rpms/selinux-policy
5
0
Fork 0
Code Issues Pull Requests Releases Activity

ysctl_modprobe_t and sysctl_hotplug_t are now obsoleted by usermodhelper_t

Browse Source
This commit is contained in:
Miroslav Grepl 2014-01-17 21:26:23 +01:00
parent 438fa3b5de
commit 912db9180b
2 changed files with 234 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

237
policy-rawhide-base.patch
View File

@ -14897,7 +14897,7 @@ index 7be4ddf..d5ef507 100644
+/sys/class/net/ib.* gen_context(system_u:object_r:sysctl_net_t,s0) +/sys/class/net/ib.* gen_context(system_u:object_r:sysctl_net_t,s0)
+/sys/kernel/uevent_helper -- gen_context(system_u:object_r:usermodehelper_t,s0) +/sys/kernel/uevent_helper -- gen_context(system_u:object_r:usermodehelper_t,s0)
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index e100d88..d3b9fb4 100644 index e100d88..7463ed0 100644
--- a/policy/modules/kernel/kernel.if --- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if +++ b/policy/modules/kernel/kernel.if
@@ -286,7 +286,7 @@ interface(`kernel_rw_unix_dgram_sockets',` @@ -286,7 +286,7 @@ interface(`kernel_rw_unix_dgram_sockets',`
@ -15036,7 +15036,116 @@ index e100d88..d3b9fb4 100644
## Do not audit attempts by caller to search ## Do not audit attempts by caller to search
## the base directory of sysctls. ## the base directory of sysctls.
## </summary> ## </summary>
@@ -2085,7 +2155,7 @@ interface(`kernel_dontaudit_list_all_sysctls',` @@ -1750,16 +1820,9 @@ interface(`kernel_rw_unix_sysctls',`
## Domain allowed access.
## </summary>
## </param>
-## <rolecap/>
#
interface(`kernel_read_hotplug_sysctls',`
- gen_require(`
- type proc_t, sysctl_t, sysctl_kernel_t, sysctl_hotplug_t;
- ')
-
- read_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_hotplug_t)
-
- list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
+ refpolicywarn(`$0($*) has been deprecated.')
')
########################################
@@ -1771,21 +1834,42 @@ interface(`kernel_read_hotplug_sysctls',`
## Domain allowed access.
## </summary>
## </param>
-## <rolecap/>
#
interface(`kernel_rw_hotplug_sysctls',`
- gen_require(`
- type proc_t, sysctl_t, sysctl_kernel_t, sysctl_hotplug_t;
- ')
+ refpolicywarn(`$0($*) has been deprecated.')
+')
- rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_hotplug_t)
+########################################
+## <summary>
+## Read the modprobe sysctl.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`kernel_read_modprobe_sysctls',`
+ refpolicywarn(`$0($*) has been deprecated.')
+')
- list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
+########################################
+## <summary>
+## Read and write the modprobe sysctl.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`kernel_rw_modprobe_sysctls',`
+ refpolicywarn(`$0($*) has been deprecated.')
')
########################################
## <summary>
-## Read the modprobe sysctl.
+## Read the hotplug sysctl.
## </summary>
## <param name="domain">
## <summary>
@@ -1794,33 +1878,32 @@ interface(`kernel_rw_hotplug_sysctls',`
## </param>
## <rolecap/>
#
-interface(`kernel_read_modprobe_sysctls',`
+interface(`kernel_read_usermodehelper',`
gen_require(`
- type proc_t, sysctl_t, sysctl_kernel_t, sysctl_modprobe_t;
+ type proc_t, sysctl_t, sysctl_kernel_t, usermodehelper_t;
')
- read_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_modprobe_t)
+ read_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, usermodehelper)
list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
')
########################################
## <summary>
-## Read and write the modprobe sysctl.
+## Read and write the hotplug sysctl.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
-## <rolecap/>
#
-interface(`kernel_rw_modprobe_sysctls',`
+interface(`kernel_rw_usermodehelper',`
gen_require(`
- type proc_t, sysctl_t, sysctl_kernel_t, sysctl_modprobe_t;
+ type proc_t, sysctl_t, sysctl_kernel_t, usermodehelper_t;
')
- rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_modprobe_t)
+ rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, usermodehelper_t)
list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
')
@@ -2085,7 +2168,7 @@ interface(`kernel_dontaudit_list_all_sysctls',`
') ')
dontaudit $1 sysctl_type:dir list_dir_perms; dontaudit $1 sysctl_type:dir list_dir_perms;
@ -15045,7 +15154,7 @@ index e100d88..d3b9fb4 100644
') ')
######################################## ########################################
@@ -2282,6 +2352,25 @@ interface(`kernel_list_unlabeled',` @@ -2282,6 +2365,25 @@ interface(`kernel_list_unlabeled',`
######################################## ########################################
## <summary> ## <summary>
@ -15071,7 +15180,7 @@ index e100d88..d3b9fb4 100644
## Read the process state (/proc/pid) of all unlabeled_t. ## Read the process state (/proc/pid) of all unlabeled_t.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -2306,7 +2395,7 @@ interface(`kernel_read_unlabeled_state',` @@ -2306,7 +2408,7 @@ interface(`kernel_read_unlabeled_state',`
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@ -15080,7 +15189,7 @@ index e100d88..d3b9fb4 100644
## </summary> ## </summary>
## </param> ## </param>
# #
@@ -2488,6 +2577,24 @@ interface(`kernel_rw_unlabeled_blk_files',` @@ -2488,6 +2590,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
######################################## ########################################
