rpms/selinux-policy
5
0
Fork 0
Code Issues Pull Requests Releases Activity

* Mon Nov 10 2014 Lukas Vrabec <lvrabec@redhat.com> 3.12.1-92

Browse Source 
- Add kdump_rw_inherited_kdumpctl_tmp_pipes()
- Added fixes related to linuxptp. BZ (1149693)
- Label keystone cgi files as keystone_cgi_script_exec_t. BZ(1138424
- Dontaudit policykit_auth_t to access to user home dirs. BZ (1157256)
- Fix seutil_dontaudit_access_check_load_policy()
- Add dontaudit interfaces for audit_access in seutil
- Label /etc/strongimcv as ipsec_conf_file_t.
This commit is contained in:
Lukas Vrabec 2014-11-10 18:19:50 +01:00
parent 062b36f481
commit b6161d4177
3 changed files with 221 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

117
policy-rawhide-base.patch
View File

@ -32228,10 +32228,10 @@ index 17eda24..d4113cc 100644
+ ') + ')
+ ') + ')
diff --git a/policy/modules/system/ipsec.fc b/policy/modules/system/ipsec.fc diff --git a/policy/modules/system/ipsec.fc b/policy/modules/system/ipsec.fc
index 662e79b..fc34e78 100644 index 662e79b..353c3b7 100644
--- a/policy/modules/system/ipsec.fc --- a/policy/modules/system/ipsec.fc
+++ b/policy/modules/system/ipsec.fc +++ b/policy/modules/system/ipsec.fc
@@ -1,14 +1,24 @@ @@ -1,14 +1,25 @@
/etc/rc\.d/init\.d/ipsec -- gen_context(system_u:object_r:ipsec_initrc_exec_t,s0) /etc/rc\.d/init\.d/ipsec -- gen_context(system_u:object_r:ipsec_initrc_exec_t,s0)
/etc/rc\.d/init\.d/racoon -- gen_context(system_u:object_r:ipsec_initrc_exec_t,s0) /etc/rc\.d/init\.d/racoon -- gen_context(system_u:object_r:ipsec_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/strongswan -- gen_context(system_u:object_r:ipsec_initrc_exec_t,s0) +/etc/rc\.d/init\.d/strongswan -- gen_context(system_u:object_r:ipsec_initrc_exec_t,s0)
@ -32251,13 +32251,14 @@ index 662e79b..fc34e78 100644
/etc/racoon/certs(/.*)? gen_context(system_u:object_r:ipsec_key_file_t,s0) /etc/racoon/certs(/.*)? gen_context(system_u:object_r:ipsec_key_file_t,s0)
+/etc/strongswan(/.*)? gen_context(system_u:object_r:ipsec_conf_file_t,s0) +/etc/strongswan(/.*)? gen_context(system_u:object_r:ipsec_conf_file_t,s0)
+/etc/strongimcv(/.*)? gen_context(system_u:object_r:ipsec_conf_file_t,s0)
+ +
/etc/ipsec\.d(/.*)? gen_context(system_u:object_r:ipsec_key_file_t,s0) /etc/ipsec\.d(/.*)? gen_context(system_u:object_r:ipsec_key_file_t,s0)
+/etc/strongswan/ipsec\.d(/.*)? gen_context(system_u:object_r:ipsec_key_file_t,s0) +/etc/strongswan/ipsec\.d(/.*)? gen_context(system_u:object_r:ipsec_key_file_t,s0)
/sbin/setkey -- gen_context(system_u:object_r:setkey_exec_t,s0) /sbin/setkey -- gen_context(system_u:object_r:setkey_exec_t,s0)
@@ -26,16 +36,26 @@ @@ -26,16 +37,26 @@
/usr/libexec/ipsec/pluto -- gen_context(system_u:object_r:ipsec_exec_t,s0) /usr/libexec/ipsec/pluto -- gen_context(system_u:object_r:ipsec_exec_t,s0)
/usr/libexec/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0) /usr/libexec/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0)
/usr/libexec/nm-openswan-service -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0) /usr/libexec/nm-openswan-service -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
@ -37267,10 +37268,35 @@ index d43f3b1..870bc36 100644
+/etc/share/selinux/targeted(/.*)? gen_context(system_u:object_r:semanage_store_t,s0) +/etc/share/selinux/targeted(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
