SELinux policy configuration
22bdc94c2b
- Remove all ganesha bits from gluster and rpc policy - Label /usr/share/spamassassin/sa-update.cron as spamd_update_exec_t - Add dac_override capability to ssad_t domains - Allow pesign_t domain to read gnome home configs - Label /usr/libexec/lm_sensors/sensord-service-wrapper as lsmd_exec_t - Allow rngd_t domains read kernel state - Allow certmonger_t domains to read bind cache - Allow ypbind_t domain to stream connect to sssd - Allow rngd_t domain to setsched - Allow sanlock_t domain to read/write sysfs_t files - Add dac_override capability to postfix_local_t domain - Allow ypbind_t to search sssd_var_lib_t dirs - Allow virt_qemu_ga_t domain to write to user_tmp_t files - Allow systemd_logind_t to dbus chat with virt_qemu_ga_t - Update sssd_manage_lib_files() interface to allow also mmap sssd_var_lib_t files - Add new interface sssd_signal() - Update xserver_filetrans_home_content() and xserver_filetrans_admin_home_content() unterfaces to allow caller domain to create .vnc dir in users homedir labeled as xdm_home_t - Update logging_filetrans_named_content() to allow caller domains of this interface to create /var/log/journal/remote directory labeled as var_log_t - Add sys_resource capability to the systemd_passwd_agent_t domain - Allow ipsec_t domains to read bind cache - kernel/files.fc: Label /run/motd as etc_t - Allow systemd to stream connect to userdomain processes - Label /var/lib/private/systemd/ as init_var_lib_t - Allow initrc_t domain to create new socket labeled as init_T - Allow audisp_remote_t domain remote logging client to read local audit events from relevant socket. - Add tracefs_t type to mountpoint attribute - Allow useradd_t and groupadd_t domains to send signals to sssd_t - Allow systemd_logind_t domain to remove directories labeled as tmpfs_t BZ(1648636) - Allow useradd_t and groupadd_t domains to access sssd files because of the new feature in shadow-utils |
||
---|---|---|
tests | ||
.gitignore | ||
booleans-minimum.conf | ||
booleans-mls.conf | ||
booleans-targeted.conf | ||
booleans.subs_dist | ||
COPYING | ||
customizable_types | ||
file_contexts.subs_dist | ||
make-rhat-patches.sh | ||
Makefile | ||
Makefile.devel | ||
modules-minimum.conf | ||
modules-mls-base.conf | ||
modules-mls-contrib.conf | ||
modules-targeted-base.conf | ||
modules-targeted-contrib.conf | ||
modules-targeted.conf | ||
permissivedomains.cil | ||
README | ||
rpm.macros | ||
securetty_types-minimum | ||
securetty_types-mls | ||
securetty_types-targeted | ||
selinux-factory-reset | ||
selinux-factory-reset@.service | ||
selinux-policy.conf | ||
selinux-policy.spec | ||
setrans-minimum.conf | ||
setrans-mls.conf | ||
setrans-targeted.conf | ||
seusers | ||
sources | ||
users-minimum | ||
users-mls | ||
users-targeted |
## Purpose SELinux Fedora Policy is a large patch off the mainline. The [fedora-selinux/selinux-policy](https://github.com/selinux-policy/selinux-policy.git) makes Fedora Policy packaging more simple and transparent for developers, upstream developers and users. It is used for applying downstream Fedora fixes, for communication about proposed/committed changes, for communication with upstream and the community. It reflects upstream repository structure to make submitting patches to upstream easy. ## Structure ### github On GitHub, we have two repositories (selinux-policy and selinux-policy-contrib ) for dist-git repository. $ cd selinux-policy $ git remote -v origin git@github.com:fedora-selinux/selinux-policy.git (fetch) $ git branch -r origin/HEAD -> origin/master origin/f27 origin/f28 origin/master origin/rawhide $ cd selinux-policy-contrib $ git remote -v origin git@github.com:fedora-selinux/selinux-policy-contrib.git (fetch) $ git branch -r origin/HEAD -> origin/master origin/f27 origin/f28 origin/master origin/rawhide Note: _master_ branch on GitHub does not reflect master branch in dist-git. For this purpose, we created the _rawhide github branches in both selinux-policy and selinux-policy-contrib repositories. ### dist-git Package sources in dist-git are generally composed from a _selinux-policy and _selinux-policy-contrib repository snapshots tarballs and from other config files. ## Build process 1. clone [fedora-selinux/selinux-policy](https://github.com/fedora-selinux/selinux-policy) repository $ cd ~/devel/github $ git clone git@github.com:fedora-selinux/selinux-policy.git $ cd selinux-policy 2. clone [fedora-selinux/selinux-policy-contrib](https://github.com/fedora-selinux/selinux-policy-contrib) repository $ cd ~/devel/github $ git clone git@github.com:fedora-selinux/selinux-policy-contrib.git $ cd selinux-policy-contrib 3. create, backport, cherry-pick needed changes to a particular branch and push them 4. clone **selinux-policy** dist-git repository $ cd ~/devel/dist-git $ fedpkg clone selinux-policy $ cd selinux-policy 4. Download the latest snaphots from selinux-policy and selinux-policy-contrib github repositories $ ./make-rhat-patches.sh 5. add changes to the dist-git repository, bump release, create a changelog entry, commit and push 6. build the package $ fedpkg build