Compare commits
No commits in common. "c9s" and "c8" have entirely different histories.
@ -1 +0,0 @@
|
|||||||
1
|
|
7
.gitignore
vendored
7
.gitignore
vendored
@ -1,4 +1,3 @@
|
|||||||
/selinux-policy-*.tar.gz
|
SOURCES/container-selinux.tgz
|
||||||
/container-selinux.tgz
|
SOURCES/selinux-policy-contrib-aadacd8.tar.gz
|
||||||
/macro-expander
|
SOURCES/selinux-policy-fa87f85.tar.gz
|
||||||
*.rpm
|
|
||||||
|
3
.selinux-policy.metadata
Normal file
3
.selinux-policy.metadata
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
34a078fbec0190b407d64c1664aaa0887204ba2e SOURCES/container-selinux.tgz
|
||||||
|
470eeffd45f8dd003edb6ddbff4104e573b6c08d SOURCES/selinux-policy-contrib-aadacd8.tar.gz
|
||||||
|
91c17cd38073aba5562898449fe3b4f2bbffac8e SOURCES/selinux-policy-fa87f85.tar.gz
|
340
COPYING
340
COPYING
@ -1,340 +0,0 @@
|
|||||||
GNU GENERAL PUBLIC LICENSE
|
|
||||||
Version 2, June 1991
|
|
||||||
|
|
||||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
|
|
||||||
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
||||||
Everyone is permitted to copy and distribute verbatim copies
|
|
||||||
of this license document, but changing it is not allowed.
|
|
||||||
|
|
||||||
Preamble
|
|
||||||
|
|
||||||
The licenses for most software are designed to take away your
|
|
||||||
freedom to share and change it. By contrast, the GNU General Public
|
|
||||||
License is intended to guarantee your freedom to share and change free
|
|
||||||
software--to make sure the software is free for all its users. This
|
|
||||||
General Public License applies to most of the Free Software
|
|
||||||
Foundation's software and to any other program whose authors commit to
|
|
||||||
using it. (Some other Free Software Foundation software is covered by
|
|
||||||
the GNU Library General Public License instead.) You can apply it to
|
|
||||||
your programs, too.
|
|
||||||
|
|
||||||
When we speak of free software, we are referring to freedom, not
|
|
||||||
price. Our General Public Licenses are designed to make sure that you
|
|
||||||
have the freedom to distribute copies of free software (and charge for
|
|
||||||
this service if you wish), that you receive source code or can get it
|
|
||||||
if you want it, that you can change the software or use pieces of it
|
|
||||||
in new free programs; and that you know you can do these things.
|
|
||||||
|
|
||||||
To protect your rights, we need to make restrictions that forbid
|
|
||||||
anyone to deny you these rights or to ask you to surrender the rights.
|
|
||||||
These restrictions translate to certain responsibilities for you if you
|
|
||||||
distribute copies of the software, or if you modify it.
|
|
||||||
|
|
||||||
For example, if you distribute copies of such a program, whether
|
|
||||||
gratis or for a fee, you must give the recipients all the rights that
|
|
||||||
you have. You must make sure that they, too, receive or can get the
|
|
||||||
source code. And you must show them these terms so they know their
|
|
||||||
rights.
|
|
||||||
|
|
||||||
We protect your rights with two steps: (1) copyright the software, and
|
|
||||||
(2) offer you this license which gives you legal permission to copy,
|
|
||||||
distribute and/or modify the software.
|
|
||||||
|
|
||||||
Also, for each author's protection and ours, we want to make certain
|
|
||||||
that everyone understands that there is no warranty for this free
|
|
||||||
software. If the software is modified by someone else and passed on, we
|
|
||||||
want its recipients to know that what they have is not the original, so
|
|
||||||
that any problems introduced by others will not reflect on the original
|
|
||||||
authors' reputations.
|
|
||||||
|
|
||||||
Finally, any free program is threatened constantly by software
|
|
||||||
patents. We wish to avoid the danger that redistributors of a free
|
|
||||||
program will individually obtain patent licenses, in effect making the
|
|
||||||
program proprietary. To prevent this, we have made it clear that any
|
|
||||||
patent must be licensed for everyone's free use or not licensed at all.
|
|
||||||
|
|
||||||
The precise terms and conditions for copying, distribution and
|
|
||||||
modification follow.
|
|
||||||
|
|
||||||
GNU GENERAL PUBLIC LICENSE
|
|
||||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
|
||||||
|
|
||||||
0. This License applies to any program or other work which contains
|
|
||||||
a notice placed by the copyright holder saying it may be distributed
|
|
||||||
under the terms of this General Public License. The "Program", below,
|
|
||||||
refers to any such program or work, and a "work based on the Program"
|
|
||||||
means either the Program or any derivative work under copyright law:
|
|
||||||
that is to say, a work containing the Program or a portion of it,
|
|
||||||
either verbatim or with modifications and/or translated into another
|
|
||||||
language. (Hereinafter, translation is included without limitation in
|
|
||||||
the term "modification".) Each licensee is addressed as "you".
|
|
||||||
|
|
||||||
Activities other than copying, distribution and modification are not
|
|
||||||
covered by this License; they are outside its scope. The act of
|
|
||||||
running the Program is not restricted, and the output from the Program
|
|
||||||
is covered only if its contents constitute a work based on the
|
|
||||||
Program (independent of having been made by running the Program).
|
|
||||||
Whether that is true depends on what the Program does.
|
|
||||||
|
|
||||||
1. You may copy and distribute verbatim copies of the Program's
|
|
||||||
source code as you receive it, in any medium, provided that you
|
|
||||||
conspicuously and appropriately publish on each copy an appropriate
|
|
||||||
copyright notice and disclaimer of warranty; keep intact all the
|
|
||||||
notices that refer to this License and to the absence of any warranty;
|
|
||||||
and give any other recipients of the Program a copy of this License
|
|
||||||
along with the Program.
|
|
||||||
|
|
||||||
You may charge a fee for the physical act of transferring a copy, and
|
|
||||||
you may at your option offer warranty protection in exchange for a fee.
|
|
||||||
|
|
||||||
2. You may modify your copy or copies of the Program or any portion
|
|
||||||
of it, thus forming a work based on the Program, and copy and
|
|
||||||
distribute such modifications or work under the terms of Section 1
|
|
||||||
above, provided that you also meet all of these conditions:
|
|
||||||
|
|
||||||
a) You must cause the modified files to carry prominent notices
|
|
||||||
stating that you changed the files and the date of any change.
|
|
||||||
|
|
||||||
b) You must cause any work that you distribute or publish, that in
|
|
||||||
whole or in part contains or is derived from the Program or any
|
|
||||||
part thereof, to be licensed as a whole at no charge to all third
|
|
||||||
parties under the terms of this License.
|
|
||||||
|
|
||||||
c) If the modified program normally reads commands interactively
|
|
||||||
when run, you must cause it, when started running for such
|
|
||||||
interactive use in the most ordinary way, to print or display an
|
|
||||||
announcement including an appropriate copyright notice and a
|
|
||||||
notice that there is no warranty (or else, saying that you provide
|
|
||||||
a warranty) and that users may redistribute the program under
|
|
||||||
these conditions, and telling the user how to view a copy of this
|
|
||||||
License. (Exception: if the Program itself is interactive but
|
|
||||||
does not normally print such an announcement, your work based on
|
|
||||||
the Program is not required to print an announcement.)