+/etc/share/selinux/mls(/.*)? gen_context(system_u:object_r:semanage_store_t,s0) +/etc/share/selinux/mls(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
index 3822072..270bde3 100644 index 3822072..8686e0a 100644
--- a/policy/modules/system/selinuxutil.if --- a/policy/modules/system/selinuxutil.if
+++ b/policy/modules/system/selinuxutil.if +++ b/policy/modules/system/selinuxutil.if
@@ -192,11 +192,22 @@ interface(`seutil_domtrans_newrole',` @@ -135,6 +135,24 @@ interface(`seutil_exec_loadpolicy',`
########################################
## <summary>
+## Dontaudit access check on load_policy.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`seutil_dontaudit_access_check_load_policy',`
+ gen_require(`
+ type load_policy_exec_t;
+ ')
+
+ dontaudit $1 load_policy_exec_t:file audit_access;
+')
+
+########################################
+## <summary>
## Read the load_policy program file.
## </summary>
## <param name="domain">
@@ -192,11 +210,22 @@ interface(`seutil_domtrans_newrole',`
# #
interface(`seutil_run_newrole',` interface(`seutil_run_newrole',`
gen_require(` gen_require(`
@ -37295,7 +37321,7 @@ index 3822072..270bde3 100644
') ')
######################################## ########################################
@@ -359,6 +370,27 @@ interface(`seutil_exec_restorecon',` @@ -359,6 +388,27 @@ interface(`seutil_exec_restorecon',`
######################################## ########################################
## <summary> ## <summary>
@ -37323,7 +37349,7 @@ index 3822072..270bde3 100644
## Execute run_init in the run_init domain. ## Execute run_init in the run_init domain.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -425,11 +457,20 @@ interface(`seutil_init_script_domtrans_runinit',` @@ -425,11 +475,20 @@ interface(`seutil_init_script_domtrans_runinit',`
# #
interface(`seutil_run_runinit',` interface(`seutil_run_runinit',`
gen_require(` gen_require(`
@ -37347,7 +37373,7 @@ index 3822072..270bde3 100644
') ')
######################################## ########################################
@@ -461,11 +502,19 @@ interface(`seutil_run_runinit',` @@ -461,11 +520,19 @@ interface(`seutil_run_runinit',`
# #
interface(`seutil_init_script_run_runinit',` interface(`seutil_init_script_run_runinit',`
gen_require(` gen_require(`
@ -37370,7 +37396,7 @@ index 3822072..270bde3 100644
') ')
######################################## ########################################
@@ -535,6 +584,53 @@ interface(`seutil_run_setfiles',` @@ -535,6 +602,53 @@ interface(`seutil_run_setfiles',`
######################################## ########################################
## <summary> ## <summary>
@ -37424,7 +37450,32 @@ index 3822072..270bde3 100644
## Execute setfiles in the caller domain. ## Execute setfiles in the caller domain.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -680,10 +776,115 @@ interface(`seutil_manage_config',` @@ -555,6 +669,24 @@ interface(`seutil_exec_setfiles',`
########################################
## <summary>
+## Dontaudit access check on setfiles.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`seutil_dontaudit_access_check_setfiles',`
+ gen_require(`
+ type setfiles_exec_t;
+ ')
+
+ dontaudit $1 setfiles_exec_t:file audit_access;
+')
