rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Tue Jul 26 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-204 

- Allow lsmd_plugin_t to exec ldconfig.
- Allow vnstatd domain to read /sys/class/net/ files
- Remove duplicate allow rules in spamassassin SELinux module
- Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs
- Allow ipa_dnskey domain to search cache dirs
- Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file
- Allow ipa-dnskey read system state.
- Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1356245
- Add interface to write to nsfs inodes
- Allow init_t domain to read rpm db. This is needed due dnf-upgrade process failing. BZ(1349721)
- Allow systemd_modules_load_t to read /etc/modprobe.d/lockd.conf
- sysadmin should be allowed to use docker.
This commit is contained in:
Lukas Vrabec 2016-07-26 17:05:44 +02:00
parent 5b18dd6042
commit 95987e7beb
4 changed files with 708 additions and 493 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
docker-selinux.tgz
View File

Binary file not shown.

1047
policy-rawhide-base.patch
View File

File diff suppressed because it is too large Load Diff

138
policy-rawhide-contrib.patch
View File

@ -12256,7 +12256,7 @@ index 008f8ef..144c074 100644
admin_pattern($1, certmonger_var_run_t) admin_pattern($1, certmonger_var_run_t)
') ')
diff --git a/certmonger.te b/certmonger.te diff --git a/certmonger.te b/certmonger.te
index 550b287..ea704c2 100644 index 550b287..f37b9b0 100644
--- a/certmonger.te --- a/certmonger.te
+++ b/certmonger.te +++ b/certmonger.te
@@ -18,6 +18,9 @@ files_type(certmonger_var_lib_t) @@ -18,6 +18,9 @@ files_type(certmonger_var_lib_t)
@ -12346,7 +12346,7 @@ index 550b287..ea704c2 100644
') ')
optional_policy(` optional_policy(`
@@ -92,11 +110,58 @@ optional_policy(` @@ -92,11 +110,60 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -12359,8 +12359,10 @@ index 550b287..ea704c2 100644
+ +
+optional_policy(` +optional_policy(`
+ ipa_manage_lib(certmonger_t) + ipa_manage_lib(certmonger_t)
+ ipa_manage_log(certmonger_t)
+ ipa_manage_pid_files(certmonger_t) + ipa_manage_pid_files(certmonger_t)
+ ipa_filetrans_pid(certmonger_t,"renewal.lock") + ipa_filetrans_pid(certmonger_t,"renewal.lock")
+ ipa_named_filetrans_log_dir(certmonger_t)
+') +')
+ +
+optional_policy(` +optional_policy(`
@ -37452,10 +37454,10 @@ index 6517fad..f183748 100644
+ allow $1 hypervkvp_unit_file_t:service all_service_perms; + allow $1 hypervkvp_unit_file_t:service all_service_perms;
') ')
diff --git a/hypervkvp.te b/hypervkvp.te diff --git a/hypervkvp.te b/hypervkvp.te
index 4eb7041..b7b9201 100644 index 4eb7041..d750c5c 100644
--- a/hypervkvp.te --- a/hypervkvp.te
+++ b/hypervkvp.te +++ b/hypervkvp.te
@@ -5,24 +5,148 @@ policy_module(hypervkvp, 1.0.0) @@ -5,24 +5,150 @@ policy_module(hypervkvp, 1.0.0)
# Declarations # Declarations
# #
@ -37493,7 +37495,7 @@ index 4eb7041..b7b9201 100644
# #
-# Local policy -# Local policy
+# hyperv domain local policy +# hyperv domain local policy
# +#
+ +
+allow hyperv_domain self:capability net_admin; +allow hyperv_domain self:capability net_admin;
+allow hyperv_domain self:netlink_socket create_socket_perms; +allow hyperv_domain self:netlink_socket create_socket_perms;
@ -37507,7 +37509,7 @@ index 4eb7041..b7b9201 100644
+dev_read_sysfs(hyperv_domain) +dev_read_sysfs(hyperv_domain)
+ +
+######################################## +########################################
# +#
+# hypervkvp local policy +# hypervkvp local policy