|
|
||||||
|
|
||||||
These requirements apply to the modified work as a whole. If
|
|
||||||
identifiable sections of that work are not derived from the Program,
|
|
||||||
and can be reasonably considered independent and separate works in
|
|
||||||
themselves, then this License, and its terms, do not apply to those
|
|
||||||
sections when you distribute them as separate works. But when you
|
|
||||||
distribute the same sections as part of a whole which is a work based
|
|
||||||
on the Program, the distribution of the whole must be on the terms of
|
|
||||||
this License, whose permissions for other licensees extend to the
|
|
||||||
entire whole, and thus to each and every part regardless of who wrote it.
|
|
||||||
|
|
||||||
Thus, it is not the intent of this section to claim rights or contest
|
|
||||||
your rights to work written entirely by you; rather, the intent is to
|
|
||||||
exercise the right to control the distribution of derivative or
|
|
||||||
collective works based on the Program.
|
|
||||||
|
|
||||||
In addition, mere aggregation of another work not based on the Program
|
|
||||||
with the Program (or with a work based on the Program) on a volume of
|
|
||||||
a storage or distribution medium does not bring the other work under
|
|
||||||
the scope of this License.
|
|
||||||
|
|
||||||
3. You may copy and distribute the Program (or a work based on it,
|
|
||||||
under Section 2) in object code or executable form under the terms of
|
|
||||||
Sections 1 and 2 above provided that you also do one of the following:
|
|
||||||
|
|
||||||
a) Accompany it with the complete corresponding machine-readable
|
|
||||||
source code, which must be distributed under the terms of Sections
|
|
||||||
1 and 2 above on a medium customarily used for software interchange; or,
|
|
||||||
|
|
||||||
b) Accompany it with a written offer, valid for at least three
|
|
||||||
years, to give any third party, for a charge no more than your
|
|
||||||
cost of physically performing source distribution, a complete
|
|
||||||
machine-readable copy of the corresponding source code, to be
|
|
||||||
distributed under the terms of Sections 1 and 2 above on a medium
|
|
||||||
customarily used for software interchange; or,
|
|
||||||
|
|
||||||
c) Accompany it with the information you received as to the offer
|
|
||||||
to distribute corresponding source code. (This alternative is
|
|
||||||
allowed only for noncommercial distribution and only if you
|
|
||||||
received the program in object code or executable form with such
|
|
||||||
an offer, in accord with Subsection b above.)
|
|
||||||
|
|
||||||
The source code for a work means the preferred form of the work for
|
|
||||||
making modifications to it. For an executable work, complete source
|
|
||||||
code means all the source code for all modules it contains, plus any
|
|
||||||
associated interface definition files, plus the scripts used to
|
|
||||||
control compilation and installation of the executable. However, as a
|
|
||||||
special exception, the source code distributed need not include
|
|
||||||
anything that is normally distributed (in either source or binary
|
|
||||||
form) with the major components (compiler, kernel, and so on) of the
|
|
||||||
operating system on which the executable runs, unless that component
|
|
||||||
itself accompanies the executable.
|
|
||||||
|
|
||||||
If distribution of executable or object code is made by offering
|
|
||||||
access to copy from a designated place, then offering equivalent
|
|
||||||
access to copy the source code from the same place counts as
|
|
||||||
distribution of the source code, even though third parties are not
|
|
||||||
compelled to copy the source along with the object code.
|
|
||||||
|
|
||||||
4. You may not copy, modify, sublicense, or distribute the Program
|
|
||||||
except as expressly provided under this License. Any attempt
|
|
||||||
otherwise to copy, modify, sublicense or distribute the Program is
|
|
||||||
void, and will automatically terminate your rights under this License.
|
|
||||||
However, parties who have received copies, or rights, from you under
|
|
||||||
this License will not have their licenses terminated so long as such
|
|
||||||
parties remain in full compliance.
|
|
||||||
|
|
||||||
5. You are not required to accept this License, since you have not
|
|
||||||
signed it. However, nothing else grants you permission to modify or
|
|
||||||
distribute the Program or its derivative works. These actions are
|
|
||||||
prohibited by law if you do not accept this License. Therefore, by
|
|
||||||
modifying or distributing the Program (or any work based on the
|
|
||||||
Program), you indicate your acceptance of this License to do so, and
|
|
||||||
all its terms and conditions for copying, distributing or modifying
|
|
||||||
the Program or works based on it.
|
|
||||||
|
|
||||||
6. Each time you redistribute the Program (or any work based on the
|
|
||||||
Program), the recipient automatically receives a license from the
|
|
||||||
original licensor to copy, distribute or modify the Program subject to
|
|
||||||
these terms and conditions. You may not impose any further
|
|
||||||
restrictions on the recipients' exercise of the rights granted herein.
|
|
||||||
You are not responsible for enforcing compliance by third parties to
|
|
||||||
this License.
|
|
||||||
|
|
||||||
7. If, as a consequence of a court judgment or allegation of patent
|
|
||||||
infringement or for any other reason (not limited to patent issues),
|
|
||||||
conditions are imposed on you (whether by court order, agreement or
|
|
||||||
otherwise) that contradict the conditions of this License, they do not
|
|
||||||
excuse you from the conditions of this License. If you cannot
|
|
||||||
distribute so as to satisfy simultaneously your obligations under this
|
|
||||||
License and any other pertinent obligations, then as a consequence you
|
|
||||||
may not distribute the Program at all. For example, if a patent
|
|
||||||
license would not permit royalty-free redistribution of the Program by
|
|
||||||
all those who receive copies directly or indirectly through you, then
|
|
||||||
the only way you could satisfy both it and this License would be to
|
|
||||||
refrain entirely from distribution of the Program.
|
|
||||||
|
|
||||||
If any portion of this section is held invalid or unenforceable under
|
|
||||||
any particular circumstance, the balance of the section is intended to
|
|
||||||
apply and the section as a whole is intended to apply in other
|
|
||||||
circumstances.
|
|
||||||
|
|
||||||
It is not the purpose of this section to induce you to infringe any
|
|
||||||
patents or other property right claims or to contest validity of any
|
|
||||||
such claims; this section has the sole purpose of protecting the
|
|
||||||
integrity of the free software distribution system, which is
|
|
||||||
implemented by public license practices. Many people have made
|
|
||||||
generous contributions to the wide range of software distributed
|
|
||||||
through that system in reliance on consistent application of that
|
|
||||||
system; it is up to the author/donor to decide if he or she is willing
|
|
||||||
to distribute software through any other system and a licensee cannot
|
|
||||||
impose that choice.
|
|
||||||
|
|
||||||
This section is intended to make thoroughly clear what is believed to
|
|
||||||
be a consequence of the rest of this License.
