From 96feeb5e2028b0110e89524c4001954fe51cd6de Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Fri, 17 Mar 2017 17:34:02 +0100 Subject: [PATCH] * Fri Mar 17 2017 Lukas Vrabec - 3.13.1-245 - Allow vdagent domain to getattr cgroup filesystem - Allow abrt_dump_oops_t stream connect to sssd_t domain - Allow cyrus stream connect to gssproxy - Label /usr/libexec/cockpit-ssh as cockpit_session_exec_t and allow few rules - Allow colord_t to read systemd hwdb.bin file - Allow dirsrv_t to create /var/lock/dirsrv labeled as dirsrc_var_lock_t - Allow certmonger to manage /etc/krb5kdc_conf_t - Allow kdumpctl to getenforce - Allow ptp4l wake_alarm capability - Allow ganesha to chat with unconfined domains via dbus - Add nmbd_t capability2 block_suspend - Add domain transition from sosreport_t to iptables_t - Dontaudit init_t to mounton modules_object_t - Add interface files_dontaudit_mounton_modules_object - Allow xdm_t to execute files labeled as xdm_var_lib_t - Make mtrr_device_t mountpoint. - Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmd --- container-selinux.tgz | Bin 6463 -> 6463 bytes policy-rawhide-base.patch | 192 ++++++++++++++++++++--------------- policy-rawhide-contrib.patch | 143 +++++++++++++++----------- selinux-policy.spec | 21 +++- 4 files changed, 214 insertions(+), 142 deletions(-) diff --git a/container-selinux.tgz b/container-selinux.tgz index 3c76eaa0415004aa8d04345da5ebe7f9bc531095..870f0c0895175d5d86a0ac40154444db037b6e60 100644 GIT binary patch delta 3003 zcmV;s3qvwN|uCIT1_xjy8*RS8)yng*n zaQ##Q>DQrd!YT;9N$;v~!y+r)*z^CT*XsH6;K%xqWnuOB=fCe+P?RixRTqaUVnJAz zX%dA^QshA-8%n_P9sFMYcqQ3Z0OEIbN`pVn{`rALhlXkBNggzN{YG45@Q+Jkz0!Dt zAIq=`vmg(DGxn!voa))12POPW4}vgFi+dIaO%XIznAZuulnL~TP~qRJByU)?4I_5` zo04W-9r7m0*c!?soEI;DTb=D#zOL9Ghol19)!A9|SZZ&ec$$}nn+!CtZaz4;vT|D! z#fyv8>MSZM7G?3eW?>cW*PA3i|MvC8>P!l>F2e?Ys#Sk<_O>X@iPG82j_go>qcSyhr^zOWLHwvG zs)W^l6EyAYHy%yftYV=Q5X(owcVUI3t!}CO;M>z!l$-8viQ`qA6D#Z(mDy`uXj%Fq4hMW8*JM)r3)Z`!!4gG8|O~*+t~>I6+Wo$zfiBo@wqNp zlx!2IAYPF;wz7fAqcUUOAdvsa!TkyC;BgJbV%cV>+@SP-3-fT-A4tBAK9-SaPiET$ z{4v%|VvKc|C$*Bs8vL4E0j(ag zk>x&V_CW}QhXypg;TUn@a+x!_Xhql`+iyf?3aK2`70SY$crhHc-puDb770Y0jPR{ zLrg%%n~P8TYF6DX5`$bQP-U5SKh~4012hX`l!W6L=A)V<@9~rB10oLhRbq0mGnT=~ z_2oPDJ(C&)9W;+qhwz|>Z&hb7G2VEnp|LfOWFE0Ebd@T5NKdsfyDJ+C?&CvL6#g3Y zD+%96`)bWQ$o-RR1YZF=lgk7(0w1E20tG5E-IA#LqHgM?0cpOrAZEqtBE7pr4J-o7 zYpMoEU{gG>WnQ0SqEovdTmkckG<;kh@n(}=1u_gDg1P~hB%|?#HDBD5oCPL-y^IM5 zoh6kS-mkOa{q2{ZS{drEx%HKicMC*X^vmGKH!j0()0ArsvXXj2EQyf`4FfWnO!Ri1~1>*fEj6yamfr4S|rWkKGPwg(LiaeV%X?dFJA~}zZ)>s4Y zvPRwEo#Ctn{B-k!o$)?*XFS7y03y~Be1u7Q1=WCr5c(Sq zsbKgz-tB}@Fw7qf@M6q=;JN^p69%;Eu`J+qxu=@c%OrN7ACfV}szvHQR!D9rmE~hZ!lw?A zhN%#m*Eooh_H!95YVYO(^pvh1I;85ZVB4HlGq1kTrm@P~u2P48V}~uC<3ce{y9{j*jGcmV;&lg|ks0S}Y!2_PW%QCNnXBu$#f;A0T&i~Bsd zO<>sH!oL7)TeBvKgX}hwFA5+6`Y@AG3TOh{1e3c8H3-}Ft=NEdV0V-F3O51clQ0W8 z0Th#J3t=`#d{@ds4nC>91oK{YXSgx%_S0~+_<8V`IOaK1S$NAj2@QJ|-3IqXb$bb9|5B7} zdq~qq3<-kgF+$EU1F#vF;ABf-|{{g}elaCBa zGp8&>?y7ytGA29RQ_AoeMfzJRuw`n)#|QT^i>vgl9x$HTP58U%ZpFOUQ9Gl_N*4Kt zlMD?g6-lt$J%&#Sf3rNkXHNP%$ ze)y$03d8&^byHO6!eI^rnePXf3&u%(YoVv5dmO~_y1q}EXm6$y+rRtG2PUR*ac`3| z4{QOClb{bV3wf}qMCahm&j$TiliUwPGme`@uk42d;x)z#}OSTy5l8D zzGrBWV=X^ucyBqF;XZE1q2JuS9+Z@;IxUuZgRZW&-)vz^+GTzKNR zz=@5(1M%hv$QHBJ<1)=utCz4TvSeycGQK#PSgd=i4@;uR44`j?&Q@|K?lp;njHgR&Fz_B0qCn2I?!$&jWI$fvhbe*o#b-GU1>H2?j{SVLtuI>QH0068t*D?SA delta 3003 zcmV;s3q`Y&8>-(G+J?wdDnU%&f*;obXp@87@w=JlJm*Ke=C z30^;zK>Bs4o3ILkZ_?W;+_1<>H}?F0>9ubADgGXm$2&7-u! z`T{zy_hH4JlGaHef4y^Z53Q$3-C*0cDO~`68E*Mh**JHa-^@nvukb;2|Al%zj?Z<; zqGX#u1@Vf+v6T%>9+esM27&xX4(^X=2ajtg7Rxq6ttz0DPIWwg zAj@6S?1K;p4-IIzNuq$>zMVXPxkI{8vx8-o++sOM`2{Pqhb*L6qZ9^wjKy zTq$V0Bhu28qB!q5O2fLg6h+U5Wo?)!E}l{z{{LA}l&JqO{nN9iI@n$jNqfa^Sd#C& ziZyo;Y2&;jG{z3%3a4nD;M;5X?=Ac?_x-Z|*)RY4^Aj04$crhHc-puDb770Y0jPR{ zLrg%%n~P8TYF6DY5`$bQP-U5SKh%?}12hX_l!W6L=A)VZ&hb7G2VEnp|Ld&WFE0Ebd@T5NKdsfyDb|E?&CvL6#g3Y zD+xbD`)bWQ$la4`1YZF&lgk7(0`H@f0tG5E?UJbbqHgM?0cpOrAZEqtBE7vt4J-o7 zYpMoEU{l<)WnQ0SqEovdTmkckG<;Yd@p_Y91u_ipgSr8iB%|?#HDBG6oCPL-gNz9W zoh6kS-mkOa{q2{ZS{dr6-1^GMy9FXG`epFr8<*j?Y09+*S;;}+Z(jGN@C5z=H6-QX zbb%17DUPfin3u@tV08eg0`YznMj@M(K*2C}Q;fHpr*@lEMV?KXv^-9Ak(|dyYpj8H zS)=ao&T!TOe!BU=&Ul}@GoE3801;~mKEWit0&N6!vdhDici7D2zrYGocjB zy|Up#(3UT(ePWDXL?nCssAUfTUKz+Oy?MpI^I{jTZwL~Ob8GEnJUS=iY-kn+K{gri zUzbIiL=V)$Wl&H=0Ym5kja-1e(4LP34PPuB>|KY4W-l_e1`%I+_{1`Q+DP6hd8fqC zu@>4ZADK_8Aq{RHm$zW9sAF>tAIYvuEqGVQQR#&m!m;bD24|b=`RV#R^!C%;?qM$| z(*u}TZ)eEM3GQS1KAYZQ47J%`sGjACZ^aia2WxLVv>{ z6%1d;yPYr!hWUd5UW^%kTo>SS!hlvilm)yl_f(U5*~IpRbI)6G=jKJbTt8077xCJX zcx`B6@t|8bueAk}w^eHIkkgnlsEN~i>_9T+l=WosLo%jVwMhNP3ds$nvV4q4_|zfN zFcm`c8V6C*elCMW?cH2}p3>Drhg97aY@5?+=G7P4G*)@rRqAkm?6AdiTqx$Lw`*>G ze1c~V=PfNLR(uRTWNyYsGx@{PnKq%F711c`?9_O&<3{U5&C6}pB! zRvGU7pYN~V{qX%@|L426r~RK_;^GtabymcOl%1>A@G^LF`TFwp#j4kPd6FQXn+H`< zG{wzSM{D&w_?ZEdJqQ>9-LqB*cmV;2lg|ks0gsdK2_PU3QCNnXBu$!!;8PIoi@Q9y zNnqID!oL7)TeBvKgX|`gFA5+6{y39S3TOgc2a~%BH3*yajo5&7V7HU_3O51elQ0W8 z0TPpH3t=`Vd{@ds4nC{B1oK{YXSgx%_VaMH_<8V`IOaK1S$M-b2@QJ|-2`_gF+$EU1F#vF;ABf-|{{g~}laCBa zGsi4M?y7yvGA29RQ_AoeMfzJRuw`n)$4B=vi>vgl9x$HTP58U%ZpFOUQ9Gl_N*4LY zlMD?g6;ZI;J%*17f4w}uXHMcHu ze)y$03d8&^byHO6!eI^rneTg;3&u%(W1**|dmO~_y1q-AXm6$y+rRtG2PUR*ac7e= z4{QO8lb{bV3%R$cMCahm&j$TaliUwPGnSi0ukB zzGrBWV=X^ugp;@HaKCt;y72A-<`dB<&7pMZsL2gh-w1m zKg&Raf7aqH1qhSzR|vP{y94Icf+E7RXc++!O@C4S$A4Y@=XX4`v~2CX!k|dqEGDr) z6`x>O8a6L(i}aAOSJPFYe^9vt4envQRHLeOz-1a~w{tG80j-4P+E@!M#%l39&mw4_ zd=coZkv8ib`tHR)oq1zL@wWXaT?WPEWn$;*g`NLOMm#HPNoS%XJeAZKS6n2*rs zC9=8eAKmlK@QWG%dlAdn0g1n`Igqf6TYQBc@bSh0{DPT-bi1yqWI$fvhbe*o#b-GU1={jAf>vWy2)Aj%6`X9&MY=QvD006S#;M)KI diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index 94395953..4a243058 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -9912,7 +9912,7 @@ index 76f285e..47c1b4d 100644 + filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card9") +') diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te -index 0b1a871..9099db5 100644 +index 0b1a871..db382e7 100644 --- a/policy/modules/kernel/devices.te +++ b/policy/modules/kernel/devices.te @@ -15,11 +15,12 @@ attribute devices_unconfined_type; @@ -10017,7 +10017,7 @@ index 0b1a871..9099db5 100644 type loop_control_device_t; dev_node(loop_control_device_t) -@@ -150,12 +185,24 @@ type modem_device_t; +@@ -150,16 +185,29 @@ type modem_device_t; dev_node(modem_device_t) # @@ -10042,7 +10042,12 @@ index 0b1a871..9099db5 100644 # Type for /dev/cpu/mtrr and /proc/mtrr # type