## <summary> ## <summary>
@ -15105,7 +15214,7 @@ index e100d88..d3b9fb4 100644
## Do not audit attempts by caller to get attributes for ## Do not audit attempts by caller to get attributes for
## unlabeled character devices. ## unlabeled character devices.
## </summary> ## </summary>
@@ -2525,6 +2632,24 @@ interface(`kernel_relabelfrom_unlabeled_dirs',` @@ -2525,6 +2645,24 @@ interface(`kernel_relabelfrom_unlabeled_dirs',`
######################################## ########################################
## <summary> ## <summary>
@ -15130,7 +15239,7 @@ index e100d88..d3b9fb4 100644
## Allow caller to relabel unlabeled files. ## Allow caller to relabel unlabeled files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -2667,6 +2792,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',` @@ -2667,6 +2805,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
######################################## ########################################
## <summary> ## <summary>
@ -15155,7 +15264,7 @@ index e100d88..d3b9fb4 100644
## Receive TCP packets from an unlabeled connection. ## Receive TCP packets from an unlabeled connection.
## </summary> ## </summary>
## <desc> ## <desc>
@@ -2694,6 +2837,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',` @@ -2694,6 +2850,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',`
######################################## ########################################
## <summary> ## <summary>
@ -15181,7 +15290,7 @@ index e100d88..d3b9fb4 100644
## Do not audit attempts to receive TCP packets from an unlabeled ## Do not audit attempts to receive TCP packets from an unlabeled
## connection. ## connection.
## </summary> ## </summary>
@@ -2803,6 +2965,33 @@ interface(`kernel_raw_recvfrom_unlabeled',` @@ -2803,6 +2978,33 @@ interface(`kernel_raw_recvfrom_unlabeled',`
allow $1 unlabeled_t:rawip_socket recvfrom; allow $1 unlabeled_t:rawip_socket recvfrom;
') ')
@ -15215,7 +15324,7 @@ index e100d88..d3b9fb4 100644
######################################## ########################################
## <summary> ## <summary>
@@ -2958,6 +3147,24 @@ interface(`kernel_relabelfrom_unlabeled_database',` @@ -2958,6 +3160,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
######################################## ########################################
## <summary> ## <summary>
@ -15240,7 +15349,7 @@ index e100d88..d3b9fb4 100644
## Unconfined access to kernel module resources. ## Unconfined access to kernel module resources.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -2972,5 +3179,505 @@ interface(`kernel_unconfined',` @@ -2972,5 +3192,505 @@ interface(`kernel_unconfined',`
') ')
typeattribute $1 kern_unconfined; typeattribute $1 kern_unconfined;
@ -15748,7 +15857,7 @@ index e100d88..d3b9fb4 100644
+ list_dirs_pattern($1, proc_t, userhelper_t) + list_dirs_pattern($1, proc_t, userhelper_t)
') ')
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index 8dbab4c..e387939 100644 index 8dbab4c..4b6c9ad 100644
--- a/policy/modules/kernel/kernel.te --- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te
@@ -25,6 +25,9 @@ attribute kern_unconfined; @@ -25,6 +25,9 @@ attribute kern_unconfined;
@ -15777,7 +15886,7 @@ index 8dbab4c..e387939 100644
allow debugfs_t self:filesystem associate; allow debugfs_t self:filesystem associate;
genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0) genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0)
@@ -95,9 +100,29 @@ genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,mls_systemhigh) @@ -95,9 +100,31 @@ genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,mls_systemhigh)
type proc_mdstat_t, proc_type; type proc_mdstat_t, proc_type;
genfscon proc /mdstat gen_context(system_u:object_r:proc_mdstat_t,s0) genfscon proc /mdstat gen_context(system_u:object_r:proc_mdstat_t,s0)
@ -15798,6 +15907,8 @@ index 8dbab4c..e387939 100644
+genfscon proc /sys/kernel/randomize_va_space gen_context(system_u:object_r:proc_security_t,s0) +genfscon proc /sys/kernel/randomize_va_space gen_context(system_u:object_r:proc_security_t,s0)
+ +
+type usermodehelper_t, proc_type; +type usermodehelper_t, proc_type;
+typealias usermodehelper_t alias sysctl_hotplug_t;
+typealias usermodehelper_t alias sysctl_modprobe_t;
+genfscon proc /sys/kernel/core_pattern gen_context(system_u:object_r:usermodehelper_t,s0) +genfscon proc /sys/kernel/core_pattern gen_context(system_u:object_r:usermodehelper_t,s0)
+genfscon proc /sys/kernel/hotplug gen_context(system_u:object_r:usermodehelper_t,s0) +genfscon proc /sys/kernel/hotplug gen_context(system_u:object_r:usermodehelper_t,s0)
+genfscon proc /sys/kernel/modprobe gen_context(system_u:object_r:usermodehelper_t,s0) +genfscon proc /sys/kernel/modprobe gen_context(system_u:object_r:usermodehelper_t,s0)
@ -15807,7 +15918,22 @@ index 8dbab4c..e387939 100644
type proc_xen_t, proc_type; type proc_xen_t, proc_type;
files_mountpoint(proc_xen_t) files_mountpoint(proc_xen_t)
