* Wed Dec 14 2016 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-231
- Allow pptp_t to read /dev/random BZ(1404248) - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t - Allow systemd to stop glusterd_t domains. - Merge branch 'rawhide-base' of github.com:fedora-selinux/selinux-policy into rawhide-base - Label /usr/sbin/sln as ldconfig_exec_t BZ(1378323) - Revert "Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs."
This commit is contained in:
Lukas Vrabec
parent
12b9bf40f9
commit
aabe3f000e
Binary file not shown.
|
|
@ -10068,7 +10068,7 @@ index 0b1a871..29965c3 100644
|
|||
+dev_getattr_all(devices_unconfined_type)
|
||||
+
|
||||
diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if
|
||||
index 6a1e4d1..1a2713b 100644
|
||||
index 6a1e4d1..f23f6a6 100644
|
||||
--- a/policy/modules/kernel/domain.if
|
||||
+++ b/policy/modules/kernel/domain.if
|
||||
@@ -76,33 +76,8 @@ interface(`domain_type',`
|
||||
|
|
@ -10107,15 +10107,6 @@ index 6a1e4d1..1a2713b 100644
|
|||
')
|
||||
|
||||
########################################
|
||||
@@ -128,7 +103,7 @@ interface(`domain_entry_file',`
|
||||
')
|
||||
|
||||
allow $1 $2:file entrypoint;
|
||||
- allow $1 $2:file { mmap_file_perms ioctl lock };
|
||||
+ allow $1 $2:file { mmap_file_perms ioctl lock execute_no_trans };
|
||||
|
||||
typeattribute $2 entry_type;
|
||||
|
||||
@@ -513,6 +488,26 @@ interface(`domain_signull_all_domains',`
|
||||
|
||||
########################################
|
||||
|
|
@ -39984,7 +39975,7 @@ index c42fbc3..bf211db 100644
|
|||
+ files_pid_filetrans($1, iptables_var_run_t, file, "xtables.lock")
|
||||
+')
|
||||
diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te
|
||||
index be8ed1e..218750e 100644
|
||||
index be8ed1e..aa38f90 100644
|
||||
--- a/policy/modules/system/iptables.te
|
||||
+++ b/policy/modules/system/iptables.te
|
||||
@@ -16,15 +16,21 @@ role iptables_roles types iptables_t;
|
||||
|
|
@ -40120,7 +40111,16 @@ index be8ed1e..218750e 100644
|
|||
modutils_run_insmod(iptables_t, iptables_roles)
|
||||
')
|
||||
|
||||
@@ -124,6 +154,16 @@ optional_policy(`
|
||||
@@ -119,11 +149,25 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
+ plymouthd_exec_plymouth(iptables_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
ppp_dontaudit_use_fds(iptables_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
psad_rw_tmp_files(iptables_t)
|
||||
|
|
@ -40137,7 +40137,7 @@ index be8ed1e..218750e 100644
|
|||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -135,9 +175,9 @@ optional_policy(`
|
||||
@@ -135,9 +179,9 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
|
@ -40184,7 +40184,7 @@ index 0000000..c814795
|
|||
+fs_manage_kdbus_dirs(systemd_logind_t)
|
||||
+fs_manage_kdbus_files(systemd_logind_t)
|
||||
diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc
|
||||
index 73bb3c0..549c41b 100644
|
||||
index 73bb3c0..fffae71 100644
|
||||
--- a/policy/modules/system/libraries.fc
|
||||
+++ b/policy/modules/system/libraries.fc
|
||||
@@ -1,3 +1,4 @@
|
||||
|
|
@ -40222,7 +40222,12 @@ index 73bb3c0..549c41b 100644
|
|||
/opt/(.*/)?java/.+\.jar -- gen_context(system_u:object_r:lib_t,s0)
|
||||
/opt/(.*/)?jre.*/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/opt/(.*/)?jre/.+\.jar -- gen_context(system_u:object_r:lib_t,s0)
|
||||
@@ -103,6 +106,12 @@ ifdef(`distro_redhat',`
|
||||
@@ -99,10 +102,17 @@ ifdef(`distro_redhat',`
|
||||
# /sbin
|
||||
#
|
||||
/sbin/ldconfig -- gen_context(system_u:object_r:ldconfig_exec_t,s0)
|
||||
+/sbin/sln -- gen_context(system_u:object_r:ldconfig_exec_t,s0)
