rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Fri Jan 05 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-309 

- auth_use_nsswitch() interface cannot be used for attributes fixing munin policy
- Allow git_script_t to mmap git_user_content_t files BZ(1530937)
- Allow certmonger domain to create temp files BZ(1530795)
- Improve interface mock_read_lib_files() to include also symlinks. BZ(1530563)
- Allow fsdaemon_t to read nvme devices BZ(1530018)
- Dontaudit fsdaemon_t to write to admin homedir. BZ(153030)
- Update munin plugin policy BZ(1528471)
- Allow sendmail_t domain to be system dbusd client BZ(1478735)
- Allow amanda_t domain to getattr on tmpfs filesystem BZ(1527645)
- Allow named file transition to create rpmrebuilddb dir with proper SELinux context BZ(1461313)
- Dontaudit httpd_passwd_t domain to read state of systemd BZ(1522672)
- Allow thumb_t to mmap non security files BZ(1517393)
- Allow smbd_t to mmap files with label samba_share_t BZ(1530453)
- Fix broken sysnet_filetrans_named_content() interface
- Allow init_t to create tcp sockets for unconfined services BZ(1366968)
- Allow xdm_t to getattr on xserver_t process files BZ(1506116)
- Allow domains which can create resolv.conf file also create it in systemd_resolved_var_run_t dir BZ(1530297)
- Allow X userdomains to send dgram msgs to xserver_t BZ(1515967)
- Add interface files_map_non_security_files()
This commit is contained in:
Lukas Vrabec 2018-01-05 15:16:17 +01:00
parent 46f9f9c36a
commit af863d8251
4 changed files with 3997 additions and 1753 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
container-selinux.tgz
View File

Binary file not shown.

5453
policy-rawhide-base.patch
View File

File diff suppressed because it is too large Load Diff

274
policy-rawhide-contrib.patch
View File

@ -2331,7 +2331,7 @@ index 7f4dfbca3..e5c9f45b8 100644
/usr/sbin/amrecover -- gen_context(system_u:object_r:amanda_recover_exec_t,s0) /usr/sbin/amrecover -- gen_context(system_u:object_r:amanda_recover_exec_t,s0)
diff --git a/amanda.te b/amanda.te diff --git a/amanda.te b/amanda.te
index 519051c7d..96bbc0825 100644 index 519051c7d..48d816150 100644
--- a/amanda.te --- a/amanda.te
+++ b/amanda.te +++ b/amanda.te
@@ -9,11 +9,14 @@ attribute_role amanda_recover_roles; @@ -9,11 +9,14 @@ attribute_role amanda_recover_roles;
@ -2425,7 +2425,12 @@ index 519051c7d..96bbc0825 100644
files_read_etc_runtime_files(amanda_t) files_read_etc_runtime_files(amanda_t)
files_list_all(amanda_t) files_list_all(amanda_t)
@@ -130,6 +145,7 @@ fs_list_all(amanda_t) @@ -126,10 +141,12 @@ files_getattr_all_sockets(amanda_t)
fs_getattr_xattr_fs(amanda_t)
fs_list_all(amanda_t)
+fs_getattr_tmpfs(amanda_t)
storage_raw_read_fixed_disk(amanda_t) storage_raw_read_fixed_disk(amanda_t)
storage_read_tape(amanda_t) storage_read_tape(amanda_t)
storage_write_tape(amanda_t) storage_write_tape(amanda_t)
@ -2433,7 +2438,7 @@ index 519051c7d..96bbc0825 100644
auth_use_nsswitch(amanda_t) auth_use_nsswitch(amanda_t)
auth_read_shadow(amanda_t) auth_read_shadow(amanda_t)
@@ -141,7 +157,7 @@ logging_send_syslog_msg(amanda_t) @@ -141,7 +158,7 @@ logging_send_syslog_msg(amanda_t)
# Recover local policy # Recover local policy
# #
@ -2442,7 +2447,7 @@ index 519051c7d..96bbc0825 100644
allow amanda_recover_t self:process { sigkill sigstop signal }; allow amanda_recover_t self:process { sigkill sigstop signal };
allow amanda_recover_t self:fifo_file rw_fifo_file_perms; allow amanda_recover_t self:fifo_file rw_fifo_file_perms;
allow amanda_recover_t self:unix_stream_socket create_socket_perms; allow amanda_recover_t self:unix_stream_socket create_socket_perms;
@@ -170,7 +186,6 @@ kernel_read_system_state(amanda_recover_t) @@ -170,7 +187,6 @@ kernel_read_system_state(amanda_recover_t)
corecmd_exec_shell(amanda_recover_t) corecmd_exec_shell(amanda_recover_t)
corecmd_exec_bin(amanda_recover_t) corecmd_exec_bin(amanda_recover_t)
@ -2450,7 +2455,7 @@ index 519051c7d..96bbc0825 100644
corenet_all_recvfrom_netlabel(amanda_recover_t) corenet_all_recvfrom_netlabel(amanda_recover_t)
corenet_tcp_sendrecv_generic_if(amanda_recover_t) corenet_tcp_sendrecv_generic_if(amanda_recover_t)
corenet_udp_sendrecv_generic_if(amanda_recover_t) corenet_udp_sendrecv_generic_if(amanda_recover_t)
@@ -195,12 +210,16 @@ files_search_tmp(amanda_recover_t) @@ -195,12 +211,16 @@ files_search_tmp(amanda_recover_t)
auth_use_nsswitch(amanda_recover_t) auth_use_nsswitch(amanda_recover_t)
@ -5635,7 +5640,7 @@ index f6eb4851f..3628a384f 100644
+ allow $1 httpd_t:process { noatsecure }; + allow $1 httpd_t:process { noatsecure };
') ')
diff --git a/apache.te b/apache.te diff --git a/apache.te b/apache.te
index 6649962b6..1df48fb13 100644 index 6649962b6..c45ca1fb1 100644
--- a/apache.te --- a/apache.te
+++ b/apache.te +++ b/apache.te
@@ -5,280 +5,346 @@ policy_module(apache, 2.7.2) @@ -5,280 +5,346 @@ policy_module(apache, 2.7.2)
@ -7895,39 +7900,47 @@ index 6649962b6..1df48fb13 100644
kernel_read_system_state(httpd_passwd_t) kernel_read_system_state(httpd_passwd_t)
corecmd_exec_bin(httpd_passwd_t) corecmd_exec_bin(httpd_passwd_t)
@@ -1382,38 +1682,110 @@ dev_read_urand(httpd_passwd_t) @@ -1384,36 +1684,109 @@ domain_use_interactive_fds(httpd_passwd_t)
domain_use_interactive_fds(httpd_passwd_t)
+
auth_use_nsswitch(httpd_passwd_t) auth_use_nsswitch(httpd_passwd_t)
-miscfiles_read_generic_certs(httpd_passwd_t) -miscfiles_read_generic_certs(httpd_passwd_t)
-miscfiles_read_localization(httpd_passwd_t) -miscfiles_read_localization(httpd_passwd_t)
+miscfiles_read_certs(httpd_passwd_t) +init_dontaudit_read_state(httpd_passwd_t)
-######################################## -########################################
-# -#
-# GPG local policy -# GPG local policy
-# -#
+miscfiles_read_certs(httpd_passwd_t)
-allow httpd_gpg_t self:process setrlimit;
+systemd_manage_passwd_run(httpd_passwd_t) +systemd_manage_passwd_run(httpd_passwd_t)
+systemd_manage_passwd_run(httpd_t) +systemd_manage_passwd_run(httpd_t)
+#systemd_passwd_agent_dev_template(httpd) +#systemd_passwd_agent_dev_template(httpd)
-allow httpd_gpg_t self:process setrlimit; -allow httpd_gpg_t httpd_t:fd use;