genfscon proc /xen gen_context(system_u:object_r:proc_xen_t,s0) genfscon proc /xen gen_context(system_u:object_r:proc_xen_t,s0)
@@ -153,6 +178,10 @@ genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0) @@ -133,14 +160,6 @@ genfscon proc /sys/fs gen_context(system_u:object_r:sysctl_fs_t,s0)
type sysctl_kernel_t, sysctl_type;
genfscon proc /sys/kernel gen_context(system_u:object_r:sysctl_kernel_t,s0)
-# /proc/sys/kernel/modprobe file
-type sysctl_modprobe_t, sysctl_type;
-genfscon proc /sys/kernel/modprobe gen_context(system_u:object_r:sysctl_modprobe_t,s0)
-
-# /proc/sys/kernel/hotplug file
-type sysctl_hotplug_t, sysctl_type;
-genfscon proc /sys/kernel/hotplug gen_context(system_u:object_r:sysctl_hotplug_t,s0)
-
# /proc/sys/net directory and files
type sysctl_net_t, sysctl_type;
genfscon proc /sys/net gen_context(system_u:object_r:sysctl_net_t,s0)
@@ -153,6 +172,10 @@ genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0)
type sysctl_vm_t, sysctl_type; type sysctl_vm_t, sysctl_type;
genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0) genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0)
@ -15818,7 +15944,7 @@ index 8dbab4c..e387939 100644
# /proc/sys/dev directory and files # /proc/sys/dev directory and files
type sysctl_dev_t, sysctl_type; type sysctl_dev_t, sysctl_type;
genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0) genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
@@ -165,6 +194,14 @@ genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0) @@ -165,6 +188,14 @@ genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
type unlabeled_t; type unlabeled_t;
fs_associate(unlabeled_t) fs_associate(unlabeled_t)
sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
@ -15833,7 +15959,7 @@ index 8dbab4c..e387939 100644
# These initial sids are no longer used, and can be removed: # These initial sids are no longer used, and can be removed:
sid any_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) sid any_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
@@ -189,6 +226,7 @@ sid tcp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) @@ -189,6 +220,7 @@ sid tcp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
# kernel local policy # kernel local policy
# #
@ -15841,7 +15967,7 @@ index 8dbab4c..e387939 100644
allow kernel_t self:capability ~sys_module; allow kernel_t self:capability ~sys_module;
allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow kernel_t self:shm create_shm_perms; allow kernel_t self:shm create_shm_perms;
@@ -233,7 +271,6 @@ allow unlabeled_t unlabeled_t:packet { forward_in forward_out }; @@ -233,7 +265,6 @@ allow unlabeled_t unlabeled_t:packet { forward_in forward_out };
corenet_in_generic_if(unlabeled_t) corenet_in_generic_if(unlabeled_t)
corenet_in_generic_node(unlabeled_t) corenet_in_generic_node(unlabeled_t)
@ -15849,7 +15975,7 @@ index 8dbab4c..e387939 100644
corenet_all_recvfrom_netlabel(kernel_t) corenet_all_recvfrom_netlabel(kernel_t)
# Kernel-generated traffic e.g., ICMP replies: # Kernel-generated traffic e.g., ICMP replies:
corenet_raw_sendrecv_all_if(kernel_t) corenet_raw_sendrecv_all_if(kernel_t)
@@ -244,17 +281,21 @@ corenet_tcp_sendrecv_all_if(kernel_t) @@ -244,17 +275,21 @@ corenet_tcp_sendrecv_all_if(kernel_t)
corenet_tcp_sendrecv_all_nodes(kernel_t) corenet_tcp_sendrecv_all_nodes(kernel_t)
corenet_raw_send_generic_node(kernel_t) corenet_raw_send_generic_node(kernel_t)
corenet_send_all_packets(kernel_t) corenet_send_all_packets(kernel_t)
@ -15875,7 +16001,7 @@ index 8dbab4c..e387939 100644
# Mount root file system. Used when loading a policy # Mount root file system. Used when loading a policy
# from initrd, then mounting the root filesystem # from initrd, then mounting the root filesystem
@@ -263,7 +304,8 @@ fs_unmount_all_fs(kernel_t) @@ -263,7 +298,8 @@ fs_unmount_all_fs(kernel_t)
selinux_load_policy(kernel_t) selinux_load_policy(kernel_t)
@ -15885,7 +16011,7 @@ index 8dbab4c..e387939 100644
corecmd_exec_shell(kernel_t) corecmd_exec_shell(kernel_t)
corecmd_list_bin(kernel_t) corecmd_list_bin(kernel_t)
@@ -277,25 +319,49 @@ files_list_root(kernel_t) @@ -277,25 +313,49 @@ files_list_root(kernel_t)
files_list_etc(kernel_t) files_list_etc(kernel_t)
files_list_home(kernel_t) files_list_home(kernel_t)
files_read_usr_files(kernel_t) files_read_usr_files(kernel_t)
@ -15935,7 +16061,7 @@ index 8dbab4c..e387939 100644
') ')
optional_policy(` optional_policy(`
@@ -305,6 +371,19 @@ optional_policy(` @@ -305,6 +365,19 @@ optional_policy(`
optional_policy(` optional_policy(`
logging_send_syslog_msg(kernel_t) logging_send_syslog_msg(kernel_t)
@ -15955,7 +16081,7 @@ index 8dbab4c..e387939 100644
') ')
optional_policy(` optional_policy(`
@@ -312,6 +391,11 @@ optional_policy(` @@ -312,6 +385,11 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -15967,7 +16093,7 @@ index 8dbab4c..e387939 100644
# nfs kernel server needs kernel UDP access. It is less risky and painful # nfs kernel server needs kernel UDP access. It is less risky and painful