+
+########################################
+## <summary>
## Do not audit attempts to search the SELinux
## configuration directory (/etc/selinux).
## </summary>
@@ -680,10 +812,115 @@ interface(`seutil_manage_config',`
') ')
files_search_etc($1) files_search_etc($1)
@ -37540,7 +37591,7 @@ index 3822072..270bde3 100644
####################################### #######################################
## <summary> ## <summary>
## Create, read, write, and delete ## Create, read, write, and delete
@@ -694,15 +895,62 @@ interface(`seutil_manage_config',` @@ -694,15 +931,62 @@ interface(`seutil_manage_config',`
## Domain allowed access. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
@ -37606,7 +37657,7 @@ index 3822072..270bde3 100644
') ')
######################################## ########################################
@@ -746,6 +994,29 @@ interface(`seutil_read_default_contexts',` @@ -746,6 +1030,29 @@ interface(`seutil_read_default_contexts',`
read_files_pattern($1, default_context_t, default_context_t) read_files_pattern($1, default_context_t, default_context_t)
') ')
@ -37636,7 +37687,7 @@ index 3822072..270bde3 100644
######################################## ########################################
## <summary> ## <summary>
## Create, read, write, and delete the default_contexts files. ## Create, read, write, and delete the default_contexts files.
@@ -784,7 +1055,9 @@ interface(`seutil_read_file_contexts',` @@ -784,7 +1091,9 @@ interface(`seutil_read_file_contexts',`
files_search_etc($1) files_search_etc($1)
allow $1 { selinux_config_t default_context_t }:dir search_dir_perms; allow $1 { selinux_config_t default_context_t }:dir search_dir_perms;
@ -37646,7 +37697,7 @@ index 3822072..270bde3 100644
') ')
######################################## ########################################
@@ -999,6 +1272,26 @@ interface(`seutil_domtrans_semanage',` @@ -999,6 +1308,26 @@ interface(`seutil_domtrans_semanage',`
######################################## ########################################
## <summary> ## <summary>
@ -37673,7 +37724,7 @@ index 3822072..270bde3 100644
## Execute semanage in the semanage domain, and ## Execute semanage in the semanage domain, and
## allow the specified role the semanage domain, ## allow the specified role the semanage domain,
## and use the caller's terminal. ## and use the caller's terminal.
@@ -1017,11 +1310,67 @@ interface(`seutil_domtrans_semanage',` @@ -1017,11 +1346,67 @@ interface(`seutil_domtrans_semanage',`
# #
interface(`seutil_run_semanage',` interface(`seutil_run_semanage',`
gen_require(` gen_require(`
@ -37743,7 +37794,7 @@ index 3822072..270bde3 100644
') ')
######################################## ########################################
@@ -1043,7 +1392,11 @@ interface(`seutil_manage_module_store',` @@ -1043,7 +1428,11 @@ interface(`seutil_manage_module_store',`
files_search_etc($1) files_search_etc($1)
manage_dirs_pattern($1, selinux_config_t, semanage_store_t) manage_dirs_pattern($1, selinux_config_t, semanage_store_t)
manage_files_pattern($1, semanage_store_t, semanage_store_t) manage_files_pattern($1, semanage_store_t, semanage_store_t)
@ -37755,7 +37806,32 @@ index 3822072..270bde3 100644
') ')
