* Sun Jan 08 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-233
-Allow thumb domain sendto via dgram sockets. BZ(1398813) - Add condor_procd_t domain sys_ptrace cap_userns BZ(1411077) - Allow cobbler domain to create netlink_audit sockets BZ(1384600) - Allow networkmanager to manage networkmanager_var_lib_t lnk files BZ(1408626) - Add dhcpd_t domain fowner capability BZ(1409963) - Allow thumb to create netlink_kobject_uevent sockets. BZ(1410942) - Fix broken interfaces - Allow setfiles_t domain rw inherited kdumpctl tmp pipes BZ(1356456) - Allow user_t run systemctl --user BZ(1401625)
This commit is contained in:
parent
5b738b7ea2
commit
cb674ac32f
Binary file not shown.
@ -27823,7 +27823,7 @@ index 3835596..fbca2be 100644
|
|||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
|
diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
|
||||||
index 6d77e81..656a8c4 100644
|
index 6d77e81..20657b8 100644
|
||||||
--- a/policy/modules/roles/unprivuser.te
|
--- a/policy/modules/roles/unprivuser.te
|
||||||
+++ b/policy/modules/roles/unprivuser.te
|
+++ b/policy/modules/roles/unprivuser.te
|
||||||
@@ -1,5 +1,12 @@
|
@@ -1,5 +1,12 @@
|
||||||
@ -27839,7 +27839,7 @@ index 6d77e81..656a8c4 100644
|
|||||||
# this module should be named user, but that is
|
# this module should be named user, but that is
|
||||||
# a compile error since user is a keyword.
|
# a compile error since user is a keyword.
|
||||||
|
|
||||||
@@ -12,12 +19,98 @@ role user_r;
|
@@ -12,12 +19,103 @@ role user_r;
|
||||||
|
|
||||||
userdom_unpriv_user_template(user)
|
userdom_unpriv_user_template(user)
|
||||||
|
|
||||||
@ -27927,6 +27927,11 @@ index 6d77e81..656a8c4 100644
|
|||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
|
+ systemd_read_unit_files(user_t)
|
||||||
|
+ systemd_exec_systemctl(user_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
+ sandbox_transition(user_t, user_r)
|
+ sandbox_transition(user_t, user_r)
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
@ -27939,29 +27944,29 @@ index 6d77e81..656a8c4 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -25,11 +118,19 @@ optional_policy(`
|
@@ -25,11 +123,19 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
- vlock_run(user_t, user_r)
|
- vlock_run(user_t, user_r)
|
||||||
+ setroubleshoot_dontaudit_stream_connect(user_t)
|
+ setroubleshoot_dontaudit_stream_connect(user_t)
|
||||||
+')
|
')
|
||||||
+
|
|
||||||
+#optional_policy(`
|
+#optional_policy(`
|
||||||
+# telepathy_dbus_session_role(user_r, user_t)
|
+# telepathy_dbus_session_role(user_r, user_t)
|
||||||
+#')
|
+#')
|
||||||
+
|
+
|
||||||
+optional_policy(`
|
|
||||||
+ usbmuxd_stream_connect(user_t)
|
|
||||||
')
|
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
- xserver_role(user_r, user_t)
|
- xserver_role(user_r, user_t)
|
||||||
|
+ usbmuxd_stream_connect(user_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
+ vlock_run(user_t, user_r)
|
+ vlock_run(user_t, user_r)
|
||||||
')
|
')
|
||||||
|
|
||||||
ifndef(`distro_redhat',`
|
ifndef(`distro_redhat',`
|
||||||
@@ -102,10 +203,6 @@ ifndef(`distro_redhat',`
|
@@ -102,10 +208,6 @@ ifndef(`distro_redhat',`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -27972,7 +27977,7 @@ index 6d77e81..656a8c4 100644
|
|||||||
postgresql_role(user_r, user_t)
|
postgresql_role(user_r, user_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -128,7 +225,6 @@ ifndef(`distro_redhat',`
|
@@ -128,7 +230,6 @@ ifndef(`distro_redhat',`
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
ssh_role_template(user, user_r, user_t)
|
ssh_role_template(user, user_r, user_t)
|
||||||
')
|
')
|
||||||
@ -27980,7 +27985,7 @@ index 6d77e81..656a8c4 100644
|
|||||||
optional_policy(`
|
optional_policy(`
|
||||||
su_role_template(user, user_r, user_t)
|
