rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Tue Feb 21 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-241 

- Remove ganesha from gluster module and create own module for ganesha
- FIx label for /usr/lib/libGLdispatch.so.0.0.0
This commit is contained in:
Lukas Vrabec 2017-02-21 14:04:18 +01:00
parent 9d87d07100
commit acb049dbc4
4 changed files with 369 additions and 104 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
container-selinux.tgz
View File

Binary file not shown.

178
policy-rawhide-base.patch
View File

@ -1,3 +1,13 @@
diff --git a/.gitmodules b/.gitmodules
index 360bd03..e794aa3 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,4 @@
[submodule "policy/modules/contrib"]
path = policy/modules/contrib
- url = http://oss.tresys.com/git/refpolicy-contrib.git
+ url = https://github.com/fedora-selinux/selinux-policy-contrib
+ branch = rawhide
diff --git a/Makefile b/Makefile diff --git a/Makefile b/Makefile
index ec7b5cb..e2936c6 100644 index ec7b5cb..e2936c6 100644
--- a/Makefile --- a/Makefile
@ -19165,7 +19175,7 @@ index 7be4ddf..9710b33 100644
+/sys/kernel/debug -d gen_context(system_u:object_r:debugfs_t,s0) +/sys/kernel/debug -d gen_context(system_u:object_r:debugfs_t,s0)
+/sys/kernel/debug/.* <<none>> +/sys/kernel/debug/.* <<none>>
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index e100d88..342fb1e 100644 index e100d88..d780b64 100644
--- a/policy/modules/kernel/kernel.if --- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if +++ b/policy/modules/kernel/kernel.if
@@ -126,6 +126,24 @@ interface(`kernel_setsched',` @@ -126,6 +126,24 @@ interface(`kernel_setsched',`
@ -19561,7 +19571,34 @@ index e100d88..342fb1e 100644
') ')
######################################## ########################################
@@ -2085,7 +2241,54 @@ interface(`kernel_dontaudit_list_all_sysctls',` @@ -2048,6 +2204,26 @@ interface(`kernel_read_rpc_sysctls',`
list_dirs_pattern($1, { proc_t proc_net_t }, sysctl_rpc_t)
')
+
+########################################
+## <summary>
+## Read RPC sysctls.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`kernel_rw_rpc_sysctls_dirs',`
+ gen_require(`
+ type proc_t, proc_net_t, sysctl_rpc_t;
+ ')
+
+ rw_dirs_pattern($1, { proc_t proc_net_t }, sysctl_rpc_t)
+')
+
########################################
## <summary>
## Read and write RPC sysctls.
@@ -2085,7 +2261,54 @@ interface(`kernel_dontaudit_list_all_sysctls',`
') ')
dontaudit $1 sysctl_type:dir list_dir_perms; dontaudit $1 sysctl_type:dir list_dir_perms;
@ -19617,7 +19654,7 @@ index e100d88..342fb1e 100644
') ')
######################################## ########################################
@@ -2282,6 +2485,25 @@ interface(`kernel_list_unlabeled',` @@ -2282,6 +2505,25 @@ interface(`kernel_list_unlabeled',`
######################################## ########################################
## <summary> ## <summary>
@ -19643,7 +19680,7 @@ index e100d88..342fb1e 100644
## Read the process state (/proc/pid) of all unlabeled_t. ## Read the process state (/proc/pid) of all unlabeled_t.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -2306,7 +2528,7 @@ interface(`kernel_read_unlabeled_state',` @@ -2306,7 +2548,7 @@ interface(`kernel_read_unlabeled_state',`
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@ -19652,80 +19689,56 @@ index e100d88..342fb1e 100644
## </summary> ## </summary>
## </param> ## </param>
# #
@@ -2488,6 +2710,24 @@ interface(`kernel_rw_unlabeled_blk_files',` @@ -2488,21 +2730,39 @@ interface(`kernel_rw_unlabeled_blk_files',`
######################################## ########################################
## <summary> ## <summary>
-## Do not audit attempts by caller to get attributes for
-## unlabeled character devices.
+## Read and write unlabeled sockets. +## Read and write unlabeled sockets.
+## </summary> ## </summary>
+## <param name="domain"> ## <param name="domain">
+## <summary> ## <summary>
-## Domain to not audit.
+## Domain allowed access. +## Domain allowed access.