####################################### #######################################
@@ -1137,3 +1490,122 @@ interface(`seutil_dontaudit_libselinux_linked',` @@ -1067,6 +1456,24 @@ interface(`seutil_get_semanage_read_lock',`
#######################################
## <summary>
+## Dontaudit access check on module store
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`seutil_dontaudit_access_check_semanage_read_lock',`
+ gen_require(`
+ type semanage_read_lock_t;
+ ')
+
+ dontaudit $1 semanage_read_lock_t:file audit_access;
+')
+
+#######################################
+## <summary>
## Get trans lock on module store
## </summary>
## <param name="domain">
@@ -1137,3 +1544,122 @@ interface(`seutil_dontaudit_libselinux_linked',`
selinux_dontaudit_get_fs_mount($1) selinux_dontaudit_get_fs_mount($1)
seutil_dontaudit_read_config($1) seutil_dontaudit_read_config($1)
') ')
@ -39289,7 +39365,7 @@ index 2cea692..e094fc0 100644
+ files_pid_filetrans($1, ifconfig_var_run_t, dir, "netns") + files_pid_filetrans($1, ifconfig_var_run_t, dir, "netns")
+') +')
diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
index a392fc4..4302955 100644 index a392fc4..ca1b2bc 100644
--- a/policy/modules/system/sysnetwork.te --- a/policy/modules/system/sysnetwork.te
+++ b/policy/modules/system/sysnetwork.te +++ b/policy/modules/system/sysnetwork.te
@@ -5,6 +5,13 @@ policy_module(sysnetwork, 1.15.4) @@ -5,6 +5,13 @@ policy_module(sysnetwork, 1.15.4)
@ -39648,12 +39724,13 @@ index a392fc4..4302955 100644
') ')
optional_policy(` optional_policy(`
@@ -350,7 +450,15 @@ optional_policy(` @@ -350,7 +450,16 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
- nis_use_ypbind(ifconfig_t) - nis_use_ypbind(ifconfig_t)
+ kdump_dontaudit_read_config(ifconfig_t) + kdump_dontaudit_read_config(ifconfig_t)
+ kdump_rw_inherited_kdumpctl_tmp_pipes(ifconfig_t)
+') +')
+ +
+optional_policy(` +optional_policy(`
@ -39665,7 +39742,7 @@ index a392fc4..4302955 100644
') ')
optional_policy(` optional_policy(`
@@ -371,3 +479,13 @@ optional_policy(` @@ -371,3 +480,13 @@ optional_policy(`
xen_append_log(ifconfig_t) xen_append_log(ifconfig_t)
xen_dontaudit_rw_unix_stream_sockets(ifconfig_t) xen_dontaudit_rw_unix_stream_sockets(ifconfig_t)
') ')

129
policy-rawhide-contrib.patch
View File

@ -12502,7 +12502,7 @@ index 32e8265..0de4af3 100644
+ allow $1 chronyd_unit_file_t:service all_service_perms; + allow $1 chronyd_unit_file_t:service all_service_perms;
') ')
diff --git a/chronyd.te b/chronyd.te diff --git a/chronyd.te b/chronyd.te
index e5b621c..f975594 100644 index e5b621c..fc150e9 100644
--- a/chronyd.te --- a/chronyd.te
+++ b/chronyd.te +++ b/chronyd.te
@@ -18,6 +18,9 @@ files_type(chronyd_keys_t) @@ -18,6 +18,9 @@ files_type(chronyd_keys_t)
@ -12533,7 +12533,7 @@ index e5b621c..f975594 100644
allow chronyd_t chronyd_keys_t:file read_file_perms; allow chronyd_t chronyd_keys_t:file read_file_perms;
manage_dirs_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t) manage_dirs_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
@@ -76,18 +83,24 @@ corenet_sendrecv_chronyd_server_packets(chronyd_t) @@ -76,18 +83,29 @@ corenet_sendrecv_chronyd_server_packets(chronyd_t)
corenet_udp_bind_chronyd_port(chronyd_t) corenet_udp_bind_chronyd_port(chronyd_t)
