* Tue Oct 24 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-299
- Label /usr/libexec/bluetooth/obexd as bluetoothd_exec_t to run process as bluetooth_t - Allow chronyd_t do request kernel module and block_suspend capability - Allow system_cronjob_t to create /var/lib/letsencrypt dir with right label - Allow slapd_t domain to mmap files labeled as slpad_db_t BZ(1505414) - Allow dnssec_trigger_t domain to execute binaries with dnssec_trigeer_exec_t BZ(1487912) - Allow l2tpd_t domain to send SIGKILL to ipsec_mgmt_t domains BZ(1505220) - Allow thumb_t creating thumb_home_t files in user_home_dir_t direcotry BZ(1474110) - Allow httpd_t also read httpd_user_content_type dirs when httpd_enable_homedirs is enables - Allow svnserve to use kerberos - Allow conman to use ptmx. Add conman_use_nfs boolean - Allow nnp transition for amavis and tmpreaper SELinux domains - Allow chronyd_t to mmap chronyc_exec_t binary files - Add dac_read_search capability to openvswitch_t domain - Allow svnserve to manage own svnserve_log_t files/dirs - Allow keepalived_t to search network sysctls - Allow puppetagent_t domain dbus chat with rhsmcertd_t domain - Add kill capability to openvswitch_t domain - Label also compressed logs in /var/log for different services - Allow inetd_child_t and system_cronjob_t to run chronyc. - Allow chrony to create netlink route sockets - Add SELinux support for chronyc - Add support for running certbot(letsencrypt) in crontab - Allow nnp trasintion for unconfined_service_t - Allow unpriv user domains and unconfined_service_t to use chronyc
This commit is contained in:
parent
2fff8fe522
commit
7911257b23
Binary file not shown.
@ -27411,10 +27411,10 @@ index 000000000..bb9082586
|
|||||||
+
|
+
|
||||||
diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
|
diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 000000000..bdfe41b61
|
index 000000000..93d7f8839
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/policy/modules/roles/unconfineduser.te
|
+++ b/policy/modules/roles/unconfineduser.te
|
||||||
@@ -0,0 +1,363 @@
|
@@ -0,0 +1,367 @@
|
||||||
+policy_module(unconfineduser, 1.0.0)
|
+policy_module(unconfineduser, 1.0.0)
|
||||||
+
|
+
|
||||||
+########################################
|
+########################################
|
||||||
@ -27735,6 +27735,10 @@ index 000000000..bdfe41b61
|
|||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
|
+ chronyd_run_chronyc(unconfined_t, unconfined_r)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
+ oddjob_run_mkhomedir(unconfined_t, unconfined_r)
|
+ oddjob_run_mkhomedir(unconfined_t, unconfined_r)
|
||||||
+ oddjob_run(unconfined_t, unconfined_r)
|
+ oddjob_run(unconfined_t, unconfined_r)
|
||||||
+')
|
+')
|
||||||
@ -43463,7 +43467,7 @@ index 79048c410..d404d6528 100644
|
|||||||
udev_read_pid_files(lvm_t)
|
udev_read_pid_files(lvm_t)
|
||||||
')
|
')
|
||||||
diff --git a/policy/modules/system/miscfiles.fc b/policy/modules/system/miscfiles.fc
|
diff --git a/policy/modules/system/miscfiles.fc b/policy/modules/system/miscfiles.fc
|
||||||
index 9fe8e01e3..c62c76136 100644
|
index 9fe8e01e3..6aa1ea05a 100644
|
||||||
--- a/policy/modules/system/miscfiles.fc
|
--- a/policy/modules/system/miscfiles.fc
|
||||||
+++ b/policy/modules/system/miscfiles.fc
|
+++ b/policy/modules/system/miscfiles.fc
|
||||||
@@ -9,11 +9,16 @@ ifdef(`distro_gentoo',`
|
@@ -9,11 +9,16 @@ ifdef(`distro_gentoo',`
|
||||||
@ -43524,16 +43528,19 @@ index 9fe8e01e3..c62c76136 100644
|
|||||||
|
|
||||||
/var/named/chroot/etc/pki(/.*)? gen_context(system_u:object_r:cert_t,s0)
|
/var/named/chroot/etc/pki(/.*)? gen_context(system_u:object_r:cert_t,s0)
|
||||||
|
|
||||||
@@ -90,6 +91,7 @@ ifdef(`distro_debian',`
|
@@ -89,7 +90,10 @@ ifdef(`distro_debian',`
|
||||||
|
/var/lib/usbutils(/.*)? gen_context(system_u:object_r:hwdata_t,s0)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
+/var/lib/letsencrypt(/.*)? gen_context(system_u:object_r:cert_t,s0)
|
||||||
|
+
|
||||||
ifdef(`distro_redhat',`
|
ifdef(`distro_redhat',`
|
||||||
+/var/named/chroot/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
|
+/var/named/chroot/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
|
||||||
/var/empty/sshd/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
|
/var/empty/sshd/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
|
||||||
/var/spool/postfix/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
|
/var/spool/postfix/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
|
||||||
')
|
')
|
||||||
diff --git a/policy/modules/system/miscfiles.if b/policy/modules/system/miscfiles.if
|
diff --git a/policy/modules/system/miscfiles.if b/policy/modules/system/miscfiles.if
|
||||||
index fc28bc31b..7ed7664fb 100644
|
index fc28bc31b..1701f0861 100644
|
||||||
--- a/policy/modules/system/miscfiles.if
|
--- a/policy/modules/system/miscfiles.if
|
||||||
+++ b/policy/modules/system/miscfiles.if
|
+++ b/policy/modules/system/miscfiles.if
|
||||||
@@ -67,6 +67,27 @@ interface(`miscfiles_read_all_certs',`
|
@@ -67,6 +67,27 @@ interface(`miscfiles_read_all_certs',`
|
||||||
@ -43777,7 +43784,7 @@ index fc28bc31b..7ed7664fb 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -809,3 +944,61 @@ interface(`miscfiles_manage_localization',`
|
@@ -809,3 +944,81 @@ interface(`miscfiles_manage_localization',`
|
||||||
manage_lnk_files_pattern($1, locale_t, locale_t)
|
manage_lnk_files_pattern($1, locale_t, locale_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -43831,6 +43838,7 @@ index fc28bc31b..7ed7664fb 100644
|
|||||||
+ files_var_filetrans($1, man_t, dir, "man")
|
+ files_var_filetrans($1, man_t, dir, "man")
|
||||||
+ files_etc_filetrans($1, cert_t, dir, "pki")
|
+ files_etc_filetrans($1, cert_t, dir, "pki")
|
||||||
+ files_usr_filetrans($1, cert_t, dir, "certs")
|
+ files_usr_filetrans($1, cert_t, dir, "certs")
|
||||||
|
+ files_var_lib_filetrans($1, cert_t, dir, "letsencrypt")
|
||||||
+ files_usr_filetrans($1, fonts_t, dir, "fonts")
|
+ files_usr_filetrans($1, fonts_t, dir, "fonts")
|
||||||
+ files_usr_filetrans($1, hwdata_t, dir, "hwdata")
|
+ files_usr_filetrans($1, hwdata_t, dir, "hwdata")
|
||||||
+ files_var_filetrans($1, fonts_cache_t, dir, "fontconfig")
|
+ files_var_filetrans($1, fonts_cache_t, dir, "fontconfig")
|
||||||
@ -43839,6 +43847,25 @@ index fc28bc31b..7ed7664fb 100644
|
|||||||
+ files_var_lib_filetrans($1, tetex_data_t, dir, "texmf")
|
+ files_var_lib_filetrans($1, tetex_data_t, dir, "texmf")
|
||||||
+ files_var_filetrans($1, public_content_t, dir, "ftp")
|
+ files_var_filetrans($1, public_content_t, dir, "ftp")
|
||||||
+')
|
+')
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Transition to miscfiles named content
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`miscfiles_filetrans_named_content_letsencrypt',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type cert_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ files_var_lib_filetrans($1, cert_t, dir, "letsencrypt")
|
||||||
|
+')
|
||||||
diff --git a/policy/modules/system/miscfiles.te b/policy/modules/system/miscfiles.te
|
diff --git a/policy/modules/system/miscfiles.te b/policy/modules/system/miscfiles.te
|
||||||
index 1361961d0..be6b7fc80 100644
|
index 1361961d0..be6b7fc80 100644
|
||||||
--- a/policy/modules/system/miscfiles.te
|
--- a/policy/modules/system/miscfiles.te
|
||||||
@ -52359,10 +52386,10 @@ index 5ca20a97d..43bb011b3 100644
|
|||||||
+ allow $1 unconfined_service_t:process { noatsecure };
|
+ allow $1 unconfined_service_t:process { noatsecure };
|
||||||
')
|
')
|
||||||
diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
|
diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
|
||||||
index 5fe902db3..0a7c3bb00 100644
|
index 5fe902db3..52a051d8a 100644
|
||||||
--- a/policy/modules/system/unconfined.te
|
--- a/policy/modules/system/unconfined.te
|
||||||
+++ b/policy/modules/system/unconfined.te
|
+++ b/policy/modules/system/unconfined.te
|
||||||
@@ -1,207 +1,33 @@
|
@@ -1,207 +1,38 @@
|
||||||
-policy_module(unconfined, 3.5.1)
|
-policy_module(unconfined, 3.5.1)
|
||||||
+policy_module(unconfined, 3.5.0)
|
+policy_module(unconfined, 3.5.0)
|
||||||
|
|
||||||
@ -52382,6 +52409,7 @@ index 5fe902db3..0a7c3bb00 100644
|
|||||||
+type unconfined_service_t;
|
+type unconfined_service_t;
|
||||||
+domain_type(unconfined_service_t)
|
+domain_type(unconfined_service_t)
|
||||||
+role system_r types unconfined_service_t;
|
+role system_r types unconfined_service_t;
|
||||||
|
+init_nnp_daemon_domain(unconfined_service_t)
|
||||||
|
|
||||||
-type unconfined_exec_t;
|
-type unconfined_exec_t;
|
||||||
-init_system_domain(unconfined_t, unconfined_exec_t)
|
-init_system_domain(unconfined_t, unconfined_exec_t)
|
||||||
@ -52434,24 +52462,30 @@ index 5fe902db3..0a7c3bb00 100644
|
|||||||
- apache_run_helper(unconfined_t, unconfined_r)
|
- apache_run_helper(unconfined_t, unconfined_r)
|
||||||
- apache_role(unconfined_r, unconfined_t)
|
- apache_role(unconfined_r, unconfined_t)
|
||||||
-')
|
-')
|
||||||
-
|
+role unconfined_r types unconfined_service_t;
|
||||||
|
|
||||||
-optional_policy(`
|
-optional_policy(`
|
||||||
- bind_run_ndc(unconfined_t, unconfined_r)
|
- bind_run_ndc(unconfined_t, unconfined_r)
|
||||||
-')
|
-')
|
||||||
-
|
+corecmd_bin_entry_type(unconfined_service_t)
|
||||||
-optional_policy(`
|
+corecmd_shell_entry_type(unconfined_service_t)
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
- bootloader_run(unconfined_t, unconfined_r)
|
- bootloader_run(unconfined_t, unconfined_r)
|
||||||
-')
|
+ rpm_transition_script(unconfined_service_t, system_r)
|
||||||
-
|
')
|
||||||
-optional_policy(`
|
|
||||||
|
optional_policy(`
|
||||||
- cron_unconfined_role(unconfined_r, unconfined_t)
|
- cron_unconfined_role(unconfined_r, unconfined_t)
|
||||||
-')
|
+ chronyd_run_chronyc(unconfined_service_t, system_r)
|
||||||
-
|
')
|
||||||
-optional_policy(`
|
|
||||||
|
optional_policy(`
|
||||||
- firstboot_run(unconfined_t, unconfined_r)
|
- firstboot_run(unconfined_t, unconfined_r)
|
||||||
-')
|
+ dbus_chat_system_bus(unconfined_service_t)
|
||||||
-
|
')
|
||||||
-optional_policy(`
|
|
||||||
|
optional_policy(`
|
||||||
- ftp_run_ftpdctl(unconfined_t, unconfined_r)
|
- ftp_run_ftpdctl(unconfined_t, unconfined_r)
|
||||||
-')
|
-')
|
||||||
-
|
-
|
||||||
@ -52523,8 +52557,7 @@ index 5fe902db3..0a7c3bb00 100644
|
|||||||
-optional_policy(`
|
-optional_policy(`
|
||||||
- rpm_run(unconfined_t, unconfined_r)
|
- rpm_run(unconfined_t, unconfined_r)
|
||||||
-')
|
-')
|
||||||
+role unconfined_r types unconfined_service_t;
|
-
|
||||||
|
|
||||||
-optional_policy(`
|
-optional_policy(`
|
||||||
- samba_run_net(unconfined_t, unconfined_r)
|
- samba_run_net(unconfined_t, unconfined_r)
|
||||||
- samba_run_winbind_helper(unconfined_t, unconfined_r)
|
- samba_run_winbind_helper(unconfined_t, unconfined_r)
|
||||||
@ -52546,20 +52579,16 @@ index 5fe902db3..0a7c3bb00 100644
|
|||||||
-optional_policy(`
|
-optional_policy(`
|
||||||
- unconfined_dbus_chat(unconfined_t)
|
- unconfined_dbus_chat(unconfined_t)
|
||||||
-')
|
-')
|
||||||
+corecmd_bin_entry_type(unconfined_service_t)
|
-
|
||||||
+corecmd_shell_entry_type(unconfined_service_t)
|
-optional_policy(`
|
||||||
|
|
||||||
optional_policy(`
|
|
||||||
- usermanage_run_admin_passwd(unconfined_t, unconfined_r)
|
- usermanage_run_admin_passwd(unconfined_t, unconfined_r)
|
||||||
+ rpm_transition_script(unconfined_service_t, system_r)
|
-')
|
||||||
')
|
-
|
||||||
|
-optional_policy(`
|
||||||
optional_policy(`
|
|
||||||
- vpn_run(unconfined_t, unconfined_r)
|
- vpn_run(unconfined_t, unconfined_r)
|
||||||
+ dbus_chat_system_bus(unconfined_service_t)
|
-')
|
||||||
')
|
-
|
||||||
|
-optional_policy(`
|
||||||
optional_policy(`
|
|
||||||
- webalizer_run(unconfined_t, unconfined_r)
|
- webalizer_run(unconfined_t, unconfined_r)
|
||||||
-')
|
-')
|
||||||
-
|
-
|
||||||
@ -52628,7 +52657,7 @@ index db7597682..c54480a1d 100644
|
|||||||
+/var/tmp/hsperfdata_root gen_context(system_u:object_r:user_tmp_t,s0)
|
+/var/tmp/hsperfdata_root gen_context(system_u:object_r:user_tmp_t,s0)
|
||||||
+
|
+
|
||||||
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
|
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
|
||||||
index 9dc60c6c0..1d1213e00 100644
|
index 9dc60c6c0..562afbe9a 100644
|
||||||
--- a/policy/modules/system/userdomain.if
|
--- a/policy/modules/system/userdomain.if
|
||||||
+++ b/policy/modules/system/userdomain.if
|
+++ b/policy/modules/system/userdomain.if
|
||||||
@@ -30,9 +30,11 @@ template(`userdom_base_user_template',`
|
@@ -30,9 +30,11 @@ template(`userdom_base_user_template',`
|
||||||
@ -53653,7 +53682,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
|
|
||||||
userdom_change_password_template($1)
|
userdom_change_password_template($1)
|
||||||
|
|
||||||
@@ -761,86 +1031,117 @@ template(`userdom_login_user_template', `
|
@@ -761,86 +1031,121 @@ template(`userdom_login_user_template', `
|
||||||
#
|
#
|
||||||
# User domain Local policy
|
# User domain Local policy
|
||||||
#
|
#
|
||||||
@ -53797,6 +53826,10 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
+ ')
|
+ ')
|
||||||
+
|
+
|
||||||
+ optional_policy(`
|
+ optional_policy(`
|
||||||
|
+ chronyd_run_chronyc($1_t, $1_r)
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ optional_policy(`
|
||||||
+ ipa_run_helper($1_t, $1_r)
|
+ ipa_run_helper($1_t, $1_r)
|
||||||
+ ')
|
+ ')
|
||||||
+
|
+
|
||||||
@ -53809,7 +53842,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## <summary>