+## </summary> ## </summary>
+## </param> ## </param>
+# #
-interface(`kernel_dontaudit_getattr_unlabeled_chr_files',`
+interface(`kernel_rw_unlabeled_socket',` +interface(`kernel_rw_unlabeled_socket',`
+ gen_require(` gen_require(`
+ type unlabeled_t; type unlabeled_t;
+ ') ')
+
- dontaudit $1 unlabeled_t:chr_file getattr;
+ allow $1 unlabeled_t:socket rw_socket_perms; + allow $1 unlabeled_t:socket rw_socket_perms;
+') +')
+ +
+######################################## +########################################
+## <summary> +## <summary>
## Do not audit attempts by caller to get attributes for +## Do not audit attempts by caller to get attributes for
## unlabeled character devices. +## unlabeled character devices.
## </summary> +## </summary>
@@ -2525,7 +2765,7 @@ interface(`kernel_relabelfrom_unlabeled_dirs',` +## <param name="domain">
+## <summary>
######################################## +## Domain to not audit.
## <summary> +## </summary>
-## Allow caller to relabel unlabeled files. +## </param>
+## Allow caller to relabel unlabeled filesystems. +#
## </summary> +interface(`kernel_dontaudit_getattr_unlabeled_chr_files',`
## <param name="domain"> + gen_require(`
## <summary> + type unlabeled_t;
@@ -2533,18 +2773,17 @@ interface(`kernel_relabelfrom_unlabeled_dirs',` + ')
## </summary> +
## </param> + dontaudit $1 unlabeled_t:chr_file getattr;
#
-interface(`kernel_relabelfrom_unlabeled_files',`
+interface(`kernel_relabelfrom_unlabeled_fs',`
gen_require(`
type unlabeled_t;
')
- kernel_list_unlabeled($1)
- allow $1 unlabeled_t:file { getattr relabelfrom };
+ allow $1 unlabeled_t:filesystem relabelfrom;
') ')
######################################## ########################################
## <summary> @@ -2525,6 +2785,24 @@ interface(`kernel_relabelfrom_unlabeled_dirs',`
-## Allow caller to relabel unlabeled symbolic links.
+## Allow caller to relabel unlabeled files.
## </summary>
## <param name="domain">
## <summary>
@@ -2552,13 +2791,32 @@ interface(`kernel_relabelfrom_unlabeled_files',`
## </summary>
## </param>
#
-interface(`kernel_relabelfrom_unlabeled_symlinks',`
+interface(`kernel_relabelfrom_unlabeled_files',`
gen_require(`
type unlabeled_t;
')
kernel_list_unlabeled($1) ########################################
- allow $1 unlabeled_t:lnk_file { getattr relabelfrom }; ## <summary>
+ allow $1 unlabeled_t:file { getattr relabelfrom }; +## Allow caller to relabel unlabeled filesystems.
+')
+
+########################################
+## <summary>
+## Allow caller to relabel unlabeled symbolic links.
+## </summary> +## </summary>
+## <param name="domain"> +## <param name="domain">
+## <summary> +## <summary>
@ -19733,17 +19746,20 @@ index e100d88..342fb1e 100644
+## </summary> +## </summary>
+## </param> +## </param>
+# +#
+interface(`kernel_relabelfrom_unlabeled_symlinks',` +interface(`kernel_relabelfrom_unlabeled_fs',`
+ gen_require(` + gen_require(`
+ type unlabeled_t; + type unlabeled_t;
+ ') + ')
+ +
+ kernel_list_unlabeled($1) + allow $1 unlabeled_t:filesystem relabelfrom;
+ allow $1 unlabeled_t:lnk_file { getattr relabelfrom }; +')
') +
+########################################
######################################## +## <summary>
@@ -2667,6 +2925,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',` ## Allow caller to relabel unlabeled files.
## </summary>
## <param name="domain">
@@ -2667,6 +2945,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
######################################## ########################################
## <summary> ## <summary>
@ -19768,7 +19784,7 @@ index e100d88..342fb1e 100644
## Receive TCP packets from an unlabeled connection. ## Receive TCP packets from an unlabeled connection.
## </summary> ## </summary>
## <desc> ## <desc>
@@ -2694,6 +2970,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',` @@ -2694,6 +2990,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',`
######################################## ########################################
## <summary> ## <summary>
@ -19794,7 +19810,7 @@ index e100d88..342fb1e 100644
## Do not audit attempts to receive TCP packets from an unlabeled ## Do not audit attempts to receive TCP packets from an unlabeled
