rpms/selinux-policy
5
0
Fork 0
Code Issues Pull Requests Releases Activity

* Thu Aug 28 2014 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-77

Browse Source 
- Allow aide to read random number generator
- Allow pppd to connect to http port. (#1128947)
- sssd needs to be able write krb5.conf.
- Labeli initial-setup as install_exec_t.
- Allow domains to are allowed to mounton proc to mount on files as well as dirs
This commit is contained in:
Lukas Vrabec 2014-08-28 15:33:54 +02:00
parent 45b429ef46
commit c463599b36
3 changed files with 50 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
policy-rawhide-base.patch
View File

@ -17459,7 +17459,7 @@ index 7be4ddf..71e675a 100644
+/sys/class/net/ib.* -- gen_context(system_u:object_r:sysctl_net_t,s0)
+/sys/kernel/uevent_helper -- gen_context(system_u:object_r:usermodehelper_t,s0)
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index e100d88..a4648ed 100644
index e100d88..227ae89 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -126,6 +126,24 @@ interface(`kernel_setsched',`
@ -17648,7 +17648,7 @@ index e100d88..a4648ed 100644
## Allow caller to get the attributes of kernel message
## interface (/proc/kmsg).
## </summary>
@@ -1458,6 +1564,24 @@ interface(`kernel_list_all_proc',`
@@ -1458,6 +1564,25 @@ interface(`kernel_list_all_proc',`
########################################
## <summary>
@ -17666,6 +17666,7 @@ index e100d88..a4648ed 100644
+ ')
+
+ allow $1 proc_type:dir mounton;
+ allow $1 proc_type:file mounton;
+')
+
+########################################
@ -17673,7 +17674,7 @@ index e100d88..a4648ed 100644
## Do not audit attempts to list all proc directories.
## </summary>
## <param name="domain">
@@ -1477,6 +1601,24 @@ interface(`kernel_dontaudit_list_all_proc',`
@@ -1477,6 +1602,24 @@ interface(`kernel_dontaudit_list_all_proc',`
########################################
## <summary>
@ -17698,7 +17699,7 @@ index e100d88..a4648ed 100644
## Do not audit attempts by caller to search
## the base directory of sysctls.
## </summary>
@@ -1672,7 +1814,7 @@ interface(`kernel_read_net_sysctls',`
@@ -1672,7 +1815,7 @@ interface(`kernel_read_net_sysctls',`
')
read_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_t)
@ -17707,7 +17708,7 @@ index e100d88..a4648ed 100644
list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
')
@@ -1693,7 +1835,7 @@ interface(`kernel_rw_net_sysctls',`
@@ -1693,7 +1836,7 @@ interface(`kernel_rw_net_sysctls',`
')
rw_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_t)
@ -17716,7 +17717,7 @@ index e100d88..a4648ed 100644
list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
')
@@ -1715,7 +1857,6 @@ interface(`kernel_read_unix_sysctls',`
@@ -1715,7 +1858,6 @@ interface(`kernel_read_unix_sysctls',`
')
read_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_unix_t)
@ -17724,7 +17725,7 @@ index e100d88..a4648ed 100644
list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
')
@@ -1750,16 +1891,9 @@ interface(`kernel_rw_unix_sysctls',`
@@ -1750,16 +1892,9 @@ interface(`kernel_rw_unix_sysctls',`
## Domain allowed access.
## </summary>
## </param>
@ -17742,7 +17743,7 @@ index e100d88..a4648ed 100644
')
########################################
@@ -1771,16 +1905,9 @@ interface(`kernel_read_hotplug_sysctls',`
@@ -1771,16 +1906,9 @@ interface(`kernel_read_hotplug_sysctls',`
## Domain allowed access.
## </summary>
## </param>
@ -17760,7 +17761,7 @@ index e100d88..a4648ed 100644
')