su_role_template(user, user_r, user_t)
|
||||||
')
|
')
|
||||||
@@ -160,4 +256,24 @@ ifndef(`distro_redhat',`
|
@@ -160,4 +261,24 @@ ifndef(`distro_redhat',`
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
wireshark_role(user_r, user_t)
|
wireshark_role(user_r, user_t)
|
||||||
')
|
')
|
||||||
@ -45583,7 +45588,7 @@ index 3822072..d358162 100644
|
|||||||
+ allow semanage_t $1:dbus send_msg;
|
+ allow semanage_t $1:dbus send_msg;
|
||||||
+')
|
+')
|
||||||
diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
|
diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
|
||||||
index dc46420..9edcb69 100644
|
index dc46420..8d4ed0f 100644
|
||||||
--- a/policy/modules/system/selinuxutil.te
|
--- a/policy/modules/system/selinuxutil.te
|
||||||
+++ b/policy/modules/system/selinuxutil.te
|
+++ b/policy/modules/system/selinuxutil.te
|
||||||
@@ -11,14 +11,16 @@ gen_require(`
|
@@ -11,14 +11,16 @@ gen_require(`
|
||||||
@ -46001,9 +46006,9 @@ index dc46420..9edcb69 100644
|
|||||||
-corecmd_exec_bin(semanage_t)
|
-corecmd_exec_bin(semanage_t)
|
||||||
-
|
-
|
||||||
-dev_read_urand(semanage_t)
|
-dev_read_urand(semanage_t)
|
||||||
|
|
||||||
-domain_use_interactive_fds(semanage_t)
|
|
||||||
-
|
-
|
||||||
|
-domain_use_interactive_fds(semanage_t)
|
||||||
|
|
||||||
-files_read_etc_files(semanage_t)
|
-files_read_etc_files(semanage_t)
|
||||||
-files_read_etc_runtime_files(semanage_t)
|
-files_read_etc_runtime_files(semanage_t)
|
||||||
-files_read_usr_files(semanage_t)
|
-files_read_usr_files(semanage_t)
|
||||||
@ -46026,11 +46031,11 @@ index dc46420..9edcb69 100644
|
|||||||
-auth_use_nsswitch(semanage_t)
|
-auth_use_nsswitch(semanage_t)
|
||||||
-
|
-
|
||||||
-locallogin_use_fds(semanage_t)
|
-locallogin_use_fds(semanage_t)
|
||||||
|
-
|
||||||
|
-logging_send_syslog_msg(semanage_t)
|
||||||
+# Admins are creating pp files in random locations
|
+# Admins are creating pp files in random locations
|
||||||
+files_read_non_security_files(semanage_t)
|
+files_read_non_security_files(semanage_t)
|
||||||
|
|
||||||
-logging_send_syslog_msg(semanage_t)
|
|
||||||
-
|
|
||||||
-miscfiles_read_localization(semanage_t)
|
-miscfiles_read_localization(semanage_t)
|
||||||
-
|
-
|
||||||
-seutil_libselinux_linked(semanage_t)
|
-seutil_libselinux_linked(semanage_t)
|
||||||
@ -46118,7 +46123,7 @@ index dc46420..9edcb69 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -522,111 +597,197 @@ ifdef(`distro_ubuntu',`
|
@@ -522,111 +597,201 @@ ifdef(`distro_ubuntu',`
|
||||||
# Setfiles local policy
|
# Setfiles local policy
|
||||||
#
|
#
|
||||||
|
|
||||||
@ -46197,23 +46202,27 @@ index dc46420..9edcb69 100644
|
|||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
+ cloudform_dontaudit_write_cloud_log(setfiles_t)
|
+ cloudform_dontaudit_write_cloud_log(setfiles_t)
|
||||||
+')
|
+')
|
||||||
+
|
|
||||||
|
-seutil_libselinux_linked(setfiles_t)
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
+ devicekit_dontaudit_read_pid_files(setfiles_t)
|
+ devicekit_dontaudit_read_pid_files(setfiles_t)
|
||||||
+ devicekit_dontaudit_rw_log(setfiles_t)
|
+ devicekit_dontaudit_rw_log(setfiles_t)
|
||||||
+')
|
+')
|
||||||
|
|
||||||
-seutil_libselinux_linked(setfiles_t)
|
-userdom_use_all_users_fds(setfiles_t)
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
+ # pki is leaking
|
+ # pki is leaking
|
||||||
+ pki_dontaudit_write_log(setfiles_t)
|
+ pki_dontaudit_write_log(setfiles_t)
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
|
+ kdump_rw_inherited_kdumpctl_tmp_pipes(setfiles_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
+ xserver_append_xdm_tmp_files(setfiles_t)
|
+ xserver_append_xdm_tmp_files(setfiles_t)
|
||||||
+')
|
+')
|
||||||
|
+
|
||||||
-userdom_use_all_users_fds(setfiles_t)
|
|
||||||
+ifdef(`hide_broken_symptoms',`