|
|
||||||
|
|
||||||
8. If the distribution and/or use of the Program is restricted in
|
|
||||||
certain countries either by patents or by copyrighted interfaces, the
|
|
||||||
original copyright holder who places the Program under this License
|
|
||||||
may add an explicit geographical distribution limitation excluding
|
|
||||||
those countries, so that distribution is permitted only in or among
|
|
||||||
countries not thus excluded. In such case, this License incorporates
|
|
||||||
the limitation as if written in the body of this License.
|
|
||||||
|
|
||||||
9. The Free Software Foundation may publish revised and/or new versions
|
|
||||||
of the General Public License from time to time. Such new versions will
|
|
||||||
be similar in spirit to the present version, but may differ in detail to
|
|
||||||
address new problems or concerns.
|
|
||||||
|
|
||||||
Each version is given a distinguishing version number. If the Program
|
|
||||||
specifies a version number of this License which applies to it and "any
|
|
||||||
later version", you have the option of following the terms and conditions
|
|
||||||
either of that version or of any later version published by the Free
|
|
||||||
Software Foundation. If the Program does not specify a version number of
|
|
||||||
this License, you may choose any version ever published by the Free Software
|
|
||||||
Foundation.
|
|
||||||
|
|
||||||
10. If you wish to incorporate parts of the Program into other free
|
|
||||||
programs whose distribution conditions are different, write to the author
|
|
||||||
to ask for permission. For software which is copyrighted by the Free
|
|
||||||
Software Foundation, write to the Free Software Foundation; we sometimes
|
|
||||||
make exceptions for this. Our decision will be guided by the two goals
|
|
||||||
of preserving the free status of all derivatives of our free software and
|
|
||||||
of promoting the sharing and reuse of software generally.
|
|
||||||
|
|
||||||
NO WARRANTY
|
|
||||||
|
|
||||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
|
||||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
|
||||||
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
|
||||||
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
|
||||||
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
|
||||||
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
|
||||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
|
||||||
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
|
||||||
REPAIR OR CORRECTION.
|
|
||||||
|
|
||||||
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
|
||||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
|
||||||
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
|
||||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
|
||||||
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
|
||||||
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
|
||||||
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
|
||||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
|
||||||
POSSIBILITY OF SUCH DAMAGES.
|
|
||||||
|
|
||||||
END OF TERMS AND CONDITIONS
|
|
||||||
|
|
||||||
How to Apply These Terms to Your New Programs
|
|
||||||
|
|
||||||
If you develop a new program, and you want it to be of the greatest
|
|
||||||
possible use to the public, the best way to achieve this is to make it
|
|
||||||
free software which everyone can redistribute and change under these terms.
|
|
||||||
|
|
||||||
To do so, attach the following notices to the program. It is safest
|
|
||||||
to attach them to the start of each source file to most effectively
|
|
||||||
convey the exclusion of warranty; and each file should have at least
|
|
||||||
the "copyright" line and a pointer to where the full notice is found.
|
|
||||||
|
|
||||||
<one line to give the program's name and a brief idea of what it does.>
|
|
||||||
Copyright (C) <year> <name of author>
|
|
||||||
|
|
||||||
This program is free software; you can redistribute it and/or modify
|
|
||||||
it under the terms of the GNU General Public License as published by
|
|
||||||
the Free Software Foundation; either version 2 of the License, or
|
|
||||||
(at your option) any later version.
|
|
||||||
|
|
||||||
This program is distributed in the hope that it will be useful,
|
|
||||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
GNU General Public License for more details.
|
|
||||||
|
|
||||||
You should have received a copy of the GNU General Public License
|
|
||||||
along with this program; if not, write to the Free Software
|
|
||||||
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
||||||
|
|
||||||
|
|
||||||
Also add information on how to contact you by electronic and paper mail.
|
|
||||||
|
|
||||||
If the program is interactive, make it output a short notice like this
|
|
||||||
when it starts in an interactive mode:
|
|
||||||
|
|
||||||
Gnomovision version 69, Copyright (C) year name of author
|
|
||||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
|
||||||
This is free software, and you are welcome to redistribute it
|
|
||||||
under certain conditions; type `show c' for details.
|
|
||||||
|
|
||||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
|
||||||
parts of the General Public License. Of course, the commands you use may
|
|
||||||
be called something other than `show w' and `show c'; they could even be
|
|
||||||
mouse-clicks or menu items--whatever suits your program.
|
|
||||||
|
|
||||||
You should also get your employer (if you work as a programmer) or your
|
|
||||||
school, if any, to sign a "copyright disclaimer" for the program, if
|
|
||||||
necessary. Here is a sample; alter the names:
|
|
||||||
|
|
||||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
|
||||||
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
|
||||||
|
|
||||||
<signature of Ty Coon>, 1 April 1989
|
|
||||||
Ty Coon, President of Vice
|
|
||||||
|
|
||||||
This General Public License does not permit incorporating your program into
|
|
||||||
proprietary programs. If your program is a subroutine library, you may
|
|
||||||
consider it more useful to permit linking proprietary applications with the
|
|
||||||
library. If this is what you want to do, use the GNU Library General
|
|
||||||
Public License instead of this License.
|
|
49
README.md
49
README.md
@ -1,49 +0,0 @@
|
|||||||
## Purpose
|
|
||||||
|
|
||||||
SELinux Fedora Policy is a fork of the [SELinux reference policy](https://github.com/SELinuxProject/refpolicy/). The [fedora-selinux/selinux-policy](https://github.com/selinux-policy/selinux-policy.git) repo makes Fedora packaging simpler and more transparent for packagers, upstream developers, and users. It is used for applying downstream Fedora fixes, for communication about proposed/committed changes, and for communication with upstream and the community. It reflects the upstream repository structure to make submitting patches to upstream easy.
|
|
||||||
|
|
||||||
## Structure
|
|
||||||
|
|
||||||
### GitHub
|
|
||||||
On GitHub, we have one repository containing the policy sources.
|
|
||||||
|
|
||||||
$ cd selinux-policy
|
|
||||||
$ git remote -v
|
|
||||||
origin git@github.com:fedora-selinux/selinux-policy.git (fetch)
|
|
||||||
|
|
||||||
$ git branch -r
|
|
||||||
origin/HEAD -> origin/master
|
|
||||||
origin/f27
|
|
||||||
origin/f28
|
|
||||||
origin/master
|
|
||||||
origin/rawhide
|
|
||||||
|
|
||||||
Note: As opposed to dist-git, the Rawhide content resides in the _rawhide_ branch rather than _master_.
|
|
||||||
|
|
||||||
### dist-git
|
|
||||||
Package sources in dist-git are composed from the _selinux-policy_ repository snapshot tarball, _container-selinux_ policy files snapshot, the _macro-expander_ script snapshot, and from other config files.
