.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -1,4 +1,3 @@
-/selinux-policy-*.tar.gz
+SOURCES/container-selinux.tgz
-/container-selinux.tgz
+SOURCES/selinux-policy-contrib-aadacd8.tar.gz
-/macro-expander
+SOURCES/selinux-policy-fa87f85.tar.gz
-*.rpm

.selinux-policy.metadata

@@ -0,0 +1,3 @@
+34a078fbec0190b407d64c1664aaa0887204ba2e SOURCES/container-selinux.tgz
+470eeffd45f8dd003edb6ddbff4104e573b6c08d SOURCES/selinux-policy-contrib-aadacd8.tar.gz
+91c17cd38073aba5562898449fe3b4f2bbffac8e SOURCES/selinux-policy-fa87f85.tar.gz

COPYING

@@ -1,340 +0,0 @@
-		    GNU GENERAL PUBLIC LICENSE
-		       Version 2, June 1991
-
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.
-                       59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-			    Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Library General Public License instead.)  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
-
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-		    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
-
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
-
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-
-  8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
-
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
-			    NO WARRANTY
-
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
-		     END OF TERMS AND CONDITIONS
-
-	    How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) year name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Library General
-Public License instead of this License.

README.md

@@ -1,49 +0,0 @@
-## Purpose
-
-SELinux Fedora Policy is a fork of the [SELinux reference policy](https://github.com/SELinuxProject/refpolicy/). The [fedora-selinux/selinux-policy](https://github.com/selinux-policy/selinux-policy.git) repo makes Fedora packaging simpler and more transparent for packagers, upstream developers, and users. It is used for applying downstream Fedora fixes, for communication about proposed/committed changes, and for communication with upstream and the community. It reflects the upstream repository structure to make submitting patches to upstream easy.
-
-## Structure
-
-### GitHub
-On GitHub, we have one repository containing the policy sources.
-
-    $ cd selinux-policy
-    $ git remote -v
-    origin	git@github.com:fedora-selinux/selinux-policy.git (fetch)
-
-    $ git branch -r
-    origin/HEAD -> origin/master
-    origin/f27
-    origin/f28
-    origin/master
-    origin/rawhide
-
-Note: As opposed to dist-git, the Rawhide content resides in the _rawhide_ branch rather than _master_.
-
-### dist-git
-Package sources in dist-git are composed from the _selinux-policy_ repository snapshot tarball, _container-selinux_ policy files snapshot, the _macro-expander_ script snapshot, and from other config files.
-
-## Build process
-
-1. Clone the [fedora-selinux/selinux-policy](https://github.com/fedora-selinux/selinux-policy) repository.
-
-        $ cd ~/devel/github
-        $ git clone git@github.com:fedora-selinux/selinux-policy.git
-        $ cd selinux-policy
-
-2. Create, backport, or cherry-pick needed changes to a particular branch and push them.
-
-3. Clone the **selinux-policy** dist-git repository.
-
-        $ cd ~/devel/dist-git
-        $ fedpkg clone selinux-policy
-        $ cd selinux-policy
-
-4. Download the latest snapshot from the selinux-policy GitHub repository.
-
-        $ ./make-rhat-patches.sh
-
-5. Add changes to the dist-git repository, bump release, create a changelog entry, commit, and push.
-6. Build the package.
-
-        $ fedpkg build

SOURCES/booleans-targeted.conf

@@ -12,6 +12,7 @@ pppd_can_insmod = false
 privoxy_connect_any = true
 selinuxuser_direct_dri_enabled = true
 selinuxuser_execmem = true
+selinuxuser_execmod = true
 selinuxuser_execstack = true
 selinuxuser_rw_noexattrfile=true
 selinuxuser_ping = true
@@ -21,4 +22,3 @@ unconfined_chrome_sandbox_transition=true
 unconfined_mozilla_plugin_transition=true
 xguest_exec_content = true
 mozilla_plugin_can_network_connect = true
-use_virtualbox = true

SOURCES/file_contexts.subs_dist

@@ -2,7 +2,6 @@
 /run/lock /var/lock
 /run/systemd/system /usr/lib/systemd/system
 /run/systemd/generator /usr/lib/systemd/system
-/run/systemd/generator.early /usr/lib/systemd/system
 /run/systemd/generator.late /usr/lib/systemd/system
 /lib /usr/lib
 /lib64 /usr/lib
@@ -13,12 +12,9 @@
 /var/lib/xguest/home /home
 /var/named/chroot/usr/lib64 /usr/lib
 /var/named/chroot/lib64 /usr/lib
-/var/named/chroot/var  /var
 /home-inst            /home
 /home/home-inst            /home
 /var/roothome        /root
 /sbin                /usr/sbin
 /sysroot/tmp         /tmp
 /var/usrlocal        /usr/local
-/var/mnt             /mnt
-/bin                 /usr/bin

