rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Wed Mar 12 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-34 

- Add install_t for anaconda
This commit is contained in:
Miroslav Grepl 2014-03-12 20:45:39 +01:00
parent ab84f40064
commit 695bbc81ea
3 changed files with 187 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
policy-rawhide-base.patch
View File

@ -20087,10 +20087,10 @@ index 0000000..b1163a6
+')
diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
new file mode 100644
index 0000000..f5bbd82
index 0000000..a3fe7f6
--- /dev/null
+++ b/policy/modules/roles/unconfineduser.te
@@ -0,0 +1,336 @@
@@ -0,0 +1,340 @@
+policy_module(unconfineduser, 1.0.0)
+
+########################################
@ -20366,6 +20366,10 @@ index 0000000..f5bbd82
+')
+
+optional_policy(`
+ anaconda_run_install(unconfined_t, unconfined_r)
+')
+
+optional_policy(`
+ java_run_unconfined(unconfined_t, unconfined_r)
+')
+

224
policy-rawhide-contrib.patch
View File

@ -2308,8 +2308,76 @@ index 16d0d66..60abfd0 100644
optional_policy(`
nscd_dontaudit_search_pid(amtu_t)
diff --git a/anaconda.fc b/anaconda.fc
index b098089..b2c4d10 100644
--- a/anaconda.fc
+++ b/anaconda.fc
@@ -1 +1,4 @@
# No file context specifications.
+
+/usr/libexec/anaconda/anaconda-yum -- gen_context(system_u:object_r:install_exec_t,s0)
+/usr/sbin/anaconda -- gen_context(system_u:object_r:install_exec_t,s0)
diff --git a/anaconda.if b/anaconda.if
index 14a61b7..21bbf36 100644
--- a/anaconda.if
+++ b/anaconda.if
@@ -1 +1,54 @@
## <summary>Anaconda installer.</summary>
+
+########################################
+## <summary>
+## Execute a domain transition to run install.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`anaconda_domtrans_install',`
+ gen_require(`
+ type install_t, install_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ domtrans_pattern($1, install_exec_t, install_t)
+')
+
+########################################
+## <summary>
+## Execute install in the install
+## domain, and allow the specified
+## role the install domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## Role allowed access.
+## </summary>
+## </param>
+#
+interface(`anaconda_run_install',`
+ gen_require(`
+ type install_t;
+ type install_exec_t;
+ attribute_role install_roles;
+ ')
+
+ anaconda_domtrans_install($1)
+ roleattribute $2 install_roles;
+ role_transition $2 install_exec_t system_r;
+
+ optional_policy(`
+ rpm_transition_script(install_t, $2)
+ ')
+')
+
diff --git a/anaconda.te b/anaconda.te
index aa44abf..16a6342 100644
index aa44abf..13ba56c 100644
--- a/anaconda.te
+++ b/anaconda.te
@@ -4,6 +4,10 @@ gen_require(`
@ -2323,7 +2391,22 @@ index aa44abf..16a6342 100644
########################################
#
# Declarations
@@ -34,8 +38,9 @@ modutils_domtrans_insmod(anaconda_t)
@@ -16,6 +20,14 @@ domain_entry_file(anaconda_t, anaconda_exec_t)
domain_obj_id_change_exemption(anaconda_t)
role system_r types anaconda_t;
+attribute_role install_roles;
+roleattribute system_r install_roles;
+
+type install_t;
+type install_exec_t;
+application_domain(install_t, install_exec_t)
+role install_roles types install_t;
+
########################################
#
# Local policy
@@ -34,8 +46,9 @@ modutils_domtrans_insmod(anaconda_t)
modutils_domtrans_depmod(anaconda_t)
seutil_domtrans_semanage(anaconda_t)
@ -2334,6 +2417,39 @@ index aa44abf..16a6342 100644
