From b8c3e1f89604eb24682914f5e36c2f96769d4f54 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Tue, 21 Mar 2017 09:58:13 +0100 Subject: [PATCH] * Tue Mar 21 2017 Lukas Vrabec - 3.13.1-247 - Make fwupd_var_lib_t type mountpoint. BZ(1429341) - Remove tomcat_t domain from unconfined domains - Create new boolean: sanlock_enable_home_dirs() - Allow mdadm_t domain to read/write nvme_device_t - Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content - Add interface dev_rw_nvme - Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555) --- container-selinux.tgz | Bin 6461 -> 6463 bytes policy-rawhide-base.patch | 630 ++++++++++++----------------------- policy-rawhide-contrib.patch | 126 +++---- selinux-policy.spec | 11 +- 4 files changed, 287 insertions(+), 480 deletions(-) diff --git a/container-selinux.tgz b/container-selinux.tgz index 0fd402a22404770af8ba5f4f17b9f25ceef6dfe1..fb4b70afc2b3c914480e27487b205251c074d4d2 100644 GIT binary patch delta 6429 zcmV+&8RF)>GQTo^ABzY8lIqY{00Zq^ZI9eGlFrxZUm@55JQLV6HL>-X<&Zf?H0e*Na=_4PNw z^-~F?Ux%89RST!91bdy&BAAb^P zU4|Uw#=G|7Oi%d53JX}UDkZX3rMun}QEUEHdp4Es)W@OH0|s+9!=Y z+t((V5AdFW#D{;bOIBqyFm98S)v91gO*OKx>H6AKO%3XgRJ5gmH+)BG{I4vGd+MgD z{o;zQKrnhk5@(jWt!?y-z{O+pDBWQF0XnbuVa2{Ct&>3hdKcs#T2GUjV}IMWDO~~? zZuwN%ICq-g&PMRB@IiI|g?c@X&vnV7WSc+*iHgLrl?_ZDl^Kf$f&51f?oVh3k83Cv z%Qi#h2BrU7n1{RmK=O6;v5Z7}GTSEMkFjnFW30nGsg*R=;Me2|X!VFj?P;pfVJ@Fk z`#*xk1glhRegl2iIKc?Ds(*k|I@R%rEcXfD2O$t1IB1wBQ9y6sP9DJAAzi51!Lmy3 zupFfP11q$LETveZ6b5{Z#?Y%2Te8GLDQLVS($bWo1n)XZ!@9NCtE z|5;F!sQ)ni(=%QjY_Eu-N zu2NMG>8UnmcO|FbK0ZW6;jclzitt0Uuhyc2+^<23Wt5DUn13#|6GSokYRblcv7Ap) zHD1G#94aSr#>=I2z#6#R7^PNEUC=!ew_{PZ$JOo%20pJt*?x{TOiV+Uj{$EaT#%&rd(@~ zl^hiD=6`i>3Qyo4P(w-{K^I7|cyVOyz`R672de`}70CCaFbdhM1PX?+n_|4(Jhi)| zD)Ma7q~&RQ z!v>!}P7BCDVKh3K36)^(l?@kywtQjj6Jz``B7fQAM=g5*h{`~2<;^$zJ1=(m`i3Ck zIJeeL#-np8&W2`T5M)yU|8-fUN%Tl9Tm=PX6flGyz|{imh4y?TX!v63VDCCS@V(5` z8bo~Q;a8T?M)FR{J0*sWwa{Mq$b3=_X>j|vyajVb9h+&85oZvpD@3ZM0#!#F6g(?a#Zi+)5*VJKfHFX(V zCKiMn_#^UiTM=iiLFjKdq=Mn=c()Tq!7zU`z{@d1=mK0$7|^Q6vVhkWo@!Dro7lc^ z?s+Tj+`MR)>nG^MB3@gPs0~dl5p?V3wSTr?>UNXbJLEK`3~J)^9y^eXIb}Ur{E&<( zRxMKhaf9TBYO;KcNchwt(l8Z5^BMS(Q=2R|{usc2s*SgaKpmYCI%OwcH0Y6imu2aqPX z-!rg%m7a_cl5?e^j1&t@)8Owv{(l^lMa7#8j#64JfsQZ34|%xJU$t@U!P$EmY{Rr> z7d?@rM8YSOi%@!;7)sA%+VHL_4rOpIgBlmoW_m~=hjanZ%3V-iajP9?UeB}V)eH<1r!2j_kMA+8GUc9Gjyw2)K& zO|NbY3>$;rT}%}a7l^4!V<|cBbD7Wv0?HtIKR4sN$K>eYSvlzCc&n)y_@jr|VRa(o zlG*@UEHyThj|nM%q9WGK&2uBd5ME{Rb+OwdK#|bLAJ2y@Lom6f-^FV3)PxeU0;-HA z;O7HIgQ8*N9H^J>eOzIrGH0CrKJT+k9sk>L9C}ok2Eqw}M1ENk~6*qNE`yz zn6N@;UVQ#ICIyV$YLT;IDL92GE^>}Asd?K!pwQ@0fin3xPuI;FBX8DDFgH|NND+%O z-ptxYE>GU9-qCUp{CaX=lCVfH)f0usnD#Bx-j@kv`dxA1zdhMZ3)-@1{iY`xkIDs5 z4)FkG3VYjsd2WIYjb!zqE?FMCIQu-vizor%Jz77#+!1el z1S^<_WQjThQd;lGKB~g5hvlU2c@3Qf^t%&sAWQPu2^&@l2&jcI4;?L93B$QlfF^d1o~!5>SkFv7so6- z(!Ouf{wCXzxu0-qhIcL$Vw3p20Hlvak_icTfW;>{5O1p@YX@c84j4E{&t>Mztu&42@jvS zUf`24;53}UejctCKM(#A$0BDc3vXE`p<&N|qTArUsBSNT>|ctKZ4YVsh#_InKvvvQ zyf_c;S+Eb`k1*IUR6tM{=>cPm!1eEv0D0nq7S^@}z6Vt9OR<7~UmVg{7LI>sFg%01 z1amhA0M7IS8T=DJK={##LNQIB2*&nTRU;JYf@Ba=mF!7Xys9m*BS;l0CdrBET zqey>C1-49W`1t5vW^t9i)dR*;yNP%=-L07SI?c{#vXVvqaaJ#L9mX}cv3OukZX6z% zOXE%M?Ji888kWQp9UtFT+=#M_r)1uLR`?{??HYPQeoX<6O^wyk??}<6t=y~E!HhiAA(}Pi-z>}@u7_N^c>>SrRaS~|S5$`YZ zf)4E1Sx$3XuNUT2C(;vmUNiFmp4H4;xZPE8?`9w&P0gTrcWMwm&3Jfw1liH;el}(oHqJ7$b;d0VX6>f$|JJ}3JMe65EwrBDSHjyl8?<<08_ENrL zkMUFoxo8)u)7&=Z{Jx7WRlR3v>OtohSUO_Wu(O`0*plrGrkQ2+Qe75a+S_wpdKRHr zq9V)6ls&AeO^)++RyTb$Xk_wRdI%6q$Y-LmochuFTxf3bQ7J7|;JZe)3oy4t; z>sSZejx(8Sv@p4n=|?PgFow2%ti9}^#!WXFF8}*Lirws9uXo5P4%3TU+o}sgNJ9IR z|LlB6Nh#t!Bf@(qqwdy(qtyF#k&DAGscd2<%p$msO3}n6^U@jOZ^{s`TmhN#7 z%j^0+;nChqC%1q1n-5HXOylC-0xeJMRQqwvR78Z&50*EQ1V!oQx0xe)uBMT4#gz8J zVQP=x+!=jPvg_*G`Giz}3LOd3#**GZd0G3j>(D{qB9;q7(b5aTqaUM5*j_yvF zMX&TG+KUA3HGPPG#CbuuzsNtW_#dAr8(8=X9=X7JQYG+aVYJ5ZX_dr`{ty|+pU0DT z+w*e3uv1cU^MloezvV8812wZ7oTuZPHbPiOSChi(qCxEuyIqunnV@QEYqFe?$76x*{D zI-|??U9Dn&cBfAOEMXvx2o#4a-L@DLP*SzSNN4FS4avcSCcUEpk5`35G(2w|rE*fF zMNxV|`4x%6!FXOd=if?aNu9)$3N<=Emh*%o7)GbZ0}h`F@PMgV5Szr+EO(7f_65&) z0n&CMwGUkm|4|ZKVh)*`aJ%not8d9OHi_2502UDHJE1St8E_MvQ&KC{H4Al1(e_YcmiJ4zNS%ojbT!5Mjf zK1|(|Bol{rwhOI)bM5OgeY7T=>Ql7gh&DUhw(jIJh)NN@gq;cJNG+EdjKwU?%w-9H zh9xZykcOR0n2J&*thfg0-cTHg{|a&ZBns&@Dt+E7kyz>D$d7e#m*1SMBTO=U}MZ9 zT+qmI-O_q4)Wzz#PS|d6np6~Zh0(PcLFQQa5IxGn?K4rTt~ge9(`8*FD^aWLKwo<0 zvvnA#5n8yO2iu~;MGgtj9xT4@SQm59SDks)oaAb@Oisq2up!5R0) z-ZChrIhu4Tzm``m5gaX?KCIGzE(=;0{tTz5nmfH;iL#v<(#xT>>dCs;a(hF#EW)_r zZ68u4mwl9O4}!J&97Nta9u21U5EO*wQG4n;`mOVV+_)B1+!kLp=_G}^kz32swO?d6 zFUCx{`i@U)ylr+($=NrOj;wD@@OejhiLVEYoaZHvQJisHmCiZwaHht84Y$B)%m2-x zVITFgRjhu6I=p{mH^lfC2wcxbH%2T3@7&6;P#LaW4aXMY-r(SaKEBDp@+pWBvw!Tj zAt>HHWv9(F#rfsYH*LMQ)4>qAYDis~jSZ2OuBHxOF@pJ}>^0=$*<20jOoPY!*6w-m zqd3_weH3R#B;xZMFld8+JB`Np5NjpO4+!nd9;)H=XI13rx);X#+mDP|%$hdZHS{0-*45}tWlwCP^~A+y53IE(^dLQZoM$92 z+e=Dm^j$*woS{0#JLO2%F{}xL;ER{RukCk7^&Cvwwj0ZTYHUl;NuuhnO&gQ2dh5p4 zj_lW}P-rT4d<&61T2t3`Y@ho(_{LY8_*e5;qeiC7?UQ}m#{K=D>+j#ae?9pA&-L5W z_kaF~>k3bozxw4;9QRKj>%u0%9=QC5&HC^`nv&{6+koW>vGp}{fvZDZU8TteCyZAD z=j!sivsbT7ywTLeO@2=nQB9!YXBlYl&sw~t0AVuz3gMP~cfh<_P(*kZEh8YJHB|rc zUswP6od_*0TRX2XC{pvqB$lZ16AVkk=EYr+9y0c7ljav5f8|&$f9F{Q?UOGOopEKe z&Y|yK{L`5?R-{gpCIz%OvKt%)x4OCu#arXLwm|X)YF92vFa^|k$wjaL>Pkrc3my>X z4XT!AO^^*$jp&!