* Tue Mar 21 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-247

- Make fwupd_var_lib_t type mountpoint. BZ(1429341)
- Remove tomcat_t domain from unconfined domains
- Create new boolean: sanlock_enable_home_dirs()
- Allow mdadm_t domain to read/write nvme_device_t
- Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content
- Add interface dev_rw_nvme
- Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555)

policy-rawhide-base.patch

@@ -6640,7 +6640,7 @@ index b31c054..3ad1127 100644
 +/usr/lib/udev/devices/null	-c	gen_context(system_u:object_r:null_device_t,s0)
 +/usr/lib/udev/devices/zero	-c	gen_context(system_u:object_r:zero_device_t,s0)
 diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
-index 76f285e..47c1b4d 100644
+index 76f285e..519431d 100644
 --- a/policy/modules/kernel/devices.if
 +++ b/policy/modules/kernel/devices.if
 @@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',`
@@ -7739,7 +7739,7 @@ index 76f285e..47c1b4d 100644
  ')
  
  ########################################
-@@ -3144,6 +3767,61 @@ interface(`dev_create_null_dev',`
+@@ -3144,6 +3767,80 @@ interface(`dev_create_null_dev',`
  
  ########################################
  ## <summary>
@@ -7797,11 +7797,30 @@ index 76f285e..47c1b4d 100644
 +')
 +
 +########################################
++## <summary>
++##	Read/Write Non-Volatile Memory Host Controller Interface.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_rw_nvme',`
++	gen_require(`
++		type nvme_device_t;
++	')
++
++	rw_chr_files_pattern($1, device_t, nvme_device_t)
++	rw_blk_files_pattern($1, device_t, nvme_device_t)
++')
++
++########################################
 +## <summary>
  ##	Do not audit attempts to get the attributes
  ##	of the BIOS non-volatile RAM device.
  ## </summary>
-@@ -3163,6 +3841,24 @@ interface(`dev_dontaudit_getattr_nvram_dev',`
+@@ -3163,6 +3860,24 @@ interface(`dev_dontaudit_getattr_nvram_dev',`
  
  ########################################
  ## <summary>
@@ -7826,7 +7845,7 @@ index 76f285e..47c1b4d 100644
  ##	Read and write BIOS non-volatile RAM.
  ## </summary>
  ## <param name="domain">
-@@ -3254,7 +3950,25 @@ interface(`dev_rw_printer',`
+@@ -3254,7 +3969,25 @@ interface(`dev_rw_printer',`
  
  ########################################
  ## <summary>
@@ -7853,7 +7872,7 @@ index 76f285e..47c1b4d 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -3262,12 +3976,13 @@ interface(`dev_rw_printer',`
+@@ -3262,12 +3995,13 @@ interface(`dev_rw_printer',`
  ##	</summary>
  ## </param>
  #
@@ -7870,7 +7889,7 @@ index 76f285e..47c1b4d 100644
  ')
  
  ########################################
-@@ -3399,7 +4114,7 @@ interface(`dev_dontaudit_read_rand',`
+@@ -3399,7 +4133,7 @@ interface(`dev_dontaudit_read_rand',`
  
  ########################################
  ## <summary>
@@ -7879,7 +7898,7 @@ index 76f285e..47c1b4d 100644
  ##	number generator devices (e.g., /dev/random)
  ## </summary>
  ## <param name="domain">
-@@ -3413,7 +4128,7 @@ interface(`dev_dontaudit_append_rand',`
+@@ -3413,7 +4147,7 @@ interface(`dev_dontaudit_append_rand',`
  		type random_device_t;
  	')
  
@@ -7888,7 +7907,7 @@ index 76f285e..47c1b4d 100644
  ')
  
  ########################################
-@@ -3855,7 +4570,7 @@ interface(`dev_getattr_sysfs_dirs',`
+@@ -3855,7 +4589,7 @@ interface(`dev_getattr_sysfs_dirs',`
  
  ########################################
  ## <summary>
@@ -7897,7 +7916,7 @@ index 76f285e..47c1b4d 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -3863,91 +4578,89 @@ interface(`dev_getattr_sysfs_dirs',`
+@@ -3863,91 +4597,89 @@ interface(`dev_getattr_sysfs_dirs',`
  ##	</summary>
  ## </param>
  #
@@ -8008,7 +8027,7 @@ index 76f285e..47c1b4d 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -3955,68 +4668,53 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
+@@ -3955,60 +4687,215 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
  ##	</summary>
  ## </param>
  #
@@ -8074,38 +8093,30 @@ index 76f285e..47c1b4d 100644
  	')
  