mtrr_device_t; -@@ -183,6 +230,12 @@ type nvram_device_t; + dev_node(mtrr_device_t) ++files_mountpoint(mtrr_device_t) + genfscon proc /mtrr gen_context(system_u:object_r:mtrr_device_t,s0) + + # +@@ -183,6 +231,12 @@ type nvram_device_t; dev_node(nvram_device_t) # @@ -10055,7 +10060,7 @@ index 0b1a871..9099db5 100644 # Type for /dev/pmu # type power_device_t; -@@ -227,6 +280,10 @@ files_mountpoint(sysfs_t) +@@ -227,6 +281,10 @@ files_mountpoint(sysfs_t) fs_type(sysfs_t) genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0) @@ -10066,7 +10071,7 @@ index 0b1a871..9099db5 100644 # # Type for /dev/tpm # -@@ -266,6 +323,15 @@ dev_node(usbmon_device_t) +@@ -266,6 +324,15 @@ dev_node(usbmon_device_t) type userio_device_t; dev_node(userio_device_t) @@ -10082,7 +10087,7 @@ index 0b1a871..9099db5 100644 type v4l_device_t; dev_node(v4l_device_t) -@@ -274,6 +340,7 @@ dev_node(v4l_device_t) +@@ -274,6 +341,7 @@ dev_node(v4l_device_t) # type vhost_device_t; dev_node(vhost_device_t) @@ -10090,7 +10095,7 @@ index 0b1a871..9099db5 100644 # Type for vmware devices. type vmware_device_t; -@@ -319,5 +386,8 @@ files_associate_tmp(device_node) +@@ -319,5 +387,8 @@ files_associate_tmp(device_node) # allow devices_unconfined_type self:capability sys_rawio; @@ -11279,7 +11284,7 @@ index b876c48..3690ce4 100644 +/nsr(/.*)? gen_context(system_u:object_r:var_t,s0) +/nsr/logs(/.*)? gen_context(system_u:object_r:var_log_t,s0) diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if -index f962f76..1ac470a 100644 +index f962f76..b64717f 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -19,6 +19,136 @@ @@ -14797,7 +14802,7 @@ index f962f76..1ac470a 100644 ') ######################################## -@@ -6580,3 +8414,605 @@ interface(`files_unconfined',` +@@ -6580,3 +8414,623 @@ interface(`files_unconfined',` typeattribute $1 files_unconfined_type; ') @@ -15403,6 +15408,24 @@ index f962f76..1ac470a 100644 + + allow $1 etc_t:service status; +') ++ ++######################################## ++## ++## Dontaudit Mount a modules_object_t ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_dontaudit_mounton_modules_object',` ++ gen_require(` ++ type modules_object_t; ++ ') ++ ++ allow $1 modules_object_t:dir mounton; ++') diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te index 1a03abd..3221f80 100644 --- a/policy/modules/kernel/files.te @@ -29699,7 +29722,7 @@ index 6bf0ecc..e6be63a 100644 +') + diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te -index 8b40377..84a88ff 100644 +index 8b40377..bd907ca 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -26,28 +26,66 @@ gen_require(` @@ -30058,7 +30081,7 @@ index 8b40377..84a88ff 100644 ssh_sigchld(xauth_t) ssh_read_pipes(xauth_t) ssh_dontaudit_rw_tcp_sockets(xauth_t) -@@ -300,64 +420,105 @@ optional_policy(` +@@ -300,64 +420,106 @@ optional_policy(` # XDM Local policy # @@ -30142,6 +30165,7 @@ index 8b40377..84a88ff 100644 manage_dirs_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t) manage_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t) -files_var_lib_filetrans(xdm_t, xdm_var_lib_t, file) ++exec_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t) +manage_lnk_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t) +manage_sock_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t) +files_var_lib_filetrans(xdm_t, xdm_var_lib_t, { file dir }) @@ -30177,7 +30201,7 @@ index 8b40377..84a88ff 100644 # connect to xdm xserver over stream socket stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) -@@ -366,20 +527,30 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) +@@ -366,20 +528,30 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) @@ -30210,7 +30234,7 @@ index 8b40377..84a88ff 100644 corenet_all_recvfrom_netlabel(xdm_t) corenet_tcp_sendrecv_generic_if(xdm_t) corenet_udp_sendrecv_generic_if(xdm_t) -@@ -389,38 +560,50 @@ corenet_tcp_sendrecv_all_ports(xdm_t) +@@ -389,38 +561,50 @@ corenet_tcp_sendrecv_all_ports(xdm_t) corenet_udp_sendrecv_all_ports(xdm_t) corenet_tcp_bind_generic_node(xdm_t) corenet_udp_bind_generic_node(xdm_t) @@ -30265,7 +30289,7 @@ index 8b40377..84a88ff 100644 files_read_etc_files(xdm_t) files_read_var_files(xdm_t) -@@ -431,9 +614,30 @@ files_list_mnt(xdm_t) +@@ -431,9 +615,30 @@ files_list_mnt(xdm_t) files_read_usr_files(xdm_t) # Poweroff wants to create the /poweroff file when run from xdm files_create_boot_flag(xdm_t) @@ -30296,7 +30320,7 @@ index 8b40377..84a88ff 100644 storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t) -@@ -442,28 +646,46 @@ storage_dontaudit_raw_read_removable_device(xdm_t) +@@ -442,28 +647,46 @@ storage_dontaudit_raw_read_removable_device(xdm_t) storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t) @@ -30347,7 +30371,7 @@ index 8b40377..84a88ff 100644 userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_create_all_users_keys(xdm_t) -@@ -472,24 +694,163 @@ userdom_read_user_home_content_files(xdm_t) +@@ -472,24 +695,163 @@ userdom_read_user_home_content_files(xdm_t) # Search /proc for any user domain processes. userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) @@ -30517,7 +30541,7 @@ index 8b40377..84a88ff 100644 tunable_policy(`xdm_sysadm_login',` userdom_xsession_spec_domtrans_all_users(xdm_t) # FIXME: -@@ -502,12 +863,31 @@ tunable_policy(`xdm_sysadm_login',` +@@ -502,12 +864,31 @@ tunable_policy(`xdm_sysadm_login',` # allow xserver_t xdm_tmpfs_t:file rw_file_perms; ') @@ -30549,7 +30573,7 @@ index 8b40377..84a88ff 100644 ') optional_policy(` -@@ -518,8 +898,36 @@ optional_policy(` +@@ -518,8 +899,36 @@ optional_policy(` dbus_system_bus_client(xdm_t) dbus_connect_system_bus(xdm_t) @@ -30587,7 +30611,7 @@ index 8b40377..84a88ff 100644 ') ') -@@ -530,6 +938,20 @@ optional_policy(` +@@ -530,6 +939,20 @@ optional_policy(` ') optional_policy(` @@ -30608,7 +30632,7 @@ index 8b40377..84a88ff 100644 hostname_exec(xdm_t) ') -@@ -547,28 +969,78 @@ optional_policy(` +@@ -547,28 +970,78 @@ optional_policy(` ') optional_policy(` @@ -30696,7 +30720,7 @@ index 8b40377..84a88ff 100644 ') optional_policy(` -@@ -580,6 +1052,14 @@ optional_policy(` +@@ -580,6 +1053,14 @@ optional_policy(` ') optional_policy(` @@ -30711,7 +30735,7 @@ index 8b40377..84a88ff 100644 xfs_stream_connect(xdm_t) ') -@@ -594,7 +1074,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t; +@@ -594,7 +1075,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t; type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t; allow xserver_t { root_xdrawable_t x_domain }:x_drawable send; @@ -30720,7 +30744,7 @@ index 8b40377..84a88ff 100644 # setuid/setgid for the wrapper program to change UID # sys_rawio is for iopl access - should not be needed for frame-buffer -@@ -604,8 +1084,11 @@ allow xserver_t input_xevent_t:x_event send; +@@ -604,8 +1085,11 @@ allow xserver_t input_xevent_t:x_event send; # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack @@ -30733,7 +30757,7 @@ index 8b40377..84a88ff 100644 allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow xserver_t self:fd use; allow xserver_t self:fifo_file rw_fifo_file_perms; -@@ -618,8 +1101,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; +@@ -618,8 +1102,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:udp_socket create_socket_perms; @@ -30749,7 +30773,7 @@ index 8b40377..84a88ff 100644 manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) -@@ -627,6 +1117,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) +@@ -627,6 +1118,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file) @@ -30760,7 +30784,7 @@ index 8b40377..84a88ff 100644 manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) -@@ -638,25 +1132,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) +@@ -638,25 +1133,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) files_search_var_lib(xserver_t) @@ -30802,7 +30826,7 @@ index 8b40377..84a88ff 100644 corenet_all_recvfrom_netlabel(xserver_t) corenet_tcp_sendrecv_generic_if(xserver_t) corenet_udp_sendrecv_generic_if(xserver_t) -@@ -677,23 +1183,28 @@ dev_rw_apm_bios(xserver_t) +@@ -677,23 +1184,28 @@ dev_rw_apm_bios(xserver_t) dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) @@ -30834,7 +30858,7 @@ index 8b40377..84a88ff 100644 # brought on by rhgb files_search_mnt(xserver_t) -@@ -705,6 +1216,14 @@ fs_search_nfs(xserver_t) +@@ -705,6 +1217,14 @@ fs_search_nfs(xserver_t) fs_search_auto_mountpoints(xserver_t) fs_search_ramfs(xserver_t) @@ -30849,7 +30873,7 @@ index 8b40377..84a88ff 100644 mls_xwin_read_to_clearance(xserver_t) selinux_validate_context(xserver_t) -@@ -718,20 +1237,18 @@ init_getpgid(xserver_t) +@@ -718,20 +1238,18 @@ init_getpgid(xserver_t) term_setattr_unallocated_ttys(xserver_t) term_use_unallocated_ttys(xserver_t) @@ -30873,7 +30897,7 @@ index 8b40377..84a88ff 100644 userdom_search_user_home_dirs(xserver_t) userdom_use_user_ttys(xserver_t) -@@ -739,8 +1256,6 @@ userdom_setattr_user_ttys(xserver_t) +@@ -739,8 +1257,6 @@ userdom_setattr_user_ttys(xserver_t) userdom_read_user_tmp_files(xserver_t) userdom_rw_user_tmpfs_files(xserver_t) @@ -30882,7 +30906,7 @@ index 8b40377..84a88ff 100644 ifndef(`distro_redhat',` allow xserver_t self:process { execmem execheap execstack }; domain_mmap_low_uncond(xserver_t) -@@ -785,17 +1300,54 @@ optional_policy(` +@@ -785,17 +1301,54 @@ optional_policy(` ') optional_policy(` @@ -30939,7 +30963,7 @@ index 8b40377..84a88ff 100644 ') optional_policy(` -@@ -803,6 +1355,10 @@ optional_policy(` +@@ -803,6 +1356,10 @@ optional_policy(` ') optional_policy(` @@ -30950,7 +30974,7 @@ index 8b40377..84a88ff 100644 xfs_stream_connect(xserver_t) ') -@@ -818,18 +1374,17 @@ allow xserver_t xdm_t:shm rw_shm_perms; +@@ -818,18 +1375,17 @@ allow xserver_t xdm_t:shm rw_shm_perms; # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open # handle of a file inside the dir!!! @@ -30975,7 +30999,7 @@ index 8b40377..84a88ff 100644 can_exec(xserver_t, xkb_var_lib_t) # VNC v4 module in X server -@@ -842,26 +1397,21 @@ init_use_fds(xserver_t) +@@ -842,26 +1398,21 @@ init_use_fds(xserver_t) # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_user_home_content_files(xserver_t) @@ -31010,7 +31034,7 @@ index 8b40377..84a88ff 100644 ') optional_policy(` -@@ -912,7 +1462,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy +@@ -912,7 +1463,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show }; # operations allowed on my windows allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; @@ -31019,7 +31043,7 @@ index 8b40377..84a88ff 100644 # operations allowed on all windows allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child }; -@@ -966,11 +1516,31 @@ allow x_domain self:x_resource { read write }; +@@ -966,11 +1517,31 @@ allow x_domain self:x_resource { read write }; # can mess with the screensaver allow x_domain xserver_t:x_screen { getattr saver_getattr }; @@ -31051,7 +31075,7 @@ index 8b40377..84a88ff 100644 tunable_policy(`! xserver_object_manager',` # should be xserver_unconfined(x_domain), # but typeattribute doesnt work in conditionals -@@ -992,18 +1562,148 @@ tunable_policy(`! xserver_object_manager',` +@@ -992,18 +1563,148 @@ tunable_policy(`! xserver_object_manager',` allow x_domain xevent_type:{ x_event x_synthetic_event } *; ') @@ -35415,7 +35439,7 @@ index 79a45f6..6126f21 100644 + allow $1 init_var_lib_t:dir search_dir_perms; ') diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te -index 17eda24..3395ea6 100644 +index 17eda24..a78f8b6 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -11,10 +11,31 @@ gen_require(` @@ -35623,7 +35647,7 @@ index 17eda24..3395ea6 100644 domain_getpgid_all_domains(init_t) domain_kill_all_domains(init_t) -@@ -139,14 +239,26 @@ domain_signal_all_domains(init_t) +@@ -139,45 +239,102 @@ domain_signal_all_domains(init_t) domain_signull_all_domains(init_t) domain_sigstop_all_domains(init_t) domain_sigchld_all_domains(init_t) @@ -35652,7 +35676,9 @@ index 17eda24..3395ea6 100644 # file descriptors inherited from the rootfs: files_dontaudit_rw_root_files(init_t) files_dontaudit_rw_root_chr_files(init_t) -@@ -155,29 +267,73 @@ fs_list_inotifyfs(init_t) ++files_dontaudit_mounton_modules_object(init_t) + + fs_list_inotifyfs(init_t) # cjp: this may be related to /dev/log fs_write_ramfs_sockets(init_t) @@ -35731,7 +35757,7 @@ index 17eda24..3395ea6 100644 ifdef(`distro_gentoo',` allow init_t self:process { getcap setcap }; -@@ -186,29 +342,275 @@ ifdef(`distro_gentoo',` +@@ -186,29 +343,275 @@ ifdef(`distro_gentoo',` ') ifdef(`distro_redhat',` @@ -36016,7 +36042,7 @@ index 17eda24..3395ea6 100644 ') optional_policy(` -@@ -216,7 +618,30 @@ optional_policy(` +@@ -216,7 +619,30 @@ optional_policy(` ') optional_policy(` @@ -36048,7 +36074,7 @@ index 17eda24..3395ea6 100644 ') ######################################## -@@ -225,9 +650,9 @@ optional_policy(` +@@ -225,9 +651,9 @@ optional_policy(` # allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; @@ -36060,7 +36086,7 @@ index 17eda24..3395ea6 100644 allow initrc_t self:passwd rootok; allow initrc_t self:key manage_key_perms; -@@ -258,12 +683,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) +@@ -258,12 +684,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) allow initrc_t initrc_var_run_t:file manage_file_perms; files_pid_filetrans(initrc_t, initrc_var_run_t, file) @@ -36077,7 +36103,7 @@ index 17eda24..3395ea6 100644 manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) -@@ -279,23 +708,36 @@ kernel_change_ring_buffer_level(initrc_t) +@@ -279,23 +709,36 @@ kernel_change_ring_buffer_level(initrc_t) kernel_clear_ring_buffer(initrc_t) kernel_get_sysvipc_info(initrc_t) kernel_read_all_sysctls(initrc_t) @@ -36120,7 +36146,7 @@ index 17eda24..3395ea6 100644 corenet_tcp_sendrecv_all_ports(initrc_t) corenet_udp_sendrecv_all_ports(initrc_t) corenet_tcp_connect_all_ports(initrc_t) -@@ -303,9 +745,11 @@ corenet_sendrecv_all_client_packets(initrc_t) +@@ -303,9 +746,11 @@ corenet_sendrecv_all_client_packets(initrc_t) dev_read_rand(initrc_t) dev_read_urand(initrc_t) @@ -36132,7 +36158,7 @@ index 17eda24..3395ea6 100644 dev_rw_sysfs(initrc_t) dev_list_usbfs(initrc_t) dev_read_framebuffer(initrc_t) -@@ -313,8 +757,10 @@ dev_write_framebuffer(initrc_t) +@@ -313,8 +758,10 @@ dev_write_framebuffer(initrc_t) dev_read_realtime_clock(initrc_t) dev_read_sound_mixer(initrc_t) dev_write_sound_mixer(initrc_t) @@ -36143,7 +36169,7 @@ index 17eda24..3395ea6 100644 dev_delete_lvm_control_dev(initrc_t) dev_manage_generic_symlinks(initrc_t) dev_manage_generic_files(initrc_t) -@@ -322,8 +768,7 @@ dev_manage_generic_files(initrc_t) +@@ -322,8 +769,7 @@ dev_manage_generic_files(initrc_t) dev_delete_generic_symlinks(initrc_t) dev_getattr_all_blk_files(initrc_t) dev_getattr_all_chr_files(initrc_t) @@ -36153,7 +36179,7 @@ index 17eda24..3395ea6 100644 domain_kill_all_domains(initrc_t) domain_signal_all_domains(initrc_t) -@@ -332,7 +777,6 @@ domain_sigstop_all_domains(initrc_t) +@@ -332,7 +778,6 @@ domain_sigstop_all_domains(initrc_t) domain_sigchld_all_domains(initrc_t) domain_read_all_domains_state(initrc_t) domain_getattr_all_domains(initrc_t) @@ -36161,7 +36187,7 @@ index 17eda24..3395ea6 100644 domain_getsession_all_domains(initrc_t) domain_use_interactive_fds(initrc_t) # for lsof which is used by alsa shutdown: -@@ -340,6 +784,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) +@@ -340,6 +785,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) domain_dontaudit_getattr_all_tcp_sockets(initrc_t) domain_dontaudit_getattr_all_dgram_sockets(initrc_t) domain_dontaudit_getattr_all_pipes(initrc_t) @@ -36169,7 +36195,7 @@ index 17eda24..3395ea6 100644 files_getattr_all_dirs(initrc_t) files_getattr_all_files(initrc_t) -@@ -347,14 +792,15 @@ files_getattr_all_symlinks(initrc_t) +@@ -347,14 +793,15 @@ files_getattr_all_symlinks(initrc_t) files_getattr_all_pipes(initrc_t) files_getattr_all_sockets(initrc_t) files_purge_tmp(initrc_t) @@ -36187,7 +36213,7 @@ index 17eda24..3395ea6 100644 files_read_usr_files(initrc_t) files_manage_urandom_seed(initrc_t) files_manage_generic_spool(initrc_t) -@@ -364,8 +810,12 @@ files_list_isid_type_dirs(initrc_t) +@@ -364,8 +811,12 @@ files_list_isid_type_dirs(initrc_t) files_mounton_isid_type_dirs(initrc_t) files_list_default(initrc_t) files_mounton_default(initrc_t) @@ -36201,7 +36227,7 @@ index 17eda24..3395ea6 100644 fs_list_inotifyfs(initrc_t) fs_register_binary_executable_type(initrc_t) # rhgb-console writes to ramfs -@@ -375,10 +825,11 @@ fs_mount_all_fs(initrc_t) +@@ -375,10 +826,11 @@ fs_mount_all_fs(initrc_t) fs_unmount_all_fs(initrc_t) fs_remount_all_fs(initrc_t) fs_getattr_all_fs(initrc_t) @@ -36215,7 +36241,7 @@ index 17eda24..3395ea6 100644 mcs_process_set_categories(initrc_t) mls_file_read_all_levels(initrc_t) -@@ -387,8 +838,10 @@ mls_process_read_up(initrc_t) +@@ -387,8 +839,10 @@ mls_process_read_up(initrc_t) mls_process_write_down(initrc_t) mls_rangetrans_source(initrc_t) mls_fd_share_all_levels(initrc_t) @@ -36226,7 +36252,7 @@ index 17eda24..3395ea6 100644 storage_getattr_fixed_disk_dev(initrc_t) storage_setattr_fixed_disk_dev(initrc_t) -@@ -398,6 +851,7 @@ term_use_all_terms(initrc_t) +@@ -398,6 +852,7 @@ term_use_all_terms(initrc_t) term_reset_tty_labels(initrc_t) auth_rw_login_records(initrc_t) @@ -36234,7 +36260,7 @@ index 17eda24..3395ea6 100644 auth_setattr_login_records(initrc_t) auth_rw_lastlog(initrc_t) auth_read_pam_pid(initrc_t) -@@ -416,20 +870,18 @@ logging_read_all_logs(initrc_t) +@@ -416,20 +871,18 @@ logging_read_all_logs(initrc_t) logging_append_all_logs(initrc_t) logging_read_audit_config(initrc_t) @@ -36258,7 +36284,7 @@ index 17eda24..3395ea6 100644 ifdef(`distro_debian',` dev_setattr_generic_dirs(initrc_t) -@@ -451,7 +903,6 @@ ifdef(`distro_gentoo',` +@@ -451,7 +904,6 @@ ifdef(`distro_gentoo',` allow initrc_t self:process setfscreate; dev_create_null_dev(initrc_t) dev_create_zero_dev(initrc_t) @@ -36266,7 +36292,7 @@ index 17eda24..3395ea6 100644 term_create_console_dev(initrc_t) # unfortunately /sbin/rc does stupid tricks -@@ -486,6 +937,10 @@ ifdef(`distro_gentoo',` +@@ -486,6 +938,10 @@ ifdef(`distro_gentoo',` sysnet_setattr_config(initrc_t) optional_policy(` @@ -36277,7 +36303,7 @@ index 17eda24..3395ea6 100644 alsa_read_lib(initrc_t) ') -@@ -506,7 +961,7 @@ ifdef(`distro_redhat',` +@@ -506,7 +962,7 @@ ifdef(`distro_redhat',` # Red Hat systems seem to have a stray # fd open from the initrd @@ -36286,7 +36312,7 @@ index 17eda24..3395ea6 100644 files_dontaudit_read_root_files(initrc_t) # These seem to be from the initrd -@@ -521,6 +976,7 @@ ifdef(`distro_redhat',` +@@ -521,6 +977,7 @@ ifdef(`distro_redhat',` files_create_boot_dirs(initrc_t) files_create_boot_flag(initrc_t) files_rw_boot_symlinks(initrc_t) @@ -36294,7 +36320,7 @@ index 17eda24..3395ea6 100644 # wants to read /.fonts directory files_read_default_files(initrc_t) files_mountpoint(initrc_tmp_t) -@@ -541,6 +997,7 @@ ifdef(`distro_redhat',` +@@ -541,6 +998,7 @@ ifdef(`distro_redhat',` miscfiles_rw_localization(initrc_t) miscfiles_setattr_localization(initrc_t) miscfiles_relabel_localization(initrc_t) @@ -36302,7 +36328,7 @@ index 17eda24..3395ea6 100644 