SOURCES/macro-expander

@@ -0,0 +1,81 @@
+#!/bin/bash
+
+function usage {
+    echo "Usage: $0 [ -c | -t [ -M ] ] <macro>"
+    echo "Options:
+  -c     generate CIL output
+  -t     generate standard policy source format (.te) allow rules - this is default
+  -M     generate complete module .te output
+"
+}
+
+function cleanup {
+    rm -rf $TEMP_STORE
+}
+
+while getopts "chMt" opt; do
+    case $opt in
+        c) GENCIL=1
+           ;;
+        t) GENTE=1
+           ;;
+        M) GENTEMODULE=1
+           ;;
+        h) usage
+           exit 0
+           ;;
+        \?) usage
+           exit 1
+           ;;
+    esac
+done
+
+shift $((OPTIND-1))
+
+SELINUX_MACRO=$1
+
+if [ -z "$SELINUX_MACRO" ]
+then
+    exit 1
+fi
+
+TEMP_STORE="$(mktemp -d)"
+cd $TEMP_STORE || exit 1
+
+IFS="("
+set $1
+SELINUX_DOMAIN="${2::-1}"
+
+echo -e "policy_module(expander, 1.0.0) \n" \
+     "gen_require(\`\n" \
+     "type $SELINUX_DOMAIN ; \n" \
+     "')" > expander.te
+
+echo "$SELINUX_MACRO" >> expander.te
+
+make -f /usr/share/selinux/devel/Makefile tmp/all_interfaces.conf &> /dev/null
+
+if [ "x$GENCIL" = "x1" ]; then
+
+    make -f /usr/share/selinux/devel/Makefile expander.pp &> /dev/null
+    MAKE_RESULT=$?
+
+    if [ $MAKE_RESULT -ne 2 ]
+    then
+        /usr/libexec/selinux/hll/pp < $TEMP_STORE/expander.pp > $TEMP_STORE/expander.cil 2> /dev/null
+        grep -v "cil_gen_require" $TEMP_STORE/expander.cil | sort -u
+    fi
+fi
+
+if [ "$GENTE" = "1" ] || [ "x$GENCIL" != "x1" ]; then
+    m4 -D enable_mcs -D distro_redhat -D hide_broken_symptoms -D mls_num_sens=16 -D mls_num_cats=1024 -D mcs_num_cats=1024 -s /usr/share/selinux/devel/include/support/file_patterns.spt /usr/share/selinux/devel/include/support/ipc_patterns.spt /usr/share/selinux/devel/include/support/obj_perm_sets.spt /usr/share/selinux/devel/include/support/misc_patterns.spt /usr/share/selinux/devel/include/support/misc_macros.spt /usr/share/selinux/devel/include/support/all_perms.spt /usr/share/selinux/devel/include/support/mls_mcs_macros.spt /usr/share/selinux/devel/include/support/loadable_module.spt tmp/all_interfaces.conf expander.te > expander.tmp 2> /dev/null
+    if [ "x$GENTEMODULE" = "x1" ]; then
+       #    sed '/^#.*$/d;/^\s*$/d;/^\s*class .*/d;/^\s*category .*/d;s/^\s*//' expander.tmp
+        sed '/^#.*$/d;/^\s*$/d;/^\s*category .*/d;s/^\s*//' expander.tmp
+    else
+        grep  '^\s*allow' expander.tmp | sed 's/^\s*//'
+    fi
+fi
+
+cd - > /dev/null || exit 1
+cleanup

SOURCES/modules-mls-contrib.conf

@@ -691,13 +691,6 @@ logwatch = module
 # 
 lpd = module
 
-# Layer: services
-# Module: lsm
-# 
-# lsm policy
-#
-lsm = module
-
 # Layer: services
 # Module: mailman
 #
@@ -1579,10 +1572,3 @@ zosremote = module
 # Policy for mandb
 # 
 mandb = module
-
-# Layer: service
-# Module: qgs
-#
-# TDX QGS Daemon
-#
-qgs = module

SOURCES/modules-targeted-base.conf

@@ -391,3 +391,10 @@ udev = module
 # The unconfined domain.
 # 
 unconfined = module
+
+# Layer: system
+# Module: kdbus
+#
+# Policy for kdbus.
+#
+kdbus = module

SOURCES/modules-targeted-contrib.conf

@@ -292,6 +292,13 @@ cfengine = module
 # 
 cgroup = module
 
+# Layer: contrib
+# Module: cgdcbxd
+#
+# cgdcbxd policy
+#
+cgdcbxd = module
+
 # Layer: apps
 # Module: chrome
 #
@@ -342,6 +349,13 @@ cmirrord = module
 # 
 cobbler = module
 
+# Layer: contrib
+# Module: cockpit
+#
+# cockpit - Cockpit runs in a browser and can manage your network of GNU/Linux machines.
+# 
+cockpit = module
+
 # Layer: services
 # Module: collectd
 #
@@ -1991,7 +2005,7 @@ timidity = off
 tmpreaper = module
 
 # Layer: contrib
-# Module: glusterd
+# Module: tomcat
 #  
 #  policy for tomcat service
 #
@@ -2643,135 +2657,9 @@ rrdcached = module
 #
 stratisd = module
 