|
## <summary>
|
||||||
## The template for creating a unprivileged login user.
|
## The template for creating a unprivileged login user.
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -868,6 +1169,12 @@ template(`userdom_restricted_user_template',`
|
@@ -868,6 +1173,12 @@ template(`userdom_restricted_user_template',`
|
||||||
typeattribute $1_t unpriv_userdomain;
|
typeattribute $1_t unpriv_userdomain;
|
||||||
domain_interactive_fd($1_t)
|
domain_interactive_fd($1_t)
|
||||||
|
|
||||||
@ -53822,7 +53855,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
##############################
|
##############################
|
||||||
#
|
#
|
||||||
# Local policy
|
# Local policy
|
||||||
@@ -907,53 +1214,143 @@ template(`userdom_restricted_xwindows_user_template',`
|
@@ -907,53 +1218,143 @@ template(`userdom_restricted_xwindows_user_template',`
|
||||||
#
|
#
|
||||||
# Local policy
|
# Local policy
|
||||||
#
|
#
|
||||||
@ -53901,13 +53934,15 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
+ dbus_role_template($1, $1_r, $1_usertype)
|
+ dbus_role_template($1, $1_r, $1_usertype)
|
||||||
+ dbus_system_bus_client($1_usertype)
|
+ dbus_system_bus_client($1_usertype)
|
||||||
+ allow $1_usertype $1_usertype:dbus send_msg;
|
+ allow $1_usertype $1_usertype:dbus send_msg;
|
||||||
+
|
|
||||||
+ optional_policy(`
|
optional_policy(`
|
||||||
|
- consolekit_dbus_chat($1_t)
|
||||||
+ abrt_dbus_chat($1_usertype)
|
+ abrt_dbus_chat($1_usertype)
|
||||||
+ abrt_run_helper($1_usertype, $1_r)
|
+ abrt_run_helper($1_usertype, $1_r)
|
||||||
+ ')
|
')
|
||||||
+
|
|
||||||
+ optional_policy(`
|
optional_policy(`
|
||||||
|
- cups_dbus_chat($1_t)
|
||||||
+ accountsd_dbus_chat($1_usertype)
|
+ accountsd_dbus_chat($1_usertype)
|
||||||
+ ')
|
+ ')
|
||||||
+
|
+
|
||||||
@ -53915,15 +53950,13 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
+ consolekit_dontaudit_read_log($1_usertype)
|
+ consolekit_dontaudit_read_log($1_usertype)
|
||||||
+ consolekit_dbus_chat($1_usertype)
|
+ consolekit_dbus_chat($1_usertype)
|
||||||
+ ')
|
+ ')
|
||||||
|
+
|
||||||
optional_policy(`
|
+ optional_policy(`
|
||||||
- consolekit_dbus_chat($1_t)
|
|
||||||
+ cups_dbus_chat($1_usertype)
|
+ cups_dbus_chat($1_usertype)
|
||||||
+ cups_dbus_chat_config($1_usertype)
|
+ cups_dbus_chat_config($1_usertype)
|
||||||
')
|
+ ')
|
||||||
|
+
|
||||||
optional_policy(`
|
+ optional_policy(`
|
||||||
- cups_dbus_chat($1_t)
|
|
||||||
+ devicekit_dbus_chat($1_usertype)
|
+ devicekit_dbus_chat($1_usertype)
|
||||||
+ devicekit_dbus_chat_disk($1_usertype)
|
+ devicekit_dbus_chat_disk($1_usertype)
|
||||||
+ devicekit_dbus_chat_power($1_usertype)
|
+ devicekit_dbus_chat_power($1_usertype)
|
||||||
@ -53978,7 +54011,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
#######################################
|
#######################################
|
||||||
@@ -987,27 +1384,36 @@ template(`userdom_unpriv_user_template', `
|
@@ -987,27 +1388,36 @@ template(`userdom_unpriv_user_template', `
|
||||||
#
|
#
|
||||||
|
|
||||||
# Inherit rules for ordinary users.
|
# Inherit rules for ordinary users.
|
||||||
@ -54019,7 +54052,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
fs_manage_noxattr_fs_files($1_t)
|
fs_manage_noxattr_fs_files($1_t)
|
||||||
fs_manage_noxattr_fs_dirs($1_t)
|
fs_manage_noxattr_fs_dirs($1_t)
|
||||||
# Write floppies
|
# Write floppies
|
||||||
@@ -1018,23 +1424,64 @@ template(`userdom_unpriv_user_template', `
|
@@ -1018,23 +1428,64 @@ template(`userdom_unpriv_user_template', `
|
||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -54080,21 +54113,21 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
+ optional_policy(`
|
+ optional_policy(`
|
||||||
+ mount_run_fusermount($1_t, $1_r)
|
+ mount_run_fusermount($1_t, $1_r)
|
||||||
+ mount_read_pid_files($1_t)
|
+ mount_read_pid_files($1_t)
|
||||||
+ ')
|
|
||||||
+
|
|
||||||
+ optional_policy(`
|
|
||||||
+ wine_role_template($1, $1_r, $1_t)
|
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
- netutils_run_ping_cond($1_t, $1_r)
|
- netutils_run_ping_cond($1_t, $1_r)
|
||||||
- netutils_run_traceroute_cond($1_t, $1_r)
|
- netutils_run_traceroute_cond($1_t, $1_r)
|
||||||
|
+ wine_role_template($1, $1_r, $1_t)
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ optional_policy(`
|
||||||
+ postfix_run_postdrop($1_t, $1_r)
|
+ postfix_run_postdrop($1_t, $1_r)
|
||||||
+ postfix_search_spool($1_t)
|
+ postfix_search_spool($1_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
# Run pppd in pppd_t by default for user
|
# Run pppd in pppd_t by default for user
|
||||||
@@ -1043,7 +1490,9 @@ template(`userdom_unpriv_user_template', `
|
@@ -1043,7 +1494,9 @@ template(`userdom_unpriv_user_template', `
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -54105,7 +54138,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -1079,7 +1528,9 @@ template(`userdom_unpriv_user_template', `
|
@@ -1079,7 +1532,9 @@ template(`userdom_unpriv_user_template', `
|
||||||
template(`userdom_admin_user_template',`
|
template(`userdom_admin_user_template',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
attribute admindomain;
|
attribute admindomain;
|
||||||
@ -54116,7 +54149,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
##############################
|
##############################
|
||||||
@@ -1095,6 +1546,7 @@ template(`userdom_admin_user_template',`
|
@@ -1095,6 +1550,7 @@ template(`userdom_admin_user_template',`
|
||||||
role system_r types $1_t;
|
role system_r types $1_t;
|
||||||
|
|
||||||
typeattribute $1_t admindomain;
|
typeattribute $1_t admindomain;
|
||||||
@ -54124,7 +54157,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
|
|
||||||
ifdef(`direct_sysadm_daemon',`
|
ifdef(`direct_sysadm_daemon',`
|
||||||
domain_system_change_exemption($1_t)
|
domain_system_change_exemption($1_t)
|
||||||
@@ -1105,14 +1557,8 @@ template(`userdom_admin_user_template',`
|
@@ -1105,14 +1561,8 @@ template(`userdom_admin_user_template',`
|
||||||
# $1_t local policy
|
# $1_t local policy
|
||||||
#
|
#
|
||||||
|
|
||||||
@ -54141,7 +54174,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
|
|
||||||
kernel_read_software_raid_state($1_t)
|
kernel_read_software_raid_state($1_t)
|
||||||
kernel_getattr_core_if($1_t)
|
kernel_getattr_core_if($1_t)
|
||||||
@@ -1128,6 +1574,8 @@ template(`userdom_admin_user_template',`
|
@@ -1128,6 +1578,8 @@ template(`userdom_admin_user_template',`
|
||||||
kernel_sigstop_unlabeled($1_t)
|
kernel_sigstop_unlabeled($1_t)
|
||||||
kernel_signull_unlabeled($1_t)
|
kernel_signull_unlabeled($1_t)
|
||||||
kernel_sigchld_unlabeled($1_t)
|
kernel_sigchld_unlabeled($1_t)
|
||||||
@ -54150,7 +54183,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
|
|
||||||
corenet_tcp_bind_generic_port($1_t)
|
corenet_tcp_bind_generic_port($1_t)
|
||||||
# allow setting up tunnels
|
# allow setting up tunnels
|
||||||
@@ -1145,10 +1593,15 @@ template(`userdom_admin_user_template',`
|
@@ -1145,10 +1597,15 @@ template(`userdom_admin_user_template',`
|
||||||
dev_rename_all_blk_files($1_t)
|
dev_rename_all_blk_files($1_t)
|
||||||
dev_rename_all_chr_files($1_t)
|
dev_rename_all_chr_files($1_t)
|
||||||
dev_create_generic_symlinks($1_t)
|
dev_create_generic_symlinks($1_t)
|
||||||
@ -54166,7 +54199,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
domain_dontaudit_ptrace_all_domains($1_t)
|
domain_dontaudit_ptrace_all_domains($1_t)
|
||||||
# signal all domains:
|
# signal all domains:
|
||||||
domain_kill_all_domains($1_t)
|
domain_kill_all_domains($1_t)
|
||||||
@@ -1159,29 +1612,40 @@ template(`userdom_admin_user_template',`
|
@@ -1159,29 +1616,40 @@ template(`userdom_admin_user_template',`
|
||||||
domain_sigchld_all_domains($1_t)
|
domain_sigchld_all_domains($1_t)
|
||||||
# for lsof
|
# for lsof
|
||||||
domain_getattr_all_sockets($1_t)
|
domain_getattr_all_sockets($1_t)
|
||||||
@ -54211,7 +54244,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
|
|
||||||
# The following rule is temporary until such time that a complete
|
# The following rule is temporary until such time that a complete
|
||||||
# policy management infrastructure is in place so that an administrator
|
# policy management infrastructure is in place so that an administrator
|
||||||
@@ -1191,6 +1655,8 @@ template(`userdom_admin_user_template',`
|
@@ -1191,6 +1659,8 @@ template(`userdom_admin_user_template',`
|
||||||
# But presently necessary for installing the file_contexts file.
|
# But presently necessary for installing the file_contexts file.
|
||||||
seutil_manage_bin_policy($1_t)
|
seutil_manage_bin_policy($1_t)
|
||||||
|
|
||||||
@ -54220,7 +54253,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
userdom_manage_user_home_content_dirs($1_t)
|
userdom_manage_user_home_content_dirs($1_t)
|
||||||
userdom_manage_user_home_content_files($1_t)
|
userdom_manage_user_home_content_files($1_t)
|
||||||
userdom_manage_user_home_content_symlinks($1_t)
|
userdom_manage_user_home_content_symlinks($1_t)
|
||||||
@@ -1198,13 +1664,21 @@ template(`userdom_admin_user_template',`
|
@@ -1198,13 +1668,21 @@ template(`userdom_admin_user_template',`
|
||||||
userdom_manage_user_home_content_sockets($1_t)
|
userdom_manage_user_home_content_sockets($1_t)
|
||||||
userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
|
userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
|
||||||
|
|
||||||
@ -54243,7 +54276,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
optional_policy(`
|
optional_policy(`
|
||||||
postgresql_unconfined($1_t)
|
postgresql_unconfined($1_t)
|
||||||
')
|
')
|
||||||
@@ -1240,8 +1714,8 @@ template(`userdom_admin_user_template',`
|
@@ -1240,8 +1718,8 @@ template(`userdom_admin_user_template',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -54254,7 +54287,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
|
|
||||||
corecmd_exec_shell($1)
|
corecmd_exec_shell($1)
|
||||||
|
|
||||||
@@ -1250,6 +1724,8 @@ template(`userdom_security_admin_template',`
|
@@ -1250,6 +1728,8 @@ template(`userdom_security_admin_template',`
|
||||||
dev_relabel_all_dev_nodes($1)
|
dev_relabel_all_dev_nodes($1)
|
||||||
|
|
||||||
files_create_boot_flag($1)
|
files_create_boot_flag($1)
|
||||||
@ -54263,7 +54296,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
|
|
||||||
# Necessary for managing /boot/efi
|
# Necessary for managing /boot/efi
|
||||||
fs_manage_dos_files($1)
|
fs_manage_dos_files($1)
|
||||||
@@ -1262,8 +1738,10 @@ template(`userdom_security_admin_template',`
|
@@ -1262,8 +1742,10 @@ template(`userdom_security_admin_template',`
|
||||||
selinux_set_enforce_mode($1)
|
selinux_set_enforce_mode($1)
|
||||||
selinux_set_all_booleans($1)
|
selinux_set_all_booleans($1)
|
||||||
selinux_set_parameters($1)
|
selinux_set_parameters($1)
|
||||||
@ -54275,7 +54308,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
auth_relabel_shadow($1)
|
auth_relabel_shadow($1)
|
||||||
|
|
||||||
init_exec($1)
|
init_exec($1)
|
||||||
@@ -1274,29 +1752,31 @@ template(`userdom_security_admin_template',`
|
@@ -1274,29 +1756,31 @@ template(`userdom_security_admin_template',`
|
||||||
logging_read_audit_config($1)
|
logging_read_audit_config($1)
|
||||||
|
|
||||||
seutil_manage_bin_policy($1)
|
seutil_manage_bin_policy($1)
|
||||||
@ -54318,7 +54351,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -1357,14 +1837,17 @@ interface(`userdom_user_home_content',`
|
@@ -1357,14 +1841,17 @@ interface(`userdom_user_home_content',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
attribute user_home_content_type;
|
attribute user_home_content_type;
|
||||||
type user_home_t;
|
type user_home_t;
|
||||||
@ -54337,7 +54370,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1397,12 +1880,52 @@ interface(`userdom_user_tmp_file',`
|
@@ -1397,12 +1884,52 @@ interface(`userdom_user_tmp_file',`
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
interface(`userdom_user_tmpfs_file',`
|
interface(`userdom_user_tmpfs_file',`
|
||||||
@ -54391,7 +54424,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## Allow domain to attach to TUN devices created by administrative users.
|
## Allow domain to attach to TUN devices created by administrative users.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -1509,11 +2032,31 @@ interface(`userdom_search_user_home_dirs',`
|
@@ -1509,11 +2036,31 @@ interface(`userdom_search_user_home_dirs',`
|
||||||
')
|
')
|
||||||
|
|
||||||
allow $1 user_home_dir_t:dir search_dir_perms;
|
allow $1 user_home_dir_t:dir search_dir_perms;
|
||||||
@ -54423,7 +54456,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## Do not audit attempts to search user home directories.
|
## Do not audit attempts to search user home directories.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <desc>
|
## <desc>
|
||||||
@@ -1555,6 +2098,14 @@ interface(`userdom_list_user_home_dirs',`
|
@@ -1555,6 +2102,14 @@ interface(`userdom_list_user_home_dirs',`
|
||||||
|
|
||||||
allow $1 user_home_dir_t:dir list_dir_perms;
|
allow $1 user_home_dir_t:dir list_dir_perms;
|
||||||
files_search_home($1)
|
files_search_home($1)
|
||||||
@ -54438,7 +54471,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1570,9 +2121,11 @@ interface(`userdom_list_user_home_dirs',`
|
@@ -1570,9 +2125,11 @@ interface(`userdom_list_user_home_dirs',`
|
||||||
interface(`userdom_dontaudit_list_user_home_dirs',`
|
interface(`userdom_dontaudit_list_user_home_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type user_home_dir_t;
|
type user_home_dir_t;
|
||||||
@ -54450,7 +54483,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1613,6 +2166,24 @@ interface(`userdom_manage_user_home_dirs',`
|
@@ -1613,6 +2170,24 @@ interface(`userdom_manage_user_home_dirs',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -54475,7 +54508,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## Relabel to user home directories.