########################################
@@ -1792,16 +1919,9 @@ interface(`kernel_rw_hotplug_sysctls',`
@@ -1792,16 +1920,9 @@ interface(`kernel_rw_hotplug_sysctls',`
## Domain allowed access.
## </summary>
## </param>
@ -17778,7 +17779,7 @@ index e100d88..a4648ed 100644
')
########################################
@@ -1813,16 +1933,9 @@ interface(`kernel_read_modprobe_sysctls',`
@@ -1813,16 +1934,9 @@ interface(`kernel_read_modprobe_sysctls',`
## Domain allowed access.
## </summary>
## </param>
@ -17796,7 +17797,7 @@ index e100d88..a4648ed 100644
')
########################################
@@ -2085,9 +2198,28 @@ interface(`kernel_dontaudit_list_all_sysctls',`
@@ -2085,9 +2199,28 @@ interface(`kernel_dontaudit_list_all_sysctls',`
')
dontaudit $1 sysctl_type:dir list_dir_perms;
@ -17826,7 +17827,7 @@ index e100d88..a4648ed 100644
########################################
## <summary>
## Allow caller to read all sysctls.
@@ -2282,6 +2414,25 @@ interface(`kernel_list_unlabeled',`
@@ -2282,6 +2415,25 @@ interface(`kernel_list_unlabeled',`
########################################
## <summary>
@ -17852,7 +17853,7 @@ index e100d88..a4648ed 100644
## Read the process state (/proc/pid) of all unlabeled_t.
## </summary>
## <param name="domain">
@@ -2306,7 +2457,7 @@ interface(`kernel_read_unlabeled_state',`
@@ -2306,7 +2458,7 @@ interface(`kernel_read_unlabeled_state',`
## </summary>
## <param name="domain">
## <summary>
@ -17861,7 +17862,7 @@ index e100d88..a4648ed 100644
## </summary>
## </param>
#
@@ -2488,6 +2639,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
@@ -2488,6 +2640,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
########################################
## <summary>
@ -17886,7 +17887,7 @@ index e100d88..a4648ed 100644
## Do not audit attempts by caller to get attributes for
## unlabeled character devices.
## </summary>
@@ -2525,6 +2694,24 @@ interface(`kernel_relabelfrom_unlabeled_dirs',`
@@ -2525,6 +2695,24 @@ interface(`kernel_relabelfrom_unlabeled_dirs',`
########################################
## <summary>
@ -17911,7 +17912,7 @@ index e100d88..a4648ed 100644
## Allow caller to relabel unlabeled files.
## </summary>
## <param name="domain">
@@ -2667,6 +2854,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
@@ -2667,6 +2855,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
########################################
## <summary>
@ -17936,7 +17937,7 @@ index e100d88..a4648ed 100644
## Receive TCP packets from an unlabeled connection.
## </summary>
## <desc>
@@ -2694,6 +2899,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',`
@@ -2694,6 +2900,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',`
########################################
## <summary>
@ -17962,7 +17963,7 @@ index e100d88..a4648ed 100644
## Do not audit attempts to receive TCP packets from an unlabeled
## connection.
## </summary>
@@ -2803,20 +3027,47 @@ interface(`kernel_raw_recvfrom_unlabeled',`
@@ -2803,20 +3028,47 @@ interface(`kernel_raw_recvfrom_unlabeled',`
allow $1 unlabeled_t:rawip_socket recvfrom;
')