|
+ifdef(`hide_broken_symptoms',`
|
||||||
+
|
+
|
||||||
+ optional_policy(`
|
+ optional_policy(`
|
||||||
|
@ -14958,10 +14958,18 @@ index c223f81..8b567c1 100644
|
|||||||
- admin_pattern($1, { httpd_cobbler_content_t httpd_cobbler_content_ra_t httpd_cobbler_content_rw_t })
|
- admin_pattern($1, { httpd_cobbler_content_t httpd_cobbler_content_ra_t httpd_cobbler_content_rw_t })
|
||||||
')
|
')
|
||||||
diff --git a/cobbler.te b/cobbler.te
|
diff --git a/cobbler.te b/cobbler.te
|
||||||
index 5f306dd..578b615 100644
|
index 5f306dd..cf347c6 100644
|
||||||
--- a/cobbler.te
|
--- a/cobbler.te
|
||||||
+++ b/cobbler.te
|
+++ b/cobbler.te
|
||||||
@@ -81,6 +81,7 @@ manage_dirs_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
|
@@ -67,6 +67,7 @@ dontaudit cobblerd_t self:capability sys_tty_config;
|
||||||
|
allow cobblerd_t self:process { getsched setsched signal };
|
||||||
|
allow cobblerd_t self:fifo_file rw_fifo_file_perms;
|
||||||
|
allow cobblerd_t self:tcp_socket { accept listen };
|
||||||
|
+allow cobblerd_t self:netlink_audit_socket create_socket_perms;
|
||||||
|
|
||||||
|
allow cobblerd_t cobbler_etc_t:dir list_dir_perms;
|
||||||
|
allow cobblerd_t cobbler_etc_t:file read_file_perms;
|
||||||
|
@@ -81,6 +82,7 @@ manage_dirs_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
|
||||||
manage_files_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
|
manage_files_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
|
||||||
manage_lnk_files_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
|
manage_lnk_files_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
|
||||||
files_var_lib_filetrans(cobblerd_t, cobbler_var_lib_t, dir)
|
files_var_lib_filetrans(cobblerd_t, cobbler_var_lib_t, dir)
|
||||||
@ -14969,7 +14977,7 @@ index 5f306dd..578b615 100644
|
|||||||
|
|
||||||
append_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
|
append_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
|
||||||
create_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
|
create_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
|
||||||
@@ -89,7 +90,7 @@ setattr_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
|
@@ -89,7 +91,7 @@ setattr_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
|
||||||
logging_log_filetrans(cobblerd_t, cobbler_var_log_t, file)
|
logging_log_filetrans(cobblerd_t, cobbler_var_log_t, file)
|
||||||
|
|
||||||
kernel_read_system_state(cobblerd_t)
|
kernel_read_system_state(cobblerd_t)
|
||||||
@ -14978,7 +14986,7 @@ index 5f306dd..578b615 100644
|
|||||||
|
|
||||||
corecmd_exec_bin(cobblerd_t)
|
corecmd_exec_bin(cobblerd_t)
|
||||||
corecmd_exec_shell(cobblerd_t)
|
corecmd_exec_shell(cobblerd_t)
|
||||||
@@ -112,14 +113,13 @@ corenet_tcp_sendrecv_http_port(cobblerd_t)
|
@@ -112,14 +114,13 @@ corenet_tcp_sendrecv_http_port(cobblerd_t)
|
||||||
corenet_tcp_connect_http_port(cobblerd_t)
|
corenet_tcp_connect_http_port(cobblerd_t)
|
||||||
corenet_sendrecv_http_client_packets(cobblerd_t)
|
corenet_sendrecv_http_client_packets(cobblerd_t)
|
||||||
|
|
||||||
@ -14994,7 +15002,7 @@ index 5f306dd..578b615 100644
|
|||||||
|
|
||||||
fs_getattr_all_fs(cobblerd_t)
|
fs_getattr_all_fs(cobblerd_t)
|
||||||
fs_read_iso9660_files(cobblerd_t)
|
fs_read_iso9660_files(cobblerd_t)
|
||||||
@@ -128,6 +128,8 @@ selinux_get_enforce_mode(cobblerd_t)
|
@@ -128,6 +129,8 @@ selinux_get_enforce_mode(cobblerd_t)
|
||||||
|
|
||||||
term_use_console(cobblerd_t)
|
term_use_console(cobblerd_t)
|
||||||
|
|
||||||
@ -15003,7 +15011,7 @@ index 5f306dd..578b615 100644
|
|||||||
logging_send_syslog_msg(cobblerd_t)
|
logging_send_syslog_msg(cobblerd_t)
|
||||||
|
|
||||||
miscfiles_read_localization(cobblerd_t)
|
miscfiles_read_localization(cobblerd_t)
|
||||||
@@ -160,6 +162,7 @@ tunable_policy(`cobbler_use_nfs',`