 -	rw_files_pattern($1, sysfs_t, sysfs_t)
--	read_lnk_files_pattern($1, sysfs_t, sysfs_t)
--
--	list_dirs_pattern($1, sysfs_t, sysfs_t)
 +	dontaudit $1 sysfs_t:dir search_dir_perms;
- ')
++')
- 
++
- ########################################
++########################################
- ## <summary>
++## <summary>
--##	Read and write the TPM device.
 +##	List the contents of the sysfs directories.
- ## </summary>
++## </summary>
- ## <param name="domain">
++## <param name="domain">
- ##	<summary>
++##	<summary>
-@@ -4024,17 +4722,262 @@ interface(`dev_rw_sysfs',`
++##	Domain allowed access.
- ##	</summary>
++##	</summary>
- ## </param>
++## </param>
- #
++#
--interface(`dev_rw_tpm',`
 +interface(`dev_list_sysfs',`
- 	gen_require(`
++	gen_require(`
--		type device_t, tpm_device_t;
 +		type sysfs_t;
- 	')
++	')
- 
++
--	rw_chr_files_pattern($1, device_t, tpm_device_t)
 +	read_lnk_files_pattern($1, sysfs_t, sysfs_t)
 +	list_dirs_pattern($1, sysfs_t, sysfs_t)
- ')
++')
- 
++
- ########################################
++########################################
- ## <summary>
++## <summary>
--##	Read from pseudo random number generator devices (e.g., /dev/urandom).
 +##	Write in a sysfs directories.
 +## </summary>
 +## <param name="domain">
@@ -8250,13 +8261,13 @@ index 76f285e..47c1b4d 100644
 +	')
 +
 +	rw_files_pattern($1, sysfs_t, sysfs_t)
-+	read_lnk_files_pattern($1, sysfs_t, sysfs_t)
+ 	read_lnk_files_pattern($1, sysfs_t, sysfs_t)
-+
+ 
-+	list_dirs_pattern($1, sysfs_t, sysfs_t)
+ 	list_dirs_pattern($1, sysfs_t, sysfs_t)
-+')
+@@ -4016,6 +4903,81 @@ interface(`dev_rw_sysfs',`
-+
+ 
-+########################################
+ ########################################
-+## <summary>
+ ## <summary>
 +##	Relabel hardware state directories.
 +## </summary>
 +## <param name="domain">
@@ -8332,29 +8343,10 @@ index 76f285e..47c1b4d 100644
 +
 +########################################
 +## <summary>
-+##	Read and write the TPM device.
+ ##	Read and write the TPM device.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_rw_tpm',`
-+	gen_require(`
-+		type device_t, tpm_device_t;
-+	')
-+
-+	rw_chr_files_pattern($1, device_t, tpm_device_t)
-+')
-+
-+########################################
-+## <summary>
-+##	Read from pseudo random number generator devices (e.g., /dev/urandom).
  ## </summary>
- ## <desc>
+ ## <param name="domain">
- ##	<p>
+@@ -4113,6 +5075,25 @@ interface(`dev_write_urand',`
-@@ -4113,6 +5056,25 @@ interface(`dev_write_urand',`
  
  ########################################
  ## <summary>
@@ -8380,7 +8372,7 @@ index 76f285e..47c1b4d 100644
  ##	Getattr generic the USB devices.
  ## </summary>
  ## <param name="domain">
-@@ -4123,7 +5085,7 @@ interface(`dev_write_urand',`
+@@ -4123,7 +5104,7 @@ interface(`dev_write_urand',`
  #
  interface(`dev_getattr_generic_usb_dev',`
  	gen_require(`
@@ -8389,416 +8381,218 @@ index 76f285e..47c1b4d 100644
  	')
  
  	getattr_chr_files_pattern($1, device_t, usb_device_t)
-@@ -4351,7 +5313,159 @@ interface(`dev_list_usbfs',`
+@@ -4409,9 +5390,9 @@ interface(`dev_rw_usbfs',`
+ 	read_lnk_files_pattern($1, usbfs_t, usbfs_t)
+ ')
  