-allow httpd_gpg_t httpd_t:fifo_file rw_fifo_file_perms;
-allow httpd_gpg_t httpd_t:process sigchld;
+domtrans_pattern(httpd_t, httpd_passwd_exec_t, httpd_passwd_t) +domtrans_pattern(httpd_t, httpd_passwd_exec_t, httpd_passwd_t)
+dontaudit httpd_passwd_t httpd_config_t:file read; +dontaudit httpd_passwd_t httpd_config_t:file read;
+
-dev_read_rand(httpd_gpg_t)
-dev_read_urand(httpd_gpg_t)
+search_dirs_pattern(httpd_script_type, httpd_sys_content_t, httpd_script_exec_type) +search_dirs_pattern(httpd_script_type, httpd_sys_content_t, httpd_script_exec_type)
+corecmd_shell_entry_type(httpd_script_type) +corecmd_shell_entry_type(httpd_script_type)
+
-files_read_usr_files(httpd_gpg_t)
+allow httpd_script_type self:fifo_file rw_file_perms; +allow httpd_script_type self:fifo_file rw_file_perms;
+allow httpd_script_type self:unix_stream_socket connectto; +allow httpd_script_type self:unix_stream_socket connectto;
+
-miscfiles_read_localization(httpd_gpg_t)
+allow httpd_script_type httpd_t:fifo_file write; +allow httpd_script_type httpd_t:fifo_file write;
+# apache should set close-on-exec +# apache should set close-on-exec
+apache_dontaudit_leaks(httpd_script_type) +apache_dontaudit_leaks(httpd_script_type)
+
-tunable_policy(`httpd_gpg_anon_write',`
- miscfiles_manage_public_files(httpd_gpg_t)
+append_files_pattern(httpd_script_type, httpd_log_t, httpd_log_t) +append_files_pattern(httpd_script_type, httpd_log_t, httpd_log_t)
+logging_search_logs(httpd_script_type) +logging_search_logs(httpd_script_type)
+ +
@ -7955,29 +7968,20 @@ index 6649962b6..1df48fb13 100644
+allow httpd_t httpd_script_exec_type:lnk_file read_lnk_file_perms; +allow httpd_t httpd_script_exec_type:lnk_file read_lnk_file_perms;
+allow httpd_t httpd_script_type:process { signal sigkill sigstop signull }; +allow httpd_t httpd_script_type:process { signal sigkill sigstop signull };
+allow httpd_t httpd_script_exec_type:dir list_dir_perms; +allow httpd_t httpd_script_exec_type:dir list_dir_perms;
+
-allow httpd_gpg_t httpd_t:fd use;
-allow httpd_gpg_t httpd_t:fifo_file rw_fifo_file_perms;
-allow httpd_gpg_t httpd_t:process sigchld;
+allow httpd_script_type self:process { setsched signal_perms }; +allow httpd_script_type self:process { setsched signal_perms };
+allow httpd_script_type self:unix_stream_socket create_stream_socket_perms; +allow httpd_script_type self:unix_stream_socket create_stream_socket_perms;
+allow httpd_script_type self:unix_dgram_socket create_socket_perms; +allow httpd_script_type self:unix_dgram_socket create_socket_perms;
+allow httpd_script_type httpd_t:unix_stream_socket rw_stream_socket_perms; +allow httpd_script_type httpd_t:unix_stream_socket rw_stream_socket_perms;
+
-dev_read_rand(httpd_gpg_t)
-dev_read_urand(httpd_gpg_t)
+allow httpd_script_type httpd_t:fd use; +allow httpd_script_type httpd_t:fd use;
+allow httpd_script_type httpd_t:process sigchld; +allow httpd_script_type httpd_t:process sigchld;
+
-files_read_usr_files(httpd_gpg_t)
+dontaudit httpd_script_type httpd_t:tcp_socket { read write }; +dontaudit httpd_script_type httpd_t:tcp_socket { read write };
+dontaudit httpd_script_type httpd_t:unix_stream_socket { read write }; +dontaudit httpd_script_type httpd_t:unix_stream_socket { read write };
+
-miscfiles_read_localization(httpd_gpg_t)
+fs_getattr_xattr_fs(httpd_script_type) +fs_getattr_xattr_fs(httpd_script_type)
+
-tunable_policy(`httpd_gpg_anon_write',`
- miscfiles_manage_public_files(httpd_gpg_t)
+files_read_etc_runtime_files(httpd_script_type) +files_read_etc_runtime_files(httpd_script_type)
+ +
+libs_read_lib_files(httpd_script_type) +libs_read_lib_files(httpd_script_type)
@ -12617,10 +12621,10 @@ index 008f8ef26..144c0740a 100644
admin_pattern($1, certmonger_var_run_t) admin_pattern($1, certmonger_var_run_t)
') ')
diff --git a/certmonger.te b/certmonger.te diff --git a/certmonger.te b/certmonger.te
index 550b287ce..73104ec93 100644 index 550b287ce..36c9f99b1 100644
--- a/certmonger.te --- a/certmonger.te
+++ b/certmonger.te +++ b/certmonger.te
@@ -18,18 +18,26 @@ files_type(certmonger_var_lib_t) @@ -18,18 +18,29 @@ files_type(certmonger_var_lib_t)
type certmonger_var_run_t; type certmonger_var_run_t;
files_pid_file(certmonger_var_run_t) files_pid_file(certmonger_var_run_t)
@ -12629,6 +12633,9 @@ index 550b287ce..73104ec93 100644
+ +
+type certmonger_unit_file_t; +type certmonger_unit_file_t;
+systemd_unit_file(certmonger_unit_file_t) +systemd_unit_file(certmonger_unit_file_t)
+
+type certmonger_tmp_t;
+files_tmp_file(certmonger_tmp_t)
+ +
######################################## ########################################
# #
@ -12651,15 +12658,21 @@ index 550b287ce..73104ec93 100644
manage_dirs_pattern(certmonger_t, certmonger_var_lib_t, certmonger_var_lib_t) manage_dirs_pattern(certmonger_t, certmonger_var_lib_t, certmonger_var_lib_t)
manage_files_pattern(certmonger_t, certmonger_var_lib_t, certmonger_var_lib_t) manage_files_pattern(certmonger_t, certmonger_var_lib_t, certmonger_var_lib_t)
@@ -41,6 +49,7 @@ files_pid_filetrans(certmonger_t, certmonger_var_run_t, { dir file }) @@ -39,8 +50,13 @@ manage_dirs_pattern(certmonger_t, certmonger_var_run_t, certmonger_var_run_t)
manage_files_pattern(certmonger_t, certmonger_var_run_t, certmonger_var_run_t)
files_pid_filetrans(certmonger_t, certmonger_var_run_t, { dir file })
+manage_dirs_pattern(certmonger_t, certmonger_tmp_t, certmonger_tmp_t)
+manage_files_pattern(certmonger_t, certmonger_tmp_t, certmonger_tmp_t)
+files_tmp_filetrans(certmonger_t, certmonger_tmp_t, { file dir })
+
kernel_read_kernel_sysctls(certmonger_t) kernel_read_kernel_sysctls(certmonger_t)
kernel_read_system_state(certmonger_t) kernel_read_system_state(certmonger_t)
+kernel_read_network_state(certmonger_t) +kernel_read_network_state(certmonger_t)
corenet_all_recvfrom_unlabeled(certmonger_t) corenet_all_recvfrom_unlabeled(certmonger_t)
corenet_all_recvfrom_netlabel(certmonger_t) corenet_all_recvfrom_netlabel(certmonger_t)
@@ -49,17 +58,26 @@ corenet_tcp_sendrecv_generic_node(certmonger_t) @@ -49,17 +65,26 @@ corenet_tcp_sendrecv_generic_node(certmonger_t)
corenet_sendrecv_certmaster_client_packets(certmonger_t) corenet_sendrecv_certmaster_client_packets(certmonger_t)