|
@@ -160,6 +163,7 @@ tunable_policy(`cobbler_use_nfs',`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -15011,7 +15019,7 @@ index 5f306dd..578b615 100644
|
|||||||
apache_search_sys_content(cobblerd_t)
|
apache_search_sys_content(cobblerd_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -170,6 +173,7 @@ optional_policy(`
|
@@ -170,6 +174,7 @@ optional_policy(`
|
||||||
bind_domtrans(cobblerd_t)
|
bind_domtrans(cobblerd_t)
|
||||||
bind_initrc_domtrans(cobblerd_t)
|
bind_initrc_domtrans(cobblerd_t)
|
||||||
bind_manage_zone(cobblerd_t)
|
bind_manage_zone(cobblerd_t)
|
||||||
@ -15019,7 +15027,7 @@ index 5f306dd..578b615 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -179,12 +183,22 @@ optional_policy(`
|
@@ -179,12 +184,22 @@ optional_policy(`
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
dhcpd_domtrans(cobblerd_t)
|
dhcpd_domtrans(cobblerd_t)
|
||||||
dhcpd_initrc_domtrans(cobblerd_t)
|
dhcpd_initrc_domtrans(cobblerd_t)
|
||||||
@ -15042,7 +15050,7 @@ index 5f306dd..578b615 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -192,13 +206,14 @@ optional_policy(`
|
@@ -192,13 +207,14 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -16417,7 +16425,7 @@ index 881d92f..a2d588a 100644
|
|||||||
+ ')
|
+ ')
|
||||||
')
|
')
|
||||||
diff --git a/condor.te b/condor.te
|
diff --git a/condor.te b/condor.te
|
||||||
index ce9f040..dc29445 100644
|
index ce9f040..320d6e8 100644
|
||||||
--- a/condor.te
|
--- a/condor.te
|
||||||
+++ b/condor.te
|
+++ b/condor.te
|
||||||
@@ -34,7 +34,7 @@ files_tmp_file(condor_startd_tmp_t)
|
@@ -34,7 +34,7 @@ files_tmp_file(condor_startd_tmp_t)
|
||||||
@ -16528,7 +16536,7 @@ index ce9f040..dc29445 100644
|
|||||||
#####################################
|
#####################################
|
||||||
#
|
#
|
||||||
# Negotiator local policy
|
# Negotiator local policy
|
||||||
@@ -183,6 +200,8 @@ allow condor_negotiator_t self:capability { setuid setgid };
|
@@ -183,12 +200,15 @@ allow condor_negotiator_t self:capability { setuid setgid };
|
||||||
allow condor_negotiator_t condor_master_t:tcp_socket rw_stream_socket_perms;
|
allow condor_negotiator_t condor_master_t:tcp_socket rw_stream_socket_perms;
|
||||||
allow condor_negotiator_t condor_master_t:udp_socket getattr;
|
allow condor_negotiator_t condor_master_t:udp_socket getattr;
|
||||||
|
|
||||||
@ -16537,7 +16545,14 @@ index ce9f040..dc29445 100644
|
|||||||
######################################
|
######################################
|
||||||
#
|
#
|
||||||
# Procd local policy
|
# Procd local policy
|
||||||
@@ -206,6 +225,8 @@ allow condor_schedd_t condor_master_t:udp_socket getattr;
|
#
|
||||||
|
|
||||||
|
allow condor_procd_t self:capability { fowner chown kill dac_override sys_ptrace };
|
||||||
|
+allow condor_procd_t self:cap_userns { sys_ptrace };
|
||||||
|
|
||||||
|
allow condor_procd_t condor_domain:process sigkill;
|
||||||
|
|
||||||
|
@@ -206,6 +226,8 @@ allow condor_schedd_t condor_master_t:udp_socket getattr;
|
||||||
|
|
||||||
allow condor_schedd_t condor_var_lock_t:dir manage_file_perms;
|
allow condor_schedd_t condor_var_lock_t:dir manage_file_perms;
|
||||||
|
|
||||||
@ -16546,7 +16561,7 @@ index ce9f040..dc29445 100644
|
|||||||
domtrans_pattern(condor_schedd_t, condor_procd_exec_t, condor_procd_t)
|
domtrans_pattern(condor_schedd_t, condor_procd_exec_t, condor_procd_t)
|
||||||
domtrans_pattern(condor_schedd_t, condor_startd_exec_t, condor_startd_t)
|
domtrans_pattern(condor_schedd_t, condor_startd_exec_t, condor_startd_t)
|
||||||
|
|
||||||
@@ -214,6 +235,8 @@ manage_files_pattern(condor_schedd_t, condor_schedd_tmp_t, condor_schedd_tmp_t)
|
@@ -214,6 +236,8 @@ manage_files_pattern(condor_schedd_t, condor_schedd_tmp_t, condor_schedd_tmp_t)
|
||||||