+# +#
+ +
@ -37553,6 +37555,8 @@ index 4eb7041..b7b9201 100644
+ +
+modutils_domtrans_insmod(hypervkvp_t) +modutils_domtrans_insmod(hypervkvp_t)
+ +
+seutil_domtrans_setfiles(hypervkvp_t)
+
+sysnet_dns_name_resolve(hypervkvp_t) +sysnet_dns_name_resolve(hypervkvp_t)
+sysnet_domtrans_dhcpc(hypervkvp_t) +sysnet_domtrans_dhcpc(hypervkvp_t)
+sysnet_domtrans_ifconfig(hypervkvp_t) +sysnet_domtrans_ifconfig(hypervkvp_t)
@ -37596,14 +37600,14 @@ index 4eb7041..b7b9201 100644
+') +')
+ +
+######################################## +########################################
+# #
+# hypervvssd local policy +# hypervvssd local policy
+# #
+
+allow hypervvssd_t self:capability sys_admin;
-allow hypervkvpd_t self:fifo_file rw_fifo_file_perms; -allow hypervkvpd_t self:fifo_file rw_fifo_file_perms;
-allow hypervkvpd_t self:unix_stream_socket create_stream_socket_perms; -allow hypervkvpd_t self:unix_stream_socket create_stream_socket_perms;
+allow hypervvssd_t self:capability sys_admin;
+
+dev_rw_hypervvssd(hypervvssd_t) +dev_rw_hypervvssd(hypervvssd_t)
-logging_send_syslog_msg(hypervkvpd_t) -logging_send_syslog_msg(hypervkvpd_t)
@ -38312,10 +38316,10 @@ index 0000000..61f2003
+userdom_use_user_terminals(iotop_t) +userdom_use_user_terminals(iotop_t)
diff --git a/ipa.fc b/ipa.fc diff --git a/ipa.fc b/ipa.fc
new file mode 100644 new file mode 100644
index 0000000..e1ddda0 index 0000000..1131ca0
--- /dev/null --- /dev/null
+++ b/ipa.fc +++ b/ipa.fc
@@ -0,0 +1,19 @@ @@ -0,0 +1,21 @@
+/usr/lib/systemd/system/ipa-otpd.* -- gen_context(system_u:object_r:ipa_otpd_unit_file_t,s0) +/usr/lib/systemd/system/ipa-otpd.* -- gen_context(system_u:object_r:ipa_otpd_unit_file_t,s0)
+ +
+/usr/lib/systemd/system/ipa-dnskeysyncd.* -- gen_context(system_u:object_r:ipa_dnskey_unit_file_t,s0) +/usr/lib/systemd/system/ipa-dnskeysyncd.* -- gen_context(system_u:object_r:ipa_dnskey_unit_file_t,s0)
@ -38331,16 +38335,18 @@ index 0000000..e1ddda0
+ +
+/var/lib/ipa(/.*)? gen_context(system_u:object_r:ipa_var_lib_t,s0) +/var/lib/ipa(/.*)? gen_context(system_u:object_r:ipa_var_lib_t,s0)
+ +
+/var/log/ipa(/.*)? gen_context(system_u:object_r:ipa_log_t,s0)
+
+/var/log/ipareplica-conncheck.log -- gen_context(system_u:object_r:ipa_log_t,s0) +/var/log/ipareplica-conncheck.log -- gen_context(system_u:object_r:ipa_log_t,s0)
+ +
+/var/run/ipa(/.*)? gen_context(system_u:object_r:ipa_var_run_t,s0) +/var/run/ipa(/.*)? gen_context(system_u:object_r:ipa_var_run_t,s0)
+ +
diff --git a/ipa.if b/ipa.if diff --git a/ipa.if b/ipa.if
new file mode 100644 new file mode 100644
index 0000000..ee3a606 index 0000000..1a30961
--- /dev/null --- /dev/null
+++ b/ipa.if +++ b/ipa.if
@@ -0,0 +1,197 @@ @@ -0,0 +1,235 @@
+## <summary>Policy for IPA services.</summary> +## <summary>Policy for IPA services.</summary>
+ +
+######################################## +########################################
@ -38461,6 +38467,25 @@ index 0000000..ee3a606
+ +
+######################################## +########################################
+## <summary> +## <summary>
+## Allow domain to manage ipa log files/dirs.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ipa_manage_log',`
+ gen_require(`
+ type ipa_log_t;
+ ')
+
+ manage_files_pattern($1, ipa_log_t, ipa_log_t)
+ manage_dirs_pattern($1, ipa_log_t, ipa_log_t)
+')
+
+########################################
+## <summary>
+## Allow domain to manage ipa lib files/dirs. +## Allow domain to manage ipa lib files/dirs.