corenet_tcp_connect_certmaster_port(certmonger_t) corenet_tcp_connect_certmaster_port(certmonger_t)
@ -12687,7 +12700,7 @@ index 550b287ce..73104ec93 100644
fs_search_cgroup_dirs(certmonger_t) fs_search_cgroup_dirs(certmonger_t)
@@ -68,18 +86,24 @@ auth_rw_cache(certmonger_t) @@ -68,18 +93,24 @@ auth_rw_cache(certmonger_t)
init_getattr_all_script_files(certmonger_t) init_getattr_all_script_files(certmonger_t)
@ -12716,7 +12729,7 @@ index 550b287ce..73104ec93 100644
') ')
optional_policy(` optional_policy(`
@@ -92,11 +116,74 @@ optional_policy(` @@ -92,11 +123,74 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -32849,7 +32862,7 @@ index 1e29af196..6c64f55c3 100644
+ userdom_user_home_dir_filetrans($1, git_user_content_t, dir, "public_git") + userdom_user_home_dir_filetrans($1, git_user_content_t, dir, "public_git")
+') +')
diff --git a/git.te b/git.te diff --git a/git.te b/git.te
index dc49c715e..e25890c3d 100644 index dc49c715e..43f79d6de 100644
--- a/git.te --- a/git.te
+++ b/git.te +++ b/git.te
@@ -49,14 +49,6 @@ gen_tunable(git_session_users, false) @@ -49,14 +49,6 @@ gen_tunable(git_session_users, false)
@ -32934,7 +32947,7 @@ index dc49c715e..e25890c3d 100644
') ')
tunable_policy(`git_system_enable_homedirs && use_nfs_home_dirs',` tunable_policy(`git_system_enable_homedirs && use_nfs_home_dirs',`
@@ -215,48 +218,53 @@ tunable_policy(`git_system_use_nfs',` @@ -215,48 +218,54 @@ tunable_policy(`git_system_use_nfs',`
# CGI policy # CGI policy
# #
@ -32951,6 +32964,7 @@ index dc49c715e..e25890c3d 100644
+read_files_pattern(git_script_t, { git_sys_content_t git_user_content_t }, { git_sys_content_t git_user_content_t }) +read_files_pattern(git_script_t, { git_sys_content_t git_user_content_t }, { git_sys_content_t git_user_content_t })
+files_search_var_lib(git_script_t) +files_search_var_lib(git_script_t)
+allow git_script_t git_sys_content_t:file map; +allow git_script_t git_sys_content_t:file map;
+allow git_script_t git_user_content_t:file map;
-auth_use_nsswitch(httpd_git_script_t) -auth_use_nsswitch(httpd_git_script_t)
+auth_use_nsswitch(git_script_t) +auth_use_nsswitch(git_script_t)
@ -33010,7 +33024,7 @@ index dc49c715e..e25890c3d 100644
') ')
######################################## ########################################
@@ -266,12 +274,9 @@ tunable_policy(`git_cgi_use_nfs',` @@ -266,12 +275,9 @@ tunable_policy(`git_cgi_use_nfs',`
allow git_daemon self:fifo_file rw_fifo_file_perms; allow git_daemon self:fifo_file rw_fifo_file_perms;
@ -51743,10 +51757,10 @@ index 000000000..394bc4658
+/var/cache/mock(/.*)? gen_context(system_u:object_r:mock_cache_t,s0) +/var/cache/mock(/.*)? gen_context(system_u:object_r:mock_cache_t,s0)
diff --git a/mock.if b/mock.if diff --git a/mock.if b/mock.if
new file mode 100644 new file mode 100644
index 000000000..f5b98e6de index 000000000..4807174c8
--- /dev/null --- /dev/null
+++ b/mock.if +++ b/mock.if
@@ -0,0 +1,311 @@ @@ -0,0 +1,312 @@
+## <summary>policy for mock</summary> +## <summary>policy for mock</summary>
+ +
+######################################## +########################################
@ -51804,6 +51818,7 @@ index 000000000..f5b98e6de
+ files_search_var_lib($1) + files_search_var_lib($1)
+ list_dirs_pattern($1, mock_var_lib_t, mock_var_lib_t) + list_dirs_pattern($1, mock_var_lib_t, mock_var_lib_t)
+ read_files_pattern($1, mock_var_lib_t, mock_var_lib_t) + read_files_pattern($1, mock_var_lib_t, mock_var_lib_t)
+ read_lnk_files_pattern($1, mock_var_lib_t, mock_var_lib_t)
+') +')
+ +
+######################################## +########################################
@ -57636,7 +57651,7 @@ index b744fe35e..cb0e2af61 100644
+ admin_pattern($1, munin_content_t) + admin_pattern($1, munin_content_t)
') ')
diff --git a/munin.te b/munin.te diff --git a/munin.te b/munin.te
index b70870816..e2a5280c3 100644 index b70870816..19e70e27c 100644
--- a/munin.te --- a/munin.te
+++ b/munin.te +++ b/munin.te
@@ -44,41 +44,40 @@ files_tmpfs_file(services_munin_plugin_tmpfs_t) @@ -44,41 +44,40 @@ files_tmpfs_file(services_munin_plugin_tmpfs_t)
@ -57697,16 +57712,18 @@ index b70870816..e2a5280c3 100644
dontaudit munin_t self:capability sys_tty_config; dontaudit munin_t self:capability sys_tty_config;
allow munin_t self:process { getsched setsched signal_perms }; allow munin_t self:process { getsched setsched signal_perms };
allow munin_t self:unix_stream_socket { accept connectto listen }; allow munin_t self:unix_stream_socket { accept connectto listen };
@@ -118,7 +117,7 @@ manage_dirs_pattern(munin_t, munin_var_lib_t, munin_var_lib_t) @@ -117,8 +116,9 @@ files_tmp_filetrans(munin_t, munin_tmp_t, { file dir sock_file })
manage_dirs_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
manage_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t) manage_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
manage_lnk_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t) manage_lnk_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
+allow munin_t munin_var_lib_t:file map;
-read_files_pattern(munin_t, munin_plugin_state_t, munin_plugin_state_t) -read_files_pattern(munin_t, munin_plugin_state_t, munin_plugin_state_t)
+rw_files_pattern(munin_t, munin_plugin_state_t, munin_plugin_state_t) +rw_files_pattern(munin_t, munin_plugin_state_t, munin_plugin_state_t)
manage_dirs_pattern(munin_t, munin_var_run_t, munin_var_run_t) manage_dirs_pattern(munin_t, munin_var_run_t, munin_var_run_t)
manage_files_pattern(munin_t, munin_var_run_t, munin_var_run_t) manage_files_pattern(munin_t, munin_var_run_t, munin_var_run_t)
@@ -134,7 +133,6 @@ kernel_read_all_sysctls(munin_t) @@ -134,7 +134,6 @@ kernel_read_all_sysctls(munin_t)
corecmd_exec_bin(munin_t) corecmd_exec_bin(munin_t)
corecmd_exec_shell(munin_t) corecmd_exec_shell(munin_t)
@ -57714,7 +57731,7 @@ index b70870816..e2a5280c3 100644
corenet_all_recvfrom_netlabel(munin_t) corenet_all_recvfrom_netlabel(munin_t)
corenet_tcp_sendrecv_generic_if(munin_t) corenet_tcp_sendrecv_generic_if(munin_t)
corenet_tcp_sendrecv_generic_node(munin_t) corenet_tcp_sendrecv_generic_node(munin_t)