- ########################################
+-########################################
- ## <summary>
--##	Set the attributes of usbfs filesystem.
-+##	Set the attributes of usbfs filesystem.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_setattr_usbfs_files',`
-+	gen_require(`
-+		type usbfs_t;
-+	')
-+
-+	setattr_files_pattern($1, usbfs_t, usbfs_t)
-+	list_dirs_pattern($1, usbfs_t, usbfs_t)
-+')
-+
-+########################################
-+## <summary>
-+##	Read USB hardware information using
-+##	the usbfs filesystem interface.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_read_usbfs',`
-+	gen_require(`
-+		type usbfs_t;
-+	')
-+
-+	read_files_pattern($1, usbfs_t, usbfs_t)
-+	read_lnk_files_pattern($1, usbfs_t, usbfs_t)
-+	list_dirs_pattern($1, usbfs_t, usbfs_t)
-+')
-+
-+########################################
-+## <summary>
-+##	Allow caller to modify usb hardware configuration files.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_rw_usbfs',`
-+	gen_require(`
-+		type usbfs_t;
-+	')
-+
-+	list_dirs_pattern($1, usbfs_t, usbfs_t)
-+	rw_files_pattern($1, usbfs_t, usbfs_t)
-+	read_lnk_files_pattern($1, usbfs_t, usbfs_t)
-+')
-+
 +######################################
-+## <summary>
-+##	Read and write userio device.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_rw_userio_dev',`
-+	gen_require(`
-+		type device_t, userio_device_t;
-+	')
-+
-+	rw_chr_files_pattern($1, device_t, userio_device_t)
-+')
-+
-+########################################
-+## <summary>
-+##	Get the attributes of video4linux devices.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_getattr_video_dev',`
-+	gen_require(`
-+		type device_t, v4l_device_t;
-+	')
-+
-+	getattr_chr_files_pattern($1, device_t, v4l_device_t)
-+')
-+
-+########################################
-+## <summary>
-+##	Do not audit attempts to get the attributes
-+##	of video4linux device nodes.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain to not audit.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_dontaudit_getattr_video_dev',`
-+	gen_require(`
-+		type v4l_device_t;
-+	')
-+
-+	dontaudit $1 v4l_device_t:chr_file getattr;
-+')
-+
-+########################################
-+## <summary>
-+##	Set the attributes of video4linux device nodes.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_setattr_video_dev',`
-+	gen_require(`
-+		type device_t, v4l_device_t;
-+	')
-+
-+	setattr_chr_files_pattern($1, device_t, v4l_device_t)
-+')
-+
-+########################################
-+## <summary>
-+##	Do not audit attempts to set the attributes
-+##	of video4linux device nodes.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain to not audit.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_dontaudit_setattr_video_dev',`
-+	gen_require(`
-+		type v4l_device_t;
-+	')
-+
-+	dontaudit $1 v4l_device_t:chr_file setattr;
-+')
-+
-+########################################
-+## <summary>
-+##	Read the video4linux devices.
- ## </summary>
- ## <param name="domain">
- ##	<summary>
-@@ -4359,19 +5473,17 @@ interface(`dev_list_usbfs',`
- ##	</summary>
- ## </param>
- #
--interface(`dev_setattr_usbfs_files',`
-+interface(`dev_read_video_dev',`
- 	gen_require(`
--		type usbfs_t;
-+		type device_t, v4l_device_t;
- 	')
- 
--	setattr_files_pattern($1, usbfs_t, usbfs_t)
--	list_dirs_pattern($1, usbfs_t, usbfs_t)
-+	read_chr_files_pattern($1, device_t, v4l_device_t)
- ')
- 
- ########################################
- ## <summary>
--##	Read USB hardware information using
--##	the usbfs filesystem interface.
-+##	Write the video4linux devices.
- ## </summary>
- ## <param name="domain">
- ##	<summary>
-@@ -4379,19 +5491,17 @@ interface(`dev_setattr_usbfs_files',`
- ##	</summary>
- ## </param>
- #
--interface(`dev_read_usbfs',`
-+interface(`dev_write_video_dev',`
- 	gen_require(`
--		type usbfs_t;
-+		type device_t, v4l_device_t;
- 	')
- 
--	read_files_pattern($1, usbfs_t, usbfs_t)
--	read_lnk_files_pattern($1, usbfs_t, usbfs_t)
--	list_dirs_pattern($1, usbfs_t, usbfs_t)
-+	write_chr_files_pattern($1, device_t, v4l_device_t)
- ')
- 
- ########################################
- ## <summary>
--##	Allow caller to modify usb hardware configuration files.
-+##	Get the attributes of vfio devices.
- ## </summary>
- ## <param name="domain">
- ##	<summary>
-@@ -4399,37 +5509,36 @@ interface(`dev_read_usbfs',`
- ##	</summary>
- ## </param>
- #
--interface(`dev_rw_usbfs',`
-+interface(`dev_getattr_vfio_dev',`
- 	gen_require(`
--		type usbfs_t;
-+		type device_t, vfio_device_t;
- 	')
- 
--	list_dirs_pattern($1, usbfs_t, usbfs_t)
--	rw_files_pattern($1, usbfs_t, usbfs_t)
--	read_lnk_files_pattern($1, usbfs_t, usbfs_t)
-+	getattr_chr_files_pattern($1, device_t, vfio_device_t)
- ')
- 
- ########################################
  ## <summary>
 -##	Get the attributes of video4linux devices.
-+##	Do not audit attempts to get the attributes
++##	Read and write userio device.
-+##	of vfio device nodes.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
--##	Domain allowed access.
+@@ -4419,17 +5400,17 @@ interface(`dev_rw_usbfs',`
-+##	Domain to not audit.
  ##	</summary>
  ## </param>
  #
 -interface(`dev_getattr_video_dev',`
-+interface(`dev_dontaudit_getattr_vfio_dev',`
++interface(`dev_rw_userio_dev',`
  	gen_require(`
 -		type device_t, v4l_device_t;
-+		type vfio_device_t;
++		type device_t, userio_device_t;
  	')
  
 -	getattr_chr_files_pattern($1, device_t, v4l_device_t)
-+	dontaudit $1 vfio_device_t:chr_file getattr;
++	rw_chr_files_pattern($1, device_t, userio_device_t)
  ')
  
 -######################################
 +########################################
  ## <summary>
 -##	Read and write userio device.
-+##	Set the attributes of vfio device nodes.
++##	Get the attributes of video4linux devices.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4437,18 +5546,18 @@ interface(`dev_getattr_video_dev',`
+@@ -4437,12 +5418,12 @@ interface(`dev_getattr_video_dev',`
  ##	</summary>
  ## </param>
  #
 -interface(`dev_rw_userio_dev',`
-+interface(`dev_setattr_vfio_dev',`
++interface(`dev_getattr_video_dev',`
  	gen_require(`
 -		type device_t, userio_device_t;
-+		type device_t, vfio_device_t;
++		type device_t, v4l_device_t;
  	')
  
 -	rw_chr_files_pattern($1, device_t, userio_device_t)
-+	setattr_chr_files_pattern($1, device_t, vfio_device_t)
++	getattr_chr_files_pattern($1, device_t, v4l_device_t)
  ')
  