|
|
||||||
|
|
||||||
## Build process
|
|
||||||
|
|
||||||
1. Clone the [fedora-selinux/selinux-policy](https://github.com/fedora-selinux/selinux-policy) repository.
|
|
||||||
|
|
||||||
$ cd ~/devel/github
|
|
||||||
$ git clone git@github.com:fedora-selinux/selinux-policy.git
|
|
||||||
$ cd selinux-policy
|
|
||||||
|
|
||||||
2. Create, backport, or cherry-pick needed changes to a particular branch and push them.
|
|
||||||
|
|
||||||
3. Clone the **selinux-policy** dist-git repository.
|
|
||||||
|
|
||||||
$ cd ~/devel/dist-git
|
|
||||||
$ fedpkg clone selinux-policy
|
|
||||||
$ cd selinux-policy
|
|
||||||
|
|
||||||
4. Download the latest snapshot from the selinux-policy GitHub repository.
|
|
||||||
|
|
||||||
$ ./make-rhat-patches.sh
|
|
||||||
|
|
||||||
5. Add changes to the dist-git repository, bump release, create a changelog entry, commit, and push.
|
|
||||||
6. Build the package.
|
|
||||||
|
|
||||||
$ fedpkg build
|
|
@ -12,6 +12,7 @@ pppd_can_insmod = false
|
|||||||
privoxy_connect_any = true
|
privoxy_connect_any = true
|
||||||
selinuxuser_direct_dri_enabled = true
|
selinuxuser_direct_dri_enabled = true
|
||||||
selinuxuser_execmem = true
|
selinuxuser_execmem = true
|
||||||
|
selinuxuser_execmod = true
|
||||||
selinuxuser_execstack = true
|
selinuxuser_execstack = true
|
||||||
selinuxuser_rw_noexattrfile=true
|
selinuxuser_rw_noexattrfile=true
|
||||||
selinuxuser_ping = true
|
selinuxuser_ping = true
|
||||||
@ -21,4 +22,3 @@ unconfined_chrome_sandbox_transition=true
|
|||||||
unconfined_mozilla_plugin_transition=true
|
unconfined_mozilla_plugin_transition=true
|
||||||
xguest_exec_content = true
|
xguest_exec_content = true
|
||||||
mozilla_plugin_can_network_connect = true
|
mozilla_plugin_can_network_connect = true
|
||||||
use_virtualbox = true
|
|
@ -2,7 +2,6 @@
|
|||||||
/run/lock /var/lock
|
/run/lock /var/lock
|
||||||
/run/systemd/system /usr/lib/systemd/system
|
/run/systemd/system /usr/lib/systemd/system
|
||||||
/run/systemd/generator /usr/lib/systemd/system
|
/run/systemd/generator /usr/lib/systemd/system
|
||||||
/run/systemd/generator.early /usr/lib/systemd/system
|
|
||||||
/run/systemd/generator.late /usr/lib/systemd/system
|
/run/systemd/generator.late /usr/lib/systemd/system
|
||||||
/lib /usr/lib
|
/lib /usr/lib
|
||||||
/lib64 /usr/lib
|
/lib64 /usr/lib
|
||||||
@ -13,12 +12,9 @@
|
|||||||
/var/lib/xguest/home /home
|
/var/lib/xguest/home /home
|
||||||
/var/named/chroot/usr/lib64 /usr/lib
|
/var/named/chroot/usr/lib64 /usr/lib
|
||||||
/var/named/chroot/lib64 /usr/lib
|
/var/named/chroot/lib64 /usr/lib
|
||||||
/var/named/chroot/var /var
|
|
||||||
/home-inst /home
|
/home-inst /home
|
||||||
/home/home-inst /home
|
/home/home-inst /home
|
||||||
/var/roothome /root
|
/var/roothome /root
|
||||||
/sbin /usr/sbin
|
/sbin /usr/sbin
|
||||||
/sysroot/tmp /tmp
|
/sysroot/tmp /tmp
|
||||||
/var/usrlocal /usr/local
|
/var/usrlocal /usr/local
|
||||||
/var/mnt /mnt
|
|
||||||
/bin /usr/bin
|
|
81
SOURCES/macro-expander
Normal file
81
SOURCES/macro-expander
Normal file
@ -0,0 +1,81 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
function usage {
|
||||||
|
echo "Usage: $0 [ -c | -t [ -M ] ] <macro>"
|
||||||
|
echo "Options:
|
||||||
|
-c generate CIL output
|
||||||
|
-t generate standard policy source format (.te) allow rules - this is default
|
||||||
|
-M generate complete module .te output
|
||||||
|
"
|
||||||
|
}
|
||||||
|
|
||||||
|
function cleanup {
|
||||||
|
rm -rf $TEMP_STORE
|
||||||
|
}
|
||||||
|
|
||||||
|
while getopts "chMt" opt; do
|
||||||
|
case $opt in
|
||||||
|
c) GENCIL=1
|
||||||
|
;;
|
||||||
|
t) GENTE=1
|
||||||
|
;;
|
||||||
|
M) GENTEMODULE=1
|
||||||
|
;;
|
||||||
|
h) usage
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
\?) usage
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
shift $((OPTIND-1))
|
||||||
|
|
||||||
|
SELINUX_MACRO=$1
|
||||||
|
|
||||||
|
if [ -z "$SELINUX_MACRO" ]
|
||||||
|
then
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
TEMP_STORE="$(mktemp -d)"
|
||||||
|
cd $TEMP_STORE || exit 1
|
||||||
|
|
||||||
|
IFS="("
|
||||||
|
set $1
|
||||||
|
SELINUX_DOMAIN="${2::-1}"
|
||||||
|
|
||||||
|
echo -e "policy_module(expander, 1.0.0) \n" \
|
||||||
|
"gen_require(\`\n" \
|
||||||
|
"type $SELINUX_DOMAIN ; \n" \
|
||||||
|
"')" > expander.te
|
||||||
|
|
||||||
|
echo "$SELINUX_MACRO" >> expander.te
|
||||||
|
|
||||||
|
make -f /usr/share/selinux/devel/Makefile tmp/all_interfaces.conf &> /dev/null
|
||||||
|
|
||||||
|
if [ "x$GENCIL" = "x1" ]; then
|
||||||
|
|
||||||
|
make -f /usr/share/selinux/devel/Makefile expander.pp &> /dev/null
|
||||||
|
MAKE_RESULT=$?
|
||||||
|
|
||||||
|
if [ $MAKE_RESULT -ne 2 ]
|
||||||
|
then
|
||||||
|
/usr/libexec/selinux/hll/pp < $TEMP_STORE/expander.pp > $TEMP_STORE/expander.cil 2> /dev/null
|
||||||
|
grep -v "cil_gen_require" $TEMP_STORE/expander.cil | sort -u
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$GENTE" = "1" ] || [ "x$GENCIL" != "x1" ]; then
|
||||||
|
m4 -D enable_mcs -D distro_redhat -D hide_broken_symptoms -D mls_num_sens=16 -D mls_num_cats=1024 -D mcs_num_cats=1024 -s /usr/share/selinux/devel/include/support/file_patterns.spt /usr/share/selinux/devel/include/support/ipc_patterns.spt /usr/share/selinux/devel/include/support/obj_perm_sets.spt /usr/share/selinux/devel/include/support/misc_patterns.spt /usr/share/selinux/devel/include/support/misc_macros.spt /usr/share/selinux/devel/include/support/all_perms.spt /usr/share/selinux/devel/include/support/mls_mcs_macros.spt /usr/share/selinux/devel/include/support/loadable_module.spt tmp/all_interfaces.conf expander.te > expander.tmp 2> /dev/null
|
||||||
|
if [ "x$GENTEMODULE" = "x1" ]; then
|
||||||
|
# sed '/^#.*$/d;/^\s*$/d;/^\s*class .*/d;/^\s*category .*/d;s/^\s*//' expander.tmp
|
||||||
|
sed '/^#.*$/d;/^\s*$/d;/^\s*category .*/d;s/^\s*//' expander.tmp
|
||||||
|
else
|
||||||
|
grep '^\s*allow' expander.tmp | sed 's/^\s*//'