+## </summary> +## </summary>
+## <param name="domain"> +## <param name="domain">
@ -38538,12 +38563,31 @@ index 0000000..ee3a606
+ files_search_tmp($1) + files_search_tmp($1)
+ allow $1 ipa_tmp_t:file unlink; + allow $1 ipa_tmp_t:file unlink;
+') +')
+
+########################################
+## <summary>
+## Create log files with a named file
+## type transition.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ipa_named_filetrans_log_dir',`
+ gen_require(`
+ type ipa_log_t;
+ ')
+
+ logging_log_named_filetrans($1, ipa_log_t, dir, "ipa")
+')
diff --git a/ipa.te b/ipa.te diff --git a/ipa.te b/ipa.te
new file mode 100644 new file mode 100644
index 0000000..3ca42f7 index 0000000..e3b22a3
--- /dev/null --- /dev/null
+++ b/ipa.te +++ b/ipa.te
@@ -0,0 +1,199 @@ @@ -0,0 +1,201 @@
+policy_module(ipa, 1.0.0) +policy_module(ipa, 1.0.0)
+ +
+######################################## +########################################
@ -38702,6 +38746,7 @@ index 0000000..3ca42f7
+files_tmp_filetrans(ipa_dnskey_t, ipa_tmp_t, { file }) +files_tmp_filetrans(ipa_dnskey_t, ipa_tmp_t, { file })
+ +
+kernel_dgram_send(ipa_dnskey_t) +kernel_dgram_send(ipa_dnskey_t)
+kernel_read_system_state(ipa_dnskey_t)
+ +
+auth_use_nsswitch(ipa_dnskey_t) +auth_use_nsswitch(ipa_dnskey_t)
+ +
@ -38731,6 +38776,7 @@ index 0000000..3ca42f7
+ bind_read_dnssec_keys(ipa_dnskey_t) + bind_read_dnssec_keys(ipa_dnskey_t)
+ bind_manage_zone(ipa_dnskey_t) + bind_manage_zone(ipa_dnskey_t)
+ bind_manage_zone_dirs(ipa_dnskey_t) + bind_manage_zone_dirs(ipa_dnskey_t)
+ bind_search_cache(ipa_dnskey_t)
+') +')
+ +
+optional_policy(` +optional_policy(`
@ -46754,7 +46800,7 @@ index d314333..27ede09 100644
+ ') + ')
') ')
diff --git a/lsm.te b/lsm.te diff --git a/lsm.te b/lsm.te
index 4ec0eea..db7c68b 100644 index 4ec0eea..693d9ae 100644
--- a/lsm.te --- a/lsm.te
+++ b/lsm.te +++ b/lsm.te
@@ -4,6 +4,13 @@ policy_module(lsm, 1.0.0) @@ -4,6 +4,13 @@ policy_module(lsm, 1.0.0)
@ -46796,7 +46842,7 @@ index 4ec0eea..db7c68b 100644
allow lsmd_t self:unix_stream_socket create_stream_socket_perms; allow lsmd_t self:unix_stream_socket create_stream_socket_perms;
manage_dirs_pattern(lsmd_t, lsmd_var_run_t, lsmd_var_run_t) manage_dirs_pattern(lsmd_t, lsmd_var_run_t, lsmd_var_run_t)
@@ -26,4 +44,69 @@ manage_lnk_files_pattern(lsmd_t, lsmd_var_run_t, lsmd_var_run_t) @@ -26,4 +44,71 @@ manage_lnk_files_pattern(lsmd_t, lsmd_var_run_t, lsmd_var_run_t)
manage_sock_files_pattern(lsmd_t, lsmd_var_run_t, lsmd_var_run_t) manage_sock_files_pattern(lsmd_t, lsmd_var_run_t, lsmd_var_run_t)
files_pid_filetrans(lsmd_t, lsmd_var_run_t, { dir file sock_file }) files_pid_filetrans(lsmd_t, lsmd_var_run_t, { dir file sock_file })
@ -46855,6 +46901,8 @@ index 4ec0eea..db7c68b 100644
+init_stream_connect(lsmd_plugin_t) +init_stream_connect(lsmd_plugin_t)
+init_dontaudit_rw_stream_socket(lsmd_plugin_t) +init_dontaudit_rw_stream_socket(lsmd_plugin_t)
+ +
+libs_exec_ldconfig(lsmd_plugin_t)
+
+logging_send_syslog_msg(lsmd_plugin_t) +logging_send_syslog_msg(lsmd_plugin_t)