@@ -157,7 +155,6 @@ domain_use_interactive_fds(munin_t) @@ -157,7 +156,6 @@ domain_use_interactive_fds(munin_t)
domain_read_all_domains_state(munin_t) domain_read_all_domains_state(munin_t)
files_read_etc_runtime_files(munin_t) files_read_etc_runtime_files(munin_t)
@ -57722,7 +57739,7 @@ index b70870816..e2a5280c3 100644
files_list_spool(munin_t) files_list_spool(munin_t)
fs_getattr_all_fs(munin_t) fs_getattr_all_fs(munin_t)
@@ -169,7 +166,6 @@ logging_send_syslog_msg(munin_t) @@ -169,7 +167,6 @@ logging_send_syslog_msg(munin_t)
logging_read_all_logs(munin_t) logging_read_all_logs(munin_t)
miscfiles_read_fonts(munin_t) miscfiles_read_fonts(munin_t)
@ -57730,7 +57747,7 @@ index b70870816..e2a5280c3 100644
miscfiles_setattr_fonts_cache_dirs(munin_t) miscfiles_setattr_fonts_cache_dirs(munin_t)
sysnet_exec_ifconfig(munin_t) sysnet_exec_ifconfig(munin_t)
@@ -177,13 +173,6 @@ sysnet_exec_ifconfig(munin_t) @@ -177,13 +174,6 @@ sysnet_exec_ifconfig(munin_t)
userdom_dontaudit_use_unpriv_user_fds(munin_t) userdom_dontaudit_use_unpriv_user_fds(munin_t)
userdom_dontaudit_search_user_home_dirs(munin_t) userdom_dontaudit_search_user_home_dirs(munin_t)
@ -57744,7 +57761,7 @@ index b70870816..e2a5280c3 100644
optional_policy(` optional_policy(`
cron_system_entry(munin_t, munin_exec_t) cron_system_entry(munin_t, munin_exec_t)
@@ -217,7 +206,6 @@ optional_policy(` @@ -217,7 +207,6 @@ optional_policy(`
optional_policy(` optional_policy(`
postfix_list_spool(munin_t) postfix_list_spool(munin_t)
@ -57752,10 +57769,12 @@ index b70870816..e2a5280c3 100644
') ')
optional_policy(` optional_policy(`
@@ -246,21 +234,25 @@ allow disk_munin_plugin_t self:tcp_socket create_stream_socket_perms; @@ -246,21 +235,27 @@ allow disk_munin_plugin_t self:tcp_socket create_stream_socket_perms;
rw_files_pattern(disk_munin_plugin_t, munin_var_lib_t, munin_var_lib_t) rw_files_pattern(disk_munin_plugin_t, munin_var_lib_t, munin_var_lib_t)
+auth_use_nsswitch(disk_munin_plugin_t)
+
+kernel_read_fs_sysctls(disk_munin_plugin_t) +kernel_read_fs_sysctls(disk_munin_plugin_t)
+ +
corenet_sendrecv_hddtemp_client_packets(disk_munin_plugin_t) corenet_sendrecv_hddtemp_client_packets(disk_munin_plugin_t)
@ -57782,7 +57801,7 @@ index b70870816..e2a5280c3 100644
sysnet_read_config(disk_munin_plugin_t) sysnet_read_config(disk_munin_plugin_t)
@@ -272,34 +264,50 @@ optional_policy(` @@ -272,34 +267,53 @@ optional_policy(`
fstools_exec(disk_munin_plugin_t) fstools_exec(disk_munin_plugin_t)
') ')
@ -57804,7 +57823,10 @@ index b70870816..e2a5280c3 100644
rw_files_pattern(mail_munin_plugin_t, munin_var_lib_t, munin_var_lib_t) rw_files_pattern(mail_munin_plugin_t, munin_var_lib_t, munin_var_lib_t)
+auth_use_nsswitch(mail_munin_plugin_t)
+
+kernel_read_net_sysctls(mail_munin_plugin_t) +kernel_read_net_sysctls(mail_munin_plugin_t)
+kernel_read_network_state(mail_munin_plugin_t)
+ +
dev_read_urand(mail_munin_plugin_t) dev_read_urand(mail_munin_plugin_t)
@ -57838,7 +57860,16 @@ index b70870816..e2a5280c3 100644
') ')
optional_policy(` optional_policy(`
@@ -339,7 +347,7 @@ dev_read_rand(services_munin_plugin_t) @@ -311,6 +325,8 @@ optional_policy(`
# Selinux local policy
#
+auth_use_nsswitch(selinux_munin_plugin_t)
+
selinux_get_enforce_mode(selinux_munin_plugin_t)
###################################
@@ -339,7 +355,7 @@ dev_read_rand(services_munin_plugin_t)
sysnet_read_config(services_munin_plugin_t) sysnet_read_config(services_munin_plugin_t)
optional_policy(` optional_policy(`
@ -57847,7 +57878,7 @@ index b70870816..e2a5280c3 100644
') ')
optional_policy(` optional_policy(`
@@ -348,6 +356,10 @@ optional_policy(` @@ -348,6 +364,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -57858,7 +57889,7 @@ index b70870816..e2a5280c3 100644
lpd_exec_lpr(services_munin_plugin_t) lpd_exec_lpr(services_munin_plugin_t)
') ')
@@ -361,7 +373,11 @@ optional_policy(` @@ -361,7 +381,11 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -57871,7 +57902,7 @@ index b70870816..e2a5280c3 100644
') ')
optional_policy(` optional_policy(`
@@ -393,6 +409,7 @@ read_files_pattern(system_munin_plugin_t, munin_log_t, munin_log_t) @@ -393,6 +417,7 @@ read_files_pattern(system_munin_plugin_t, munin_log_t, munin_log_t)
kernel_read_network_state(system_munin_plugin_t) kernel_read_network_state(system_munin_plugin_t)
kernel_read_all_sysctls(system_munin_plugin_t) kernel_read_all_sysctls(system_munin_plugin_t)
@ -57879,7 +57910,7 @@ index b70870816..e2a5280c3 100644
dev_read_sysfs(system_munin_plugin_t) dev_read_sysfs(system_munin_plugin_t)
dev_read_urand(system_munin_plugin_t) dev_read_urand(system_munin_plugin_t)
@@ -421,3 +438,33 @@ optional_policy(` @@ -421,3 +446,33 @@ optional_policy(`
optional_policy(` optional_policy(`
unconfined_domain(unconfined_munin_plugin_t) unconfined_domain(unconfined_munin_plugin_t)
') ')
@ -57908,7 +57939,7 @@ index b70870816..e2a5280c3 100644
+ +
+files_search_var_lib(munin_script_t) +files_search_var_lib(munin_script_t)
+ +
+auth_read_passwd(munin_script_t) +auth_use_nsswitch(munin_script_t)
+ +
+optional_policy(` +optional_policy(`
+ apache_search_sys_content(munin_t) + apache_search_sys_content(munin_t)
@ -94607,7 +94638,7 @@ index ebe91fc70..6ba4338cb 100644
+/sbin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0) +/sbin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
') ')
diff --git a/rpm.if b/rpm.if diff --git a/rpm.if b/rpm.if
index ef3b22507..79518530e 100644 index ef3b22507..b7bd65539 100644
--- a/rpm.if --- a/rpm.if
+++ b/rpm.if +++ b/rpm.if
@@ -1,8 +1,8 @@ @@ -1,8 +1,8 @@
@ -94886,7 +94917,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -302,7 +398,32 @@ interface(`rpm_manage_log',` @@ -302,7 +398,33 @@ interface(`rpm_manage_log',`
######################################## ########################################
## <summary> ## <summary>
@ -94912,6 +94943,7 @@ index ef3b22507..79518530e 100644
+ files_var_lib_filetrans($1, rpm_var_lib_t, dir, "dnf") + files_var_lib_filetrans($1, rpm_var_lib_t, dir, "dnf")
+ files_var_lib_filetrans($1, rpm_var_lib_t, dir, "yum") + files_var_lib_filetrans($1, rpm_var_lib_t, dir, "yum")
+ files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpm") + files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpm")
