re-import sources as agreed with the maintainer
This commit is contained in:
Adam Samalik
parent
3bab9162c4
commit
faa3fb4616
6
.gitignore
vendored
6
.gitignore
vendored
@ -1,2 +1,6 @@
|
|||||||
SOURCES/v0.1.8.tar.gz
|
/v0.1.5.tar.gz
|
||||||
|
/v0.1.6.tar.gz
|
||||||
/v0.1.8.tar.gz
|
/v0.1.8.tar.gz
|
||||||
|
/v0.2.0.tar.gz
|
||||||
|
/v0.2.1.tar.gz
|
||||||
|
/v0.2.5.tar.gz
|
||||||
|
|||||||
381
0001-Update-templates-to-work-properly-with-new-cil-parse.patch
Normal file
381
0001-Update-templates-to-work-properly-with-new-cil-parse.patch
Normal file
@ -0,0 +1,381 @@
|
|||||||
|
From 09bf6b339f1219769ada2c108c429013af19ceb5 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Thu, 26 Aug 2021 17:48:45 +0200
|
||||||
|
Subject: [PATCH] Update templates to work properly with new cil parser
|
||||||
|
|
||||||
|
Cil parser was recently updated to reject the following:
|
||||||
|
(block template1 (type t) )
|
||||||
|
(block template2 (blockinherit template1))
|
||||||
|
(block b (blockinherit template1) (blockinherit template2))
|
||||||
|
|
||||||
|
Re-declaration of type t
|
||||||
|
Previous declaration of type at /var/lib/selinux/targeted/tmp/modules/400/test/cil:1
|
||||||
|
Failed to copy block contents into blockinherit
|
||||||
|
Failed to resolve AST
|
||||||
|
semodule: Failed!
|
||||||
|
|
||||||
|
Remove (blockinherit container) from all templates so that "process" and
|
||||||
|
"socket" are only defined once (by inheriting "container" block in the
|
||||||
|
generated policy).
|
||||||
|
All allow rules referencing "process" and "socket" now need to be
|
||||||
|
enclosed in an optional block.
|
||||||
|
|
||||||
|
While at it, unify indentation.
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
---
|
||||||
|
udica/templates/config_container.cil | 33 ++++++++++---------
|
||||||
|
udica/templates/home_container.cil | 48 +++++++++++++++-------------
|
||||||
|
udica/templates/log_container.cil | 44 +++++++++++++------------
|
||||||
|
udica/templates/net_container.cil | 32 +++++++++----------
|
||||||
|
udica/templates/tmp_container.cil | 18 +++++------
|
||||||
|
udica/templates/tty_container.cil | 13 ++++----
|
||||||
|
udica/templates/virt_container.cil | 20 ++++++------
|
||||||
|
udica/templates/x_container.cil | 30 ++++++++---------
|
||||||
|
8 files changed, 120 insertions(+), 118 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/udica/templates/config_container.cil b/udica/templates/config_container.cil
|
||||||
|
index abd2c0e..6014f90 100644
|
||||||
|
--- a/udica/templates/config_container.cil
|
||||||
|
+++ b/udica/templates/config_container.cil
|
||||||
|
@@ -1,25 +1,24 @@
|
||||||
|
(block config_container
|
||||||
|
- (blockinherit container)
|
||||||
|
-
|
||||||
|
- (allow process configfile (dir (ioctl read getattr lock search open)))
|
||||||
|
- (allow process configfile (file (ioctl read getattr lock open)))
|
||||||
|
- (allow process configfile (lnk_file (read getattr)))
|
||||||
|
-
|
||||||
|
+ (optional config_container_optional
|
||||||
|
+ (allow process configfile (dir (ioctl read getattr lock search open)))
|
||||||
|
+ (allow process configfile (file (ioctl read getattr lock open)))
|
||||||
|
+ (allow process configfile (lnk_file (read getattr)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
|
||||||
|
(block config_rw_container
|
||||||
|
- (blockinherit config_container)
|
||||||
|
-
|
||||||
|
- (allow process configfile (dir (ioctl read write getattr lock append open)))
|
||||||
|
- (allow process configfile (file (ioctl read write getattr lock append open)))
|
||||||
|
- (allow process configfile (lnk_file (ioctl read write getattr lock append open)))
|
||||||
|
+ (blockinherit config_container)
|
||||||
|
+ (optional config_rw_container_optional
|
||||||
|
+ (allow process configfile (dir (ioctl read write getattr lock append open)))
|
||||||
|
+ (allow process configfile (file (ioctl read write getattr lock append open)))
|
||||||
|