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
cd - > /dev/null || exit 1
|
||||||
|
cleanup
|
@ -691,13 +691,6 @@ logwatch = module
|
|||||||
#
|
#
|
||||||
lpd = module
|
lpd = module
|
||||||
|
|
||||||
# Layer: services
|
|
||||||
# Module: lsm
|
|
||||||
#
|
|
||||||
# lsm policy
|
|
||||||
#
|
|
||||||
lsm = module
|
|
||||||
|
|
||||||
# Layer: services
|
# Layer: services
|
||||||
# Module: mailman
|
# Module: mailman
|
||||||
#
|
#
|
@ -391,3 +391,10 @@ udev = module
|
|||||||
# The unconfined domain.
|
# The unconfined domain.
|
||||||
#
|
#
|
||||||
unconfined = module
|
unconfined = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: kdbus
|
||||||
|
#
|
||||||
|
# Policy for kdbus.
|
||||||
|
#
|
||||||
|
kdbus = module
|
@ -292,6 +292,13 @@ cfengine = module
|
|||||||
#
|
#
|
||||||
cgroup = module
|
cgroup = module
|
||||||
|
|
||||||
|
# Layer: contrib
|
||||||
|
# Module: cgdcbxd
|
||||||
|
#
|
||||||
|
# cgdcbxd policy
|
||||||
|
#
|
||||||
|
cgdcbxd = module
|
||||||
|
|
||||||
# Layer: apps
|
# Layer: apps
|
||||||
# Module: chrome
|
# Module: chrome
|
||||||
#
|
#
|
||||||
@ -342,6 +349,13 @@ cmirrord = module
|
|||||||
#
|
#
|
||||||
cobbler = module
|
cobbler = module
|
||||||
|
|
||||||
|
# Layer: contrib
|
||||||
|
# Module: cockpit
|
||||||
|
#
|
||||||
|
# cockpit - Cockpit runs in a browser and can manage your network of GNU/Linux machines.
|
||||||
|
#
|
||||||
|
cockpit = module
|
||||||
|
|
||||||
# Layer: services
|
# Layer: services
|
||||||
# Module: collectd
|
# Module: collectd
|
||||||
#
|
#
|
||||||
@ -1991,7 +2005,7 @@ timidity = off
|
|||||||
tmpreaper = module
|
tmpreaper = module
|
||||||
|
|
||||||
# Layer: contrib
|
# Layer: contrib
|
||||||
# Module: glusterd
|
# Module: tomcat
|
||||||
#
|
#
|
||||||
# policy for tomcat service
|
# policy for tomcat service
|
||||||
#
|
#
|
||||||
@ -2643,114 +2657,9 @@ rrdcached = module
|
|||||||
#
|
#
|
||||||
stratisd = module
|
stratisd = module
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: ica
|
|
||||||
#
|
|
||||||
# ica
|
|
||||||
#
|
|
||||||
ica = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
# Layer: contrib
|
||||||
# Module: insights_client
|
# Module: insights_client
|
||||||
#
|
#
|
||||||
# insights_client
|
# insights_client
|
||||||
#
|
#
|
||||||
insights_client = module
|
insights_client = module
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: stalld
|
|
||||||
#
|
|
||||||
# stalld
|
|
||||||
#
|
|
||||||
stalld = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: rhcd
|
|
||||||
#
|
|
||||||
# rhcd
|
|
||||||
#
|
|
||||||
rhcd = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: wireguard
|
|
||||||
#
|
|
||||||
# wireguard
|
|
||||||
#
|
|
||||||
wireguard = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: mptcpd
|
|
||||||
#
|
|
||||||
# mptcpd
|
|
||||||
#
|
|
||||||
mptcpd = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: rshim
|
|
||||||
#
|
|
||||||
# rshim
|
|
||||||
#
|
|
||||||
rshim = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: boothd
|
|
||||||
#
|
|
||||||
# boothd - Booth cluster ticket manager
|
|
||||||
#
|
|
||||||
boothd = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: fdo
|
|
||||||
#
|
|
||||||
# fdo - fido device onboard protocol for IoT devices
|
|
||||||
#
|
|
||||||
fdo = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: qatlib
|
|
||||||
#
|
|
||||||
# qatlib - Intel QuickAssist technology library and resources management
|
|
||||||
#
|
|
||||||
qatlib = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: nvme_stas
|
|
||||||
#
|
|
||||||
# nvme_stas
|
|
||||||
#
|
|
||||||
nvme_stas = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: coreos_installer
|
|
||||||
#
|
|
||||||
# coreos_installer
|
|
||||||
#
|
|
||||||
coreos_installer = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: afterburn