|
## Relabel to user home directories.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -1631,6 +2202,59 @@ interface(`userdom_relabelto_user_home_dirs',`
|
@@ -1631,6 +2206,59 @@ interface(`userdom_relabelto_user_home_dirs',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -54535,7 +54568,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## Create directories in the home dir root with
|
## Create directories in the home dir root with
|
||||||
## the user home directory type.
|
## the user home directory type.
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -1704,10 +2328,12 @@ interface(`userdom_user_home_domtrans',`
|
@@ -1704,10 +2332,12 @@ interface(`userdom_user_home_domtrans',`
|
||||||
#
|
#
|
||||||
interface(`userdom_dontaudit_search_user_home_content',`
|
interface(`userdom_dontaudit_search_user_home_content',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -54550,7 +54583,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1741,10 +2367,12 @@ interface(`userdom_list_all_user_home_content',`
|
@@ -1741,10 +2371,12 @@ interface(`userdom_list_all_user_home_content',`
|
||||||
#
|
#
|
||||||
interface(`userdom_list_user_home_content',`
|
interface(`userdom_list_user_home_content',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -54565,7 +54598,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1769,7 +2397,7 @@ interface(`userdom_manage_user_home_content_dirs',`
|
@@ -1769,7 +2401,7 @@ interface(`userdom_manage_user_home_content_dirs',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -54574,7 +54607,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -1777,19 +2405,17 @@ interface(`userdom_manage_user_home_content_dirs',`
|
@@ -1777,19 +2409,17 @@ interface(`userdom_manage_user_home_content_dirs',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -54598,7 +54631,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -1797,47 +2423,157 @@ interface(`userdom_delete_all_user_home_content_dirs',`
|
@@ -1797,45 +2427,155 @@ interface(`userdom_delete_all_user_home_content_dirs',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -54653,8 +54686,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
#
|
#
|
||||||
-interface(`userdom_dontaudit_setattr_user_home_content_files',`
|
-interface(`userdom_dontaudit_setattr_user_home_content_files',`
|
||||||
+interface(`userdom_setattr_user_tmp_files',`
|
+interface(`userdom_setattr_user_tmp_files',`
|
||||||
gen_require(`
|
+ gen_require(`
|
||||||
- type user_home_t;
|
|
||||||
+ type user_tmp_t;
|
+ type user_tmp_t;
|
||||||
+ ')
|
+ ')
|
||||||
+
|
+
|
||||||
@ -54764,12 +54796,10 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
+## </param>
|
+## </param>
|
||||||
+#
|
+#
|
||||||
+interface(`userdom_dontaudit_setattr_user_home_content_files',`
|
+interface(`userdom_dontaudit_setattr_user_home_content_files',`
|
||||||
+ gen_require(`
|
gen_require(`
|
||||||
+ type user_home_t;
|
type user_home_t;
|
||||||
')
|
')
|
||||||
|
@@ -1845,6 +2585,25 @@ interface(`userdom_dontaudit_setattr_user_home_content_files',`
|
||||||
dontaudit $1 user_home_t:file setattr_file_perms;
|
|
||||||
@@ -1845,6 +2581,25 @@ interface(`userdom_dontaudit_setattr_user_home_content_files',`
|
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -54795,7 +54825,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## Mmap user home files.
|
## Mmap user home files.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -1875,14 +2630,36 @@ interface(`userdom_mmap_user_home_content_files',`
|
@@ -1875,14 +2634,36 @@ interface(`userdom_mmap_user_home_content_files',`
|
||||||
interface(`userdom_read_user_home_content_files',`
|
interface(`userdom_read_user_home_content_files',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type user_home_dir_t, user_home_t;
|
type user_home_dir_t, user_home_t;
|
||||||
@ -54833,7 +54863,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## Do not audit attempts to read user home files.
|
## Do not audit attempts to read user home files.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -1893,11 +2670,14 @@ interface(`userdom_read_user_home_content_files',`
|
@@ -1893,11 +2674,14 @@ interface(`userdom_read_user_home_content_files',`
|
||||||
#
|
#
|
||||||
interface(`userdom_dontaudit_read_user_home_content_files',`
|
interface(`userdom_dontaudit_read_user_home_content_files',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -54851,7 +54881,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1938,7 +2718,7 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
|
@@ -1938,7 +2722,7 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -54860,7 +54890,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -1946,10 +2726,9 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
|
@@ -1946,10 +2730,9 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -54873,7 +54903,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
userdom_search_user_home_content($1)
|
userdom_search_user_home_content($1)
|
||||||
@@ -1958,7 +2737,7 @@ interface(`userdom_delete_all_user_home_content_files',`
|
@@ -1958,7 +2741,7 @@ interface(`userdom_delete_all_user_home_content_files',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -54882,7 +54912,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -1966,12 +2745,66 @@ interface(`userdom_delete_all_user_home_content_files',`
|
@@ -1966,12 +2749,66 @@ interface(`userdom_delete_all_user_home_content_files',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -54951,7 +54981,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -2007,8 +2840,7 @@ interface(`userdom_read_user_home_content_symlinks',`
|
@@ -2007,8 +2844,7 @@ interface(`userdom_read_user_home_content_symlinks',`
|
||||||
type user_home_dir_t, user_home_t;
|
type user_home_dir_t, user_home_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -54961,7 +54991,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -2024,20 +2856,14 @@ interface(`userdom_read_user_home_content_symlinks',`
|
@@ -2024,20 +2860,14 @@ interface(`userdom_read_user_home_content_symlinks',`
|
||||||
#
|
#
|
||||||
interface(`userdom_exec_user_home_content_files',`
|
interface(`userdom_exec_user_home_content_files',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -54986,7 +55016,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -2120,7 +2946,7 @@ interface(`userdom_manage_user_home_content_symlinks',`
|
@@ -2120,7 +2950,7 @@ interface(`userdom_manage_user_home_content_symlinks',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -54995,7 +55025,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -2128,19 +2954,17 @@ interface(`userdom_manage_user_home_content_symlinks',`
|
@@ -2128,19 +2958,17 @@ interface(`userdom_manage_user_home_content_symlinks',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -55019,7 +55049,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -2148,12 +2972,12 @@ interface(`userdom_delete_all_user_home_content_symlinks',`
|
@@ -2148,12 +2976,12 @@ interface(`userdom_delete_all_user_home_content_symlinks',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -55035,7 +55065,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -2388,18 +3212,54 @@ interface(`userdom_dontaudit_manage_user_tmp_dirs',`
|
@@ -2388,18 +3216,54 @@ interface(`userdom_dontaudit_manage_user_tmp_dirs',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -55093,7 +55123,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## Do not audit attempts to read users
|
## Do not audit attempts to read users
|
||||||
## temporary files.
|
## temporary files.
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -2414,7 +3274,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
|
@@ -2414,7 +3278,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
|
||||||
type user_tmp_t;
|
type user_tmp_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -55102,7 +55132,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -2455,6 +3315,25 @@ interface(`userdom_rw_user_tmp_files',`
|
@@ -2455,6 +3319,25 @@ interface(`userdom_rw_user_tmp_files',`
|
||||||
rw_files_pattern($1, user_tmp_t, user_tmp_t)
|
rw_files_pattern($1, user_tmp_t, user_tmp_t)
|
||||||
files_search_tmp($1)
|
files_search_tmp($1)
|
||||||
')
|
')
|
||||||
@ -55128,7 +55158,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -2538,7 +3417,7 @@ interface(`userdom_manage_user_tmp_files',`
|
@@ -2538,7 +3421,7 @@ interface(`userdom_manage_user_tmp_files',`
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Create, read, write, and delete user
|
## Create, read, write, and delete user
|
||||||
@ -55137,7 +55167,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -2546,19 +3425,19 @@ interface(`userdom_manage_user_tmp_files',`
|
@@ -2546,19 +3429,19 @@ interface(`userdom_manage_user_tmp_files',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -55160,7 +55190,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -2566,19 +3445,19 @@ interface(`userdom_manage_user_tmp_symlinks',`
|
@@ -2566,19 +3449,19 @@ interface(`userdom_manage_user_tmp_symlinks',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -55183,7 +55213,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -2586,19 +3465,60 @@ interface(`userdom_manage_user_tmp_pipes',`
|
@@ -2586,20 +3469,61 @@ interface(`userdom_manage_user_tmp_pipes',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -55203,6 +55233,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## <summary>
|
## <summary>
|
||||||
-## Create objects in a user temporary directory
|
-## Create objects in a user temporary directory
|
||||||
-## with an automatic type transition to
|
-## with an automatic type transition to
|
||||||
|
-## a specified private type.
|
||||||
+## Create, read, write, and delete user
|
+## Create, read, write, and delete user
|
||||||
+## temporary named pipes.
|
+## temporary named pipes.
|
||||||
+## </summary>
|
+## </summary>
|
||||||
@ -55245,10 +55276,11 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
+## <summary>
|
+## <summary>
|
||||||
+## Create objects in a user temporary directory
|
+## Create objects in a user temporary directory
|
||||||
+## with an automatic type transition to
|
+## with an automatic type transition to
|
||||||
## a specified private type.
|
+## a specified private type.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -2661,6 +3581,21 @@ interface(`userdom_tmp_filetrans_user_tmp',`
|
## <summary>
|
||||||
|
@@ -2661,6 +3585,21 @@ interface(`userdom_tmp_filetrans_user_tmp',`
|
||||||
files_tmp_filetrans($1, user_tmp_t, $2, $3)
|
files_tmp_filetrans($1, user_tmp_t, $2, $3)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -55270,7 +55302,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Read user tmpfs files.
|
## Read user tmpfs files.
|
||||||
@@ -2672,18 +3607,13 @@ interface(`userdom_tmp_filetrans_user_tmp',`
|
@@ -2672,18 +3611,13 @@ interface(`userdom_tmp_filetrans_user_tmp',`
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
interface(`userdom_read_user_tmpfs_files',`
|
interface(`userdom_read_user_tmpfs_files',`
|
||||||
@ -55292,7 +55324,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -2692,19 +3622,13 @@ interface(`userdom_read_user_tmpfs_files',`
|
@@ -2692,19 +3626,13 @@ interface(`userdom_read_user_tmpfs_files',`
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
interface(`userdom_rw_user_tmpfs_files',`
|
interface(`userdom_rw_user_tmpfs_files',`
|
||||||
@ -55315,7 +55347,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -2713,13 +3637,56 @@ interface(`userdom_rw_user_tmpfs_files',`
|
@@ -2713,13 +3641,56 @@ interface(`userdom_rw_user_tmpfs_files',`
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
interface(`userdom_manage_user_tmpfs_files',`
|
interface(`userdom_manage_user_tmpfs_files',`
|
||||||
@ -55376,7 +55408,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -2814,6 +3781,24 @@ interface(`userdom_use_user_ttys',`
|
@@ -2814,6 +3785,24 @@ interface(`userdom_use_user_ttys',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -55401,7 +55433,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## Read and write a user domain pty.
|
## Read and write a user domain pty.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -2832,22 +3817,34 @@ interface(`userdom_use_user_ptys',`
|
@@ -2832,22 +3821,34 @@ interface(`userdom_use_user_ptys',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -55444,7 +55476,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## </desc>
|
## </desc>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -2856,14 +3853,33 @@ interface(`userdom_use_user_ptys',`
|
@@ -2856,14 +3857,33 @@ interface(`userdom_use_user_ptys',`
|
||||||
## </param>
|
## </param>
|
||||||
## <infoflow type="both" weight="10"/>
|
## <infoflow type="both" weight="10"/>
|
||||||
#
|
#
|
||||||
@ -55482,7 +55514,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -2882,8 +3898,27 @@ interface(`userdom_dontaudit_use_user_terminals',`
|
@@ -2882,8 +3902,27 @@ interface(`userdom_dontaudit_use_user_terminals',`
|
||||||
type user_tty_device_t, user_devpts_t;
|
type user_tty_device_t, user_devpts_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -55512,7 +55544,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -2955,6 +3990,42 @@ interface(`userdom_spec_domtrans_unpriv_users',`
|
@@ -2955,6 +3994,42 @@ interface(`userdom_spec_domtrans_unpriv_users',`
|
||||||
allow unpriv_userdomain $1:process sigchld;
|
allow unpriv_userdomain $1:process sigchld;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -55555,7 +55587,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Execute an Xserver session in all unprivileged user domains. This
|
## Execute an Xserver session in all unprivileged user domains. This
|
||||||
@@ -2978,24 +4049,6 @@ interface(`userdom_xsession_spec_domtrans_unpriv_users',`
|
@@ -2978,24 +4053,6 @@ interface(`userdom_xsession_spec_domtrans_unpriv_users',`
|
||||||
allow unpriv_userdomain $1:process sigchld;
|
allow unpriv_userdomain $1:process sigchld;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -55580,7 +55612,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Manage unpriviledged user SysV sempaphores.
|
## Manage unpriviledged user SysV sempaphores.
|
||||||
@@ -3014,9 +4067,9 @@ interface(`userdom_manage_unpriv_user_semaphores',`
|
@@ -3014,9 +4071,9 @@ interface(`userdom_manage_unpriv_user_semaphores',`
|
||||||
allow $1 unpriv_userdomain:sem create_sem_perms;
|
allow $1 unpriv_userdomain:sem create_sem_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -55592,7 +55624,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## memory segments.
|
## memory segments.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -3025,17 +4078,17 @@ interface(`userdom_manage_unpriv_user_semaphores',`
|
@@ -3025,17 +4082,17 @@ interface(`userdom_manage_unpriv_user_semaphores',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -55613,7 +55645,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## memory segments.
|
## memory segments.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -3044,12 +4097,12 @@ interface(`userdom_rw_unpriv_user_shared_mem',`
|
@@ -3044,12 +4101,12 @@ interface(`userdom_rw_unpriv_user_shared_mem',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -55628,7 +55660,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -3094,7 +4147,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
|
@@ -3094,7 +4151,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
|
||||||
|
|
||||||
domain_entry_file_spec_domtrans($1, unpriv_userdomain)
|
domain_entry_file_spec_domtrans($1, unpriv_userdomain)
|
||||||
allow unpriv_userdomain $1:fd use;
|
allow unpriv_userdomain $1:fd use;
|
||||||
@ -55637,7 +55669,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
allow unpriv_userdomain $1:process sigchld;
|
allow unpriv_userdomain $1:process sigchld;
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -3110,29 +4163,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
|
@@ -3110,29 +4167,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
|
||||||
#
|
#
|
||||||
interface(`userdom_search_user_home_content',`
|
interface(`userdom_search_user_home_content',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -55671,7 +55703,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -3214,7 +4251,25 @@ interface(`userdom_dontaudit_use_user_ptys',`
|
@@ -3214,7 +4255,25 @@ interface(`userdom_dontaudit_use_user_ptys',`
|
||||||
type user_devpts_t;
|
type user_devpts_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -55698,7 +55730,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -3269,12 +4324,13 @@ interface(`userdom_write_user_tmp_files',`
|
@@ -3269,12 +4328,13 @@ interface(`userdom_write_user_tmp_files',`
|
||||||
type user_tmp_t;
|
type user_tmp_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -55714,7 +55746,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -3282,49 +4338,125 @@ interface(`userdom_write_user_tmp_files',`
|
@@ -3282,46 +4342,122 @@ interface(`userdom_write_user_tmp_files',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -55772,9 +55804,8 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
gen_require(`
|
gen_require(`
|
||||||
- attribute userdomain;
|
- attribute userdomain;
|
||||||
+ type user_tmp_t;
|
+ type user_tmp_t;
|
||||||
')
|
+ ')
|
||||||
|
+
|
||||||
- allow $1 userdomain:process getattr;
|
|
||||||
+ dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
|
+ dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
@ -55848,13 +55879,10 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
+interface(`userdom_getattr_all_users',`
|
+interface(`userdom_getattr_all_users',`
|
||||||
+ gen_require(`
|
+ gen_require(`
|
||||||
+ attribute userdomain;
|
+ attribute userdomain;
|
||||||
+ ')
|
')
|
||||||
+
|
|
||||||
+ allow $1 userdomain:process getattr;
|
|
||||||
')
|
|
||||||
|
|
||||||
########################################
|
allow $1 userdomain:process getattr;
|
||||||
@@ -3382,6 +4514,42 @@ interface(`userdom_signal_all_users',`
|
@@ -3382,6 +4518,42 @@ interface(`userdom_signal_all_users',`
|
||||||
allow $1 userdomain:process signal;
|
allow $1 userdomain:process signal;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -55897,7 +55925,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Send a SIGCHLD signal to all user domains.
