From b3dccbc4b20aec4efec00484f776cf12dc80bdbc Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Sat, 18 Mar 2017 16:12:18 +0100 Subject: [PATCH] * Sat Mar 18 2017 Lukas Vrabec - 3.13.1-246 - Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555) --- container-selinux.tgz | Bin 6463 -> 6461 bytes policy-rawhide-base.patch | 11 +++++------ selinux-policy.spec | 5 ++++- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/container-selinux.tgz b/container-selinux.tgz index 870f0c0895175d5d86a0ac40154444db037b6e60..0fd402a22404770af8ba5f4f17b9f25ceef6dfe1 100644 GIT binary patch delta 4907 zcmV+`6V&X#GQBc?ABzY8+e^(@00Zq^ZI9eIa^A1gze2DV@XW$9V~^Kfz}~yyup1!x z5MXh4Kt5!XUbV#T){fp*QqM~a-)~P<@kNwGQj}U_J4p+$XGW@eSSpgmVzEd?Mc#x- z&Z?_q`^^(wui$$3?tA?C`iHl#^q+9Od2{pq+izaKdG!u|fBE6fn{QsdeslBs?Ki=z zrxHlN4s{b&LGVp_SA`oES?R`}|1Z5(&z}cB)`u($tH(e8eb0iTWcg)X9IA)~VOge0 z6gEkb2a#+j0n2yr^XkWI$+iLzzpGOk{Bicr4=g$~OhZrdpxNs;;v$1zu88$o;|+c+ z!z#>zJj~dCpPq55XMY})@H0IK!Za=JSsXM)&{SbwC-_n(&}%}4-&aZAuxcAd?EE(+ z&AK||O_H%Slt(x(UjDW^+p&CIu|Ez;1+=TPv*xkX-azp*FAX;tXkguZaByYiwkC=f z7pv7-R8%a=;&si!D%!6%Nq+wA>xUlL;a1))YP3On;-`9qo$}5 zR!`7>w6ouMG;Onrg;GE)9|hlq6_U2PrSgMsUz=#&!+Qn-AAVhztjcO&+$JfjWx;}) zYGh&4^|h&*8r0`hw55S7z9TjMR~E)SbyL-TaYa`k7`-8hGfUmpHhM_W63AcgoZLg}X;L@XwrxrmK!#g?K2Hiky;jTZBd>wr(BhjABwh8!S zteeCb>o8AhC5<)sHMs&>J)%*2nrd{I%O}=pp;H^JR-|a zebVfM5C{(qXt+tDfZo2HJb<}Fx=^!&WtH4vIY{{#E3}6!q*$XA27HXh(5n<%vcy~| zXuKoR(v+e&?>b7uy0#QW&xU1fm?$ouQXc-3O9Lx^djtQzU)DeSkrFr1o~8#`5E}kP>UbzZ$gR-$J40koc_MLDFL9 zVAaM#3&p<3SicR3K~W64GSY7u8j<8>@Jv0s0={P#vvJ}gx}6VF1NV9$5#F7H2Clx2 za~Y)xRPTHw{%#9MGD|lcqlo5dwkJU?FrfMEz+a|jXhVOYCMprqhp1D$Z2m40gtKcA zVJ6N%5t9)N)j1R6G6i#2>n+RE|2G8k+Sb2Kc2_LFTM~6&)J?rKAkEhn#H?6dq<2@S zfkj|>P1WECY>EfA%~X%AG2x)Iq%y<%bvC@e{qj>QL;W?kzB2M| zfk=yf8T{~#%kbMY03uX|H?0)LMhlJb9WxE9f%NN!@F~%<4h4?vFoe`XPfK!>-Bl)?Wcdc-NRl`rUx*w-p-Jh6Wqu2eKx(r7;3Y> zP(=a8O>xNMnmP=wrY>X4_=2#4KO!