rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
ba7c7aec15
selinux-policy/policy-systemd.patch
Dan Walsh ba7c7aec15 Add labeling for /var/run/systemd/journal/syslog 
libvirt sends signals to ifconfig
Allow domains that read logind session files to list them
2012-01-13 11:51:57 -05:00

279 lines
11 KiB
Diff
Raw Blame History

diff -up serefpolicy-3.10.0/policy/modules/kernel/devices.if.systemd serefpolicy-3.10.0/policy/modules/kernel/devices.if
--- serefpolicy-3.10.0/policy/modules/kernel/devices.if.systemd 2012-01-13 11:49:49.140435334 -0500
+++ serefpolicy-3.10.0/policy/modules/kernel/devices.if 2012-01-13 11:49:49.236428320 -0500
@@ -143,13 +143,13 @@ interface(`dev_relabel_all_dev_nodes',`
type device_t;
')
- relabelfrom_dirs_pattern($1, device_t, device_node)
- relabelfrom_files_pattern($1, device_t, device_node)
- relabelfrom_lnk_files_pattern($1, device_t, { device_t device_node })
- relabel_fifo_files_pattern($1, device_t, { device_t device_node })
- relabel_sock_files_pattern($1, device_t, { device_t device_node })
- relabel_blk_files_pattern($1, device_t, { device_t device_node })
- relabel_chr_files_pattern($1, device_t, { device_t device_node })
+ relabel_dirs_pattern($1, device_t, device_node)
+ relabel_files_pattern($1, device_t, device_node)
+ relabel_lnk_files_pattern($1, device_t, device_node)
+ relabel_fifo_files_pattern($1, device_t, device_node)
+ relabel_sock_files_pattern($1, device_t, device_node)
+ relabel_blk_files_pattern($1, device_t, device_node)
+ relabel_chr_files_pattern($1, device_t, device_node)
')
########################################
@@ -4201,6 +4201,27 @@ interface(`dev_read_cpu_online',`
########################################
## <summary>
+## Relabel cpu online hardware state information.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`dev_relabel_cpu_online',`
+ gen_require(`
+ type cpu_online_t;
+ type sysfs_t;
+ ')
+
+ dev_search_sysfs($1)
+ allow $1 cpu_online_t:file relabel;
+')
+
+
+########################################
+## <summary>
## Read hardware state information.
## </summary>
## <desc>
@@ -4269,6 +4290,26 @@ interface(`dev_relabel_sysfs_dirs',`
')
########################################
+## <summary>
+## Relabel hardware state files
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`dev_relabel_all_sysfs',`
+ gen_require(`
+ type sysfs_t;
+ ')
+
+ relabel_dirs_pattern($1, sysfs_t, sysfs_t)
+ relabel_files_pattern($1, sysfs_t, sysfs_t)
+ relabel_lnk_files_pattern($1, sysfs_t, sysfs_t)
+')
+
+########################################
## <summary>
## Allow caller to modify hardware state information.
## </summary>
diff -up serefpolicy-3.10.0/policy/modules/roles/staff.te.systemd serefpolicy-3.10.0/policy/modules/roles/staff.te
--- serefpolicy-3.10.0/policy/modules/roles/staff.te.systemd 2012-01-13 11:49:49.147434822 -0500
+++ serefpolicy-3.10.0/policy/modules/roles/staff.te 2012-01-13 11:49:49.236428320 -0500
@@ -70,6 +70,10 @@ optional_policy(`
')
optional_policy(`
+ bluetooth_role(staff_r, staff_t)
+')
+
+optional_policy(`
dbadm_role_change(staff_r)
')
@@ -238,10 +242,6 @@ ifndef(`distro_redhat',`
')
optional_policy(`
- bluetooth_role(staff_r, staff_t)
- ')
-
- optional_policy(`
cdrecord_role(staff_r, staff_t)
')
diff -up serefpolicy-3.10.0/policy/modules/roles/unprivuser.te.systemd serefpolicy-3.10.0/policy/modules/roles/unprivuser.te