+ (allow process configfile (lnk_file (ioctl read write getattr lock append open)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
|
||||||
|
(block config_manage_container
|
||||||
|
- (blockinherit container)
|
||||||
|
-
|
||||||
|
- (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open)))
|
||||||
|
- (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open)))
|
||||||
|
- (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open)))
|
||||||
|
-
|
||||||
|
+ (optional config_manage_container_optional
|
||||||
|
+ (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open)))
|
||||||
|
+ (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open)))
|
||||||
|
+ (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
diff --git a/udica/templates/home_container.cil b/udica/templates/home_container.cil
|
||||||
|
index 2683606..33499bc 100644
|
||||||
|
--- a/udica/templates/home_container.cil
|
||||||
|
+++ b/udica/templates/home_container.cil
|
||||||
|
@@ -1,33 +1,37 @@
|
||||||
|
(block home_container
|
||||||
|
- (blockinherit container)
|
||||||
|
+ (optional home_container_optional
|
||||||
|
+ (allow process process (capability (dac_override )))
|
||||||
|
|
||||||
|
- (allow process process (capability (dac_override )))
|
||||||
|
+ (allow process user_home_dir_t (dir (getattr search open read lock ioctl)))
|
||||||
|
+ (allow process home_root_t (dir (getattr search open read lock ioctl)))
|
||||||
|
+ (allow process user_home_t (dir (getattr search open read lock ioctl)))
|
||||||
|
|
||||||
|
- (allow process user_home_dir_t (dir (getattr search open read lock ioctl)))
|
||||||
|
- (allow process home_root_t (dir (getattr search open read lock ioctl)))
|
||||||
|
- (allow process user_home_t (dir (getattr search open read lock ioctl)))
|
||||||
|
-
|
||||||
|
- (allow process user_home_dir_t (file (getattr ioctl lock open read)))
|
||||||
|
- (allow process user_home_t (file (getattr ioctl lock open read)))
|
||||||
|
+ (allow process user_home_dir_t (file (getattr ioctl lock open read)))
|
||||||
|
+ (allow process user_home_t (file (getattr ioctl lock open read)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
(block home_rw_container
|
||||||
|
- (blockinherit home_container)
|
||||||
|
- (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl)))
|
||||||
|
- (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl)))
|
||||||
|
- (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl)))
|
||||||
|
-
|
||||||
|
- (allow process user_home_t (file (open getattr read write append ioctl lock)))
|
||||||
|
- (allow process user_home_dir_t (file (open getattr read write append ioctl lock)))
|
||||||
|
+ (blockinherit home_container)
|
||||||
|
+ (optional home_rw_container_optional
|
||||||
|
+ (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl)))
|
||||||
|
+ (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl)))
|
||||||
|
+ (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl)))
|
||||||
|
+
|
||||||
|
+ (allow process user_home_t (file (open getattr read write append ioctl lock)))
|
||||||
|
+ (allow process user_home_dir_t (file (open getattr read write append ioctl lock)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
|
||||||
|
(block home_manage_container
|
||||||
|
- (blockinherit home_rw_container)
|
||||||
|
- (allow process user_home_dir_t (dir (create unlink rename rmdir )))
|
||||||
|
- (allow process home_root_t (dir (create unlink rename rmdir )))
|
||||||
|
- (allow process user_home_t (dir (create unlink rename rmdir )))
|
||||||
|
-
|
||||||
|
- (allow process user_home_t (file (create rename link unlink )))
|
||||||
|
- (allow process user_home_dir_t (file (create rename link unlink )))
|
||||||
|
+ (blockinherit home_rw_container)
|
||||||
|
+ (optional home_manage_container_optional
|
||||||
|
+ (allow process user_home_dir_t (dir (create unlink rename rmdir )))
|
||||||
|
+ (allow process home_root_t (dir (create unlink rename rmdir )))
|
||||||
|