# to just give it everything. # to just give it everything.
allow kernel_t self:tcp_socket create_stream_socket_perms; allow kernel_t self:tcp_socket create_stream_socket_perms;
@@ -332,9 +416,6 @@ optional_policy(` @@ -332,9 +410,6 @@ optional_policy(`
sysnet_read_config(kernel_t) sysnet_read_config(kernel_t)
@ -15977,7 +16103,7 @@ index 8dbab4c..e387939 100644
rpc_udp_rw_nfs_sockets(kernel_t) rpc_udp_rw_nfs_sockets(kernel_t)
tunable_policy(`nfs_export_all_ro',` tunable_policy(`nfs_export_all_ro',`
@@ -343,9 +424,7 @@ optional_policy(` @@ -343,9 +418,7 @@ optional_policy(`
fs_read_noxattr_fs_files(kernel_t) fs_read_noxattr_fs_files(kernel_t)
fs_read_noxattr_fs_symlinks(kernel_t) fs_read_noxattr_fs_symlinks(kernel_t)
@ -15988,7 +16114,7 @@ index 8dbab4c..e387939 100644
') ')
tunable_policy(`nfs_export_all_rw',` tunable_policy(`nfs_export_all_rw',`
@@ -354,7 +433,7 @@ optional_policy(` @@ -354,7 +427,7 @@ optional_policy(`
fs_read_noxattr_fs_files(kernel_t) fs_read_noxattr_fs_files(kernel_t)
fs_read_noxattr_fs_symlinks(kernel_t) fs_read_noxattr_fs_symlinks(kernel_t)
@ -15997,7 +16123,7 @@ index 8dbab4c..e387939 100644
') ')
') ')
@@ -367,6 +446,15 @@ optional_policy(` @@ -367,6 +440,15 @@ optional_policy(`
unconfined_domain_noaudit(kernel_t) unconfined_domain_noaudit(kernel_t)
') ')
@ -16013,7 +16139,7 @@ index 8dbab4c..e387939 100644
######################################## ########################################
# #
# Unlabeled process local policy # Unlabeled process local policy
@@ -409,4 +497,26 @@ allow kern_unconfined unlabeled_t:dir_file_class_set *; @@ -409,4 +491,26 @@ allow kern_unconfined unlabeled_t:dir_file_class_set *;
allow kern_unconfined unlabeled_t:filesystem *; allow kern_unconfined unlabeled_t:filesystem *;
allow kern_unconfined unlabeled_t:association *; allow kern_unconfined unlabeled_t:association *;
allow kern_unconfined unlabeled_t:packet *; allow kern_unconfined unlabeled_t:packet *;
@ -23981,7 +24107,7 @@ index 6bf0ecc..115c533 100644
+ dontaudit $1 xserver_log_t:dir search_dir_perms; + dontaudit $1 xserver_log_t:dir search_dir_perms;
+') +')
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index 8b40377..326b206 100644 index 8b40377..d57efee 100644
--- a/policy/modules/services/xserver.te --- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te
@@ -26,28 +26,59 @@ gen_require(` @@ -26,28 +26,59 @@ gen_require(`
@ -25002,7 +25128,7 @@ index 8b40377..326b206 100644
manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
@@ -638,12 +1100,19 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) @@ -638,25 +1100,32 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t) files_search_var_lib(xserver_t)
@ -25024,7 +25150,8 @@ index 8b40377..326b206 100644
kernel_read_system_state(xserver_t) kernel_read_system_state(xserver_t)
kernel_read_device_sysctls(xserver_t) kernel_read_device_sysctls(xserver_t)
@@ -651,12 +1120,12 @@ kernel_read_modprobe_sysctls(xserver_t) -kernel_read_modprobe_sysctls(xserver_t)
+kernel_read_usermodhelper(xserver_t)
# Xorg wants to check if kernel is tainted # Xorg wants to check if kernel is tainted
kernel_read_kernel_sysctls(xserver_t) kernel_read_kernel_sysctls(xserver_t)
kernel_write_proc_files(xserver_t) kernel_write_proc_files(xserver_t)