--- serefpolicy-3.10.0/policy/modules/roles/unprivuser.te.systemd 2012-01-13 11:49:49.148434749 -0500
+++ serefpolicy-3.10.0/policy/modules/roles/unprivuser.te 2012-01-13 11:49:49.236428320 -0500
@@ -35,6 +35,10 @@ optional_policy(`
')
optional_policy(`
+ bluetooth_role(user_r, user_t)
+')
+
+optional_policy(`
colord_dbus_chat(user_t)
')
diff -up serefpolicy-3.10.0/policy/modules/services/blueman.te.systemd serefpolicy-3.10.0/policy/modules/services/blueman.te
--- serefpolicy-3.10.0/policy/modules/services/blueman.te.systemd 2012-01-13 11:49:49.155434238 -0500
+++ serefpolicy-3.10.0/policy/modules/services/blueman.te 2012-01-13 11:49:49.236428320 -0500
@@ -36,3 +36,7 @@ miscfiles_read_localization(blueman_t)
optional_policy(`
avahi_domtrans(blueman_t)
')
+
+optional_policy(`
+ gnome_search_gconf(blueman_t)
+')
diff -up serefpolicy-3.10.0/policy/modules/services/entropyd.te.systemd serefpolicy-3.10.0/policy/modules/services/entropyd.te
--- serefpolicy-3.10.0/policy/modules/services/entropyd.te.systemd 2012-01-13 11:49:49.169433214 -0500
+++ serefpolicy-3.10.0/policy/modules/services/entropyd.te 2012-01-13 11:49:49.237428247 -0500
@@ -52,6 +52,8 @@ domain_use_interactive_fds(entropyd_t)
logging_send_syslog_msg(entropyd_t)
+auth_use_nsswitch(entropyd_t)
+
miscfiles_read_localization(entropyd_t)
userdom_dontaudit_use_unpriv_user_fds(entropyd_t)
diff -up serefpolicy-3.10.0/policy/modules/services/virt.fc.systemd serefpolicy-3.10.0/policy/modules/services/virt.fc
--- serefpolicy-3.10.0/policy/modules/services/virt.fc.systemd 2012-01-13 11:49:49.212430073 -0500
+++ serefpolicy-3.10.0/policy/modules/services/virt.fc 2012-01-13 11:49:49.237428247 -0500
@@ -49,3 +49,7 @@ HOME_DIR/VirtualMachines/isos(/.*)? gen_
# support for nova-stack
/usr/bin/nova-compute -- gen_context(system_u:object_r:virtd_exec_t,s0)
+/usr/bin/qemu -- gen_context(system_u:object_r:qemu_exec_t,s0)
+/usr/bin/qemu-system-.* -- gen_context(system_u:object_r:qemu_exec_t,s0)
+/usr/bin/qemu-kvm -- gen_context(system_u:object_r:qemu_exec_t,s0)
+/usr/libexec/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0)
diff -up serefpolicy-3.10.0/policy/modules/system/init.te.systemd serefpolicy-3.10.0/policy/modules/system/init.te
diff -up serefpolicy-3.10.0/policy/modules/system/logging.fc.systemd serefpolicy-3.10.0/policy/modules/system/logging.fc
--- serefpolicy-3.10.0/policy/modules/system/logging.fc.systemd 2012-01-13 11:49:49.222429343 -0500
+++ serefpolicy-3.10.0/policy/modules/system/logging.fc 2012-01-13 11:49:53.281133673 -0500
@@ -61,6 +61,7 @@ ifdef(`distro_suse', `
/var/log/spooler[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/audit(/.*)? gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
/var/log/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
+/var/run/log(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
ifndef(`distro_gentoo',`
/var/log/audit\.log -- gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
diff -up serefpolicy-3.10.0/policy/modules/system/logging.te.systemd serefpolicy-3.10.0/policy/modules/system/logging.te
--- serefpolicy-3.10.0/policy/modules/system/logging.te.systemd 2012-01-13 11:49:49.223429270 -0500
+++ serefpolicy-3.10.0/policy/modules/system/logging.te 2012-01-13 11:49:53.281133673 -0500