+ +
+miscfiles_read_certs(lsmd_plugin_t) +miscfiles_read_certs(lsmd_plugin_t)
@ -101860,7 +101908,7 @@ index e9bd097..5724bcf 100644
+/usr/bin/pyzor -- gen_context(system_u:object_r:spamc_exec_t,s0) +/usr/bin/pyzor -- gen_context(system_u:object_r:spamc_exec_t,s0)
+/usr/bin/pyzord -- gen_context(system_u:object_r:spamd_exec_t,s0) +/usr/bin/pyzord -- gen_context(system_u:object_r:spamd_exec_t,s0)
diff --git a/spamassassin.if b/spamassassin.if diff --git a/spamassassin.if b/spamassassin.if
index 1499b0b..6950cab 100644 index 1499b0b..e695a62 100644
--- a/spamassassin.if --- a/spamassassin.if
+++ b/spamassassin.if +++ b/spamassassin.if
@@ -2,39 +2,45 @@ @@ -2,39 +2,45 @@
@ -102244,7 +102292,7 @@ index 1499b0b..6950cab 100644
+ ') + ')
+ +
+ userdom_user_home_dir_filetrans($1, spamc_home_t, dir, ".pyzor") + userdom_user_home_dir_filetrans($1, spamc_home_t, dir, ".pyzor")
+ userdom_user_home_dir_filetrans($1, spamc_home_t, file, ".spamassassin") + userdom_user_home_dir_filetrans($1, spamc_home_t, dir, ".spamassassin")
+ userdom_user_home_dir_filetrans($1, spamc_home_t, dir, ".spamd") + userdom_user_home_dir_filetrans($1, spamc_home_t, dir, ".spamd")
+ userdom_user_home_dir_filetrans($1, spamc_home_t, dir, ".razor") + userdom_user_home_dir_filetrans($1, spamc_home_t, dir, ".razor")
+') +')
@ -102265,7 +102313,7 @@ index 1499b0b..6950cab 100644
+ ') + ')
+ +
+ userdom_admin_home_dir_filetrans($1, spamc_home_t, dir, ".pyzor") + userdom_admin_home_dir_filetrans($1, spamc_home_t, dir, ".pyzor")
+ userdom_admin_home_dir_filetrans($1, spamc_home_t, file, ".spamassassin") + userdom_admin_home_dir_filetrans($1, spamc_home_t, dir, ".spamassassin")
+ userdom_admin_home_dir_filetrans($1, spamc_home_t, dir, ".spamd") + userdom_admin_home_dir_filetrans($1, spamc_home_t, dir, ".spamd")
+ userdom_admin_home_dir_filetrans($1, spamc_home_t, dir, ".razor") + userdom_admin_home_dir_filetrans($1, spamc_home_t, dir, ".razor")
+') +')
@ -102315,7 +102363,7 @@ index 1499b0b..6950cab 100644
- spamassassin_role($2, $1) - spamassassin_role($2, $1)
') ')
diff --git a/spamassassin.te b/spamassassin.te diff --git a/spamassassin.te b/spamassassin.te
index cc58e35..7e5c719 100644 index cc58e35..d844f55 100644
--- a/spamassassin.te --- a/spamassassin.te
+++ b/spamassassin.te +++ b/spamassassin.te
@@ -7,50 +7,30 @@ policy_module(spamassassin, 2.6.1) @@ -7,50 +7,30 @@ policy_module(spamassassin, 2.6.1)
@ -102395,7 +102443,7 @@ index cc58e35..7e5c719 100644
type spamd_initrc_exec_t; type spamd_initrc_exec_t;
init_script_file(spamd_initrc_exec_t) init_script_file(spamd_initrc_exec_t)
@@ -72,87 +46,199 @@ type spamd_log_t; @@ -72,87 +46,197 @@ type spamd_log_t;
logging_log_file(spamd_log_t) logging_log_file(spamd_log_t)
type spamd_spool_t; type spamd_spool_t;
@ -102532,8 +102580,6 @@ index cc58e35..7e5c719 100644
+manage_lnk_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t) +manage_lnk_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
