* Mon Jan 18 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-167
- Add fwupd policy for daemon to allow session software to update device firmware - Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t. BZ(1289930) - Allow systemd services to use PrivateNetwork feature - Add a type and genfscon for nsfs. - Fix SELinux context for rsyslog unit file. BZ(1284173)
This commit is contained in:
parent
3852fc17ea
commit
6d3ee17c0b
Binary file not shown.
File diff suppressed because it is too large
Load Diff
@ -29627,6 +29627,340 @@ index 36838c2..8bfc879 100644
|
|||||||
- fs_read_nfs_files(sftpd_t)
|
- fs_read_nfs_files(sftpd_t)
|
||||||
- fs_read_nfs_symlinks(ftpd_t)
|
- fs_read_nfs_symlinks(ftpd_t)
|
||||||
-')
|
-')
|
||||||
|
diff --git a/fwupd.fc b/fwupd.fc
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000..1f13f70
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/fwupd.fc
|
||||||
|
@@ -0,0 +1,8 @@
|
||||||
|
+/usr/lib/systemd/system/fwupd-offline-update.* -- gen_context(system_u:object_r:fwupd_unit_file_t,s0)
|
||||||
|
+/usr/lib/systemd/system/fwupd.* -- gen_context(system_u:object_r:fwupd_unit_file_t,s0)
|
||||||
|
+
|
||||||
|
+/usr/libexec/fwupd/fwupd -- gen_context(system_u:object_r:fwupd_exec_t,s0)
|
||||||
|
+
|
||||||
|
+/var/cache/app-info(/.*)? gen_context(system_u:object_r:fwupd_cache_t,s0)
|
||||||
|
+
|
||||||
|
+/var/lib/fwupd(/.*)? gen_context(system_u:object_r:fwupd_var_lib_t,s0)
|
||||||
|
diff --git a/fwupd.if b/fwupd.if
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000..c4d2c2d
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/fwupd.if
|
||||||
|
@@ -0,0 +1,260 @@
|
||||||
|
+
|
||||||
|
+## <summary>fwupd is a daemon to allow session software to update device firmware</summary>
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Execute fwupd_exec_t in the fwupd domain.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed to transition.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`fwupd_domtrans',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type fwupd_t, fwupd_exec_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ corecmd_search_bin($1)
|
||||||
|
+ domtrans_pattern($1, fwupd_exec_t, fwupd_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+######################################
|
||||||
|
+## <summary>
|
||||||
|
+## Execute fwupd in the caller domain.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`fwupd_exec',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type fwupd_exec_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ corecmd_search_bin($1)
|
||||||
|
+ can_exec($1, fwupd_exec_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Search fwupd cache directories.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`fwupd_search_cache',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type fwupd_cache_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ allow $1 fwupd_cache_t:dir search_dir_perms;
|
||||||
|
+ files_search_var($1)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Read fwupd cache files.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`fwupd_read_cache_files',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type fwupd_cache_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ files_search_var($1)
|
||||||
|
+ read_files_pattern($1, fwupd_cache_t, fwupd_cache_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Create, read, write, and delete
|
||||||
|
+## fwupd cache files.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`fwupd_manage_cache_files',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type fwupd_cache_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ files_search_var($1)
|
||||||
|
+ manage_files_pattern($1, fwupd_cache_t, fwupd_cache_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Manage fwupd cache dirs.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`fwupd_manage_cache_dirs',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type fwupd_cache_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ files_search_var($1)
|
||||||
|
