|
 |
5c9578 |
From 609ffa1d2ed490c7d5c77d2dd2dfdc50f415b935 Mon Sep 17 00:00:00 2001
|
|
|
5c9578 |
From: Radovan Sroka <rsroka@redhat.com>
|
|
|
5c9578 |
Date: Thu, 24 Mar 2022 09:59:05 +0100
|
|
|
5c9578 |
Subject: [PATCH] Reorder loop holes with patterns in rules.d
|
|
|
5c9578 |
|
|
|
5c9578 |
- this keeps backwards compatibility with older wersions of rules
|
|
|
5c9578 |
- the ld_so pattern was applied to root
|
|
|
5c9578 |
- it caused problems with running ldd as root(previously unrestricted)
|
|
|
5c9578 |
|
|
|
5c9578 |
Signed-off-by: Radovan Sroka <rsroka@redhat.com>
|
|
|
5c9578 |
---
|
|
|
5c9578 |
fapolicyd.spec | 6 +++---
|
|
|
5c9578 |
rules.d/{30-dracut.rules => 20-dracut.rules} | 0
|
|
|
5c9578 |
rules.d/{30-updaters.rules => 21-updaters.rules} | 0
|
|
|
5c9578 |
rules.d/{20-patterns.rules => 30-patterns.rules} | 0
|
|
|
5c9578 |
rules.d/Makefile.am | 4 ++--
|
|
|
5c9578 |
rules.d/README-rules | 16 ++++++++--------
|
|
|
5c9578 |
6 files changed, 13 insertions(+), 13 deletions(-)
|
|
|
5c9578 |
rename rules.d/{30-dracut.rules => 20-dracut.rules} (100%)
|
|
|
5c9578 |
rename rules.d/{30-updaters.rules => 21-updaters.rules} (100%)
|
|
|
5c9578 |
rename rules.d/{20-patterns.rules => 30-patterns.rules} (100%)
|
|
|
5c9578 |
|
|
|
5c9578 |
diff --git a/fapolicyd.spec b/fapolicyd.spec
|
|
|
5c9578 |
index c2aae21..261b780 100644
|
|
|
5c9578 |
--- a/fapolicyd.spec
|
|
|
5c9578 |
+++ b/fapolicyd.spec
|
|
|
5c9578 |
@@ -66,9 +66,9 @@ if [ ! -e %{_sysconfdir}/%{name}/%{name}.rules ] ; then
|
|
|
5c9578 |
if [ "$files" -eq 0 ] ; then
|
|
|
5c9578 |
## Install the known libs policy
|
|
|
5c9578 |
cp %{_datadir}/%{name}/sample-rules/10-languages.rules %{_sysconfdir}/%{name}/rules.d/
|
|
|
5c9578 |
-cp %{_datadir}/%{name}/sample-rules/20-patterns.rules %{_sysconfdir}/%{name}/rules.d/
|
|
|
5c9578 |
-cp %{_datadir}/%{name}/sample-rules/30-dracut.rules %{_sysconfdir}/%{name}/rules.d/
|
|
|
5c9578 |
-cp %{_datadir}/%{name}/sample-rules/30-updaters.rules %{_sysconfdir}/%{name}/rules.d/
|
|
|
5c9578 |
+cp %{_datadir}/%{name}/sample-rules/20-dracut.rules %{_sysconfdir}/%{name}/rules.d/
|
|
|
5c9578 |
+cp %{_datadir}/%{name}/sample-rules/21-updaters.rules %{_sysconfdir}/%{name}/rules.d/
|
|
|
5c9578 |
+cp %{_datadir}/%{name}/sample-rules/30-patterns.rules %{_sysconfdir}/%{name}/rules.d/
|
|
|
5c9578 |
cp %{_datadir}/%{name}/sample-rules/40-bad-elf.rules %{_sysconfdir}/%{name}/rules.d/
|
|
|
5c9578 |
cp %{_datadir}/%{name}/sample-rules/41-shared-obj.rules %{_sysconfdir}/%{name}/rules.d/
|
|
|
5c9578 |
cp %{_datadir}/%{name}/sample-rules/42-trusted-elf.rules %{_sysconfdir}/%{name}/rules.d/
|
|
|
5c9578 |
diff --git a/rules.d/30-dracut.rules b/rules.d/20-dracut.rules
|
|
|
5c9578 |
similarity index 100%
|
|
|
5c9578 |
rename from rules.d/30-dracut.rules
|
|
|
5c9578 |
rename to rules.d/20-dracut.rules
|
|
|
5c9578 |