corenet_udp_sendrecv_chronyd_port(chronyd_t) corenet_udp_sendrecv_chronyd_port(chronyd_t)
@ -12559,6 +12559,11 @@ index e5b621c..f975594 100644
optional_policy(` optional_policy(`
- mta_send_mail(chronyd_t) - mta_send_mail(chronyd_t)
+ timemaster_stream_connect(chronyd_t) + timemaster_stream_connect(chronyd_t)
+ timemaster_rw_shm(chronyd_t)
+')
+
+optional_policy(`
+ ptp4l_rw_shm(chronyd_t)
') ')
diff --git a/cinder.fc b/cinder.fc diff --git a/cinder.fc b/cinder.fc
new file mode 100644 new file mode 100644
@ -37843,7 +37848,7 @@ index a49ae4e..0c0e987 100644
+ +
+/var/lock/kdump(/.*)? gen_context(system_u:object_r:kdump_lock_t,s0) +/var/lock/kdump(/.*)? gen_context(system_u:object_r:kdump_lock_t,s0)
diff --git a/kdump.if b/kdump.if diff --git a/kdump.if b/kdump.if
index 3a00b3a..21efcc4 100644 index 3a00b3a..6043fd6 100644
--- a/kdump.if --- a/kdump.if
+++ b/kdump.if +++ b/kdump.if
@@ -1,4 +1,4 @@ @@ -1,4 +1,4 @@
@ -37984,7 +37989,7 @@ index 3a00b3a..21efcc4 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -76,10 +177,69 @@ interface(`kdump_manage_config',` @@ -76,10 +177,88 @@ interface(`kdump_manage_config',`
allow $1 kdump_etc_t:file manage_file_perms; allow $1 kdump_etc_t:file manage_file_perms;
') ')
@ -38009,6 +38014,25 @@ index 3a00b3a..21efcc4 100644
+ +
+################################### +###################################
+## <summary> +## <summary>
+## Read/write inherited kdump /var/tmp named pipes.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`kdump_rw_inherited_kdumpctl_tmp_pipes',`
+ gen_require(`
+ type kdumpctl_tmp_t;
+ ')
+
+ files_search_tmp($1)
+ allow $1 kdumpctl_tmp_t:fifo_file rw_inherited_fifo_file_perms;
+')
+
+###################################
+## <summary>
+## Manage kdump /var/tmp files. +## Manage kdump /var/tmp files.
+## </summary> +## </summary>
+## <param name="domain"> +## <param name="domain">
@ -38056,7 +38080,7 @@ index 3a00b3a..21efcc4 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -88,19 +248,24 @@ interface(`kdump_manage_config',` @@ -88,19 +267,24 @@ interface(`kdump_manage_config',`
## </param> ## </param>
## <param name="role"> ## <param name="role">
## <summary> ## <summary>
@ -38086,7 +38110,7 @@ index 3a00b3a..21efcc4 100644
init_labeled_script_domtrans($1, kdump_initrc_exec_t) init_labeled_script_domtrans($1, kdump_initrc_exec_t)
domain_system_change_exemption($1) domain_system_change_exemption($1)
@@ -110,6 +275,10 @@ interface(`kdump_admin',` @@ -110,6 +294,10 @@ interface(`kdump_admin',`
files_search_etc($1) files_search_etc($1)
admin_pattern($1, kdump_etc_t) admin_pattern($1, kdump_etc_t)
@ -39886,16 +39910,18 @@ index 628b78b..fe65617 100644
- -
-miscfiles_read_localization(keyboardd_t) -miscfiles_read_localization(keyboardd_t)
diff --git a/keystone.fc b/keystone.fc diff --git a/keystone.fc b/keystone.fc
index b273d80..6a07210 100644 index b273d80..9b6e9bd 100644
--- a/keystone.fc --- a/keystone.fc
+++ b/keystone.fc +++ b/keystone.fc
@@ -1,3 +1,5 @@ @@ -1,7 +1,13 @@
+/usr/lib/systemd/system/openstack-keystone.* -- gen_context(system_u:object_r:keystone_unit_file_t,s0) +/usr/lib/systemd/system/openstack-keystone.* -- gen_context(system_u:object_r:keystone_unit_file_t,s0)