## connection. ## connection.
## </summary> ## </summary>
@@ -2803,6 +3098,33 @@ interface(`kernel_raw_recvfrom_unlabeled',` @@ -2803,6 +3118,33 @@ interface(`kernel_raw_recvfrom_unlabeled',`
allow $1 unlabeled_t:rawip_socket recvfrom; allow $1 unlabeled_t:rawip_socket recvfrom;
') ')
@ -19828,7 +19844,7 @@ index e100d88..342fb1e 100644
######################################## ########################################
## <summary> ## <summary>
@@ -2958,6 +3280,24 @@ interface(`kernel_relabelfrom_unlabeled_database',` @@ -2958,6 +3300,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
######################################## ########################################
## <summary> ## <summary>
@ -19853,7 +19869,7 @@ index e100d88..342fb1e 100644
## Unconfined access to kernel module resources. ## Unconfined access to kernel module resources.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -2972,5 +3312,649 @@ interface(`kernel_unconfined',` @@ -2972,5 +3332,649 @@ interface(`kernel_unconfined',`
') ')
typeattribute $1 kern_unconfined; typeattribute $1 kern_unconfined;
@ -37802,7 +37818,7 @@ index 0000000..c814795
+fs_manage_kdbus_dirs(systemd_logind_t) +fs_manage_kdbus_dirs(systemd_logind_t)
+fs_manage_kdbus_files(systemd_logind_t) +fs_manage_kdbus_files(systemd_logind_t)
diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc
index 73bb3c0..7b05663 100644 index 73bb3c0..5d62107 100644
--- a/policy/modules/system/libraries.fc --- a/policy/modules/system/libraries.fc
+++ b/policy/modules/system/libraries.fc +++ b/policy/modules/system/libraries.fc
@@ -1,3 +1,4 @@ @@ -1,3 +1,4 @@
@ -37886,7 +37902,7 @@ index 73bb3c0..7b05663 100644
/usr/lib/libADM5.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/libADM5.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/libatiadlxx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/libatiadlxx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/win32/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/win32/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib/libGLdispatch/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib/libGLdispatch.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/ADM_plugins/videoFilter/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/ADM_plugins/videoFilter/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@ -43211,7 +43227,7 @@ index 3822072..d358162 100644
+ allow semanage_t $1:dbus send_msg; + allow semanage_t $1:dbus send_msg;
+') +')
diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
index dc46420..8d4ed0f 100644 index dc46420..a86e9eb 100644
--- a/policy/modules/system/selinuxutil.te --- a/policy/modules/system/selinuxutil.te
+++ b/policy/modules/system/selinuxutil.te +++ b/policy/modules/system/selinuxutil.te
@@ -11,14 +11,16 @@ gen_require(` @@ -11,14 +11,16 @@ gen_require(`
@ -43746,7 +43762,7 @@ index dc46420..8d4ed0f 100644
') ')
######################################## ########################################
@@ -522,111 +597,201 @@ ifdef(`distro_ubuntu',` @@ -522,111 +597,202 @@ ifdef(`distro_ubuntu',`
# Setfiles local policy # Setfiles local policy
# #
@ -43911,6 +43927,7 @@ index dc46420..8d4ed0f 100644
+fs_getattr_all_files(setfiles_domain) +fs_getattr_all_files(setfiles_domain)
+fs_search_auto_mountpoints(setfiles_domain) +fs_search_auto_mountpoints(setfiles_domain)
+fs_relabelfrom_noxattr_fs(setfiles_domain) +fs_relabelfrom_noxattr_fs(setfiles_domain)
+fs_mount_tracefs(setfiles_domain)
+ +
+selinux_validate_context(setfiles_domain) +selinux_validate_context(setfiles_domain)
+selinux_compute_access_vector(setfiles_domain) +selinux_compute_access_vector(setfiles_domain)
@ -47071,10 +47088,10 @@ index 0000000..86e3d01
+') +')
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644 new file mode 100644