|
|
||||||
#
|
|
||||||
# afterburn
|
|
||||||
#
|
|
||||||
afterburn = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: sap_unconfined
|
|
||||||
#
|
|
||||||
# sap_unconfined
|
|
||||||
#
|
|
||||||
sap = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: bootupd
|
|
||||||
#
|
|
||||||
# bootupd - bootloader update daemon
|
|
||||||
#
|
|
||||||
bootupd = module
|
|
||||||
|
|
||||||
# Layer: contrib
|
|
||||||
# Module: iiosensorproxy
|
|
||||||
#
|
|
||||||
# Policy for iio-sensor-proxy - IIO sensors to D-Bus proxy
|
|
||||||
#
|
|
||||||
iiosensorproxy = module
|
|
@ -32,6 +32,7 @@
|
|||||||
# %selinux_requires
|
# %selinux_requires
|
||||||
%selinux_requires \
|
%selinux_requires \
|
||||||
Requires: selinux-policy >= %{_selinux_policy_version} \
|
Requires: selinux-policy >= %{_selinux_policy_version} \
|
||||||
|
BuildRequires: git \
|
||||||
BuildRequires: pkgconfig(systemd) \
|
BuildRequires: pkgconfig(systemd) \
|
||||||
BuildRequires: selinux-policy \
|
BuildRequires: selinux-policy \
|
||||||
BuildRequires: selinux-policy-devel \
|
BuildRequires: selinux-policy-devel \
|
||||||
@ -47,24 +48,20 @@ Requires(post): policycoreutils-python \
|
|||||||
|
|
||||||
# %selinux_modules_install [-s <policytype>] [-p <modulepriority>] module [module]...
|
# %selinux_modules_install [-s <policytype>] [-p <modulepriority>] module [module]...
|
||||||
%selinux_modules_install("s:p:") \
|
%selinux_modules_install("s:p:") \
|
||||||
if [ -e /etc/selinux/config ]; then \
|
|
||||||
. /etc/selinux/config \
|
. /etc/selinux/config \
|
||||||
fi \
|
|
||||||
_policytype=%{-s*} \
|
_policytype=%{-s*} \
|
||||||
if [ -z "${_policytype}" ]; then \
|
if [ -z "${_policytype}" ]; then \
|
||||||
_policytype="targeted" \
|
_policytype="targeted" \
|
||||||
fi \
|
fi \
|
||||||
if [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
|
if [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
|
||||||
%{_sbindir}/semodule -n -s ${_policytype} -X %{!-p:200}%{-p*} -i %* || : \
|
%{_sbindir}/semodule -n -s ${_policytype} -X %{!-p:200}%{-p*} -i %* \
|
||||||
%{_sbindir}/selinuxenabled && %{_sbindir}/load_policy || : \
|
%{_sbindir}/selinuxenabled && %{_sbindir}/load_policy || : \
|
||||||
fi \
|
fi \
|
||||||
%{nil}
|
%{nil}
|
||||||
|
|
||||||
# %selinux_modules_uninstall [-s <policytype>] [-p <modulepriority>] module [module]...
|
# %selinux_modules_uninstall [-s <policytype>] [-p <modulepriority>] module [module]...
|
||||||
%selinux_modules_uninstall("s:p:") \
|
%selinux_modules_uninstall("s:p:") \
|
||||||
if [ -e /etc/selinux/config ]; then \
|
|
||||||
. /etc/selinux/config \
|
. /etc/selinux/config \
|
||||||
fi \
|
|
||||||
_policytype=%{-s*} \
|
_policytype=%{-s*} \
|
||||||
if [ -z "${_policytype}" ]; then \
|
if [ -z "${_policytype}" ]; then \
|
||||||
_policytype="targeted" \
|
_policytype="targeted" \
|
||||||
@ -79,26 +76,20 @@ fi \
|
|||||||
|
|
||||||
# %selinux_relabel_pre [-s <policytype>]
|
# %selinux_relabel_pre [-s <policytype>]
|
||||||
%selinux_relabel_pre("s:") \
|
%selinux_relabel_pre("s:") \
|
||||||
if %{_sbindir}/selinuxenabled; then \
|
|
||||||
if [ -e /etc/selinux/config ]; then \
|
|
||||||
. /etc/selinux/config \
|
. /etc/selinux/config \
|
||||||
fi \
|
|
||||||
_policytype=%{-s*} \
|
_policytype=%{-s*} \
|
||||||
if [ -z "${_policytype}" ]; then \
|
if [ -z "${_policytype}" ]; then \
|
||||||
_policytype="targeted" \
|
_policytype="targeted" \
|
||||||
fi \
|
fi \
|
||||||
if [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
|
if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
|
||||||
[ -f %{_file_context_file_pre} ] || cp -f %{_file_context_file} %{_file_context_file_pre} \
|
[ -f %{_file_context_file_pre} ] || cp -f %{_file_context_file} %{_file_context_file_pre} \
|
||||||
fi \
|
fi \
|
||||||
fi \
|
|
||||||
%{nil}
|
%{nil}
|
||||||
|
|
||||||
|
|
||||||
# %selinux_relabel_post [-s <policytype>]
|
# %selinux_relabel_post [-s <policytype>]
|
||||||
%selinux_relabel_post("s:") \
|
%selinux_relabel_post("s:") \
|
||||||
if [ -e /etc/selinux/config ]; then \
|
|
||||||
. /etc/selinux/config \
|
. /etc/selinux/config \
|
||||||
fi \
|
|
||||||
_policytype=%{-s*} \
|
_policytype=%{-s*} \
|
||||||
if [ -z "${_policytype}" ]; then \
|
if [ -z "${_policytype}" ]; then \
|
||||||
_policytype="targeted" \
|
_policytype="targeted" \
|
||||||
@ -113,9 +104,7 @@ fi \
|
|||||||
|
|
||||||
# %selinux_set_booleans [-s <policytype>] boolean [boolean]...
|
# %selinux_set_booleans [-s <policytype>] boolean [boolean]...
|
||||||
%selinux_set_booleans("s:") \
|
%selinux_set_booleans("s:") \
|
||||||
if [ -e /etc/selinux/config ]; then \
|
|
||||||
. /etc/selinux/config \
|
. /etc/selinux/config \
|
||||||
fi \
|
|
||||||
_policytype=%{-s*} \
|
_policytype=%{-s*} \
|
||||||
if [ -z "${_policytype}" ]; then \
|
if [ -z "${_policytype}" ]; then \
|
||||||
_policytype="targeted" \
|
_policytype="targeted" \
|
||||||
@ -154,9 +143,7 @@ fi \
|
|||||||
|
|
||||||
# %selinux_unset_booleans [-s <policytype>] boolean [boolean]...
|
# %selinux_unset_booleans [-s <policytype>] boolean [boolean]...
|
||||||
%selinux_unset_booleans("s:") \
|
%selinux_unset_booleans("s:") \
|
||||||
if [ -e /etc/selinux/config ]; then \
|
|
||||||
. /etc/selinux/config \
|
. /etc/selinux/config \
|
||||||
fi \
|
|
||||||
_policytype=%{-s*} \
|
_policytype=%{-s*} \
|
||||||
if [ -z "${_policytype}" ]; then \
|
if [ -z "${_policytype}" ]; then \
|
||||||
_policytype="targeted" \
|
_policytype="targeted" \
|
@ -25,7 +25,7 @@ gen_user(system_u,, system_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
|||||||
# permit any access to such users, then remove this entry.
|
# permit any access to such users, then remove this entry.
|
||||||
#
|
#
|
||||||
gen_user(user_u, user, user_r, s0, s0)
|
gen_user(user_u, user, user_r, s0, s0)
|
||||||
gen_user(staff_u, user, staff_r system_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
gen_user(staff_u, user, staff_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
|
|
||||||
#
|
#
|
||||||
@ -36,4 +36,3 @@ gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
|||||||
# not in the sysadm_r.
|
# not in the sysadm_r.
|
||||||
#
|
#
|
||||||
gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
|
@ -25,7 +25,7 @@ gen_user(system_u,, system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
|||||||
# permit any access to such users, then remove this entry.
|
# permit any access to such users, then remove this entry.
|
||||||
#
|
#
|
||||||
gen_user(user_u, user, user_r, s0, s0)
|
gen_user(user_u, user, user_r, s0, s0)
|
||||||
gen_user(staff_u, user, staff_r system_r sysadm_r secadm_r auditadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
gen_user(staff_u, user, staff_r sysadm_r secadm_r auditadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
|
|
||||||
#
|
#
|
||||||
@ -36,5 +36,3 @@ gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
|||||||
# not in the sysadm_r.
|
# not in the sysadm_r.
|
||||||
#
|
#
|
||||||
gen_user(root, user, sysadm_r staff_r secadm_r auditadm_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
gen_user(root, user, sysadm_r staff_r secadm_r auditadm_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
gen_user(guest_u, user, guest_r, s0, s0)
|
|
||||||
gen_user(xguest_u, user, xguest_r, s0, s0)
|
|
@ -25,7 +25,7 @@ gen_user(system_u,, system_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