-# Layer: contrib
-# Module: ica
-#
-# ica
-#
-ica = module
-
 # Layer: contrib
 # Module: insights_client
 #
 # insights_client
 #
 insights_client = module
-
-# Layer: contrib
-# Module: stalld
-#
-# stalld
-#
-stalld = module
-
-# Layer: contrib
-# Module: rhcd
-#
-# rhcd
-#
-rhcd = module
-
-# Layer: contrib
-# Module: wireguard
-#
-# wireguard
-#
-wireguard = module
-
-# Layer: contrib
-# Module: mptcpd
-#
-# mptcpd
-#
-mptcpd = module
-	
-# Layer: contrib
-# Module: rshim
-#
-# rshim
-#
-rshim = module
-
-# Layer: contrib
-# Module: boothd
-#
-#  boothd - Booth cluster ticket manager
-#
-boothd = module
-
-# Layer: contrib
-# Module: fdo
-#
-#  fdo - fido device onboard protocol for IoT devices
-#
-fdo = module
-
-# Layer: contrib
-# Module: qatlib
-#
-#  qatlib - Intel QuickAssist technology library and resources management
-#
-qatlib = module
-
-# Layer: contrib
-# Module: nvme_stas
-#
-# nvme_stas
-#
-nvme_stas = module
-
-# Layer: contrib
-# Module: coreos_installer
-#
-# coreos_installer
-#
-coreos_installer = module
-
-# Layer: contrib
-# Module: afterburn
-#
-# afterburn
-#
-afterburn = module
-
-# Layer: contrib
-# Module: sap_unconfined
-#
-#  sap_unconfined
-#
-sap = module
-
-# Layer: contrib
-# Module: bootupd
-#
-#  bootupd - bootloader update daemon
-#
-bootupd = module
-
-# Layer: contrib
-# Module: iiosensorproxy
-#
-# Policy for iio-sensor-proxy - IIO sensors to D-Bus proxy
-#
-iiosensorproxy = module
-
-# Layer: system
-# Module: powerprofiles
-#
-# Policy for power-profiles-daemon - power profiles handling over D-Bus
-#
-powerprofiles = module
-
-# Layer: system
-# Module: switcheroo
-#
-# Policy for switcheroo-control: D-Bus service to check dual GPU availability
-#
-switcheroo = module
-
-# Layer: service
-# Module: qgs
-#
-# TDX QGS Daemon
-#
-qgs = module

SOURCES/rpm.macros

@@ -32,6 +32,7 @@
 # %selinux_requires
 %selinux_requires \
 Requires: selinux-policy >= %{_selinux_policy_version} \
+BuildRequires: git \
 BuildRequires: pkgconfig(systemd) \
 BuildRequires: selinux-policy \
 BuildRequires: selinux-policy-devel \
@@ -47,24 +48,20 @@ Requires(post): policycoreutils-python \
 
 # %selinux_modules_install [-s <policytype>] [-p <modulepriority>] module [module]...
 %selinux_modules_install("s:p:") \
-if [ -e /etc/selinux/config ]; then \
+. /etc/selinux/config \
-  . /etc/selinux/config \
-fi \
 _policytype=%{-s*} \
 if [ -z "${_policytype}" ]; then \
   _policytype="targeted" \
 fi \
 if [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
-  %{_sbindir}/semodule -n -s ${_policytype} -X %{!-p:200}%{-p*} -i %* || : \
+  %{_sbindir}/semodule -n -s ${_policytype} -X %{!-p:200}%{-p*} -i %* \
   %{_sbindir}/selinuxenabled && %{_sbindir}/load_policy || : \
 fi \
 %{nil}
 
 # %selinux_modules_uninstall [-s <policytype>] [-p <modulepriority>] module [module]...
 %selinux_modules_uninstall("s:p:") \
-if [ -e /etc/selinux/config ]; then \
+. /etc/selinux/config \
-  . /etc/selinux/config \
-fi \
 _policytype=%{-s*} \
 if [ -z "${_policytype}" ]; then \
   _policytype="targeted" \
@@ -79,26 +76,20 @@ fi \
 
 # %selinux_relabel_pre [-s <policytype>]
 %selinux_relabel_pre("s:") \
-if %{_sbindir}/selinuxenabled; then \
+. /etc/selinux/config \
-  if [ -e /etc/selinux/config ]; then \
+_policytype=%{-s*} \
-    . /etc/selinux/config \
+if [ -z "${_policytype}" ]; then \
-  fi \
-  _policytype=%{-s*} \
-  if [ -z "${_policytype}" ]; then \
   _policytype="targeted" \
-  fi \
+fi \
-  if [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
+if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
   [ -f %{_file_context_file_pre} ] || cp -f %{_file_context_file} %{_file_context_file_pre} \
-  fi \
 fi \
 %{nil}
 
 
 # %selinux_relabel_post [-s <policytype>]
 %selinux_relabel_post("s:") \
-if [ -e /etc/selinux/config ]; then \
+. /etc/selinux/config \
-  . /etc/selinux/config \
-fi \
 _policytype=%{-s*} \
 if [ -z "${_policytype}" ]; then \
   _policytype="targeted" \
@@ -113,9 +104,7 @@ fi \
 
 # %selinux_set_booleans [-s <policytype>] boolean [boolean]...
 %selinux_set_booleans("s:") \
-if [ -e /etc/selinux/config ]; then \
+. /etc/selinux/config \
-  . /etc/selinux/config \
-fi \
 _policytype=%{-s*} \
 if [ -z "${_policytype}" ]; then \
   _policytype="targeted" \
@@ -154,9 +143,7 @@ fi \
 
 # %selinux_unset_booleans [-s <policytype>] boolean [boolean]...
 %selinux_unset_booleans("s:") \
-if [ -e /etc/selinux/config ]; then \
+. /etc/selinux/config \
-  . /etc/selinux/config \
-fi \
 _policytype=%{-s*} \
 if [ -z "${_policytype}" ]; then \
   _policytype="targeted" \

SOURCES/users-minimum

@@ -25,7 +25,7 @@ gen_user(system_u,, system_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
 # permit any access to such users, then remove this entry.
 #
 gen_user(user_u, user, user_r, s0, s0)
-gen_user(staff_u, user, staff_r system_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
+gen_user(staff_u, user, staff_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
 gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
 