index 0000000..c6280dc index 0000000..0100a56
--- /dev/null --- /dev/null
+++ b/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te
@@ -0,0 +1,1017 @@ @@ -0,0 +1,1018 @@
+policy_module(systemd, 1.0.0) +policy_module(systemd, 1.0.0)
+ +
+####################################### +#######################################
@ -48072,6 +48089,7 @@ index 0000000..c6280dc
+# +#
+ +
+allow systemd_bootchart_t self:capability2 wake_alarm; +allow systemd_bootchart_t self:capability2 wake_alarm;
+allow systemd_bootchart_t self:unix_dgram_socket create_socket_perms;
+ +
+kernel_dgram_send(systemd_bootchart_t) +kernel_dgram_send(systemd_bootchart_t)
+kernel_rw_kernel_sysctl(systemd_bootchart_t) +kernel_rw_kernel_sysctl(systemd_bootchart_t)

289
policy-rawhide-contrib.patch
View File

@ -12878,7 +12878,7 @@ index 85ca63f..1d1c99c 100644
admin_pattern($1, { cgconfig_etc_t cgrules_etc_t }) admin_pattern($1, { cgconfig_etc_t cgrules_etc_t })
files_list_etc($1) files_list_etc($1)
diff --git a/cgroup.te b/cgroup.te diff --git a/cgroup.te b/cgroup.te
index 80a88a2..ec869f5 100644 index 80a88a2..71c25c3 100644
--- a/cgroup.te --- a/cgroup.te
+++ b/cgroup.te +++ b/cgroup.te
@@ -25,8 +25,8 @@ files_pid_file(cgred_var_run_t) @@ -25,8 +25,8 @@ files_pid_file(cgred_var_run_t)
@ -12906,7 +12906,7 @@ index 80a88a2..ec869f5 100644
domain_setpriority_all_domains(cgclear_t) domain_setpriority_all_domains(cgclear_t)
fs_manage_cgroup_dirs(cgclear_t) fs_manage_cgroup_dirs(cgclear_t)
@@ -64,23 +66,25 @@ allow cgconfig_t cgconfig_etc_t:file read_file_perms; @@ -64,23 +66,26 @@ allow cgconfig_t cgconfig_etc_t:file read_file_perms;
kernel_list_unlabeled(cgconfig_t) kernel_list_unlabeled(cgconfig_t)
kernel_read_system_state(cgconfig_t) kernel_read_system_state(cgconfig_t)
@ -12930,12 +12930,13 @@ index 80a88a2..ec869f5 100644
-allow cgred_t self:capability { chown fsetid net_admin sys_admin sys_ptrace dac_override }; -allow cgred_t self:capability { chown fsetid net_admin sys_admin sys_ptrace dac_override };
allow cgred_t self:netlink_socket { write bind create read }; allow cgred_t self:netlink_socket { write bind create read };
allow cgred_t self:unix_dgram_socket { write create connect }; allow cgred_t self:unix_dgram_socket { write create connect };
+allow cgred_t self:netlink_connector_socket create_socket_perms;
+allow cgred_t cgconfig_etc_t:file read_file_perms; +allow cgred_t cgconfig_etc_t:file read_file_perms;
allow cgred_t cgrules_etc_t:file read_file_perms; allow cgred_t cgrules_etc_t:file read_file_perms;
allow cgred_t cgred_log_t:file { append_file_perms create_file_perms setattr_file_perms }; allow cgred_t cgred_log_t:file { append_file_perms create_file_perms setattr_file_perms };
@@ -99,10 +103,11 @@ domain_setpriority_all_domains(cgred_t) @@ -99,10 +104,11 @@ domain_setpriority_all_domains(cgred_t)
files_getattr_all_files(cgred_t) files_getattr_all_files(cgred_t)
files_getattr_all_sockets(cgred_t) files_getattr_all_sockets(cgred_t)
files_read_all_symlinks(cgred_t) files_read_all_symlinks(cgred_t)
@ -14855,10 +14856,10 @@ index cc4e7cb..f348d27 100644
domain_system_change_exemption($1) domain_system_change_exemption($1)
role_transition $2 cmirrord_initrc_exec_t system_r; role_transition $2 cmirrord_initrc_exec_t system_r;
diff --git a/cmirrord.te b/cmirrord.te diff --git a/cmirrord.te b/cmirrord.te
index bbdd396..8328b95 100644 index bbdd396..28b1761 100644
--- a/cmirrord.te --- a/cmirrord.te
+++ b/cmirrord.te +++ b/cmirrord.te
@@ -23,7 +23,7 @@ files_pid_file(cmirrord_var_run_t) @@ -23,13 +23,14 @@ files_pid_file(cmirrord_var_run_t)
# Local policy # Local policy
# #
@ -14867,7 +14868,14 @@ index bbdd396..8328b95 100644
dontaudit cmirrord_t self:capability sys_tty_config; dontaudit cmirrord_t self:capability sys_tty_config;