relabel_files_pattern(condor_schedd_t, condor_schedd_tmp_t, condor_schedd_tmp_t)
|
relabel_files_pattern(condor_schedd_t, condor_schedd_tmp_t, condor_schedd_tmp_t)
|
||||||
files_tmp_filetrans(condor_schedd_t, condor_schedd_tmp_t, { file dir })
|
files_tmp_filetrans(condor_schedd_t, condor_schedd_tmp_t, { file dir })
|
||||||
|
|
||||||
@ -16555,7 +16570,7 @@ index ce9f040..dc29445 100644
|
|||||||
#####################################
|
#####################################
|
||||||
#
|
#
|
||||||
# Startd local policy
|
# Startd local policy
|
||||||
@@ -238,11 +261,10 @@ domain_read_all_domains_state(condor_startd_t)
|
@@ -238,11 +262,10 @@ domain_read_all_domains_state(condor_startd_t)
|
||||||
mcs_process_set_categories(condor_startd_t)
|
mcs_process_set_categories(condor_startd_t)
|
||||||
|
|
||||||
init_domtrans_script(condor_startd_t)
|
init_domtrans_script(condor_startd_t)
|
||||||
@ -16568,7 +16583,7 @@ index ce9f040..dc29445 100644
|
|||||||
optional_policy(`
|
optional_policy(`
|
||||||
ssh_basic_client_template(condor_startd, condor_startd_t, system_r)
|
ssh_basic_client_template(condor_startd, condor_startd_t, system_r)
|
||||||
ssh_domtrans(condor_startd_t)
|
ssh_domtrans(condor_startd_t)
|
||||||
@@ -254,3 +276,7 @@ optional_policy(`
|
@@ -254,3 +277,7 @@ optional_policy(`
|
||||||
kerberos_use(condor_startd_ssh_t)
|
kerberos_use(condor_startd_ssh_t)
|
||||||
')
|
')
|
||||||
')
|
')
|
||||||
@ -24621,7 +24636,7 @@ index c697edb..954c090 100644
|
|||||||
+ allow $1 dhcpd_unit_file_t:service all_service_perms;
|
+ allow $1 dhcpd_unit_file_t:service all_service_perms;
|
||||||
')
|
')
|
||||||
diff --git a/dhcp.te b/dhcp.te
|
diff --git a/dhcp.te b/dhcp.te
|
||||||
index 98a24b9..cb5795e 100644
|
index 98a24b9..02c58ea 100644
|
||||||
--- a/dhcp.te
|
--- a/dhcp.te
|
||||||
+++ b/dhcp.te
|
+++ b/dhcp.te
|
||||||
@@ -20,6 +20,9 @@ init_daemon_domain(dhcpd_t, dhcpd_exec_t)
|
@@ -20,6 +20,9 @@ init_daemon_domain(dhcpd_t, dhcpd_exec_t)
|
||||||
@ -24639,7 +24654,7 @@ index 98a24b9..cb5795e 100644
|
|||||||
#
|
#
|
||||||
|
|
||||||
-allow dhcpd_t self:capability { chown dac_override sys_chroot net_raw setgid setuid sys_resource };
|
-allow dhcpd_t self:capability { chown dac_override sys_chroot net_raw setgid setuid sys_resource };
|
||||||
+allow dhcpd_t self:capability { chown dac_override sys_chroot net_raw kill setgid setuid setpcap sys_resource };
|
+allow dhcpd_t self:capability { chown dac_override fowner sys_chroot net_raw kill setgid setuid setpcap sys_resource };
|
||||||
dontaudit dhcpd_t self:capability { net_admin sys_tty_config };
|
dontaudit dhcpd_t self:capability { net_admin sys_tty_config };
|
||||||
allow dhcpd_t self:process { getcap setcap signal_perms };
|
allow dhcpd_t self:process { getcap setcap signal_perms };
|
||||||
allow dhcpd_t self:fifo_file rw_fifo_file_perms;
|
allow dhcpd_t self:fifo_file rw_fifo_file_perms;
|
||||||
@ -59439,7 +59454,7 @@ index 86dc29d..c7d9376 100644
|
|||||||
+ logging_log_filetrans($1, NetworkManager_var_lib_t, file, "wpa_supplicant.log")
|
+ logging_log_filetrans($1, NetworkManager_var_lib_t, file, "wpa_supplicant.log")
|
||||||
')
|
')
|
||||||
diff --git a/networkmanager.te b/networkmanager.te
|
diff --git a/networkmanager.te b/networkmanager.te
|
||||||
index 55f2009..debb78b 100644
|
index 55f2009..b073836 100644
|
||||||
--- a/networkmanager.te
|
--- a/networkmanager.te
|
||||||
+++ b/networkmanager.te
|
+++ b/networkmanager.te
|
||||||
@@ -9,15 +9,18 @@ type NetworkManager_t;
|
@@ -9,15 +9,18 @@ type NetworkManager_t;
|
||||||
@ -59530,7 +59545,7 @@ index 55f2009..debb78b 100644
|
|||||||
manage_dirs_pattern(NetworkManager_t, NetworkManager_etc_rw_t, NetworkManager_etc_rw_t)
|
manage_dirs_pattern(NetworkManager_t, NetworkManager_etc_rw_t, NetworkManager_etc_rw_t)
|
||||||