+ (allow process user_home_t (dir (create unlink rename rmdir )))
|
||||||
|
+
|
||||||
|
+ (allow process user_home_t (file (create rename link unlink )))
|
||||||
|
+ (allow process user_home_dir_t (file (create rename link unlink )))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
diff --git a/udica/templates/log_container.cil b/udica/templates/log_container.cil
|
||||||
|
index 767c669..a5ecf45 100644
|
||||||
|
--- a/udica/templates/log_container.cil
|
||||||
|
+++ b/udica/templates/log_container.cil
|
||||||
|
@@ -1,31 +1,35 @@
|
||||||
|
(block log_container
|
||||||
|
- (blockinherit container)
|
||||||
|
-
|
||||||
|
- (allow process var_t (dir (getattr search open)))
|
||||||
|
- (allow process logfile (dir (ioctl read getattr lock search open)))
|
||||||
|
- (allow process logfile (file (ioctl read getattr lock open map)))
|
||||||
|
- (allow process auditd_log_t (dir (ioctl read getattr lock search open)))
|
||||||
|
- (allow process auditd_log_t (file (ioctl read getattr lock open)))
|
||||||
|
+ (optional log_container_optional
|
||||||
|
+ (allow process var_t (dir (getattr search open)))
|
||||||
|
+ (allow process logfile (dir (ioctl read getattr lock search open)))
|
||||||
|
+ (allow process logfile (file (ioctl read getattr lock open map)))
|
||||||
|
+ (allow process auditd_log_t (dir (ioctl read getattr lock search open)))
|
||||||
|
+ (allow process auditd_log_t (file (ioctl read getattr lock open)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
(block log_rw_container
|
||||||
|
- (blockinherit log_container)
|
||||||
|
+ (blockinherit log_container)
|
||||||
|
|
||||||
|
- (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open)))
|
||||||
|
- (allow process logfile (file (ioctl read write create getattr setattr lock append open)))
|
||||||
|
- (allow process logfile (lnk_file (ioctl read write getattr lock append open)))
|
||||||
|
- (allow process var_t (dir (getattr search open)))
|
||||||
|
- (allow process auditd_log_t (dir (ioctl read getattr lock search open)))
|
||||||
|
- (allow process auditd_log_t (file (ioctl read getattr lock open)))
|
||||||
|
+ (optional log_rw_container_optional
|
||||||
|
+ (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open)))
|
||||||
|
+ (allow process logfile (file (ioctl read write create getattr setattr lock append open)))
|
||||||
|
+ (allow process logfile (lnk_file (ioctl read write getattr lock append open)))
|
||||||
|
+ (allow process var_t (dir (getattr search open)))
|
||||||
|
+ (allow process auditd_log_t (dir (ioctl read getattr lock search open)))
|
||||||
|
+ (allow process auditd_log_t (file (ioctl read getattr lock open)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
|
||||||
|
(block log_manage_container
|
||||||
|
- (blockinherit log_rw_container)
|
||||||
|
+ (blockinherit log_rw_container)
|
||||||
|
|
||||||
|
- (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open)))
|
||||||
|
- (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open)))
|
||||||
|
- (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename)))
|
||||||
|
- (allow process auditd_log_t (dir (ioctl read write getattr lock search open)))
|
||||||
|
- (allow process auditd_log_t (file (ioctl read write getattr lock open)))
|
||||||
|
+ (optional log_manage_container_optional
|
||||||
|
+ (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open)))
|
||||||
|
+ (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open)))
|
||||||
|
+ (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename)))
|
||||||
|
+ (allow process auditd_log_t (dir (ioctl read write getattr lock search open)))
|
||||||
|
+ (allow process auditd_log_t (file (ioctl read write getattr lock open)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
diff --git a/udica/templates/net_container.cil b/udica/templates/net_container.cil
|
||||||
|
index f839ed3..a89d548 100644
|
||||||
|
--- a/udica/templates/net_container.cil
|
||||||
|
+++ b/udica/templates/net_container.cil
|