+manage_fifo_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t) +manage_fifo_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
+manage_sock_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t) +manage_sock_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
+userdom_user_home_dir_filetrans(spamd_t, spamassassin_home_t, dir, ".spamassassin")
+userdom_admin_home_dir_filetrans(spamd_t, spamassassin_home_t, dir, ".spamassassin")
+userdom_home_manager(spamassassin_t) +userdom_home_manager(spamassassin_t)
+ +
kernel_read_kernel_sysctls(spamassassin_t) kernel_read_kernel_sysctls(spamassassin_t)
@ -102617,7 +102663,7 @@ index cc58e35..7e5c719 100644
nis_use_ypbind_uncond(spamassassin_t) nis_use_ypbind_uncond(spamassassin_t)
') ')
') ')
@@ -160,6 +246,8 @@ optional_policy(` @@ -160,6 +244,8 @@ optional_policy(`
optional_policy(` optional_policy(`
mta_read_config(spamassassin_t) mta_read_config(spamassassin_t)
sendmail_stub(spamassassin_t) sendmail_stub(spamassassin_t)
@ -102626,7 +102672,7 @@ index cc58e35..7e5c719 100644
') ')
######################################## ########################################
@@ -167,72 +255,95 @@ optional_policy(` @@ -167,72 +253,95 @@ optional_policy(`
# Client local policy # Client local policy
# #
@ -102753,7 +102799,7 @@ index cc58e35..7e5c719 100644
optional_policy(` optional_policy(`
abrt_stream_connect(spamc_t) abrt_stream_connect(spamc_t)
@@ -243,6 +354,7 @@ optional_policy(` @@ -243,6 +352,7 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -102761,7 +102807,7 @@ index cc58e35..7e5c719 100644
evolution_stream_connect(spamc_t) evolution_stream_connect(spamc_t)
') ')
@@ -251,11 +363,18 @@ optional_policy(` @@ -251,11 +361,18 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -102781,7 +102827,7 @@ index cc58e35..7e5c719 100644
') ')
optional_policy(` optional_policy(`
@@ -267,36 +386,40 @@ optional_policy(` @@ -267,36 +384,40 @@ optional_policy(`
######################################## ########################################
# #
@ -102839,7 +102885,7 @@ index cc58e35..7e5c719 100644
logging_log_filetrans(spamd_t, spamd_log_t, file) logging_log_filetrans(spamd_t, spamd_log_t, file)
manage_dirs_pattern(spamd_t, spamd_spool_t, spamd_spool_t) manage_dirs_pattern(spamd_t, spamd_spool_t, spamd_spool_t)
@@ -308,7 +431,8 @@ manage_dirs_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t) @@ -308,7 +429,8 @@ manage_dirs_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t)
manage_files_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t) manage_files_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t)
files_tmp_filetrans(spamd_t, spamd_tmp_t, { file dir }) files_tmp_filetrans(spamd_t, spamd_tmp_t, { file dir })
@ -102849,7 +102895,7 @@ index cc58e35..7e5c719 100644
manage_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t) manage_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t)
manage_lnk_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t) manage_lnk_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t)