manage_files_pattern(NetworkManager_t, NetworkManager_etc_rw_t, NetworkManager_etc_rw_t)
|
manage_files_pattern(NetworkManager_t, NetworkManager_etc_rw_t, NetworkManager_etc_rw_t)
|
||||||
filetrans_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_rw_t, { dir file })
|
filetrans_pattern(NetworkManager_t, NetworkManager_etc_t, NetworkManager_etc_rw_t, { dir file })
|
||||||
@@ -68,30 +102,29 @@ create_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_
|
@@ -68,30 +102,30 @@ create_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_
|
||||||
setattr_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_t)
|
setattr_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_t)
|
||||||
logging_log_filetrans(NetworkManager_t, NetworkManager_log_t, file)
|
logging_log_filetrans(NetworkManager_t, NetworkManager_log_t, file)
|
||||||
|
|
||||||
@ -59542,7 +59557,8 @@ index 55f2009..debb78b 100644
|
|||||||
manage_dirs_pattern(NetworkManager_t, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
|
manage_dirs_pattern(NetworkManager_t, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
|
||||||
manage_files_pattern(NetworkManager_t, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
|
manage_files_pattern(NetworkManager_t, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
|
||||||
-files_var_lib_filetrans(NetworkManager_t, NetworkManager_var_lib_t, dir)
|
-files_var_lib_filetrans(NetworkManager_t, NetworkManager_var_lib_t, dir)
|
||||||
+files_var_lib_filetrans(NetworkManager_t, NetworkManager_var_lib_t, { dir file })
|
+manage_lnk_files_pattern(NetworkManager_t, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
|
||||||
|
+files_var_lib_filetrans(NetworkManager_t, NetworkManager_var_lib_t, { dir file lnk_file })
|
||||||
|
|
||||||
manage_dirs_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
|
manage_dirs_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
|
||||||
manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
|
manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
|
||||||
@ -59565,7 +59581,7 @@ index 55f2009..debb78b 100644
|
|||||||
corenet_all_recvfrom_netlabel(NetworkManager_t)
|
corenet_all_recvfrom_netlabel(NetworkManager_t)
|
||||||
corenet_tcp_sendrecv_generic_if(NetworkManager_t)
|
corenet_tcp_sendrecv_generic_if(NetworkManager_t)
|
||||||
corenet_udp_sendrecv_generic_if(NetworkManager_t)
|
corenet_udp_sendrecv_generic_if(NetworkManager_t)
|
||||||
@@ -102,36 +135,24 @@ corenet_raw_sendrecv_generic_node(NetworkManager_t)
|
@@ -102,36 +136,24 @@ corenet_raw_sendrecv_generic_node(NetworkManager_t)
|
||||||
corenet_tcp_sendrecv_all_ports(NetworkManager_t)
|
corenet_tcp_sendrecv_all_ports(NetworkManager_t)
|
||||||
corenet_udp_sendrecv_all_ports(NetworkManager_t)
|
corenet_udp_sendrecv_all_ports(NetworkManager_t)
|
||||||
corenet_udp_bind_generic_node(NetworkManager_t)
|
corenet_udp_bind_generic_node(NetworkManager_t)
|
||||||
@ -59607,7 +59623,7 @@ index 55f2009..debb78b 100644
|
|||||||
fs_getattr_all_fs(NetworkManager_t)
|
fs_getattr_all_fs(NetworkManager_t)
|
||||||
fs_search_auto_mountpoints(NetworkManager_t)
|
fs_search_auto_mountpoints(NetworkManager_t)
|
||||||
fs_list_inotifyfs(NetworkManager_t)
|
fs_list_inotifyfs(NetworkManager_t)
|
||||||
@@ -140,18 +161,36 @@ mls_file_read_all_levels(NetworkManager_t)
|
@@ -140,18 +162,36 @@ mls_file_read_all_levels(NetworkManager_t)
|
||||||
|
|
||||||
selinux_dontaudit_search_fs(NetworkManager_t)
|
selinux_dontaudit_search_fs(NetworkManager_t)
|
||||||
|
|
||||||
@ -59645,7 +59661,7 @@ index 55f2009..debb78b 100644
|
|||||||
|
|
||||||
seutil_read_config(NetworkManager_t)
|
seutil_read_config(NetworkManager_t)
|
||||||
|
|
||||||
@@ -166,21 +205,37 @@ sysnet_kill_dhcpc(NetworkManager_t)
|
@@ -166,21 +206,37 @@ sysnet_kill_dhcpc(NetworkManager_t)
|
||||||