%;6>-)Yg#Ly@Dj2?wcROJe4D&|=ycjdMF2Lo4 z0j+v03wT}bsV4QZiR}yLp10!8&5L%qew>ak;`J*BIM z4yn2;*fyut%&RZ7X{_?LtJLAxVTPWwMU z$Hgb=>#T?mDLYrK;brjp>ebb&i&d}p@+3h%HxH_!Xo}mZj@IgV@G}FPiuRR)#afYJ ziCGB$HoIae~uNU^{)4gUVqFF{#UjmqFCh1GxJ==d_t zArCkDt18DHoV}O9HcV@F(Gy8X#C<}s2&Kn~q4Z3o4ezSrPzL8BsBs}|riT<_Nap~p z95z1~UN;HR&!jO4OsUgt>rzWsj`F$UkYz=_<|D(op(NM-HqN!K51ZfDFziSBFyGPB zi~>O>IK_niswan<4x7ZYOSga0hZ<2T-Z~c}3rZkz*47nGYHCT{S0|sQb=Ao44K%NZ zm4@_Qx_1U{^!L)Hu-#08^Ul*@J5mA9u83M9496pNnd79!B$h6mOl*-$jQEq^L_U}u zocH;MxH7ogMQ&r!Tu$*fy}B_lYz%&PF=arUBc?Kq<-E^jLK_Gug6Mz!+>G-clcR@c z<)D}2Embq{M-Q>X>O{sRwE;F?YEL9C}ok2HXjOM?9`z8t!VAZr?{?8E%p^ zX&!@*L9{RK^WZjtVSfw10ob-?O%ey$ZC=Cy3QLO~^xKm-3Q`#K^*(G3cE#_^_?|39?6}APVbvJRl|T#=EM`-~DJxYz%O? z;IXpl8NnYNnV~@>&%YX}97~X|UB#NlI$Q`tEmSi(RW z5hxB|j|Ut+6W{@pS`eGWrIx$KCi|RcyZ~XlklKeXhkumBmY754 zCfx4(+Ui^Ij7_5Tuz+i>%{<6_HBfgqSG$^2pL8S+0VcZ^X)msKQL~)&1E2Nz5mSU? zkst^SS^EQY$8_U>^nVP55L%KKO|pG-$4ioY&(I>rT7J;T8!0K5j{%M7^WLxQRl9G&7cPa@VYUf- zDvuIxRT8OJ^%W51G_4cMxY|iwV=`NnAP!_9Wo+S-?h=B3ez!&lEbKH+i)0xZvgvC* z7J2y*IC5ln5pkEHT{J>h!!j;8kD&H*BTV!es21pK94~AoZ$ zD|UWR6Ls5ifQ>Paa6u!-bxZ5HP#3G`I$^uPX;M+t6-L))IGJPNgZC&8x6ec=yW&{c zs>`}YR-%@F*@3?F(r4>1P$RT(JrA};g^L^lpgmZ8-LWp_pszghN}c3tvPh%CF^B3j{|Crw^;N%YxR0Kf~#%=1%WdqG+dv^m1se zda^FI+};o_iZHHt+lN%aWgn&6gJ7*b2a&gqhr-kzf`ZUIYEOMfzja=a8`q-p+x*KW zoup8IH*#xPy7r6g=EayPm*4SejknFNNjdvQ(vkJ82|n*AFaGs_k@LL7F^V&etI|0q z9?qoPa0{Ha{I3oT`=Fn#V)ZNJ;r%1KA;!Nz;CeQ?F=8Qj=T?S=%5d#!IJOA)1_vMX z@l6hvPeF{B{bRokLGkt}J8h;Z&M%K%we{YAP6tEeN|CxU8x@h3t|kv(F@pJ}>?!i` zY%WDQ)8I9IYxg|(iJ$D3KJqgo68`xO7_`BiMq_-1pD7CrzUvxHdYN{D$QR<&2!0%+ zUM#=E2M6>$$vgYd-+ItH+>w8Rp>I|P*+)3ff$4U1%MVXte4MAERJxtCmr19hnv0cx zp;?+{g-$O-BO4haMo*m+a}|^QADVuCc%&!wP0&3;FBlG3GY{=M?!-V>uGge&s`+Q| z%{Y7S*faN*J8N%lcALj0*^UvG(aioGuWhlONL@>vRDT#Ob<<5%GUQe@ep}m`3447S z{~aKW|A~Ojgp&Z93Hw$|(vHwMw*@tS{wMv>*epYM{RE%Jo`=)e(~ufR`cZE%wr-ng z`ls=CZp`in}_UR6un! zE-8)UtjKFO@9*QB-Q@S-d8mfdpJkDw>s}b|Z$C0>F>Bgrr|3WUt*gwrw|-)!3Gx zlSI{Dn>Hq4_12B89oer{q0m(9_!c62w5G1>*gp4n@QtrFHDAqVjg(AR+b8?Bjr;pQ zuYP#@?)BjNKd)b(zW?(%u4_DhUHZ?K%6(IT$(jODykaMufF>g zPcHUXB0mFp99W(?