 #
@@ -36,4 +36,3 @@ gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
 # not in the sysadm_r.
 #
 gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)

SOURCES/users-mls

@@ -25,7 +25,7 @@ gen_user(system_u,, system_r, s0, s0 - mls_systemhigh, mcs_allcats)
 # permit any access to such users, then remove this entry.
 #
 gen_user(user_u, user, user_r, s0, s0)
-gen_user(staff_u, user, staff_r system_r sysadm_r secadm_r auditadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
+gen_user(staff_u, user, staff_r sysadm_r secadm_r auditadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
 gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
 
 #
@@ -36,5 +36,3 @@ gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
 # not in the sysadm_r.
 #
 gen_user(root, user, sysadm_r staff_r secadm_r auditadm_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-gen_user(guest_u, user, guest_r, s0, s0)
-gen_user(xguest_u, user, xguest_r, s0, s0)

SOURCES/users-targeted

@@ -25,7 +25,7 @@ gen_user(system_u,, system_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
 # permit any access to such users, then remove this entry.
 #
 gen_user(user_u, user, user_r, s0, s0)
-gen_user(staff_u, user, staff_r system_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
+gen_user(staff_u, user, staff_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
 gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
 
 #
@@ -36,6 +36,3 @@ gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
 # not in the sysadm_r.
 #
 gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-gen_user(guest_u, user, guest_r, s0, s0)
-gen_user(xguest_u, user, xguest_r, s0, s0)

booleans-automotive.conf

@@ -1,15 +0,0 @@
-gssd_read_tmp = true
-httpd_builtin_scripting = true
-httpd_enable_cgi = true
-kerberos_enabled = true
-mount_anyfile = true
-nfs_export_all_ro = true
-nfs_export_all_rw = true
-pppd_can_insmod = false
-selinuxuser_direct_dri_enabled = true
-selinuxuser_execstack = true
-selinuxuser_rw_noexattrfile=true
-selinuxuser_ping = true
-unconfined_chrome_sandbox_transition=true
-unconfined_mozilla_plugin_transition=true
-use_virtualbox = true

gating.yaml

@@ -1,7 +0,0 @@
---- !Policy
-product_versions:
-  - rhel-9
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
-  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

ifndefy.py

@@ -1,80 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright (C) 2021 Red Hat, Inc.
-#
-# This library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation; either
-# version 2.1 of the License, or (at your option) any later version.
-#
-# This library is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# Lesser General Public License for more details.
-#
-# You should have received a copy of the GNU Lesser General Public
-# License along with this library.  If not, see
-# <http://www.gnu.org/licenses/>.
-
-# About:
-# When provided with an interface file, this script outputs a new interface
-# file, where all original interfaces are enclosed in an ifndef statement
-# dependent on their name. All indentation inside the interface file should
-# be converted to tabs before running this script.
-# 
-# Known issues:
-# - interface already enclosed in an ifndef statement is not ignored
-# - "`"  and "'" inside comments are not ignored
-# - \t is always used for indentation - may result in mixture of spaces and tabs
-
-import sys
-import os
-import re
-
-if len(sys.argv) < 1:
-    print(("Usage: {} <policy>.if > <output>.if").format(sys.argv[0]), file=sys.stderr)
-    exit(os.EX_USAGE)
-
-# ending index of interface
-end = 0
-with open(sys.argv[1], 'r') as f:
-    interfaces = f.read()
-    file_len = len(interfaces)
-
-    while end < file_len:
-        start = interfaces.find("interface(`", end)
-        if start < 0:
-            #no more interfaces
-            print(interfaces[end:], end ="")
-            break
-        name_end = interfaces.find("'", start+11)
-        name = interfaces[start+11:name_end]
-
-        # locate the end of the interface - i.e. ending apostrophe
-        reg = re.compile(r"[`']")
-        # skip the ' after interface name
-        i = name_end+1
-        # counter for the depth (` opens a new block, while ' closes it)
-        graves = 0
-        while i < file_len:
-            match = reg.search(interfaces, i)
-            if not match:
-                print("Malformed interface: {}".format(name), file=sys.stderr)
-                exit(1)
-
-            i = match.end()
-            if match.group(0) == '`':
-                graves += 1
-            else:
-                graves -= 1
-                if graves == 0:
-                    break
-
-        # keep everything between the end of previous interface and start of a new one
-        print(interfaces[end:start], end ="")
-        # interface ends in "')" -- add 1 for the edning bracket
-        end = i+1
-        # print the whole interface enclosed in "ifndef"
-        print("ifndef(`{}',`".format(name))
-        print('\n'.join([('\t' + x) if x else x for x in interfaces[start:end].split('\n')]))
-        print("')", end ="")