sysnet_read_dhcpc_state(NetworkManager_t)
|
sysnet_read_dhcpc_state(NetworkManager_t)
|
||||||
sysnet_delete_dhcpc_state(NetworkManager_t)
|
sysnet_delete_dhcpc_state(NetworkManager_t)
|
||||||
sysnet_search_dhcp_state(NetworkManager_t)
|
sysnet_search_dhcp_state(NetworkManager_t)
|
||||||
@ -59687,7 +59703,7 @@ index 55f2009..debb78b 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -196,10 +251,6 @@ optional_policy(`
|
@@ -196,10 +252,6 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -59698,7 +59714,7 @@ index 55f2009..debb78b 100644
|
|||||||
consoletype_exec(NetworkManager_t)
|
consoletype_exec(NetworkManager_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -210,31 +261,34 @@ optional_policy(`
|
@@ -210,31 +262,34 @@ optional_policy(`
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
dbus_system_domain(NetworkManager_t, NetworkManager_exec_t)
|
dbus_system_domain(NetworkManager_t, NetworkManager_exec_t)
|
||||||
|
|
||||||
@ -59741,7 +59757,7 @@ index 55f2009..debb78b 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -246,10 +300,26 @@ optional_policy(`
|
@@ -246,10 +301,26 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -59768,7 +59784,7 @@ index 55f2009..debb78b 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -257,15 +327,19 @@ optional_policy(`
|
@@ -257,15 +328,19 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -59790,7 +59806,7 @@ index 55f2009..debb78b 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -274,10 +348,17 @@ optional_policy(`
|
@@ -274,10 +349,17 @@ optional_policy(`
|
||||||
nscd_signull(NetworkManager_t)
|
nscd_signull(NetworkManager_t)
|
||||||
nscd_kill(NetworkManager_t)
|
nscd_kill(NetworkManager_t)
|
||||||
nscd_initrc_domtrans(NetworkManager_t)
|
nscd_initrc_domtrans(NetworkManager_t)
|
||||||
@ -59808,7 +59824,7 @@ index 55f2009..debb78b 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -286,9 +367,12 @@ optional_policy(`
|
@@ -286,9 +368,12 @@ optional_policy(`
|
||||||
openvpn_kill(NetworkManager_t)
|
openvpn_kill(NetworkManager_t)
|
||||||
openvpn_signal(NetworkManager_t)
|
openvpn_signal(NetworkManager_t)
|
||||||
openvpn_signull(NetworkManager_t)
|
openvpn_signull(NetworkManager_t)
|
||||||
@ -59821,7 +59837,7 @@ index 55f2009..debb78b 100644
|
|||||||
policykit_domtrans_auth(NetworkManager_t)
|
policykit_domtrans_auth(NetworkManager_t)
|
||||||
policykit_read_lib(NetworkManager_t)
|
policykit_read_lib(NetworkManager_t)
|
||||||
policykit_read_reload(NetworkManager_t)
|
policykit_read_reload(NetworkManager_t)
|
||||||
@@ -296,7 +380,7 @@ optional_policy(`
|
@@ -296,7 +381,7 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -59830,7 +59846,7 @@ index 55f2009..debb78b 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -307,6 +391,7 @@ optional_policy(`
|
@@ -307,6 +392,7 @@ optional_policy(`
|
||||||
ppp_signal(NetworkManager_t)
|
ppp_signal(NetworkManager_t)
|
||||||
ppp_signull(NetworkManager_t)
|
ppp_signull(NetworkManager_t)
|
||||||
ppp_read_config(NetworkManager_t)
|
ppp_read_config(NetworkManager_t)
|
||||||
@ -59838,7 +59854,7 @@ index 55f2009..debb78b 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -320,14 +405,21 @@ optional_policy(`
|
@@ -320,14 +406,21 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -59865,7 +59881,7 @@ index 55f2009..debb78b 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -338,6 +430,13 @@ optional_policy(`
|
@@ -338,6 +431,13 @@ optional_policy(`
|
||||||
vpn_relabelfrom_tun_socket(NetworkManager_t)
|
vpn_relabelfrom_tun_socket(NetworkManager_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -59879,7 +59895,7 @@ index 55f2009..debb78b 100644
|
|||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# wpa_cli local policy
|
# wpa_cli local policy
|
||||||
@@ -357,6 +456,4 @@ rw_sock_files_pattern(wpa_cli_t, NetworkManager_var_run_t, NetworkManager_var_ru
