From 1ba0a986f6f7a8c6960a1643878498c68659573b Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Aug 18 2015 08:39:06 +0000 Subject: * Tue Aug 18 2015 Lukas Vrabec 3.13.1-142 - Allow samba_net_t to manage samba_var_t sock files. - Allow httpd daemon to manage httpd_var_lib_t lnk_files. - Allow collectd stream connect to pdns.(BZ #1191044) - Add interface pdns_stream_connect() - Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib - Allow chronyd exec systemctl - Merge pull request #30 from vmojzis/rawhide-contrib - Hsqldb policy upgrade -Allow sock_file management - Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t. - Hsqldb policy upgrade. -Disallow hsqldb_tmp_t link_file management - Hsqldb policy upgrade: -Remove tmp link_file transition -Add policy summary -Remove redundant parameter for "hsqldb_admin" interface - Label /var/run/chrony-helper dir as chronyd_var_run_t. - Allow lldpad_t to getattr tmpfs_t. Label /dev/shm/lldpad.* as lldapd_tmpfs_t - Fix label on /var/tmp/kiprop_0 - Add mountpoint dontaudit access check in rhsmcertd policy. - Allow pcp_domain to manage pcp_var_lib_t lnk_files. - Allow chronyd to execute mkdir command. - Allow chronyd_t to read dhcpc state. - Label /usr/libexec/chrony-helper as chronyd_exec_t - Allow openhpid liboa_soap plugin to read resolv.conf file. - Allow openhpid liboa_soap plugin to read generic certs. - Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device) - Allow logrotate to reload services. - Allow apcupsd_t to read /sys/devices - Allow kpropd to connect to kropd tcp port. - Allow systemd_networkd to send logs to syslog. - Added interface fs_dontaudit_write_configfs_dirs - Allow audisp client to read system state. - Label /var/run/xtables.lock as iptables_var_run_t. - Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde - Add interface to read/write watchdog device. - Add transition rule for iptables_var_lib_t --- diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index 619e58c..bd4d1a9 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -14499,7 +14499,7 @@ index d7c11a0..6b3331d 100644 /var/run/shm/.* <> -') diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if -index 8416beb..cd82082 100644 +index 8416beb..f1378d6 100644 --- a/policy/modules/kernel/filesystem.if +++ b/policy/modules/kernel/filesystem.if @@ -631,6 +631,27 @@ interface(`fs_getattr_cgroup',` @@ -14737,7 +14737,7 @@ index 8416beb..cd82082 100644 ') ######################################## -@@ -1542,6 +1666,44 @@ interface(`fs_cifs_domtrans',` +@@ -1542,6 +1666,63 @@ interface(`fs_cifs_domtrans',` domain_auto_transition_pattern($1, cifs_t, $2) ') @@ -14779,10 +14779,29 @@ index 8416beb..cd82082 100644 + allow $1 cifs_t:file entrypoint; +') + ++####################################### ++## ++## dontaudit write dirs ++## on a configfs filesystem. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`fs_dontaudit_write_configfs_dirs',` ++ gen_require(` ++ type configfs_t; ++ ') ++ ++ dontaudit $1 configfs_t:dir write; ++') ++ ####################################### ## ## Create, read, write, and delete dirs -@@ -1582,6 +1744,24 @@ interface(`fs_manage_configfs_files',` +@@ -1582,6 +1763,24 @@ interface(`fs_manage_configfs_files',` ######################################## ## @@ -14807,7 +14826,7 @@ index 8416beb..cd82082 100644 ## Mount a DOS filesystem, such as ## FAT32 or NTFS. ## -@@ -1793,63 +1973,70 @@ interface(`fs_read_eventpollfs',` +@@ -1793,63 +1992,70 @@ interface(`fs_read_eventpollfs',` refpolicywarn(`$0($*) has been deprecated.') ') @@ -14903,7 +14922,7 @@ index 8416beb..cd82082 100644 ## on a FUSEFS filesystem. ## ## -@@ -1859,18 +2046,19 @@ interface(`fs_mounton_fusefs',` +@@ -1859,18 +2065,19 @@ interface(`fs_mounton_fusefs',` ## ## # @@ -14928,7 +14947,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -1878,135 +2066,151 @@ interface(`fs_search_fusefs',` +@@ -1878,135 +2085,151 @@ interface(`fs_search_fusefs',` ## ## # @@ -15123,7 +15142,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -2014,19 +2218,440 @@ interface(`fs_dontaudit_manage_fusefs_files',` +@@ -2014,145 +2237,194 @@ interface(`fs_dontaudit_manage_fusefs_files',` ## ## # @@ -15144,24 +15163,28 @@ index 8416beb..cd82082 100644 -## filesystem. +## Search directories +## on a FUSEFS filesystem. -+## -+## -+## -+## Domain allowed access. -+## -+## + ## + ## + ## + ## Domain allowed access. + ## + ## +## -+# + # +-interface(`fs_getattr_hugetlbfs',` +interface(`fs_search_fusefs',` -+ gen_require(` + gen_require(` +- type hugetlbfs_t; + type fusefs_t; -+ ') -+ + ') + +- allow $1 hugetlbfs_t:filesystem getattr; + allow $1 fusefs_t:dir search_dir_perms; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## List hugetlbfs. +## Do not audit attempts to list the contents +## of directories on a FUSEFS filesystem. +## @@ -15183,24 +15206,28 @@ index 8416beb..cd82082 100644 +## +## Create, read, write, and delete directories +## on a FUSEFS filesystem. -+## -+## -+## -+## Domain allowed access. -+## -+## + ## + ## + ## + ## Domain allowed access. + ## + ## +## -+# + # +-interface(`fs_list_hugetlbfs',` +interface(`fs_manage_fusefs_dirs',` -+ gen_require(` + gen_require(` +- type hugetlbfs_t; + type fusefs_t; -+ ') -+ + ') + +- allow $1 hugetlbfs_t:dir list_dir_perms; + allow $1 fusefs_t:dir manage_dir_perms; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Manage hugetlbfs dirs. +## Do not audit attempts to create, read, +## write, and delete directories +## on a FUSEFS filesystem. @@ -15222,128 +15249,157 @@ index 8416beb..cd82082 100644 +######################################## +## +## Read, a FUSEFS filesystem. -+## -+## -+## -+## Domain allowed access. -+## -+## + ## + ## + ## + ## Domain allowed access. + ## + ## +## -+# + # +-interface(`fs_manage_hugetlbfs_dirs',` +interface(`fs_read_fusefs_files',` -+ gen_require(` + gen_require(` +- type hugetlbfs_t; + type fusefs_t; -+ ') -+ + ') + +- manage_dirs_pattern($1, hugetlbfs_t, hugetlbfs_t) + read_files_pattern($1, fusefs_t, fusefs_t) -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Read and write hugetlbfs files. +## Execute files on a FUSEFS filesystem. -+## -+## -+## -+## Domain allowed access. -+## -+## + ## + ## + ## + ## Domain allowed access. + ## + ## +## -+# + # +-interface(`fs_rw_hugetlbfs_files',` +interface(`fs_exec_fusefs_files',` -+ gen_require(` + gen_require(` +- type hugetlbfs_t; + type fusefs_t; -+ ') -+ + ') + +- rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t) + exec_files_pattern($1, fusefs_t, fusefs_t) -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Allow the type to associate to hugetlbfs filesystems. +## Make general progams in FUSEFS an entrypoint for +## the specified domain. -+## + ## +-## +## -+## + ## +-## The type of the object to be associated. +## The domain for which fusefs_t is an entrypoint. -+## -+## -+# + ## + ## + # +-interface(`fs_associate_hugetlbfs',` +interface(`fs_fusefs_entry_type',` -+ gen_require(` + gen_require(` +- type hugetlbfs_t; + type fusefs_t; -+ ') -+ + ') + +- allow $1 hugetlbfs_t:filesystem associate; + domain_entry_file($1, fusefs_t) -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Search inotifyfs filesystem. +## Make general progams in FUSEFS an entrypoint for +## the specified domain. -+## -+## -+## + ## + ## + ## +-## Domain allowed access. +## The domain for which fusefs_t is an entrypoint. -+## -+## -+# + ## + ## + # +-interface(`fs_search_inotifyfs',` +interface(`fs_fusefs_entrypoint',` -+ gen_require(` + gen_require(` +- type inotifyfs_t; + type fusefs_t; -+ ') -+ + ') + +- allow $1 inotifyfs_t:dir search_dir_perms; + allow $1 fusefs_t:file entrypoint; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## List inotifyfs filesystem. +## Create, read, write, and delete files +## on a FUSEFS filesystem. -+## -+## -+## -+## Domain