diff --git a/rules.d/30-updaters.rules b/rules.d/21-updaters.rules
|
|
|
5c9578 |
similarity index 100%
|
|
|
5c9578 |
rename from rules.d/30-updaters.rules
|
|
|
5c9578 |
rename to rules.d/21-updaters.rules
|
|
|
5c9578 |
diff --git a/rules.d/20-patterns.rules b/rules.d/30-patterns.rules
|
|
|
5c9578 |
similarity index 100%
|
|
|
5c9578 |
rename from rules.d/20-patterns.rules
|
|
|
5c9578 |
rename to rules.d/30-patterns.rules
|
|
|
5c9578 |
diff --git a/rules.d/Makefile.am b/rules.d/Makefile.am
|
|
|
5c9578 |
index 76b5377..9bb61a7 100644
|
|
|
5c9578 |
--- a/rules.d/Makefile.am
|
|
|
5c9578 |
+++ b/rules.d/Makefile.am
|
|
|
5c9578 |
@@ -23,8 +23,8 @@
|
|
|
5c9578 |
|
|
|
5c9578 |
CONFIG_CLEAN_FILES = *.rej *.orig
|
|
|
5c9578 |
|
|
|
5c9578 |
-EXTRA_DIST = README-rules 10-languages.rules 20-patterns.rules \
|
|
|
5c9578 |
- 30-dracut.rules 30-updaters.rules \
|
|
|
5c9578 |
+EXTRA_DIST = README-rules 10-languages.rules 20-dracut.rules \
|
|
|
5c9578 |
+ 21-updaters.rules 30-patterns.rules \
|
|
|
5c9578 |
40-bad-elf.rules 41-shared-obj.rules 42-trusted-elf.rules \
|
|
|
5c9578 |
43-known-elf.rules \
|
|
|
5c9578 |
70-trusted-lang.rules 71-known-python.rules 72-shell.rules \
|
|
|
5c9578 |
diff --git a/rules.d/README-rules b/rules.d/README-rules
|
|
|
5c9578 |
index c03c02b..30fcd01 100644
|
|
|
5c9578 |
--- a/rules.d/README-rules
|
|
|
5c9578 |
+++ b/rules.d/README-rules
|
|
|
5c9578 |
@@ -5,8 +5,8 @@ sort order. To make things easier to use, the files in this directory are
|
|
|
5c9578 |
organized into groups with the following meanings:
|
|
|
5c9578 |
|
|
|
5c9578 |
10 - macros
|
|
|
5c9578 |
-20 - patterns
|
|
|
5c9578 |
-30 - loop holes
|
|
|
5c9578 |
+20 - loop holes
|
|
|
5c9578 |
+30 - patterns
|
|
|
5c9578 |
40 - ELF rules
|
|
|
5c9578 |
50 - user/group access rules
|
|
|
5c9578 |
60 - application access rules
|
|
|
5c9578 |
@@ -25,9 +25,9 @@ You can reconstruct the old policy files by including the following:
|
|
|
5c9578 |
fapolicyd.rules.known-libs
|
|
|
5c9578 |
--------------------------
|
|
|
5c9578 |
10-languages.rules
|
|
|
5c9578 |
-20-patterns.rules
|
|
|
5c9578 |
-30-dracut.rules
|
|
|
5c9578 |
-30-updaters.rules
|
|
|
5c9578 |
+20-dracut.rules
|
|
|
5c9578 |
+21-updaters.rules
|
|
|
5c9578 |
+30-patterns.rules
|
|
|
5c9578 |
40-bad-elf.rules
|
|
|
5c9578 |
41-shared-obj.rules
|
|
|
5c9578 |
42-trusted-elf.rules
|
|
|
5c9578 |
@@ -39,9 +39,9 @@ fapolicyd.rules.known-libs
|
|
|
5c9578 |
fapolicyd.rules.restrictive
|
|
|
5c9578 |
---------------------------
|
|
|
5c9578 |
10-languages.rules
|
|
|
5c9578 |
-20-patterns.rules
|
|
|
5c9578 |
-30-dracut.rules
|
|
|
5c9578 |
-30-updaters.rules
|
|
|
5c9578 |
+20-dracut.rules
|
|
|
5c9578 |
+21-updaters.rules
|
|
|
5c9578 |
+30-patterns.rules
|
|
|
5c9578 |
40-bad-elf.rules
|
|
|
5c9578 |
41-shared-obj.rules
|
|
|
5c9578 |
43-known-elf.rules
|
|
|
5c9578 |
--
|
|
|
5c9578 |
2.35.1
|