optional_policy(`
rpm_domtrans(anaconda_t)
@@ -53,3 +66,32 @@ optional_policy(`
optional_policy(`
unconfined_domain_noaudit(anaconda_t)
')
+
+########################################
+#
+# Local policy
+#
+
+allow install_t self:capability2 mac_admin;
+
+tunable_policy(`deny_ptrace',`',`
+ domain_ptrace_all_domains(install_t)
+')
+
+optional_policy(`
+ mount_run(install_t, install_roles)
+')
+
+optional_policy(`
+ networkmanager_dbus_chat(install_t)
+')
+
+optional_policy(`
+ seutil_run_setfiles_mac(install_t, install_roles)
+')
+
+optional_policy(`
+ unconfined_domain_noaudit(install_t)
+')
+
+
diff --git a/antivirus.fc b/antivirus.fc
new file mode 100644
index 0000000..219f32d
@ -81851,7 +81967,7 @@ index 7fb75f4..27f5e22 100644
+userdom_getattr_user_terminals(rwho_t)
+
diff --git a/samba.fc b/samba.fc
index b8b66ff..d1fa967 100644
index b8b66ff..a93346e 100644
--- a/samba.fc
+++ b/samba.fc
@@ -1,42 +1,55 @@
@ -81945,7 +82061,7 @@ index b8b66ff..d1fa967 100644
+/var/run/samba/winbindd(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0)
+/var/run/winbindd(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0)
+
+/var/spool/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0)
+/var/spool/samba(/.*)? gen_context(system_u:object_r:samba_spool_t,s0)
-/var/spool/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0)
+ifndef(`enable_mls',`
@ -82696,7 +82812,7 @@ index 50d07fb..bada62f 100644
+ allow $1 samba_unit_file_t:service all_service_perms;
')
diff --git a/samba.te b/samba.te
index 2b7c441..706b3a4 100644
index 2b7c441..c80c3f6 100644
--- a/samba.te
+++ b/samba.te
@@ -6,100 +6,80 @@ policy_module(samba, 1.16.3)
@ -82854,7 +82970,16 @@ index 2b7c441..706b3a4 100644
type samba_net_tmp_t;
files_tmp_file(samba_net_tmp_t)
@@ -136,7 +119,7 @@ files_type(samba_var_t)
@@ -130,13 +113,16 @@ files_type(samba_secrets_t)
type samba_share_t; # customizable
files_type(samba_share_t)
+type samba_spool_t;
+files_type(samba_spool_t)
+
type samba_var_t;
files_type(samba_var_t)
type smbcontrol_t;
type smbcontrol_exec_t;
application_domain(smbcontrol_t, smbcontrol_exec_t)
@ -82863,7 +82988,7 @@ index 2b7c441..706b3a4 100644
type smbd_t;
type smbd_exec_t;
@@ -148,13 +131,17 @@ files_type(smbd_keytab_t)
@@ -148,13 +134,17 @@ files_type(smbd_keytab_t)
type smbd_tmp_t;
files_tmp_file(smbd_tmp_t)
@ -82883,7 +83008,7 @@ index 2b7c441..706b3a4 100644
type swat_t;
type swat_exec_t;
@@ -173,28 +160,29 @@ type winbind_exec_t;
@@ -173,28 +163,29 @@ type winbind_exec_t;
init_daemon_domain(winbind_t, winbind_exec_t)
type winbind_helper_t;
@ -82921,7 +83046,7 @@ index 2b7c441..706b3a4 100644
allow samba_net_t samba_etc_t:file read_file_perms;
@@ -210,17 +198,22 @@ manage_files_pattern(samba_net_t, samba_var_t, samba_var_t)
@@ -210,17 +201,22 @@ manage_files_pattern(samba_net_t, samba_var_t, samba_var_t)
manage_lnk_files_pattern(samba_net_t, samba_var_t, samba_var_t)
files_var_filetrans(samba_net_t, samba_var_t, dir, "samba")
@ -82948,7 +83073,7 @@ index 2b7c441..706b3a4 100644
dev_read_urand(samba_net_t)
@@ -233,15 +226,16 @@ auth_manage_cache(samba_net_t)
@@ -233,15 +229,16 @@ auth_manage_cache(samba_net_t)
logging_send_syslog_msg(samba_net_t)
@ -82969,7 +83094,7 @@ index 2b7c441..706b3a4 100644
')
optional_policy(`
@@ -249,46 +243,58 @@ optional_policy(`
@@ -249,46 +246,58 @@ optional_policy(`
')
optional_policy(`