|
||||
|
||||
#
|
||||
# /usr
|
||||
#
|
||||
|
|
@ -40235,7 +40240,7 @@ index 73bb3c0..549c41b 100644
|
|||
/usr/(.*/)?/HelixPlayer/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/(.*/)?/RealPlayer/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
||||
@@ -111,12 +120,12 @@ ifdef(`distro_redhat',`
|
||||
@@ -111,12 +121,12 @@ ifdef(`distro_redhat',`
|
||||
/usr/(.*/)?java/.+\.jsa -- gen_context(system_u:object_r:lib_t,s0)
|
||||
|
||||
/usr/(.*/)?lib(/.*)? gen_context(system_u:object_r:lib_t,s0)
|
||||
|
|
@ -40250,7 +40255,7 @@ index 73bb3c0..549c41b 100644
|
|||
/usr/lib/altivec/libavcodec\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/cedega/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/dovecot/(.*/)?lib.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
|
||||
@@ -125,10 +134,12 @@ ifdef(`distro_redhat',`
|
||||
@@ -125,10 +135,12 @@ ifdef(`distro_redhat',`
|
||||
/usr/lib/vlc/codec/libdmo_plugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/vlc/codec/librealaudio_plugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/libtfmessbsp\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
|
@ -40263,7 +40268,7 @@ index 73bb3c0..549c41b 100644
|
|||
/usr/lib/libADM5.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/libatiadlxx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/win32/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@@ -141,19 +152,23 @@ ifdef(`distro_redhat',`
|
||||
@@ -141,19 +153,23 @@ ifdef(`distro_redhat',`
|
||||
/usr/lib/ati-fglrx/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/fglrx/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/libjs\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
|
@ -40292,7 +40297,7 @@ index 73bb3c0..549c41b 100644
|
|||
/usr/NX/lib/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/NX/lib/libjpeg\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
||||
@@ -182,11 +197,13 @@ ifdef(`distro_redhat',`
|
||||
@@ -182,11 +198,13 @@ ifdef(`distro_redhat',`
|
||||
# Fedora Core packages: gstreamer-plugins, compat-libstdc++, Glide3, libdv
|
||||
# HelixPlayer, SDL, xorg-x11, xorg-x11-libs, Hermes, valgrind, openoffice.org-libs, httpd - php
|
||||
HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
|
@ -40306,7 +40311,7 @@ index 73bb3c0..549c41b 100644
|
|||
/usr/lib/libfglrx_gamma\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/mozilla/plugins/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/mozilla/plugins/libvlcplugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@@ -241,13 +258,11 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_
|
||||
@@ -241,13 +259,11 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_
|
||||
|
||||
# Livna.org packages: xmms-mp3, ffmpeg, xvidcore, xine-lib, gsm, lame
|
||||
/usr/lib.*/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
|
@ -40322,7 +40327,7 @@ index 73bb3c0..549c41b 100644
|
|||
|
||||
# Jai, Sun Microsystems (Jpackage SPRM)
|
||||
/usr/lib/libmlib_jai\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@@ -269,20 +284,19 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te
|
||||
@@ -269,20 +285,19 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te
|
||||
|
||||
# Java, Sun Microsystems (JPackage SRPM)
|
||||
/usr/(.*/)?jre.*/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
|
@ -40353,7 +40358,7 @@ index 73bb3c0..549c41b 100644
|
|||
|
||||
/usr/(.*/)?intellinux/SPPlugins/ADMPlugin\.apl -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
||||
@@ -299,17 +313,156 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te