|
## Send a SIGCHLD signal to all user domains.
|
||||||
@@ -3402,6 +4570,60 @@ interface(`userdom_sigchld_all_users',`
|
@@ -3402,6 +4574,60 @@ interface(`userdom_sigchld_all_users',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -55958,7 +55986,7 @@ index 9dc60c6c0..1d1213e00 100644
|
|||||||
## Create keys for all user domains.
|
## Create keys for all user domains.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -3435,4 +4657,1835 @@ interface(`userdom_dbus_send_all_users',`
|
@@ -3435,4 +4661,1835 @@ interface(`userdom_dbus_send_all_users',`
|
||||||
')
|
')
|
||||||
|
|
||||||
allow $1 userdomain:dbus send_msg;
|
allow $1 userdomain:dbus send_msg;
|
||||||
|
@ -2531,10 +2531,18 @@ index 60d4f8c90..18ef0772c 100644
|
|||||||
domain_system_change_exemption($1)
|
domain_system_change_exemption($1)
|
||||||
role_transition $2 amavis_initrc_exec_t system_r;
|
role_transition $2 amavis_initrc_exec_t system_r;
|
||||||
diff --git a/amavis.te b/amavis.te
|
diff --git a/amavis.te b/amavis.te
|
||||||
index 91fa72ae1..2e9b8246a 100644
|
index 91fa72ae1..11a55da57 100644
|
||||||
--- a/amavis.te
|
--- a/amavis.te
|
||||||
+++ b/amavis.te
|
+++ b/amavis.te
|
||||||
@@ -39,14 +39,14 @@ type amavis_quarantine_t;
|
@@ -16,6 +16,7 @@ gen_tunable(amavis_use_jit, false)
|
||||||
|
type amavis_t;
|
||||||
|
type amavis_exec_t;
|
||||||
|
init_daemon_domain(amavis_t, amavis_exec_t)
|
||||||
|
+init_nnp_daemon_domain(amavis_t)
|
||||||
|
|
||||||
|
type amavis_etc_t;
|
||||||
|
files_config_file(amavis_etc_t)
|
||||||
|
@@ -39,14 +40,14 @@ type amavis_quarantine_t;
|
||||||
files_type(amavis_quarantine_t)
|
files_type(amavis_quarantine_t)
|
||||||
|
|
||||||
type amavis_spool_t;
|
type amavis_spool_t;
|
||||||
@ -2551,7 +2559,7 @@ index 91fa72ae1..2e9b8246a 100644
|
|||||||
dontaudit amavis_t self:capability sys_tty_config;
|
dontaudit amavis_t self:capability sys_tty_config;
|
||||||
allow amavis_t self:process signal_perms;
|
allow amavis_t self:process signal_perms;
|
||||||
allow amavis_t self:fifo_file rw_fifo_file_perms;
|
allow amavis_t self:fifo_file rw_fifo_file_perms;
|
||||||
@@ -67,9 +67,12 @@ manage_lnk_files_pattern(amavis_t, amavis_spool_t, amavis_spool_t)
|
@@ -67,9 +68,12 @@ manage_lnk_files_pattern(amavis_t, amavis_spool_t, amavis_spool_t)
|
||||||
manage_sock_files_pattern(amavis_t, amavis_spool_t, amavis_spool_t)
|
manage_sock_files_pattern(amavis_t, amavis_spool_t, amavis_spool_t)
|
||||||
filetrans_pattern(amavis_t, amavis_spool_t, amavis_var_run_t, sock_file)
|
filetrans_pattern(amavis_t, amavis_spool_t, amavis_var_run_t, sock_file)
|
||||||
|
|
||||||
@ -2565,7 +2573,7 @@ index 91fa72ae1..2e9b8246a 100644
|
|||||||
|
|
||||||
manage_dirs_pattern(amavis_t, amavis_var_lib_t, amavis_var_lib_t)
|
manage_dirs_pattern(amavis_t, amavis_var_lib_t, amavis_var_lib_t)
|
||||||
manage_files_pattern(amavis_t, amavis_var_lib_t, amavis_var_lib_t)
|
manage_files_pattern(amavis_t, amavis_var_lib_t, amavis_var_lib_t)
|
||||||
@@ -95,7 +98,6 @@ kernel_dontaudit_read_proc_symlinks(amavis_t)
|
@@ -95,7 +99,6 @@ kernel_dontaudit_read_proc_symlinks(amavis_t)
|
||||||
corecmd_exec_bin(amavis_t)
|
corecmd_exec_bin(amavis_t)
|
||||||
corecmd_exec_shell(amavis_t)
|
corecmd_exec_shell(amavis_t)
|
||||||
|
|
||||||
@ -2573,7 +2581,7 @@ index 91fa72ae1..2e9b8246a 100644
|
|||||||
corenet_all_recvfrom_netlabel(amavis_t)
|
corenet_all_recvfrom_netlabel(amavis_t)
|
||||||
corenet_tcp_sendrecv_generic_if(amavis_t)
|
corenet_tcp_sendrecv_generic_if(amavis_t)
|
||||||
corenet_udp_sendrecv_generic_if(amavis_t)
|
corenet_udp_sendrecv_generic_if(amavis_t)
|
||||||
@@ -118,6 +120,7 @@ corenet_dontaudit_udp_bind_all_ports(amavis_t)
|
@@ -118,6 +121,7 @@ corenet_dontaudit_udp_bind_all_ports(amavis_t)
|
||||||
|
|
||||||
corenet_sendrecv_razor_client_packets(amavis_t)
|
corenet_sendrecv_razor_client_packets(amavis_t)
|
||||||
corenet_tcp_connect_razor_port(amavis_t)
|
corenet_tcp_connect_razor_port(amavis_t)
|
||||||
@ -2581,7 +2589,7 @@ index 91fa72ae1..2e9b8246a 100644
|
|||||||
|
|
||||||
dev_read_rand(amavis_t)
|
dev_read_rand(amavis_t)
|
||||||
dev_read_sysfs(amavis_t)
|
dev_read_sysfs(amavis_t)
|
||||||
@@ -127,7 +130,6 @@ domain_use_interactive_fds(amavis_t)
|
@@ -127,7 +131,6 @@ domain_use_interactive_fds(amavis_t)
|
||||||
domain_dontaudit_read_all_domains_state(amavis_t)
|
domain_dontaudit_read_all_domains_state(amavis_t)
|
||||||
|
|
||||||
files_read_etc_runtime_files(amavis_t)
|
files_read_etc_runtime_files(amavis_t)
|
||||||
@ -2589,7 +2597,7 @@ index 91fa72ae1..2e9b8246a 100644
|
|||||||
files_search_spool(amavis_t)
|
files_search_spool(amavis_t)
|
||||||
|
|
||||||
fs_getattr_xattr_fs(amavis_t)
|
fs_getattr_xattr_fs(amavis_t)
|
||||||
@@ -141,14 +143,20 @@ init_stream_connect_script(amavis_t)
|
@@ -141,14 +144,20 @@ init_stream_connect_script(amavis_t)
|
||||||
|
|
||||||
logging_send_syslog_msg(amavis_t)
|
logging_send_syslog_msg(amavis_t)
|
||||||
|
|
||||||
@ -2613,7 +2621,7 @@ index 91fa72ae1..2e9b8246a 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -173,6 +181,10 @@ optional_policy(`
|
@@ -173,6 +182,10 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -5615,7 +5623,7 @@ index f6eb4851f..3628a384f 100644
|
|||||||
+ allow $1 httpd_t:process { noatsecure };
|
+ allow $1 httpd_t:process { noatsecure };
|
||||||
')
|
')
|
||||||
diff --git a/apache.te b/apache.te
|
diff --git a/apache.te b/apache.te
|
||||||
index 6649962b6..f6ac61e03 100644
|
index 6649962b6..cb95398ea 100644
|
||||||
--- a/apache.te
|
--- a/apache.te
|
||||||
+++ b/apache.te
|
+++ b/apache.te
|
||||||
@@ -5,280 +5,346 @@ policy_module(apache, 2.7.2)
|
@@ -5,280 +5,346 @@ policy_module(apache, 2.7.2)
|
||||||
@ -7796,7 +7804,7 @@ index 6649962b6..f6ac61e03 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1330,49 +1633,42 @@ optional_policy(`
|
@@ -1330,49 +1633,43 @@ optional_policy(`
|
||||||
# User content local policy
|
# User content local policy
|
||||||
#
|
#
|
||||||
|
|
||||||
@ -7836,6 +7844,7 @@ index 6649962b6..f6ac61e03 100644
|
|||||||
- fs_exec_nfs_files(httpd_user_script_t)
|
- fs_exec_nfs_files(httpd_user_script_t)
|
||||||
+ read_files_pattern(httpd_t, httpd_user_content_type, httpd_user_content_type)
|
+ read_files_pattern(httpd_t, httpd_user_content_type, httpd_user_content_type)
|
||||||
+ read_lnk_files_pattern(httpd_t, httpd_user_content_type, httpd_user_content_type)
|
+ read_lnk_files_pattern(httpd_t, httpd_user_content_type, httpd_user_content_type)
|
||||||
|
+ list_dirs_pattern(httpd_t, httpd_user_content_type, httpd_user_content_type)
|
||||||
+ allow httpd_t httpd_user_content_type:file map;
|
+ allow httpd_t httpd_user_content_type:file map;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -7864,7 +7873,7 @@ index 6649962b6..f6ac61e03 100644
|
|||||||
kernel_read_system_state(httpd_passwd_t)
|
kernel_read_system_state(httpd_passwd_t)
|
||||||
|
|
||||||
corecmd_exec_bin(httpd_passwd_t)
|
corecmd_exec_bin(httpd_passwd_t)
|
||||||
@@ -1382,38 +1678,109 @@ dev_read_urand(httpd_passwd_t)
|
@@ -1382,38 +1679,109 @@ dev_read_urand(httpd_passwd_t)
|
||||||
|
|
||||||
domain_use_interactive_fds(httpd_passwd_t)
|
domain_use_interactive_fds(httpd_passwd_t)
|
||||||
|
|
||||||
@ -10562,10 +10571,10 @@ index 3a5032e06..3facb7156 100644
|
|||||||
+ xserver_read_state_xdm(blueman_t)
|
+ xserver_read_state_xdm(blueman_t)
|
||||||
+')
|
+')
|
||||||
diff --git a/bluetooth.fc b/bluetooth.fc
|
diff --git a/bluetooth.fc b/bluetooth.fc
|
||||||
index 2b9c7f329..0086b95d1 100644
|
index 2b9c7f329..6ae8a62c9 100644
|
||||||
--- a/bluetooth.fc
|
--- a/bluetooth.fc
|
||||||
+++ b/bluetooth.fc
|
+++ b/bluetooth.fc
|
||||||
@@ -5,10 +5,14 @@
|
@@ -5,10 +5,15 @@
|
||||||
/etc/rc\.d/init\.d/dund -- gen_context(system_u:object_r:bluetooth_initrc_exec_t,s0)
|
/etc/rc\.d/init\.d/dund -- gen_context(system_u:object_r:bluetooth_initrc_exec_t,s0)
|
||||||
/etc/rc\.d/init\.d/pand -- gen_context(system_u:object_r:bluetooth_initrc_exec_t,s0)
|
/etc/rc\.d/init\.d/pand -- gen_context(system_u:object_r:bluetooth_initrc_exec_t,s0)
|
||||||
|
|
||||||
@ -10577,6 +10586,7 @@ index 2b9c7f329..0086b95d1 100644
|
|||||||
/usr/bin/rfcomm -- gen_context(system_u:object_r:bluetooth_exec_t,s0)
|
/usr/bin/rfcomm -- gen_context(system_u:object_r:bluetooth_exec_t,s0)
|
||||||
+/usr/bin/pand -- gen_context(system_u:object_r:bluetooth_exec_t,s0)
|
+/usr/bin/pand -- gen_context(system_u:object_r:bluetooth_exec_t,s0)
|
||||||
+/usr/libexec/bluetooth/bluetoothd -- gen_context(system_u:object_r:bluetooth_exec_t,s0)
|
+/usr/libexec/bluetooth/bluetoothd -- gen_context(system_u:object_r:bluetooth_exec_t,s0)
|
||||||
|
+/usr/libexec/bluetooth/obexd -- gen_context(system_u:object_r:bluetooth_exec_t,s0)
|
||||||
|
|
||||||
/usr/sbin/bluetoothd -- gen_context(system_u:object_r:bluetooth_exec_t,s0)
|
/usr/sbin/bluetoothd -- gen_context(system_u:object_r:bluetooth_exec_t,s0)
|
||||||
/usr/sbin/hciattach -- gen_context(system_u:object_r:bluetooth_exec_t,s0)
|
/usr/sbin/hciattach -- gen_context(system_u:object_r:bluetooth_exec_t,s0)
|
||||||
@ -13642,10 +13652,10 @@ index 000000000..ca526f823
|
|||||||
+ gnome_dontaudit_write_config_files(chrome_sandbox_nacl_t)
|
+ gnome_dontaudit_write_config_files(chrome_sandbox_nacl_t)
|
||||||
+')
|
+')
|
||||||
diff --git a/chronyd.fc b/chronyd.fc
|
diff --git a/chronyd.fc b/chronyd.fc
|
||||||
index 4e4143ed8..f03dba037 100644
|
index 4e4143ed8..9c06350c2 100644
|
||||||
--- a/chronyd.fc
|
--- a/chronyd.fc
|
||||||
+++ b/chronyd.fc
|
+++ b/chronyd.fc
|
||||||
@@ -1,13 +1,18 @@
|
@@ -1,13 +1,20 @@
|
||||||
-/etc/chrony\.keys -- gen_context(system_u:object_r:chronyd_keys_t,s0)
|
-/etc/chrony\.keys -- gen_context(system_u:object_r:chronyd_keys_t,s0)
|
||||||
+/etc/chrony\.keys.* -- gen_context(system_u:object_r:chronyd_keys_t,s0)
|
+/etc/chrony\.keys.* -- gen_context(system_u:object_r:chronyd_keys_t,s0)
|
||||||
|
|
||||||
@ -13655,6 +13665,8 @@ index 4e4143ed8..f03dba037 100644
|
|||||||
+
|
+
|
||||||
/usr/sbin/chronyd -- gen_context(system_u:object_r:chronyd_exec_t,s0)
|
/usr/sbin/chronyd -- gen_context(system_u:object_r:chronyd_exec_t,s0)
|
||||||
+/usr/libexec/chrony-helper -- gen_context(system_u:object_r:chronyd_exec_t,s0)
|
+/usr/libexec/chrony-helper -- gen_context(system_u:object_r:chronyd_exec_t,s0)
|
||||||
|
+
|
||||||
|
+/usr/bin/chronyc -- gen_context(system_u:object_r:chronyc_exec_t,s0)
|
||||||
|
|
||||||
/var/lib/chrony(/.*)? gen_context(system_u:object_r:chronyd_var_lib_t,s0)
|
/var/lib/chrony(/.*)? gen_context(system_u:object_r:chronyd_var_lib_t,s0)
|
||||||
|
|
||||||
@ -13667,7 +13679,7 @@ index 4e4143ed8..f03dba037 100644
|
|||||||
/var/run/chronyd\.pid -- gen_context(system_u:object_r:chronyd_var_run_t,s0)
|
/var/run/chronyd\.pid -- gen_context(system_u:object_r:chronyd_var_run_t,s0)
|
||||||
/var/run/chronyd\.sock -s gen_context(system_u:object_r:chronyd_var_run_t,s0)
|
/var/run/chronyd\.sock -s gen_context(system_u:object_r:chronyd_var_run_t,s0)
|
||||||
diff --git a/chronyd.if b/chronyd.if
|
diff --git a/chronyd.if b/chronyd.if
|
||||||
index 32e8265c2..ac74503d1 100644
|
index 32e8265c2..508f3b84f 100644
|
||||||
--- a/chronyd.if
|
--- a/chronyd.if
|
||||||
+++ b/chronyd.if
|
+++ b/chronyd.if
|
||||||
@@ -57,6 +57,24 @@ interface(`chronyd_exec',`
|
@@ -57,6 +57,24 @@ interface(`chronyd_exec',`
|
||||||
@ -13801,7 +13813,7 @@ index 32e8265c2..ac74503d1 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
####################################
|
####################################
|
||||||
@@ -176,28 +255,38 @@ interface(`chronyd_read_key_files',`
|
@@ -176,28 +255,81 @@ interface(`chronyd_read_key_files',`
|
||||||
#
|
#
|
||||||
interface(`chronyd_admin',`
|
interface(`chronyd_admin',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -13848,12 +13860,65 @@ index 32e8265c2..ac74503d1 100644
|
|||||||
+ admin_pattern($1, chronyd_unit_file_t)
|
+ admin_pattern($1, chronyd_unit_file_t)
|
||||||
+ chronyd_systemctl($1)
|
+ chronyd_systemctl($1)
|
||||||
+ allow $1 chronyd_unit_file_t:service all_service_perms;
|
+ allow $1 chronyd_unit_file_t:service all_service_perms;