+ manage_dirs_pattern($1, fwupd_cache_t, fwupd_cache_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Search fwupd lib directories.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`fwupd_search_lib',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type fwupd_var_lib_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ allow $1 fwupd_var_lib_t:dir search_dir_perms;
|
||||||
|
+ files_search_var_lib($1)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Read fwupd lib files.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`fwupd_read_lib_files',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type fwupd_var_lib_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ files_search_var_lib($1)
|
||||||
|
+ read_files_pattern($1, fwupd_var_lib_t, fwupd_var_lib_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Manage fwupd lib files.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`fwupd_manage_lib_files',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type fwupd_var_lib_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ files_search_var_lib($1)
|
||||||
|
+ manage_files_pattern($1, fwupd_var_lib_t, fwupd_var_lib_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Manage fwupd lib directories.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`fwupd_manage_lib_dirs',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type fwupd_var_lib_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ files_search_var_lib($1)
|
||||||
|
+ manage_dirs_pattern($1, fwupd_var_lib_t, fwupd_var_lib_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Execute fwupd server in the fwupd domain.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed to transition.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`fwupd_systemctl',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type fwupd_t;
|
||||||
|
+ type fwupd_unit_file_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ systemd_exec_systemctl($1)
|
||||||
|
+ systemd_read_fifo_file_passwd_run($1)
|
||||||
|
+ allow $1 fwupd_unit_file_t:file read_file_perms;
|
||||||
|
+ allow $1 fwupd_unit_file_t:service manage_service_perms;
|
||||||
|
+
|
||||||
|
+ ps_process_pattern($1, fwupd_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## All of the rules required to administrate
|
||||||
|
+## an fwupd environment
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`fwupd_admin',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type fwupd_t;
|
||||||
|
+ type fwupd_cache_t;
|
||||||
|
+ type fwupd_var_lib_t;
|
||||||
|
+ type fwupd_unit_file_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ allow $1 fwupd_t:process { signal_perms };
|
||||||
|
+ ps_process_pattern($1, fwupd_t)
|
||||||
|
+
|
||||||
|
+ tunable_policy(`deny_ptrace',`',`
|
||||||
|
+ allow $1 fwupd_t:process ptrace;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ files_search_var($1)
|
||||||
|
+ admin_pattern($1, fwupd_cache_t)
|
||||||
|
+
|
||||||
|
+ files_search_var_lib($1)
|
||||||
|
+ admin_pattern($1, fwupd_var_lib_t)
|
||||||
|
+
|
||||||
|
+ fwupd_systemctl($1)
|
||||||
|
+ admin_pattern($1, fwupd_unit_file_t)
|
||||||
|
+ allow $1 fwupd_unit_file_t:service all_service_perms;
|
||||||
|
+ optional_policy(`
|
||||||
|
+ systemd_passwd_agent_exec($1)
|
||||||
|
+ systemd_read_fifo_file_passwd_run($1)
|
||||||
|
+ ')
|
||||||
|
+')
|
||||||
|
diff --git a/fwupd.te b/fwupd.te
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000..8937282
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/fwupd.te
|
||||||
|
@@ -0,0 +1,48 @@
|
||||||
|
+policy_module(fwupd, 1.0.0)
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+#
|
||||||
|
+# Declarations
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+type fwupd_t;
|
||||||
|
+type fwupd_exec_t;
|
||||||
|
+init_daemon_domain(fwupd_t, fwupd_exec_t)
|
||||||
|
+
|
||||||
|
+type fwupd_cache_t;
|
||||||
|
+files_type(fwupd_cache_t)
|
||||||
|
+
|
||||||
|
+type fwupd_var_lib_t;
|
||||||
|
+files_type(fwupd_var_lib_t)
|
||||||
|
+
|
||||||
|
+type fwupd_unit_file_t;
|
||||||
|
+systemd_unit_file(fwupd_unit_file_t)
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+#
|
||||||
|
+# fwupd local policy
|
||||||
|
+#
|
||||||
|
+allow fwupd_t self:fifo_file rw_fifo_file_perms;
|
||||||
|
+allow fwupd_t self:unix_stream_socket create_stream_socket_perms;