allow cmirrord_t self:process { setfscreate signal }; allow cmirrord_t self:process { setfscreate signal };
allow cmirrord_t self:fifo_file rw_fifo_file_perms; allow cmirrord_t self:fifo_file rw_fifo_file_perms;
@@ -42,16 +42,18 @@ files_pid_filetrans(cmirrord_t, cmirrord_var_run_t, file) allow cmirrord_t self:sem create_sem_perms;
allow cmirrord_t self:shm create_shm_perms;
allow cmirrord_t self:netlink_socket create_socket_perms;
+allow cmirrord_t self:netlink_connector_socket create_socket_perms;
allow cmirrord_t self:unix_stream_socket { accept listen };
manage_dirs_pattern(cmirrord_t, cmirrord_tmpfs_t, cmirrord_tmpfs_t)
@@ -42,16 +43,18 @@ files_pid_filetrans(cmirrord_t, cmirrord_var_run_t, file)
domain_use_interactive_fds(cmirrord_t) domain_use_interactive_fds(cmirrord_t)
domain_obj_id_change_exemption(cmirrord_t) domain_obj_id_change_exemption(cmirrord_t)
@ -30858,6 +30866,243 @@ index e5b15fb..220622e 100644
allow games_t self:process execmem; allow games_t self:process execmem;
') ')
diff --git a/ganesha.fc b/ganesha.fc
new file mode 100644
index 0000000..c5982d5
--- /dev/null
+++ b/ganesha.fc
@@ -0,0 +1,11 @@
+/usr/bin/ganesha.nfsd -- gen_context(system_u:object_r:ganesha_exec_t,s0)
+
+/usr/lib/systemd/system/nfs-ganesha-config.* -- gen_context(system_u:object_r:ganesha_unit_file_t,s0)
+
+/usr/lib/systemd/system/nfs-ganesha-lock.* -- gen_context(system_u:object_r:ganesha_unit_file_t,s0)
+
+/usr/lib/systemd/system/nfs-ganesha.*e -- gen_context(system_u:object_r:ganesha_unit_file_t,s0)
+
+/var/log/ganesha.log -- gen_context(system_u:object_r:ganesha_var_log_t,s0)
+
+/var/run/ganesha(/.*)? gen_context(system_u:object_r:ganesha_var_run_t,s0)
diff --git a/ganesha.if b/ganesha.if
new file mode 100644
index 0000000..d9ba5fa
--- /dev/null
+++ b/ganesha.if
@@ -0,0 +1,147 @@
+
+## <summary>policy for ganesha</summary>
+
+########################################
+## <summary>
+## Execute ganesha_exec_t in the ganesha domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ganesha_domtrans',`
+ gen_require(`
+ type ganesha_t, ganesha_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ domtrans_pattern($1, ganesha_exec_t, ganesha_t)
+')
+
+######################################
+## <summary>
+## Execute ganesha in the caller domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ganesha_exec',`
+ gen_require(`
+ type ganesha_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ can_exec($1, ganesha_exec_t)
+')
+########################################
+## <summary>
+## Read ganesha PID files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ganesha_read_pid_files',`
+ gen_require(`
+ type ganesha_var_run_t;
+ ')
+
+ files_search_pids($1)
+ read_files_pattern($1, ganesha_var_run_t, ganesha_var_run_t)
+')
+
+########################################
+## <summary>
+## Execute ganesha server in the ganesha domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ganesha_systemctl',`
+ gen_require(`
+ type ganesha_t;
+ type ganesha_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ systemd_read_fifo_file_passwd_run($1)
+ allow $1 ganesha_unit_file_t:file read_file_perms;
+ allow $1 ganesha_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, ganesha_t)
+')
+
+
+########################################
+## <summary>
+## Send and receive messages from
+## ganesha over dbus.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ganesha_dbus_chat',`
+ gen_require(`
+ type ganesha_t;
+ class dbus send_msg;
+ ')
+
+ allow $1 ganesha_t:dbus send_msg;
+ allow ganesha_t $1:dbus send_msg;
+')
+
+########################################
+## <summary>
+## All of the rules required to administrate
+## an ganesha environment
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## Role allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`ganesha_admin',`