||||||
|
@@ -1,25 +1,25 @@
|
||||||
|
(block net_container
|
||||||
|
- (blockinherit container)
|
||||||
|
- (typeattributeset sandbox_net_domain (process))
|
||||||
|
+ (optional net_container_optional
|
||||||
|
+ (typeattributeset sandbox_net_domain (process))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
|
||||||
|
(block restricted_net_container
|
||||||
|
- (blockinherit container)
|
||||||
|
+ (optional restricted_net_container_optional
|
||||||
|
+ (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept)))
|
||||||
|
+ (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create)))
|
||||||
|
+ (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create)))
|
||||||
|
|
||||||
|
- (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept)))
|
||||||
|
- (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create)))
|
||||||
|
- (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create)))
|
||||||
|
+ (allow process proc_t (lnk_file (read)))
|
||||||
|
|
||||||
|
- (allow process proc_t (lnk_file (read)))
|
||||||
|
+ (allow process node_t (node (tcp_recv tcp_send recvfrom sendto)))
|
||||||
|
+ (allow process node_t (node (udp_recv recvfrom)))
|
||||||
|
+ (allow process node_t (node (udp_send sendto)))
|
||||||
|
|
||||||
|
- (allow process node_t (node (tcp_recv tcp_send recvfrom sendto)))
|
||||||
|
- (allow process node_t (node (udp_recv recvfrom)))
|
||||||
|
- (allow process node_t (node (udp_send sendto)))
|
||||||
|
+ (allow process node_t (udp_socket (node_bind)))
|
||||||
|
+ (allow process node_t (tcp_socket (node_bind)))
|
||||||
|
|
||||||
|
- (allow process node_t (udp_socket (node_bind)))
|
||||||
|
- (allow process node_t (tcp_socket (node_bind)))
|
||||||
|
-
|
||||||
|
- (allow process http_port_t (tcp_socket (name_connect)))
|
||||||
|
- (allow process http_port_t (tcp_socket (recv_msg send_msg)))
|
||||||
|
+ (allow process http_port_t (tcp_socket (name_connect)))
|
||||||
|
+ (allow process http_port_t (tcp_socket (recv_msg send_msg)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
-
|
||||||
|
diff --git a/udica/templates/tmp_container.cil b/udica/templates/tmp_container.cil
|
||||||
|
index 3b3e940..c2a899b 100644
|
||||||
|
--- a/udica/templates/tmp_container.cil
|
||||||
|
+++ b/udica/templates/tmp_container.cil
|
||||||
|
@@ -1,15 +1,15 @@
|
||||||
|
(block tmp_container
|
||||||
|
- (blockinherit container)
|
||||||
|
-
|
||||||
|
- (allow process tmpfile (dir (getattr search open)))
|
||||||
|
- (allow process tmpfile (file (ioctl read getattr lock open)))
|
||||||
|
-
|
||||||
|
+ (optional tmp_container_optional
|
||||||
|
+ (allow process tmpfile (dir (getattr search open)))
|
||||||
|
+ (allow process tmpfile (file (ioctl read getattr lock open)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
|
||||||
|
(block tmp_rw_container
|
||||||
|
- (blockinherit tmp_container)
|
||||||
|
-
|
||||||
|
- (allow process tmpfile (file (ioctl read write getattr lock append open)))
|
||||||
|
- (allow process tmpfile (dir (ioctl read write getattr lock append open)))
|
||||||
|
+ (blockinherit tmp_container)
|
||||||
|
|
||||||
|
+ (optional tmp_rw_container_optional
|
||||||
|
+ (allow process tmpfile (file (ioctl read write getattr lock append open)))
|
||||||
|
+ (allow process tmpfile (dir (ioctl read write getattr lock append open)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
diff --git a/udica/templates/tty_container.cil b/udica/templates/tty_container.cil
|
||||||
|
index 444b5f8..7a5522e 100644
|
||||||
|
--- a/udica/templates/tty_container.cil
|
||||||
|
+++ b/udica/templates/tty_container.cil
|
||||||
|
@@ -1,10 +1,9 @@
|
||||||
|
(block tty_container
|
||||||
|
- (blockinherit container)
|
||||||
|
+ (optional tty_container_optional
|
||||||
|
+ (allow process device_t (dir (getattr search open)))
|
||||||
|
+ (allow process device_t (dir (ioctl read getattr lock search open)))
|
||||||
|
+ (allow process device_t (lnk_file (read getattr)))
|
||||||