@@ -317,12 +441,14 @@ manage_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t) @@ -317,12 +439,14 @@ manage_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
manage_sock_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t) manage_sock_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
files_pid_filetrans(spamd_t, spamd_var_run_t, { file dir }) files_pid_filetrans(spamd_t, spamd_var_run_t, { file dir })
@ -102866,7 +102912,7 @@ index cc58e35..7e5c719 100644
corenet_all_recvfrom_netlabel(spamd_t) corenet_all_recvfrom_netlabel(spamd_t)
corenet_tcp_sendrecv_generic_if(spamd_t) corenet_tcp_sendrecv_generic_if(spamd_t)
corenet_udp_sendrecv_generic_if(spamd_t) corenet_udp_sendrecv_generic_if(spamd_t)
@@ -331,78 +457,60 @@ corenet_udp_sendrecv_generic_node(spamd_t) @@ -331,78 +455,60 @@ corenet_udp_sendrecv_generic_node(spamd_t)
corenet_tcp_sendrecv_all_ports(spamd_t) corenet_tcp_sendrecv_all_ports(spamd_t)
corenet_udp_sendrecv_all_ports(spamd_t) corenet_udp_sendrecv_all_ports(spamd_t)
corenet_tcp_bind_generic_node(spamd_t) corenet_tcp_bind_generic_node(spamd_t)
@ -102971,7 +103017,7 @@ index cc58e35..7e5c719 100644
') ')
optional_policy(` optional_policy(`
@@ -421,21 +529,13 @@ optional_policy(` @@ -421,21 +527,13 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -102995,7 +103041,7 @@ index cc58e35..7e5c719 100644
') ')
optional_policy(` optional_policy(`
@@ -443,8 +543,8 @@ optional_policy(` @@ -443,8 +541,8 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -103005,7 +103051,7 @@ index cc58e35..7e5c719 100644
') ')
optional_policy(` optional_policy(`
@@ -455,7 +555,17 @@ optional_policy(` @@ -455,7 +553,17 @@ optional_policy(`
optional_policy(` optional_policy(`
razor_domtrans(spamd_t) razor_domtrans(spamd_t)
razor_read_lib_files(spamd_t) razor_read_lib_files(spamd_t)
@ -103024,7 +103070,7 @@ index cc58e35..7e5c719 100644
') ')
optional_policy(` optional_policy(`
@@ -463,9 +573,9 @@ optional_policy(` @@ -463,9 +571,9 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -103035,7 +103081,7 @@ index cc58e35..7e5c719 100644
') ')
optional_policy(` optional_policy(`
@@ -474,32 +584,32 @@ optional_policy(` @@ -474,32 +582,32 @@ optional_policy(`
######################################## ########################################
# #
@ -103078,7 +103124,7 @@ index cc58e35..7e5c719 100644
corecmd_exec_bin(spamd_update_t) corecmd_exec_bin(spamd_update_t)
corecmd_exec_shell(spamd_update_t) corecmd_exec_shell(spamd_update_t)
@@ -508,25 +618,26 @@ dev_read_urand(spamd_update_t) @@ -508,25 +616,26 @@ dev_read_urand(spamd_update_t)
domain_use_interactive_fds(spamd_update_t) domain_use_interactive_fds(spamd_update_t)
@ -115879,7 +115925,7 @@ index 137ac44..b644854 100644
domain_system_change_exemption($1) domain_system_change_exemption($1)
role_transition $2 vnstatd_initrc_exec_t system_r; role_transition $2 vnstatd_initrc_exec_t system_r;
diff --git a/vnstatd.te b/vnstatd.te diff --git a/vnstatd.te b/vnstatd.te