+ gen_require(`
+ type ganesha_t;
+ type ganesha_var_run_t;
+ type ganesha_unit_file_t;
+ ')
+
+ allow $1 ganesha_t:process { signal_perms };
+ ps_process_pattern($1, ganesha_t)
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 ganesha_t:process ptrace;
+ ')
+
+ files_search_pids($1)
+ admin_pattern($1, ganesha_var_run_t)
+
+ ganesha_systemctl($1)
+ admin_pattern($1, ganesha_unit_file_t)
+ allow $1 ganesha_unit_file_t:service all_service_perms;
+ optional_policy(`
+ systemd_passwd_agent_exec($1)
+ systemd_read_fifo_file_passwd_run($1)
+ ')
+')
diff --git a/ganesha.te b/ganesha.te
new file mode 100644
index 0000000..20b9fcf
--- /dev/null
+++ b/ganesha.te
@@ -0,0 +1,61 @@
+policy_module(ganesha, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type ganesha_t;
+type ganesha_exec_t;
+init_daemon_domain(ganesha_t, ganesha_exec_t)
+
+permissive ganesha_t;
+
+type ganesha_var_log_t;
+logging_log_file(ganesha_var_log_t)
+
+type ganesha_var_run_t;
+files_pid_file(ganesha_var_run_t)
+
+type ganesha_unit_file_t;
+systemd_unit_file(ganesha_unit_file_t)
+
+########################################
+#
+# ganesha local policy
+#
+allow ganesha_t self:process { setcap setrlimit };
+allow ganesha_t self:fifo_file rw_fifo_file_perms;
+allow ganesha_t self:unix_stream_socket create_stream_socket_perms;
+allow ganesha_t self:tcp_socket { accept listen };
+
+manage_dirs_pattern(ganesha_t, ganesha_var_run_t, ganesha_var_run_t)
+manage_files_pattern(ganesha_t, ganesha_var_run_t, ganesha_var_run_t)
+manage_lnk_files_pattern(ganesha_t, ganesha_var_run_t, ganesha_var_run_t)
+files_pid_filetrans(ganesha_t, ganesha_var_run_t, { dir file lnk_file })
+
+manage_dirs_pattern(ganesha_t, ganesha_var_log_t, ganesha_var_log_t)
+manage_files_pattern(ganesha_t, ganesha_var_log_t, ganesha_var_log_t)
+logging_log_filetrans(ganesha_t, ganesha_var_log_t, { file dir })
+
+auth_use_nsswitch(ganesha_t)
+
+corenet_tcp_bind_nfs_port(ganesha_t)
+corenet_tcp_connect_generic_port(ganesha_t)
+corenet_udp_bind_nfs_port(ganesha_t)
+corenet_udp_bind_all_rpc_ports(ganesha_t)
+corenet_tcp_bind_all_rpc_ports(ganesha_t)
+
+logging_send_syslog_msg(ganesha_t)
+
+sysnet_dns_name_resolve(ganesha_t)
+
+optional_policy(`
+ dbus_system_bus_client(ganesha_t)
+ dbus_connect_system_bus(ganesha_t)
+')
+
+optional_policy(`
+ rpc_manage_nfs_state_data_dir(ganesha_t)
+ rpcbind_stream_connect(ganesha_t)
+')
diff --git a/gatekeeper.te b/gatekeeper.te diff --git a/gatekeeper.te b/gatekeeper.te
index 2820368..88c98f4 100644 index 2820368..88c98f4 100644
--- a/gatekeeper.te --- a/gatekeeper.te
@ -32165,10 +32410,10 @@ index 5cd0909..bd3c3d2 100644
+corenet_tcp_connect_glance_registry_port(glance_scrubber_t) +corenet_tcp_connect_glance_registry_port(glance_scrubber_t)
diff --git a/glusterd.fc b/glusterd.fc diff --git a/glusterd.fc b/glusterd.fc
new file mode 100644 new file mode 100644
index 0000000..a3633cd index 0000000..9806f50
--- /dev/null --- /dev/null
+++ b/glusterd.fc +++ b/glusterd.fc
@@ -0,0 +1,29 @@ @@ -0,0 +1,25 @@
+/etc/rc\.d/init\.d/gluster.* -- gen_context(system_u:object_r:glusterd_initrc_exec_t,s0) +/etc/rc\.d/init\.d/gluster.* -- gen_context(system_u:object_r:glusterd_initrc_exec_t,s0)
+ +
+/etc/glusterfs(/.*)? gen_context(system_u:object_r:glusterd_conf_t,s0) +/etc/glusterfs(/.*)? gen_context(system_u:object_r:glusterd_conf_t,s0)
@ -32184,20 +32429,16 @@ index 0000000..a3633cd
+/usr/libexec/glusterfs/peer_eventsapi.py -- gen_context(system_u:object_r:glusterd_exec_t,s0) +/usr/libexec/glusterfs/peer_eventsapi.py -- gen_context(system_u:object_r:glusterd_exec_t,s0)
+/usr/libexec/glusterfs/events/glustereventsd.py -- gen_context(system_u:object_r:glusterd_exec_t,s0) +/usr/libexec/glusterfs/events/glustereventsd.py -- gen_context(system_u:object_r:glusterd_exec_t,s0)