+ +
/etc/rc\.d/init\.d/openstack-keystone -- gen_context(system_u:object_r:keystone_initrc_exec_t,s0) /etc/rc\.d/init\.d/openstack-keystone -- gen_context(system_u:object_r:keystone_initrc_exec_t,s0)
/usr/bin/keystone-all -- gen_context(system_u:object_r:keystone_exec_t,s0) /usr/bin/keystone-all -- gen_context(system_u:object_r:keystone_exec_t,s0)
@@ -5,3 +7,5 @@
+/usr/share/keystone(/.*)? gen_context(system_u:object_r:keystone_cgi_script_exec_t,s0)
+
/var/lib/keystone(/.*)? gen_context(system_u:object_r:keystone_var_lib_t,s0) /var/lib/keystone(/.*)? gen_context(system_u:object_r:keystone_var_lib_t,s0)
/var/log/keystone(/.*)? gen_context(system_u:object_r:keystone_log_t,s0) /var/log/keystone(/.*)? gen_context(system_u:object_r:keystone_log_t,s0)
@ -41912,10 +41938,10 @@ index 0000000..d2061a9
+/var/run/timemaster(/.*)? gen_context(system_u:object_r:timemaster_var_run_t,s0) +/var/run/timemaster(/.*)? gen_context(system_u:object_r:timemaster_var_run_t,s0)
diff --git a/linuxptp.if b/linuxptp.if diff --git a/linuxptp.if b/linuxptp.if
new file mode 100644 new file mode 100644
index 0000000..8d6873f index 0000000..236707b
--- /dev/null --- /dev/null
+++ b/linuxptp.if +++ b/linuxptp.if
@@ -0,0 +1,59 @@ @@ -0,0 +1,103 @@
+## <summary>implementation of the Precision Time Protocol (PTP) according to IEEE standard 1588 for Linux.</summary> +## <summary>implementation of the Precision Time Protocol (PTP) according to IEEE standard 1588 for Linux.</summary>
+ +
+######################################## +########################################
@ -41975,12 +42001,56 @@ index 0000000..8d6873f
+ stream_connect_pattern($1, timemaster_var_run_t, timemaster_var_run_t, timemaster_t) + stream_connect_pattern($1, timemaster_var_run_t, timemaster_var_run_t, timemaster_t)
+') +')
+ +
+########################################
+## <summary>
+## Read and write timemaster shared memory.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`timemaster_rw_shm',`
+ gen_require(`
+ type timemaster_t, timemaster_tmpfs_t;
+ ')
+
+ allow $1 timemaster_t:shm rw_shm_perms;
+ list_dirs_pattern($1, timemaster_tmpfs_t, timemaster_tmpfs_t)
+ rw_files_pattern($1, timemaster_tmpfs_t, timemaster_tmpfs_t)
+ read_lnk_files_pattern($1, timemaster_tmpfs_t, timemaster_tmpfs_t)
+ fs_search_tmpfs($1)
+')
+
+########################################
+## <summary>
+## Read and write ptp4l_t shared memory.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ptp4l_rw_shm',`
+ gen_require(`
+ type ptp4l_t, timemaster_tmpfs_t;
+ ')
+
+ allow $1 ptp4l_t:shm rw_shm_perms;
+ list_dirs_pattern($1, timemaster_tmpfs_t, timemaster_tmpfs_t)
+ rw_files_pattern($1, timemaster_tmpfs_t, timemaster_tmpfs_t)
+ read_lnk_files_pattern($1, timemaster_tmpfs_t, timemaster_tmpfs_t)
+ fs_search_tmpfs($1)
+')
+
diff --git a/linuxptp.te b/linuxptp.te diff --git a/linuxptp.te b/linuxptp.te
new file mode 100644 new file mode 100644
index 0000000..5a1445c index 0000000..affa9bd
--- /dev/null --- /dev/null
+++ b/linuxptp.te +++ b/linuxptp.te
@@ -0,0 +1,144 @@ @@ -0,0 +1,173 @@
+policy_module(linuxptp, 1.0.0) +policy_module(linuxptp, 1.0.0)
+ +
+ +
@ -41996,6 +42066,9 @@ index 0000000..5a1445c
+type timemaster_var_run_t; +type timemaster_var_run_t;