@ -18017,7 +18018,7 @@ index e100d88..a4648ed 100644
## </p>
## </desc>
## <param name="domain">
@@ -2958,6 +3209,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
@@ -2958,6 +3210,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
########################################
## <summary>
@ -18042,7 +18043,7 @@ index e100d88..a4648ed 100644
## Unconfined access to kernel module resources.
## </summary>
## <param name="domain">
@@ -2972,5 +3241,565 @@ interface(`kernel_unconfined',`
@@ -2972,5 +3242,565 @@ interface(`kernel_unconfined',`
')
typeattribute $1 kern_unconfined;

35
policy-rawhide-contrib.patch
View File

@ -1594,7 +1594,7 @@ index 01cbb67..94a4a24 100644
files_list_etc($1)
diff --git a/aide.te b/aide.te
index 03831e6..cfc9115 100644
index 03831e6..94a723f 100644
--- a/aide.te
+++ b/aide.te
@@ -10,6 +10,7 @@ attribute_role aide_roles;
@ -1605,12 +1605,13 @@ index 03831e6..cfc9115 100644
role aide_roles types aide_t;
type aide_log_t;
@@ -23,22 +24,30 @@ files_type(aide_db_t)
@@ -23,22 +24,34 @@ files_type(aide_db_t)
# Local policy
#
-allow aide_t self:capability { dac_override fowner };
+allow aide_t self:capability { dac_override fowner ipc_lock sys_admin };
+allow aide_t self:process signal;
manage_files_pattern(aide_t, aide_db_t, aide_db_t)
+files_var_lib_filetrans(aide_t, aide_db_t, { dir file })
@ -1621,6 +1622,9 @@ index 03831e6..cfc9115 100644
+manage_files_pattern(aide_t, aide_log_t, aide_log_t)
logging_log_filetrans(aide_t, aide_log_t, file)
+dev_read_rand(aide_t)
+dev_read_urand(aide_t)
+
files_read_all_files(aide_t)
files_read_all_symlinks(aide_t)
+files_getattr_all_pipes(aide_t)
@ -2365,15 +2369,16 @@ index 16d0d66..60abfd0 100644
optional_policy(`
nscd_dontaudit_search_pid(amtu_t)
diff --git a/anaconda.fc b/anaconda.fc
index b098089..358c9f9 100644
index b098089..37d428c 100644
--- a/anaconda.fc
+++ b/anaconda.fc
@@ -1 +1,11 @@
@@ -1 +1,12 @@
# No file context specifications.
+
+/usr/libexec/anaconda/anaconda-yum -- gen_context(system_u:object_r:install_exec_t,s0)
+/usr/sbin/anaconda -- gen_context(system_u:object_r:install_exec_t,s0)
+
+/usr/bin/initial-setup -- gen_context(system_u:object_r:install_exec_t,s0)
+/usr/bin/ostree -- gen_context(system_u:object_r:install_exec_t,s0)
+/usr/bin/rpm-ostree -- gen_context(system_u:object_r:install_exec_t,s0)
+
@ -69388,7 +69393,7 @@ index cd8b8b9..6c73980 100644
+ allow $1 pppd_unit_file_t:service all_service_perms;
')
diff --git a/ppp.te b/ppp.te
index d616ca3..fd72341 100644
index d616ca3..979a6e0 100644
--- a/ppp.te
+++ b/ppp.te
@@ -6,41 +6,47 @@ policy_module(ppp, 1.14.0)
@ -69544,11 +69549,12 @@ index d616ca3..fd72341 100644
corenet_all_recvfrom_netlabel(pppd_t)
corenet_tcp_sendrecv_generic_if(pppd_t)
corenet_raw_sendrecv_generic_if(pppd_t)
@@ -135,9 +145,21 @@ corenet_raw_sendrecv_generic_node(pppd_t)
@@ -135,9 +145,22 @@ corenet_raw_sendrecv_generic_node(pppd_t)
corenet_udp_sendrecv_generic_node(pppd_t)
corenet_tcp_sendrecv_all_ports(pppd_t)
corenet_udp_sendrecv_all_ports(pppd_t)
-
+corenet_tcp_connect_http_port(pppd_t)
+# Access /dev/ppp.