|||||||
# permit any access to such users, then remove this entry.
|
# permit any access to such users, then remove this entry.
|
||||||
#
|
#
|
||||||
gen_user(user_u, user, user_r, s0, s0)
|
gen_user(user_u, user, user_r, s0, s0)
|
||||||
gen_user(staff_u, user, staff_r system_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
gen_user(staff_u, user, staff_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
|
|
||||||
#
|
#
|
||||||
@ -36,6 +36,3 @@ gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
|||||||
# not in the sysadm_r.
|
# not in the sysadm_r.
|
||||||
#
|
#
|
||||||
gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
|
||||||
gen_user(guest_u, user, guest_r, s0, s0)
|
|
||||||
gen_user(xguest_u, user, xguest_r, s0, s0)
|
|
16132
SPECS/selinux-policy.spec
Normal file
16132
SPECS/selinux-policy.spec
Normal file
File diff suppressed because it is too large
Load Diff
@ -1,7 +0,0 @@
|
|||||||
--- !Policy
|
|
||||||
product_versions:
|
|
||||||
- rhel-9
|
|
||||||
decision_context: osci_compose_gate
|
|
||||||
rules:
|
|
||||||
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
|
|
||||||
- !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
|
|
80
ifndefy.py
80
ifndefy.py
@ -1,80 +0,0 @@
|
|||||||
#!/usr/bin/env python3
|
|
||||||
#
|
|
||||||
# Copyright (C) 2021 Red Hat, Inc.
|
|
||||||
#
|
|
||||||
# This library is free software; you can redistribute it and/or
|
|
||||||
# modify it under the terms of the GNU Lesser General Public
|
|
||||||
# License as published by the Free Software Foundation; either
|
|
||||||
# version 2.1 of the License, or (at your option) any later version.
|
|
||||||
#
|
|
||||||
# This library is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
||||||
# Lesser General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU Lesser General Public
|
|
||||||
# License along with this library. If not, see
|
|
||||||
# <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
# About:
|
|
||||||
# When provided with an interface file, this script outputs a new interface
|
|
||||||
# file, where all original interfaces are enclosed in an ifndef statement
|
|
||||||
# dependent on their name. All indentation inside the interface file should
|
|
||||||
# be converted to tabs before running this script.
|
|
||||||
#
|
|
||||||
# Known issues:
|
|
||||||
# - interface already enclosed in an ifndef statement is not ignored
|
|
||||||
# - "`" and "'" inside comments are not ignored
|
|
||||||
# - \t is always used for indentation - may result in mixture of spaces and tabs
|
|
||||||
|
|
||||||
import sys
|
|
||||||
import os
|
|
||||||
import re
|
|
||||||
|
|
||||||
if len(sys.argv) < 1:
|
|
||||||
print(("Usage: {} <policy>.if > <output>.if").format(sys.argv[0]), file=sys.stderr)
|
|
||||||
exit(os.EX_USAGE)
|
|
||||||
|
|
||||||
# ending index of interface
|
|
||||||
end = 0
|
|
||||||
with open(sys.argv[1], 'r') as f:
|
|
||||||
interfaces = f.read()
|
|
||||||
file_len = len(interfaces)
|
|
||||||
|
|
||||||
while end < file_len:
|
|
||||||
start = interfaces.find("interface(`", end)
|
|
||||||
if start < 0:
|
|
||||||
#no more interfaces
|
|
||||||
print(interfaces[end:], end ="")
|
|
||||||
break
|
|
||||||
name_end = interfaces.find("'", start+11)
|
|
||||||
name = interfaces[start+11:name_end]
|
|
||||||
|
|
||||||
# locate the end of the interface - i.e. ending apostrophe
|
|
||||||
reg = re.compile(r"[`']")
|
|
||||||
# skip the ' after interface name
|
|
||||||
i = name_end+1
|
|
||||||
# counter for the depth (` opens a new block, while ' closes it)
|
|
||||||
graves = 0
|
|
||||||
while i < file_len:
|
|
||||||
match = reg.search(interfaces, i)
|
|
||||||
if not match:
|
|
||||||
print("Malformed interface: {}".format(name), file=sys.stderr)
|
|
||||||
exit(1)
|
|
||||||
|
|
||||||
i = match.end()
|
|
||||||
if match.group(0) == '`':
|
|
||||||
graves += 1
|
|
||||||
else:
|
|
||||||
graves -= 1
|
|
||||||
if graves == 0:
|
|
||||||
break
|
|
||||||
|
|
||||||
# keep everything between the end of previous interface and start of a new one
|
|
||||||
print(interfaces[end:start], end ="")
|
|
||||||
# interface ends in "')" -- add 1 for the edning bracket
|
|
||||||
end = i+1
|
|
||||||
# print the whole interface enclosed in "ifndef"
|
|
||||||
print("ifndef(`{}',`".format(name))
|
|
||||||
print('\n'.join([('\t' + x) if x else x for x in interfaces[start:end].split('\n')]))
|
|
||||||
print("')", end ="")
|
|
@ -1,57 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
DISTGIT_PATH=$(pwd)
|
|
||||||
|
|
||||||
RHEL_VERSION="c9s"
|
|
||||||
DISTGIT_BRANCH="c9s"
|
|
||||||
REPO_SELINUX_POLICY=${REPO_SELINUX_POLICY:-https://github.com/fedora-selinux/selinux-policy.git}
|
|
||||||
REPO_SELINUX_POLICY_BRANCH=${REPO_SELINUX_POLICY_BRANCH:-$RHEL_VERSION}
|
|
||||||
REPO_CONTAINER_SELINUX=${REPO_CONTAINER_SELINUX:-git@github.com:projectatomic/container-selinux.git}
|
|
||||||
REPO_MACRO_EXPANDER=${REPO_MACRO_EXPANDER:-git@gitlab.cee.redhat.com:SELinux/macro-expander.git}
|
|
||||||
|
|
||||||
# When -l is specified, we use locally created tarballs and don't download them from github
|
|
||||||
DOWNLOAD_DEFAULT_GITHUB_TARBALLS=1
|
|
||||||
if [ "$1" == "-l" ]; then
|
|
||||||
DOWNLOAD_DEFAULT_GITHUB_TARBALLS=0
|
|
||||||
fi
|
|
||||||
|
|
||||||
#git checkout $DISTGIT_BRANCH -q
|
|
||||||
|
|
||||||
POLICYSOURCES=`mktemp -d --tmpdir policysources.XXXXXX`
|
|
||||||
pushd $POLICYSOURCES > /dev/null
|
|
||||||
|
|
||||||
git clone --depth=1 -q $REPO_SELINUX_POLICY selinux-policy \
|
|
||||||
-b $REPO_SELINUX_POLICY_BRANCH
|
|
||||||
git clone --depth=1 -q $REPO_CONTAINER_SELINUX container-selinux
|
|
||||||
git clone --depth=1 -q $REPO_MACRO_EXPANDER macro-expander
|
|
||||||
|
|
||||||
pushd selinux-policy > /dev/null
|
|
||||||
# prepare policy patches against upstream commits matching the last upstream merge
|
|
||||||
BASE_HEAD_ID=$(git rev-parse HEAD)
|
|
||||||
BASE_SHORT_HEAD_ID=$(c=${BASE_HEAD_ID}; echo ${c:0:7})
|
|
||||||
git archive --prefix=selinux-policy-$BASE_HEAD_ID/ --format tgz HEAD > $DISTGIT_PATH/selinux-policy-$BASE_SHORT_HEAD_ID.tar.gz
|
|
||||||
popd > /dev/null
|
|
||||||
|
|
||||||
pushd container-selinux > /dev/null
|
|
||||||
# Actual container-selinux files are in master branch
|
|
||||||
#git checkout -b ${DOCKER_FEDORA_VERSION} -t origin/${DOCKER_FEDORA_VERSION} -q
|
|
||||||
tar -czf container-selinux.tgz container.if container.te container.fc
|
|
||||||
popd > /dev/null
|
|
||||||
|
|
||||||
pushd $DISTGIT_PATH > /dev/null
|
|
||||||
cp $POLICYSOURCES/container-selinux/container-selinux.tgz .