make-rhat-patches.sh

@@ -1,57 +0,0 @@
-#!/bin/bash
-
-DISTGIT_PATH=$(pwd)
-
-RHEL_VERSION="c9s"
-DISTGIT_BRANCH="c9s"
-REPO_SELINUX_POLICY=${REPO_SELINUX_POLICY:-https://github.com/fedora-selinux/selinux-policy.git}
-REPO_SELINUX_POLICY_BRANCH=${REPO_SELINUX_POLICY_BRANCH:-$RHEL_VERSION}
-REPO_CONTAINER_SELINUX=${REPO_CONTAINER_SELINUX:-git@github.com:projectatomic/container-selinux.git}
-REPO_MACRO_EXPANDER=${REPO_MACRO_EXPANDER:-git@gitlab.cee.redhat.com:SELinux/macro-expander.git}
-
-# When -l is specified, we use locally created tarballs and don't download them from github
-DOWNLOAD_DEFAULT_GITHUB_TARBALLS=1
-if [ "$1" == "-l" ]; then
-    DOWNLOAD_DEFAULT_GITHUB_TARBALLS=0
-fi
-
-#git checkout $DISTGIT_BRANCH -q
-
-POLICYSOURCES=`mktemp -d --tmpdir policysources.XXXXXX`
-pushd $POLICYSOURCES > /dev/null
-
-git clone --depth=1 -q $REPO_SELINUX_POLICY selinux-policy \
-    -b $REPO_SELINUX_POLICY_BRANCH
-git clone --depth=1 -q $REPO_CONTAINER_SELINUX container-selinux
-git clone --depth=1 -q $REPO_MACRO_EXPANDER macro-expander
-
-pushd selinux-policy > /dev/null
-# prepare policy patches against upstream commits matching the last upstream merge
-BASE_HEAD_ID=$(git rev-parse HEAD)
-BASE_SHORT_HEAD_ID=$(c=${BASE_HEAD_ID}; echo ${c:0:7})
-git archive --prefix=selinux-policy-$BASE_HEAD_ID/ --format tgz HEAD > $DISTGIT_PATH/selinux-policy-$BASE_SHORT_HEAD_ID.tar.gz
-popd > /dev/null
-
-pushd container-selinux > /dev/null
-# Actual container-selinux files are in master branch
-#git checkout -b ${DOCKER_FEDORA_VERSION} -t origin/${DOCKER_FEDORA_VERSION} -q
-tar -czf container-selinux.tgz container.if container.te container.fc
-popd > /dev/null
-
-pushd $DISTGIT_PATH > /dev/null
-cp $POLICYSOURCES/container-selinux/container-selinux.tgz .
-cp $POLICYSOURCES/macro-expander/macro-expander.sh ./macro-expander
-chmod +x ./macro-expander
-popd > /dev/null
-
-popd > /dev/null
-rm -rf $POLICYSOURCES
-
-# Update commit id in selinux-policy.spec file
-sed -i "s/%global commit [^ ]*$/%global commit $BASE_HEAD_ID/" selinux-policy.spec
-
-# Update sources
-sha512sum --tag selinux-policy-${BASE_SHORT_HEAD_ID}.tar.gz container-selinux.tgz macro-expander > sources
-
-echo -e "\nSELinux policy tarball and container-selinux.tgz with container policy files have been created."
-echo "Commit id of selinux-policy in spec file was changed to ${BASE_HEAD_ID}"