+ +
+/usr/bin/ganesha.nfsd -- gen_context(system_u:object_r:glusterd_exec_t,s0)
+
+/opt/glusterfs/[^/]+/sbin/glusterfsd -- gen_context(system_u:object_r:glusterd_exec_t,s0) +/opt/glusterfs/[^/]+/sbin/glusterfsd -- gen_context(system_u:object_r:glusterd_exec_t,s0)
+ +
+/var/lib/glusterd(/.*)? gen_context(system_u:object_r:glusterd_var_lib_t,s0) +/var/lib/glusterd(/.*)? gen_context(system_u:object_r:glusterd_var_lib_t,s0)
+ +
+/var/log/glusterfs(/.*)? gen_context(system_u:object_r:glusterd_log_t,s0) +/var/log/glusterfs(/.*)? gen_context(system_u:object_r:glusterd_log_t,s0)
+/var/log/ganesha.log -- gen_context(system_u:object_r:glusterd_log_t,s0)
+ +
+/var/run/gluster(/.*)? gen_context(system_u:object_r:glusterd_var_run_t,s0) +/var/run/gluster(/.*)? gen_context(system_u:object_r:glusterd_var_run_t,s0)
+/var/run/glusterd(/.*)? gen_context(system_u:object_r:glusterd_var_run_t,s0) +/var/run/glusterd(/.*)? gen_context(system_u:object_r:glusterd_var_run_t,s0)
+/var/run/glusterd.* -- gen_context(system_u:object_r:glusterd_var_run_t,s0) +/var/run/glusterd.* -- gen_context(system_u:object_r:glusterd_var_run_t,s0)
+/var/run/glusterd.* -s gen_context(system_u:object_r:glusterd_var_run_t,s0) +/var/run/glusterd.* -s gen_context(system_u:object_r:glusterd_var_run_t,s0)
+/var/run/ganesha.* -- gen_context(system_u:object_r:glusterd_var_run_t,s0)
diff --git a/glusterd.if b/glusterd.if diff --git a/glusterd.if b/glusterd.if
new file mode 100644 new file mode 100644
index 0000000..764ae00 index 0000000..764ae00
@ -83507,7 +83748,7 @@ index da64218..3fb8575 100644
+ domtrans_pattern($1, quota_nld_exec_t, quota_nld_t) + domtrans_pattern($1, quota_nld_exec_t, quota_nld_t)
') ')
diff --git a/quota.te b/quota.te diff --git a/quota.te b/quota.te
index f47c8e8..d4e9042 100644 index f47c8e8..af09c76 100644
--- a/quota.te --- a/quota.te
+++ b/quota.te +++ b/quota.te
@@ -5,12 +5,10 @@ policy_module(quota, 1.6.0) @@ -5,12 +5,10 @@ policy_module(quota, 1.6.0)
@ -83602,7 +83843,7 @@ index f47c8e8..d4e9042 100644
') ')
optional_policy(` optional_policy(`
@@ -103,12 +102,12 @@ optional_policy(` @@ -103,12 +102,13 @@ optional_policy(`
####################################### #######################################
# #
@ -83613,11 +83854,12 @@ index f47c8e8..d4e9042 100644
allow quota_nld_t self:fifo_file rw_fifo_file_perms; allow quota_nld_t self:fifo_file rw_fifo_file_perms;
allow quota_nld_t self:netlink_socket create_socket_perms; allow quota_nld_t self:netlink_socket create_socket_perms;
-allow quota_nld_t self:unix_stream_socket { accept listen }; -allow quota_nld_t self:unix_stream_socket { accept listen };
+allow quota_nld_t self:netlink_generic_socket create_socket_perms;
+allow quota_nld_t self:unix_stream_socket create_stream_socket_perms; +allow quota_nld_t self:unix_stream_socket create_stream_socket_perms;
manage_files_pattern(quota_nld_t, quota_nld_var_run_t, quota_nld_var_run_t) manage_files_pattern(quota_nld_t, quota_nld_var_run_t, quota_nld_var_run_t)
files_pid_filetrans(quota_nld_t, quota_nld_var_run_t, { file }) files_pid_filetrans(quota_nld_t, quota_nld_var_run_t, { file })
@@ -121,11 +120,9 @@ init_read_utmp(quota_nld_t) @@ -121,11 +121,9 @@ init_read_utmp(quota_nld_t)
logging_send_syslog_msg(quota_nld_t) logging_send_syslog_msg(quota_nld_t)
@ -91112,7 +91354,7 @@ index 0bf13c2..ed393a0 100644
files_list_tmp($1) files_list_tmp($1)
admin_pattern($1, gssd_tmp_t) admin_pattern($1, gssd_tmp_t)
diff --git a/rpc.te b/rpc.te diff --git a/rpc.te b/rpc.te
index 2da9fca..a37f579 100644 index 2da9fca..be1fab2 100644
--- a/rpc.te --- a/rpc.te
+++ b/rpc.te +++ b/rpc.te
@@ -6,22 +6,27 @@ policy_module(rpc, 1.15.1) @@ -6,22 +6,27 @@ policy_module(rpc, 1.15.1)
@ -91316,7 +91558,7 @@ index 2da9fca..a37f579 100644
') ')