miscfiles_read_fonts(initrc_t) miscfiles_read_hwdata(initrc_t) -@@ -550,8 +1007,44 @@ ifdef(`distro_redhat',` +@@ -550,8 +1008,44 @@ ifdef(`distro_redhat',` ') optional_policy(` @@ -36347,7 +36373,7 @@ index 17eda24..3395ea6 100644 ') optional_policy(` -@@ -559,14 +1052,31 @@ ifdef(`distro_redhat',` +@@ -559,14 +1053,31 @@ ifdef(`distro_redhat',` rpc_write_exports(initrc_t) rpc_manage_nfs_state_data(initrc_t) ') @@ -36379,7 +36405,7 @@ index 17eda24..3395ea6 100644 ') ') -@@ -577,6 +1087,39 @@ ifdef(`distro_suse',` +@@ -577,6 +1088,39 @@ ifdef(`distro_suse',` ') ') @@ -36419,7 +36445,7 @@ index 17eda24..3395ea6 100644 optional_policy(` amavis_search_lib(initrc_t) amavis_setattr_pid_files(initrc_t) -@@ -589,6 +1132,8 @@ optional_policy(` +@@ -589,6 +1133,8 @@ optional_policy(` optional_policy(` apache_read_config(initrc_t) apache_list_modules(initrc_t) @@ -36428,7 +36454,7 @@ index 17eda24..3395ea6 100644 ') optional_policy(` -@@ -610,6 +1155,7 @@ optional_policy(` +@@ -610,6 +1156,7 @@ optional_policy(` optional_policy(` cgroup_stream_connect_cgred(initrc_t) @@ -36436,7 +36462,7 @@ index 17eda24..3395ea6 100644 ') optional_policy(` -@@ -626,6 +1172,17 @@ optional_policy(` +@@ -626,6 +1173,17 @@ optional_policy(` ') optional_policy(` @@ -36454,7 +36480,7 @@ index 17eda24..3395ea6 100644 dev_getattr_printer_dev(initrc_t) cups_read_log(initrc_t) -@@ -642,9 +1199,13 @@ optional_policy(` +@@ -642,9 +1200,13 @@ optional_policy(` dbus_connect_system_bus(initrc_t) dbus_system_bus_client(initrc_t) dbus_read_config(initrc_t) @@ -36468,7 +36494,7 @@ index 17eda24..3395ea6 100644 ') optional_policy(` -@@ -657,15 +1218,11 @@ optional_policy(` +@@ -657,15 +1219,11 @@ optional_policy(` ') optional_policy(` @@ -36486,7 +36512,7 @@ index 17eda24..3395ea6 100644 ') optional_policy(` -@@ -686,6 +1243,15 @@ optional_policy(` +@@ -686,6 +1244,15 @@ optional_policy(` ') optional_policy(` @@ -36502,7 +36528,7 @@ index 17eda24..3395ea6 100644 inn_exec_config(initrc_t) ') -@@ -726,6 +1292,7 @@ optional_policy(` +@@ -726,6 +1293,7 @@ optional_policy(` lpd_list_spool(initrc_t) lpd_read_config(initrc_t) @@ -36510,7 +36536,7 @@ index 17eda24..3395ea6 100644 ') optional_policy(` -@@ -743,7 +1310,13 @@ optional_policy(` +@@ -743,7 +1311,13 @@ optional_policy(` ') optional_policy(` @@ -36525,7 +36551,7 @@ index 17eda24..3395ea6 100644 mta_dontaudit_read_spool_symlinks(initrc_t) ') -@@ -766,6 +1339,10 @@ optional_policy(` +@@ -766,6 +1340,10 @@ optional_policy(` ') optional_policy(` @@ -36536,7 +36562,7 @@ index 17eda24..3395ea6 100644 postgresql_manage_db(initrc_t) postgresql_read_config(initrc_t) ') -@@ -775,10 +1352,20 @@ optional_policy(` +@@ -775,10 +1353,20 @@ optional_policy(` ') optional_policy(` @@ -36557,7 +36583,7 @@ index 17eda24..3395ea6 100644 quota_manage_flags(initrc_t) ') -@@ -787,6 +1374,10 @@ optional_policy(` +@@ -787,6 +1375,10 @@ optional_policy(` ') optional_policy(` @@ -36568,7 +36594,7 @@ index 17eda24..3395ea6 100644 fs_write_ramfs_sockets(initrc_t) fs_search_ramfs(initrc_t) -@@ -808,8 +1399,6 @@ optional_policy(` +@@ -808,8 +1400,6 @@ optional_policy(` # bash tries ioctl for some reason files_dontaudit_ioctl_all_pids(initrc_t) @@ -36577,7 +36603,7 @@ index 17eda24..3395ea6 100644 ') optional_policy(` -@@ -818,6 +1407,10 @@ optional_policy(` +@@ -818,6 +1408,10 @@ optional_policy(` ') optional_policy(` @@ -36588,7 +36614,7 @@ index 17eda24..3395ea6 100644 # shorewall-init script run /var/lib/shorewall/firewall shorewall_lib_domtrans(initrc_t) ') -@@ -827,10 +1420,12 @@ optional_policy(` +@@ -827,10 +1421,12 @@ optional_policy(` squid_manage_logs(initrc_t) ') @@ -36601,7 +36627,7 @@ index 17eda24..3395ea6 100644 optional_policy(` ssh_dontaudit_read_server_keys(initrc_t) -@@ -857,21 +1452,62 @@ optional_policy(` +@@ -857,21 +1453,62 @@ optional_policy(` ') optional_policy(` @@ -36665,7 +36691,7 @@ index 17eda24..3395ea6 100644 ') optional_policy(` -@@ -887,6 +1523,10 @@ optional_policy(` +@@ -887,6 +1524,10 @@ optional_policy(` ') optional_policy(` @@ -36676,7 +36702,7 @@ index 17eda24..3395ea6 100644 # Set device ownerships/modes. xserver_setattr_console_pipes(initrc_t) -@@ -897,3 +1537,218 @@ optional_policy(` +@@ -897,3 +1538,218 @@ optional_policy(` optional_policy(` zebra_read_config(initrc_t) ') @@ -37886,7 +37912,7 @@ index 0000000..c814795 +fs_manage_kdbus_dirs(systemd_logind_t) +fs_manage_kdbus_files(systemd_logind_t) diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc -index 73bb3c0..f36d28b 100644 +index 73bb3c0..a70bee5 100644 --- a/policy/modules/system/libraries.fc +++ b/policy/modules/system/libraries.fc @@ -1,3 +1,4 @@ @@ -38218,7 +38244,7 @@ index 73bb3c0..f36d28b 100644 + +/usr/lib/libGTL.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) + -+/usr/lib64/erlang/erts-[^/]*/bin/epmd -- gen_context(system_u:object_r:lib_t,s0) ++/usr/lib/erlang/erts-[^/]*/bin/epmd -- gen_context(system_u:object_r:lib_t,s0) + +/usr/lib/nsr/(.*/)?.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/opt/lgtonmc/bin/.*\.so(\.[0-9])? -- gen_context(system_u:object_r:textrel_shlib_t,s0) diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index 94a80b3e..ba6795e5 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -589,7 +589,7 @@ index 058d908..ee0c559 100644 +') + diff --git a/abrt.te b/abrt.te -index eb50f07..963ccdc 100644 +index eb50f07..1c4fbd3 100644 --- a/abrt.te +++ b/abrt.te @@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1) @@ -1058,7 +1058,7 @@ index eb50f07..963ccdc 100644 allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms; domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t) -@@ -365,38 +474,80 @@ corecmd_exec_shell(abrt_retrace_worker_t) +@@ -365,38 +474,84 @@ corecmd_exec_shell(abrt_retrace_worker_t) dev_read_urand(abrt_retrace_worker_t) @@ -1120,10 +1120,10 @@ index eb50f07..963ccdc 100644 +domain_ptrace_all_domains(abrt_dump_oops_t) +domain_read_all_domains_state(abrt_dump_oops_t) +domain_getattr_all_domains(abrt_dump_oops_t) -+ + +files_manage_non_security_dirs(abrt_dump_oops_t) +files_manage_non_security_files(abrt_dump_oops_t) - ++ +fs_getattr_all_fs(abrt_dump_oops_t) fs_list_inotifyfs(abrt_dump_oops_t) +fs_list_pstorefs(abrt_dump_oops_t) @@ -1138,12 +1138,16 @@ index eb50f07..963ccdc 100644 +init_read_var_lib_files(abrt_dump_oops_t) + +optional_policy(` ++ sssd_stream_connect(abrt_dump_oops_t) ++') ++ ++optional_policy(` + xserver_exec(abrt_dump_oops_t) +') ####################################### # -@@ -404,25 +555,60 @@ logging_read_generic_logs(abrt_dump_oops_t) +@@ -404,25 +559,60 @@ logging_read_generic_logs(abrt_dump_oops_t) # allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms; @@ -1206,7 +1210,7 @@ index eb50f07..963ccdc 100644 ') ####################################### -@@ -430,10 +616,7 @@ tunable_policy(`abrt_upload_watch_anon_write',` +@@ -430,10 +620,7 @@ tunable_policy(`abrt_upload_watch_anon_write',` # Global local policy # @@ -12356,7 +12360,7 @@ index 008f8ef..144c074 100644 admin_pattern($1, certmonger_var_run_t) ') diff --git a/certmonger.te b/certmonger.te -index 550b287..1401e7b 100644 +index 550b287..814aeca 100644 --- a/certmonger.te +++ b/certmonger.te @@ -18,18 +18,23 @@ files_type(certmonger_var_lib_t) @@ -12449,7 +12453,7 @@ index 550b287..1401e7b 100644 ') optional_policy(` -@@ -92,11 +111,60 @@ optional_policy(` +@@ -92,11 +111,61 @@ optional_policy(` ') optional_policy(` @@ -12471,6 +12475,7 @@ index 550b287..1401e7b 100644 +optional_policy(` kerberos_use(certmonger_t) + kerberos_read_keytab(certmonger_t) ++ kerberos_manage_config(certmonger_t) ') optional_policy(` @@ -15122,10 +15127,10 @@ index 5f306dd..cf347c6 100644 ') diff --git a/cockpit.fc b/cockpit.fc new file mode 100644 -index 0000000..9ed6fdc +index 0000000..bf80173 --- /dev/null +++ b/cockpit.fc -@@ -0,0 +1,12 @@ +@@ -0,0 +1,13 @@ +# cockpit stuff + +/usr/lib/systemd/system/cockpit.* -- gen_context(system_u:object_r:cockpit_unit_file_t,s0) @@ -15134,6 +15139,7 @@ index 0000000..9ed6fdc +/usr/libexec/cockpit-ws -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0) + +/usr/libexec/cockpit-session -- gen_context(system_u:object_r:cockpit_session_exec_t,s0) ++/usr/libexec/cockpit-ssh -- gen_context(system_u:object_r:cockpit_session_exec_t,s0) + +/var/lib/cockpit(/.*)? gen_context(system_u:object_r:cockpit_var_lib_t,s0) + @@ -15334,10 +15340,10 @@ index 0000000..d5920c0 +') diff --git a/cockpit.te b/cockpit.te new file mode 100644 -index 0000000..e7b8c7e +index 0000000..da93926 --- /dev/null +++ b/cockpit.te -@@ -0,0 +1,115 @@ +@@ -0,0 +1,120 @@ +policy_module(cockpit, 1.0.0) + +######################################## @@ -15431,6 +15437,9 @@ index 0000000..e7b8c7e +allow cockpit_session_t self:capability { sys_admin dac_override setuid setgid }; +allow cockpit_session_t self:process { setexec setsched signal_perms }; + ++read_files_pattern(cockpit_session_t, cockpit_var_lib_t, cockpit_var_lib_t) ++list_dirs_pattern(cockpit_session_t, cockpit_var_lib_t, cockpit_var_lib_t) ++ +manage_dirs_pattern(cockpit_session_t, cockpit_tmp_t, cockpit_tmp_t) +manage_files_pattern(cockpit_session_t, cockpit_tmp_t, cockpit_tmp_t) +files_tmp_filetrans(cockpit_session_t, cockpit_tmp_t, { dir file }) @@ -15442,6 +15451,8 @@ index 0000000..e7b8c7e +auth_manage_shadow(cockpit_session_t) +auth_write_login_records(cockpit_session_t) + ++corenet_tcp_bind_ssh_port(cockpit_session_t) ++ +# cockpit-session can execute cockpit-agent as the user +userdom_spec_domtrans_all_users(cockpit_session_t) +usermanage_read_crack_db(cockpit_session_t) @@ -15850,7 +15861,7 @@ index 8e27a37..c69be28 100644 + ps_process_pattern($1, colord_t) +') diff --git a/colord.te b/colord.te -index 9f2dfb2..def3424 100644 +index 9f2dfb2..86836f9 100644 --- a/colord.te +++ b/colord.te @@ -8,6 +8,7 @@ policy_module(colord, 1.1.0) @@ -15913,7 +15924,7 @@ index 9f2dfb2..def3424 100644 storage_getattr_fixed_disk_dev(colord_t) storage_getattr_removable_dev(colord_t) -@@ -100,19 +106,16 @@ init_read_state(colord_t) +@@ -100,19 +106,17 @@ init_read_state(colord_t) auth_use_nsswitch(colord_t) @@ -15928,6 +15939,7 @@ index 9f2dfb2..def3424 100644 - fs_read_nfs_files(colord_t) -') +systemd_read_logind_sessions_files(colord_t) ++systemd_hwdb_manage_config(colord_t) -tunable_policy(`use_samba_home_dirs',` - fs_getattr_cifs(colord_t) @@ -15940,7 +15952,7 @@ index 9f2dfb2..def3424 100644 optional_policy(` cups_read_config(colord_t) -@@ -120,6 +123,13 @@ optional_policy(` +@@ -120,6 +124,13 @@ optional_policy(` cups_read_state(colord_t) cups_stream_connect(colord_t) cups_dbus_chat(colord_t) @@ -15954,7 +15966,7 @@ index 9f2dfb2..def3424 100644 ') optional_policy(` -@@ -134,6 +144,23 @@ optional_policy(` +@@ -134,6 +145,23 @@ optional_policy(` ') optional_policy(` @@ -21988,7 +22000,7 @@ index 83bfda6..92d9fb2 100644 domain_system_change_exemption($1) role_transition $2 cyrus_initrc_exec_t system_r; diff --git a/cyrus.te b/cyrus.te -index 4283f2d..21a3620 100644 +index 4283f2d..30b684c 100644 --- a/cyrus.te +++ b/cyrus.te @@ -29,7 +29,7 @@ files_pid_file(cyrus_var_run_t) @@ -22041,18 +22053,22 @@ index 4283f2d..21a3620 100644 miscfiles_read_generic_certs(cyrus_t) userdom_use_unpriv_users_fds(cyrus_t) -@@ -121,6 +121,10 @@ optional_policy(` +@@ -121,6 +121,14 @@ optional_policy(` ') optional_policy(` + dirsrv_stream_connect(cyrus_t) +') + ++optional_policy(` ++ gssproxy_stream_connect(cyrus_t) ++') ++ +optional_policy(` kerberos_read_keytab(cyrus_t) kerberos_use(cyrus_t) ') -@@ -134,8 +138,8 @@ optional_policy(` +@@ -134,8 +142,8 @@ optional_policy(` ') optional_policy(` @@ -25463,7 +25479,7 @@ index 0000000..b3784d8 +') diff --git a/dirsrv.te b/dirsrv.te new file mode 100644 -index 0000000..89f1271 +index 0000000..f9f9806 --- /dev/null +++ b/dirsrv.te @@ -0,0 +1,203 @@ @@ -25548,7 +25564,7 @@ index 0000000..89f1271 + +manage_files_pattern(dirsrv_t, dirsrv_var_lock_t, dirsrv_var_lock_t) +manage_dirs_pattern(dirsrv_t, dirsrv_var_lock_t, dirsrv_var_lock_t) -+files_lock_filetrans(dirsrv_t, dirsrv_var_lock_t, file) ++files_lock_filetrans(dirsrv_t, dirsrv_var_lock_t, { dir file }) +files_setattr_lock_dirs(dirsrv_t) + +manage_files_pattern(dirsrv_t, dirsrv_config_t, dirsrv_config_t) @@ -31069,10 +31085,10 @@ index 0000000..d9ba5fa +') diff --git a/ganesha.te b/ganesha.te new file mode 100644 -index 0000000..4125c8d +index 0000000..fe7b5d7 --- /dev/null +++ b/ganesha.te -@@ -0,0 +1,71 @@ +@@ -0,0 +1,72 @@ +policy_module(ganesha, 1.0.0) + +######################################## @@ -31133,6 +31149,7 @@ index 0000000..4125c8d +optional_policy(` + dbus_system_bus_client(ganesha_t) + dbus_connect_system_bus(ganesha_t) ++ unconfined_dbus_chat(ganesha_t) +') + + @@ -42122,7 +42139,7 @@ index 3a00b3a..92f125f 