modules-automotive-base.conf

@@ -1,604 +0,0 @@
-# Layer: admin
-# Module: anaconda
-#
-# Policy for the Anaconda installer.
-#
-anaconda = module
-
-# Layer: services
-# Module: apache
-#
-# Apache web server
-#
-apache = module
-
-# Module: application
-# Required in base
-#
-# Defines attributs and interfaces for all user applications
-#
-application = module
-
-# Layer: role
-# Module: auditadm
-#
-# auditadm account on tty logins
-#
-auditadm = module
-
-# Layer: system
-# Module: authlogin
-#
-# Common policy for authentication and user login.
-#
-authlogin = module
-
-# Layer: services
-# Module: bluetooth
-#
-# Bluetooth tools and system services.
-#
-bluetooth = module
-
-# Module: bootloader
-#
-# Policy for the kernel modules, kernel image, and bootloader.
-#
-bootloader = module
-
-# Layer: services
-# Module: chronyd
-#
-# Daemon for maintaining clock time
-#
-chronyd = module
-
-# Layer: system
-# Module: clock
-#
-# Policy for reading and setting the hardware clock.
-#
-clock = module
-
-# Layer: kernel
-# Module: corecommands
-# Required in base
-#
-# Core policy for shells, and generic programs
-# in /bin, /sbin, /usr/bin, and /usr/sbin.
-#
-corecommands = base
-
-# Layer: kernel
-# Module: corenetwork
-# Required in base
-#
-# Policy controlling access to network objects
-#
-corenetwork = base
-
-# Layer: services
-# Module: cpucontrol
-#
-# Services for loading CPU microcode and CPU frequency scaling.
-#
-cpucontrol = module
-
-# Layer: system
-# Module: daemontools
-#
-# Collection of tools for managing UNIX services
-#
-daemontools = module
-
-# Layer: services
-# Module: dbus
-#
-# Desktop messaging bus
-#
-dbus = module
-
-# Module: devices
-# Required in base
-#
-# Device nodes and interfaces for many basic system devices.
-#
-devices = base
-
-# Layer: services
-# Module: dhcp
-#
-# Dynamic host configuration protocol (DHCP) server
-#
-dhcp = module
-
-# Layer: admin
-# Module: dmesg
-#
-# Policy for dmesg.
-#
-dmesg = module
-
-# Module: domain
-# Required in base
-#
-# Core policy for domains.
-#
-domain = base
-
-# Module: files
-# Required in base
-#
-# Basic filesystem types and interfaces.
-#
-files = base
-
-# Module: filesystem
-# Required in base
-#
-# Policy for filesystems.
-#
-filesystem = base
-
-# Layer: system
-# Module: fstools
-#
-# Tools for filesystem management, such as mkfs and fsck.
-#
-fstools = module
-
-# Layer: contrib
-# Module: fwupd
-#
-# fwupd is a daemon to allow session software to update device firmware.
-#
-fwupd = module
-
-# Layer: apps
-# Module: games
-#
-# The Open Group Pegasus CIM/WBEM Server.
-#
-games = module
-
-# Layer: system
-# Module: getty
-#
-# Policy for getty.
-#
-getty = module
-
-# Layer: apps
-# Module: gnome
-#
-# gnome session and gconf
-#
-gnome = module
-
-# Layer: apps
-# Module: gpg
-#
-# Policy for GNU Privacy Guard and related programs.
-#
-gpg = module
-
-# Layer: system
-# Module: hostname
-#
-# Policy for changing the system host name.
-#
-hostname = module
-
-# Layer: system
-# Module: init
-#
-# System initialization programs (init and init scripts).
-#
-init = module
-
-# Layer: system
-# Module: ipsec
-#
-# TCP/IP encryption
-#
-ipsec = module
-
-# Layer: system
-# Module: iptables
-#
-# Policy for iptables.
-#
-iptables = module
-
-# Layer: contrib
-# Module: journalctl
-#
-# journalctl policy
-#
-journalctl = module
-
-# Layer: services
-# Module: kerberos
-#
-# MIT Kerberos admin and KDC
-#
-kerberos = module
-
-# Module: kernel
-# Required in base
-#
-# Policy for kernel threads, proc filesystem,and unlabeled processes and objects.
-#
-kernel = base
-
-# Layer: services
-# Module: ldap
-#
-# OpenLDAP directory server
-#
-ldap = module
-
-# Layer: system
-# Module: libraries
-#
-# Policy for system libraries.
-#
-libraries = module
-
-# Layer: apps
-# Module: loadkeys
-#
-# Load keyboard mappings.
-#
-loadkeys = module
-
-# Layer: system
-# Module: locallogin
-#
-# Policy for local logins.
-#
-locallogin = module
-
-# Layer: role
-# Module: logadm
-#
-# Minimally prived root role for managing logging system
-#
-logadm = module
-
-# Layer: system
-# Module: logging
-#
-# Policy for the kernel message logger and system logging daemon.
-#
-logging = module
-
-# Layer: services
-# Module: lpd
-#
-# Line printer daemon
-#
-lpd = module
-
-# Layer: system
-# Module: lvm
-#
-# Policy for logical volume management programs.
-#
-lvm = module
-
-# Layer: contrib
-# Module: mandb
-#
-# Policy for mandb
-#
-mandb = module
-
-# Module: mcs
-# Required in base
-#
-# MultiCategory security policy
-#
-mcs = base
-
-# Layer: system
-# Module: miscfiles
-#
-# Miscelaneous files.
-#
-miscfiles = module
-
-# Module: mls
-# Required in base
-#
-# Multilevel security policy
-#
-mls = base
-
-# Layer: system
-# Module: modutils
-#
-# Policy for kernel module utilities
-#
-modutils = module
-
-# Layer: system
-# Module: mount
-#
-# Policy for mount.
-#
-mount = module
-
-# Layer: services
-# Module: mta
-#
-# Policy common to all email tranfer agents.
-#
-mta = module
-
-# Layer: apps
-# Module: namespace
-#
-# policy for namespace.init script
-#
-namespace = module
-
-# Layer: system
-# Module: netlabel
-#
-# Basic netlabel types and interfaces.
-#
-netlabel = module
-
-# Layer: admin
-# Module: netutils
-#
-# Network analysis utilities
-#
-netutils = module
-
-# Layer: services
-# Module: networkmanager
-#
-# Manager for dynamically switching between networks.
-#
-networkmanager = module
-
-# Layer: services
-# Module: nis
-#
-# Policy for NIS (YP) servers and clients
-#
-nis = module
-
-# Layer: services
-# Module: oddjob
-#
-# policy for oddjob
-#
-oddjob = module
-
-# Layer: contrib
-# Module: pesign
-#
-# policy for pesign
-#
-pesign = module
-
-# Layer: services
-# Module: postgresql
-#
-# PostgreSQL relational database
-#
-postgresql = module
-
-# Layer: services
-# Module: rdisc
-#
-# Network router discovery daemon
-#
-rdisc = module
-
-# Layer: services
-# Module: rpcbind
-#
-#  universal addresses to RPC program number mapper
-#
-rpc = module
-
-# Layer: admin
-# Module: rpm
-#
-# Policy for the RPM package manager.
-#
-rpm = module
-
-# Layer: role
-# Module: secadm
-#
-# secadm account on tty logins
-#
-secadm = module
-
-# Module: selinux
-# Required in base
-#
-# Policy for kernel security interface, in particular, selinuxfs.
-#
-selinux = base
-
-# Layer: system
-# Module: selinuxutil
-#
-# Policy for SELinux policy and userland applications.
-#
-selinuxutil = module
-
-# Module: setrans
-# Required in base
-#
-# Policy for setrans
-#
-setrans = module
-
-# Layer: apps
-# Module: seunshare
-#
-# seunshare executable
-#
-seunshare = module
-
-# Layer: services
-# Module: ssh
-#
-# Secure shell client and server policy.
-#
-ssh = module
-
-# Layer: services
-# Module: sssd
-#
-# System Security Services Daemon
-#
-sssd = module
-
-# Layer: contrib
-# Module: stalld
-#
-# stalld
-#
-stalld = module
-
-# Layer: kernel
-# Module: storage
-#
-# Policy controlling access to storage devices
-#
-storage = base
-
-# Layer: admin
-# Module: sudo
-#
-# Execute a command with a substitute user
-#
-su = module
-
-# Layer: admin
-# Module: sudo
-#
-# Execute a command with a substitute user
-#
-sudo = module
-
-# Layer:role
-# Module: sysadm_secadm
-#
-# System Administrator with Security Admin rules
-#
-sysadm = module
-
-# Layer:role
-# Module: sysadm_secadm
-#
-# System Administrator with Security Admin rules
-#
-sysadm_secadm = module
-
-# Layer: system
-# Module: sysnetwork
-#
-# Policy for network configuration: ifconfig and dhcp client.
-#
-sysnetwork = module
-
-# Layer: system
-# Module: systemd
-#
-# Policy for systemd components
-#
-systemd = module
-
-# Module: terminal
-# Required in base
-#
-# Policy for terminals.
-#
-terminal = base
-
-# Layer: kernel
-# Module: ubac
-#
-#
-#
-ubac = base
-
-# Layer: system
-# Module: udev
-#
-# Policy for udev.
-#
-udev = module
-
-# Layer: role
-# Module: unconfineduser
-#
-# The unconfined user domain.
-#
-unconfined = module
-
-# Layer: role
-# Module: unconfineduser
-#
-# The unconfined user domain.
-#
-unconfineduser = module
-
-# Layer: kernel
-# Module: unconfined
-#
-# The unlabelednet module.
-#
-unlabelednet = module
-
-# Layer: system
-# Module: userdomain
-#
-# Policy for user domains
-#
-userdomain = module
-
-# Layer: apps
-# Module: userhelper
-#
-# A helper interface to pam.
-#
-userhelper = module
-
-# Layer: admin
-# Module: usermanage
-#
-# Policy for managing user accounts.
-#
-usermanage = module
-
-# Layer: services
-# Module: virt
-#
-# Virtualization libraries
-#
-virt = module
-
-# Layer: apps
-# Module: vhostmd
-#
-# vlock - Virtual Console lock program
-#
-vlock = module
-
-# Layer: services
-# Module: xserver
-#
-# X windows login display manager
-#
-xserver = module
-

