From 74ec503d1c10481ee512c8fcb11060d4c1f50408 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Fri, 21 Feb 2014 17:01:54 +0100 Subject: [PATCH] - Add labeling for /usr/sbin/amavi - Colin asked for this program to be treated as cloud-init - Allow ftp services to manage xferlog_t - Fix vmtools policy to allow user roles to access vmtools_helper_t - Allow block_suspend cap2 for ipa-otpd - Allow certmonger to search home content - Allow pkcsslotd to read users state - Allow exim to use pam stack to check passwords - Add labeling for /usr/sbin/amavi - Colin asked for this program to be treated as cloud-init - Allow ftp services to manage xferlog_t - Fix vmtools policy to allow user roles to access vmtools_helper_t - Allow block_suspend cap2 for ipa-otpd - Allow certmonger to search home content - Allow pkcsslotd to read users state - Allow exim to use pam stack to check passwor --- policy-rawhide-base.patch | 19 ++++++------ policy-rawhide-contrib.patch | 59 ++++++++++++++++++++++-------------- selinux-policy.spec | 20 +++++++++++- 3 files changed, 66 insertions(+), 32 deletions(-) diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index 18fa17b1..1679ed19 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -22555,7 +22555,7 @@ index cc877c7..07f129b 100644 + xserver_rw_xdm_pipes(ssh_agent_type) +') diff --git a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc -index 8274418..abeb351 100644 +index 8274418..0069d82 100644 --- a/policy/modules/services/xserver.fc +++ b/policy/modules/services/xserver.fc @@ -2,13 +2,35 @@ @@ -22617,7 +22617,7 @@ index 8274418..abeb351 100644 /etc/X11/[wx]dm/Xreset.* -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0) -@@ -46,26 +76,32 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) +@@ -46,26 +76,33 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) # /tmp # @@ -22643,6 +22643,7 @@ index 8274418..abeb351 100644 -/usr/s?bin/[xkw]dm -- gen_context(system_u:object_r:xdm_exec_t,s0) +/usr/s?bin/[mxgkw]dm -- gen_context(system_u:object_r:xdm_exec_t,s0) + ++/usr/bin/sddm-greeter -- gen_context(system_u:object_r:xdm_exec_t,s0) /usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0) /usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0) +/usr/bin/razor-lightdm-.* -- gen_context(system_u:object_r:xdm_exec_t,s0) @@ -22656,7 +22657,7 @@ index 8274418..abeb351 100644 /usr/lib/qt-.*/etc/settings(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) -@@ -92,18 +128,31 @@ ifndef(`distro_debian',` +@@ -92,18 +129,31 @@ ifndef(`distro_debian',` /var/lib/gdm(3)?(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0) /var/lib/lxdm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0) @@ -22692,7 +22693,7 @@ index 8274418..abeb351 100644 /var/run/xdm\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0) /var/run/lxdm\.auth -- gen_context(system_u:object_r:xdm_var_run_t,s0) /var/run/lxdm\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0) -@@ -112,6 +161,16 @@ ifndef(`distro_debian',` +@@ -112,6 +162,16 @@ ifndef(`distro_debian',` /var/run/xauth(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) /var/run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) @@ -40629,7 +40630,7 @@ index 0abaf84..8b34dbc 100644 -/usr/lib/openoffice/program/[^/]+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) -') diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if -index 5ca20a9..7bbabfc 100644 +index 5ca20a9..e749152 100644 --- a/policy/modules/system/unconfined.if +++ b/policy/modules/system/unconfined.if @@ -12,53 +12,57 @@ @@ -41133,14 +41134,14 @@ index 5ca20a9..7bbabfc 100644 gen_require(` - type unconfined_t; - class dbus send_msg; -+ type unconfined_server_t; ++ type unconfined_service_t; ') - allow $1 unconfined_t:dbus send_msg; - allow unconfined_t $1:dbus send_msg; + files_search_pids($1) + files_write_generic_pid_pipes($1) -+ allow $1 unconfined_server_t:unix_stream_socket { getattr connectto }; ++ allow $1 unconfined_service_t:unix_stream_socket { getattr connectto }; ') ######################################## @@ -41160,11 +41161,11 @@ index 5ca20a9..7bbabfc 100644 gen_require(` - type unconfined_t; - class dbus acquire_svc; -+ type unconfined_server_t; ++ type unconfined_service_t; ') - allow $1 unconfined_t:dbus acquire_svc; -+ corecmd_bin_domtrans($1, unconfined_server_t) ++ corecmd_bin_domtrans($1, unconfined_service_t) ') diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te index 5fe902d..fe042f9 100644 diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index 1beefa12..1c6e10cb 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -10747,7 +10747,7 @@ index 008f8ef..144c074 100644 admin_pattern($1, certmonger_var_run_t) ') diff --git a/certmonger.te b/certmonger.te -index 550b287..8dd67f1 100644 +index 550b287..6f366b4 100644 --- a/certmonger.te +++ b/certmonger.te @@ -18,6 +18,9 @@ files_type(certmonger_var_lib_t) @@ -10809,16 +10809,16 @@ index 550b287..8dd67f1 100644 files_list_tmp(certmonger_t) fs_search_cgroup_dirs(certmonger_t) -@@ -70,16 +83,17 @@ init_getattr_all_script_files(certmonger_t) +@@ -70,16 +83,18 @@ init_getattr_all_script_files(certmonger_t) logging_send_syslog_msg(certmonger_t) -miscfiles_read_localization(certmonger_t) miscfiles_manage_generic_cert_files(certmonger_t) --userdom_search_user_home_content(certmonger_t) +systemd_exec_systemctl(certmonger_t) + + userdom_search_user_home_content(certmonger_t) +userdom_manage_home_certs(certmonger_t) optional_policy(` @@ -10830,7 +10830,7 @@ index 550b287..8dd67f1 100644 ') optional_policy(` -@@ -92,11 +106,47 @@ optional_policy(` +@@ -92,11 +107,47 @@ optional_policy(` ') optional_policy(` @@ -12310,14 +12310,15 @@ index 4a5b3d1..cd146bd 100644 ') diff --git a/cloudform.fc b/cloudform.fc new file mode 100644 -index 0000000..51990d0 +index 0000000..6cc6774 --- /dev/null +++ b/cloudform.fc -@@ -0,0 +1,27 @@ +@@ -0,0 +1,28 @@ +/etc/rc\.d/init\.d/iwhd -- gen_context(system_u:object_r:iwhd_initrc_exec_t,s0) +/etc/rc\.d/init\.d/mongod -- gen_context(system_u:object_r:mongod_initrc_exec_t,s0) + +/usr/bin/cloud-init -- gen_context(system_u:object_r:cloud_init_exec_t,s0) ++/usr/libexec/min-metadata-service -- gen_context(system_u:object_r:cloud_init_exec_t,s0) +/usr/bin/deltacloudd -- gen_context(system_u:object_r:deltacloudd_exec_t,s0) +/usr/bin/iwhd -- gen_context(system_u:object_r:iwhd_exec_t,s0) +/usr/bin/mongod -- gen_context(system_u:object_r:mongod_exec_t,s0) @@ -26847,7 +26848,7 @@ index 4498143..77bbcef 100644 ftp_run_ftpdctl($1, $2) ') diff --git a/ftp.te b/ftp.te -index 36838c2..34b08ac 100644 +index 36838c2..a09e8b2 100644 --- a/ftp.te +++ b/ftp.te @@ -13,7 +13,7 @@ policy_module(ftp, 1.15.1) @@ -26913,7 +26914,18 @@ index 36838c2..34b08ac 100644 manage_dirs_pattern(ftpd_t, ftpd_tmpfs_t, ftpd_tmpfs_t) manage_files_pattern(ftpd_t, ftpd_tmpfs_t, ftpd_tmpfs_t) manage_lnk_files_pattern(ftpd_t, ftpd_tmpfs_t, ftpd_tmpfs_t) -@@ -206,14 +219,13 @@ logging_log_filetrans(ftpd_t, xferlog_t, file) +@@ -198,22 +211,19 @@ files_pid_filetrans(ftpd_t, ftpd_var_run_t, { file dir }) + + allow ftpd_t ftpdctl_tmp_t:sock_file delete_sock_file_perms; + +-allow ftpd_t xferlog_t:dir setattr_dir_perms; +-append_files_pattern(ftpd_t, xferlog_t, xferlog_t) +-create_files_pattern(ftpd_t, xferlog_t, xferlog_t) +-setattr_files_pattern(ftpd_t, xferlog_t, xferlog_t) +-logging_log_filetrans(ftpd_t, xferlog_t, file) ++manage_dirs_pattern(ftpd_t, xferlog_t, xferlog_t) ++manage_files_pattern(ftpd_t, xferlog_t, xferlog_t) ++logging_log_filetrans(ftpd_t, xferlog_t, { dir file }) kernel_read_kernel_sysctls(ftpd_t) kernel_read_system_state(ftpd_t) @@ -26929,7 +26941,7 @@ index 36838c2..34b08ac 100644 corenet_all_recvfrom_netlabel(ftpd_t) corenet_tcp_sendrecv_generic_if(ftpd_t) corenet_udp_sendrecv_generic_if(ftpd_t) -@@ -229,9 +241,12 @@ corenet_tcp_bind_ftp_port(ftpd_t) +@@ -229,9 +239,12 @@ corenet_tcp_bind_ftp_port(ftpd_t) corenet_sendrecv_ftp_data_server_packets(ftpd_t) corenet_tcp_bind_ftp_data_port(ftpd_t) @@ -26943,7 +26955,7 @@ index 36838c2..34b08ac 100644 files_read_etc_runtime_files(ftpd_t) files_search_var_lib(ftpd_t) -@@ -250,7 +265,6 @@ logging_send_audit_msgs(ftpd_t) +@@ -250,7 +263,6 @@ logging_send_audit_msgs(ftpd_t) logging_send_syslog_msg(ftpd_t) logging_set_loginuid(ftpd_t) @@ -26951,7 +26963,7 @@ index 36838c2..34b08ac 100644 miscfiles_read_public_files(ftpd_t) seutil_dontaudit_search_config(ftpd_t) -@@ -259,32 +273,50 @@ sysnet_use_ldap(ftpd_t) +@@ -259,32 +271,50 @@ sysnet_use_ldap(ftpd_t) userdom_dontaudit_use_unpriv_user_fds(ftpd_t) userdom_dontaudit_search_user_home_dirs(ftpd_t) @@ -27009,7 +27021,7 @@ index 36838c2..34b08ac 100644 ') tunable_policy(`ftpd_use_passive_mode',` -@@ -304,22 +336,19 @@ tunable_policy(`ftpd_connect_db',` +@@ -304,22 +334,19 @@ tunable_policy(`ftpd_connect_db',` corenet_sendrecv_mssql_client_packets(ftpd_t) corenet_tcp_connect_mssql_port(ftpd_t) corenet_tcp_sendrecv_mssql_port(ftpd_t) @@ -27037,7 +27049,7 @@ index 36838c2..34b08ac 100644 userdom_tmp_filetrans_user_tmp(ftpd_t, { dir file }) ') -@@ -363,9 +392,8 @@ optional_policy(` +@@ -363,9 +390,8 @@ optional_policy(` optional_policy(` selinux_validate_context(ftpd_t) @@ -27048,7 +27060,7 @@ index 36838c2..34b08ac 100644 kerberos_use(ftpd_t) ') -@@ -416,21 +444,20 @@ optional_policy(` +@@ -416,21 +442,20 @@ optional_policy(` # stream_connect_pattern(ftpdctl_t, ftpd_var_run_t, ftpd_var_run_t, ftpd_t) @@ -27072,7 +27084,7 @@ index 36838c2..34b08ac 100644 miscfiles_read_public_files(anon_sftpd_t) -@@ -443,23 +470,34 @@ tunable_policy(`sftpd_anon_write',` +@@ -443,23 +468,34 @@ tunable_policy(`sftpd_anon_write',` # Sftpd local policy # @@ -27113,7 +27125,7 @@ index 36838c2..34b08ac 100644 ') tunable_policy(`sftpd_enable_homedirs && use_nfs_home_dirs',` -@@ -481,21 +519,11 @@ tunable_policy(`sftpd_anon_write',` +@@ -481,21 +517,11 @@ tunable_policy(`sftpd_anon_write',` tunable_policy(`sftpd_full_access',` allow sftpd_t self:capability { dac_override dac_read_search }; fs_read_noxattr_fs_files(sftpd_t) @@ -33114,10 +33126,10 @@ index 0000000..deb738f + diff --git a/ipa.te b/ipa.te new file mode 100644 -index 0000000..589066e +index 0000000..0fd2678 --- /dev/null +++ b/ipa.te -@@ -0,0 +1,38 @@ +@@ -0,0 +1,40 @@ +policy_module(ipa, 1.0.0) + +######################################## @@ -33139,6 +33151,8 @@ index 0000000..589066e +# ipa_otpd local policy +# + ++allow ipa_otpd_t self:capability2 block_suspend; ++ +allow ipa_otpd_t self:fifo_file rw_fifo_file_perms; +allow ipa_otpd_t self:unix_stream_socket create_stream_socket_perms; + @@ -60638,7 +60652,7 @@ index 0000000..a989aea + +sysnet_read_config(piranha_domain) diff --git a/pkcs.te b/pkcs.te -index 8eb3f7b..7c08f64 100644 +index 8eb3f7b..1ff0fe3 100644 --- a/pkcs.te +++ b/pkcs.te @@ -7,21 +7,27 @@ policy_module(pkcs, 1.0.1) @@ -60669,7 +60683,7 @@ index 8eb3f7b..7c08f64 100644 files_tmpfs_file(pkcs_slotd_tmpfs_t) ######################################## -@@ -53,8 +59,5 @@ manage_dirs_pattern(pkcs_slotd_t, pkcs_slotd_tmpfs_t, pkcs_slotd_tmpfs_t) +@@ -53,8 +59,6 @@ manage_dirs_pattern(pkcs_slotd_t, pkcs_slotd_tmpfs_t, pkcs_slotd_tmpfs_t) manage_files_pattern(pkcs_slotd_t, pkcs_slotd_tmpfs_t, pkcs_slotd_tmpfs_t) fs_tmpfs_filetrans(pkcs_slotd_t, pkcs_slotd_tmpfs_t, dir) @@ -60678,6 +60692,7 @@ index 8eb3f7b..7c08f64 100644 logging_send_syslog_msg(pkcs_slotd_t) -miscfiles_read_localization(pkcs_slotd_t) ++userdom_read_all_users_state(pkcs_slotd_t) diff --git a/pki.fc b/pki.fc new file mode 100644 index 0000000..726d992 @@ -101457,7 +101472,7 @@ index 0000000..7933d80 +') diff --git a/vmtools.te b/vmtools.te new file mode 100644 -index 0000000..b881c53 +index 0000000..c47cb0e --- /dev/null +++ b/vmtools.te @@ -0,0 +1,82 @@ @@ -101480,7 +101495,7 @@ index 0000000..b881c53 +type vmtools_helper_t; +type vmtools_helper_exec_t; +application_domain(vmtools_helper_t, vmtools_helper_exec_t) -+role vmtools_helper_roles types vmtools_t; ++role vmtools_helper_roles types vmtools_helper_t; + +type vmtools_unit_file_t; +systemd_unit_file(vmtools_unit_file_t) diff --git a/selinux-policy.spec b/selinux-policy.spec index c19f68e0..ab2ad460 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 25%{?dist} +Release: 26%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -580,6 +580,24 @@ SELinux Reference policy mls base module. %endif %changelog +* Fri Feb 21 2014 Miroslav Grepl 3.13.1-26 +- Add labeling for /usr/sbin/amavi +- Colin asked for this program to be treated as cloud-init +- Allow ftp services to manage xferlog_t +- Fix vmtools policy to allow user roles to access vmtools_helper_t +- Allow block_suspend cap2 for ipa-otpd +- Allow certmonger to search home content +- Allow pkcsslotd to read users state +- Allow exim to use pam stack to check passwords +- Add labeling for /usr/sbin/amavi +- Colin asked for this program to be treated as cloud-init +- Allow ftp services to manage xferlog_t +- Fix vmtools policy to allow user roles to access vmtools_helper_t +- Allow block_suspend cap2 for ipa-otpd +- Allow certmonger to search home content +- Allow pkcsslotd to read users state +- Allow exim to use pam stack to check passwords + * Tue Feb 18 2014 Miroslav Grepl 3.13.1-25 - Add lvm_read_metadata() - Allow auditadm to search /var/log/audit dir