allowed access. -+## -+## + ## + ## + ## + ## Domain allowed access. + ## + ## +## -+# + # +-interface(`fs_list_inotifyfs',` +interface(`fs_manage_fusefs_files',` -+ gen_require(` + gen_require(` +- type inotifyfs_t; + type fusefs_t; -+ ') -+ + ') + +- allow $1 inotifyfs_t:dir list_dir_perms; + manage_files_pattern($1, fusefs_t, fusefs_t) -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Dontaudit List inotifyfs filesystem. +## Do not audit attempts to create, +## read, write, and delete files +## on a FUSEFS filesystem. -+## -+## -+## -+## Domain to not audit. -+## -+## -+# + ## + ## + ## +@@ -2160,53 +2432,626 @@ interface(`fs_list_inotifyfs',` + ## + ## + # +-interface(`fs_dontaudit_list_inotifyfs',` +interface(`fs_dontaudit_manage_fusefs_files',` -+ gen_require(` + gen_require(` +- type inotifyfs_t; + type fusefs_t; -+ ') -+ + ') + +- dontaudit $1 inotifyfs_t:dir list_dir_perms; + dontaudit $1 fusefs_t:file manage_file_perms; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Create an object in a hugetlbfs filesystem, with a private +-## type using a type transition. +## Read symbolic links on a FUSEFS filesystem. -+## -+## -+## -+## Domain allowed access. -+## -+## + ## + ## + ## + ## Domain allowed access. + ## + ## +-## +# +interface(`fs_read_fusefs_symlinks',` + gen_require(` @@ -15359,10 +15415,12 @@ index 8416beb..cd82082 100644 +## Manage symbolic links on a FUSEFS filesystem. +## +## -+## + ## +-## The type of the object to be created. +## Domain allowed access. -+## -+## + ## + ## +-## +# +interface(`fs_manage_fusefs_symlinks',` + gen_require(` @@ -15397,12 +15455,15 @@ index 8416beb..cd82082 100644 +##

+## +## -+## + ## +-## The object class of the object being created. +## Domain allowed to transition. -+## -+## + ## + ## +-## +## -+## + ## +-## The name of the object being created. +## The type of the new process. +## +## @@ -15566,50 +15627,42 @@ index 8416beb..cd82082 100644 +######################################## +## +## Search inotifyfs filesystem. - ## - ## - ## -@@ -2034,17 +2659,17 @@ interface(`fs_read_fusefs_symlinks',` - ## - ## - # --interface(`fs_getattr_hugetlbfs',` ++## ++## ++## ++## Domain allowed access. ++## ++## ++# +interface(`fs_search_inotifyfs',` - gen_require(` -- type hugetlbfs_t; ++ gen_require(` + type inotifyfs_t; - ') - -- allow $1 hugetlbfs_t:filesystem getattr; ++ ') ++ + allow $1 inotifyfs_t:dir search_dir_perms; - ') - - ######################################## - ## --## List hugetlbfs. ++') ++ ++######################################## ++## +## List inotifyfs filesystem. - ## - ## - ## -@@ -2052,35 +2677,72 @@ interface(`fs_getattr_hugetlbfs',` - ## - ## - # --interface(`fs_list_hugetlbfs',` ++## ++## ++## ++## Domain allowed access. ++## ++## ++# +interface(`fs_list_inotifyfs',` - gen_require(` -- type hugetlbfs_t; ++ gen_require(` + type inotifyfs_t; - ') - -- allow $1 hugetlbfs_t:dir list_dir_perms; ++ ') ++ + allow $1 inotifyfs_t:dir list_dir_perms; + fs_read_anon_inodefs_files($1) - ') - - ######################################## - ## --## Manage hugetlbfs dirs. ++') ++ ++######################################## ++## +## Do not audit attempts to list inotifyfs filesystem. +## +## @@ -15630,12 +15683,12 @@ index 8416beb..cd82082 100644 +## +## Create an object in a hugetlbfs filesystem, with a private +## type using a type transition. - ## - ## - ## - ## Domain allowed access. - ## - ## ++## ++## ++## ++## Domain allowed access. ++## ++## +## +## +## The type of the object to be created. @@ -15651,152 +15704,124 @@ index 8416beb..cd82082 100644 +## The name of the object being created. +## +## - # --interface(`fs_manage_hugetlbfs_dirs',` ++# +interface(`fs_hugetlbfs_filetrans',` - gen_require(` - type hugetlbfs_t; - ') - -- manage_dirs_pattern($1, hugetlbfs_t, hugetlbfs_t) ++ gen_require(` ++ type hugetlbfs_t; ++ ') ++ + allow $2 hugetlbfs_t:filesystem