@ -83040,10 +83165,17 @@ index 2b7c441..706b3a4 100644
manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t)
allow smbd_t samba_share_t:filesystem { getattr quotaget };
@@ -298,65 +304,64 @@ manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t)
@@ -298,65 +307,71 @@ manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t)
manage_sock_files_pattern(smbd_t, samba_var_t, samba_var_t)
files_var_filetrans(smbd_t, samba_var_t, dir, "samba")
+manage_dirs_pattern(smbd_t, samba_spool_t, samba_spool_t)
+manage_files_pattern(smbd_t, samba_spool_t, samba_spool_t)
+manage_lnk_files_pattern(smbd_t, samba_spool_t, samba_spool_t)
+manage_sock_files_pattern(smbd_t, samba_spool_t, samba_spool_t)
+files_spool_filetrans(smbd_t, samba_spool_t, dir, "samba")
+
+
+allow smbd_t smbcontrol_t:process { signal signull };
+
manage_dirs_pattern(smbd_t, smbd_tmp_t, smbd_tmp_t)
@ -83129,7 +83261,7 @@ index 2b7c441..706b3a4 100644
fs_getattr_all_fs(smbd_t)
fs_getattr_all_dirs(smbd_t)
@@ -366,44 +371,53 @@ fs_getattr_rpc_dirs(smbd_t)
@@ -366,44 +381,53 @@ fs_getattr_rpc_dirs(smbd_t)
fs_list_inotifyfs(smbd_t)
fs_get_all_fs_quotas(smbd_t)
@ -83195,7 +83327,7 @@ index 2b7c441..706b3a4 100644
')
tunable_policy(`samba_domain_controller',`
@@ -419,20 +433,10 @@ tunable_policy(`samba_domain_controller',`
@@ -419,20 +443,10 @@ tunable_policy(`samba_domain_controller',`
')
tunable_policy(`samba_enable_home_dirs',`
@ -83218,7 +83350,7 @@ index 2b7c441..706b3a4 100644
tunable_policy(`samba_share_nfs',`
fs_manage_nfs_dirs(smbd_t)
fs_manage_nfs_files(smbd_t)
@@ -441,6 +445,7 @@ tunable_policy(`samba_share_nfs',`
@@ -441,6 +455,7 @@ tunable_policy(`samba_share_nfs',`
fs_manage_nfs_named_sockets(smbd_t)
')
@ -83226,7 +83358,7 @@ index 2b7c441..706b3a4 100644
tunable_policy(`samba_share_fusefs',`
fs_manage_fusefs_dirs(smbd_t)
fs_manage_fusefs_files(smbd_t)
@@ -448,17 +453,6 @@ tunable_policy(`samba_share_fusefs',`
@@ -448,17 +463,6 @@ tunable_policy(`samba_share_fusefs',`
fs_search_fusefs(smbd_t)
')
@ -83244,7 +83376,7 @@ index 2b7c441..706b3a4 100644
optional_policy(`
ccs_read_config(smbd_t)
')
@@ -466,6 +460,7 @@ optional_policy(`
@@ -466,6 +470,7 @@ optional_policy(`
optional_policy(`
ctdbd_stream_connect(smbd_t)
ctdbd_manage_lib_files(smbd_t)
@ -83252,7 +83384,7 @@ index 2b7c441..706b3a4 100644
')
optional_policy(`
@@ -479,6 +474,11 @@ optional_policy(`
@@ -479,6 +484,11 @@ optional_policy(`
')
optional_policy(`
@ -83264,7 +83396,7 @@ index 2b7c441..706b3a4 100644
lpd_exec_lpr(smbd_t)
')
@@ -488,6 +488,10 @@ optional_policy(`
@@ -488,6 +498,10 @@ optional_policy(`
')
optional_policy(`
@ -83275,7 +83407,7 @@ index 2b7c441..706b3a4 100644
rpc_search_nfs_state_data(smbd_t)
')
@@ -499,9 +503,36 @@ optional_policy(`
@@ -499,9 +513,36 @@ optional_policy(`
udev_read_db(smbd_t)
')
@ -83313,7 +83445,7 @@ index 2b7c441..706b3a4 100644
#
dontaudit nmbd_t self:capability sys_tty_config;
@@ -512,9 +543,11 @@ allow nmbd_t self:msg { send receive };
@@ -512,9 +553,11 @@ allow nmbd_t self:msg { send receive };
allow nmbd_t self:msgq create_msgq_perms;
allow nmbd_t self:sem create_sem_perms;
allow nmbd_t self:shm create_shm_perms;
@ -83328,7 +83460,7 @@ index 2b7c441..706b3a4 100644
manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t)
manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t)
@@ -526,20 +559,15 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