({emYK`zukLfjkbZ&Ybf{_7|Ftn_C7L*KDV@BNv`LE^uNa@Ibsd z080UvK1z%Q6NNVn^%jhqP95X|Yy20S6$FPCK!Px41b z;4t_Dc=a-PuVjkvGAfhpZ_SPYu;%tmJFo!s)e9YHHxEZyk}o~sKV7Hm rbe*o#b-GU1={jAf>vWy2({;K|*XcT4r|We6zq$SgP8F!(0LTCU4qT`% delta 6427 zcmV+$8RX`_GQBc?ABzY8+e^(@00Zq^ZI9eIa^A1gze2DV@XW$9V~^Kfz}~yyup1!x z5MXh4Kt5!XUbV#T){fp*QqM~a-)~P<@kNwGQj}U_J4p+$XGW@eSSpgmVzEd?Mc#x- z&Z?_q`^^(wui$$3?tA?C`iHl#^q+9Od2{pq+izaKdG!u|fBE6fn{QsdeslBs?Ki=z zrxHlN4s{b&LGVp_SA`oES?R`}|1Z5(&z}cB)`u($tH(e8eb0iTWcg)X9IA)~VOge0 z6gEkb2a#+j0n2yr^XkWI$+iLzzpGOk{Bicr4=g$~OhZrdpxNs;;v$1zu88$o;|+c+ z!z#>zJj~cxpPq55XMY})@H0IK!Za=JSsXM)&{SbwC-_n(&}%}4-&aZAuxcAd?EE(+ z&AK||O_H%Slt(x(UjDW^+p&CIu|Ez;1+=TPv*xkX-azp*FAX;tXkguZaFbU7AAb~R zU4{+Fjd$(EnVvKkD=c8asuajtmF{{^c&+(Y?b)QNJ+oD9uYjsZnF0QA^0u)H2^KJar=%V}$0K9cp#Yaa`SdasfVR>8M7W(pJ#|yn zesM)tAQ-(Ni8D*x);4-Z;QX<9lvY@uLFe^8tk~D2brQ&5@0{F2>uFLq*nhTdN*6$e zTRv4b&YkABvl09&d{EtgpC z{!d^r!73G--$CCsPB22PDu1AqPIWvY%YD-9gAfQ04QRMYqJZAMojicKL%LA2gJqT6 zVL3?o87s7hETmYY6b5{Z#?Y%2Te8GlDQLVS($bWoIPW@2!@9NCtE z|12m<)PI=%=~+`9Y_Eud zx-!yl85)t~W$;Wry8^yv7qfBVBD$RqQUmvTAQ9f3g9fg?j&m8M2~_WVB>rv-NHR+| z9HWTlX|^XpEq^ee`R%}8re4AnUk<1z(v zSL-dy)BiUF^4iwFO?Fo-zgrS@U(`*#G$75_7R0PrU8HwcsDVXbc}>;e2yBW6w#@5u zOmu1&gezeFkcN-TBi<|s88$_hNE-l-O9i9$I*hX<=YL}nE(F=S4e*=^#tE(^^}{lW?n*LiB5j!m z`9b%jo%+Z;A?$I!moed>v!pV^`*k+Fzy0!4D?|M?x4ts+Zh=UPei{7mjmz-cH04@@ ztmL5ZH-E2tQ+NV@j~bHlaJoQ<)f7k84$Mnrbg(*rRDpOu3ZszCN}ymEyD7%o%~QKe zsv^%OOmfpPL-+8f%*Ea+S z$GNq3G9I0iaW*sygCLs>_^-<%O`=C?;W8*FqJSavfJQFBUTDupf`%`a4)(6YL$eo| zT7!r$J^act+DP6hd8fqCu@>4ZADK_8Aq{RHm$zW9sAF>tpUAFDEqGVQQR#&m!m;bD z27hOp>-p>TdFbt@yWPWHP^JekvEI&*mlNE_^nEtH!x(C_zfeU1#!Yd^1;)i5R zv1*a}j}?*|N@e*Nk?^TQq+u$A<~0tYr2Sk5i`u)n06nFvhYqQ_E7&%t)y%6ev}vsJ zwyV_P*kOz3xKPYfZ`a)X_zZPg21Wlz&a3K%@}#yn0oOtnUwVwjcjsLXFrBzlKVe=wJUTDd#Wg%kC4=FoWt>IoQn39g2h^qVToBCi3E*Oq-HQoZ~$q7 z`#l5OSLw+JAvsqv%1E)mG!6d#(|<2PSyYY6;3$RF;^_D?%^?pr`l~9(9-O_G!8S~5 zcF_|_NW^_Yu?VHdiJ|mNqz&(?;!pi zg7ePPVLMU*&#s7CA`HhPb(!O&#w3<5oJ?$yON{uF-$Xu`9h~?1hqyAh+eL0;(OgdP zH@&(sFl-EdcQIu^oFk?(jVa~4&t*az2q=Q+{oIW69+RVoXXT)m<1JM)@JA1^!|FuF zCA9%IUusm7j|nM%A|ux7=D87J2rskvy4YL9C}ok2HXjOM?9`z8t!VAZr?{?8E%p^ zX&!@*L9{RK^WZjtVSfw10ob-?O%ey$ZC=Cy3QLO~^xGzX$yLrW-Kats$yu`nNE`yz zn6N@;UVQp6CIyV$a*?xQDL92GE^>}A$$8s9pwQ@0fijzMp01lUMy}RQFgH|NNa2e! z-ptxYE>GU9-qCUp{Pg6&Bw?OlswWDMG3{HXy)P5U^oQia-#yt(3)-S+{iY{c6O{{~ z9O41W6!x}%^V|d*8p-NIU9voOarS$<{wf$!ppNCyxWE{Z(F~wT7f}Mjd$fLfxg*~A z2v#r;$r5!2rY24D+x4y3fOTMZxcqs9WD*f7B2L0x4@y3r1?iGX4FK2x$eO}5hE++l z24ib<5-t=AHr$CUp#P~X)H0ztS1h{YNh>%J9G7f=4iAauNv{+(fnH5X-7G8T;+Ta; z*!NA^-()*7_v22@@Xm!qREggUK>AoDk&u7~SbP)%@wO_mc2K5G?pYDTkiIf*PaY9Z zraBHMDW+Yr$AS%aJ%0do4sl5dAUUp}=G51xSSd+V!4bQyQ z!VgSSoJwZ>1#2TMb~E4c{j|0qiF5jEHGWFBG!(xAR>7UKjZlJbdPQ zfse+3({Kj+X}DVaJorl-^PH(Hyk(t)hCPdaZiD-xy1fFje<@0~J*4R)hJ--_S#d}4 z;yk!#!9IjP!eGNt0YP1)2aGWS*S`w_WCD`1??_gn}}C+e~BvtBUXZ1W>#bl*;}$@*Y_ zUU!~|J-K`P;&&r$UY)%MZRzw!Dtsi({%EE9;vb`U|9239iKi???y7ytGA29RQ_Aoe zMfzJRuw`n)#|QT^i>vgl9x$HTP58U%ZpFOUQ9Gl_N*4KtS-s447}wm!;(_UyN*tbm@SM`;|4Q^&Gz{gl+IF-&B~L6D5=#>~a5F^OiDoz|Qa@j^J(Hia@nlJRU*S}OD(S4?4fV(h;kMo%KA)mTYG*%`B^z>ay_C-o9x{&mtsC zRAgD1vWGRb$#LG!>ZY#-jZA)Pyt7wQXDlU;t&H;Fj=H)qcRa<}La&j3M{O#hleo2U z9qWMGaVB$(7A96Q{fNa5#?aP}wU<5AxalUt<$oVYzMI|a^$t13VR~_ETXkUwiEE$o zpPlb0D0$pxM0gKn)ZLnJlzP7|a(?)wI10o3E_G8>=)z$R1DWp!m*x?P&|8MK3ivLmH7!W3 zBW8Pl6RY%Vw{Qm#LcnmCj-Ir{X270 z`n=-yLVefB(z)27Nrdkjvu$`t8y;tQu&G4n;LXnl{aE7=6N~uGnxA22=`@0vT%ly^ z#5Ej>QP=x+!=jPvg_*G`Giz}3f(D{qB9;q7(b5e2-aUM5*j_!_| zMX&TG+KUA3HGPPG_<2FNzsNtW_#YoB8<_hF9=X7JQYG+aVYJ5ZX_dr`{@@wNpT?7S z+w*e3uv1d9`hnGjKg(Sb2XbaNI8Vnn$q)LUO708zlyaCc=$$h7u&w$DvPY#L3hQ`0 zASLj|yQ`tEmSi(RW5hxB4;TEanMEFpN%*2OK^V-~p3b5SzrMmb=C#`Ra%PO``R%fNQRQ%{<6_HBfgqSG$^2pL8S+0VcZ^ zX)msKQL~)&1E2Nz5mSU?kst^SS^EQY$8_U>^bCX$T9Ow{vVC;NOOkxg&?3iLe$dDp zDJhqa0gdSM-mmOcyMm-5#nx$@A}yQj!9gN54@g$c6QP`hj}pp$amdkuj6$je`)U_@ zU@%R8Zf9vwcQxF!&y{HlEDsw|gHbzQZS(M!rE1pdFZmrACr`XNp!X4?ySPhigQnV? z;4@KFw7hM2Ze);L%Co~8&K0DVgI8QzkV98SCYgsimB()Gw0-$nSLKX!^hRiNE?43J z3pG=}OQ2FIh`Hq_Gqt7^?l@%V5jtM5N6B-4Y@DIk9*5gboT(u!w{@&DZ2)r;(Fi{F zI;}HLvN>G&7cPa@VYUf-DvuIxRT8OJ^$_JWtrN?*+DTnwGFz1(4rC!^Y~jDH`UX!c z2*2-mPb0ZQ8Y8{?O(hF8AI{+|sI z)J;h;acF0|(E4|yeO;!HroyQ{MH`N2v$JjMPCfz)sdnQ)HOa>>D%&(h3XmH=p2 z(&7MV*tvu$DP_Wndmyuvwkum-1b(+h2rTS0PK#t28nWqYJr;TS5jb*WcM)-yp$y-DtLHjlyTNHvQPdSi*Je1GW8s7MC=a*KL@B%CSlOz}x<*!_mf3;6^wMYR zFi<13a6J#UMTLtT0-!xueBH4w=Af@U^GcoMYO+YCkh97x60a%EnkKfbsSpEy*p(0$ zas)k|q>|7Pk`{|*56K$@HXO{tR~FAY#O>xdcMCae)}Y^Wrx-{YBboUd7$50Nh@*=G zCeNlVEozUalYY&NqXKlcZk|r)aOL`i`DXY`J`oU4F*TkAMCY*`vy;?y$lKtIdt+}I z6r+wNoyxD}RSN`13#SjOw9A5j)`dUA>8a*U?^mK|r-t-$Xsvp(F1Fm>5H5-^u6Wyr zRKaB*rQ3sGtv&~lw~mLx)EOo zDVN{zX^pqdu1PujM$(b>tqDHwC@=o?fRXdO#4(C9j;qo+CmznE+;9tjoVNV04h{RD zpRHo`E9Bw*BfBBSzd+!6Ho7rlA$aFjhK0&-?P@r-2=@jDAN27}4wg?rjF|mnzYRh0 z_9;7UrYX)Zk6yL)-cAQYOPy4I7%X+uO;s}FRyBTG+nNb`eH#BAAdUZtfX#%H0GkQ> zR!q{4&^fmSHU204(bz0Qc>M&Q#-4}M*wc_2NBU83Ft%=+Y5J-8#%%lE@**uN_SVS} zXk<#%xkux9KOQN6l22TlNBH`FUhw3L-jU|AyHJX|I-OKNbu=z1jpMAyYd7!jb&Pk)k*;G{69&N-FN5FO?~dv@n6_;C`4;QK$XU!T7J z^Es|-JYD|!*DHS9KYgqVn*@7k#5Zi#hxfviRPWmcEKZ26UqKhRKGfB9nrv{wc+GLH zuf99Gy!1v&lM^@bJy}FGf$|^AK!bnQ;w=RTlkrQ0Tk_oj^LjxM;aRkdfQY83{^P%{ z|MNQ@T3WVtE-@%lH;YLuP{k)0mWIuXyCOYg>~fRn7ao7bSS^0evk2NJUj#a9q|G{q zzI*XcXWm$mJW-ky(Bg=0a1`9?`Yz;ejqBPR$rq?yxg^0PQ0FBV!2+mjF7>Z?K%6(I zT$(jODykaMufF>gPcHUXB0mFp99W(?