From 93e99e4693367e42c025c261cf27edd34373a3d3 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Sun, 19 Jan 2014 22:18:55 +0100 Subject: [PATCH] Rename badly used userhelper_t in kernel.if to usermodehelper --- policy-rawhide-base.patch | 197 ++++++++++++++--------------------- policy-rawhide-contrib.patch | 32 +++--- 2 files changed, 97 insertions(+), 132 deletions(-) diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index a3ab12e0..172f475a 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -14897,7 +14897,7 @@ index 7be4ddf..d5ef507 100644 +/sys/class/net/ib.* gen_context(system_u:object_r:sysctl_net_t,s0) +/sys/kernel/uevent_helper -- gen_context(system_u:object_r:usermodehelper_t,s0) diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if -index e100d88..854e39d 100644 +index e100d88..3910ec4 100644 --- a/policy/modules/kernel/kernel.if +++ b/policy/modules/kernel/kernel.if @@ -286,7 +286,7 @@ interface(`kernel_rw_unix_dgram_sockets',` @@ -15054,7 +15054,7 @@ index e100d88..854e39d 100644 ') ######################################## -@@ -1771,21 +1834,42 @@ interface(`kernel_read_hotplug_sysctls',` +@@ -1771,16 +1834,9 @@ interface(`kernel_read_hotplug_sysctls',` ## Domain allowed access. ## ## @@ -15064,88 +15064,51 @@ index e100d88..854e39d 100644 - gen_require(` - type proc_t, sysctl_t, sysctl_kernel_t, sysctl_hotplug_t; - ') -+ refpolicywarn(`$0($*) has been deprecated.') -+') - +- - rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_hotplug_t) -+######################################## -+## -+## Read the modprobe sysctl. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`kernel_read_modprobe_sysctls',` -+ refpolicywarn(`$0($*) has been deprecated.') -+') - +- - list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t) -+######################################## -+## -+## Read and write the modprobe sysctl. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`kernel_rw_modprobe_sysctls',` + refpolicywarn(`$0($*) has been deprecated.') ') ######################################## - ## --## Read the modprobe sysctl. -+## Read the hotplug sysctl. - ## - ## - ## -@@ -1794,33 +1878,32 @@ interface(`kernel_rw_hotplug_sysctls',` - ## - ## - # --interface(`kernel_read_modprobe_sysctls',` -+interface(`kernel_read_usermodehelper',` - gen_require(` -- type proc_t, sysctl_t, sysctl_kernel_t, sysctl_modprobe_t; -+ type proc_t, sysctl_t, sysctl_kernel_t, usermodehelper_t; - ') - -- read_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_modprobe_t) -+ read_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, usermodehelper_t) - - list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t) - ') - - ######################################## - ## --## Read and write the modprobe sysctl. -+## Read and write the hotplug sysctl. - ## - ## - ## +@@ -1792,16 +1848,9 @@ interface(`kernel_rw_hotplug_sysctls',` ## Domain allowed access. ## ## -## # --interface(`kernel_rw_modprobe_sysctls',` -+interface(`kernel_rw_usermodehelper',` - gen_require(` + interface(`kernel_read_modprobe_sysctls',` +- gen_require(` - type proc_t, sysctl_t, sysctl_kernel_t, sysctl_modprobe_t; -+ type proc_t, sysctl_t, sysctl_kernel_t, usermodehelper_t; - ') - -- rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_modprobe_t) -+ rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, usermodehelper_t) - - list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t) +- ') +- +- read_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_modprobe_t) +- +- list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t) ++ refpolicywarn(`$0($*) has been deprecated.') ') -@@ -2085,7 +2168,7 @@ interface(`kernel_dontaudit_list_all_sysctls',` + + ######################################## +@@ -1813,16 +1862,9 @@ interface(`kernel_read_modprobe_sysctls',` + ## Domain allowed access. + ## + ## +-## + # + interface(`kernel_rw_modprobe_sysctls',` +- gen_require(` +- type proc_t, sysctl_t, sysctl_kernel_t, sysctl_modprobe_t; +- ') +- +- rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_modprobe_t) +- +- list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t) ++ refpolicywarn(`$0($*) has been deprecated.') + ') + + ######################################## +@@ -2085,7 +2127,7 @@ interface(`kernel_dontaudit_list_all_sysctls',` ') dontaudit $1 sysctl_type:dir list_dir_perms; @@ -15154,7 +15117,7 @@ index e100d88..854e39d 100644 ') ######################################## -@@ -2282,6 +2365,25 @@ interface(`kernel_list_unlabeled',` +@@ -2282,6 +2324,25 @@ interface(`kernel_list_unlabeled',` ######################################## ## @@ -15180,7 +15143,7 @@ index e100d88..854e39d 100644 ## Read the process state (/proc/pid) of all unlabeled_t. ## ## -@@ -2306,7 +2408,7 @@ interface(`kernel_read_unlabeled_state',` +@@ -2306,7 +2367,7 @@ interface(`kernel_read_unlabeled_state',` ## ## ## @@ -15189,7 +15152,7 @@ index e100d88..854e39d 100644 ## ## # -@@ -2488,6 +2590,24 @@ interface(`kernel_rw_unlabeled_blk_files',` +@@ -2488,6 +2549,24 @@ interface(`kernel_rw_unlabeled_blk_files',` ######################################## ## @@ -15214,7 +15177,7 @@ index e100d88..854e39d 100644 ## Do not audit attempts by caller to get attributes for ## unlabeled character devices. ## -@@ -2525,6 +2645,24 @@ interface(`kernel_relabelfrom_unlabeled_dirs',` +@@ -2525,6 +2604,24 @@ interface(`kernel_relabelfrom_unlabeled_dirs',` ######################################## ## @@ -15239,7 +15202,7 @@ index e100d88..854e39d 100644 ## Allow caller to relabel unlabeled files. ## ## -@@ -2667,6 +2805,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',` +@@ -2667,6 +2764,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',` ######################################## ## @@ -15264,7 +15227,7 @@ index e100d88..854e39d 100644 ## Receive TCP packets from an unlabeled connection. ## ## -@@ -2694,6 +2850,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',` +@@ -2694,6 +2809,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',` ######################################## ## @@ -15290,7 +15253,7 @@ index e100d88..854e39d 100644 ## Do not audit attempts to receive TCP packets from an unlabeled ## connection. ## -@@ -2803,6 +2978,33 @@ interface(`kernel_raw_recvfrom_unlabeled',` +@@ -2803,6 +2937,33 @@ interface(`kernel_raw_recvfrom_unlabeled',` allow $1 unlabeled_t:rawip_socket recvfrom; ') @@ -15324,7 +15287,7 @@ index e100d88..854e39d 100644 ######################################## ## -@@ -2958,6 +3160,24 @@ interface(`kernel_relabelfrom_unlabeled_database',` +@@ -2958,6 +3119,24 @@ interface(`kernel_relabelfrom_unlabeled_database',` ######################################## ## @@ -15349,7 +15312,7 @@ index e100d88..854e39d 100644 ## Unconfined access to kernel module resources. ## ## -@@ -2972,5 +3192,525 @@ interface(`kernel_unconfined',` +@@ -2972,5 +3151,525 @@ interface(`kernel_unconfined',` ') typeattribute $1 kern_unconfined; @@ -15766,7 +15729,7 @@ index e100d88..854e39d 100644 + +######################################## +## -+## Read and write userhelper state ++## Read and write usermodehelper state +## +## +## @@ -15775,19 +15738,19 @@ index e100d88..854e39d 100644 +## +## +# -+interface(`kernel_rw_userhelper_state',` ++interface(`kernel_rw_usermodehelper_state',` + gen_require(` -+ type proc_t, userhelper_t; ++ type proc_t, usermodehelper_t; + ') + + dev_search_sysfs($1) -+ rw_files_pattern($1, proc_t, userhelper_t) -+ list_dirs_pattern($1, proc_t, userhelper_t) ++ rw_files_pattern($1, proc_t, usermodehelper_t) ++ list_dirs_pattern($1, proc_t, usermodehelper_t) +') + +######################################## +## -+## Do not audit attempts to search the userhelper ++## Do not audit attempts to search the usermodehelper +## state directory. +## +## @@ -15797,17 +15760,17 @@ index e100d88..854e39d 100644 +## +## +# -+interface(`kernel_dontaudit_search_userhelper_state',` ++interface(`kernel_dontaudit_search_usermodehelper_state',` + gen_require(` -+ type userhelper_t; ++ type usermodehelper_t; + ') + -+ dontaudit $1 userhelper_t:dir search; ++ dontaudit $1 usermodehelper_t:dir search; +') + +######################################## +## -+## Allow searching of userhelper state directory. ++## Allow searching of usermodehelper state directory. +## +## +## @@ -15816,24 +15779,24 @@ index e100d88..854e39d 100644 +## +## +# -+interface(`kernel_search_userhelper_state',` ++interface(`kernel_search_usermodehelper_state',` + gen_require(` -+ type userhelper_t; ++ type usermodehelper_t; + ') + -+ search_dirs_pattern($1, proc_t, userhelper_t) ++ search_dirs_pattern($1, proc_t, usermodehelper_t) +') + +######################################## +## -+## Read the userhelper state information. ++## Read the usermodehelper state information. +## +## +##

-+## Allow the specified domain to read the userhelpering ++## Allow the specified domain to read the usermodehelpering +## state information. This includes several pieces -+## of userhelpering information, such as userhelper interface -+## names, userhelperfilter (iptables) statistics, protocol ++## of usermodehelpering information, such as usermodehelper interface ++## names, usermodehelperfilter (iptables) statistics, protocol +## information, routes, and remote procedure call (RPC) +## information. +##

@@ -15846,20 +15809,20 @@ index e100d88..854e39d 100644 +## +## +# -+interface(`kernel_read_userhelper_state',` ++interface(`kernel_read_usermodehelper_state',` + gen_require(` -+ type proc_t, userhelper_t; ++ type proc_t, usermodehelper_t; + ') + -+ read_files_pattern($1, { proc_t userhelper_t }, userhelper_t) -+ read_lnk_files_pattern($1, { proc_t userhelper_t }, userhelper_t) ++ read_files_pattern($1, { proc_t usermodehelper_t }, usermodehelper_t) ++ read_lnk_files_pattern($1, { proc_t usermodehelper_t }, usermodehelper_t) + -+ list_dirs_pattern($1, proc_t, userhelper_t) ++ list_dirs_pattern($1, proc_t, usermodehelper_t) +') + +######################################## +## -+## Allow caller to read the userhelper state symbolic links. ++## Allow caller to read the usermodehelper state symbolic links. +## +## +## @@ -15867,14 +15830,14 @@ index e100d88..854e39d 100644 +## +## +# -+interface(`kernel_read_userhelper_state_symlinks',` ++interface(`kernel_read_usermodehelper_state_symlinks',` + gen_require(` -+ type proc_t, userhelper_t; ++ type proc_t, usermodehelper_t; + ') + -+ read_lnk_files_pattern($1, { proc_t userhelper_t }, userhelper_t) ++ read_lnk_files_pattern($1, { proc_t usermodehelper_t }, usermodehelper_t) + -+ list_dirs_pattern($1, proc_t, userhelper_t) ++ list_dirs_pattern($1, proc_t, usermodehelper_t) ') diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te index 8dbab4c..4b6c9ad 100644 @@ -24130,7 +24093,7 @@ index 6bf0ecc..115c533 100644 + dontaudit $1 xserver_log_t:dir search_dir_perms; +') diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te -index 8b40377..ea6dc13 100644 +index 8b40377..ef809dd 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -26,28 +26,59 @@ gen_require(` @@ -25174,7 +25137,7 @@ index 8b40377..ea6dc13 100644 kernel_read_system_state(xserver_t) kernel_read_device_sysctls(xserver_t) -kernel_read_modprobe_sysctls(xserver_t) -+kernel_read_usermodehelper(xserver_t) ++kernel_read_usermodehelper_state(xserver_t) # Xorg