######################################## ########################################
@@ -202,41 +232,61 @@ optional_policy(` @@ -202,41 +232,62 @@ optional_policy(`
# #
allow nfsd_t self:capability { dac_override dac_read_search sys_admin sys_resource }; allow nfsd_t self:capability { dac_override dac_read_search sys_admin sys_resource };
@ -91334,6 +91576,7 @@ index 2da9fca..a37f579 100644
kernel_request_load_module(nfsd_t) kernel_request_load_module(nfsd_t)
-# kernel_mounton_proc(nfsd_t) -# kernel_mounton_proc(nfsd_t)
+kernel_mounton_proc(nfsd_t) +kernel_mounton_proc(nfsd_t)
+kernel_rw_rpc_sysctls_dirs(nfsd_t)
-corenet_sendrecv_nfs_server_packets(nfsd_t) -corenet_sendrecv_nfs_server_packets(nfsd_t)
+corecmd_exec_shell(nfsd_t) +corecmd_exec_shell(nfsd_t)
@ -91388,7 +91631,7 @@ index 2da9fca..a37f579 100644
miscfiles_manage_public_files(nfsd_t) miscfiles_manage_public_files(nfsd_t)
') ')
@@ -245,7 +295,6 @@ tunable_policy(`nfs_export_all_rw',` @@ -245,7 +296,6 @@ tunable_policy(`nfs_export_all_rw',`
dev_getattr_all_chr_files(nfsd_t) dev_getattr_all_chr_files(nfsd_t)
fs_read_noxattr_fs_files(nfsd_t) fs_read_noxattr_fs_files(nfsd_t)
@ -91396,7 +91639,7 @@ index 2da9fca..a37f579 100644
') ')
tunable_policy(`nfs_export_all_ro',` tunable_policy(`nfs_export_all_ro',`
@@ -257,12 +306,12 @@ tunable_policy(`nfs_export_all_ro',` @@ -257,12 +307,12 @@ tunable_policy(`nfs_export_all_ro',`
fs_read_noxattr_fs_files(nfsd_t) fs_read_noxattr_fs_files(nfsd_t)
@ -91411,7 +91654,7 @@ index 2da9fca..a37f579 100644
') ')
######################################## ########################################
@@ -270,7 +319,7 @@ optional_policy(` @@ -270,7 +320,7 @@ optional_policy(`
# GSSD local policy # GSSD local policy
# #
@ -91420,7 +91663,7 @@ index 2da9fca..a37f579 100644
allow gssd_t self:process { getsched setsched }; allow gssd_t self:process { getsched setsched };
allow gssd_t self:fifo_file rw_fifo_file_perms; allow gssd_t self:fifo_file rw_fifo_file_perms;
@@ -280,6 +329,7 @@ manage_dirs_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t) @@ -280,6 +330,7 @@ manage_dirs_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t)
manage_files_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t) manage_files_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t)
files_tmp_filetrans(gssd_t, gssd_tmp_t, { file dir }) files_tmp_filetrans(gssd_t, gssd_tmp_t, { file dir })
@ -91428,7 +91671,7 @@ index 2da9fca..a37f579 100644
kernel_read_network_state(gssd_t) kernel_read_network_state(gssd_t)
kernel_read_network_state_symlinks(gssd_t) kernel_read_network_state_symlinks(gssd_t)
kernel_request_load_module(gssd_t) kernel_request_load_module(gssd_t)
@@ -288,25 +338,31 @@ kernel_signal(gssd_t) @@ -288,25 +339,31 @@ kernel_signal(gssd_t)
corecmd_exec_bin(gssd_t) corecmd_exec_bin(gssd_t)
@ -91463,7 +91706,7 @@ index 2da9fca..a37f579 100644
') ')
optional_policy(` optional_policy(`
@@ -314,9 +370,12 @@ optional_policy(` @@ -314,9 +371,12 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`

6
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.13.1 Version: 3.13.1
Release: 240%{?dist} Release: 241%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -675,6 +675,10 @@ exit 0
%endif %endif
%changelog %changelog
* Tue Feb 21 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-241
- Remove ganesha from gluster module and create own module for ganesha
- FIx label for /usr/lib/libGLdispatch.so.0.0.0
* Wed Feb 15 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-240 * Wed Feb 15 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-240
- Dontaudit xdm_t wake_alarm capability2 - Dontaudit xdm_t wake_alarm capability2
- Allow systemd_initctl_t to create and connect unix_dgram sockets - Allow systemd_initctl_t to create and connect unix_dgram sockets