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Execute chronyc in the chronyc domain.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed to transition.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`chronyd_domtrans_chronyc',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type chronyc_t, chronyc_exec_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ domtrans_pattern($1, chronyc_exec_t, chronyc_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Execute chronyc in the chronyc domain.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed to transition.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+## <param name="role">
|
||||||
|
+## <summary>
|
||||||
|
+## Role allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`chronyd_run_chronyc',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type chronyc_t;
|
||||||
|
+ attribute_role chronyc_roles;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ chronyd_domtrans_chronyc($1)
|
||||||
|
+ roleattribute $2 chronyc_roles;
|
||||||
')
|
')
|
||||||
diff --git a/chronyd.te b/chronyd.te
|
diff --git a/chronyd.te b/chronyd.te
|
||||||
index e5b621c29..cfc64f1b0 100644
|
index e5b621c29..89ecee1f7 100644
|
||||||
--- a/chronyd.te
|
--- a/chronyd.te
|
||||||
+++ b/chronyd.te
|
+++ b/chronyd.te
|
||||||
@@ -18,6 +18,9 @@ files_type(chronyd_keys_t)
|
@@ -5,6 +5,9 @@ policy_module(chronyd, 1.2.0)
|
||||||
|
# Declarations
|
||||||
|
#
|
||||||
|
|
||||||
|
+attribute_role chronyc_roles;
|
||||||
|
+roleattribute system_r chronyc_roles;
|
||||||
|
+
|
||||||
|
type chronyd_t;
|
||||||
|
type chronyd_exec_t;
|
||||||
|
init_daemon_domain(chronyd_t, chronyd_exec_t)
|
||||||
|
@@ -18,6 +21,9 @@ files_type(chronyd_keys_t)
|
||||||
type chronyd_tmpfs_t;
|
type chronyd_tmpfs_t;
|
||||||
files_tmpfs_file(chronyd_tmpfs_t)
|
files_tmpfs_file(chronyd_tmpfs_t)
|
||||||
|
|
||||||
@ -13863,13 +13928,25 @@ index e5b621c29..cfc64f1b0 100644
|
|||||||
type chronyd_var_lib_t;
|
type chronyd_var_lib_t;
|
||||||
files_type(chronyd_var_lib_t)
|
files_type(chronyd_var_lib_t)
|
||||||
|
|
||||||
@@ -32,11 +35,15 @@ files_pid_file(chronyd_var_run_t)
|
@@ -27,18 +33,33 @@ logging_log_file(chronyd_var_log_t)
|
||||||
|
type chronyd_var_run_t;
|
||||||
|
files_pid_file(chronyd_var_run_t)
|
||||||
|
|
||||||
|
+type chronyc_t;
|
||||||
|
+type chronyc_exec_t;
|
||||||
|
+domain_type(chronyc_t, chronyc_exec_t)
|
||||||
|
+init_system_domain(chronyc_t, chronyc_exec_t)
|
||||||
|
+role chronyc_roles types chronyc_t;
|
||||||
|
+
|
||||||
|
########################################
|
||||||
|
#
|
||||||
# Local policy
|
# Local policy
|
||||||
#
|
#
|
||||||
|
|
||||||
-allow chronyd_t self:capability { dac_override ipc_lock setuid setgid sys_resource sys_time };
|
-allow chronyd_t self:capability { dac_override ipc_lock setuid setgid sys_resource sys_time };
|
||||||
-allow chronyd_t self:process { getcap setcap setrlimit signal };
|
-allow chronyd_t self:process { getcap setcap setrlimit signal };
|
||||||
+allow chronyd_t self:capability { dac_read_search dac_override ipc_lock fsetid setuid setgid sys_nice sys_resource sys_time chown net_admin };
|
+allow chronyd_t self:capability { dac_read_search dac_override ipc_lock fsetid setuid setgid sys_nice sys_resource sys_time chown net_admin };
|
||||||
|
+allow chronyd_t self:capability2 block_suspend;
|
||||||
+allow chronyd_t self:process { getsched setsched getcap setcap setrlimit signal };
|
+allow chronyd_t self:process { getsched setsched getcap setcap setrlimit signal };
|
||||||
allow chronyd_t self:shm create_shm_perms;
|
allow chronyd_t self:shm create_shm_perms;
|
||||||
+allow chronyd_t self:udp_socket create_socket_perms;
|
+allow chronyd_t self:udp_socket create_socket_perms;
|
||||||
@ -13880,17 +13957,24 @@ index e5b621c29..cfc64f1b0 100644
|
|||||||
+allow chronyd_t chronyd_keys_t:file setattr_file_perms;
|
+allow chronyd_t chronyd_keys_t:file setattr_file_perms;
|
||||||
allow chronyd_t chronyd_keys_t:file read_file_perms;
|
allow chronyd_t chronyd_keys_t:file read_file_perms;
|
||||||
|
|
||||||
|
+allow chronyd_t chronyc_t:unix_dgram_socket sendto;
|
||||||
|
+
|
||||||
|
+allow chronyd_t chronyc_exec_t:file mmap_file_perms;
|
||||||
|
+
|
||||||
manage_dirs_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
|
manage_dirs_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
|
||||||
@@ -62,6 +69,8 @@ files_pid_filetrans(chronyd_t, chronyd_var_run_t, { dir file sock_file })
|
manage_files_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
|
||||||
|
fs_tmpfs_filetrans(chronyd_t, chronyd_tmpfs_t, { dir file })
|
||||||
|
@@ -61,6 +82,9 @@ files_pid_filetrans(chronyd_t, chronyd_var_run_t, { dir file sock_file })
|
||||||
|
|
||||||
kernel_read_system_state(chronyd_t)
|
kernel_read_system_state(chronyd_t)
|
||||||
kernel_read_network_state(chronyd_t)
|
kernel_read_network_state(chronyd_t)
|
||||||
|
+kernel_request_load_module(chronyd_t)
|
||||||
+clock_read_adjtime(chronyd_t)
|
|
||||||
+
|
+
|
||||||
|
+clock_read_adjtime(chronyd_t)
|
||||||
|
|
||||||
corenet_all_recvfrom_unlabeled(chronyd_t)
|
corenet_all_recvfrom_unlabeled(chronyd_t)
|
||||||
corenet_all_recvfrom_netlabel(chronyd_t)
|
corenet_all_recvfrom_netlabel(chronyd_t)
|
||||||
corenet_udp_sendrecv_generic_if(chronyd_t)
|
@@ -76,18 +100,62 @@ corenet_sendrecv_chronyd_server_packets(chronyd_t)
|
||||||
@@ -76,18 +85,42 @@ corenet_sendrecv_chronyd_server_packets(chronyd_t)
|
|
||||||
corenet_udp_bind_chronyd_port(chronyd_t)
|
corenet_udp_bind_chronyd_port(chronyd_t)
|
||||||
corenet_udp_sendrecv_chronyd_port(chronyd_t)
|
corenet_udp_sendrecv_chronyd_port(chronyd_t)
|
||||||
|
|
||||||
@ -13935,6 +14019,26 @@ index e5b621c29..cfc64f1b0 100644
|
|||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
+ ptp4l_rw_shm(chronyd_t)
|
+ ptp4l_rw_shm(chronyd_t)
|
||||||
')
|
')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+#
|
||||||
|
+# Local policy
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+allow chronyc_t self:capability { dac_read_search dac_override };
|
||||||
|
+allow chronyc_t self:udp_socket create_socket_perms;
|
||||||
|
+allow chronyc_t self:unix_dgram_socket create_socket_perms;
|
||||||
|
+allow chronyc_t self:netlink_route_socket create_netlink_socket_perms;
|
||||||
|
+
|
||||||
|
+allow chronyc_t chronyd_t:unix_dgram_socket sendto;
|
||||||
|
+
|
||||||
|
+manage_dirs_pattern(chronyc_t, chronyd_var_run_t, chronyd_var_run_t)
|
||||||
|
+manage_files_pattern(chronyc_t, chronyd_var_run_t, chronyd_var_run_t)
|
||||||
|
+manage_sock_files_pattern(chronyc_t, chronyd_var_run_t, chronyd_var_run_t)
|
||||||
|
+
|
||||||
|
+corecmd_exec_bin(chronyc_t)
|
||||||
|
+
|
||||||
|
+sysnet_read_config(chronyc_t)
|
||||||
diff --git a/cinder.fc b/cinder.fc
|
diff --git a/cinder.fc b/cinder.fc
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 000000000..4b318b783
|
index 000000000..4b318b783
|
||||||
@ -17134,10 +17238,10 @@ index 000000000..1cc5fa464
|
|||||||
+')
|
+')
|
||||||
diff --git a/conman.te b/conman.te
|
diff --git a/conman.te b/conman.te
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 000000000..25cbb9aff
|
index 000000000..246420052
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/conman.te
|
+++ b/conman.te
|
||||||
@@ -0,0 +1,99 @@
|
@@ -0,0 +1,114 @@
|
||||||
+policy_module(conman, 1.0.0)
|
+policy_module(conman, 1.0.0)
|
||||||
+
|
+
|
||||||
+########################################
|
+########################################
|
||||||
@ -17153,6 +17257,13 @@ index 000000000..25cbb9aff
|
|||||||
+## </desc>
|
+## </desc>
|
||||||
+gen_tunable(conman_can_network, false)
|
+gen_tunable(conman_can_network, false)
|
||||||
+
|
+
|
||||||
|
+## <desc>
|
||||||
|
+## <p>
|
||||||
|
+## Allow conman to manage nfs files
|
||||||
|
+## </p>
|
||||||
|
+## </desc>
|
||||||
|
+gen_tunable(conman_use_nfs, false)
|
||||||
|
+
|
||||||
+type conman_t;
|
+type conman_t;
|
||||||
+type conman_exec_t;
|
+type conman_exec_t;
|
||||||
+init_daemon_domain(conman_t, conman_exec_t)
|
+init_daemon_domain(conman_t, conman_exec_t)
|
||||||
@ -17209,6 +17320,8 @@ index 000000000..25cbb9aff
|
|||||||
+
|
+
|
||||||
+corecmd_exec_bin(conman_t)
|
+corecmd_exec_bin(conman_t)
|
||||||
+
|
+
|
||||||
|
+dev_read_urand(conman_t)
|
||||||
|
+
|
||||||
+logging_send_syslog_msg(conman_t)
|
+logging_send_syslog_msg(conman_t)
|
||||||
+
|
+
|
||||||
+sysnet_dns_name_resolve(conman_t)
|
+sysnet_dns_name_resolve(conman_t)
|
||||||
@ -17216,6 +17329,7 @@ index 000000000..25cbb9aff
|
|||||||
+userdom_use_user_ptys(conman_t)
|
+userdom_use_user_ptys(conman_t)
|
||||||
+
|
+
|
||||||
+term_use_usb_ttys(conman_t)
|
+term_use_usb_ttys(conman_t)
|
||||||
|
+term_use_ptmx(conman_t)
|
||||||
+
|
+
|
||||||
+tunable_policy(`conman_can_network',`
|
+tunable_policy(`conman_can_network',`
|
||||||
+ corenet_sendrecv_all_client_packets(conman_t)
|
+ corenet_sendrecv_all_client_packets(conman_t)
|
||||||
@ -17223,6 +17337,11 @@ index 000000000..25cbb9aff
|
|||||||
+ corenet_tcp_sendrecv_all_ports(conman_t)
|
+ corenet_tcp_sendrecv_all_ports(conman_t)
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
|
+tunable_policy(`conman_use_nfs',`
|
||||||
|
+ fs_manage_nfs_files(conman_t)
|
||||||
|
+ fs_read_nfs_symlinks(conman_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
+ freeipmi_stream_connect(conman_t)
|
+ freeipmi_stream_connect(conman_t)
|
||||||
+')
|
+')
|
||||||
@ -19865,7 +19984,7 @@ index 1303b3036..f5bd4aee8 100644
|
|||||||
+ logging_log_filetrans($1, var_log_t, file, "redhat-access-insights.log")
|
+ logging_log_filetrans($1, var_log_t, file, "redhat-access-insights.log")
|
||||||
')
|
')
|
||||||
diff --git a/cron.te b/cron.te
|
diff --git a/cron.te b/cron.te
|
||||||
index 7de385956..f91dd2fe5 100644
|
index 7de385956..46400791a 100644
|
||||||
--- a/cron.te
|
--- a/cron.te
|
||||||
+++ b/cron.te
|
+++ b/cron.te
|
||||||
@@ -11,46 +11,54 @@ gen_require(`
|
@@ -11,46 +11,54 @@ gen_require(`
|
||||||
@ -20504,12 +20623,13 @@ index 7de385956..f91dd2fe5 100644
|
|||||||
|
|
||||||
auth_use_nsswitch(system_cronjob_t)
|
auth_use_nsswitch(system_cronjob_t)
|
||||||
|
|
||||||
@@ -516,20 +520,26 @@ logging_read_generic_logs(system_cronjob_t)
|
@@ -516,20 +520,28 @@ logging_read_generic_logs(system_cronjob_t)
|
||||||
logging_send_audit_msgs(system_cronjob_t)
|
logging_send_audit_msgs(system_cronjob_t)
|
||||||
logging_send_syslog_msg(system_cronjob_t)
|
logging_send_syslog_msg(system_cronjob_t)
|
||||||
|
|
||||||
-miscfiles_read_localization(system_cronjob_t)
|
-miscfiles_read_localization(system_cronjob_t)
|
||||||
-
|
+miscfiles_filetrans_named_content_letsencrypt(system_cronjob_t)
|
||||||
|
|
||||||
seutil_read_config(system_cronjob_t)
|
seutil_read_config(system_cronjob_t)
|
||||||
|
|
||||||
+userdom_manage_tmpfs_files(system_cronjob_t, file)
|
+userdom_manage_tmpfs_files(system_cronjob_t, file)
|
||||||
@ -20534,7 +20654,7 @@ index 7de385956..f91dd2fe5 100644
|
|||||||
selinux_validate_context(system_cronjob_t)
|
selinux_validate_context(system_cronjob_t)
|
||||||
selinux_compute_access_vector(system_cronjob_t)
|
selinux_compute_access_vector(system_cronjob_t)
|
||||||
selinux_compute_create_context(system_cronjob_t)
|
selinux_compute_create_context(system_cronjob_t)
|
||||||
@@ -539,10 +549,22 @@ tunable_policy(`cron_can_relabel',`
|
@@ -539,10 +551,26 @@ tunable_policy(`cron_can_relabel',`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -20554,10 +20674,14 @@ index 7de385956..f91dd2fe5 100644
|
|||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
+ cron_generic_log_filetrans_log_insights(system_cronjob_t)
|
+ cron_generic_log_filetrans_log_insights(system_cronjob_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
+ chronyd_run_chronyc(system_cronjob_t,system_r)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -551,10 +573,6 @@ optional_policy(`
|
@@ -551,10 +579,6 @@ optional_policy(`
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
dbus_system_bus_client(system_cronjob_t)
|
dbus_system_bus_client(system_cronjob_t)
|
||||||
@ -20568,7 +20692,7 @@ index 7de385956..f91dd2fe5 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -567,6 +585,10 @@ optional_policy(`
|
@@ -567,6 +591,10 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -20579,7 +20703,7 @@ index 7de385956..f91dd2fe5 100644
|
|||||||
ftp_read_log(system_cronjob_t)