@ -30944,7 +31071,7 @@ index c42fbc3..174cfdb 100644
## <summary> ## <summary>
## Set the attributes of iptables config files. ## Set the attributes of iptables config files.
diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te
index be8ed1e..8fc86ce 100644 index be8ed1e..271dc71 100644
--- a/policy/modules/system/iptables.te --- a/policy/modules/system/iptables.te
+++ b/policy/modules/system/iptables.te +++ b/policy/modules/system/iptables.te
@@ -16,15 +16,15 @@ role iptables_roles types iptables_t; @@ -16,15 +16,15 @@ role iptables_roles types iptables_t;
@ -30977,7 +31104,7 @@ index be8ed1e..8fc86ce 100644
manage_files_pattern(iptables_t, iptables_var_run_t, iptables_var_run_t) manage_files_pattern(iptables_t, iptables_var_run_t, iptables_var_run_t)
files_pid_filetrans(iptables_t, iptables_var_run_t, file) files_pid_filetrans(iptables_t, iptables_var_run_t, file)
@@ -49,6 +49,7 @@ allow iptables_t iptables_tmp_t:dir manage_dir_perms; @@ -49,11 +49,12 @@ allow iptables_t iptables_tmp_t:dir manage_dir_perms;
allow iptables_t iptables_tmp_t:file manage_file_perms; allow iptables_t iptables_tmp_t:file manage_file_perms;
files_tmp_filetrans(iptables_t, iptables_tmp_t, { file dir }) files_tmp_filetrans(iptables_t, iptables_tmp_t, { file dir })
@ -30985,6 +31112,12 @@ index be8ed1e..8fc86ce 100644
kernel_request_load_module(iptables_t) kernel_request_load_module(iptables_t)
kernel_read_system_state(iptables_t) kernel_read_system_state(iptables_t)
kernel_read_network_state(iptables_t) kernel_read_network_state(iptables_t)
kernel_read_kernel_sysctls(iptables_t)
-kernel_read_modprobe_sysctls(iptables_t)
+kernel_read_usermodhelper(iptables_t)
kernel_use_fds(iptables_t)
# needed by ipvsadm
@@ -64,6 +65,8 @@ corenet_relabelto_all_packets(iptables_t) @@ -64,6 +65,8 @@ corenet_relabelto_all_packets(iptables_t)
corenet_dontaudit_rw_tun_tap_dev(iptables_t) corenet_dontaudit_rw_tun_tap_dev(iptables_t)
@ -33898,7 +34031,7 @@ index 7449974..28cb8a3 100644
+ files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.dep.bin") + files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.dep.bin")
+') +')
diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
index 7a363b8..6f9d5d5 100644 index 7a363b8..70c672e 100644
--- a/policy/modules/system/modutils.te --- a/policy/modules/system/modutils.te
+++ b/policy/modules/system/modutils.te +++ b/policy/modules/system/modutils.te
@@ -5,7 +5,7 @@ policy_module(modutils, 1.14.0) @@ -5,7 +5,7 @@ policy_module(modutils, 1.14.0)
@ -34013,7 +34146,7 @@ index 7a363b8..6f9d5d5 100644
# Read module config and dependency information # Read module config and dependency information
list_dirs_pattern(insmod_t, modules_conf_t, modules_conf_t) list_dirs_pattern(insmod_t, modules_conf_t, modules_conf_t)
@@ -115,16 +124,24 @@ read_files_pattern(insmod_t, modules_conf_t, modules_conf_t) @@ -115,20 +124,28 @@ read_files_pattern(insmod_t, modules_conf_t, modules_conf_t)
list_dirs_pattern(insmod_t, modules_dep_t, modules_dep_t) list_dirs_pattern(insmod_t, modules_dep_t, modules_dep_t)
read_files_pattern(insmod_t, modules_dep_t, modules_dep_t) read_files_pattern(insmod_t, modules_dep_t, modules_dep_t)
@ -34039,6 +34172,11 @@ index 7a363b8..6f9d5d5 100644
# Rules for /proc/sys/kernel/tainted # Rules for /proc/sys/kernel/tainted
kernel_read_kernel_sysctls(insmod_t) kernel_read_kernel_sysctls(insmod_t)
kernel_rw_kernel_sysctl(insmod_t) kernel_rw_kernel_sysctl(insmod_t)
-kernel_read_hotplug_sysctls(insmod_t)
+kernel_read_usermodehelper(insmod_t)
kernel_setsched(insmod_t)
corecmd_exec_bin(insmod_t)
@@ -142,6 +159,7 @@ dev_rw_agp(insmod_t) @@ -142,6 +159,7 @@ dev_rw_agp(insmod_t)
dev_read_sound(insmod_t) dev_read_sound(insmod_t)
dev_write_sound(insmod_t) dev_write_sound(insmod_t)
@ -39789,7 +39927,7 @@ index 9a1650d..d7e8a01 100644
######################################## ########################################
diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index 39f185f..d3c9fcc 100644 index 39f185f..e17ab92 100644