+files_pid_file(timemaster_var_run_t) +files_pid_file(timemaster_var_run_t)
+ +
+type timemaster_tmpfs_t;
+files_tmpfs_file(timemaster_tmpfs_t)
+
+type timemaster_unit_file_t; +type timemaster_unit_file_t;
+systemd_unit_file(timemaster_unit_file_t) +systemd_unit_file(timemaster_unit_file_t)
+ +
@ -42028,11 +42101,17 @@ index 0000000..5a1445c
+allow timemaster_t ptp4l_t:process signal; +allow timemaster_t ptp4l_t:process signal;
+allow timemaster_t phc2sys_t:process signal; +allow timemaster_t phc2sys_t:process signal;
+ +
+allow timemaster_t ptp4l_t:shm rw_shm_perms;
+
+manage_dirs_pattern(timemaster_t, timemaster_var_run_t, timemaster_var_run_t) +manage_dirs_pattern(timemaster_t, timemaster_var_run_t, timemaster_var_run_t)
+manage_files_pattern(timemaster_t, timemaster_var_run_t, timemaster_var_run_t) +manage_files_pattern(timemaster_t, timemaster_var_run_t, timemaster_var_run_t)
+manage_sock_files_pattern(timemaster_t, timemaster_var_run_t, timemaster_var_run_t) +manage_sock_files_pattern(timemaster_t, timemaster_var_run_t, timemaster_var_run_t)
+files_pid_filetrans(timemaster_t, timemaster_var_run_t, { dir file sock_file }) +files_pid_filetrans(timemaster_t, timemaster_var_run_t, { dir file sock_file })
+ +
+manage_dirs_pattern(timemaster_t, timemaster_tmpfs_t, timemaster_tmpfs_t)
+manage_files_pattern(timemaster_t, timemaster_tmpfs_t, timemaster_tmpfs_t)
+fs_tmpfs_filetrans(timemaster_t, timemaster_tmpfs_t, { dir file })
+
+kernel_read_network_state(timemaster_t) +kernel_read_network_state(timemaster_t)
+ +
+auth_use_nsswitch(timemaster_t) +auth_use_nsswitch(timemaster_t)
@ -42040,11 +42119,17 @@ index 0000000..5a1445c
+corenet_udp_bind_generic_node(timemaster_t) +corenet_udp_bind_generic_node(timemaster_t)
+corenet_udp_bind_ntp_port(timemaster_t) +corenet_udp_bind_ntp_port(timemaster_t)
+ +
+dev_read_urand(timemaster_t)
+
+logging_send_syslog_msg(timemaster_t) +logging_send_syslog_msg(timemaster_t)
+ +
+sysnet_read_config(timemaster_t) +sysnet_read_config(timemaster_t)
+ +
+optional_policy(` +optional_policy(`
+ ntp_domtrans(timemaster_t)
+')
+
+optional_policy(`
+ chronyd_domtrans(timemaster_t) + chronyd_domtrans(timemaster_t)
+ chronyd_rw_shm(timemaster_t) + chronyd_rw_shm(timemaster_t)
+') +')
@ -42074,11 +42159,19 @@ index 0000000..5a1445c
+ +
+allow phc2sys_t ptp4l_t:unix_dgram_socket sendto; +allow phc2sys_t ptp4l_t:unix_dgram_socket sendto;
+ +
+allow phc2sys_t timemaster_t:shm rw_shm_perms;
+
+manage_dirs_pattern(phc2sys_t, timemaster_var_run_t, timemaster_var_run_t) +manage_dirs_pattern(phc2sys_t, timemaster_var_run_t, timemaster_var_run_t)
+manage_files_pattern(phc2sys_t, timemaster_var_run_t, timemaster_var_run_t) +manage_files_pattern(phc2sys_t, timemaster_var_run_t, timemaster_var_run_t)
+manage_sock_files_pattern(phc2sys_t, timemaster_var_run_t, timemaster_var_run_t) +manage_sock_files_pattern(phc2sys_t, timemaster_var_run_t, timemaster_var_run_t)
+files_pid_filetrans(phc2sys_t, timemaster_var_run_t, { dir file sock_file }) +files_pid_filetrans(phc2sys_t, timemaster_var_run_t, { dir file sock_file })
+ +
+manage_dirs_pattern(phc2sys_t, timemaster_tmpfs_t, timemaster_tmpfs_t)