|
ftp_read_log(system_cronjob_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -591,6 +613,8 @@ optional_policy(`
|
@@ -591,6 +619,8 @@ optional_policy(`
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
mta_read_config(system_cronjob_t)
|
mta_read_config(system_cronjob_t)
|
||||||
mta_send_mail(system_cronjob_t)
|
mta_send_mail(system_cronjob_t)
|
||||||
@ -20588,7 +20712,7 @@ index 7de385956..f91dd2fe5 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -598,7 +622,31 @@ optional_policy(`
|
@@ -598,7 +628,31 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -20620,7 +20744,7 @@ index 7de385956..f91dd2fe5 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -607,7 +655,12 @@ optional_policy(`
|
@@ -607,7 +661,12 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -20633,7 +20757,7 @@ index 7de385956..f91dd2fe5 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -615,12 +668,27 @@ optional_policy(`
|
@@ -615,12 +674,27 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -20663,7 +20787,7 @@ index 7de385956..f91dd2fe5 100644
|
|||||||
#
|
#
|
||||||
|
|
||||||
allow cronjob_t self:process { signal_perms setsched };
|
allow cronjob_t self:process { signal_perms setsched };
|
||||||
@@ -628,12 +696,32 @@ allow cronjob_t self:fifo_file rw_fifo_file_perms;
|
@@ -628,12 +702,32 @@ allow cronjob_t self:fifo_file rw_fifo_file_perms;
|
||||||
allow cronjob_t self:unix_stream_socket create_stream_socket_perms;
|
allow cronjob_t self:unix_stream_socket create_stream_socket_perms;
|
||||||
allow cronjob_t self:unix_dgram_socket create_socket_perms;
|
allow cronjob_t self:unix_dgram_socket create_socket_perms;
|
||||||
|
|
||||||
@ -20697,7 +20821,7 @@ index 7de385956..f91dd2fe5 100644
|
|||||||
corenet_all_recvfrom_netlabel(cronjob_t)
|
corenet_all_recvfrom_netlabel(cronjob_t)
|
||||||
corenet_tcp_sendrecv_generic_if(cronjob_t)
|
corenet_tcp_sendrecv_generic_if(cronjob_t)
|
||||||
corenet_udp_sendrecv_generic_if(cronjob_t)
|
corenet_udp_sendrecv_generic_if(cronjob_t)
|
||||||
@@ -641,66 +729,141 @@ corenet_tcp_sendrecv_generic_node(cronjob_t)
|
@@ -641,66 +735,141 @@ corenet_tcp_sendrecv_generic_node(cronjob_t)
|
||||||
corenet_udp_sendrecv_generic_node(cronjob_t)
|
corenet_udp_sendrecv_generic_node(cronjob_t)
|
||||||
corenet_tcp_sendrecv_all_ports(cronjob_t)
|
corenet_tcp_sendrecv_all_ports(cronjob_t)
|
||||||
corenet_udp_sendrecv_all_ports(cronjob_t)
|
corenet_udp_sendrecv_all_ports(cronjob_t)
|
||||||
@ -27002,10 +27126,10 @@ index 000000000..d22ed691a
|
|||||||
+')
|
+')
|
||||||
diff --git a/dnssec.te b/dnssec.te
|
diff --git a/dnssec.te b/dnssec.te
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 000000000..238787661
|
index 000000000..b93540692
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/dnssec.te
|
+++ b/dnssec.te
|
||||||
@@ -0,0 +1,91 @@
|
@@ -0,0 +1,93 @@
|
||||||
+policy_module(dnssec, 1.0.0)
|
+policy_module(dnssec, 1.0.0)
|
||||||
+
|
+
|
||||||
+########################################
|
+########################################
|
||||||
@ -27049,6 +27173,8 @@ index 000000000..238787661
|
|||||||
+
|
+
|
||||||
+kernel_read_system_state(dnssec_trigger_t)
|
+kernel_read_system_state(dnssec_trigger_t)
|
||||||
+
|
+
|
||||||
|
+can_exec(dnssec_trigger_t, dnssec_trigger_exec_t)
|
||||||
|
+
|
||||||
+corecmd_exec_bin(dnssec_trigger_t)
|
+corecmd_exec_bin(dnssec_trigger_t)
|
||||||
+corecmd_exec_shell(dnssec_trigger_t)
|
+corecmd_exec_shell(dnssec_trigger_t)
|
||||||
+corecmd_read_all_executables(dnssec_trigger_t)
|
+corecmd_read_all_executables(dnssec_trigger_t)
|
||||||
@ -31797,7 +31923,7 @@ index e5b15fb7e..220622e84 100644
|
|||||||
|
|
||||||
diff --git a/ganesha.fc b/ganesha.fc
|
diff --git a/ganesha.fc b/ganesha.fc
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 000000000..855f58e55
|
index 000000000..c723bfb97
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/ganesha.fc
|
+++ b/ganesha.fc
|
||||||
@@ -0,0 +1,12 @@
|
@@ -0,0 +1,12 @@
|
||||||
@ -31809,8 +31935,8 @@ index 000000000..855f58e55
|
|||||||
+
|
+
|
||||||
+/usr/lib/systemd/system/nfs-ganesha.*e -- gen_context(system_u:object_r:ganesha_unit_file_t,s0)
|
+/usr/lib/systemd/system/nfs-ganesha.*e -- gen_context(system_u:object_r:ganesha_unit_file_t,s0)
|
||||||
+
|
+
|
||||||
+/var/log/ganesha.log -- gen_context(system_u:object_r:ganesha_var_log_t,s0)
|
+/var/log/ganesha.log.* -- gen_context(system_u:object_r:ganesha_var_log_t,s0)
|
||||||
+/var/log/ganesha-gfapi.log -- gen_context(system_u:object_r:ganesha_var_log_t,s0)
|
+/var/log/ganesha-gfapi.log.* -- gen_context(system_u:object_r:ganesha_var_log_t,s0)
|
||||||
+
|
+
|
||||||
+/var/run/ganesha(/.*)? gen_context(system_u:object_r:ganesha_var_run_t,s0)
|
+/var/run/ganesha(/.*)? gen_context(system_u:object_r:ganesha_var_run_t,s0)
|
||||||
diff --git a/ganesha.if b/ganesha.if
|
diff --git a/ganesha.if b/ganesha.if
|
||||||
@ -39473,7 +39599,7 @@ index fbb54e7d8..05c377768 100644
|
|||||||
|
|
||||||
########################################
|
########################################
|
||||||
diff --git a/inetd.te b/inetd.te
|
diff --git a/inetd.te b/inetd.te
|
||||||
index c6450df8a..ed6af7994 100644
|
index c6450df8a..94760a2ec 100644
|
||||||
--- a/inetd.te
|
--- a/inetd.te
|
||||||
+++ b/inetd.te
|
+++ b/inetd.te
|
||||||
@@ -21,6 +21,7 @@ files_pid_file(inetd_var_run_t)
|
@@ -21,6 +21,7 @@ files_pid_file(inetd_var_run_t)
|
||||||
@ -39571,7 +39697,7 @@ index c6450df8a..ed6af7994 100644
|
|||||||
dev_read_urand(inetd_child_t)
|
dev_read_urand(inetd_child_t)
|
||||||
|
|
||||||
fs_getattr_xattr_fs(inetd_child_t)
|
fs_getattr_xattr_fs(inetd_child_t)
|
||||||
@@ -230,7 +244,15 @@ auth_use_nsswitch(inetd_child_t)
|
@@ -230,7 +244,19 @@ auth_use_nsswitch(inetd_child_t)
|
||||||
|
|
||||||
logging_send_syslog_msg(inetd_child_t)
|
logging_send_syslog_msg(inetd_child_t)
|
||||||
|
|
||||||
@ -39579,6 +39705,10 @@ index c6450df8a..ed6af7994 100644
|
|||||||
+sysnet_read_config(inetd_child_t)
|
+sysnet_read_config(inetd_child_t)
|
||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
|
+ chronyd_run_chronyc(inetd_child_t,system_r)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
+ kerberos_use(inetd_child_t)
|
+ kerberos_use(inetd_child_t)
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
@ -40028,7 +40158,7 @@ index 000000000..61f2003c8
|
|||||||
+userdom_use_user_terminals(iotop_t)
|
+userdom_use_user_terminals(iotop_t)
|
||||||
diff --git a/ipa.fc b/ipa.fc
|
diff --git a/ipa.fc b/ipa.fc
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 000000000..74206edcb
|
index 000000000..61fd84f00
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/ipa.fc
|
+++ b/ipa.fc
|
||||||
@@ -0,0 +1,29 @@
|
@@ -0,0 +1,29 @@
|
||||||
@ -40057,7 +40187,7 @@ index 000000000..74206edcb
|
|||||||
+
|
+
|
||||||
+/var/log/ipa(/.*)? gen_context(system_u:object_r:ipa_log_t,s0)
|
+/var/log/ipa(/.*)? gen_context(system_u:object_r:ipa_log_t,s0)
|
||||||
+
|
+
|
||||||
+/var/log/ipareplica-conncheck.log -- gen_context(system_u:object_r:ipa_log_t,s0)
|
+/var/log/ipareplica-conncheck.log.* -- gen_context(system_u:object_r:ipa_log_t,s0)
|
||||||
+
|
+
|
||||||
+/var/run/ipa(/.*)? gen_context(system_u:object_r:ipa_var_run_t,s0)
|
+/var/run/ipa(/.*)? gen_context(system_u:object_r:ipa_var_run_t,s0)
|
||||||
+
|
+
|
||||||
@ -43698,10 +43828,10 @@ index 000000000..bd7e7fa17
|
|||||||
+')
|
+')
|
||||||
diff --git a/keepalived.te b/keepalived.te
|
diff --git a/keepalived.te b/keepalived.te
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 000000000..e5b8b3bbf
|
index 000000000..f84877209
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/keepalived.te
|
+++ b/keepalived.te
|
||||||
@@ -0,0 +1,100 @@
|
@@ -0,0 +1,101 @@
|
||||||
+policy_module(keepalived, 1.0.0)
|
+policy_module(keepalived, 1.0.0)
|
||||||
+
|
+
|
||||||
+########################################
|
+########################################
|
||||||
@ -43743,6 +43873,7 @@ index 000000000..e5b8b3bbf
|
|||||||
+kernel_read_network_state(keepalived_t)
|
+kernel_read_network_state(keepalived_t)
|
||||||
+kernel_request_load_module(keepalived_t)
|
+kernel_request_load_module(keepalived_t)
|
||||||
+kernel_rw_usermodehelper_state(keepalived_t)
|
+kernel_rw_usermodehelper_state(keepalived_t)
|
||||||
|
+kernel_search_network_sysctl(keepalived_t)
|
||||||
+
|
+
|
||||||
+auth_use_nsswitch(keepalived_t)
|
+auth_use_nsswitch(keepalived_t)
|
||||||
+
|
+
|
||||||
@ -46465,7 +46596,7 @@ index 73e2803ee..34ca3aa22 100644
|
|||||||
role_transition $2 l2tpd_initrc_exec_t system_r;
|
role_transition $2 l2tpd_initrc_exec_t system_r;
|
||||||
allow $2 system_r;
|
allow $2 system_r;
|
||||||
diff --git a/l2tp.te b/l2tp.te
|
diff --git a/l2tp.te b/l2tp.te
|
||||||
index bb06a7fee..01e784bf5 100644
|
index bb06a7fee..3339bd85c 100644
|
||||||
--- a/l2tp.te
|
--- a/l2tp.te
|
||||||
+++ b/l2tp.te
|
+++ b/l2tp.te
|
||||||
@@ -27,7 +27,7 @@ files_pid_file(l2tpd_var_run_t)
|
@@ -27,7 +27,7 @@ files_pid_file(l2tpd_var_run_t)
|
||||||
@ -46492,7 +46623,7 @@ index bb06a7fee..01e784bf5 100644
|
|||||||
corenet_all_recvfrom_unlabeled(l2tpd_t)
|
corenet_all_recvfrom_unlabeled(l2tpd_t)
|
||||||
corenet_all_recvfrom_netlabel(l2tpd_t)
|
corenet_all_recvfrom_netlabel(l2tpd_t)
|
||||||
corenet_raw_sendrecv_generic_if(l2tpd_t)
|
corenet_raw_sendrecv_generic_if(l2tpd_t)
|
||||||
@@ -75,19 +77,37 @@ corecmd_exec_bin(l2tpd_t)
|
@@ -75,19 +77,38 @@ corecmd_exec_bin(l2tpd_t)
|
||||||
|
|
||||||
dev_read_urand(l2tpd_t)
|
dev_read_urand(l2tpd_t)
|
||||||
|
|
||||||
@ -46524,6 +46655,7 @@ index bb06a7fee..01e784bf5 100644
|
|||||||
+ ipsec_mgmt_read_pid(l2tpd_t)
|
+ ipsec_mgmt_read_pid(l2tpd_t)
|
||||||
+ ipsec_filetrans_key_file(l2tpd_t)
|
+ ipsec_filetrans_key_file(l2tpd_t)
|
||||||
+ ipsec_manage_key_file(l2tpd_t)
|
+ ipsec_manage_key_file(l2tpd_t)
|
||||||
|
+ ipsec_kill_mgmt(l2tpd_t)
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
@ -46812,7 +46944,7 @@ index 3602712d0..af83a5b6b 100644
|
|||||||
+ allow $1 slapd_unit_file_t:service all_service_perms;
|
+ allow $1 slapd_unit_file_t:service all_service_perms;
|
||||||
')
|
')
|
||||||
diff --git a/ldap.te b/ldap.te
|
diff --git a/ldap.te b/ldap.te
|
||||||
index 4c2b1110e..7b306e4bb 100644
|
index 4c2b1110e..f01469806 100644
|
||||||
--- a/ldap.te
|
--- a/ldap.te
|
||||||
+++ b/ldap.te
|
+++ b/ldap.te
|
||||||
@@ -21,6 +21,9 @@ files_config_file(slapd_etc_t)
|
@@ -21,6 +21,9 @@ files_config_file(slapd_etc_t)
|
||||||
@ -46837,7 +46969,15 @@ index 4c2b1110e..7b306e4bb 100644
|
|||||||
allow slapd_t self:fifo_file rw_fifo_file_perms;
|
allow slapd_t self:fifo_file rw_fifo_file_perms;
|
||||||
allow slapd_t self:tcp_socket { accept listen };
|
allow slapd_t self:tcp_socket { accept listen };
|
||||||
|
|
||||||
@@ -69,9 +72,7 @@ allow slapd_t slapd_lock_t:file manage_file_perms;
|
@@ -60,6 +63,7 @@ read_lnk_files_pattern(slapd_t, slapd_cert_t, slapd_cert_t)
|
||||||
|
manage_dirs_pattern(slapd_t, slapd_db_t, slapd_db_t)
|
||||||
|
manage_files_pattern(slapd_t, slapd_db_t, slapd_db_t)
|
||||||
|
manage_lnk_files_pattern(slapd_t, slapd_db_t, slapd_db_t)
|
||||||
|
+allow slapd_t slapd_db_t:file map;
|
||||||
|
|
||||||
|
allow slapd_t slapd_etc_t:file read_file_perms;
|
||||||
|
|
||||||
|
@@ -69,9 +73,7 @@ allow slapd_t slapd_lock_t:file manage_file_perms;
|
||||||
files_lock_filetrans(slapd_t, slapd_lock_t, file)
|
files_lock_filetrans(slapd_t, slapd_lock_t, file)
|
||||||
|
|
||||||
manage_dirs_pattern(slapd_t, slapd_log_t, slapd_log_t)
|
manage_dirs_pattern(slapd_t, slapd_log_t, slapd_log_t)
|
||||||
@ -46848,7 +46988,7 @@ index 4c2b1110e..7b306e4bb 100644
|
|||||||
logging_log_filetrans(slapd_t, slapd_log_t, { file dir })
|
logging_log_filetrans(slapd_t, slapd_log_t, { file dir })
|
||||||
|
|
||||||
manage_dirs_pattern(slapd_t, slapd_replog_t, slapd_replog_t)
|
manage_dirs_pattern(slapd_t, slapd_replog_t, slapd_replog_t)
|
||||||
@@ -93,7 +94,6 @@ files_pid_filetrans(slapd_t, slapd_var_run_t, { dir file sock_file })
|
@@ -93,7 +95,6 @@ files_pid_filetrans(slapd_t, slapd_var_run_t, { dir file sock_file })
|
||||||
kernel_read_system_state(slapd_t)
|
kernel_read_system_state(slapd_t)
|
||||||
kernel_read_kernel_sysctls(slapd_t)
|
kernel_read_kernel_sysctls(slapd_t)
|
||||||
|
|
||||||