--- a/policy/modules/system/udev.te --- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te +++ b/policy/modules/system/udev.te
@@ -17,16 +17,17 @@ init_daemon_domain(udev_t, udev_exec_t) @@ -17,16 +17,17 @@ init_daemon_domain(udev_t, udev_exec_t)
@ -39835,7 +39973,7 @@ index 39f185f..d3c9fcc 100644
allow udev_t udev_exec_t:file write; allow udev_t udev_exec_t:file write;
can_exec(udev_t, udev_exec_t) can_exec(udev_t, udev_exec_t)
@@ -64,31 +66,40 @@ can_exec(udev_t, udev_helper_exec_t) @@ -64,31 +66,38 @@ can_exec(udev_t, udev_helper_exec_t)
# read udev config # read udev config
allow udev_t udev_etc_t:file read_file_perms; allow udev_t udev_etc_t:file read_file_perms;
@ -39865,11 +40003,12 @@ index 39f185f..d3c9fcc 100644
kernel_getattr_core_if(udev_t) kernel_getattr_core_if(udev_t)
kernel_use_fds(udev_t) kernel_use_fds(udev_t)
kernel_read_device_sysctls(udev_t) kernel_read_device_sysctls(udev_t)
-kernel_read_hotplug_sysctls(udev_t)
-kernel_read_modprobe_sysctls(udev_t)
+kernel_read_fs_sysctls(udev_t) +kernel_read_fs_sysctls(udev_t)
kernel_read_hotplug_sysctls(udev_t)
kernel_read_modprobe_sysctls(udev_t)
kernel_read_kernel_sysctls(udev_t) kernel_read_kernel_sysctls(udev_t)
kernel_rw_hotplug_sysctls(udev_t) -kernel_rw_hotplug_sysctls(udev_t)
+kernel_rw_usermodhelper(udev_t)
kernel_rw_unix_dgram_sockets(udev_t) kernel_rw_unix_dgram_sockets(udev_t)
kernel_dgram_send(udev_t) kernel_dgram_send(udev_t)
-kernel_signal(udev_t) -kernel_signal(udev_t)
@ -39880,7 +40019,7 @@ index 39f185f..d3c9fcc 100644
#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182 #https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182
kernel_rw_net_sysctls(udev_t) kernel_rw_net_sysctls(udev_t)
@@ -99,6 +110,7 @@ corecmd_exec_all_executables(udev_t) @@ -99,6 +108,7 @@ corecmd_exec_all_executables(udev_t)
dev_rw_sysfs(udev_t) dev_rw_sysfs(udev_t)
dev_manage_all_dev_nodes(udev_t) dev_manage_all_dev_nodes(udev_t)
@ -39888,7 +40027,7 @@ index 39f185f..d3c9fcc 100644
dev_rw_generic_files(udev_t) dev_rw_generic_files(udev_t)
dev_delete_generic_files(udev_t) dev_delete_generic_files(udev_t)
dev_search_usbfs(udev_t) dev_search_usbfs(udev_t)
@@ -107,23 +119,31 @@ dev_relabel_all_dev_nodes(udev_t) @@ -107,23 +117,31 @@ dev_relabel_all_dev_nodes(udev_t)
# preserved, instead of short circuiting the relabel # preserved, instead of short circuiting the relabel
dev_relabel_generic_symlinks(udev_t) dev_relabel_generic_symlinks(udev_t)
dev_manage_generic_symlinks(udev_t) dev_manage_generic_symlinks(udev_t)
@ -39924,7 +40063,7 @@ index 39f185f..d3c9fcc 100644
mls_file_read_all_levels(udev_t) mls_file_read_all_levels(udev_t)
mls_file_write_all_levels(udev_t) mls_file_write_all_levels(udev_t)
@@ -145,17 +165,20 @@ auth_use_nsswitch(udev_t) @@ -145,17 +163,20 @@ auth_use_nsswitch(udev_t)
init_read_utmp(udev_t) init_read_utmp(udev_t)
init_dontaudit_write_utmp(udev_t) init_dontaudit_write_utmp(udev_t)
init_getattr_initctl(udev_t) init_getattr_initctl(udev_t)
@ -39946,7 +40085,7 @@ index 39f185f..d3c9fcc 100644
seutil_read_config(udev_t) seutil_read_config(udev_t)
seutil_read_default_contexts(udev_t) seutil_read_default_contexts(udev_t)
@@ -169,7 +192,11 @@ sysnet_read_dhcpc_pid(udev_t) @@ -169,7 +190,11 @@ sysnet_read_dhcpc_pid(udev_t)
sysnet_delete_dhcpc_pid(udev_t) sysnet_delete_dhcpc_pid(udev_t)
sysnet_signal_dhcpc(udev_t) sysnet_signal_dhcpc(udev_t)
sysnet_manage_config(udev_t) sysnet_manage_config(udev_t)
@ -39959,7 +40098,7 @@ index 39f185f..d3c9fcc 100644
userdom_dontaudit_search_user_home_content(udev_t) userdom_dontaudit_search_user_home_content(udev_t)
@@ -195,16 +222,9 @@ ifdef(`distro_gentoo',` @@ -195,16 +220,9 @@ ifdef(`distro_gentoo',`
') ')
ifdef(`distro_redhat',` ifdef(`distro_redhat',`
@ -39978,7 +40117,7 @@ index 39f185f..d3c9fcc 100644
# for arping used for static IP addresses on PCMCIA ethernet # for arping used for static IP addresses on PCMCIA ethernet
netutils_domtrans(udev_t) netutils_domtrans(udev_t)
@@ -242,6 +262,7 @@ optional_policy(` @@ -242,6 +260,7 @@ optional_policy(`