+ files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpmrebuilddb")
+') +')
+ +
+######################################## +########################################
@ -94920,7 +94952,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -320,8 +441,8 @@ interface(`rpm_use_script_fds',` @@ -320,8 +442,8 @@ interface(`rpm_use_script_fds',`
######################################## ########################################
## <summary> ## <summary>
@ -94931,7 +94963,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -335,12 +456,15 @@ interface(`rpm_manage_script_tmp_files',` @@ -335,12 +457,15 @@ interface(`rpm_manage_script_tmp_files',`
') ')
files_search_tmp($1) files_search_tmp($1)
@ -94948,7 +94980,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -353,14 +477,13 @@ interface(`rpm_append_tmp_files',` @@ -353,14 +478,13 @@ interface(`rpm_append_tmp_files',`
type rpm_tmp_t; type rpm_tmp_t;
') ')
@ -94966,7 +94998,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -374,12 +497,34 @@ interface(`rpm_manage_tmp_files',` @@ -374,12 +498,34 @@ interface(`rpm_manage_tmp_files',`
') ')
files_search_tmp($1) files_search_tmp($1)
@ -95002,7 +95034,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -399,7 +544,7 @@ interface(`rpm_read_script_tmp_files',` @@ -399,7 +545,7 @@ interface(`rpm_read_script_tmp_files',`
######################################## ########################################
## <summary> ## <summary>
@ -95011,7 +95043,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -420,8 +565,7 @@ interface(`rpm_read_cache',` @@ -420,8 +566,7 @@ interface(`rpm_read_cache',`
######################################## ########################################
## <summary> ## <summary>
@ -95021,7 +95053,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -442,7 +586,7 @@ interface(`rpm_manage_cache',` @@ -442,7 +587,7 @@ interface(`rpm_manage_cache',`
######################################## ########################################
## <summary> ## <summary>
@ -95030,7 +95062,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -459,11 +603,13 @@ interface(`rpm_read_db',` @@ -459,11 +604,13 @@ interface(`rpm_read_db',`
allow $1 rpm_var_lib_t:dir list_dir_perms; allow $1 rpm_var_lib_t:dir list_dir_perms;
read_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t) read_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
read_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t) read_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
@ -95045,7 +95077,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -482,8 +628,7 @@ interface(`rpm_delete_db',` @@ -482,8 +629,7 @@ interface(`rpm_delete_db',`
######################################## ########################################
## <summary> ## <summary>
@ -95055,7 +95087,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -499,12 +644,33 @@ interface(`rpm_manage_db',` @@ -499,12 +645,33 @@ interface(`rpm_manage_db',`
files_search_var_lib($1) files_search_var_lib($1)
manage_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t) manage_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
manage_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t) manage_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
@ -95090,7 +95122,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -517,9 +683,10 @@ interface(`rpm_dontaudit_manage_db',` @@ -517,9 +684,10 @@ interface(`rpm_dontaudit_manage_db',`
type rpm_var_lib_t; type rpm_var_lib_t;
') ')
@ -95102,7 +95134,7 @@ index ef3b22507..79518530e 100644
') ')
##################################### #####################################
@@ -543,8 +710,7 @@ interface(`rpm_read_pid_files',` @@ -543,8 +711,7 @@ interface(`rpm_read_pid_files',`
##################################### #####################################
## <summary> ## <summary>
@ -95112,7 +95144,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -563,8 +729,7 @@ interface(`rpm_manage_pid_files',` @@ -563,8 +730,7 @@ interface(`rpm_manage_pid_files',`
###################################### ######################################
## <summary> ## <summary>
@ -95122,7 +95154,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -573,43 +738,54 @@ interface(`rpm_manage_pid_files',` @@ -573,43 +739,54 @@ interface(`rpm_manage_pid_files',`
## </param> ## </param>
# #
interface(`rpm_pid_filetrans',` interface(`rpm_pid_filetrans',`
@ -95194,7 +95226,7 @@ index ef3b22507..79518530e 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -617,22 +793,57 @@ interface(`rpm_pid_filetrans_rpm_pid',` @@ -617,22 +794,57 @@ interface(`rpm_pid_filetrans_rpm_pid',`
## </summary> ## </summary>
## </param> ## </param>
## <param name="role"> ## <param name="role">
@ -95263,7 +95295,7 @@ index ef3b22507..79518530e 100644
init_labeled_script_domtrans($1, rpm_initrc_exec_t) init_labeled_script_domtrans($1, rpm_initrc_exec_t)
domain_system_change_exemption($1) domain_system_change_exemption($1)
@@ -641,9 +852,6 @@ interface(`rpm_admin',` @@ -641,9 +853,6 @@ interface(`rpm_admin',`
admin_pattern($1, rpm_file_t) admin_pattern($1, rpm_file_t)
@ -97896,7 +97928,7 @@ index 50d07fb2e..a15cd5b6b 100644
+ allow $1 samba_unit_file_t:service all_service_perms; + allow $1 samba_unit_file_t:service all_service_perms;
') ')
diff --git a/samba.te b/samba.te diff --git a/samba.te b/samba.te
index 2b7c441e7..0f95635dd 100644 index 2b7c441e7..1bfd11b61 100644
--- a/samba.te --- a/samba.te
+++ b/samba.te +++ b/samba.te
@@ -6,99 +6,86 @@ policy_module(samba, 1.16.3) @@ -6,99 +6,86 @@ policy_module(samba, 1.16.3)
@ -98194,7 +98226,7 @@ index 2b7c441e7..0f95635dd 100644
') ')
optional_policy(` optional_policy(`
@@ -249,46 +261,59 @@ optional_policy(` @@ -249,47 +261,61 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -98265,9 +98297,11 @@ index 2b7c441e7..0f95635dd 100644
+manage_fifo_files_pattern(smbd_t, samba_share_t, samba_share_t) +manage_fifo_files_pattern(smbd_t, samba_share_t, samba_share_t)
+manage_sock_files_pattern(smbd_t, samba_share_t, samba_share_t) +manage_sock_files_pattern(smbd_t, samba_share_t, samba_share_t)
manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t) manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t)