+ ########################################
+@@ -4539,6 +5520,134 @@ interface(`dev_write_video_dev',`
+ 
  ########################################
  ## <summary>
--##	Do not audit attempts to get the attributes
++##	Get the attributes of vfio devices.
--##	of video4linux device nodes.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_getattr_vfio_dev',`
++	gen_require(`
++		type device_t, vfio_device_t;
++	')
++
++	getattr_chr_files_pattern($1, device_t, vfio_device_t)
++')
++
++########################################
++## <summary>
++##	Do not audit attempts to get the attributes
++##	of vfio device nodes.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain to not audit.
++##	</summary>
++## </param>
++#
++interface(`dev_dontaudit_getattr_vfio_dev',`
++	gen_require(`
++		type vfio_device_t;
++	')
++
++	dontaudit $1 vfio_device_t:chr_file getattr;
++')
++
++########################################
++## <summary>
++##	Set the attributes of vfio device nodes.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_setattr_vfio_dev',`
++	gen_require(`
++		type device_t, vfio_device_t;
++	')
++
++	setattr_chr_files_pattern($1, device_t, vfio_device_t)
++')
++
++########################################
++## <summary>
 +##	Do not audit attempts to set the attributes
 +##	of vfio device nodes.
- ## </summary>
++## </summary>
- ## <param name="domain">
++## <param name="domain">
- ##	<summary>
++##	<summary>
-@@ -4456,17 +5565,17 @@ interface(`dev_rw_userio_dev',`
++##	Domain to not audit.
- ##	</summary>
++##	</summary>
- ## </param>
++## </param>
- #
++#
--interface(`dev_dontaudit_getattr_video_dev',`
 +interface(`dev_dontaudit_setattr_vfio_dev',`
- 	gen_require(`
++	gen_require(`
--		type v4l_device_t;
 +		type vfio_device_t;
- 	')
++	')
- 
++
--	dontaudit $1 v4l_device_t:chr_file getattr;
 +	dontaudit $1 vfio_device_t:chr_file setattr;
- ')
++')
- 
++
- ########################################
++########################################
- ## <summary>
++## <summary>
--##	Set the attributes of video4linux device nodes.
 +##	Read the vfio devices.
- ## </summary>
++## </summary>
- ## <param name="domain">
++## <param name="domain">
- ##	<summary>
++##	<summary>
-@@ -4474,36 +5583,35 @@ interface(`dev_dontaudit_getattr_video_dev',`
- ##	</summary>
- ## </param>
- #
--interface(`dev_setattr_video_dev',`
-+interface(`dev_read_vfio_dev',`
- 	gen_require(`
--		type device_t, v4l_device_t;
-+		type device_t, vfio_device_t;
- 	')
- 
--	setattr_chr_files_pattern($1, device_t, v4l_device_t)
-+	read_chr_files_pattern($1, device_t, vfio_device_t)
- ')
- 
- ########################################
- ## <summary>
--##	Do not audit attempts to set the attributes
--##	of video4linux device nodes.
-+##	Write the vfio devices.
- ## </summary>
- ## <param name="domain">
- ##	<summary>
--##	Domain to not audit.
 +##	Domain allowed access.
- ##	</summary>
++##	</summary>
- ## </param>
++## </param>
- #
++#
--interface(`dev_dontaudit_setattr_video_dev',`
++interface(`dev_read_vfio_dev',`
++	gen_require(`
++		type device_t, vfio_device_t;
++	')
++
++	read_chr_files_pattern($1, device_t, vfio_device_t)
++')
++
++########################################
++## <summary>
++##	Write the vfio devices.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
 +interface(`dev_write_vfio_dev',`
- 	gen_require(`
++	gen_require(`
--		type v4l_device_t;
 +		type device_t, vfio_device_t;
- 	')
++	')
- 
++
--	dontaudit $1 v4l_device_t:chr_file setattr;
 +	write_chr_files_pattern($1, device_t, vfio_device_t)
- ')
++')
- 
++
- ########################################
++########################################
- ## <summary>
++## <summary>
--##	Read the video4linux devices.
 +##	Read and write the VFIO devices.
- ## </summary>
++## </summary>
- ## <param name="domain">
++## <param name="domain">
- ##	<summary>
++##	<summary>
-@@ -4511,17 +5619,17 @@ interface(`dev_dontaudit_setattr_video_dev',`
++##	Domain allowed access.
- ##	</summary>
++##	</summary>
- ## </param>
++## </param>
- #
++#
--interface(`dev_read_video_dev',`
 +interface(`dev_rw_vfio_dev',`
- 	gen_require(`
++	gen_require(`
--		type device_t, v4l_device_t;
 +		type device_t, vfio_device_t;
- 	')
++	')
- 
++
--	read_chr_files_pattern($1, device_t, v4l_device_t)
 +	rw_chr_files_pattern($1, device_t, vfio_device_t)
- ')
++')
- 
++
- ########################################
++########################################
- ## <summary>
++## <summary>
--##	Write the video4linux devices.
+ ##	Allow read/write the vhost net device
-+##	Allow read/write the vhost net device
  ## </summary>
  ## <param name="domain">
- ##	<summary>
+@@ -4557,6 +5666,24 @@ interface(`dev_rw_vhost',`
-@@ -4529,17 +5637,17 @@ interface(`dev_read_video_dev',`
- ##	</summary>
- ## </param>
- #
--interface(`dev_write_video_dev',`
-+interface(`dev_rw_vhost',`
- 	gen_require(`
--		type device_t, v4l_device_t;
-+		type device_t, vhost_device_t;
- 	')
- 
--	write_chr_files_pattern($1, device_t, v4l_device_t)
-+	rw_chr_files_pattern($1, device_t, vhost_device_t)
- ')
  