optional_policy(` optional_policy(`
cups_domtrans_config(udev_t) cups_domtrans_config(udev_t)
@ -39986,7 +40125,7 @@ index 39f185f..d3c9fcc 100644
') ')
optional_policy(` optional_policy(`
@@ -249,17 +270,31 @@ optional_policy(` @@ -249,17 +268,31 @@ optional_policy(`
dbus_use_system_bus_fds(udev_t) dbus_use_system_bus_fds(udev_t)
optional_policy(` optional_policy(`
@ -40020,7 +40159,7 @@ index 39f185f..d3c9fcc 100644
') ')
optional_policy(` optional_policy(`
@@ -289,6 +324,10 @@ optional_policy(` @@ -289,6 +322,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -40031,7 +40170,7 @@ index 39f185f..d3c9fcc 100644
openct_read_pid_files(udev_t) openct_read_pid_files(udev_t)
openct_domtrans(udev_t) openct_domtrans(udev_t)
') ')
@@ -303,6 +342,15 @@ optional_policy(` @@ -303,6 +340,15 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -40047,7 +40186,7 @@ index 39f185f..d3c9fcc 100644
unconfined_signal(udev_t) unconfined_signal(udev_t)
') ')
@@ -315,6 +363,7 @@ optional_policy(` @@ -315,6 +361,7 @@ optional_policy(`
kernel_read_xen_state(udev_t) kernel_read_xen_state(udev_t)
xen_manage_log(udev_t) xen_manage_log(udev_t)
xen_read_image_files(udev_t) xen_read_image_files(udev_t)

55
policy-rawhide-contrib.patch
View File

@ -10965,7 +10965,7 @@ index a731122..5279d4e 100644
') ')
+ +
diff --git a/cfengine.te b/cfengine.te diff --git a/cfengine.te b/cfengine.te
index fbe3ad9..ffde263 100644 index fbe3ad9..7cb4f72 100644
--- a/cfengine.te --- a/cfengine.te
+++ b/cfengine.te +++ b/cfengine.te
@@ -41,18 +41,13 @@ create_files_pattern(cfengine_domain, cfengine_log_t, cfengine_log_t) @@ -41,18 +41,13 @@ create_files_pattern(cfengine_domain, cfengine_log_t, cfengine_log_t)
@ -10988,6 +10988,15 @@ index fbe3ad9..ffde263 100644
sysnet_domtrans_ifconfig(cfengine_domain) sysnet_domtrans_ifconfig(cfengine_domain)
######################################## ########################################
@@ -69,7 +64,7 @@ domain_read_all_domains_state(cfengine_execd_t)
# Monitord local policy
#
-kernel_read_hotplug_sysctls(cfengine_monitord_t)
+kernel_read_usermodhelper(cfengine_monitord_t)
kernel_read_network_state(cfengine_monitord_t)
domain_read_all_domains_state(cfengine_monitord_t)
diff --git a/cgroup.if b/cgroup.if diff --git a/cgroup.if b/cgroup.if
index 85ca63f..1d1c99c 100644 index 85ca63f..1d1c99c 100644
--- a/cgroup.if --- a/cgroup.if
@ -20954,7 +20963,7 @@ index 8ce99ff..0819898 100644
+ logging_log_filetrans($1, devicekit_var_log_t, file, "pm-suspend.log") + logging_log_filetrans($1, devicekit_var_log_t, file, "pm-suspend.log")
') ')
diff --git a/devicekit.te b/devicekit.te diff --git a/devicekit.te b/devicekit.te
index 77a5003..2728ee6 100644 index 77a5003..75da3e4 100644
--- a/devicekit.te --- a/devicekit.te
+++ b/devicekit.te +++ b/devicekit.te
@@ -7,15 +7,15 @@ policy_module(devicekit, 1.3.1) @@ -7,15 +7,15 @@ policy_module(devicekit, 1.3.1)
@ -21105,6 +21114,15 @@ index 77a5003..2728ee6 100644
logging_log_filetrans(devicekit_power_t, devicekit_var_log_t, file) logging_log_filetrans(devicekit_power_t, devicekit_var_log_t, file)
manage_dirs_pattern(devicekit_power_t, devicekit_var_run_t, devicekit_var_run_t) manage_dirs_pattern(devicekit_power_t, devicekit_var_run_t, devicekit_var_run_t)
@@ -224,7 +236,7 @@ files_pid_filetrans(devicekit_power_t, devicekit_var_run_t, { dir file })
kernel_read_fs_sysctls(devicekit_power_t)
kernel_read_network_state(devicekit_power_t)
kernel_read_system_state(devicekit_power_t)
-kernel_rw_hotplug_sysctls(devicekit_power_t)
+kernel_rw_usermodhelper(devicekit_power_t)
kernel_rw_kernel_sysctl(devicekit_power_t)
kernel_rw_vm_sysctls(devicekit_power_t)
kernel_search_debugfs(devicekit_power_t)
@@ -248,21 +260,18 @@ domain_read_all_domains_state(devicekit_power_t) @@ -248,21 +260,18 @@ domain_read_all_domains_state(devicekit_power_t)
files_read_kernel_img(devicekit_power_t) files_read_kernel_img(devicekit_power_t)
@ -36526,9 +36544,18 @@ index 5297064..6ba8108 100644
domain_system_change_exemption($1) domain_system_change_exemption($1)