@@ -526,20 +569,15 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t)
@ -83352,7 +83484,7 @@ index 2b7c441..706b3a4 100644
kernel_getattr_core_if(nmbd_t)
kernel_getattr_message_if(nmbd_t)
@@ -548,52 +576,42 @@ kernel_read_network_state(nmbd_t)
@@ -548,52 +586,42 @@ kernel_read_network_state(nmbd_t)
kernel_read_software_raid_state(nmbd_t)
kernel_read_system_state(nmbd_t)
@ -83401,14 +83533,14 @@ index 2b7c441..706b3a4 100644
-
userdom_use_unpriv_users_fds(nmbd_t)
-userdom_user_home_dir_filetrans_user_home_content(nmbd_t, { file dir })
+userdom_dontaudit_search_user_home_dirs(nmbd_t)
-
-tunable_policy(`samba_export_all_ro',`
- fs_read_noxattr_fs_files(nmbd_t)
- files_list_non_auth_dirs(nmbd_t)
- files_read_non_auth_files(nmbd_t)
-')
-
+userdom_dontaudit_search_user_home_dirs(nmbd_t)
-tunable_policy(`samba_export_all_rw',`
- fs_read_noxattr_fs_files(nmbd_t)
- files_manage_non_auth_files(nmbd_t)
@ -83419,7 +83551,7 @@ index 2b7c441..706b3a4 100644
')
optional_policy(`
@@ -606,16 +624,22 @@ optional_policy(`
@@ -606,16 +634,22 @@ optional_policy(`
########################################
#
@ -83446,7 +83578,7 @@ index 2b7c441..706b3a4 100644
manage_files_pattern(smbcontrol_t, samba_var_t, samba_var_t)
@@ -627,16 +651,11 @@ domain_use_interactive_fds(smbcontrol_t)
@@ -627,16 +661,11 @@ domain_use_interactive_fds(smbcontrol_t)
dev_read_urand(smbcontrol_t)
@ -83464,7 +83596,7 @@ index 2b7c441..706b3a4 100644
optional_policy(`
ctdbd_stream_connect(smbcontrol_t)
@@ -644,22 +663,23 @@ optional_policy(`
@@ -644,22 +673,23 @@ optional_policy(`
########################################
#
@ -83496,7 +83628,7 @@ index 2b7c441..706b3a4 100644
allow smbmount_t samba_secrets_t:file manage_file_perms;
@@ -668,26 +688,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t)
@@ -668,26 +698,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t)
manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t)
files_var_filetrans(smbmount_t, samba_var_t, dir, "samba")
@ -83532,7 +83664,7 @@ index 2b7c441..706b3a4 100644
fs_getattr_cifs(smbmount_t)
fs_mount_cifs(smbmount_t)
@@ -699,58 +715,77 @@ fs_read_cifs_files(smbmount_t)
@@ -699,58 +725,77 @@ fs_read_cifs_files(smbmount_t)
storage_raw_read_fixed_disk(smbmount_t)
storage_raw_write_fixed_disk(smbmount_t)
@ -83584,13 +83716,13 @@ index 2b7c441..706b3a4 100644
-allow swat_t { nmbd_t smbd_t }:process { signal signull };
+samba_domtrans_smbd(swat_t)
+allow swat_t smbd_t:process { signal signull };
-allow swat_t smbd_var_run_t:file read_file_perms;
-allow swat_t smbd_var_run_t:file { lock delete_file_perms };
+
+samba_domtrans_nmbd(swat_t)
+allow swat_t nmbd_t:process { signal signull };
+allow nmbd_t swat_t:process signal;
+
-allow swat_t smbd_var_run_t:file read_file_perms;
-allow swat_t smbd_var_run_t:file { lock delete_file_perms };
+read_files_pattern(swat_t, nmbd_var_run_t, nmbd_var_run_t)
+stream_connect_pattern(swat_t, nmbd_var_run_t, nmbd_var_run_t, nmbd_t)
+
@ -83624,7 +83756,7 @@ index 2b7c441..706b3a4 100644
manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t)
manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t)
@@ -759,17 +794,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir })
@@ -759,17 +804,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir })
manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t)
files_pid_filetrans(swat_t, swat_var_run_t, file)