modules-minimum.conf

@@ -1 +0,0 @@
-modules-targeted.conf

plans/selinux.fmf

@@ -1,13 +0,0 @@
-summary: Tier 1 selinux-policy test plan
-discover:
-  how: fmf
-  url: https://src.fedoraproject.org/tests/selinux.git
-  filter: "tier:1 & tag:-failinfedora | component:selinux-policy & tag:-failinfedora"
-prepare:
-  how: shell
-  script:
-    - yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm || true
-    - yum config-manager --set-enabled epel || true
-    - yum config-manager --set-enabled crb || true
-execute:
-  how: tmt

readme-automotive

@@ -1,52 +0,0 @@
-The automotive package is modeled after selinux-policy-minimum in that it
-contains all the modules that are present in selinux-policy-targeted, but most
-of them are disabled (content of module-automotive-contrib.conf).
-The rest of the configuration files is copied from targeted, only
-booleans-automotive.conf and users-automotive are missing booleans and users
-defined in disabled modules.
-
-
-The content of module-automotive-base.conf was determined as follows.
-Modules providing file context definitions related to packages in qm-minimal
-image package set [1]:
-["anaconda", "authlogin", "bluetooth", "bootloader", "clock", "cpucontrol",
-"cups", "daemontools", "dbus", "dmesg", "fstools", "fwupd", "games", "gpg",
-"hostname", "init", "iptables", "journalctl", "kerberos", "ldap", "libraries",
-"loadkeys", "locallogin", "logging", "lpd", "lvm", "miscfiles", "modutils",
-"mount", "mta", "namespace", "networkmanager", "nis", "oddjob", "rpc", "rpm",
-"selinuxutil", "stalld", "su", "sysnetwork", "systemd", "udev", "userdomain",
-"userhelper", "usermanage", "vlock"]
-
-Modules chosen based on name comparison with the qm-minimal image package set:
-["cyrus","dbus","gpg","ldap","rpm","sasl","fwupd","stalld","ssh","hostname",
-"iptables","mount","systemd","udev"]
-
-The following are additions based on qm-developer image package set:
-["netutils", "ssh", "sudo ", "chronyd", "mandb", "pesign", "rdisc", "rsync",
-"sosreport", "virt"]
-
-Dependencies of container-selinux:
-["anaconda","gnome","sssd"]
-
-Dependency of gpg:
-["apache"]
-
-systemd_logind does not work properly without:
-["dhcp"]
-
-
-All remaining modules are listed in module-automotive-contrib.conf and
-therefore disabled (modules set to "off" in modules-targeted-* where kept
-"off" in automotive as well).
-
-sandbox module was set to "off" instead of it being removed in spec file (as
-done in "minimum") to simplify the spec file.
-
-Note that DSP modules will not be installed if they follow [2], which is
-probably for the best, since they do not consistently use optional_policy
-blocks and would likely fail to install. However, container module is needed
-even for the qm-minimal image and has to be installed manually (probably in
-automotive-image-builder).
-
-[1] - https://autosd.sig.centos.org/AutoSD-9/nightly/core-rpms/autosd-core-rpms-x86_64.txt
-[2] - https://fedoraproject.org/wiki/SELinux/IndependentPolicy

securetty_types-automotive

@@ -1,4 +0,0 @@
-console_device_t
-sysadm_tty_device_t
-user_tty_device_t
-staff_tty_device_t