  ########################################
  ## <summary>
--##	Allow read/write the vhost net device
 +##	Allow read/write inheretid the vhost net device
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_rw_inherited_vhost',`
++	gen_require(`
++		type device_t, vhost_device_t;
++	')
++
++	allow $1 vhost_device_t:chr_file rw_inherited_chr_file_perms;
++')
++
++########################################
++## <summary>
+ ##	Read and write VMWare devices.
  ## </summary>
  ## <param name="domain">
- ##	<summary>
+@@ -4630,6 +5757,24 @@ interface(`dev_write_watchdog',`
-@@ -4547,12 +5655,12 @@ interface(`dev_write_video_dev',`
- ##	</summary>
- ## </param>
- #
--interface(`dev_rw_vhost',`
-+interface(`dev_rw_inherited_vhost',`
- 	gen_require(`
- 		type device_t, vhost_device_t;
- 	')
- 
--	rw_chr_files_pattern($1, device_t, vhost_device_t)
-+	allow $1 vhost_device_t:chr_file rw_inherited_chr_file_perms;
- ')
- 
- ########################################
-@@ -4630,6 +5738,24 @@ interface(`dev_write_watchdog',`
  
  ########################################
  ## <summary>
@@ -8823,7 +8617,7 @@ index 76f285e..47c1b4d 100644
  ##	Read and write the the wireless device.
  ## </summary>
  ## <param name="domain">
-@@ -4762,6 +5888,44 @@ interface(`dev_rw_xserver_misc',`
+@@ -4762,6 +5907,44 @@ interface(`dev_rw_xserver_misc',`
  
  ########################################
  ## <summary>
@@ -8868,7 +8662,7 @@ index 76f285e..47c1b4d 100644
  ##	Read and write to the zero device (/dev/zero).
  ## </summary>
  ## <param name="domain">
-@@ -4851,3 +6015,1042 @@ interface(`dev_unconfined',`
+@@ -4851,3 +6034,1042 @@ interface(`dev_unconfined',`
  
  	typeattribute $1 devices_unconfined_type;
  ')

policy-rawhide-contrib.patch

@@ -5533,7 +5533,7 @@ index f6eb485..fe461a3 100644
 +		ps_process_pattern(httpd_t, $1)
  ')
 diff --git a/apache.te b/apache.te
-index 6649962..248b38c 100644
+index 6649962..0d0ffbd 100644
 --- a/apache.te
 +++ b/apache.te
 @@ -5,280 +5,346 @@ policy_module(apache, 2.7.2)
@@ -6101,30 +6101,30 @@ index 6649962..248b38c 100644
  
  type httpd_tmp_t;
  files_tmp_file(httpd_tmp_t)
-@@ -324,14 +418,21 @@ files_tmp_file(httpd_tmp_t)
+@@ -324,14 +418,16 @@ files_tmp_file(httpd_tmp_t)
  type httpd_tmpfs_t;
  files_tmpfs_file(httpd_tmpfs_t)
  
 -apache_content_template(user)
 +apache_user_content_template(httpd_user)
  ubac_constrained(httpd_user_script_t)
+-userdom_user_home_content(httpd_user_content_t)
+-userdom_user_home_content(httpd_user_htaccess_t)
+-userdom_user_home_content(httpd_user_script_exec_t)
+-userdom_user_home_content(httpd_user_ra_content_t)
+-userdom_user_home_content(httpd_user_rw_content_t)
 +
 +typeattribute httpd_user_content_t httpdcontent;
 +typeattribute httpd_user_rw_content_t httpdcontent;
 +typeattribute httpd_user_ra_content_t httpdcontent;
 +
- userdom_user_home_content(httpd_user_content_t)
- userdom_user_home_content(httpd_user_htaccess_t)
- userdom_user_home_content(httpd_user_script_exec_t)
- userdom_user_home_content(httpd_user_ra_content_t)
- userdom_user_home_content(httpd_user_rw_content_t)
 +typeattribute httpd_user_script_t httpd_script_domains;
  typealias httpd_user_content_t alias { httpd_staff_content_t httpd_sysadm_content_t };
 +typealias httpd_user_content_t alias httpd_unconfined_content_t;
  typealias httpd_user_content_t alias { httpd_auditadm_content_t httpd_secadm_content_t };
  typealias httpd_user_content_t alias { httpd_staff_script_ro_t httpd_sysadm_script_ro_t };
  typealias httpd_user_content_t alias { httpd_auditadm_script_ro_t httpd_secadm_script_ro_t };
-@@ -346,33 +447,40 @@ typealias httpd_user_rw_content_t alias { httpd_auditadm_script_rw_t httpd_secad
+@@ -346,33 +442,40 @@ typealias httpd_user_rw_content_t alias { httpd_auditadm_script_rw_t httpd_secad
  typealias httpd_user_ra_content_t alias { httpd_staff_script_ra_t httpd_sysadm_script_ra_t };
  typealias httpd_user_ra_content_t alias { httpd_auditadm_script_ra_t httpd_secadm_script_ra_t };
  