@ -83648,7 +83780,7 @@ index 2b7c441..706b3a4 100644
kernel_read_kernel_sysctls(swat_t)
kernel_read_system_state(swat_t)
@@ -777,36 +808,25 @@ kernel_read_network_state(swat_t)
@@ -777,36 +818,25 @@ kernel_read_network_state(swat_t)
corecmd_search_bin(swat_t)
@ -83691,7 +83823,7 @@ index 2b7c441..706b3a4 100644
auth_domtrans_chk_passwd(swat_t)
auth_use_nsswitch(swat_t)
@@ -818,10 +838,11 @@ logging_send_syslog_msg(swat_t)
@@ -818,10 +848,11 @@ logging_send_syslog_msg(swat_t)
logging_send_audit_msgs(swat_t)
logging_search_logs(swat_t)
@ -83705,7 +83837,7 @@ index 2b7c441..706b3a4 100644
optional_policy(`
cups_read_rw_config(swat_t)
cups_stream_connect(swat_t)
@@ -840,17 +861,20 @@ optional_policy(`
@@ -840,17 +871,20 @@ optional_policy(`
# Winbind local policy
#
@ -83731,7 +83863,7 @@ index 2b7c441..706b3a4 100644
allow winbind_t samba_etc_t:dir list_dir_perms;
read_files_pattern(winbind_t, samba_etc_t, samba_etc_t)
@@ -860,9 +884,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t)
@@ -860,9 +894,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t)
filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file)
manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t)
@ -83742,7 +83874,7 @@ index 2b7c441..706b3a4 100644
manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t)
manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t)
@@ -873,23 +895,21 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba")
@@ -873,23 +905,21 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba")
rw_files_pattern(winbind_t, smbd_tmp_t, smbd_tmp_t)
@ -83772,7 +83904,7 @@ index 2b7c441..706b3a4 100644
manage_sock_files_pattern(winbind_t, smbd_var_run_t, smbd_var_run_t)
kernel_read_network_state(winbind_t)
@@ -898,13 +918,17 @@ kernel_read_system_state(winbind_t)
@@ -898,13 +928,17 @@ kernel_read_system_state(winbind_t)
corecmd_exec_bin(winbind_t)
@ -83793,7 +83925,7 @@ index 2b7c441..706b3a4 100644
corenet_tcp_connect_smbd_port(winbind_t)
corenet_tcp_connect_epmap_port(winbind_t)
corenet_tcp_connect_all_unreserved_ports(winbind_t)
@@ -912,10 +936,6 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t)
@@ -912,10 +946,6 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t)
dev_read_sysfs(winbind_t)
dev_read_urand(winbind_t)
@ -83804,7 +83936,7 @@ index 2b7c441..706b3a4 100644
fs_getattr_all_fs(winbind_t)
fs_search_auto_mountpoints(winbind_t)
@@ -924,26 +944,39 @@ auth_domtrans_chk_passwd(winbind_t)
@@ -924,26 +954,39 @@ auth_domtrans_chk_passwd(winbind_t)
auth_use_nsswitch(winbind_t)
auth_manage_cache(winbind_t)
@ -83846,7 +83978,7 @@ index 2b7c441..706b3a4 100644
')
optional_policy(`
@@ -959,31 +992,29 @@ optional_policy(`
@@ -959,31 +1002,29 @@ optional_policy(`
# Winbind helper local policy
#
@ -83884,7 +84016,7 @@ index 2b7c441..706b3a4 100644
optional_policy(`
apache_append_log(winbind_helper_t)
@@ -997,25 +1028,38 @@ optional_policy(`
@@ -997,25 +1038,38 @@ optional_policy(`
########################################
#

3
selinux-policy.spec
View File

@ -580,6 +580,9 @@ SELinux Reference policy mls base module.
%endif
%changelog
* Wed Mar 12 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-34
- Add install_t for anaconda
* Wed Mar 12 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-33
- Allow init_t to stream connect to ipsec
- Add /usr/lib/systemd/systemd-networkd policy