selinux-check-proper-disable.service

@@ -1,15 +0,0 @@
-[Unit]
-Description=Check that SELinux is not disabled the unsafe way
-ConditionKernelCommandLine=!selinux=0
-After=sysinit.target
-
-[Service]
-Type=oneshot
-EnvironmentFile=/etc/selinux/config
-ExecCondition=test "$SELINUX" = disabled
-ExecStart=/usr/bin/echo 'SELINUX=disabled in /etc/selinux/config, but no selinux=0 on kernel command line - SELinux may not be fully disabled. Please update bootloader configuration to pass selinux=0 to kernel at boot.'
-StandardOutput=journal+console
-SyslogLevel=warning
-
-[Install]
-WantedBy=multi-user.target

setrans-automotive.conf

@@ -1,19 +0,0 @@
-#
-# Multi-Category Security translation table for SELinux
-# 
-# Uncomment the following to disable translation libary
-# disable=1
-#
-# Objects can be categorized with 0-1023 categories defined by the admin.
-# Objects can be in more than one category at a time.
-# Categories are stored in the system as c0-c1023.  Users can use this
-# table to translate the categories into a more meaningful output.
-# Examples:
-# s0:c0=CompanyConfidential
-# s0:c1=PatientRecord
-# s0:c2=Unclassified
-# s0:c3=TopSecret
-# s0:c1,c3=CompanyConfidentialRedHat
-s0=SystemLow
-s0-s0:c0.c1023=SystemLow-SystemHigh
-s0:c0.c1023=SystemHigh

sources

@@ -1,3 +0,0 @@
-SHA512 (selinux-policy-e0a45e7.tar.gz) = 7c3ae116e597856d7b06260bfe42459b0dc60c1e039c50f4bff28fca7d532bb76ac4d26797de05aa1c50d9a8d461ff197034a78482c92c690684aaa209004efe
-SHA512 (container-selinux.tgz) = 8693f303ad3ad5069f96e82dae1dc0204373b74da33d7bcc370a9b2e8b0db7cb0ccf4696728df158cb4cff446ebe2f4da05f4a9414be1d9f7f38164740bdb6a3
-SHA512 (macro-expander) = 243ee49f1185b78ac47e56ca9a3f3592f8975fab1a2401c0fcc7f88217be614fe31805bacec602b728e7fcfc21dcc17d90e9a54ce87f3a0c97624d9ad885aea4

tests/tests-reboot.yml

@@ -1,50 +0,0 @@
----
-- hosts: localhost
-  vars:
-  - artifacts: "{{ lookup('env', 'TEST_ARTIFACTS')|default('./artifacts', true) }}"
-  tags:
-  - classic
-  tasks:
-  # switch SELinux to permissive mode
-  - name: Get default kernel
-    command: "grubby --default-kernel"
-    register: default_kernel
-  - debug: msg="{{ default_kernel.stdout }}"
-  - name: Set permissive mode
-    command: "grubby --args=enforcing=0 --update-kernel {{ default_kernel.stdout }}"
-
-  - name: reboot
-    block:
-      - name: restart host
-        shell: sleep 2 && shutdown -r now "Ansible updates triggered"
-        async: 1
-        poll: 0
-        ignore_errors: true
-
-      - name: wait for host to come back
-        wait_for_connection:
-          delay: 10
-          timeout: 300
-
-      - name: Re-create /tmp/artifacts
-        command: mkdir /tmp/artifacts
-
-      - name: Gather SELinux denials since boot
-        shell: |
-            result=pass
-            dmesg | grep -i -e type=1300 -e type=1400 > /tmp/avc.log && result=fail
-            ausearch -m avc -m selinux_err -m user_avc -ts boot &>> /tmp/avc.log
-            grep -q '<no matches>' /tmp/avc.log || result=fail
-            echo -e "\nresults:\n- test: reboot and collect AVC\n  result: $result\n  logs:\n  - avc.log\n\n" > /tmp/results.yml
-            ( [ $result = "pass" ] && echo PASS test-reboot || echo FAIL test-reboot ) > /tmp/test.log
-
-    always:
-      - name: Pull out the artifacts
-        fetch:
-          dest: "{{ artifacts }}/"
-          src: "{{ item }}"
-          flat: yes
-        with_items:
-          - /tmp/test.log
-          - /tmp/avc.log
-          - /tmp/results.yml

users-automotive

@@ -1,39 +0,0 @@
-##################################
-#
-# Core User configuration.
-#
-
-#
-# gen_user(username, prefix, role_set, mls_defaultlevel, mls_range, [mcs_catetories])
-#
-# Note: Identities without a prefix will not be listed
-# in the users_extra file used by genhomedircon.
-
-#
-# system_u is the user identity for system processes and objects.
-# There should be no corresponding Unix user identity for system,
-# and a user process should never be assigned the system user
-# identity.
-#
-gen_user(system_u,, system_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
-
-#
-# user_u is a generic user identity for Linux users who have no
-# SELinux user identity defined.  The modified daemons will use
-# this user identity in the security context if there is no matching
-# SELinux user identity for a Linux user.  If you do not want to
-# permit any access to such users, then remove this entry.
-#
-gen_user(user_u, user, user_r, s0, s0)
-gen_user(staff_u, user, staff_r system_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
-gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
-
-#
-# The following users correspond to Unix identities.
-# These identities are typically assigned as the user attribute
-# when login starts the user shell.  Users with access to the sysadm_r
-# role should use the staff_r role instead of the user_r role when
-# not in the sysadm_r.
-#
-gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)