role_transition $2 kudzu_initrc_exec_t system_r; role_transition $2 kudzu_initrc_exec_t system_r;
diff --git a/kudzu.te b/kudzu.te diff --git a/kudzu.te b/kudzu.te
index 1664036..d10ed5a 100644 index 1664036..b67a112 100644
--- a/kudzu.te --- a/kudzu.te
+++ b/kudzu.te +++ b/kudzu.te
@@ -47,7 +47,7 @@ kernel_read_device_sysctls(kudzu_t)
kernel_read_kernel_sysctls(kudzu_t)
kernel_read_network_state(kudzu_t)
kernel_read_system_state(kudzu_t)
-kernel_rw_hotplug_sysctls(kudzu_t)
+kernel_rw_usermodhelper(kudzu_t)
kernel_rw_kernel_sysctl(kudzu_t)
corecmd_exec_all_executables(kudzu_t)
@@ -63,7 +63,6 @@ dev_rwx_zero(kudzu_t) @@ -63,7 +63,6 @@ dev_rwx_zero(kudzu_t)
domain_use_interactive_fds(kudzu_t) domain_use_interactive_fds(kudzu_t)
@ -48695,10 +48722,10 @@ index db9578f..4309e3d 100644
') ')
+ +
diff --git a/ncftool.te b/ncftool.te diff --git a/ncftool.te b/ncftool.te
index 71f30ba..d20f048 100644 index 71f30ba..4976452 100644
--- a/ncftool.te --- a/ncftool.te
+++ b/ncftool.te +++ b/ncftool.te
@@ -22,6 +22,7 @@ role ncftool_roles types ncftool_t; @@ -22,13 +22,14 @@ role ncftool_roles types ncftool_t;
allow ncftool_t self:capability net_admin; allow ncftool_t self:capability net_admin;
allow ncftool_t self:process signal; allow ncftool_t self:process signal;
@ -48706,6 +48733,14 @@ index 71f30ba..d20f048 100644
allow ncftool_t self:fifo_file manage_fifo_file_perms; allow ncftool_t self:fifo_file manage_fifo_file_perms;
allow ncftool_t self:unix_stream_socket create_stream_socket_perms; allow ncftool_t self:unix_stream_socket create_stream_socket_perms;
allow ncftool_t self:netlink_route_socket create_netlink_socket_perms; allow ncftool_t self:netlink_route_socket create_netlink_socket_perms;
allow ncftool_t self:tcp_socket create_stream_socket_perms;
kernel_read_kernel_sysctls(ncftool_t)
-kernel_read_modprobe_sysctls(ncftool_t)
+kernel_read_usermodhelper(ncftool_t)
kernel_read_network_state(ncftool_t)
kernel_read_system_state(ncftool_t)
kernel_request_load_module(ncftool_t)
@@ -41,11 +42,11 @@ domain_read_all_domains_state(ncftool_t) @@ -41,11 +42,11 @@ domain_read_all_domains_state(ncftool_t)
dev_read_sysfs(ncftool_t) dev_read_sysfs(ncftool_t)
@ -93900,7 +93935,7 @@ index e29db63..061fb98 100644
domain_system_change_exemption($1) domain_system_change_exemption($1)
role_transition $2 tuned_initrc_exec_t system_r; role_transition $2 tuned_initrc_exec_t system_r;
diff --git a/tuned.te b/tuned.te diff --git a/tuned.te b/tuned.te
index 393a330..0075849 100644 index 393a330..6ce4613 100644
--- a/tuned.te --- a/tuned.te
+++ b/tuned.te +++ b/tuned.te
@@ -21,6 +21,9 @@ files_config_file(tuned_rw_etc_t) @@ -21,6 +21,9 @@ files_config_file(tuned_rw_etc_t)
@ -93930,7 +93965,7 @@ index 393a330..0075849 100644
read_files_pattern(tuned_t, tuned_etc_t, tuned_etc_t) read_files_pattern(tuned_t, tuned_etc_t, tuned_etc_t)
exec_files_pattern(tuned_t, tuned_etc_t, tuned_etc_t) exec_files_pattern(tuned_t, tuned_etc_t, tuned_etc_t)
@@ -41,14 +48,19 @@ manage_files_pattern(tuned_t, tuned_etc_t, tuned_rw_etc_t) @@ -41,22 +48,29 @@ manage_files_pattern(tuned_t, tuned_etc_t, tuned_rw_etc_t)
files_etc_filetrans(tuned_t, tuned_rw_etc_t, file, "active_profile") files_etc_filetrans(tuned_t, tuned_rw_etc_t, file, "active_profile")
manage_dirs_pattern(tuned_t, tuned_log_t, tuned_log_t) manage_dirs_pattern(tuned_t, tuned_log_t, tuned_log_t)
@ -93954,9 +93989,11 @@ index 393a330..0075849 100644
kernel_read_system_state(tuned_t) kernel_read_system_state(tuned_t)
kernel_read_network_state(tuned_t) kernel_read_network_state(tuned_t)
@@ -57,6 +69,8 @@ kernel_request_load_module(tuned_t) kernel_read_kernel_sysctls(tuned_t)
kernel_request_load_module(tuned_t)
kernel_rw_kernel_sysctl(tuned_t) kernel_rw_kernel_sysctl(tuned_t)
kernel_rw_hotplug_sysctls(tuned_t) -kernel_rw_hotplug_sysctls(tuned_t)
+kernel_rw_usermodhelper(tuned_t)
kernel_rw_vm_sysctls(tuned_t) kernel_rw_vm_sysctls(tuned_t)
+kernel_setsched(tuned_t) +kernel_setsched(tuned_t)
+kernel_rw_all_sysctls(tuned_t) +kernel_rw_all_sysctls(tuned_t)