@@ -6176,7 +6176,7 @@ index 6649962..248b38c 100644
  allow httpd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
  allow httpd_t self:fd use;
  allow httpd_t self:sock_file read_sock_file_perms;
-@@ -381,30 +489,39 @@ allow httpd_t self:shm create_shm_perms;
+@@ -381,30 +484,39 @@ allow httpd_t self:shm create_shm_perms;
  allow httpd_t self:sem create_sem_perms;
  allow httpd_t self:msgq create_msgq_perms;
  allow httpd_t self:msg { send receive };
@@ -6221,7 +6221,7 @@ index 6649962..248b38c 100644
  logging_log_filetrans(httpd_t, httpd_log_t, file)
  
  allow httpd_t httpd_modules_t:dir list_dir_perms;
-@@ -412,13 +529,20 @@ mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
+@@ -412,13 +524,20 @@ mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
  read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
  read_lnk_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
  
@@ -6243,7 +6243,7 @@ index 6649962..248b38c 100644
  
  allow httpd_t httpd_sys_script_t:unix_stream_socket connectto;
  
-@@ -438,6 +562,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi
+@@ -438,6 +557,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi
  
  manage_dirs_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t)
  manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t)
@@ -6251,7 +6251,7 @@ index 6649962..248b38c 100644
  files_var_lib_filetrans(httpd_t, httpd_var_lib_t, { dir file })
  
  setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
-@@ -450,140 +575,177 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
+@@ -450,140 +570,177 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
  manage_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
  manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
  
@@ -6493,7 +6493,7 @@ index 6649962..248b38c 100644
  ')
  
  tunable_policy(`httpd_enable_cgi && httpd_use_nfs',`
-@@ -594,28 +756,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',`
+@@ -594,28 +751,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',`
  	fs_cifs_domtrans(httpd_t, httpd_sys_script_t)
  ')
  
@@ -6553,7 +6553,7 @@ index 6649962..248b38c 100644
  ')
  
  tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -624,68 +808,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
+@@ -624,68 +803,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
  	fs_read_nfs_symlinks(httpd_t)
  ')
  
@@ -6656,7 +6656,7 @@ index 6649962..248b38c 100644
  ')
  
  tunable_policy(`httpd_setrlimit',`
-@@ -695,49 +867,48 @@ tunable_policy(`httpd_setrlimit',`
+@@ -695,49 +862,48 @@ tunable_policy(`httpd_setrlimit',`
  
  tunable_policy(`httpd_ssi_exec',`
  	corecmd_shell_domtrans(httpd_t, httpd_sys_script_t)
@@ -6737,7 +6737,7 @@ index 6649962..248b38c 100644
  ')
  
  optional_policy(`
-@@ -749,24 +920,32 @@ optional_policy(`
+@@ -749,24 +915,32 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -6776,7 +6776,7 @@ index 6649962..248b38c 100644
  ')
  
  optional_policy(`
-@@ -775,6 +954,10 @@ optional_policy(`
+@@ -775,6 +949,10 @@ optional_policy(`
  	tunable_policy(`httpd_dbus_avahi',`
  		avahi_dbus_chat(httpd_t)
  	')
@@ -6787,7 +6787,7 @@ index 6649962..248b38c 100644
  ')
  
  optional_policy(`
-@@ -786,35 +969,60 @@ optional_policy(`
+@@ -786,35 +964,60 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -6861,7 +6861,7 @@ index 6649962..248b38c 100644
  
  	tunable_policy(`httpd_manage_ipa',`
  		memcached_manage_pid_files(httpd_t)
-@@ -822,8 +1030,30 @@ optional_policy(`
+@@ -822,8 +1025,30 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -6892,7 +6892,7 @@ index 6649962..248b38c 100644
  
  	tunable_policy(`httpd_can_network_connect_db',`
  		mysql_tcp_connect(httpd_t)
-@@ -832,6 +1062,8 @@ optional_policy(`
+@@ -832,6 +1057,8 @@ optional_policy(`
  
  optional_policy(`
  	nagios_read_config(httpd_t)
@@ -6901,7 +6901,7 @@ index 6649962..248b38c 100644
  ')
  
  optional_policy(`
-@@ -842,20 +1074,44 @@ optional_policy(`
+@@ -842,20 +1069,44 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -6952,7 +6952,7 @@ index 6649962..248b38c 100644
  ')
  
  optional_policy(`
-@@ -863,16 +1119,31 @@ optional_policy(`
+@@ -863,16 +1114,31 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -6986,7 +6986,7 @@ index 6649962..248b38c 100644
  ')
  
  optional_policy(`
-@@ -883,65 +1154,189 @@ optional_policy(`
+@@ -883,65 +1149,189 @@ optional_policy(`
  	yam_read_content(httpd_t)
  ')
  
@@ -7198,7 +7198,7 @@ index 6649962..248b38c 100644
  files_dontaudit_search_pids(httpd_suexec_t)
  files_search_home(httpd_suexec_t)
  