+allow smbd_t samba_share_t:file { map };
allow smbd_t samba_share_t:filesystem { getattr quotaget }; allow smbd_t samba_share_t:filesystem { getattr quotaget };
@@ -297,66 +322,74 @@ manage_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_dirs_pattern(smbd_t, samba_var_t, samba_var_t)
@@ -297,66 +323,74 @@ manage_files_pattern(smbd_t, samba_var_t, samba_var_t)
manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t)
manage_sock_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_sock_files_pattern(smbd_t, samba_var_t, samba_var_t)
files_var_filetrans(smbd_t, samba_var_t, dir, "samba") files_var_filetrans(smbd_t, samba_var_t, dir, "samba")
@ -98366,7 +98400,7 @@ index 2b7c441e7..0f95635dd 100644
fs_getattr_all_fs(smbd_t) fs_getattr_all_fs(smbd_t)
fs_getattr_all_dirs(smbd_t) fs_getattr_all_dirs(smbd_t)
@@ -366,44 +399,53 @@ fs_getattr_rpc_dirs(smbd_t) @@ -366,44 +400,53 @@ fs_getattr_rpc_dirs(smbd_t)
fs_list_inotifyfs(smbd_t) fs_list_inotifyfs(smbd_t)
fs_get_all_fs_quotas(smbd_t) fs_get_all_fs_quotas(smbd_t)
@ -98432,7 +98466,7 @@ index 2b7c441e7..0f95635dd 100644
') ')
tunable_policy(`samba_domain_controller',` tunable_policy(`samba_domain_controller',`
@@ -419,20 +461,16 @@ tunable_policy(`samba_domain_controller',` @@ -419,20 +462,16 @@ tunable_policy(`samba_domain_controller',`
') ')
tunable_policy(`samba_enable_home_dirs',` tunable_policy(`samba_enable_home_dirs',`
@ -98459,7 +98493,7 @@ index 2b7c441e7..0f95635dd 100644
tunable_policy(`samba_share_nfs',` tunable_policy(`samba_share_nfs',`
fs_manage_nfs_dirs(smbd_t) fs_manage_nfs_dirs(smbd_t)
fs_manage_nfs_files(smbd_t) fs_manage_nfs_files(smbd_t)
@@ -441,6 +479,7 @@ tunable_policy(`samba_share_nfs',` @@ -441,6 +480,7 @@ tunable_policy(`samba_share_nfs',`
fs_manage_nfs_named_sockets(smbd_t) fs_manage_nfs_named_sockets(smbd_t)
') ')
@ -98467,7 +98501,7 @@ index 2b7c441e7..0f95635dd 100644
tunable_policy(`samba_share_fusefs',` tunable_policy(`samba_share_fusefs',`
fs_manage_fusefs_dirs(smbd_t) fs_manage_fusefs_dirs(smbd_t)
fs_manage_fusefs_files(smbd_t) fs_manage_fusefs_files(smbd_t)
@@ -448,15 +487,10 @@ tunable_policy(`samba_share_fusefs',` @@ -448,15 +488,10 @@ tunable_policy(`samba_share_fusefs',`
fs_search_fusefs(smbd_t) fs_search_fusefs(smbd_t)
') ')
@ -98487,7 +98521,7 @@ index 2b7c441e7..0f95635dd 100644
') ')
optional_policy(` optional_policy(`
@@ -466,6 +500,7 @@ optional_policy(` @@ -466,6 +501,7 @@ optional_policy(`
optional_policy(` optional_policy(`
ctdbd_stream_connect(smbd_t) ctdbd_stream_connect(smbd_t)
ctdbd_manage_lib_files(smbd_t) ctdbd_manage_lib_files(smbd_t)
@ -98495,7 +98529,7 @@ index 2b7c441e7..0f95635dd 100644
') ')
optional_policy(` optional_policy(`
@@ -474,11 +509,31 @@ optional_policy(` @@ -474,11 +510,31 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -98527,7 +98561,7 @@ index 2b7c441e7..0f95635dd 100644
lpd_exec_lpr(smbd_t) lpd_exec_lpr(smbd_t)
') ')
@@ -488,6 +543,10 @@ optional_policy(` @@ -488,6 +544,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -98538,7 +98572,7 @@ index 2b7c441e7..0f95635dd 100644
rpc_search_nfs_state_data(smbd_t) rpc_search_nfs_state_data(smbd_t)
') ')
@@ -499,12 +558,53 @@ optional_policy(` @@ -499,12 +559,53 @@ optional_policy(`
udev_read_db(smbd_t) udev_read_db(smbd_t)
') ')
@ -98593,7 +98627,7 @@ index 2b7c441e7..0f95635dd 100644
allow nmbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow nmbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow nmbd_t self:fd use; allow nmbd_t self:fd use;
allow nmbd_t self:fifo_file rw_fifo_file_perms; allow nmbd_t self:fifo_file rw_fifo_file_perms;
@@ -512,9 +612,11 @@ allow nmbd_t self:msg { send receive }; @@ -512,9 +613,11 @@ allow nmbd_t self:msg { send receive };
allow nmbd_t self:msgq create_msgq_perms; allow nmbd_t self:msgq create_msgq_perms;
allow nmbd_t self:sem create_sem_perms; allow nmbd_t self:sem create_sem_perms;
allow nmbd_t self:shm create_shm_perms; allow nmbd_t self:shm create_shm_perms;
@ -98608,7 +98642,7 @@ index 2b7c441e7..0f95635dd 100644
manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t) manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t)
manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t) manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t)
@@ -526,20 +628,17 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) @@ -526,20 +629,17 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t) manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t)
@ -98634,7 +98668,7 @@ index 2b7c441e7..0f95635dd 100644
kernel_getattr_core_if(nmbd_t) kernel_getattr_core_if(nmbd_t)
kernel_getattr_message_if(nmbd_t) kernel_getattr_message_if(nmbd_t)
@@ -547,53 +646,44 @@ kernel_read_kernel_sysctls(nmbd_t) @@ -547,53 +647,44 @@ kernel_read_kernel_sysctls(nmbd_t)
kernel_read_network_state(nmbd_t) kernel_read_network_state(nmbd_t)
kernel_read_software_raid_state(nmbd_t) kernel_read_software_raid_state(nmbd_t)
kernel_read_system_state(nmbd_t) kernel_read_system_state(nmbd_t)
@ -98703,7 +98737,7 @@ index 2b7c441e7..0f95635dd 100644
') ')
optional_policy(` optional_policy(`
@@ -606,18 +696,29 @@ optional_policy(` @@ -606,18 +697,29 @@ optional_policy(`
######################################## ########################################
# #
@ -98739,7 +98773,7 @@ index 2b7c441e7..0f95635dd 100644
samba_read_config(smbcontrol_t) samba_read_config(smbcontrol_t)
samba_search_var(smbcontrol_t) samba_search_var(smbcontrol_t)
@@ -627,39 +728,38 @@ domain_use_interactive_fds(smbcontrol_t) @@ -627,39 +729,38 @@ domain_use_interactive_fds(smbcontrol_t)
dev_read_urand(smbcontrol_t) dev_read_urand(smbcontrol_t)
@ -98791,7 +98825,7 @@ index 2b7c441e7..0f95635dd 100644
allow smbmount_t samba_secrets_t:file manage_file_perms; allow smbmount_t samba_secrets_t:file manage_file_perms;
@@ -668,26 +768,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) @@ -668,26 +769,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t)
manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t)
files_var_filetrans(smbmount_t, samba_var_t, dir, "samba") files_var_filetrans(smbmount_t, samba_var_t, dir, "samba")