wants to check if kernel is tainted kernel_read_kernel_sysctls(xserver_t) kernel_write_proc_files(xserver_t) @@ -29131,7 +29094,7 @@ index 79a45f6..e1589ac 100644 + files_etc_filetrans($1, machineid_t, file, "machine-id" ) +') diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te -index 17eda24..b4a2519 100644 +index 17eda24..a627baf 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -11,10 +11,31 @@ gen_require(` @@ -29456,7 +29419,7 @@ index 17eda24..b4a2519 100644 +kernel_read_network_state(init_t) +kernel_rw_all_sysctls(init_t) +kernel_rw_security_state(init_t) -+kernel_rw_userhelper_state(init_t) ++kernel_rw_usermodehelper_state(init_t) +kernel_read_software_raid_state(init_t) +kernel_unmount_debugfs(init_t) +kernel_setsched(init_t) @@ -31094,7 +31057,7 @@ index c42fbc3..174cfdb 100644 ## ## Set the attributes of iptables config files. diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te -index be8ed1e..50b3d56 100644 +index be8ed1e..5e28da7 100644 --- a/policy/modules/system/iptables.te +++ b/policy/modules/system/iptables.te @@ -16,15 +16,15 @@ role iptables_roles types iptables_t; @@ -31137,7 +31100,7 @@ index be8ed1e..50b3d56 100644 kernel_read_network_state(iptables_t) kernel_read_kernel_sysctls(iptables_t) -kernel_read_modprobe_sysctls(iptables_t) -+kernel_read_usermodehelper(iptables_t) ++kernel_read_usermodehelper_state(iptables_t) kernel_use_fds(iptables_t) # needed by ipvsadm @@ -34054,7 +34017,7 @@ index 7449974..28cb8a3 100644 + files_kernel_modules_filetrans($1, modules_dep_t, file, "modules.dep.bin") +') diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te -index 7a363b8..70c672e 100644 +index 7a363b8..ba534ac 100644 --- a/policy/modules/system/modutils.te +++ b/policy/modules/system/modutils.te @@ -5,7 +5,7 @@ policy_module(modutils, 1.14.0) @@ -34196,7 +34159,7 @@ index 7a363b8..70c672e 100644 kernel_read_kernel_sysctls(insmod_t) kernel_rw_kernel_sysctl(insmod_t) -kernel_read_hotplug_sysctls(insmod_t) -+kernel_read_usermodehelper(insmod_t) ++kernel_read_usermodehelper_state(insmod_t) kernel_setsched(insmod_t) corecmd_exec_bin(insmod_t) @@ -39950,7 +39913,7 @@ index 9a1650d..d7e8a01 100644 ######################################## diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te -index 39f185f..5aa688d 100644 +index 39f185f..f5aa25f 100644 --- a/policy/modules/system/udev.te +++ b/policy/modules/system/udev.te @@ -17,16 +17,17 @@ init_daemon_domain(udev_t, udev_exec_t) @@ -40031,7 +39994,7 @@ index 39f185f..5aa688d 100644 +kernel_read_fs_sysctls(udev_t) kernel_read_kernel_sysctls(udev_t) -kernel_rw_hotplug_sysctls(udev_t) -+kernel_rw_usermodehelper(udev_t) ++kernel_rw_usermodehelper_state(udev_t) kernel_rw_unix_dgram_sockets(udev_t) kernel_dgram_send(udev_t) -kernel_signal(udev_t) diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index 00f72cb0..70ecb9d8 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -10053,10 +10053,10 @@ index 0000000..de66654 +') diff --git a/bumblebee.te b/bumblebee.te new file mode 100644 -index 0000000..3de0f69 +index 0000000..92e9d8b --- /dev/null +++ b/bumblebee.te -@@ -0,0 +1,55 @@ +@@ -0,0 +1,56 @@ +policy_module(bumblebee, 1.0.0) + +######################################## @@ -10094,6 +10094,7 @@ index 0000000..3de0f69 +kernel_dontaudit_access_check_proc(bumblebee_t) + +corecmd_exec_shell(bumblebee_t) ++corecmd_exec_bin(bumblebee_t) + +dev_read_sysfs(bumblebee_t) + @@ -10965,7 +10966,7 @@ index a731122..5279d4e 100644 ') + diff --git a/cfengine.te b/cfengine.te -index fbe3ad9..5fe3fdb 100644 +index fbe3ad9..21ab8e1 100644 --- a/cfengine.te +++ b/cfengine.te @@ -41,18 +41,13 @@ create_files_pattern(cfengine_domain, cfengine_log_t, cfengine_log_t) @@ -10993,7 +10994,7 @@ index fbe3ad9..5fe3fdb 100644 # -kernel_read_hotplug_sysctls(cfengine_monitord_t) -+kernel_read_usermodehelper(cfengine_monitord_t) ++kernel_read_usermodehelper_state(cfengine_monitord_t) kernel_read_network_state(cfengine_monitord_t) domain_read_all_domains_state(cfengine_monitord_t) @@ -20963,7 +20964,7 @@ index 8ce99ff..0819898 100644 + logging_log_filetrans($1, devicekit_var_log_t, file, "pm-suspend.log") ') diff --git a/devicekit.te b/devicekit.te -index 77a5003..df3d66e 100644 +index 77a5003..73f2867 100644 --- a/devicekit.te +++ b/devicekit.te @@ -7,15 +7,15 @@ policy_module(devicekit, 1.3.1) @@ -21119,7 +21120,7 @@ index 77a5003..df3d66e 100644 kernel_read_network_state(devicekit_power_t) kernel_read_system_state(devicekit_power_t) -kernel_rw_hotplug_sysctls(devicekit_power_t) -+kernel_rw_usermodehelper(devicekit_power_t) ++kernel_rw_usermodehelper_state(devicekit_power_t) kernel_rw_kernel_sysctl(devicekit_power_t) kernel_rw_vm_sysctls(devicekit_power_t) kernel_search_debugfs(devicekit_power_t) @@ -36544,7 +36545,7 @@ index 5297064..6ba8108 100644 domain_system_change_exemption($1) role_transition $2 kudzu_initrc_exec_t system_r; diff --git a/kudzu.te b/kudzu.te -index 1664036..b7b07a3 100644 +index 1664036..51dd14f 100644 --- a/kudzu.te +++ b/kudzu.te @@ -47,7 +47,7 @@ kernel_read_device_sysctls(kudzu_t) @@ -36552,7 +36553,7 @@ index 1664036..b7b07a3 100644 kernel_read_network_state(kudzu_t) kernel_read_system_state(kudzu_t) -kernel_rw_hotplug_sysctls(kudzu_t) -+kernel_rw_usermodehelper(kudzu_t) ++kernel_rw_usermodehelper_state(kudzu_t) kernel_rw_kernel_sysctl(kudzu_t) corecmd_exec_all_executables(kudzu_t) @@ -37857,7 +37858,7 @@ index dd8e01a..9cd6b0b 100644 ## ## diff --git a/logrotate.te b/logrotate.te -index be0ab84..8c532a6 100644 +index be0ab84..e4d6e6f 100644 --- a/logrotate.te +++ b/logrotate.te @@ -5,16 +5,14 @@ policy_module(logrotate, 1.15.0) @@ -38085,7 +38086,7 @@ index be0ab84..8c532a6 100644 ') optional_policy(` -@@ -228,10 +268,20 @@ optional_policy(` +@@ -228,10 +268,21 @@ optional_policy(` ') optional_policy(` @@ -38099,6 +38100,7 @@ index be0ab84..8c532a6 100644 + +optional_policy(` squid_domtrans(logrotate_t) ++ squid_read_config(logrotate_t) ') optional_policy(` @@ -38106,7 +38108,7 @@ index be0ab84..8c532a6 100644 su_exec(logrotate_t) ') -@@ -241,13 +291,11 @@ optional_policy(` +@@ -241,13 +292,11 @@ optional_policy(` ####################################### # @@ -48722,7 +48724,7 @@ index db9578f..4309e3d 100644 ') + diff --git a/ncftool.te b/ncftool.te -index 71f30ba..d177ab5 100644 +index 71f30ba..d616860 100644 --- a/ncftool.te +++ b/ncftool.te @@ -22,13 +22,14 @@ role ncftool_roles types ncftool_t; @@ -48737,7 +48739,7 @@ index 71f30ba..d177ab5 100644 kernel_read_kernel_sysctls(ncftool_t) -kernel_read_modprobe_sysctls(ncftool_t) -+kernel_read_usermodehelper(ncftool_t) ++kernel_read_usermodehelper_state(ncftool_t) kernel_read_network_state(ncftool_t) kernel_read_system_state(ncftool_t) kernel_request_load_module(ncftool_t) @@ -93935,7 +93937,7 @@ index e29db63..061fb98 100644 domain_system_change_exemption($1) role_transition $2 tuned_initrc_exec_t system_r; diff --git a/tuned.te b/tuned.te -index 393a330..f30d191 100644 +index 393a330..fc018c1 100644 --- a/tuned.te +++ b/tuned.te @@ -21,6 +21,9 @@ files_config_file(tuned_rw_etc_t) @@ -93993,7 +93995,7 @@ index 393a330..f30d191 100644 kernel_request_load_module(tuned_t) kernel_rw_kernel_sysctl(tuned_t) -kernel_rw_hotplug_sysctls(tuned_t) -+kernel_rw_usermodehelper(tuned_t) ++kernel_rw_usermodehelper_state(tuned_t) kernel_rw_vm_sysctls(tuned_t) +kernel_setsched(tuned_t) +kernel_rw_all_sysctls(tuned_t)