|
|
||||||
|
- (allow process device_t (dir (getattr search open)))
|
||||||
|
- (allow process device_t (dir (ioctl read getattr lock search open)))
|
||||||
|
- (allow process device_t (lnk_file (read getattr)))
|
||||||
|
-
|
||||||
|
- (allow process devtty_t (chr_file (ioctl read write getattr lock append open)))
|
||||||
|
+ (allow process devtty_t (chr_file (ioctl read write getattr lock append open)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
-
|
||||||
|
diff --git a/udica/templates/virt_container.cil b/udica/templates/virt_container.cil
|
||||||
|
index 8ecae54..0728eba 100644
|
||||||
|
--- a/udica/templates/virt_container.cil
|
||||||
|
+++ b/udica/templates/virt_container.cil
|
||||||
|
@@ -1,16 +1,14 @@
|
||||||
|
(block virt_container
|
||||||
|
- (blockinherit container)
|
||||||
|
+ (optional virt_container_optional
|
||||||
|
+ (allow process var_t (dir (getattr search open)))
|
||||||
|
+ (allow process var_t (lnk_file (read getattr)))
|
||||||
|
|
||||||
|
- (allow process var_t (dir (getattr search open)))
|
||||||
|
- (allow process var_t (lnk_file (read getattr)))
|
||||||
|
+ (allow process var_run_t (dir (getattr search open)))
|
||||||
|
+ (allow process var_run_t (lnk_file (read getattr)))
|
||||||
|
|
||||||
|
- (allow process var_run_t (dir (getattr search open)))
|
||||||
|
- (allow process var_run_t (lnk_file (read getattr)))
|
||||||
|
-
|
||||||
|
- (allow process virt_var_run_t (dir (getattr search open)))
|
||||||
|
- (allow process virt_var_run_t (sock_file (write getattr append open)))
|
||||||
|
-
|
||||||
|
- (allow process virtd_t (unix_stream_socket (connectto)))
|
||||||
|
+ (allow process virt_var_run_t (dir (getattr search open)))
|
||||||
|
+ (allow process virt_var_run_t (sock_file (write getattr append open)))
|
||||||
|
|
||||||
|
+ (allow process virtd_t (unix_stream_socket (connectto)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
-
|
||||||
|
diff --git a/udica/templates/x_container.cil b/udica/templates/x_container.cil
|
||||||
|
index ee7441e..0a6ddb9 100644
|
||||||
|
--- a/udica/templates/x_container.cil
|
||||||
|
+++ b/udica/templates/x_container.cil
|
||||||
|
@@ -1,27 +1,25 @@
|
||||||
|
(block x_container
|
||||||
|
- (blockinherit container)
|
||||||
|
+ (optional x_container_optional
|
||||||
|
+ (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock)))
|
||||||
|
|
||||||
|
- (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock)))
|
||||||
|
+ (allow process xserver_t (unix_stream_socket (connectto)))
|
||||||
|
|
||||||
|
- (allow process xserver_t (unix_stream_socket (connectto)))
|
||||||
|
+ (allow process device_t (dir (getattr search open)))
|
||||||
|
|
||||||
|
- (allow process device_t (dir (getattr search open)))
|
||||||
|
+ (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map)))
|
||||||
|
|
||||||
|
- (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map)))
|
||||||
|
+ (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map)))
|
||||||
|
|
||||||
|
- (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map)))
|
||||||
|
+ (allow process urandom_device_t (chr_file (open read)))
|
||||||
|
|
||||||
|
- (allow process urandom_device_t (chr_file (open read)))
|
||||||
|
+ (allow process tmpfs_t (dir (getattr search open)))
|
||||||
|
|
||||||
|
- (allow process tmpfs_t (dir (getattr search open)))
|
||||||
|
+ (allow process tmp_t (dir (getattr search open)))
|
||||||
|
+ (allow process tmp_t (lnk_file (read getattr)))
|
||||||
|
|
||||||
|
- (allow process tmp_t (dir (getattr search open)))
|
||||||
|
- (allow process tmp_t (lnk_file (read getattr)))
|
||||||
|
-
|
||||||
|
- (allow process xserver_tmp_t (dir (getattr search open)))
|
||||||
|
- (allow process xserver_tmp_t (sock_file (write getattr append open)))
|
||||||
|
-
|
||||||
|
- (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open)))
|
||||||
|
+ (allow process xserver_tmp_t (dir (getattr search open)))
|
||||||
|