@ -46856,7 +46996,7 @@ index 4c2b1110e..7b306e4bb 100644
|
|||||||
corenet_all_recvfrom_netlabel(slapd_t)
|
corenet_all_recvfrom_netlabel(slapd_t)
|
||||||
corenet_tcp_sendrecv_generic_if(slapd_t)
|
corenet_tcp_sendrecv_generic_if(slapd_t)
|
||||||
corenet_tcp_sendrecv_generic_node(slapd_t)
|
corenet_tcp_sendrecv_generic_node(slapd_t)
|
||||||
@@ -115,25 +115,26 @@ fs_getattr_all_fs(slapd_t)
|
@@ -115,25 +116,26 @@ fs_getattr_all_fs(slapd_t)
|
||||||
fs_search_auto_mountpoints(slapd_t)
|
fs_search_auto_mountpoints(slapd_t)
|
||||||
|
|
||||||
files_read_etc_runtime_files(slapd_t)
|
files_read_etc_runtime_files(slapd_t)
|
||||||
@ -63258,7 +63398,7 @@ index bcd7d0a7d..9b397fdd7 100644
|
|||||||
+ unconfined_dontaudit_rw_packet_sockets(nscd_t)
|
+ unconfined_dontaudit_rw_packet_sockets(nscd_t)
|
||||||
+')
|
+')
|
||||||
diff --git a/nsd.fc b/nsd.fc
|
diff --git a/nsd.fc b/nsd.fc
|
||||||
index 4f2b1b663..6b300d54f 100644
|
index 4f2b1b663..0e24b49a9 100644
|
||||||
--- a/nsd.fc
|
--- a/nsd.fc
|
||||||
+++ b/nsd.fc
|
+++ b/nsd.fc
|
||||||
@@ -1,16 +1,19 @@
|
@@ -1,16 +1,19 @@
|
||||||
@ -63290,7 +63430,7 @@ index 4f2b1b663..6b300d54f 100644
|
|||||||
+/var/lib/nsd(/.*)? gen_context(system_u:object_r:nsd_zone_t,s0)
|
+/var/lib/nsd(/.*)? gen_context(system_u:object_r:nsd_zone_t,s0)
|
||||||
/var/run/nsd\.pid -- gen_context(system_u:object_r:nsd_var_run_t,s0)
|
/var/run/nsd\.pid -- gen_context(system_u:object_r:nsd_var_run_t,s0)
|
||||||
+
|
+
|
||||||
+/var/log/nsd\.log -- gen_context(system_u:object_r:nsd_log_t,s0)
|
+/var/log/nsd\.log.* -- gen_context(system_u:object_r:nsd_log_t,s0)
|
||||||
diff --git a/nsd.if b/nsd.if
|
diff --git a/nsd.if b/nsd.if
|
||||||
index a9c60ff87..ad4f14ad6 100644
|
index a9c60ff87..ad4f14ad6 100644
|
||||||
--- a/nsd.if
|
--- a/nsd.if
|
||||||
@ -69407,7 +69547,7 @@ index 9b157305b..cb00f200a 100644
|
|||||||
+ ')
|
+ ')
|
||||||
')
|
')
|
||||||
diff --git a/openvswitch.te b/openvswitch.te
|
diff --git a/openvswitch.te b/openvswitch.te
|
||||||
index 44dbc99ab..7bcb16c59 100644
|
index 44dbc99ab..6221f5b9a 100644
|
||||||
--- a/openvswitch.te
|
--- a/openvswitch.te
|
||||||
+++ b/openvswitch.te
|
+++ b/openvswitch.te
|
||||||
@@ -9,11 +9,8 @@ type openvswitch_t;
|
@@ -9,11 +9,8 @@ type openvswitch_t;
|
||||||
@ -69439,7 +69579,7 @@ index 44dbc99ab..7bcb16c59 100644
|
|||||||
|
|
||||||
-allow openvswitch_t self:capability { net_admin sys_nice sys_resource ipc_lock };
|
-allow openvswitch_t self:capability { net_admin sys_nice sys_resource ipc_lock };
|
||||||
-allow openvswitch_t self:process { setrlimit setsched signal };
|
-allow openvswitch_t self:process { setrlimit setsched signal };
|
||||||
+allow openvswitch_t self:capability { dac_override net_admin ipc_lock sys_module sys_nice sys_rawio sys_resource chown setgid setpcap setuid };
|
+allow openvswitch_t self:capability { dac_override dac_read_search net_admin ipc_lock sys_module sys_nice sys_rawio sys_resource chown setgid setpcap setuid kill };
|
||||||
+allow openvswitch_t self:capability2 block_suspend;
|
+allow openvswitch_t self:capability2 block_suspend;
|
||||||
+allow openvswitch_t self:process { fork setsched setrlimit signal setcap };
|
+allow openvswitch_t self:process { fork setsched setrlimit signal setcap };
|
||||||
allow openvswitch_t self:fifo_file rw_fifo_file_perms;
|
allow openvswitch_t self:fifo_file rw_fifo_file_perms;
|
||||||
@ -82044,7 +82184,7 @@ index 7cb8b1f9c..bef72173b 100644
|
|||||||
+ allow $1 puppet_var_run_t:dir search_dir_perms;
|
+ allow $1 puppet_var_run_t:dir search_dir_perms;
|
||||||
')
|
')
|
||||||
diff --git a/puppet.te b/puppet.te
|
diff --git a/puppet.te b/puppet.te
|
||||||
index 618dcfeed..5bd88a99d 100644
|
index 618dcfeed..56b9252c6 100644
|
||||||
--- a/puppet.te
|
--- a/puppet.te
|
||||||
+++ b/puppet.te
|
+++ b/puppet.te
|
||||||
@@ -6,25 +6,32 @@ policy_module(puppet, 1.4.0)
|
@@ -6,25 +6,32 @@ policy_module(puppet, 1.4.0)
|
||||||
@ -82106,7 +82246,7 @@ index 618dcfeed..5bd88a99d 100644
|
|||||||
|
|
||||||
type puppetmaster_t;
|
type puppetmaster_t;
|
||||||
type puppetmaster_exec_t;
|
type puppetmaster_exec_t;
|
||||||
@@ -56,161 +62,174 @@ files_tmp_file(puppetmaster_tmp_t)
|
@@ -56,161 +62,178 @@ files_tmp_file(puppetmaster_tmp_t)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -82305,53 +82445,49 @@ index 618dcfeed..5bd88a99d 100644
|
|||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
+ mysql_stream_connect(puppetagent_t)
|
+ mysql_stream_connect(puppetagent_t)
|
||||||
')
|
+')
|
||||||
|
+
|
||||||
optional_policy(`
|
+optional_policy(`
|
||||||
- cfengine_read_lib_files(puppet_t)
|
|
||||||
+ postgresql_stream_connect(puppetagent_t)
|
+ postgresql_stream_connect(puppetagent_t)
|
||||||
')
|
+')
|
||||||
|
+
|
||||||
optional_policy(`
|
+optional_policy(`
|
||||||
- consoletype_exec(puppet_t)
|
|
||||||
+ cfengine_read_lib_files(puppetagent_t)
|
+ cfengine_read_lib_files(puppetagent_t)
|
||||||
')
|
+')
|
||||||
|
+
|
||||||
optional_policy(`
|
+optional_policy(`
|
||||||
- hostname_exec(puppet_t)
|
|
||||||
+ consoletype_exec(puppetagent_t)
|
+ consoletype_exec(puppetagent_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
- mount_domtrans(puppet_t)
|
- cfengine_read_lib_files(puppet_t)
|
||||||
+ hostname_exec(puppetagent_t)
|
+ hostname_exec(puppetagent_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
- mta_send_mail(puppet_t)
|
- consoletype_exec(puppet_t)
|
||||||
+ mount_domtrans(puppetagent_t)
|
+ mount_domtrans(puppetagent_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
- hostname_exec(puppet_t)
|
||||||
|
+ mta_send_mail(puppetagent_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
- mount_domtrans(puppet_t)
|
||||||
|
+ networkmanager_dbus_chat(puppetagent_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
- mta_send_mail(puppet_t)
|
||||||
|
+ firewalld_dbus_chat(puppetagent_t)
|
||||||
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
- portage_domtrans(puppet_t)
|
- portage_domtrans(puppet_t)
|
||||||
- portage_domtrans_fetch(puppet_t)
|
- portage_domtrans_fetch(puppet_t)
|
||||||
- portage_domtrans_gcc_config(puppet_t)
|
- portage_domtrans_gcc_config(puppet_t)
|
||||||
+ mta_send_mail(puppetagent_t)
|
|
||||||
')
|
|
||||||
|
|
||||||
optional_policy(`
|
|
||||||
- files_rw_var_files(puppet_t)
|
|
||||||
+ networkmanager_dbus_chat(puppetagent_t)
|
|
||||||
+')
|
|
||||||
+
|
|
||||||
+optional_policy(`
|
|
||||||
+ firewalld_dbus_chat(puppetagent_t)
|
|
||||||
+')
|
|
||||||
|
|
||||||
- rpm_domtrans(puppet_t)
|
|
||||||
- rpm_manage_db(puppet_t)
|
|
||||||
- rpm_manage_log(puppet_t)
|
|
||||||
+optional_policy(`
|
|
||||||
+ portage_domtrans(puppetagent_t)
|
+ portage_domtrans(puppetagent_t)
|
||||||
+ portage_domtrans_fetch(puppetagent_t)
|
+ portage_domtrans_fetch(puppetagent_t)
|
||||||
+ portage_domtrans_gcc_config(puppetagent_t)
|
+ portage_domtrans_gcc_config(puppetagent_t)
|
||||||
@ -82363,21 +82499,29 @@ index 618dcfeed..5bd88a99d 100644
|
|||||||
+ rpm_domtrans(puppetagent_t)
|
+ rpm_domtrans(puppetagent_t)
|
||||||
+ rpm_manage_db(puppetagent_t)
|
+ rpm_manage_db(puppetagent_t)
|
||||||
+ rpm_manage_log(puppetagent_t)
|
+ rpm_manage_log(puppetagent_t)
|
||||||
+')
|
')
|
||||||
+
|
|
||||||
+optional_policy(`
|
optional_policy(`
|
||||||
|
- files_rw_var_files(puppet_t)
|
||||||
+ shorewall_domtrans(puppetagent_t)
|
+ shorewall_domtrans(puppetagent_t)
|
||||||
|
+')
|
||||||
|
|
||||||
|
- rpm_domtrans(puppet_t)
|
||||||
|
- rpm_manage_db(puppet_t)
|
||||||
|
- rpm_manage_log(puppet_t)
|
||||||
|
+optional_policy(`
|
||||||
|
+ unconfined_domain_noaudit(puppetagent_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
- unconfined_domain(puppet_t)
|
- unconfined_domain(puppet_t)
|
||||||
+ unconfined_domain_noaudit(puppetagent_t)
|
+ shorewall_domtrans(puppet_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
- usermanage_domtrans_groupadd(puppet_t)
|
- usermanage_domtrans_groupadd(puppet_t)
|
||||||
- usermanage_domtrans_useradd(puppet_t)
|
- usermanage_domtrans_useradd(puppet_t)
|
||||||
+ shorewall_domtrans(puppet_t)
|
+ rhsmcertd_dbus_chat(puppetagent_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -82398,7 +82542,7 @@ index 618dcfeed..5bd88a99d 100644
|
|||||||
|
|
||||||
allow puppetca_t puppet_var_lib_t:dir list_dir_perms;
|
allow puppetca_t puppet_var_lib_t:dir list_dir_perms;
|
||||||
manage_files_pattern(puppetca_t, puppet_var_lib_t, puppet_var_lib_t)
|
manage_files_pattern(puppetca_t, puppet_var_lib_t, puppet_var_lib_t)
|
||||||
@@ -221,6 +240,7 @@ allow puppetca_t puppet_log_t:dir search_dir_perms;
|
@@ -221,6 +244,7 @@ allow puppetca_t puppet_log_t:dir search_dir_perms;
|
||||||
allow puppetca_t puppet_var_run_t:dir search_dir_perms;
|
allow puppetca_t puppet_var_run_t:dir search_dir_perms;
|
||||||
|
|
||||||
kernel_read_system_state(puppetca_t)
|
kernel_read_system_state(puppetca_t)
|
||||||
@ -82406,7 +82550,7 @@ index 618dcfeed..5bd88a99d 100644
|
|||||||
kernel_read_kernel_sysctls(puppetca_t)
|
kernel_read_kernel_sysctls(puppetca_t)
|
||||||
|
|
||||||
corecmd_exec_bin(puppetca_t)
|
corecmd_exec_bin(puppetca_t)
|
||||||
@@ -229,15 +249,12 @@ corecmd_exec_shell(puppetca_t)
|
@@ -229,15 +253,12 @@ corecmd_exec_shell(puppetca_t)
|
||||||
dev_read_urand(puppetca_t)
|
dev_read_urand(puppetca_t)
|
||||||
dev_search_sysfs(puppetca_t)
|
dev_search_sysfs(puppetca_t)
|
||||||
|
|
||||||
@ -82422,7 +82566,7 @@ index 618dcfeed..5bd88a99d 100644
|
|||||||
miscfiles_read_generic_certs(puppetca_t)
|
miscfiles_read_generic_certs(puppetca_t)
|
||||||
|
|
||||||
seutil_read_file_contexts(puppetca_t)
|
seutil_read_file_contexts(puppetca_t)
|
||||||
@@ -246,38 +263,48 @@ optional_policy(`
|
@@ -246,38 +267,48 @@ optional_policy(`
|
||||||
hostname_exec(puppetca_t)
|
hostname_exec(puppetca_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -82488,7 +82632,7 @@ index 618dcfeed..5bd88a99d 100644
|
|||||||
|
|
||||||
kernel_dontaudit_search_kernel_sysctl(puppetmaster_t)
|
kernel_dontaudit_search_kernel_sysctl(puppetmaster_t)
|
||||||
kernel_read_network_state(puppetmaster_t)
|
kernel_read_network_state(puppetmaster_t)
|
||||||
@@ -289,23 +316,24 @@ corecmd_exec_bin(puppetmaster_t)
|
@@ -289,23 +320,24 @@ corecmd_exec_bin(puppetmaster_t)
|
||||||
corecmd_exec_shell(puppetmaster_t)
|
corecmd_exec_shell(puppetmaster_t)
|
||||||
|
|
||||||
corenet_all_recvfrom_netlabel(puppetmaster_t)
|
corenet_all_recvfrom_netlabel(puppetmaster_t)
|
||||||
@ -82519,7 +82663,7 @@ index 618dcfeed..5bd88a99d 100644
|
|||||||
|
|
||||||
selinux_validate_context(puppetmaster_t)
|
selinux_validate_context(puppetmaster_t)
|
||||||
|
|
||||||
@@ -314,26 +342,32 @@ auth_use_nsswitch(puppetmaster_t)
|
@@ -314,26 +346,32 @@ auth_use_nsswitch(puppetmaster_t)
|
||||||
logging_send_syslog_msg(puppetmaster_t)
|
logging_send_syslog_msg(puppetmaster_t)
|
||||||
|
|
||||||
miscfiles_read_generic_certs(puppetmaster_t)
|
miscfiles_read_generic_certs(puppetmaster_t)
|
||||||
@ -82557,7 +82701,7 @@ index 618dcfeed..5bd88a99d 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -342,3 +376,9 @@ optional_policy(`
|
@@ -342,3 +380,9 @@ optional_policy(`
|
||||||
rpm_exec(puppetmaster_t)
|
rpm_exec(puppetmaster_t)
|
||||||
rpm_read_db(puppetmaster_t)
|
rpm_read_db(puppetmaster_t)
|
||||||
')
|
')
|
||||||
@ -108436,10 +108580,10 @@ index 27a8480bc..fc3fca520 100644
|
|||||||
+
|
+
|
||||||
allow stunnel_t stunnel_port_t:tcp_socket name_bind;
|
allow stunnel_t stunnel_port_t:tcp_socket name_bind;
|
||||||
diff --git a/svnserve.fc b/svnserve.fc
|
diff --git a/svnserve.fc b/svnserve.fc
|
||||||
index effffd028..12ca090e1 100644
|
index effffd028..0d5c275de 100644
|
||||||
--- a/svnserve.fc
|
--- a/svnserve.fc
|
||||||
+++ b/svnserve.fc
|
+++ b/svnserve.fc
|
||||||
@@ -1,8 +1,13 @@
|
@@ -1,8 +1,15 @@
|
||||||
-/etc/rc\.d/init\.d/svnserve -- gen_context(system_u:object_r:svnserve_initrc_exec_t,s0)
|
-/etc/rc\.d/init\.d/svnserve -- gen_context(system_u:object_r:svnserve_initrc_exec_t,s0)
|
||||||
+/etc/rc.d/init.d/svnserve -- gen_context(system_u:object_r:svnserve_initrc_exec_t,s0)
|
+/etc/rc.d/init.d/svnserve -- gen_context(system_u:object_r:svnserve_initrc_exec_t,s0)
|
||||||
|
|
||||||
@ -108458,6 +108602,8 @@ index effffd028..12ca090e1 100644