@@ -386,7 +386,7 @@ optional_policy(`
# chown fsetid for syslog-ng
# sys_admin for the integrated klog of syslog-ng and metalog
# cjp: why net_admin!
-allow syslogd_t self:capability { dac_override sys_resource sys_tty_config ipc_lock net_admin sys_admin sys_nice chown fsetid };
+allow syslogd_t self:capability { dac_override sys_resource sys_tty_config ipc_lock net_admin sys_admin sys_nice chown fsetid setuid setgid };
dontaudit syslogd_t self:capability sys_tty_config;
allow syslogd_t self:capability2 syslog;
# setpgid for metalog
@@ -474,6 +474,7 @@ tunable_policy(`logging_syslogd_can_send
dev_filetrans(syslogd_t, devlog_t, sock_file)
dev_read_sysfs(syslogd_t)
dev_read_rand(syslogd_t)
+dev_read_urand(syslogd_t)
# relating to systemd-kmsg-syslogd
dev_write_kmsg(syslogd_t)
@@ -497,6 +498,7 @@ mls_file_write_all_levels(syslogd_t) # N
term_write_console(syslogd_t)
# Allow syslog to a terminal
term_write_unallocated_ttys(syslogd_t)
+term_use_generic_ptys(syslogd_t)
init_stream_connect(syslogd_t)
# for sending messages to logged in users
diff -up serefpolicy-3.10.0/policy/modules/system/systemd.te.systemd serefpolicy-3.10.0/policy/modules/system/systemd.te
--- serefpolicy-3.10.0/policy/modules/system/systemd.te.systemd 2012-01-13 11:49:49.228428904 -0500
+++ serefpolicy-3.10.0/policy/modules/system/systemd.te 2012-01-13 11:49:53.282133606 -0500
@@ -111,6 +111,7 @@ init_dbus_chat(systemd_logind_t)
init_dbus_chat_script(systemd_logind_t)
init_read_script_state(systemd_logind_t)
init_read_state(systemd_logind_t)
+init_rw_stream_sockets(systemd_logind_t)
logging_send_syslog_msg(systemd_logind_t)
@@ -198,6 +199,8 @@ kernel_read_network_state(systemd_tmpfil
files_delete_kernel_modules(systemd_tmpfiles_t)
dev_write_kmsg(systemd_tmpfiles_t)
+dev_relabel_all_sysfs(systemd_tmpfiles_t)
+dev_read_cpu_online(systemd_tmpfiles_t)
domain_obj_id_change_exemption(systemd_tmpfiles_t)
@@ -322,6 +325,8 @@ fs_getattr_cgroup_files(systemd_notify_t
auth_use_nsswitch(systemd_notify_t)
+init_rw_stream_sockets(systemd_notify_t)
+
miscfiles_read_localization(systemd_notify_t)
optional_policy(`
diff -up serefpolicy-3.10.0/policy/modules/system/udev.te.systemd serefpolicy-3.10.0/policy/modules/system/udev.te
--- serefpolicy-3.10.0/policy/modules/system/udev.te.systemd 2012-01-13 11:49:49.228428904 -0500
+++ serefpolicy-3.10.0/policy/modules/system/udev.te 2012-01-13 11:49:53.282133606 -0500
@@ -333,6 +333,7 @@ optional_policy(`
kernel_read_xen_state(udev_t)
xen_manage_log(udev_t)
xen_read_image_files(udev_t)
+ xen_stream_connect_xenstore(udev_t)
')
optional_policy(`
diff -up serefpolicy-3.10.0/policy/modules/system/xen.fc.systemd serefpolicy-3.10.0/policy/modules/system/xen.fc
--- serefpolicy-3.10.0/policy/modules/system/xen.fc.systemd 2012-01-13 11:49:49.231428683 -0500
+++ serefpolicy-3.10.0/policy/modules/system/xen.fc 2012-01-13 11:49:53.282133606 -0500
@@ -4,7 +4,7 @@
/usr/sbin/evtchnd -- gen_context(system_u:object_r:evtchnd_exec_t,s0)
/usr/sbin/tapdisk -- gen_context(system_u:object_r:blktap_exec_t,s0)
-/usr/lib/xen/bin/qemu-dm -- gen_context(system_u:object_r:qemu_dm_exec_t,s0)
+#/usr/lib/xen/bin/qemu-dm -- gen_context(system_u:object_r:qemu_dm_exec_t,s0)
ifdef(`distro_debian',`
/usr/lib/xen-[^/]*/bin/xenconsoled -- gen_context(system_u:object_r:xenconsoled_exec_t,s0)
diff -up serefpolicy-3.10.0/policy/modules/system/xen.te.systemd serefpolicy-3.10.0/policy/modules/system/xen.te
--- serefpolicy-3.10.0/policy/modules/system/xen.te.systemd 2012-01-13 11:49:49.231428683 -0500
+++ serefpolicy-3.10.0/policy/modules/system/xen.te 2012-01-13 11:49:53.282133606 -0500
@@ -167,6 +167,10 @@ files_pid_filetrans(evtchnd_t, evtchnd_v
#
# qemu-dm local policy
#
+
+# TODO: This part of policy should be removed
+# qemu-dm should run in xend_t domain
+
# Do we need to allow execution of qemu-dm?
tunable_policy(`xend_run_qemu',`
allow qemu_dm_t self:capability sys_resource;
@@ -207,6 +211,11 @@ tunable_policy(`xend_run_qemu',`
allow xend_t self:capability { dac_override ipc_lock net_admin setuid sys_admin sys_nice sys_tty_config net_raw };
allow xend_t self:process { signal sigkill };
+
+# needed by qemu_dm
+allow xend_t self:capability sys_resource;
+allow xend_t self:process setrlimit;
+
dontaudit xend_t self:process ptrace;
# internal communication is often done using fifo and unix sockets.
allow xend_t self:fifo_file rw_fifo_file_perms;
@@ -319,7 +328,6 @@ logging_send_syslog_msg(xend_t)
miscfiles_read_localization(xend_t)
miscfiles_read_hwdata(xend_t)
-
sysnet_domtrans_dhcpc(xend_t)
sysnet_signal_dhcpc(xend_t)
sysnet_domtrans_ifconfig(xend_t)
Reference in New Issue View Git Blame Copy Permalink