=a1|!G#xj$3^1B{{ue6b@%|t004S(oag`m diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index e9c57db0..2a56ec00 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -6640,7 +6640,7 @@ index b31c054..3ad1127 100644 +/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0) +/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0) diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if -index 76f285e..47c1b4d 100644 +index 76f285e..519431d 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',` @@ -7739,7 +7739,7 @@ index 76f285e..47c1b4d 100644 ') ######################################## -@@ -3144,6 +3767,61 @@ interface(`dev_create_null_dev',` +@@ -3144,6 +3767,80 @@ interface(`dev_create_null_dev',` ######################################## ## @@ -7797,11 +7797,30 @@ index 76f285e..47c1b4d 100644 +') + +######################################## ++## ++## Read/Write Non-Volatile Memory Host Controller Interface. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_rw_nvme',` ++ gen_require(` ++ type nvme_device_t; ++ ') ++ ++ rw_chr_files_pattern($1, device_t, nvme_device_t) ++ rw_blk_files_pattern($1, device_t, nvme_device_t) ++') ++ ++######################################## +## ## Do not audit attempts to get the attributes ## of the BIOS non-volatile RAM device. ## -@@ -3163,6 +3841,24 @@ interface(`dev_dontaudit_getattr_nvram_dev',` +@@ -3163,6 +3860,24 @@ interface(`dev_dontaudit_getattr_nvram_dev',` ######################################## ## @@ -7826,7 +7845,7 @@ index 76f285e..47c1b4d 100644 ## Read and write BIOS non-volatile RAM. ## ## -@@ -3254,7 +3950,25 @@ interface(`dev_rw_printer',` +@@ -3254,7 +3969,25 @@ interface(`dev_rw_printer',` ######################################## ## @@ -7853,7 +7872,7 @@ index 76f285e..47c1b4d 100644 ## ## ## -@@ -3262,12 +3976,13 @@ interface(`dev_rw_printer',` +@@ -3262,12 +3995,13 @@ interface(`dev_rw_printer',` ## ## # @@ -7870,7 +7889,7 @@ index 76f285e..47c1b4d 100644 ') ######################################## -@@ -3399,7 +4114,7 @@ interface(`dev_dontaudit_read_rand',` +@@ -3399,7 +4133,7 @@ interface(`dev_dontaudit_read_rand',` ######################################## ## @@ -7879,7 +7898,7 @@ index 76f285e..47c1b4d 100644 ## number generator devices (e.g., /dev/random) ## ## -@@ -3413,7 +4128,7 @@ interface(`dev_dontaudit_append_rand',` +@@ -3413,7 +4147,7 @@ interface(`dev_dontaudit_append_rand',` type random_device_t; ') @@ -7888,7 +7907,7 @@ index 76f285e..47c1b4d 100644 ') ######################################## -@@ -3855,7 +4570,7 @@ interface(`dev_getattr_sysfs_dirs',` +@@ -3855,7 +4589,7 @@ interface(`dev_getattr_sysfs_dirs',` ######################################## ## @@ -7897,7 +7916,7 @@ index 76f285e..47c1b4d 100644 ## ## ## -@@ -3863,91 +4578,89 @@ interface(`dev_getattr_sysfs_dirs',` +@@ -3863,91 +4597,89 @@ interface(`dev_getattr_sysfs_dirs',` ## ## # @@ -8008,7 +8027,7 @@ index 76f285e..47c1b4d 100644 ## ## ## -@@ -3955,68 +4668,53 @@ interface(`dev_dontaudit_write_sysfs_dirs',` +@@ -3955,60 +4687,215 @@ interface(`dev_dontaudit_write_sysfs_dirs',` ## ## # @@ -8074,38 +8093,30 @@ index 76f285e..47c1b4d 100644 ') - rw_files_pattern($1, sysfs_t, sysfs_t) -- read_lnk_files_pattern($1, sysfs_t, sysfs_t) -- -- list_dirs_pattern($1, sysfs_t, sysfs_t) + dontaudit $1 sysfs_t:dir search_dir_perms; - ') - - ######################################## - ## --## Read and write the TPM device. ++') ++ ++######################################## ++## +## List the contents of the sysfs directories. - ## - ## - ## -@@ -4024,17 +4722,262 @@ interface(`dev_rw_sysfs',` - ## - ## - # --interface(`dev_rw_tpm',` ++## ++## ++## ++## Domain allowed access. ++## ++## ++# +interface(`dev_list_sysfs',` - gen_require(` -- type device_t, tpm_device_t; ++ gen_require(` + type sysfs_t; - ') - -- rw_chr_files_pattern($1, device_t, tpm_device_t) ++ ') ++ + read_lnk_files_pattern($1, sysfs_t, sysfs_t) + list_dirs_pattern($1, sysfs_t, sysfs_t) - ') - - ######################################## - ## --## Read from pseudo random number generator devices (e.g., /dev/urandom). ++') ++ ++######################################## ++## +## Write in a sysfs directories. +## +## @@ -8250,13 +8261,13 @@ index 76f285e..47c1b4d 100644 + ') + + rw_files_pattern($1, sysfs_t, sysfs_t) -+ read_lnk_files_pattern($1, sysfs_t, sysfs_t) -+ -+ list_dirs_pattern($1, sysfs_t, sysfs_t) -+') -+ -+######################################## -+## + read_lnk_files_pattern($1, sysfs_t, sysfs_t) + + list_dirs_pattern($1, sysfs_t, sysfs_t) +@@ -4016,6 +4903,81 @@ interface(`dev_rw_sysfs',` + + ######################################## + ## +## Relabel hardware state directories. +## +## @@ -8332,29 +8343,10 @@ index 76f285e..47c1b4d 100644 + +######################################## +## -+## Read and write the TPM device. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_rw_tpm',` -+ gen_require(` -+ type device_t, tpm_device_t; -+ ') -+ -+ rw_chr_files_pattern($1, device_t, tpm_device_t) -+') -+ -+######################################## -+## -+## Read from pseudo random number generator devices (e.g., /dev/urandom). + ## Read and write the TPM device. ## - ## - ##

-@@ -4113,6 +5056,25 @@ interface(`dev_write_urand',` + ## +@@ -4113,6 +5075,25 @@ interface(`dev_write_urand',` ######################################## ##