-@@ -950,123 +1345,75 @@ auth_use_nsswitch(httpd_suexec_t)
+@@ -950,123 +1340,75 @@ auth_use_nsswitch(httpd_suexec_t)
  logging_search_logs(httpd_suexec_t)
  logging_send_syslog_msg(httpd_suexec_t)
  
@@ -7352,7 +7352,7 @@ index 6649962..248b38c 100644
  	mysql_read_config(httpd_suexec_t)
  
  	tunable_policy(`httpd_can_network_connect_db',`
-@@ -1083,172 +1430,107 @@ optional_policy(`
+@@ -1083,172 +1425,107 @@ optional_policy(`
  	')
  ')
  
@@ -7590,7 +7590,7 @@ index 6649962..248b38c 100644
  ')
  
  tunable_policy(`httpd_read_user_content',`
-@@ -1256,64 +1538,74 @@ tunable_policy(`httpd_read_user_content',`
+@@ -1256,64 +1533,74 @@ tunable_policy(`httpd_read_user_content',`
  ')
  
  tunable_policy(`httpd_use_cifs',`
@@ -7687,7 +7687,7 @@ index 6649962..248b38c 100644
  
  ########################################
  #
-@@ -1321,8 +1613,15 @@ miscfiles_read_localization(httpd_rotatelogs_t)
+@@ -1321,8 +1608,15 @@ miscfiles_read_localization(httpd_rotatelogs_t)
  #
  
  optional_policy(`
@@ -7704,7 +7704,7 @@ index 6649962..248b38c 100644
  ')
  
  ########################################
-@@ -1330,49 +1629,40 @@ optional_policy(`
+@@ -1330,49 +1624,40 @@ optional_policy(`
  # User content local policy
  #
  
@@ -7770,7 +7770,7 @@ index 6649962..248b38c 100644
  kernel_read_system_state(httpd_passwd_t)
  
  corecmd_exec_bin(httpd_passwd_t)
-@@ -1382,38 +1672,109 @@ dev_read_urand(httpd_passwd_t)
+@@ -1382,38 +1667,109 @@ dev_read_urand(httpd_passwd_t)
  
  domain_use_interactive_fds(httpd_passwd_t)
  
@@ -30765,10 +30765,10 @@ index 0000000..daef190
 +')
 diff --git a/fwupd.te b/fwupd.te
 new file mode 100644
-index 0000000..77a7b23
+index 0000000..7bf263a
 --- /dev/null
 +++ b/fwupd.te
-@@ -0,0 +1,69 @@
+@@ -0,0 +1,70 @@
 +policy_module(fwupd, 1.0.0)
 +
 +########################################
@@ -30788,6 +30788,7 @@ index 0000000..77a7b23
 +
 +type fwupd_var_lib_t;
 +files_type(fwupd_var_lib_t)
++files_mountpoint(fwupd_var_lib_t)
 +
 +type fwupd_unit_file_t;
 +systemd_unit_file(fwupd_unit_file_t)
@@ -84741,7 +84742,7 @@ index 951db7f..00e699d 100644
 +    files_etc_filetrans($1, mdadm_conf_t, file, "mdadm.conf.anacbak")
  ')
 diff --git a/raid.te b/raid.te
-index c99753f..0255b7e 100644
+index c99753f..6d4d0e9 100644
 --- a/raid.te
 +++ b/raid.te
 @@ -15,54 +15,104 @@ role mdadm_roles types mdadm_t;
@@ -84834,11 +84835,11 @@ index c99753f..0255b7e 100644
 +dev_read_kvm(mdadm_t)
 +dev_read_mei(mdadm_t)
 +dev_read_nvram(mdadm_t)
-+dev_read_nvme(mdadm_t)
 +dev_read_generic_files(mdadm_t)
 +dev_read_generic_usb_dev(mdadm_t)
 +dev_read_urand(mdadm_t)
 +dev_read_rand(mdadm_t)
++dev_rw_nvme(mdadm_t)
 +
 +domain_read_all_domains_state(mdadm_t)
  domain_use_interactive_fds(mdadm_t)
@@ -98229,10 +98230,10 @@ index cd6c213..6d3cdc4 100644
 +	')
  ')
 diff --git a/sanlock.te b/sanlock.te
-index 0045465..5080a66 100644
+index 0045465..5be86bf 100644
 --- a/sanlock.te
 +++ b/sanlock.te
-@@ -6,25 +6,37 @@ policy_module(sanlock, 1.1.0)
+@@ -6,25 +6,44 @@ policy_module(sanlock, 1.1.0)
  #
  