|
||||||
|
+allow fwupd_t self:netlink_kobject_uevent_socket create_socket_perms;;
|
||||||
|
+
|
||||||
|
+manage_dirs_pattern(fwupd_t, fwupd_cache_t, fwupd_cache_t)
|
||||||
|
+manage_files_pattern(fwupd_t, fwupd_cache_t, fwupd_cache_t)
|
||||||
|
+manage_lnk_files_pattern(fwupd_t, fwupd_cache_t, fwupd_cache_t)
|
||||||
|
+files_var_filetrans(fwupd_t, fwupd_cache_t, { dir })
|
||||||
|
+
|
||||||
|
+manage_dirs_pattern(fwupd_t, fwupd_var_lib_t, fwupd_var_lib_t)
|
||||||
|
+manage_files_pattern(fwupd_t, fwupd_var_lib_t, fwupd_var_lib_t)
|
||||||
|
+manage_lnk_files_pattern(fwupd_t, fwupd_var_lib_t, fwupd_var_lib_t)
|
||||||
|
+files_var_lib_filetrans(fwupd_t, fwupd_var_lib_t, { dir })
|
||||||
|
+
|
||||||
|
+auth_read_passwd(fwupd_t)
|
||||||
|
+
|
||||||
|
+dev_rw_sysfs(fwupd_t)
|
||||||
|
+dev_rw_generic_usb_dev(fwupd_t)
|
||||||
|
+
|
||||||
|
+udev_read_pid_files(fwupd_t)
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
+ dbus_system_domain(fwupd_t,fwupd_exec_t)
|
||||||
|
+')
|
||||||
diff --git a/games.if b/games.if
|
diff --git a/games.if b/games.if
|
||||||
index e2a3e0d..50ebd40 100644
|
index e2a3e0d..50ebd40 100644
|
||||||
--- a/games.if
|
--- a/games.if
|
||||||
@ -37269,16 +37603,17 @@ index 0000000..61f2003
|
|||||||
+userdom_use_user_terminals(iotop_t)
|
+userdom_use_user_terminals(iotop_t)
|
||||||
diff --git a/ipa.fc b/ipa.fc
|
diff --git a/ipa.fc b/ipa.fc
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 0000000..3a71430
|
index 0000000..ce135f3
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/ipa.fc
|
+++ b/ipa.fc
|
||||||
@@ -0,0 +1,13 @@
|
@@ -0,0 +1,14 @@
|
||||||
+/usr/lib/systemd/system/ipa-otpd.* -- gen_context(system_u:object_r:ipa_otpd_unit_file_t,s0)
|
+/usr/lib/systemd/system/ipa-otpd.* -- gen_context(system_u:object_r:ipa_otpd_unit_file_t,s0)
|
||||||
+
|
+
|
||||||
+/usr/libexec/ipa-otpd -- gen_context(system_u:object_r:ipa_otpd_exec_t,s0)
|
+/usr/libexec/ipa-otpd -- gen_context(system_u:object_r:ipa_otpd_exec_t,s0)
|
||||||
+
|
+
|
||||||
+/usr/libexec/ipa/com\.redhat\.idm\.trust-fetch-domains -- gen_context(system_u:object_r:ipa_helper_exec_t,s0)
|
+/usr/libexec/ipa/com\.redhat\.idm\.trust-fetch-domains -- gen_context(system_u:object_r:ipa_helper_exec_t,s0)
|
||||||
+/usr/libexec/ipa/oddjob/com\.redhat\.idm\.trust-fetch-domains -- gen_context(system_u:object_r:ipa_helper_exec_t,s0)
|
+/usr/libexec/ipa/oddjob/com\.redhat\.idm\.trust-fetch-domains -- gen_context(system_u:object_r:ipa_helper_exec_t,s0)
|
||||||
|
+/usr/libexec/ipa/oddjob/org\.freeipa\.server\.conncheck -- gen_context(system_u:object_r:ipa_helper_exec_t,s0)
|
||||||
+
|
+
|
||||||
+/var/lib/ipa(/.*)? gen_context(system_u:object_r:ipa_var_lib_t,s0)
|
+/var/lib/ipa(/.*)? gen_context(system_u:object_r:ipa_var_lib_t,s0)
|
||||||
+
|
+
|
||||||
|
@ -19,7 +19,7 @@
|
|||||||
Summary: SELinux policy configuration
|
Summary: SELinux policy configuration
|
||||||
Name: selinux-policy
|
Name: selinux-policy
|
||||||
Version: 3.13.1
|
Version: 3.13.1
|
||||||
Release: 166%{?dist}
|
Release: 167%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: serefpolicy-%{version}.tgz
|
Source: serefpolicy-%{version}.tgz
|
||||||
@ -664,6 +664,13 @@ exit 0
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Mon Jan 18 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-167
|
||||||
|
- Add fwupd policy for daemon to allow session software to update device firmware
|
||||||
|
- Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t. BZ(1289930)
|
||||||
|
- Allow systemd services to use PrivateNetwork feature
|
||||||
|
- Add a type and genfscon for nsfs.
|
||||||
|
- Fix SELinux context for rsyslog unit file. BZ(1284173)
|
||||||
|
|
||||||
* Wed Jan 13 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-166
|
* Wed Jan 13 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-166
|
||||||
- Allow logrotate to systemctl rsyslog service. BZ(1284173)
|
- Allow logrotate to systemctl rsyslog service. BZ(1284173)
|
||||||
- Allow condor_master_t domain capability chown. BZ(1297048)
|
- Allow condor_master_t domain capability chown. BZ(1297048)
|
||||||
|
Loading…
Reference in New Issue
Block a user