+ (allow process xserver_tmp_t (sock_file (write getattr append open)))
|
||||||
|
|
||||||
|
+ (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open)))
|
||||||
|
+ )
|
||||||
|
)
|
||||||
|
-
|
||||||
|
--
|
||||||
|
2.30.2
|
||||||
|
|
||||||
9
gating.yaml
Normal file
9
gating.yaml
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
#recipients: mmalik
|
||||||
|
--- !Policy
|
||||||
|
product_versions:
|
||||||
|
- rhel-8
|
||||||
|
decision_context: osci_compose_gate
|
||||||
|
rules:
|
||||||
|
- !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
|
||||||
|
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
|
||||||
|
|
||||||
2
sources
2
sources
@ -1 +1 @@
|
|||||||
SHA512 (v0.1.8.tar.gz) = ada8f3183904ac0aa1715e564f708ce3bda02719ecc2587e3774205bba39e585f2df7392861317a4324e8ea2c2f6fa031c3a0f440be6ca5408398b238089b891
|
SHA512 (v0.2.5.tar.gz) = 6321442ea546a630e08d3dd007bab153e47e15dce821eb824a899b239aa9e00d0edc3a239d3da1c4161afc72147f20d372e34a399a195a4b4ade12049b10df57
|
||||||
|
|||||||
22
tests/tests.yml
Normal file
22
tests/tests.yml
Normal file
@ -0,0 +1,22 @@
|
|||||||
|
- hosts: localhost
|
||||||
|
tags:
|
||||||
|
- classic
|
||||||
|
- container
|
||||||
|
roles:
|
||||||
|
- role: standard-test-source
|
||||||
|
|
||||||
|
- role: standard-test-basic
|
||||||
|
required_packages:
|
||||||
|
- make
|
||||||
|
- python3
|
||||||
|
- udica
|
||||||
|
tests:
|
||||||
|
- build_test:
|
||||||
|
dir: ./source
|
||||||
|
run: make
|
||||||
|
- smoke:
|
||||||
|
dir: ./source
|
||||||
|
run: python3 -m unittest -v tests/test_unit.py
|
||||||
|
- smoke2:
|
||||||
|
dir: ./source
|
||||||
|
run: python3 tests/test_integration.py
|
||||||
20
udica.spec
20
udica.spec
@ -1,8 +1,9 @@
|
|||||||
Summary: A tool for generating SELinux security policies for containers
|
Summary: A tool for generating SELinux security policies for containers
|
||||||
Name: udica
|
Name: udica
|
||||||
Version: 0.1.8
|
Version: 0.2.5
|
||||||
Release: 1%{?dist}
|
Release: 1%{?dist}
|
||||||
Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz
|
Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz
|
||||||
|
Patch001: 0001-Update-templates-to-work-properly-with-new-cil-parse.patch
|
||||||
License: GPLv3+
|
License: GPLv3+
|
||||||
BuildArch: noarch
|
BuildArch: noarch
|
||||||
Url: https://github.com/containers/udica
|
Url: https://github.com/containers/udica
|
||||||
@ -19,7 +20,7 @@ Tool for generating SELinux security profiles for containers based on
|
|||||||
inspection of container JSON file.
|
inspection of container JSON file.
|
||||||
|
|
||||||
%prep
|
%prep
|
||||||
%setup -q
|
%autosetup -p 1
|
||||||
|
|
||||||
%build
|
%build
|
||||||
%if 0%{?fedora} || 0%{?rhel} > 7
|
%if 0%{?fedora} || 0%{?rhel} > 7
|
||||||
@ -60,6 +61,21 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Aug 26 2021 Vit Mojzis <vmojzis@redhat.com> - 0.2.5-1
|
||||||
|
- New rebase https://github.com/containers/udica/releases/tag/v0.2.5 (#1995041)
|
||||||
|
- Replace capability dictionary with str.lower()
|
||||||
|
- Enable udica to generate policies with fifo class
|
||||||
|
- Sort container inspect data before processing
|
||||||
|
- Update templates to work properly with new cil parser
|
||||||
|
|
||||||
|
* Fri Oct 25 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.2.1-1
|
||||||
|
- New rebase https://github.com/containers/udica/releases/tag/v0.2.0
|
||||||
|
Resolves: rhbz#1757693
|
||||||
|
|
||||||
|
* Wed Oct 02 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.2.0-1
|
||||||
|
- New rebase https://github.com/containers/udica/releases/tag/v0.2.0
|
||||||
|
Resolves: rhbz#1757693
|
||||||
|
|
||||||
* Thu Jul 11 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.8-1
|
* Thu Jul 11 2019 Lukas Vrabec <lvrabec@redhat.com> - 0.1.8-1
|
||||||
- Udica supports podman version 1.4.0+
|
- Udica supports podman version 1.4.0+
|
||||||
Resolves: rhbz#1729115
|
Resolves: rhbz#1729115
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user