|
||||
@@ -299,17 +314,156 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te
|
||||
#
|
||||
/var/cache/ldconfig(/.*)? gen_context(system_u:object_r:ldconfig_cache_t,s0)
|
||||
|
||||
|
|
|
|||
|
|
@ -20522,7 +20522,7 @@ index b25b01d..06895f3 100644
|
|||
')
|
||||
+
|
||||
diff --git a/ctdb.te b/ctdb.te
|
||||
index 001b502..47199aa 100644
|
||||
index 001b502..9892b34 100644
|
||||
--- a/ctdb.te
|
||||
+++ b/ctdb.te
|
||||
@@ -24,6 +24,9 @@ files_tmp_file(ctdbd_tmp_t)
|
||||
|
|
@ -20576,7 +20576,7 @@ index 001b502..47199aa 100644
|
|||
kernel_read_network_state(ctdbd_t)
|
||||
kernel_read_system_state(ctdbd_t)
|
||||
kernel_rw_net_sysctls(ctdbd_t)
|
||||
@@ -72,9 +89,13 @@ corenet_all_recvfrom_netlabel(ctdbd_t)
|
||||
@@ -72,10 +89,16 @@ corenet_all_recvfrom_netlabel(ctdbd_t)
|
||||
corenet_tcp_sendrecv_generic_if(ctdbd_t)
|
||||
corenet_tcp_sendrecv_generic_node(ctdbd_t)
|
||||
corenet_tcp_bind_generic_node(ctdbd_t)
|
||||
|
|
@ -20588,9 +20588,12 @@ index 001b502..47199aa 100644
|
|||
+corenet_tcp_bind_smbd_port(ctdbd_t)
|
||||
+corenet_tcp_connect_ctdb_port(ctdbd_t)
|
||||
corenet_tcp_sendrecv_ctdb_port(ctdbd_t)
|
||||
+corenet_tcp_connect_gluster_port(ctdbd_t)
|
||||
+corenet_tcp_connect_nfs_port(ctdbd_t)
|
||||
|
||||
corecmd_exec_bin(ctdbd_t)
|
||||
@@ -85,14 +106,18 @@ dev_read_urand(ctdbd_t)
|
||||
corecmd_exec_shell(ctdbd_t)
|
||||
@@ -85,14 +108,18 @@ dev_read_urand(ctdbd_t)
|
||||
|
||||
domain_dontaudit_read_all_domains_state(ctdbd_t)
|
||||
|
||||
|
|
@ -20611,10 +20614,14 @@ index 001b502..47199aa 100644
|
|||
optional_policy(`
|
||||
consoletype_exec(ctdbd_t)
|
||||
')
|
||||
@@ -106,9 +131,16 @@ optional_policy(`
|
||||
@@ -106,9 +133,20 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
+ rpc_read_nfs_state_data(ctdbd_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ samba_signull_smbd(ctdbd_t)
|
||||
samba_initrc_domtrans(ctdbd_t)
|
||||
samba_domtrans_net(ctdbd_t)
|
||||
|
|
@ -32116,10 +32123,10 @@ index 5cd0909..bd3c3d2 100644
|
|||
+corenet_tcp_connect_glance_registry_port(glance_scrubber_t)
|
||||
diff --git a/glusterd.fc b/glusterd.fc
|
||||
new file mode 100644
|
||||
index 0000000..52b4110
|
||||
index 0000000..a3633cd
|
||||
--- /dev/null
|
||||
+++ b/glusterd.fc
|
||||
@@ -0,0 +1,22 @@
|
||||
@@ -0,0 +1,29 @@
|
||||
+/etc/rc\.d/init\.d/gluster.* -- gen_context(system_u:object_r:glusterd_initrc_exec_t,s0)
|
||||
+
|
||||
+/etc/glusterfs(/.*)? gen_context(system_u:object_r:glusterd_conf_t,s0)
|
||||
|
|
@ -32128,6 +32135,13 @@ index 0000000..52b4110
|
|||
+/usr/sbin/glusterd -- gen_context(system_u:object_r:glusterd_initrc_exec_t,s0)
|
||||
+/usr/sbin/glusterfsd -- gen_context(system_u:object_r:glusterd_exec_t,s0)
|
||||
+
|
||||
+/usr/sbin/glustereventsd -- gen_context(system_u:object_r:glusterd_exec_t,s0)
|
||||
+/usr/sbin/gluster-eventsapi -- gen_context(system_u:object_r:glusterd_exec_t,s0)
|
||||
+
|
||||
+
|
||||
+/usr/libexec/glusterfs/peer_eventsapi.py -- gen_context(system_u:object_r:glusterd_exec_t,s0)
|
||||
+/usr/libexec/glusterfs/events/glustereventsd.py -- gen_context(system_u:object_r:glusterd_exec_t,s0)
|
||||
+
|
||||
+/usr/bin/ganesha.nfsd -- gen_context(system_u:object_r:glusterd_exec_t,s0)
|
||||
+
|
||||
+/opt/glusterfs/[^/]+/sbin/glusterfsd -- gen_context(system_u:object_r:glusterd_exec_t,s0)
|
||||
|
|
@ -32411,10 +32425,10 @@ index 0000000..764ae00
|
|||
+
|
||||
diff --git a/glusterd.te b/glusterd.te
|
||||
new file mode 100644
|
||||
index 0000000..0a33da3
|
||||
index 0000000..40c6ade
|
||||
--- /dev/null
|
||||
+++ b/glusterd.te