  ## <desc>
@@ -98247,16 +98248,12 @@ index 0045465..5080a66 100644
  gen_tunable(sanlock_use_nfs, false)
  
  ## <desc>
--##	<p>
--##	Determine whether sanlock can use
--##	cifs file systems.
--##	</p>
 +##  <p>
 +##  Allow sanlock to manage cifs files
 +##  </p>
- ## </desc>
++## </desc>
- gen_tunable(sanlock_use_samba, false)
++gen_tunable(sanlock_use_samba, false)
- 
++
 +## <desc>
 +## <p>
 +## Allow sanlock to read/write fuse files
@@ -98264,6 +98261,16 @@ index 0045465..5080a66 100644
 +## </desc>
 +gen_tunable(sanlock_use_fusefs, false)
 +
++## <desc>
+ ##	<p>
+-##	Determine whether sanlock can use
+-##	cifs file systems.
++##	Allow sanlock to read/write user home directories.
+ ##	</p>
+ ## </desc>
+-gen_tunable(sanlock_use_samba, false)
++gen_tunable(sanlock_enable_home_dirs, false)
+ 
  type sanlock_t;
  type sanlock_exec_t;
  init_daemon_domain(sanlock_t, sanlock_exec_t)
@@ -98278,7 +98285,7 @@ index 0045465..5080a66 100644
  type sanlock_var_run_t;
  files_pid_file(sanlock_var_run_t)
  
-@@ -34,6 +46,12 @@ logging_log_file(sanlock_log_t)
+@@ -34,6 +53,12 @@ logging_log_file(sanlock_log_t)
  type sanlock_initrc_exec_t;
  init_script_file(sanlock_initrc_exec_t)
  
@@ -98291,7 +98298,7 @@ index 0045465..5080a66 100644
  ifdef(`enable_mcs',`
  	init_ranged_daemon_domain(sanlock_t, sanlock_exec_t, s0 - mcs_systemhigh)
  ')
-@@ -44,17 +62,18 @@ ifdef(`enable_mls',`
+@@ -44,17 +69,18 @@ ifdef(`enable_mls',`
  
  ########################################
  #
@@ -98305,18 +98312,18 @@ index 0045465..5080a66 100644
  allow sanlock_t self:fifo_file rw_fifo_file_perms;
 -allow sanlock_t self:unix_stream_socket { accept listen };
 +allow sanlock_t self:unix_stream_socket create_stream_socket_perms;
++
++manage_files_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t)
++manage_dirs_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t)
  
 -append_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t)
 -create_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t)
 -setattr_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t)
-+manage_files_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t)
-+manage_dirs_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t)
-+
 +manage_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t)
  logging_log_filetrans(sanlock_t, sanlock_log_t, file)
  
  manage_dirs_pattern(sanlock_t, sanlock_var_run_t, sanlock_var_run_t)
-@@ -65,13 +84,18 @@ files_pid_filetrans(sanlock_t, sanlock_var_run_t, { file dir sock_file })
+@@ -65,13 +91,18 @@ files_pid_filetrans(sanlock_t, sanlock_var_run_t, { file dir sock_file })
  kernel_read_system_state(sanlock_t)
  kernel_read_kernel_sysctls(sanlock_t)
  
@@ -98338,7 +98345,7 @@ index 0045465..5080a66 100644
  auth_use_nsswitch(sanlock_t)
  
  init_read_utmp(sanlock_t)
-@@ -79,20 +103,29 @@ init_dontaudit_write_utmp(sanlock_t)
+@@ -79,20 +110,35 @@ init_dontaudit_write_utmp(sanlock_t)
  
  logging_send_syslog_msg(sanlock_t)
  
@@ -98372,12 +98379,18 @@ index 0045465..5080a66 100644
 +    fs_read_cifs_symlinks(sanlock_t)
 +')
 +
++tunable_policy(`sanlock_enable_home_dirs',`
++	userdom_manage_user_home_content_dirs(sanlock_t)
++	userdom_manage_user_home_content_files(sanlock_t)
++	userdom_manage_user_home_content_symlinks(sanlock_t)
++')
++
 +optional_policy(`
 +    rhcs_domtrans_fenced(sanlock_t)
  ')
  
  optional_policy(`
-@@ -100,7 +133,34 @@ optional_policy(`
+@@ -100,7 +146,34 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -110350,10 +110363,10 @@ index 0000000..e5cec8f
 +')
 diff --git a/tomcat.te b/tomcat.te
 new file mode 100644
-index 0000000..5a263b2
+index 0000000..3bc263e
 --- /dev/null
 +++ b/tomcat.te
-@@ -0,0 +1,69 @@
+@@ -0,0 +1,60 @@
 +policy_module(tomcat, 1.0.0)
 +
 +########################################
@@ -110368,15 +110381,6 @@ index 0000000..5a263b2
 +type tomcat_unit_file_t;
 +systemd_unit_file(tomcat_unit_file_t)
 +
-+#######################################
-+#
-+# tomcat local policy
-+#
-+
-+optional_policy(`
-+	unconfined_domain(tomcat_t)
-+')
-+
 +########################################
 +#
 +# tomcat domain local policy

selinux-policy.spec

@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 246%{?dist}
+Release: 247%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -682,6 +682,15 @@ exit 0
 %endif
 
 %changelog
+* Tue Mar 21 2017 Lukas Vrabec  <lvrabec@redhat.com> - 3.13.1-247
+- Make fwupd_var_lib_t type mountpoint. BZ(1429341)
+- Remove tomcat_t domain from unconfined domains
+- Create new boolean: sanlock_enable_home_dirs()
+- Allow mdadm_t domain to read/write nvme_device_t
+- Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content
+- Add interface dev_rw_nvme
+- Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555)
+
 * Sat Mar 18 2017 Lukas Vrabec  <lvrabec@redhat.com> - 3.13.1-246
 - Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555)