index e2220ae..0dcf5f6 100644 index e2220ae..85f393b 100644
--- a/vnstatd.te --- a/vnstatd.te
+++ b/vnstatd.te +++ b/vnstatd.te
@@ -36,7 +36,7 @@ allow vnstatd_t self:unix_stream_socket { accept listen }; @@ -36,7 +36,7 @@ allow vnstatd_t self:unix_stream_socket { accept listen };
@ -115891,12 +115937,16 @@ index e2220ae..0dcf5f6 100644
manage_files_pattern(vnstatd_t, vnstatd_var_run_t, vnstatd_var_run_t) manage_files_pattern(vnstatd_t, vnstatd_var_run_t, vnstatd_var_run_t)
manage_dirs_pattern(vnstatd_t, vnstatd_var_run_t, vnstatd_var_run_t) manage_dirs_pattern(vnstatd_t, vnstatd_var_run_t, vnstatd_var_run_t)
@@ -47,14 +47,10 @@ kernel_read_system_state(vnstatd_t) @@ -45,16 +45,14 @@ files_pid_filetrans(vnstatd_t, vnstatd_var_run_t, { dir file })
kernel_read_network_state(vnstatd_t)
kernel_read_system_state(vnstatd_t)
domain_use_interactive_fds(vnstatd_t) -domain_use_interactive_fds(vnstatd_t)
+dev_read_sysfs(vnstatd_t)
-files_read_etc_files(vnstatd_t) -files_read_etc_files(vnstatd_t)
- +domain_use_interactive_fds(vnstatd_t)
fs_getattr_xattr_fs(vnstatd_t) fs_getattr_xattr_fs(vnstatd_t)
logging_send_syslog_msg(vnstatd_t) logging_send_syslog_msg(vnstatd_t)
@ -115906,7 +115956,7 @@ index e2220ae..0dcf5f6 100644
######################################## ########################################
# #
# Client local policy # Client local policy
@@ -64,23 +60,19 @@ allow vnstat_t self:process signal; @@ -64,23 +62,19 @@ allow vnstat_t self:process signal;
allow vnstat_t self:fifo_file rw_fifo_file_perms; allow vnstat_t self:fifo_file rw_fifo_file_perms;
allow vnstat_t self:unix_stream_socket { accept listen }; allow vnstat_t self:unix_stream_socket { accept listen };

16
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.13.1 Version: 3.13.1
Release: 203%{?dist} Release: 204%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -648,6 +648,20 @@ exit 0
%endif %endif
%changelog %changelog
* Tue Jul 26 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-204
- Allow lsmd_plugin_t to exec ldconfig.
- Allow vnstatd domain to read /sys/class/net/ files
- Remove duplicate allow rules in spamassassin SELinux module
- Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs
- Allow ipa_dnskey domain to search cache dirs
- Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file
- Allow ipa-dnskey read system state.
- Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1356245
- Add interface to write to nsfs inodes
- Allow init_t domain to read rpm db. This is needed due dnf-upgrade process failing. BZ(1349721)
- Allow systemd_modules_load_t to read /etc/modprobe.d/lockd.conf
- sysadmin should be allowed to use docker.
* Mon Jul 18 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-203 * Mon Jul 18 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-203
- Allow hypervkvp domain to run restorecon. - Allow hypervkvp domain to run restorecon.
- Allow firewalld to manage net_conf_t files - Allow firewalld to manage net_conf_t files