=a1}vFEkxDw+t|@*-mXoEB{{ue6b@%|t004%8n3Vtk delta 4909 zcmV+|6VmLxGQTo^ABzY8j}OdP00Zq^ZI9eGlFrxZUm@55JQLV6<8kZ&c6JYovwN|uCIT1_xjy8*RS8)yng*n zaQ##Q>DQrd!YT;9N$;v~!y+r)*z^CT*XsH6;K%xqWnuOB=fCe+P?RixRTqaUVnJAz zX%dA^QshA-8%n_P9sFMYcqQ3Z0OEIbN`pVn{`rALhlXkBNggzN{YG45@Q+Jkz0!Dt zAIq=`vmg(DGxn!voa))12POPW4}vgFi+dIaO%XIznAZuulnL~TP~qRJByU)?4I_5` zo04W-9r7m0*c!?soEI;DTb=D#zOL9Ghol19)!A9|SZZ&ec$$}nn+!CtZaz4;vT|D! z#fyv8>MSZM7G?3eW?>cW*PA3i|MvC8>P!l>F2e?Ys#Sk<_O>X@iPG82j_go>qcSyhr^zOWLHwvG zs)W^l6EyAYHy%yftYV=Q5X(owcVUI3t!}CO;M>z!l$-8viQ`qA6D#Z(mDy`uXj%Fq4hMW8*JM)r3)Z`!!4gG8|O~*+t~>I6+Wo$zfiBo@wqNp zlx!2IAYPF;wz7fAqcUUOAdvsa!TkyC;BgJbV%cV>+@SP-3-fT-A4tBAK9-SaPiET$ z{4v%|VvKc|C$*Bs8vL4E0j(ax&V_CW}QhXypz`)XF*EfRxVC{SgYcR$t*%c3To8baznJLE}2>TfHG zW5>eLk_GYFN|3x_X@Sl7NoG;4+k%6aU|8;Bl!W6L=A)V<@9`&4Ekn&n zN4SJQfod4Q#GjITbyh+Xs|xG^BN5U?rdeSg2lrKCa4o-ELVnk5h;6poec&XD~6|c&MSVHIHN-u`hI$DtkyzwK2OZ z8w&2@LsS(0lU)QIe;3P}DXPY6Sdv5K#4t(i?Ldv?$7>-a)`EXEXv4pSLd_xZS-*p% z#m>R1jfED9eUY(#8xVt{7<6T%-!e2J$;;rGdUgqX&n{-;#6@&FAEXBE^*|!LI|mJ1 zeI4gjlqOKU^O5+wEg;D(-EfQ|ny1;G1hv3`=C=cXnVO*ue}$T;L`WZ^PVut&yF?Jq zu0@2II0HpYMle+8OpI44n7dkUS)TsCA&}R${%x|mWcl5asQaRB>ZJi`zP2D{#p)ux zyF?8v0?TWv21j61Jg{Y6pJSp^yC7Tv^M^EiTpsaeLCCNvvP9Yda9k=Fwbx;sB{?69 za3RRnefVG{e~~WL13)`6^i$-yjBhBX17AJ}190>og1P~hB%|?#HDBC+=F*_Qfl|*- z12Il;EvX-tNpx3|Srci?Jjf5aC+*Zn<_Tes^Sz7-2c0FA8Q!n6;r;EGpIRB}uetS= zk#`G3TJ+1{$2Ts+Z_|`(4YHDh!r#2^P2marJ!(kGf5YhlAy!iySvxQ1;8n(87skB!z?1Mjj%-Qk_#tOfjZ^Mjr7K6ht4 z!vG@I5`2V7dIj1D>SULPDethsrw`KtGEf+ePG&+Wn0sZzg`h28So_2nzlcco_)*Iq z0K77ge_ML`XY6!=!vl^UjuII1U=b^Wsf9`eai@~b-AaS)XOHeFPwYciaR$i+U5FjI=+b4mc(mA6N?Akx_PZFn7pl0dxxCH zf0RK@oZe#xk};>OCyO7FF~zDy>OWRUZYY)IV?@HI4v~hb5SrIGh?4em87yk=<^uGT zt{yt1>aJkhoK`chzR;$z%G<6|hhv8=p5sC>PrY4p^W!trX&Ds#A33k88_JW~;sjg^ zS$yd+8sD9FJ(O=GCLwLPWhO{8q_;1?Nmo=^*s2Q0Zv8xO2J~S z$gsq$jzoe+DN-{SCOCjJ!Tp|r?W^=;gpiyo8D*qcV44Ph|LK>YEUHFjaFoJoe{pnt zndXp(8~s(4V-L>W%U~O(HM{7EBqZWKp;&~{9%#Lr7K7ITye;3v=i;)E-5IJk>iY7I+r0%PePt&?;98HCfM-`kEfI#}k-E%rQezTJ7fvR&$R$SncT4FkrO1f2x_NFy7{bdezAko~1jrNmn#c1Y%MeVg>36YIo*Gv|RzQ`} z1pIu!XizkaoCEdJy$>slM^xslp})`jEK|q-b{vNu6{Z1qLf{dPE0~76nx)(KQCNnX zBu$#f;A0T&i~BsdO<>sH!oL7)TeBvKgX}gh;sAxEMGyMdlQs%c7%_S0~+_<8V`IOaK1S$NAj z2@QJ|-3IqXb$bb9|5B7}dq~qq3<-kgQYb={y4C@S(8K6-+pMI7w@xw&Y+ioC*h8NNMd(%!