+manage_files_pattern(phc2sys_t, timemaster_tmpfs_t, timemaster_tmpfs_t)
+fs_tmpfs_filetrans(phc2sys_t, timemaster_tmpfs_t, { dir file })
+
+dev_rw_realtime_clock(phc2sys_t)
+
+logging_send_syslog_msg(phc2sys_t) +logging_send_syslog_msg(phc2sys_t)
+ +
+optional_policy(` +optional_policy(`
@ -42112,9 +42205,15 @@ index 0000000..5a1445c
+manage_sock_files_pattern(ptp4l_t, timemaster_var_run_t, timemaster_var_run_t) +manage_sock_files_pattern(ptp4l_t, timemaster_var_run_t, timemaster_var_run_t)
+files_pid_filetrans(ptp4l_t, timemaster_var_run_t, { dir file sock_file }) +files_pid_filetrans(ptp4l_t, timemaster_var_run_t, { dir file sock_file })
+ +
+manage_dirs_pattern(ptp4l_t, timemaster_tmpfs_t, timemaster_tmpfs_t)
+manage_files_pattern(ptp4l_t, timemaster_tmpfs_t, timemaster_tmpfs_t)
+fs_tmpfs_filetrans(ptp4l_t, timemaster_tmpfs_t, { dir file })
+
+corenet_udp_bind_generic_node(ptp4l_t) +corenet_udp_bind_generic_node(ptp4l_t)
+corenet_udp_bind_reserved_port(ptp4l_t) +corenet_udp_bind_reserved_port(ptp4l_t)
+ +
+dev_rw_realtime_clock(ptp4l_t)
+
+logging_send_syslog_msg(ptp4l_t) +logging_send_syslog_msg(ptp4l_t)
+ +
+optional_policy(` +optional_policy(`
@ -67101,7 +67200,7 @@ index 032a84d..be00a65 100644
+ allow $1 policykit_auth_t:process signal; + allow $1 policykit_auth_t:process signal;
') ')
diff --git a/policykit.te b/policykit.te diff --git a/policykit.te b/policykit.te
index ee91778..b00a474 100644 index ee91778..945a36f 100644
--- a/policykit.te --- a/policykit.te
+++ b/policykit.te +++ b/policykit.te
@@ -7,9 +7,6 @@ policy_module(policykit, 1.3.0) @@ -7,9 +7,6 @@ policy_module(policykit, 1.3.0)
@ -67297,7 +67396,7 @@ index ee91778..b00a474 100644
userdom_dontaudit_read_user_home_content_files(policykit_auth_t) userdom_dontaudit_read_user_home_content_files(policykit_auth_t)
+userdom_dontaudit_write_user_tmp_files(policykit_auth_t) +userdom_dontaudit_write_user_tmp_files(policykit_auth_t)
+userdom_dontaudit_manage_user_home_dirs(policykit_auth_t) +userdom_dontaudit_access_check_user_content(policykit_auth_t)
+userdom_read_admin_home_files(policykit_auth_t) +userdom_read_admin_home_files(policykit_auth_t)
optional_policy(` optional_policy(`

11
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.13.1 Version: 3.13.1
Release: 91%{?dist} Release: 92%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -604,6 +604,15 @@ SELinux Reference policy mls base module.
%endif %endif
%changelog %changelog
* Mon Nov 10 2014 Lukas Vrabec <lvrabec@redhat.com> 3.12.1-92
- Add kdump_rw_inherited_kdumpctl_tmp_pipes()
- Added fixes related to linuxptp. BZ (1149693)
- Label keystone cgi files as keystone_cgi_script_exec_t. BZ(1138424
- Dontaudit policykit_auth_t to access to user home dirs. BZ (1157256)
- Fix seutil_dontaudit_access_check_load_policy()
- Add dontaudit interfaces for audit_access in seutil
- Label /etc/strongimcv as ipsec_conf_file_t.
* Fri Nov 07 2014 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-91 * Fri Nov 07 2014 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-91
- Added interface userdom_dontaudit_manage_user_home_dirs - Added interface userdom_dontaudit_manage_user_home_dirs
- Fix unconfined_server_dbus_chat() interface. - Fix unconfined_server_dbus_chat() interface.