29233,7 @@ index fe0c682..d55811f 100644
files_search_pids($1) files_search_pids($1)
') ')
@@ -662,6 +684,42 @@ interface(`ssh_agent_exec',` @@ -662,6 +688,42 @@ interface(`ssh_agent_exec',`
######################################## ########################################
## <summary> ## <summary>
@ -29271,7 +29276,7 @@ index fe0c682..d55811f 100644
## Read ssh home directory content ## Read ssh home directory content
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -701,6 +759,68 @@ interface(`ssh_domtrans_keygen',` @@ -701,6 +763,68 @@ interface(`ssh_domtrans_keygen',`
######################################## ########################################
## <summary> ## <summary>
@ -29340,7 +29345,7 @@ index fe0c682..d55811f 100644
## Read ssh server keys ## Read ssh server keys
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -714,7 +834,26 @@ interface(`ssh_dontaudit_read_server_keys',` @@ -714,7 +838,26 @@ interface(`ssh_dontaudit_read_server_keys',`
type sshd_key_t; type sshd_key_t;
') ')
@ -29368,7 +29373,7 @@ index fe0c682..d55811f 100644
') ')
###################################### ######################################
@@ -754,3 +893,151 @@ interface(`ssh_delete_tmp',` @@ -754,3 +897,151 @@ interface(`ssh_delete_tmp',`
files_search_tmp($1) files_search_tmp($1)
delete_files_pattern($1, sshd_tmp_t, sshd_tmp_t) delete_files_pattern($1, sshd_tmp_t, sshd_tmp_t)
') ')

9
policy-rawhide-contrib.patch
View File

@ -589,7 +589,7 @@ index 058d908..ee0c559 100644
+') +')
+ +
diff --git a/abrt.te b/abrt.te diff --git a/abrt.te b/abrt.te
index eb50f07..d53d1e0 100644 index eb50f07..def23ab 100644
--- a/abrt.te --- a/abrt.te
+++ b/abrt.te +++ b/abrt.te
@@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1) @@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1)
@ -1048,7 +1048,7 @@ index eb50f07..d53d1e0 100644
allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms; allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms;
domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t) domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t)
@@ -365,38 +470,79 @@ corecmd_exec_shell(abrt_retrace_worker_t) @@ -365,38 +470,80 @@ corecmd_exec_shell(abrt_retrace_worker_t)
dev_read_urand(abrt_retrace_worker_t) dev_read_urand(abrt_retrace_worker_t)
@ -1100,6 +1100,7 @@ index eb50f07..d53d1e0 100644
+auth_read_passwd(abrt_dump_oops_t) +auth_read_passwd(abrt_dump_oops_t)
+ +
+corecmd_getattr_all_executables(abrt_dump_oops_t) +corecmd_getattr_all_executables(abrt_dump_oops_t)
+corecmd_exec_bin(abrt_dump_oops_t)
+ +
+dev_read_urand(abrt_dump_oops_t) +dev_read_urand(abrt_dump_oops_t)
+dev_read_rand(abrt_dump_oops_t) +dev_read_rand(abrt_dump_oops_t)
@ -1132,7 +1133,7 @@ index eb50f07..d53d1e0 100644
####################################### #######################################
# #
@@ -404,25 +550,60 @@ logging_read_generic_logs(abrt_dump_oops_t) @@ -404,25 +551,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
# #
allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms; allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms;
@ -1195,7 +1196,7 @@ index eb50f07..d53d1e0 100644
') ')
####################################### #######################################
@@ -430,10 +611,7 @@ tunable_policy(`abrt_upload_watch_anon_write',` @@ -430,10 +612,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
# Global local policy # Global local policy
# #

6
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.13.1 Version: 3.13.1
Release: 237%{?dist} Release: 238%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -675,6 +675,10 @@ exit 0
%endif %endif
%changelog %changelog
* Thu Feb 09 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-238
- Allow shiftfs to use xattr SELinux labels
- Fix ssh_server_template by add sshd_t to require section.
* Wed Feb 08 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-237 * Wed Feb 08 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-237
- Merge pull request #187 from rhatdan/container-selinux - Merge pull request #187 from rhatdan/container-selinux
- Allow rhsmcertd domain signull kernel. - Allow rhsmcertd domain signull kernel.