$9m4T%qp?c_BYlcn3&%bM&Cq z>ySKQ86qNHPu7m7Gy2*?HwRf<4uhM~?w1Vs_>py(l?Y9W?O6()(dGNDRx!KNCjgc( zkVXWG!O@SsWWXuxZ#!XX--w~kUdDbk`Sy`cPmibUaHJg=Pd zZ>h7SPGU-h8l4}DdBPD4qtoL7htC9fz@!$$CUL3duCd8J=NT_R*e;~@q08YvN@7dQ zA#)RM_kC^kEqKNz(Rx_GHP>byWWE}xyPKoiW0mQD8HAd#8}B&+6$P)@=}31z=Hov*fec*{~XYxS4>j*OEh-W<^T2+>{KCAL9RZBFoinJ6k+-ZnfpGDt4v z+2IZ63R26#E3Pfbp(`Vk%tM{ZV>fr&zI?5#az;9OBeXe}D{+8@nyKF9WU6UcUtx6CFvXC;i@RRHkf`9&PjSyJaX`B|xGBjk< z*Lp1S@*{BM$nGNIEk?dL|A=rd3)(AhX%*h=0e6}tyNAs&6v7gnX> ze0)~y{GcZ4w&egDV;NsPIRrp^u=u)TUCcpWdFGWm$<<_$Od)5L zStMRlnl(*qTT>whuqz=hb| z3y98RJ7y=T>yWp>8TZECGAKqJO*)ld%c~X$juuWIR%w?7tqXsK(^Jiz-mgT_P7Ueh z&|39mU2M6%AzTz;T=BLKse;QsO1B5WT73>8ZygVXsXYV*p?TDv`i_3su3i-cers>j5L@d5L2bXB=0h zb51;*Nx9(`IBoe~9UAsQKU>A>SIEQrM|MMue}TaDY;n!hRBs7b!9dxA}w7_9=>7(^Gn%N zsidGHfI*)M(MXGSFa^BXW|gFB7J_!2);78rcjHJJ1=?F5l8#HkVd zI7Yo#euobZ=zEfP_MyM^pm(?<{{%zdtPZk|aGnFx?dX;tp2YY#PerM8J83VIPDM2r zD}O_?G|dW~UWi6EGDM7?Iw$5TCi_1${rvDqPwJbXdxTyv9I$2{+IQTEfv#MyN!e8M z&)}PJ_TI5)?k#uL-rVdqk4>^2BP^qt{X1UUVm*<%mO82aFj(rQo2q2Ut!n(Xwlx#> z`ZWGKKpOuO0hu8vYJdDs`lGQ~hVc3cK8-yOr?ICYHIDS7-e7Fq zHq-P|^Nrc|z2!w(RP3#jBhbi{sB@3T^L{*1B%io8kMQ;Vyx_?fy(7(KccBz_bvmhl z>S$b28pm0Y*KXe5$2q&n@5A#@4W~cLB1hM~Fy7yOWYl8Tw9!t{fACvZqcfE~v44ry z6BnC3u-2Z?gY@iio{_w4FDZr5cM0iphUysalp|fouqF(GFJ1<}wcj1pb1-e&ZY-;@ zEkP%Vs=qdEOv37|8(TZFU#mi)so3!?MD}P+UDvUF?(g6mUu|l>n$H?3nJ%|a_H7&Y z_kXT`c>C`4;QK$x^g-wDzG~ydJ>%)6tN~-s50~RO5 z*4NMlt`2o|l_ndUFkW$-tIO}sUcK^0lM^@bJy}FGf%2bapus4Fv`@YWbk<0lbq;;^;-AjEu_Ae* zG%29P5#8V@xYgBN$ln^*wKCfW$b{& zU)UT-*u||v5BPZF0Di&DLAqU6RdOPjBAC;a4R~C*UoXofp5%{=z*=GO2k`1;@Lq`& z-(^%N1_18l)l)$S%ifwD17OYVnP36vs~0-ZZXS-bBwu>Mf4WZB={jAf>vWy2({;K| f*XcT4r|Wc`uG4k8PS@%Be{=m0&;+jT0LTCUh!dob diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index 4a243058..e9c57db0 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -45289,14 +45289,14 @@ index a392fc4..b7497fc 100644 +') diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc new file mode 100644 -index 0000000..db8e9dc +index 0000000..121b422 --- /dev/null +++ b/policy/modules/system/systemd.fc @@ -0,0 +1,81 @@ +HOME_DIR/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_home_t,s0) +/root/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_home_t,s0) + -+/etc/hostname -- gen_context(system_u:object_r:hostname_etc_t,s0) ++/etc/.*hostname.* -- gen_context(system_u:object_r:hostname_etc_t,s0) +/etc/machine-info -- gen_context(system_u:object_r:hostname_etc_t,s0) +/etc/udev/.*hwdb.* -- gen_context(system_u:object_r:systemd_hwdb_etc_t,s0) + @@ -47185,10 +47185,10 @@ index 0000000..86e3d01 +') diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te new file mode 100644 -index 0000000..0100a56 +index 0000000..c9d14fd --- /dev/null +++ b/policy/modules/system/systemd.te -@@ -0,0 +1,1018 @@ +@@ -0,0 +1,1017 @@ +policy_module(systemd, 1.0.0) + +####################################### @@ -47888,8 +47888,7 @@ index 0000000..0100a56 + +manage_files_pattern(systemd_hostnamed_t, hostname_etc_t, hostname_etc_t) +manage_lnk_files_pattern(systemd_hostnamed_t, hostname_etc_t, hostname_etc_t) -+files_etc_filetrans(systemd_hostnamed_t, hostname_etc_t, file, "hostname" ) -+files_etc_filetrans(systemd_hostnamed_t, hostname_etc_t, file, "machine-info" ) ++files_etc_filetrans(systemd_hostnamed_t, hostname_etc_t, file) + +kernel_dgram_send(systemd_hostnamed_t) +kernel_read_xen_state(systemd_hostnamed_t) diff --git a/selinux-policy.spec b/selinux-policy.spec index 11ef4ec1..9090419a 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 245%{?dist} +Release: 246%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -682,6 +682,9 @@ exit 0 %endif %changelog +* Sat Mar 18 2017 Lukas Vrabec - 3.13.1-246 +- Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555) + * Fri Mar 17 2017 Lukas Vrabec - 3.13.1-245 - Allow vdagent domain to getattr cgroup filesystem - Allow abrt_dump_oops_t stream connect to sssd_t domain