|
|||||||
+/var/svn(/.*)? gen_context(system_u:object_r:svnserve_content_t,s0)
|
+/var/svn(/.*)? gen_context(system_u:object_r:svnserve_content_t,s0)
|
||||||
+/var/subversion/repo(/.*)? gen_context(system_u:object_r:svnserve_content_t,s0)
|
+/var/subversion/repo(/.*)? gen_context(system_u:object_r:svnserve_content_t,s0)
|
||||||
+/var/lib/subversion/repo(/.*)? gen_context(system_u:object_r:svnserve_content_t,s0)
|
+/var/lib/subversion/repo(/.*)? gen_context(system_u:object_r:svnserve_content_t,s0)
|
||||||
|
+
|
||||||
|
+/var/log/svnserve(/.*)? gen_context(system_u:object_r:svnserve_log_t,s0)
|
||||||
diff --git a/svnserve.if b/svnserve.if
|
diff --git a/svnserve.if b/svnserve.if
|
||||||
index 2ac91b6e0..a97033d2b 100644
|
index 2ac91b6e0..a97033d2b 100644
|
||||||
--- a/svnserve.if
|
--- a/svnserve.if
|
||||||
@ -108596,10 +108742,10 @@ index 2ac91b6e0..a97033d2b 100644
|
|||||||
')
|
')
|
||||||
+
|
+
|
||||||
diff --git a/svnserve.te b/svnserve.te
|
diff --git a/svnserve.te b/svnserve.te
|
||||||
index 49d688d66..451a64768 100644
|
index 49d688d66..f7e23fe71 100644
|
||||||
--- a/svnserve.te
|
--- a/svnserve.te
|
||||||
+++ b/svnserve.te
|
+++ b/svnserve.te
|
||||||
@@ -12,12 +12,18 @@ init_daemon_domain(svnserve_t, svnserve_exec_t)
|
@@ -12,12 +12,21 @@ init_daemon_domain(svnserve_t, svnserve_exec_t)
|
||||||
type svnserve_initrc_exec_t;
|
type svnserve_initrc_exec_t;
|
||||||
init_script_file(svnserve_initrc_exec_t)
|
init_script_file(svnserve_initrc_exec_t)
|
||||||
|
|
||||||
@ -108614,11 +108760,14 @@ index 49d688d66..451a64768 100644
|
|||||||
|
|
||||||
+type svnserve_tmp_t;
|
+type svnserve_tmp_t;
|
||||||
+files_tmp_file(svnserve_tmp_t)
|
+files_tmp_file(svnserve_tmp_t)
|
||||||
|
+
|
||||||
|
+type svnserve_log_t;
|
||||||
|
+logging_log_file(svnserve_log_t)
|
||||||
+
|
+
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# Local policy
|
# Local policy
|
||||||
@@ -27,6 +33,11 @@ allow svnserve_t self:fifo_file rw_fifo_file_perms;
|
@@ -27,6 +36,11 @@ allow svnserve_t self:fifo_file rw_fifo_file_perms;
|
||||||
allow svnserve_t self:tcp_socket create_stream_socket_perms;
|
allow svnserve_t self:tcp_socket create_stream_socket_perms;
|
||||||
allow svnserve_t self:unix_stream_socket { listen accept };
|
allow svnserve_t self:unix_stream_socket { listen accept };
|
||||||
|
|
||||||
@ -108630,17 +108779,19 @@ index 49d688d66..451a64768 100644
|
|||||||
manage_dirs_pattern(svnserve_t, svnserve_content_t, svnserve_content_t)
|
manage_dirs_pattern(svnserve_t, svnserve_content_t, svnserve_content_t)
|
||||||
manage_files_pattern(svnserve_t, svnserve_content_t, svnserve_content_t)
|
manage_files_pattern(svnserve_t, svnserve_content_t, svnserve_content_t)
|
||||||
|
|
||||||
@@ -34,9 +45,6 @@ manage_dirs_pattern(svnserve_t, svnserve_var_run_t, svnserve_var_run_t)
|
@@ -34,8 +48,9 @@ manage_dirs_pattern(svnserve_t, svnserve_var_run_t, svnserve_var_run_t)
|
||||||
manage_files_pattern(svnserve_t, svnserve_var_run_t, svnserve_var_run_t)
|
manage_files_pattern(svnserve_t, svnserve_var_run_t, svnserve_var_run_t)
|
||||||
files_pid_filetrans(svnserve_t, svnserve_var_run_t, { dir file })
|
files_pid_filetrans(svnserve_t, svnserve_var_run_t, { dir file })
|
||||||
|
|
||||||
-files_read_etc_files(svnserve_t)
|
-files_read_etc_files(svnserve_t)
|
||||||
-files_read_usr_files(svnserve_t)
|
-files_read_usr_files(svnserve_t)
|
||||||
-
|
+manage_files_pattern(svnserve_t, svnserve_log_t, svnserve_log_t)
|
||||||
|
+manage_dirs_pattern(svnserve_t, svnserve_log_t, svnserve_log_t)
|
||||||
|
+logging_log_filetrans(svnserve_t, svnserve_log_t, { dir file })
|
||||||
|
|
||||||
corenet_all_recvfrom_unlabeled(svnserve_t)
|
corenet_all_recvfrom_unlabeled(svnserve_t)
|
||||||
corenet_all_recvfrom_netlabel(svnserve_t)
|
corenet_all_recvfrom_netlabel(svnserve_t)
|
||||||
corenet_tcp_sendrecv_generic_if(svnserve_t)
|
@@ -52,8 +67,13 @@ corenet_tcp_sendrecv_svn_port(svnserve_t)
|
||||||
@@ -52,8 +60,9 @@ corenet_tcp_sendrecv_svn_port(svnserve_t)
|
|
||||||
corenet_udp_bind_svn_port(svnserve_t)
|
corenet_udp_bind_svn_port(svnserve_t)
|
||||||
corenet_udp_sendrecv_svn_port(svnserve_t)
|
corenet_udp_sendrecv_svn_port(svnserve_t)
|
||||||
|
|
||||||
@ -108652,6 +108803,10 @@ index 49d688d66..451a64768 100644
|
|||||||
+logging_send_syslog_msg(svnserve_t)
|
+logging_send_syslog_msg(svnserve_t)
|
||||||
|
|
||||||
sysnet_dns_name_resolve(svnserve_t)
|
sysnet_dns_name_resolve(svnserve_t)
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
+ kerberos_use(svnserve_t)
|
||||||
|
+')
|
||||||
diff --git a/swift.fc b/swift.fc
|
diff --git a/swift.fc b/swift.fc
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 000000000..6d897bc25
|
index 000000000..6d897bc25
|
||||||
@ -111616,10 +111771,10 @@ index 000000000..9524b50aa
|
|||||||
+')
|
+')
|
||||||
diff --git a/thumb.te b/thumb.te
|
diff --git a/thumb.te b/thumb.te
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 000000000..2b15dca23
|
index 000000000..d6affa561
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/thumb.te
|
+++ b/thumb.te
|
||||||
@@ -0,0 +1,172 @@
|
@@ -0,0 +1,173 @@
|
||||||
+policy_module(thumb, 1.0.0)
|
+policy_module(thumb, 1.0.0)
|
||||||
+
|
+
|
||||||
+########################################
|
+########################################
|
||||||
@ -111670,6 +111825,7 @@ index 000000000..2b15dca23
|
|||||||
+manage_files_pattern(thumb_t, thumb_home_t, thumb_home_t)
|
+manage_files_pattern(thumb_t, thumb_home_t, thumb_home_t)
|
||||||
+userdom_user_home_dir_filetrans(thumb_t, thumb_home_t, dir, ".thumbnails")
|
+userdom_user_home_dir_filetrans(thumb_t, thumb_home_t, dir, ".thumbnails")
|
||||||
+userdom_user_home_dir_filetrans(thumb_t, thumb_home_t, file, "missfont.log")
|
+userdom_user_home_dir_filetrans(thumb_t, thumb_home_t, file, "missfont.log")
|
||||||
|
+userdom_user_home_dir_filetrans(thumb_t, thumb_home_t, file)
|
||||||
+userdom_dontaudit_access_check_user_content(thumb_t)
|
+userdom_dontaudit_access_check_user_content(thumb_t)
|
||||||
+userdom_rw_inherited_user_tmp_files(thumb_t)
|
+userdom_rw_inherited_user_tmp_files(thumb_t)
|
||||||
+userdom_manage_home_texlive(thumb_t)
|
+userdom_manage_home_texlive(thumb_t)
|
||||||
@ -112173,10 +112329,10 @@ index 000000000..5185a9e8e
|
|||||||
+ sssd_stream_connect(tlp_t)
|
+ sssd_stream_connect(tlp_t)
|
||||||
+')
|
+')
|
||||||
diff --git a/tmpreaper.te b/tmpreaper.te
|
diff --git a/tmpreaper.te b/tmpreaper.te
|
||||||
index 585a77f95..9858c8b8d 100644
|
index 585a77f95..71981be9d 100644
|
||||||
--- a/tmpreaper.te
|
--- a/tmpreaper.te
|
||||||
+++ b/tmpreaper.te
|
+++ b/tmpreaper.te
|
||||||
@@ -5,20 +5,46 @@ policy_module(tmpreaper, 1.7.1)
|
@@ -5,20 +5,47 @@ policy_module(tmpreaper, 1.7.1)
|
||||||
# Declarations
|
# Declarations
|
||||||
#
|
#
|
||||||
|
|
||||||
@ -112208,6 +112364,7 @@ index 585a77f95..9858c8b8d 100644
|
|||||||
type tmpreaper_exec_t;
|
type tmpreaper_exec_t;
|
||||||
init_system_domain(tmpreaper_t, tmpreaper_exec_t)
|
init_system_domain(tmpreaper_t, tmpreaper_exec_t)
|
||||||
+application_domain(tmpreaper_t, tmpreaper_exec_t)
|
+application_domain(tmpreaper_t, tmpreaper_exec_t)
|
||||||
|
+init_nnp_daemon_domain(tmpreaper_t)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -112224,7 +112381,7 @@ index 585a77f95..9858c8b8d 100644
|
|||||||
|
|
||||||
dev_read_urand(tmpreaper_t)
|
dev_read_urand(tmpreaper_t)
|
||||||
|
|
||||||
@@ -27,15 +53,16 @@ corecmd_exec_shell(tmpreaper_t)
|
@@ -27,15 +54,16 @@ corecmd_exec_shell(tmpreaper_t)
|
||||||
|
|
||||||
fs_getattr_xattr_fs(tmpreaper_t)
|
fs_getattr_xattr_fs(tmpreaper_t)
|
||||||
fs_list_all(tmpreaper_t)
|
fs_list_all(tmpreaper_t)
|
||||||
@ -112246,7 +112403,7 @@ index 585a77f95..9858c8b8d 100644
|
|||||||
mls_file_read_all_levels(tmpreaper_t)
|
mls_file_read_all_levels(tmpreaper_t)
|
||||||
mls_file_write_all_levels(tmpreaper_t)
|
mls_file_write_all_levels(tmpreaper_t)
|
||||||
|
|
||||||
@@ -45,7 +72,6 @@ init_use_inherited_script_ptys(tmpreaper_t)
|
@@ -45,7 +73,6 @@ init_use_inherited_script_ptys(tmpreaper_t)
|
||||||
|
|
||||||
logging_send_syslog_msg(tmpreaper_t)
|
logging_send_syslog_msg(tmpreaper_t)
|
||||||
|
|
||||||
@ -112254,7 +112411,7 @@ index 585a77f95..9858c8b8d 100644
|
|||||||
miscfiles_delete_man_pages(tmpreaper_t)
|
miscfiles_delete_man_pages(tmpreaper_t)
|
||||||
|
|
||||||
ifdef(`distro_debian',`
|
ifdef(`distro_debian',`
|
||||||
@@ -53,10 +79,33 @@ ifdef(`distro_debian',`
|
@@ -53,10 +80,33 @@ ifdef(`distro_debian',`
|
||||||
')
|
')
|
||||||
|
|
||||||
ifdef(`distro_redhat',`
|
ifdef(`distro_redhat',`
|
||||||
@ -112289,7 +112446,7 @@ index 585a77f95..9858c8b8d 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -64,6 +113,7 @@ optional_policy(`
|
@@ -64,6 +114,7 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -112297,7 +112454,7 @@ index 585a77f95..9858c8b8d 100644
|
|||||||
apache_list_cache(tmpreaper_t)
|
apache_list_cache(tmpreaper_t)
|
||||||
apache_delete_cache_dirs(tmpreaper_t)
|
apache_delete_cache_dirs(tmpreaper_t)
|
||||||
apache_delete_cache_files(tmpreaper_t)
|
apache_delete_cache_files(tmpreaper_t)
|
||||||
@@ -79,7 +129,19 @@ optional_policy(`
|
@@ -79,7 +130,19 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -112318,7 +112475,7 @@ index 585a77f95..9858c8b8d 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -89,3 +151,8 @@ optional_policy(`
|
@@ -89,3 +152,8 @@ optional_policy(`
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
rpm_manage_cache(tmpreaper_t)
|
rpm_manage_cache(tmpreaper_t)
|
||||||
')
|
')
|
||||||
|
@ -19,7 +19,7 @@
|
|||||||
Summary: SELinux policy configuration
|
Summary: SELinux policy configuration
|
||||||
Name: selinux-policy
|
Name: selinux-policy
|
||||||
Version: 3.13.1
|
Version: 3.13.1
|
||||||
Release: 298%{?dist}
|
Release: 299%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: serefpolicy-%{version}.tgz
|
Source: serefpolicy-%{version}.tgz
|
||||||
@ -719,6 +719,32 @@ exit 0
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Tue Oct 24 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-299
|
||||||
|
- Label /usr/libexec/bluetooth/obexd as bluetoothd_exec_t to run process as bluetooth_t
|
||||||
|
- Allow chronyd_t do request kernel module and block_suspend capability
|
||||||
|
- Allow system_cronjob_t to create /var/lib/letsencrypt dir with right label
|
||||||
|
- Allow slapd_t domain to mmap files labeled as slpad_db_t BZ(1505414)
|
||||||
|
- Allow dnssec_trigger_t domain to execute binaries with dnssec_trigeer_exec_t BZ(1487912)
|
||||||
|
- Allow l2tpd_t domain to send SIGKILL to ipsec_mgmt_t domains BZ(1505220)
|
||||||
|
- Allow thumb_t creating thumb_home_t files in user_home_dir_t direcotry BZ(1474110)
|
||||||
|
- Allow httpd_t also read httpd_user_content_type dirs when httpd_enable_homedirs is enables
|
||||||
|
- Allow svnserve to use kerberos
|
||||||
|
- Allow conman to use ptmx. Add conman_use_nfs boolean
|
||||||
|
- Allow nnp transition for amavis and tmpreaper SELinux domains
|
||||||
|
- Allow chronyd_t to mmap chronyc_exec_t binary files
|
||||||
|
- Add dac_read_search capability to openvswitch_t domain
|
||||||
|
- Allow svnserve to manage own svnserve_log_t files/dirs
|
||||||
|
- Allow keepalived_t to search network sysctls
|
||||||
|
- Allow puppetagent_t domain dbus chat with rhsmcertd_t domain
|
||||||
|
- Add kill capability to openvswitch_t domain
|
||||||
|
- Label also compressed logs in /var/log for different services
|
||||||
|
- Allow inetd_child_t and system_cronjob_t to run chronyc.
|
||||||
|
- Allow chrony to create netlink route sockets
|
||||||
|
- Add SELinux support for chronyc
|
||||||
|
- Add support for running certbot(letsencrypt) in crontab
|
||||||
|
- Allow nnp trasintion for unconfined_service_t
|
||||||
|
- Allow unpriv user domains and unconfined_service_t to use chronyc
|
||||||
|
|
||||||
* Sun Oct 22 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-298
|
* Sun Oct 22 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-298
|
||||||
- Drop *.lst files from file list
|
- Drop *.lst files from file list
|
||||||
- Ship file_contexts.homedirs in store
|
- Ship file_contexts.homedirs in store
|
||||||
|
Loading…
Reference in New Issue
Block a user