@ -98827,7 +98861,7 @@ index 2b7c441e7..0f95635dd 100644
fs_getattr_cifs(smbmount_t) fs_getattr_cifs(smbmount_t)
fs_mount_cifs(smbmount_t) fs_mount_cifs(smbmount_t)
@@ -699,58 +795,77 @@ fs_read_cifs_files(smbmount_t) @@ -699,58 +796,77 @@ fs_read_cifs_files(smbmount_t)
storage_raw_read_fixed_disk(smbmount_t) storage_raw_read_fixed_disk(smbmount_t)
storage_raw_write_fixed_disk(smbmount_t) storage_raw_write_fixed_disk(smbmount_t)
@ -98920,7 +98954,7 @@ index 2b7c441e7..0f95635dd 100644
manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t) manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t)
manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t) manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t)
@@ -759,17 +874,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) @@ -759,17 +875,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir })
manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t) manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t)
files_pid_filetrans(swat_t, swat_var_run_t, file) files_pid_filetrans(swat_t, swat_var_run_t, file)
@ -98944,7 +98978,7 @@ index 2b7c441e7..0f95635dd 100644
kernel_read_kernel_sysctls(swat_t) kernel_read_kernel_sysctls(swat_t)
kernel_read_system_state(swat_t) kernel_read_system_state(swat_t)
@@ -777,36 +888,25 @@ kernel_read_network_state(swat_t) @@ -777,36 +889,25 @@ kernel_read_network_state(swat_t)
corecmd_search_bin(swat_t) corecmd_search_bin(swat_t)
@ -98987,7 +99021,7 @@ index 2b7c441e7..0f95635dd 100644
auth_domtrans_chk_passwd(swat_t) auth_domtrans_chk_passwd(swat_t)
auth_use_nsswitch(swat_t) auth_use_nsswitch(swat_t)
@@ -818,10 +918,11 @@ logging_send_syslog_msg(swat_t) @@ -818,10 +919,11 @@ logging_send_syslog_msg(swat_t)
logging_send_audit_msgs(swat_t) logging_send_audit_msgs(swat_t)
logging_search_logs(swat_t) logging_search_logs(swat_t)
@ -99001,7 +99035,7 @@ index 2b7c441e7..0f95635dd 100644
optional_policy(` optional_policy(`
cups_read_rw_config(swat_t) cups_read_rw_config(swat_t)
cups_stream_connect(swat_t) cups_stream_connect(swat_t)
@@ -840,17 +941,20 @@ optional_policy(` @@ -840,17 +942,20 @@ optional_policy(`
# Winbind local policy # Winbind local policy
# #
@ -99028,7 +99062,7 @@ index 2b7c441e7..0f95635dd 100644
allow winbind_t samba_etc_t:dir list_dir_perms; allow winbind_t samba_etc_t:dir list_dir_perms;
read_files_pattern(winbind_t, samba_etc_t, samba_etc_t) read_files_pattern(winbind_t, samba_etc_t, samba_etc_t)
@@ -860,9 +964,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) @@ -860,9 +965,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t)
filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file) filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file)
manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t) manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t)
@ -99039,7 +99073,7 @@ index 2b7c441e7..0f95635dd 100644
manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t) manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t)
manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t) manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t)
@@ -870,41 +972,46 @@ manage_files_pattern(winbind_t, samba_var_t, samba_var_t) @@ -870,41 +973,46 @@ manage_files_pattern(winbind_t, samba_var_t, samba_var_t)
manage_lnk_files_pattern(winbind_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(winbind_t, samba_var_t, samba_var_t)
manage_sock_files_pattern(winbind_t, samba_var_t, samba_var_t) manage_sock_files_pattern(winbind_t, samba_var_t, samba_var_t)
files_var_filetrans(winbind_t, samba_var_t, dir, "samba") files_var_filetrans(winbind_t, samba_var_t, dir, "samba")
@ -99098,7 +99132,7 @@ index 2b7c441e7..0f95635dd 100644
corenet_tcp_connect_smbd_port(winbind_t) corenet_tcp_connect_smbd_port(winbind_t)
corenet_tcp_connect_epmap_port(winbind_t) corenet_tcp_connect_epmap_port(winbind_t)
corenet_tcp_connect_all_unreserved_ports(winbind_t) corenet_tcp_connect_all_unreserved_ports(winbind_t)
@@ -912,38 +1019,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) @@ -912,38 +1020,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t)
dev_read_sysfs(winbind_t) dev_read_sysfs(winbind_t)
dev_read_urand(winbind_t) dev_read_urand(winbind_t)
@ -99157,7 +99191,7 @@ index 2b7c441e7..0f95635dd 100644
') ')
optional_policy(` optional_policy(`
@@ -959,31 +1080,36 @@ optional_policy(` @@ -959,31 +1081,36 @@ optional_policy(`
# Winbind helper local policy # Winbind helper local policy
# #
@ -99201,7 +99235,7 @@ index 2b7c441e7..0f95635dd 100644
optional_policy(` optional_policy(`
apache_append_log(winbind_helper_t) apache_append_log(winbind_helper_t)
@@ -997,25 +1123,38 @@ optional_policy(` @@ -997,25 +1124,38 @@ optional_policy(`
######################################## ########################################
# #
@ -102451,7 +102485,7 @@ index 35ad2a733..afdc7da29 100644
+ admin_pattern($1, mail_spool_t) + admin_pattern($1, mail_spool_t)
') ')
diff --git a/sendmail.te b/sendmail.te diff --git a/sendmail.te b/sendmail.te
index 12700b413..debacc88b 100644 index 12700b413..e28f69e3e 100644
--- a/sendmail.te --- a/sendmail.te
+++ b/sendmail.te +++ b/sendmail.te
@@ -37,21 +37,23 @@ role sendmail_unconfined_roles types unconfined_sendmail_t; @@ -37,21 +37,23 @@ role sendmail_unconfined_roles types unconfined_sendmail_t;
@ -102594,7 +102628,18 @@ index 12700b413..debacc88b 100644
') ')
optional_policy(` optional_policy(`
@@ -164,6 +171,10 @@ optional_policy(` @@ -143,6 +150,10 @@ optional_policy(`
')
optional_policy(`
+ dbus_system_bus_client(sendmail_t)
+')
+
+optional_policy(`
dovecot_write_inherited_tmp_files(sendmail_t)
')
@@ -164,6 +175,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -102605,7 +102650,7 @@ index 12700b413..debacc88b 100644
milter_stream_connect_all(sendmail_t) milter_stream_connect_all(sendmail_t)
') ')
@@ -172,6 +183,11 @@ optional_policy(` @@ -172,6 +187,11 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -102617,7 +102662,7 @@ index 12700b413..debacc88b 100644
postfix_domtrans_postdrop(sendmail_t) postfix_domtrans_postdrop(sendmail_t)
postfix_domtrans_master(sendmail_t) postfix_domtrans_master(sendmail_t)