100644 +') + diff --git a/kdump.te b/kdump.te -index 715fc21..14a5a0f 100644 +index 715fc21..446ebb4 100644 --- a/kdump.te +++ b/kdump.te @@ -12,35 +12,58 @@ init_system_domain(kdump_t, kdump_exec_t) @@ -42230,7 +42247,7 @@ index 715fc21..14a5a0f 100644 kernel_read_system_state(kdumpctl_t) -@@ -71,46 +107,60 @@ corecmd_exec_bin(kdumpctl_t) +@@ -71,46 +107,62 @@ corecmd_exec_bin(kdumpctl_t) corecmd_exec_shell(kdumpctl_t) dev_read_sysfs(kdumpctl_t) @@ -42264,6 +42281,8 @@ index 715fc21..14a5a0f 100644 logging_send_syslog_msg(kdumpctl_t) +# Need log file from /var/log/dracut.log +logging_write_generic_logs(kdumpctl_t) ++ ++selinux_get_enforce_mode(kdumpctl_t) -miscfiles_read_localization(kdumpctl_t) +optional_policy(` @@ -46111,10 +46130,10 @@ index 0000000..7ba5060 + diff --git a/linuxptp.te b/linuxptp.te new file mode 100644 -index 0000000..9f7ea8e +index 0000000..7acdb2d --- /dev/null +++ b/linuxptp.te -@@ -0,0 +1,179 @@ +@@ -0,0 +1,180 @@ +policy_module(linuxptp, 1.0.0) + + @@ -46267,6 +46286,7 @@ index 0000000..9f7ea8e +allow ptp4l_t self:shm create_shm_perms; +allow ptp4l_t self:udp_socket create_socket_perms; +allow ptp4l_t self:capability { net_admin net_raw sys_time }; ++allow ptp4l_t self:capability2 { wake_alarm }; +allow ptp4l_t self:netlink_route_socket rw_netlink_socket_perms; + +allow ptp4l_t phc2sys_t:unix_dgram_socket sendto; @@ -67927,14 +67947,12 @@ index 9b15730..cb00f20 100644 + ') ') diff --git a/openvswitch.te b/openvswitch.te -index 44dbc99..e1fbbd9 100644 +index 44dbc99..9e70db7 100644 --- a/openvswitch.te +++ b/openvswitch.te -@@ -8,12 +8,10 @@ policy_module(openvswitch, 1.1.1) - type openvswitch_t; +@@ -9,11 +9,8 @@ type openvswitch_t; type openvswitch_exec_t; init_daemon_domain(openvswitch_t, openvswitch_exec_t) -+init_initrc_domain(openvswitch_t) -type openvswitch_initrc_exec_t; -init_script_file(openvswitch_initrc_exec_t) @@ -67946,7 +67964,7 @@ index 44dbc99..e1fbbd9 100644 type openvswitch_var_lib_t; files_type(openvswitch_var_lib_t) -@@ -27,20 +25,29 @@ files_tmp_file(openvswitch_tmp_t) +@@ -27,20 +24,29 @@ files_tmp_file(openvswitch_tmp_t) type openvswitch_var_run_t; files_pid_file(openvswitch_var_run_t) @@ -67984,7 +68002,7 @@ index 44dbc99..e1fbbd9 100644 manage_dirs_pattern(openvswitch_t, openvswitch_var_lib_t, openvswitch_var_lib_t) manage_files_pattern(openvswitch_t, openvswitch_var_lib_t, openvswitch_var_lib_t) -@@ -48,9 +55,7 @@ manage_lnk_files_pattern(openvswitch_t, openvswitch_var_lib_t, openvswitch_var_l +@@ -48,9 +54,7 @@ manage_lnk_files_pattern(openvswitch_t, openvswitch_var_lib_t, openvswitch_var_l files_var_lib_filetrans(openvswitch_t, openvswitch_var_lib_t, { dir file lnk_file }) manage_dirs_pattern(openvswitch_t, openvswitch_log_t, openvswitch_log_t) @@ -67995,7 +68013,7 @@ index 44dbc99..e1fbbd9 100644 manage_lnk_files_pattern(openvswitch_t, openvswitch_log_t, openvswitch_log_t) logging_log_filetrans(openvswitch_t, openvswitch_log_t, { dir file lnk_file }) -@@ -63,35 +68,56 @@ manage_dirs_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t) +@@ -63,35 +67,59 @@ manage_dirs_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t) manage_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t) manage_sock_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t) manage_lnk_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t) @@ -68032,6 +68050,7 @@ index 44dbc99..e1fbbd9 100644 -files_read_etc_files(openvswitch_t) +files_read_kernel_modules(openvswitch_t) ++files_load_kernel_modules(openvswitch_t) fs_getattr_all_fs(openvswitch_t) fs_search_cgroup_dirs(openvswitch_t) @@ -68043,6 +68062,8 @@ index 44dbc99..e1fbbd9 100644 logging_send_syslog_msg(openvswitch_t) -miscfiles_read_localization(openvswitch_t) ++init_read_script_state(openvswitch_t) ++ +modutils_exec_insmod(openvswitch_t) +modutils_list_module_config(openvswitch_t) +modutils_read_module_config(openvswitch_t) @@ -95405,7 +95426,7 @@ index 50d07fb..a34db48 100644 + allow $1 samba_unit_file_t:service all_service_perms; ') diff --git a/samba.te b/samba.te -index 2b7c441..02be6db 100644 +index 2b7c441..efe3f59 100644 --- a/samba.te +++ b/samba.te @@ -6,99 +6,86 @@ policy_module(samba, 1.16.3) @@ -96038,7 +96059,7 @@ index 2b7c441..02be6db 100644 rpc_search_nfs_state_data(smbd_t) ') -@@ -499,12 +549,52 @@ optional_policy(` +@@ -499,12 +549,53 @@ optional_policy(` udev_read_db(smbd_t) ') @@ -96089,10 +96110,11 @@ index 2b7c441..02be6db 100644 dontaudit nmbd_t self:capability sys_tty_config; +allow nmbd_t self:capability {net_admin}; ++allow nmbd_t self:capability2 block_suspend; allow nmbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow nmbd_t self:fd use; allow nmbd_t self:fifo_file rw_fifo_file_perms; -@@ -512,9 +602,11 @@ allow nmbd_t self:msg { send receive }; +@@ -512,9 +603,11 @@ allow nmbd_t self:msg { send receive }; allow nmbd_t self:msgq create_msgq_perms; allow nmbd_t self:sem create_sem_perms; allow nmbd_t self:shm create_shm_perms; @@ -96107,7 +96129,7 @@ index 2b7c441..02be6db 100644 manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t) manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t) -@@ -526,20 +618,16 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) +@@ -526,20 +619,16 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t) @@ -96132,7 +96154,7 @@ index 2b7c441..02be6db 100644 kernel_getattr_core_if(nmbd_t) kernel_getattr_message_if(nmbd_t) -@@ -547,53 +635,44 @@ kernel_read_kernel_sysctls(nmbd_t) +@@ -547,53 +636,44 @@ kernel_read_kernel_sysctls(nmbd_t) kernel_read_network_state(nmbd_t) kernel_read_software_raid_state(nmbd_t) kernel_read_system_state(nmbd_t) @@ -96201,7 +96223,7 @@ index 2b7c441..02be6db 100644 ') optional_policy(` -@@ -606,18 +685,29 @@ optional_policy(` +@@ -606,18 +686,29 @@ optional_policy(` ######################################## # @@ -96237,7 +96259,7 @@ index 2b7c441..02be6db 100644 samba_read_config(smbcontrol_t) samba_search_var(smbcontrol_t) -@@ -627,39 +717,38 @@ domain_use_interactive_fds(smbcontrol_t) +@@ -627,39 +718,38 @@ domain_use_interactive_fds(smbcontrol_t) dev_read_urand(smbcontrol_t) @@ -96289,7 +96311,7 @@ index 2b7c441..02be6db 100644 allow smbmount_t samba_secrets_t:file manage_file_perms; -@@ -668,26 +757,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) +@@ -668,26 +758,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t) files_var_filetrans(smbmount_t, samba_var_t, dir, "samba") @@ -96325,7 +96347,7 @@ index 2b7c441..02be6db 100644 fs_getattr_cifs(smbmount_t) fs_mount_cifs(smbmount_t) -@@ -699,58 +784,77 @@ fs_read_cifs_files(smbmount_t) +@@ -699,58 +785,77 @@ fs_read_cifs_files(smbmount_t) storage_raw_read_fixed_disk(smbmount_t) storage_raw_write_fixed_disk(smbmount_t) @@ -96417,7 +96439,7 @@ index 2b7c441..02be6db 100644 manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t) manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t) -@@ -759,17 +863,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) +@@ -759,17 +864,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t) files_pid_filetrans(swat_t, swat_var_run_t, file) @@ -96441,7 +96463,7 @@ index 2b7c441..02be6db 100644 kernel_read_kernel_sysctls(swat_t) kernel_read_system_state(swat_t) -@@ -777,36 +877,25 @@ kernel_read_network_state(swat_t) +@@ -777,36 +878,25 @@ kernel_read_network_state(swat_t) corecmd_search_bin(swat_t) @@ -96484,7 +96506,7 @@ index 2b7c441..02be6db 100644 auth_domtrans_chk_passwd(swat_t) auth_use_nsswitch(swat_t) -@@ -818,10 +907,11 @@ logging_send_syslog_msg(swat_t) +@@ -818,10 +908,11 @@ logging_send_syslog_msg(swat_t) logging_send_audit_msgs(swat_t) logging_search_logs(swat_t) @@ -96498,7 +96520,7 @@ index 2b7c441..02be6db 100644 optional_policy(` cups_read_rw_config(swat_t) cups_stream_connect(swat_t) -@@ -840,17 +930,20 @@ optional_policy(` +@@ -840,17 +931,20 @@ optional_policy(` # Winbind local policy # @@ -96524,7 +96546,7 @@ index 2b7c441..02be6db 100644 allow winbind_t samba_etc_t:dir list_dir_perms; read_files_pattern(winbind_t, samba_etc_t, samba_etc_t) -@@ -860,9 +953,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) +@@ -860,9 +954,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file) manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t) @@ -96535,7 +96557,7 @@ index 2b7c441..02be6db 100644 manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t) manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t) -@@ -873,38 +964,42 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba") +@@ -873,38 +965,42 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba") rw_files_pattern(winbind_t, smbd_tmp_t, smbd_tmp_t) @@ -96589,7 +96611,7 @@ index 2b7c441..02be6db 100644 corenet_tcp_connect_smbd_port(winbind_t) corenet_tcp_connect_epmap_port(winbind_t) corenet_tcp_connect_all_unreserved_ports(winbind_t) -@@ -912,38 +1007,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) +@@ -912,38 +1008,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) dev_read_sysfs(winbind_t) dev_read_urand(winbind_t) @@ -96648,7 +96670,7 @@ index 2b7c441..02be6db 100644 ') optional_policy(` -@@ -959,31 +1068,36 @@ optional_policy(` +@@ -959,31 +1069,36 @@ optional_policy(` # Winbind helper local policy # @@ -96692,7 +96714,7 @@ index 2b7c441..02be6db 100644 optional_policy(` apache_append_log(winbind_helper_t) -@@ -997,25 +1111,38 @@ optional_policy(` +@@ -997,25 +1112,38 @@ optional_policy(` ######################################## # @@ -102743,7 +102765,7 @@ index 634c6b4..f6db7a7 100644 +') + diff --git a/sosreport.te b/sosreport.te -index f2f507d..4dd29c9 100644 +index f2f507d..7db383e 100644 --- a/sosreport.te +++ b/sosreport.te @@ -13,15 +13,15 @@ type sosreport_exec_t; @@ -102883,10 +102905,14 @@ index f2f507d..4dd29c9 100644 cups_stream_connect(sosreport_t) ') -@@ -127,6 +167,16 @@ optional_policy(` +@@ -127,6 +167,20 @@ optional_policy(` ') optional_policy(` ++ iptables_domtrans(sosreport_t) ++') ++ ++optional_policy(` + lvm_read_config(sosreport_t) + lvm_dontaudit_access_check_lock(sosreport_t) +') @@ -102900,7 +102926,7 @@ index f2f507d..4dd29c9 100644 fstools_domtrans(sosreport_t) ') -@@ -136,6 +186,14 @@ optional_policy(` +@@ -136,6 +190,14 @@ optional_policy(` optional_policy(` hal_dbus_chat(sosreport_t) ') @@ -102915,7 +102941,7 @@ index f2f507d..4dd29c9 100644 ') optional_policy(` -@@ -147,13 +205,35 @@ optional_policy(` +@@ -147,13 +209,35 @@ optional_policy(` ') optional_policy(` @@ -112533,7 +112559,7 @@ index 31c752e..ef52235 100644 init_labeled_script_domtrans($1, vdagentd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/vdagent.te b/vdagent.te -index 87da8a2..4be1fcb 100644 +index 87da8a2..b80a6f4 100644 --- a/vdagent.te +++ b/vdagent.te @@ -25,6 +25,7 @@ logging_log_file(vdagent_log_t) @@ -112544,7 +112570,7 @@ index 87da8a2..4be1fcb 100644 allow vdagent_t self:fifo_file rw_fifo_file_perms; allow vdagent_t self:unix_stream_socket { accept listen }; -@@ -39,23 +40,29 @@ create_files_pattern(vdagent_t, vdagent_log_t, vdagent_log_t) +@@ -39,23 +40,30 @@ create_files_pattern(vdagent_t, vdagent_log_t, vdagent_log_t) setattr_files_pattern(vdagent_t, vdagent_log_t, vdagent_log_t) logging_log_filetrans(vdagent_t, vdagent_log_t, file) @@ -112556,6 +112582,7 @@ index 87da8a2..4be1fcb 100644 dev_dontaudit_write_mtrr(vdagent_t) -files_read_etc_files(vdagent_t) ++fs_getattr_cgroup(vdagent_t) +fs_getattr_tmpfs(vdagent_t) term_use_virtio_console(vdagent_t) diff --git a/selinux-policy.spec b/selinux-policy.spec index b937f0c3..11ef4ec1 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 244%{?dist} +Release: 245%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -682,6 +682,25 @@ exit 0 %endif %changelog +* Fri Mar 17 2017 Lukas Vrabec - 3.13.1-245 +- Allow vdagent domain to getattr cgroup filesystem +- Allow abrt_dump_oops_t stream connect to sssd_t domain +- Allow cyrus stream connect to gssproxy +- Label /usr/libexec/cockpit-ssh as cockpit_session_exec_t and allow few rules +- Allow colord_t to read systemd hwdb.bin file +- Allow dirsrv_t to create /var/lock/dirsrv labeled as dirsrc_var_lock_t +- Allow certmonger to manage /etc/krb5kdc_conf_t +- Allow kdumpctl to getenforce +- Allow ptp4l wake_alarm capability +- Allow ganesha to chat with unconfined domains via dbus +- Add nmbd_t capability2 block_suspend +- Add domain transition from sosreport_t to iptables_t +- Dontaudit init_t to mounton modules_object_t +- Add interface files_dontaudit_mounton_modules_object +- Allow xdm_t to execute files labeled as xdm_var_lib_t +- Make mtrr_device_t mountpoint. +- Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmd + * Tue Mar 07 2017 Lukas Vrabec - 3.13.1-244 - Update fwupd policy - /usr/libexec/udisks2/udisksd should be labeled as devicekit_disk_exec_t