corenet_rw_ppp_dev(pppd_t)
@ -69567,7 +69573,7 @@ index d616ca3..fd72341 100644
corecmd_exec_bin(pppd_t)
corecmd_exec_shell(pppd_t)
@@ -147,36 +169,31 @@ files_exec_etc_files(pppd_t)
@@ -147,36 +170,31 @@ files_exec_etc_files(pppd_t)
files_manage_etc_runtime_files(pppd_t)
files_dontaudit_write_etc_files(pppd_t)
@ -69613,7 +69619,7 @@ index d616ca3..fd72341 100644
optional_policy(`
ddclient_run(pppd_t, pppd_roles)
@@ -186,11 +203,13 @@ optional_policy(`
@@ -186,11 +204,13 @@ optional_policy(`
l2tpd_dgram_send(pppd_t)
l2tpd_rw_socket(pppd_t)
l2tpd_stream_connect(pppd_t)
@ -69628,7 +69634,7 @@ index d616ca3..fd72341 100644
')
')
@@ -218,16 +237,19 @@ optional_policy(`
@@ -218,16 +238,19 @@ optional_policy(`
########################################
#
@ -69651,7 +69657,7 @@ index d616ca3..fd72341 100644
allow pptp_t pppd_etc_t:dir list_dir_perms;
allow pptp_t pppd_etc_t:file read_file_perms;
@@ -236,45 +258,43 @@ allow pptp_t pppd_etc_t:lnk_file read_lnk_file_perms;
@@ -236,45 +259,43 @@ allow pptp_t pppd_etc_t:lnk_file read_lnk_file_perms;
allow pptp_t pppd_etc_rw_t:dir list_dir_perms;
allow pptp_t pppd_etc_rw_t:file read_file_perms;
allow pptp_t pppd_etc_rw_t:lnk_file read_lnk_file_perms;
@ -69708,7 +69714,7 @@ index d616ca3..fd72341 100644
fs_getattr_all_fs(pptp_t)
fs_search_auto_mountpoints(pptp_t)
@@ -282,12 +302,12 @@ term_ioctl_generic_ptys(pptp_t)
@@ -282,12 +303,12 @@ term_ioctl_generic_ptys(pptp_t)
term_search_ptys(pptp_t)
term_use_ptmx(pptp_t)
@ -69723,7 +69729,7 @@ index d616ca3..fd72341 100644
sysnet_exec_ifconfig(pptp_t)
userdom_dontaudit_use_unpriv_user_fds(pptp_t)
@@ -299,6 +319,10 @@ optional_policy(`
@@ -299,6 +320,10 @@ optional_policy(`
')
optional_policy(`
@ -95540,7 +95546,7 @@ index a240455..16a04bf 100644
- admin_pattern($1, sssd_log_t)
')
diff --git a/sssd.te b/sssd.te
index 2d8db1f..1f205fe 100644
index 2d8db1f..e1c568a 100644
--- a/sssd.te
+++ b/sssd.te
@@ -28,9 +28,12 @@ logging_log_file(sssd_var_log_t)
@ -95631,7 +95637,7 @@ index 2d8db1f..1f205fe 100644
init_read_utmp(sssd_t)
@@ -112,18 +109,35 @@ logging_send_syslog_msg(sssd_t)
@@ -112,18 +109,36 @@ logging_send_syslog_msg(sssd_t)
logging_send_audit_msgs(sssd_t)
miscfiles_read_generic_certs(sssd_t)
@ -95656,6 +95662,7 @@ index 2d8db1f..1f205fe 100644
- kerberos_tmp_filetrans_host_rcache(sssd_t, file, "host_0")
+ kerberos_tmp_filetrans_host_rcache(sssd_t, "host_0")
+ kerberos_read_home_content(sssd_t)
+ kerberos_rw_config(sssd_t)
+')
+
+optional_policy(`

9
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
Release: 76%{?dist}
Release: 77%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@ -602,6 +602,13 @@ SELinux Reference policy mls base module.
%endif
%changelog
* Thu Aug 28 2014 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-77
- Allow aide to read random number generator
- Allow pppd to connect to http port. (#1128947)
- sssd needs to be able write krb5.conf.
- Labeli initial-setup as install_exec_t.
- Allow domains to are allowed to mounton proc to mount on files as well as dirs
* Tue Aug 26 2014 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-76
- Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t
- Add a port definition for shellinaboxd