postfix_domtrans_postqueue(sendmail_t) postfix_domtrans_postqueue(sendmail_t)
@@ -193,6 +209,10 @@ optional_policy(` @@ -193,6 +213,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -102628,7 +102673,7 @@ index 12700b413..debacc88b 100644
udev_read_db(sendmail_t) udev_read_db(sendmail_t)
') ')
@@ -206,8 +226,6 @@ optional_policy(` @@ -206,8 +230,6 @@ optional_policy(`
# #
optional_policy(` optional_policy(`
@ -104096,7 +104141,7 @@ index e0644b5cf..ea347ccd5 100644
domain_system_change_exemption($1) domain_system_change_exemption($1)
role_transition $2 fsdaemon_initrc_exec_t system_r; role_transition $2 fsdaemon_initrc_exec_t system_r;
diff --git a/smartmon.te b/smartmon.te diff --git a/smartmon.te b/smartmon.te
index 9cf6582d2..d0be162c8 100644 index 9cf6582d2..97d1e6d7c 100644
--- a/smartmon.te --- a/smartmon.te
+++ b/smartmon.te +++ b/smartmon.te
@@ -38,7 +38,7 @@ ifdef(`enable_mls',` @@ -38,7 +38,7 @@ ifdef(`enable_mls',`
@ -104108,7 +104153,7 @@ index 9cf6582d2..d0be162c8 100644
dontaudit fsdaemon_t self:capability sys_tty_config; dontaudit fsdaemon_t self:capability sys_tty_config;
allow fsdaemon_t self:process { getcap setcap signal_perms }; allow fsdaemon_t self:process { getcap setcap signal_perms };
allow fsdaemon_t self:fifo_file rw_fifo_file_perms; allow fsdaemon_t self:fifo_file rw_fifo_file_perms;
@@ -58,23 +58,31 @@ kernel_read_network_state(fsdaemon_t) @@ -58,23 +58,32 @@ kernel_read_network_state(fsdaemon_t)
kernel_read_software_raid_state(fsdaemon_t) kernel_read_software_raid_state(fsdaemon_t)
kernel_read_system_state(fsdaemon_t) kernel_read_system_state(fsdaemon_t)
@ -104123,6 +104168,7 @@ index 9cf6582d2..d0be162c8 100644
+ +
dev_read_sysfs(fsdaemon_t) dev_read_sysfs(fsdaemon_t)
dev_read_urand(fsdaemon_t) dev_read_urand(fsdaemon_t)
+dev_read_nvme(fsdaemon_t)
domain_use_interactive_fds(fsdaemon_t) domain_use_interactive_fds(fsdaemon_t)
@ -104142,7 +104188,7 @@ index 9cf6582d2..d0be162c8 100644
storage_raw_read_fixed_disk(fsdaemon_t) storage_raw_read_fixed_disk(fsdaemon_t)
storage_raw_write_fixed_disk(fsdaemon_t) storage_raw_write_fixed_disk(fsdaemon_t)
storage_raw_read_removable_device(fsdaemon_t) storage_raw_read_removable_device(fsdaemon_t)
@@ -83,7 +91,9 @@ storage_write_scsi_generic(fsdaemon_t) @@ -83,7 +92,9 @@ storage_write_scsi_generic(fsdaemon_t)
term_dontaudit_search_ptys(fsdaemon_t) term_dontaudit_search_ptys(fsdaemon_t)
@ -104153,7 +104199,7 @@ index 9cf6582d2..d0be162c8 100644
init_read_utmp(fsdaemon_t) init_read_utmp(fsdaemon_t)
@@ -92,12 +102,13 @@ libs_exec_lib_files(fsdaemon_t) @@ -92,12 +103,14 @@ libs_exec_lib_files(fsdaemon_t)
logging_send_syslog_msg(fsdaemon_t) logging_send_syslog_msg(fsdaemon_t)
@ -104164,11 +104210,12 @@ index 9cf6582d2..d0be162c8 100644
userdom_dontaudit_use_unpriv_user_fds(fsdaemon_t) userdom_dontaudit_use_unpriv_user_fds(fsdaemon_t)
userdom_dontaudit_search_user_home_dirs(fsdaemon_t) userdom_dontaudit_search_user_home_dirs(fsdaemon_t)
+userdom_dontaudit_manage_admin_dir(fsdaemon_t)
+userdom_use_user_terminals(fsdaemon_t) +userdom_use_user_terminals(fsdaemon_t)
tunable_policy(`smartmon_3ware',` tunable_policy(`smartmon_3ware',`
allow fsdaemon_t self:process setfscreate; allow fsdaemon_t self:process setfscreate;
@@ -116,9 +127,9 @@ optional_policy(` @@ -116,9 +129,9 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -112077,10 +112124,10 @@ index 000000000..d371f62f6
+') +')
diff --git a/thumb.te b/thumb.te diff --git a/thumb.te b/thumb.te
new file mode 100644 new file mode 100644
index 000000000..6c04973ea index 000000000..a82cab79b
--- /dev/null --- /dev/null
+++ b/thumb.te +++ b/thumb.te
@@ -0,0 +1,176 @@ @@ -0,0 +1,177 @@
+policy_module(thumb, 1.0.0) +policy_module(thumb, 1.0.0)
+ +
+######################################## +########################################
@ -112169,6 +112216,7 @@ index 000000000..6c04973ea
+domain_dontaudit_read_all_domains_state(thumb_t) +domain_dontaudit_read_all_domains_state(thumb_t)
+ +
+files_read_non_security_files(thumb_t) +files_read_non_security_files(thumb_t)
+files_map_non_security_files(thumb_t)
+ +
+fs_getattr_all_fs(thumb_t) +fs_getattr_all_fs(thumb_t)
+fs_read_dos_files(thumb_t) +fs_read_dos_files(thumb_t)

23
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.13.1 Version: 3.13.1
Release: 308%{?dist} Release: 309%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -717,6 +717,27 @@ exit 0
%endif %endif
%changelog %changelog
* Fri Jan 05 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-309
- auth_use_nsswitch() interface cannot be used for attributes fixing munin policy
- Allow git_script_t to mmap git_user_content_t files BZ(1530937)
- Allow certmonger domain to create temp files BZ(1530795)
- Improve interface mock_read_lib_files() to include also symlinks. BZ(1530563)
- Allow fsdaemon_t to read nvme devices BZ(1530018)
- Dontaudit fsdaemon_t to write to admin homedir. BZ(153030)
- Update munin plugin policy BZ(1528471)
- Allow sendmail_t domain to be system dbusd client BZ(1478735)
- Allow amanda_t domain to getattr on tmpfs filesystem BZ(1527645)
- Allow named file transition to create rpmrebuilddb dir with proper SELinux context BZ(1461313)
- Dontaudit httpd_passwd_t domain to read state of systemd BZ(1522672)
- Allow thumb_t to mmap non security files BZ(1517393)
- Allow smbd_t to mmap files with label samba_share_t BZ(1530453)
- Fix broken sysnet_filetrans_named_content() interface
- Allow init_t to create tcp sockets for unconfined services BZ(1366968)
- Allow xdm_t to getattr on xserver_t process files BZ(1506116)
- Allow domains which can create resolv.conf file also create it in systemd_resolved_var_run_t dir BZ(1530297)
- Allow X userdomains to send dgram msgs to xserver_t BZ(1515967)
- Add interface files_map_non_security_files()
* Thu Jan 04 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-308 * Thu Jan 04 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-308
- Make working SELinux sandbox with Wayland. BZ(1474082) - Make working SELinux sandbox with Wayland. BZ(1474082)
- Allow postgrey_t domain to mmap postgrey_spool_t files BZ(1529169) - Allow postgrey_t domain to mmap postgrey_spool_t files BZ(1529169)