|
|
||||||
cp $POLICYSOURCES/macro-expander/macro-expander.sh ./macro-expander
|
|
||||||
chmod +x ./macro-expander
|
|
||||||
popd > /dev/null
|
|
||||||
|
|
||||||
popd > /dev/null
|
|
||||||
rm -rf $POLICYSOURCES
|
|
||||||
|
|
||||||
# Update commit id in selinux-policy.spec file
|
|
||||||
sed -i "s/%global commit [^ ]*$/%global commit $BASE_HEAD_ID/" selinux-policy.spec
|
|
||||||
|
|
||||||
# Update sources
|
|
||||||
sha512sum --tag selinux-policy-${BASE_SHORT_HEAD_ID}.tar.gz container-selinux.tgz macro-expander > sources
|
|
||||||
|
|
||||||
echo -e "\nSELinux policy tarball and container-selinux.tgz with container policy files have been created."
|
|
||||||
echo "Commit id of selinux-policy in spec file was changed to ${BASE_HEAD_ID}"
|
|
@ -1 +0,0 @@
|
|||||||
modules-targeted.conf
|
|
File diff suppressed because it is too large
Load Diff
@ -1,13 +0,0 @@
|
|||||||
summary: Tier 1 selinux-policy test plan
|
|
||||||
discover:
|
|
||||||
how: fmf
|
|
||||||
url: https://src.fedoraproject.org/tests/selinux.git
|
|
||||||
filter: "tier:1 & tag:-failinfedora | component:selinux-policy & tag:-failinfedora"
|
|
||||||
prepare:
|
|
||||||
how: shell
|
|
||||||
script:
|
|
||||||
- yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm || true
|
|
||||||
- yum config-manager --set-enabled epel || true
|
|
||||||
- yum config-manager --set-enabled crb || true
|
|
||||||
execute:
|
|
||||||
how: tmt
|
|
@ -1,15 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Description=Check that SELinux is not disabled the unsafe way
|
|
||||||
ConditionKernelCommandLine=!selinux=0
|
|
||||||
After=sysinit.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=oneshot
|
|
||||||
EnvironmentFile=/etc/selinux/config
|
|
||||||
ExecCondition=test "$SELINUX" = disabled
|
|
||||||
ExecStart=/usr/bin/echo 'SELINUX=disabled in /etc/selinux/config, but no selinux=0 on kernel command line - SELinux may not be fully disabled. Please update bootloader configuration to pass selinux=0 to kernel at boot.'
|
|
||||||
StandardOutput=journal+console
|
|
||||||
SyslogLevel=warning
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
2527
selinux-policy.spec
2527
selinux-policy.spec
File diff suppressed because it is too large
Load Diff
3
sources
3
sources
@ -1,3 +0,0 @@
|
|||||||
SHA512 (selinux-policy-3a35980.tar.gz) = 1440e81e39a67d981a55472a6906383a785374799cc0b3518292352f16145787d2842cdccc19b79e701052ac7df61e01397feccf07f760d0f7a5dd0ec95cdf64
|
|
||||||
SHA512 (macro-expander) = 243ee49f1185b78ac47e56ca9a3f3592f8975fab1a2401c0fcc7f88217be614fe31805bacec602b728e7fcfc21dcc17d90e9a54ce87f3a0c97624d9ad885aea4
|
|
||||||
SHA512 (container-selinux.tgz) = ba99863dc10f900452046a8653645b9b5ea3e9464607cd90246751ee8fad364ae14283d738fff0beb069e735cd2bc04a99d10153d696fa29ae5bef5846d3ea36
|
|
@ -1,50 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: localhost
|
|
||||||
vars:
|
|
||||||
- artifacts: "{{ lookup('env', 'TEST_ARTIFACTS')|default('./artifacts', true) }}"
|
|
||||||
tags:
|
|
||||||
- classic
|
|
||||||
tasks:
|
|
||||||
# switch SELinux to permissive mode
|
|
||||||
- name: Get default kernel
|
|
||||||
command: "grubby --default-kernel"
|
|
||||||
register: default_kernel
|
|
||||||
- debug: msg="{{ default_kernel.stdout }}"
|
|
||||||
- name: Set permissive mode
|
|
||||||
command: "grubby --args=enforcing=0 --update-kernel {{ default_kernel.stdout }}"
|
|
||||||
|
|
||||||
- name: reboot
|
|
||||||
block:
|
|
||||||
- name: restart host
|
|
||||||
shell: sleep 2 && shutdown -r now "Ansible updates triggered"
|
|
||||||
async: 1
|
|
||||||
poll: 0
|
|
||||||
ignore_errors: true
|
|
||||||
|
|
||||||
- name: wait for host to come back
|
|
||||||
wait_for_connection:
|
|
||||||
delay: 10
|
|
||||||
timeout: 300
|
|
||||||
|
|
||||||
- name: Re-create /tmp/artifacts
|
|
||||||
command: mkdir /tmp/artifacts
|
|
||||||
|
|
||||||
- name: Gather SELinux denials since boot
|
|
||||||
shell: |
|
|
||||||
result=pass
|
|
||||||
dmesg | grep -i -e type=1300 -e type=1400 > /tmp/avc.log && result=fail
|
|
||||||
ausearch -m avc -m selinux_err -m user_avc -ts boot &>> /tmp/avc.log
|
|
||||||
grep -q '<no matches>' /tmp/avc.log || result=fail
|
|
||||||
echo -e "\nresults:\n- test: reboot and collect AVC\n result: $result\n logs:\n - avc.log\n\n" > /tmp/results.yml
|
|
||||||
( [ $result = "pass" ] && echo PASS test-reboot || echo FAIL test-reboot ) > /tmp/test.log
|
|
||||||
|
|
||||||
always:
|
|
||||||
- name: Pull out the artifacts
|
|
||||||
fetch:
|
|
||||||
dest: "{{ artifacts }}/"
|
|
||||||
src: "{{ item }}"
|
|
||||||
flat: yes
|
|
||||||
with_items:
|
|
||||||
- /tmp/test.log
|
|
||||||
- /tmp/avc.log
|
|
||||||
- /tmp/results.yml
|
|
Loading…
Reference in New Issue
Block a user