@@ -8380,7 +8372,7 @@ index 76f285e..47c1b4d 100644 ## Getattr generic the USB devices. ## ## -@@ -4123,7 +5085,7 @@ interface(`dev_write_urand',` +@@ -4123,7 +5104,7 @@ interface(`dev_write_urand',` # interface(`dev_getattr_generic_usb_dev',` gen_require(` @@ -8389,416 +8381,218 @@ index 76f285e..47c1b4d 100644 ') getattr_chr_files_pattern($1, device_t, usb_device_t) -@@ -4351,7 +5313,159 @@ interface(`dev_list_usbfs',` +@@ -4409,9 +5390,9 @@ interface(`dev_rw_usbfs',` + read_lnk_files_pattern($1, usbfs_t, usbfs_t) + ') - ######################################## - ## --## Set the attributes of usbfs filesystem. -+## Set the attributes of usbfs filesystem. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_setattr_usbfs_files',` -+ gen_require(` -+ type usbfs_t; -+ ') -+ -+ setattr_files_pattern($1, usbfs_t, usbfs_t) -+ list_dirs_pattern($1, usbfs_t, usbfs_t) -+') -+ -+######################################## -+## -+## Read USB hardware information using -+## the usbfs filesystem interface. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_read_usbfs',` -+ gen_require(` -+ type usbfs_t; -+ ') -+ -+ read_files_pattern($1, usbfs_t, usbfs_t) -+ read_lnk_files_pattern($1, usbfs_t, usbfs_t) -+ list_dirs_pattern($1, usbfs_t, usbfs_t) -+') -+ -+######################################## -+## -+## Allow caller to modify usb hardware configuration files. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_rw_usbfs',` -+ gen_require(` -+ type usbfs_t; -+ ') -+ -+ list_dirs_pattern($1, usbfs_t, usbfs_t) -+ rw_files_pattern($1, usbfs_t, usbfs_t) -+ read_lnk_files_pattern($1, usbfs_t, usbfs_t) -+') -+ +-######################################## +###################################### -+## -+## Read and write userio device. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_rw_userio_dev',` -+ gen_require(` -+ type device_t, userio_device_t; -+ ') -+ -+ rw_chr_files_pattern($1, device_t, userio_device_t) -+') -+ -+######################################## -+## -+## Get the attributes of video4linux devices. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_getattr_video_dev',` -+ gen_require(` -+ type device_t, v4l_device_t; -+ ') -+ -+ getattr_chr_files_pattern($1, device_t, v4l_device_t) -+') -+ -+######################################## -+## -+## Do not audit attempts to get the attributes -+## of video4linux device nodes. -+## -+## -+## -+## Domain to not audit. -+## -+## -+# -+interface(`dev_dontaudit_getattr_video_dev',` -+ gen_require(` -+ type v4l_device_t; -+ ') -+ -+ dontaudit $1 v4l_device_t:chr_file getattr; -+') -+ -+######################################## -+## -+## Set the attributes of video4linux device nodes. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_setattr_video_dev',` -+ gen_require(` -+ type device_t, v4l_device_t; -+ ') -+ -+ setattr_chr_files_pattern($1, device_t, v4l_device_t) -+') -+ -+######################################## -+## -+## Do not audit attempts to set the attributes -+## of video4linux device nodes. -+## -+## -+## -+## Domain to not audit. -+## -+## -+# -+interface(`dev_dontaudit_setattr_video_dev',` -+ gen_require(` -+ type v4l_device_t; -+ ') -+ -+ dontaudit $1 v4l_device_t:chr_file setattr; -+') -+ -+######################################## -+## -+## Read the video4linux devices. - ## - ## - ## -@@ -4359,19 +5473,17 @@ interface(`dev_list_usbfs',` - ## - ## - # --interface(`dev_setattr_usbfs_files',` -+interface(`dev_read_video_dev',` - gen_require(` -- type usbfs_t; -+ type device_t, v4l_device_t; - ') - -- setattr_files_pattern($1, usbfs_t, usbfs_t) -- list_dirs_pattern($1, usbfs_t, usbfs_t) -+ read_chr_files_pattern($1, device_t, v4l_device_t) - ') - - ######################################## - ## --## Read USB hardware information using --## the usbfs filesystem interface. -+## Write the video4linux devices. - ## - ## - ## -@@ -4379,19 +5491,17 @@ interface(`dev_setattr_usbfs_files',` - ## - ## - # --interface(`dev_read_usbfs',` -+interface(`dev_write_video_dev',` - gen_require(` -- type usbfs_t; -+ type device_t, v4l_device_t; - ') - -- read_files_pattern($1, usbfs_t, usbfs_t) -- read_lnk_files_pattern($1, usbfs_t, usbfs_t) -- list_dirs_pattern($1, usbfs_t, usbfs_t) -+ write_chr_files_pattern($1, device_t, v4l_device_t) - ') - - ######################################## - ## --## Allow caller to modify usb hardware configuration files. -+## Get the attributes of vfio devices. - ## - ## - ## -@@ -4399,37 +5509,36 @@ interface(`dev_read_usbfs',` - ## - ## - # --interface(`dev_rw_usbfs',` -+interface(`dev_getattr_vfio_dev',` - gen_require(` -- type usbfs_t; -+ type device_t, vfio_device_t; - ') - -- list_dirs_pattern($1, usbfs_t, usbfs_t) -- rw_files_pattern($1, usbfs_t, usbfs_t) -- read_lnk_files_pattern($1, usbfs_t, usbfs_t) -+ getattr_chr_files_pattern($1, device_t, vfio_device_t) - ') - - ######################################## ## -## Get the attributes of video4linux devices. -+## Do not audit attempts to get the attributes -+## of vfio device nodes. ++## Read and write userio device. ## ## ## --## Domain allowed access. -+## Domain to not audit. +@@ -4419,17 +5400,17 @@ interface(`dev_rw_usbfs',` ## ## # -interface(`dev_getattr_video_dev',` -+interface(`dev_dontaudit_getattr_vfio_dev',` ++interface(`dev_rw_userio_dev',` gen_require(` - type device_t, v4l_device_t; -+ type vfio_device_t; ++ type device_t, userio_device_t; ') - getattr_chr_files_pattern($1, device_t, v4l_device_t) -+ dontaudit $1 vfio_device_t:chr_file getattr; ++ rw_chr_files_pattern($1, device_t, userio_device_t) ') -###################################### +######################################## ## -## Read and write userio device. -+## Set the attributes of vfio device nodes. ++## Get the attributes of video4linux devices. ## ## ## -@@ -4437,18 +5546,18 @@ interface(`dev_getattr_video_dev',` +@@ -4437,12 +5418,12 @@ interface(`dev_getattr_video_dev',` ## ## # -interface(`dev_rw_userio_dev',` -+interface(`dev_setattr_vfio_dev',` ++interface(`dev_getattr_video_dev',` gen_require(` - type device_t, userio_device_t; -+ type device_t, vfio_device_t; ++ type device_t, v4l_device_t; ') - rw_chr_files_pattern($1, device_t, userio_device_t) -+ setattr_chr_files_pattern($1, device_t, vfio_device_t) ++ getattr_chr_files_pattern($1, device_t, v4l_device_t) ') + ######################################## +@@ -4539,6 +5520,134 @@ interface(`dev_write_video_dev',` + ######################################## ## --## Do not audit attempts to get the attributes --## of video4linux device nodes. ++## Get the attributes of vfio devices. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_getattr_vfio_dev',` ++ gen_require(` ++ type device_t, vfio_device_t; ++ ') ++ ++ getattr_chr_files_pattern($1, device_t, vfio_device_t) ++') ++ ++######################################## ++## ++## Do not audit attempts to get the attributes ++## of vfio device nodes. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`dev_dontaudit_getattr_vfio_dev',` ++ gen_require(` ++ type vfio_device_t; ++ ') ++ ++ dontaudit $1 vfio_device_t:chr_file getattr; ++') ++ ++######################################## ++## ++## Set the attributes of vfio device nodes. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_setattr_vfio_dev',` ++ gen_require(` ++ type device_t, vfio_device_t; ++ ') ++ ++ setattr_chr_files_pattern($1, device_t, vfio_device_t) ++') ++ ++######################################## ++## +## Do not audit attempts to set the attributes +## of vfio device nodes. - ## - ## - ## -@@ -4456,17 +5565,17 @@ interface(`dev_rw_userio_dev',` - ## - ## - # --interface(`dev_dontaudit_getattr_video_dev',` ++## ++## ++## ++## Domain to not audit. ++## ++## ++# +interface(`dev_dontaudit_setattr_vfio_dev',` - gen_require(` -- type v4l_device_t; ++ gen_require(` + type vfio_device_t; - ') - -- dontaudit $1 v4l_device_t:chr_file getattr; ++ ') ++ + dontaudit $1 vfio_device_t:chr_file setattr; - ') - - ######################################## - ## --## Set the attributes of video4linux device nodes. ++') ++ ++######################################## ++## +## Read the vfio devices. - ## - ## - ## -@@ -4474,36 +5583,35 @@ interface(`dev_dontaudit_getattr_video_dev',` - ## - ## - # --interface(`dev_setattr_video_dev',` -+interface(`dev_read_vfio_dev',` - gen_require(` -- type device_t, v4l_device_t; -+ type device_t, vfio_device_t; - ') - -- setattr_chr_files_pattern($1, device_t, v4l_device_t) -+ read_chr_files_pattern($1, device_t, vfio_device_t) - ') - - ######################################## - ## --## Do not audit attempts to set the attributes --## of video4linux device nodes. -+## Write the vfio devices. - ## - ## - ## --## Domain to not audit. ++## ++## ++## +## Domain allowed access. - ## - ## - # --interface(`dev_dontaudit_setattr_video_dev',` ++## ++## ++# ++interface(`dev_read_vfio_dev',` ++ gen_require(` ++ type device_t, vfio_device_t; ++ ') ++ ++ read_chr_files_pattern($1, device_t, vfio_device_t) ++') ++ ++######################################## ++## ++## Write the vfio devices. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# +interface(`dev_write_vfio_dev',` - gen_require(` -- type v4l_device_t; ++ gen_require(` + type device_t, vfio_device_t; - ') - -- dontaudit $1 v4l_device_t:chr_file setattr; ++ ') ++ + write_chr_files_pattern($1, device_t, vfio_device_t) - ') - - ######################################## - ## --## Read the video4linux devices. ++') ++ ++######################################## ++## +## Read and write the VFIO devices. - ## - ## - ## -@@ -4511,17 +5619,17 @@ interface(`dev_dontaudit_setattr_video_dev',` - ## - ## - # --interface(`dev_read_video_dev',` ++## ++## ++## ++## Domain allowed access. ++## ++## ++# +interface(`dev_rw_vfio_dev',` - gen_require(` -- type device_t, v4l_device_t; ++ gen_require(` + type device_t, vfio_device_t; - ') - -- read_chr_files_pattern($1, device_t, v4l_device_t) ++ ') ++ + rw_chr_files_pattern($1, device_t, vfio_device_t) - ') - - ######################################## - ## --## Write the video4linux devices. -+## Allow read/write the vhost net device ++') ++ ++######################################## ++## + ## Allow read/write the vhost net device ## ## - ## -@@ -4529,17 +5637,17 @@ interface(`dev_read_video_dev',` - ## - ## - # --interface(`dev_write_video_dev',` -+interface(`dev_rw_vhost',` - gen_require(` -- type device_t, v4l_device_t; -+ type