|
||||
@@ -0,0 +1,305 @@
|
||||
@@ -0,0 +1,307 @@
|
||||
+policy_module(glusterd, 1.1.3)
|
||||
+
|
||||
+## <desc>
|
||||
|
|
@ -32604,6 +32618,7 @@ index 0000000..0a33da3
|
|||
+init_rw_script_tmp_files(glusterd_t)
|
||||
+init_manage_script_status_files(glusterd_t)
|
||||
+init_status(glusterd_t)
|
||||
+init_stop_transient_unit(glusterd_t)
|
||||
+
|
||||
+systemd_config_systemd_services(glusterd_t)
|
||||
+systemd_signal_passwd_agent(glusterd_t)
|
||||
|
|
@ -32622,6 +32637,7 @@ index 0000000..0a33da3
|
|||
+userdom_delete_user_tmp_files(glusterd_t)
|
||||
+userdom_rw_user_tmp_files(glusterd_t)
|
||||
+userdom_kill_all_users(glusterd_t)
|
||||
+userdom_signal_unpriv_users(glusterd_t)
|
||||
+
|
||||
+mount_domtrans(glusterd_t)
|
||||
+
|
||||
|
|
@ -76636,7 +76652,7 @@ index cd8b8b9..2cfa88a 100644
|
|||
+ allow $1 pppd_unit_file_t:service all_service_perms;
|
||||
')
|
||||
diff --git a/ppp.te b/ppp.te
|
||||
index d616ca3..b03d137 100644
|
||||
index d616ca3..76f9b25 100644
|
||||
--- a/ppp.te
|
||||
+++ b/ppp.te
|
||||
@@ -6,41 +6,47 @@ policy_module(ppp, 1.14.0)
|
||||
|
|
@ -76911,7 +76927,7 @@ index d616ca3..b03d137 100644
|
|||
|
||||
allow pptp_t pppd_etc_t:dir list_dir_perms;
|
||||
allow pptp_t pppd_etc_t:file read_file_perms;
|
||||
@@ -236,45 +266,45 @@ allow pptp_t pppd_etc_t:lnk_file read_lnk_file_perms;
|
||||
@@ -236,45 +266,46 @@ allow pptp_t pppd_etc_t:lnk_file read_lnk_file_perms;
|
||||
allow pptp_t pppd_etc_rw_t:dir list_dir_perms;
|
||||
allow pptp_t pppd_etc_rw_t:file read_file_perms;
|
||||
allow pptp_t pppd_etc_rw_t:lnk_file read_lnk_file_perms;
|
||||
|
|
@ -76942,6 +76958,7 @@ index d616ca3..b03d137 100644
|
|||
+dev_read_sysfs(pptp_t)
|
||||
+dev_read_rand(pptp_t)
|
||||
+dev_read_urand(pptp_t)
|
||||
+dev_read_rand(pptp_t)
|
||||
+
|
||||
corecmd_exec_shell(pptp_t)
|
||||
corecmd_read_bin_symlinks(pptp_t)
|
||||
|
|
@ -76970,7 +76987,7 @@ index d616ca3..b03d137 100644
|
|||
fs_getattr_all_fs(pptp_t)
|
||||
fs_search_auto_mountpoints(pptp_t)
|
||||
|
||||
@@ -282,12 +312,12 @@ term_ioctl_generic_ptys(pptp_t)
|
||||
@@ -282,12 +313,12 @@ term_ioctl_generic_ptys(pptp_t)
|
||||
term_search_ptys(pptp_t)
|
||||
term_use_ptmx(pptp_t)
|
||||
|
||||
|
|
@ -76985,7 +77002,7 @@ index d616ca3..b03d137 100644
|
|||
sysnet_exec_ifconfig(pptp_t)
|
||||
|
||||
userdom_dontaudit_use_unpriv_user_fds(pptp_t)
|
||||
@@ -299,6 +329,10 @@ optional_policy(`
|
||||
@@ -299,6 +330,10 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@
|
|||
Summary: SELinux policy configuration
|
||||
Name: selinux-policy
|
||||
Version: 3.13.1
|
||||
Release: 230%{?dist}
|
||||
Release: 231%{?dist}
|
||||
License: GPLv2+
|
||||
Group: System Environment/Base
|
||||
Source: serefpolicy-%{version}.tgz
|
||||
|
|
@ -675,6 +675,14 @@ exit 0
|
|||
%endif
|
||||
|
||||
%changelog
|
||||
* Wed Dec 14 2016 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-231
|
||||
- Allow pptp_t to read /dev/random BZ(1404248)
|
||||
- Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
|
||||
- Allow systemd to stop glusterd_t domains.
|
||||
- Merge branch 'rawhide-base' of github.com:fedora-selinux/selinux-policy into rawhide-base
|
||||
- Label /usr/sbin/sln as ldconfig_exec_t BZ(1378323)
|
||||
- Revert "Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs."
|
||||
|
||||
* Thu Dec 08 2016 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-230
|
||||
- Label /usr/bin/rpcbind as rpcbind_exec_t
|
||||
- Dontaudit mozilla plugin rawip socket creation. BZ(1275961)
|
||||
|
|
|
|||
Loading…
Reference in New Issue