|
@@ -357,6 +457,4 @@ rw_sock_files_pattern(wpa_cli_t, NetworkManager_var_run_t, NetworkManager_var_ru
|
||||||
init_dontaudit_use_fds(wpa_cli_t)
|
init_dontaudit_use_fds(wpa_cli_t)
|
||||||
init_use_script_ptys(wpa_cli_t)
|
init_use_script_ptys(wpa_cli_t)
|
||||||
|
|
||||||
@ -108897,10 +108913,10 @@ index 0000000..9524b50
|
|||||||
+')
|
+')
|
||||||
diff --git a/thumb.te b/thumb.te
|
diff --git a/thumb.te b/thumb.te
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 0000000..3f3a239
|
index 0000000..ab916b7
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/thumb.te
|
+++ b/thumb.te
|
||||||
@@ -0,0 +1,165 @@
|
@@ -0,0 +1,167 @@
|
||||||
+policy_module(thumb, 1.0.0)
|
+policy_module(thumb, 1.0.0)
|
||||||
+
|
+
|
||||||
+########################################
|
+########################################
|
||||||
@ -108940,6 +108956,7 @@ index 0000000..3f3a239
|
|||||||
+allow thumb_t self:fifo_file manage_fifo_file_perms;
|
+allow thumb_t self:fifo_file manage_fifo_file_perms;
|
||||||
+allow thumb_t self:unix_stream_socket create_stream_socket_perms;
|
+allow thumb_t self:unix_stream_socket create_stream_socket_perms;
|
||||||
+allow thumb_t self:netlink_route_socket r_netlink_socket_perms;
|
+allow thumb_t self:netlink_route_socket r_netlink_socket_perms;
|
||||||
|
+allow thumb_t self:netlink_kobject_uevent_socket create_socket_perms;
|
||||||
+allow thumb_t self:udp_socket create_socket_perms;
|
+allow thumb_t self:udp_socket create_socket_perms;
|
||||||
+allow thumb_t self:tcp_socket create_socket_perms;
|
+allow thumb_t self:tcp_socket create_socket_perms;
|
||||||
+allow thumb_t self:shm create_shm_perms;
|
+allow thumb_t self:shm create_shm_perms;
|
||||||
@ -108967,6 +108984,7 @@ index 0000000..3f3a239
|
|||||||
+can_exec(thumb_t, thumb_exec_t)
|
+can_exec(thumb_t, thumb_exec_t)
|
||||||
+
|
+
|
||||||
+kernel_read_system_state(thumb_t)
|
+kernel_read_system_state(thumb_t)
|
||||||
|
+kernel_dgram_send(thumb_t)
|
||||||
+
|
+
|
||||||
+corecmd_exec_bin(thumb_t)
|
+corecmd_exec_bin(thumb_t)
|
||||||
+corecmd_exec_shell(thumb_t)
|
+corecmd_exec_shell(thumb_t)
|
||||||
|
@ -19,7 +19,7 @@
|
|||||||
Summary: SELinux policy configuration
|
Summary: SELinux policy configuration
|
||||||
Name: selinux-policy
|
Name: selinux-policy
|
||||||
Version: 3.13.1
|
Version: 3.13.1
|
||||||
Release: 232%{?dist}
|
Release: 233%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: serefpolicy-%{version}.tgz
|
Source: serefpolicy-%{version}.tgz
|
||||||
@ -675,6 +675,17 @@ exit 0
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Sun Jan 08 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-233
|
||||||
|
-Allow thumb domain sendto via dgram sockets. BZ(1398813)
|
||||||
|
- Add condor_procd_t domain sys_ptrace cap_userns BZ(1411077)
|
||||||
|
- Allow cobbler domain to create netlink_audit sockets BZ(1384600)
|
||||||
|
- Allow networkmanager to manage networkmanager_var_lib_t lnk files BZ(1408626)
|
||||||
|
- Add dhcpd_t domain fowner capability BZ(1409963)
|
||||||
|
- Allow thumb to create netlink_kobject_uevent sockets. BZ(1410942)
|
||||||
|
- Fix broken interfaces
|
||||||
|
- Allow setfiles_t domain rw inherited kdumpctl tmp pipes BZ(1356456)
|
||||||
|
- Allow user_t run systemctl --user BZ(1401625)
|
||||||
|
|
||||||
* Fri Jan 06 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-232
|
* Fri Jan 06 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-232
|
||||||
- Add tlp_var_lib_t label for /var/lib/tlp directory BZ(1409977)
|
- Add tlp_var_lib_t label for /var/lib/tlp directory BZ(1409977)
|
||||||
- Allow tlp_t domain to read proc_net_t BZ(1403487)
|
- Allow tlp_t domain to read proc_net_t BZ(1403487)
|
||||||
|
Loading…
Reference in New Issue
Block a user