device_t, vhost_device_t; - ') - -- write_chr_files_pattern($1, device_t, v4l_device_t) -+ rw_chr_files_pattern($1, device_t, vhost_device_t) - ') +@@ -4557,6 +5666,24 @@ interface(`dev_rw_vhost',` ######################################## ## --## Allow read/write the vhost net device +## Allow read/write inheretid the vhost net device ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_rw_inherited_vhost',` ++ gen_require(` ++ type device_t, vhost_device_t; ++ ') ++ ++ allow $1 vhost_device_t:chr_file rw_inherited_chr_file_perms; ++') ++ ++######################################## ++## + ## Read and write VMWare devices. ## ## - ## -@@ -4547,12 +5655,12 @@ interface(`dev_write_video_dev',` - ## - ## - # --interface(`dev_rw_vhost',` -+interface(`dev_rw_inherited_vhost',` - gen_require(` - type device_t, vhost_device_t; - ') - -- rw_chr_files_pattern($1, device_t, vhost_device_t) -+ allow $1 vhost_device_t:chr_file rw_inherited_chr_file_perms; - ') - - ######################################## -@@ -4630,6 +5738,24 @@ interface(`dev_write_watchdog',` +@@ -4630,6 +5757,24 @@ interface(`dev_write_watchdog',` ######################################## ## @@ -8823,7 +8617,7 @@ index 76f285e..47c1b4d 100644 ## Read and write the the wireless device. ## ## -@@ -4762,6 +5888,44 @@ interface(`dev_rw_xserver_misc',` +@@ -4762,6 +5907,44 @@ interface(`dev_rw_xserver_misc',` ######################################## ## @@ -8868,7 +8662,7 @@ index 76f285e..47c1b4d 100644 ## Read and write to the zero device (/dev/zero). ## ## -@@ -4851,3 +6015,1042 @@ interface(`dev_unconfined',` +@@ -4851,3 +6034,1042 @@ interface(`dev_unconfined',` typeattribute $1 devices_unconfined_type; ') diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index 5022173c..7111dab0 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -5533,7 +5533,7 @@ index f6eb485..fe461a3 100644 + ps_process_pattern(httpd_t, $1) ') diff --git a/apache.te b/apache.te -index 6649962..248b38c 100644 +index 6649962..0d0ffbd 100644 --- a/apache.te +++ b/apache.te @@ -5,280 +5,346 @@ policy_module(apache, 2.7.2) @@ -6101,30 +6101,30 @@ index 6649962..248b38c 100644 type httpd_tmp_t; files_tmp_file(httpd_tmp_t) -@@ -324,14 +418,21 @@ files_tmp_file(httpd_tmp_t) +@@ -324,14 +418,16 @@ files_tmp_file(httpd_tmp_t) type httpd_tmpfs_t; files_tmpfs_file(httpd_tmpfs_t) -apache_content_template(user) +apache_user_content_template(httpd_user) ubac_constrained(httpd_user_script_t) +-userdom_user_home_content(httpd_user_content_t) +-userdom_user_home_content(httpd_user_htaccess_t) +-userdom_user_home_content(httpd_user_script_exec_t) +-userdom_user_home_content(httpd_user_ra_content_t) +-userdom_user_home_content(httpd_user_rw_content_t) + +typeattribute httpd_user_content_t httpdcontent; +typeattribute httpd_user_rw_content_t httpdcontent; +typeattribute httpd_user_ra_content_t httpdcontent; + - userdom_user_home_content(httpd_user_content_t) - userdom_user_home_content(httpd_user_htaccess_t) - userdom_user_home_content(httpd_user_script_exec_t) - userdom_user_home_content(httpd_user_ra_content_t) - userdom_user_home_content(httpd_user_rw_content_t) +typeattribute httpd_user_script_t httpd_script_domains; typealias httpd_user_content_t alias { httpd_staff_content_t httpd_sysadm_content_t }; +typealias httpd_user_content_t alias httpd_unconfined_content_t; typealias httpd_user_content_t alias { httpd_auditadm_content_t httpd_secadm_content_t }; typealias httpd_user_content_t alias { httpd_staff_script_ro_t httpd_sysadm_script_ro_t }; typealias httpd_user_content_t alias { httpd_auditadm_script_ro_t httpd_secadm_script_ro_t }; -@@ -346,33 +447,40 @@ typealias httpd_user_rw_content_t alias { httpd_auditadm_script_rw_t httpd_secad +@@ -346,33 +442,40 @@ typealias httpd_user_rw_content_t alias { httpd_auditadm_script_rw_t httpd_secad typealias httpd_user_ra_content_t alias { httpd_staff_script_ra_t httpd_sysadm_script_ra_t }; typealias httpd_user_ra_content_t alias { httpd_auditadm_script_ra_t httpd_secadm_script_ra_t }; @@ -6176,7 +6176,7 @@ index 6649962..248b38c 100644 allow httpd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow httpd_t self:fd use; allow httpd_t self:sock_file read_sock_file_perms; -@@ -381,30 +489,39 @@ allow httpd_t self:shm create_shm_perms; +@@ -381,30 +484,39 @@ allow httpd_t self:shm create_shm_perms; allow httpd_t self:sem create_sem_perms; allow httpd_t self:msgq create_msgq_perms; allow httpd_t self:msg { send receive }; @@ -6221,7 +6221,7 @@ index 6649962..248b38c 100644 logging_log_filetrans(httpd_t, httpd_log_t, file) allow httpd_t httpd_modules_t:dir list_dir_perms; -@@ -412,13 +529,20 @@ mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) +@@ -412,13 +524,20 @@ mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) read_lnk_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) @@ -6243,7 +6243,7 @@ index 6649962..248b38c 100644 allow httpd_t httpd_sys_script_t:unix_stream_socket connectto; -@@ -438,6 +562,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi +@@ -438,6 +557,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi manage_dirs_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) @@ -6251,7 +6251,7 @@ index 6649962..248b38c 100644 files_var_lib_filetrans(httpd_t, httpd_var_lib_t, { dir file }) setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) -@@ -450,140 +575,177 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) +@@ -450,140 +570,177 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) manage_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) @@ -6493,7 +6493,7 @@ index 6649962..248b38c 100644 ') tunable_policy(`httpd_enable_cgi && httpd_use_nfs',` -@@ -594,28 +756,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',` +@@ -594,28 +751,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',` fs_cifs_domtrans(httpd_t, httpd_sys_script_t) ') @@ -6553,7 +6553,7 @@ index 6649962..248b38c 100644 ') tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` -@@ -624,68 +808,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` +@@ -624,68 +803,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` fs_read_nfs_symlinks(httpd_t) ') @@ -6656,7 +6656,7 @@ index 6649962..248b38c 100644 ') tunable_policy(`httpd_setrlimit',` -@@ -695,49 +867,48 @@ tunable_policy(`httpd_setrlimit',` +@@ -695,49 +862,48 @@ tunable_policy(`httpd_setrlimit',` tunable_policy(`httpd_ssi_exec',` corecmd_shell_domtrans(httpd_t, httpd_sys_script_t) @@ -6737,7 +6737,7 @@ index 6649962..248b38c 100644 ') optional_policy(` -@@ -749,24 +920,32 @@ optional_policy(` +@@ -749,24 +915,32 @@ optional_policy(` ') optional_policy(` @@ -6776,7 +6776,7 @@ index 6649962..248b38c 100644 ') optional_policy(` -@@ -775,6 +954,10 @@ optional_policy(` +@@ -775,6 +949,10 @@ optional_policy(` tunable_policy(`httpd_dbus_avahi',` avahi_dbus_chat(httpd_t) ') @@ -6787,7 +6787,7 @@ index 6649962..248b38c 100644 ') optional_policy(` -@@ -786,35 +969,60 @@ optional_policy(` +@@ -786,35 +964,60 @@ optional_policy(` ') optional_policy(` @@ -6861,7 +6861,7 @@ index 6649962..248b38c 100644 tunable_policy(`httpd_manage_ipa',` memcached_manage_pid_files(httpd_t) -@@ -822,8 +1030,30 @@ optional_policy(` +@@ -822,8 +1025,30 @@ optional_policy(` ') optional_policy(` @@ -6892,7 +6892,7 @@ index 6649962..248b38c 100644 tunable_policy(`httpd_can_network_connect_db',` mysql_tcp_connect(httpd_t) -@@ -832,6 +1062,8 @@ optional_policy(` +@@ -832,6 +1057,8 @@ optional_policy(` optional_policy(` nagios_read_config(httpd_t) @@ -6901,7 +6901,7 @@ index 6649962..248b38c 100644 ') optional_policy(` -@@ -842,20 +1074,44 @@ optional_policy(` +@@ -842,20 +1069,44 @@ optional_policy(` ') optional_policy(` @@ -6952,7 +6952,7 @@ index 6649962..248b38c 100644 ') optional_policy(` -@@ -863,16 +1119,31 @@ optional_policy(` +@@ -863,16 +1114,31 @@ optional_policy(` ') optional_policy(` @@ -6986,7 +6986,7 @@ index 6649962..248b38c 100644 ') optional_policy(` -@@ -883,65 +1154,189 @@ optional_policy(` +@@ -883,65 +1149,189 @@ optional_policy(` yam_read_content(httpd_t) ') @@ -7198,7 +7198,7 @@ index 6649962..248b38c 100644 files_dontaudit_search_pids(httpd_suexec_t) files_search_home(httpd_suexec_t) -@@ -950,123 +1345,75 @@ auth_use_nsswitch(httpd_suexec_t) +@@ -950,123 +1340,75 @@ auth_use_nsswitch(httpd_suexec_t) logging_search_logs(httpd_suexec_t) logging_send_syslog_msg(httpd_suexec_t) @@ -7352,7 +7352,7 @@ index 6649962..248b38c 100644 mysql_read_config(httpd_suexec_t) tunable_policy(`httpd_can_network_connect_db',` -@@ -1083,172 +1430,107 @@ optional_policy(` +@@ -1083,172 +1425,107 @@ optional_policy(` ') ') @@ -7590,7 +7590,7 @@ index 6649962..248b38c 100644 ') tunable_policy(`httpd_read_user_content',` -@@ -1256,64 +1538,74 @@ tunable_policy(`httpd_read_user_content',` +@@ -1256,64 +1533,74 @@ tunable_policy(`httpd_read_user_content',` ') tunable_policy(`httpd_use_cifs',` @@ -7687,7 +7687,7 @@ index 6649962..248b38c 100644 ######################################## # -@@ -1321,8 +1613,15 @@ miscfiles_read_localization(httpd_rotatelogs_t) +@@ -1321,8 +1608,15 @@ miscfiles_read_localization(httpd_rotatelogs_t) # optional_policy(` @@ -7704,7 +7704,7 @@ index 6649962..248b38c 100644 ') ######################################## -@@ -1330,49 +1629,40 @@ optional_policy(` +@@ -1330,49 +1624,40 @@ optional_policy(` # User content local policy # @@ -7770,7 +7770,7 @@ index 6649962..248b38c 100644 kernel_read_system_state(httpd_passwd_t) corecmd_exec_bin(httpd_passwd_t) -@@ -1382,38 +1672,109 @@ dev_read_urand(httpd_passwd_t) +@@ -1382,38 +1667,109 @@ dev_read_urand(httpd_passwd_t) domain_use_interactive_fds(httpd_passwd_t) @@ -30765,10 +30765,10 @@ index 0000000..daef190 +') diff --git a/fwupd.te b/fwupd.te new file mode 100644 -index 0000000..77a7b23 +index 0000000..7bf263a --- /dev/null +++ b/fwupd.te -@@ -0,0 +1,69 @@ +@@ -0,0 +1,70 @@ +policy_module(fwupd, 1.0.0) + +######################################## @@ -30788,6 +30788,7 @@ index 0000000..77a7b23 + +type fwupd_var_lib_t; +files_type(fwupd_var_lib_t) ++files_mountpoint(fwupd_var_lib_t) + +type fwupd_unit_file_t; +systemd_unit_file(fwupd_unit_file_t) @@ -84741,7 +84742,7 @@ index 951db7f..00e699d 100644 + files_etc_filetrans($1, mdadm_conf_t, file, "mdadm.conf.anacbak") ') diff --git a/raid.te b/raid.te -index c99753f..0255b7e 100644 +index c99753f..6d4d0e9 100644 --- a/raid.te +++ b/raid.te @@ -15,54 +15,104 @@ role mdadm_roles types mdadm_t; @@ -84834,11 +84835,11 @@ index c99753f..0255b7e 100644 +dev_read_kvm(mdadm_t) +dev_read_mei(mdadm_t) +dev_read_nvram(mdadm_t) -+dev_read_nvme(mdadm_t) +dev_read_generic_files(mdadm_t) +dev_read_generic_usb_dev(mdadm_t) +dev_read_urand(mdadm_t) +dev_read_rand(mdadm_t) ++dev_rw_nvme(mdadm_t) + +domain_read_all_domains_state(mdadm_t) domain_use_interactive_fds(mdadm_t) @@ -98229,10 +98230,10 @@ index cd6c213..6d3cdc4 100644 + ') ') diff --git a/sanlock.te b/sanlock.te -index 0045465..5080a66 100644 +index 0045465..5be86bf 100644 --- a/sanlock.te +++ b/sanlock.te -@@ -6,25 +6,37 @@ policy_module(sanlock, 1.1.0) +@@ -6,25 +6,44 @@ policy_module(sanlock, 1.1.0) # ## @@ -98247,16 +98248,12 @@ index 0045465..5080a66 100644 gen_tunable(sanlock_use_nfs, false) ## --##

--## Determine whether sanlock can use --## cifs file systems. --##

+##

+## Allow sanlock to manage cifs files +##

- ## - gen_tunable(sanlock_use_samba, false) - ++## ++gen_tunable(sanlock_use_samba, false) ++ +## +##

+## Allow sanlock to read/write fuse files @@ -98264,6 +98261,16 @@ index 0045465..5080a66 100644 +## +gen_tunable(sanlock_use_fusefs, false) + ++## + ##

+-## Determine whether sanlock can use +-## cifs file systems. ++## Allow sanlock to read/write user home directories. + ##

+ ## +-gen_tunable(sanlock_use_samba, false) ++gen_tunable(sanlock_enable_home_dirs, false) + type sanlock_t; type sanlock_exec_t; init_daemon_domain(sanlock_t, sanlock_exec_t) @@ -98278,7 +98285,7 @@ index 0045465..5080a66 100644 type sanlock_var_run_t; files_pid_file(sanlock_var_run_t) -@@ -34,6 +46,12 @@ logging_log_file(sanlock_log_t) +@@ -34,6 +53,12 @@ logging_log_file(sanlock_log_t) type sanlock_initrc_exec_t; init_script_file(sanlock_initrc_exec_t) @@ -98291,7 +98298,7 @@ index 0045465..5080a66 100644 ifdef(`enable_mcs',` init_ranged_daemon_domain(sanlock_t, sanlock_exec_t, s0 - mcs_systemhigh) ') -@@ -44,17 +62,18 @@ ifdef(`enable_mls',` +@@ -44,17 +69,18 @@ ifdef(`enable_mls',` ######################################## # @@ -98305,18 +98312,18 @@ index 0045465..5080a66 100644 allow sanlock_t self:fifo_file rw_fifo_file_perms; -allow sanlock_t self:unix_stream_socket { accept listen }; +allow sanlock_t self:unix_stream_socket create_stream_socket_perms; ++ ++manage_files_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t) ++manage_dirs_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t) -append_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t) -create_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t) -setattr_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t) -+manage_files_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t) -+manage_dirs_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t) -+ +manage_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t) logging_log_filetrans(sanlock_t, sanlock_log_t, file) manage_dirs_pattern(sanlock_t, sanlock_var_run_t, sanlock_var_run_t) -@@ -65,13 +84,18 @@ files_pid_filetrans(sanlock_t, sanlock_var_run_t, { file dir sock_file }) +@@ -65,13 +91,18 @@ files_pid_filetrans(sanlock_t, sanlock_var_run_t, { file dir sock_file }) kernel_read_system_state(sanlock_t) kernel_read_kernel_sysctls(sanlock_t) @@ -98338,7 +98345,7 @@ index 0045465..5080a66 100644 auth_use_nsswitch(sanlock_t) init_read_utmp(sanlock_t) -@@ -79,20 +103,29 @@ init_dontaudit_write_utmp(sanlock_t) +@@ -79,20 +110,35 @@ init_dontaudit_write_utmp(sanlock_t) logging_send_syslog_msg(sanlock_t) @@ -98372,12 +98379,18 @@ index 0045465..5080a66 100644 + fs_read_cifs_symlinks(sanlock_t) +') + ++tunable_policy(`sanlock_enable_home_dirs',` ++ userdom_manage_user_home_content_dirs(sanlock_t) ++ userdom_manage_user_home_content_files(sanlock_t) ++ userdom_manage_user_home_content_symlinks(sanlock_t) ++') ++ +optional_policy(` + rhcs_domtrans_fenced(sanlock_t) ') optional_policy(` -@@ -100,7 +133,34 @@ optional_policy(` +@@ -100,7 +146,34 @@ optional_policy(` ') optional_policy(` @@ -110350,10 +110363,10 @@ index 0000000..e5cec8f +') diff --git a/tomcat.te b/tomcat.te new file mode 100644 -index 0000000..5a263b2 +index 0000000..3bc263e --- /dev/null +++ b/tomcat.te -@@ -0,0 +1,69 @@ +@@ -0,0 +1,60 @@ +policy_module(tomcat, 1.0.0) + +######################################## @@ -110368,15 +110381,6 @@ index 0000000..5a263b2 +type tomcat_unit_file_t; +systemd_unit_file(tomcat_unit_file_t) + -+####################################### -+# -+# tomcat local policy -+# -+ -+optional_policy(` -+ unconfined_domain(tomcat_t) -+') -+ +######################################## +# +# tomcat domain local policy diff --git a/selinux-policy.spec b/selinux-policy.spec index 9090419a..637f5e2b 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 246%{?dist} +Release: 247%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -682,6 +682,15 @@ exit 0 %endif %changelog +* Tue Mar 21 2017 Lukas Vrabec - 3.13.1-247 +- Make fwupd_var_lib_t type mountpoint. BZ(1429341) +- Remove tomcat_t domain from unconfined domains +- Create new boolean: sanlock_enable_home_dirs() +- Allow mdadm_t domain to read/write nvme_device_t +- Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content +- Add interface dev_rw_nvme +- Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555) + * Sat Mar 18 2017 Lukas Vrabec - 3.13.1-246 - Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555)