associate; + filetrans_pattern($1, hugetlbfs_t, $2, $3, $4) - ') - - ######################################## - ## --## Read and write hugetlbfs files. ++') ++ ++######################################## ++## +## Mount an iso9660 filesystem, which +## is usually used on CDs. - ## - ## - ## -@@ -2088,35 +2750,38 @@ interface(`fs_manage_hugetlbfs_dirs',` - ## - ## - # --interface(`fs_rw_hugetlbfs_files',` ++## ++## ++## ++## Domain allowed access. ++## ++## ++# +interface(`fs_mount_iso9660_fs',` - gen_require(` -- type hugetlbfs_t; ++ gen_require(` + type iso9660_t; - ') - -- rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t) ++ ') ++ + allow $1 iso9660_t:filesystem mount; - ') - - ######################################## - ## --## Allow the type to associate to hugetlbfs filesystems. ++') ++ ++######################################## ++## +## Remount an iso9660 filesystem, which +## is usually used on CDs. This allows +## some mount options to be changed. - ## --## ++## +## - ## --## The type of the object to be associated. ++## +## Domain allowed access. - ## - ## - # --interface(`fs_associate_hugetlbfs',` ++## ++## ++# +interface(`fs_remount_iso9660_fs',` - gen_require(` -- type hugetlbfs_t; ++ gen_require(` + type iso9660_t; - ') - -- allow $1 hugetlbfs_t:filesystem associate; ++ ') ++ + allow $1 iso9660_t:filesystem remount; - ') - - ######################################## - ## --## Search inotifyfs filesystem. ++') ++ ++######################################## ++## +## Unmount an iso9660 filesystem, which +## is usually used on CDs. - ## - ## - ## -@@ -2124,89 +2789,250 @@ interface(`fs_associate_hugetlbfs',` - ## - ## - # --interface(`fs_search_inotifyfs',` ++## ++## ++## ++## Domain allowed access. ++## ++## ++# +interface(`fs_unmount_iso9660_fs',` - gen_require(` -- type inotifyfs_t; ++ gen_require(` + type iso9660_t; - ') - -- allow $1 inotifyfs_t:dir search_dir_perms; ++ ') ++ + allow $1 iso9660_t:filesystem unmount; - ') - - ######################################## - ## --## List inotifyfs filesystem. ++') ++ ++######################################## ++## +## Get the attributes of an iso9660 +## filesystem, which is usually used on CDs. - ## - ## - ## - ## Domain allowed access. - ## - ## ++## ++## ++## ++## Domain allowed access. ++## ++## +## - # --interface(`fs_list_inotifyfs',` ++# +interface(`fs_getattr_iso9660_fs',` - gen_require(` -- type inotifyfs_t; ++ gen_require(` + type iso9660_t; - ') - -- allow $1 inotifyfs_t:dir list_dir_perms; ++ ') ++ + allow $1 iso9660_t:filesystem getattr; - ') - - ######################################## - ## --## Dontaudit List inotifyfs filesystem. ++') ++ ++######################################## ++## +## Read files on an iso9660 filesystem, which +## is usually used on CDs. - ## - ## - ## --## Domain to not audit. ++## ++## ++## +## Domain allowed access. - ## - ## - # --interface(`fs_dontaudit_list_inotifyfs',` ++## ++## ++# +interface(`fs_getattr_iso9660_files',` - gen_require(` -- type inotifyfs_t; ++ gen_require(` + type iso9660_t; - ') - -- dontaudit $1 inotifyfs_t:dir list_dir_perms; ++ ') ++ + allow $1 iso9660_t:dir list_dir_perms; + allow $1 iso9660_t:file getattr; - ') - - ######################################## - ## --## Create an object in a hugetlbfs filesystem, with a private --## type using a type transition. ++') ++ ++######################################## ++## +## Read files on an iso9660 filesystem, which +## is usually used on CDs. - ## - ## - ## - ## Domain allowed access. - ## - ## --## ++## ++## ++## ++## Domain allowed access. ++## ++## +# +interface(`fs_read_iso9660_files',` + gen_require(` @@ -15814,12 +15839,10 @@ index 8416beb..cd82082 100644 +## Mount kdbus filesystems. +## +## - ## --## The type of the object to be created. ++## +## Domain allowed access. - ## - ## --## ++## ++## +# +interface(`fs_mount_kdbus', ` + gen_require(` @@ -15834,12 +15857,10 @@ index 8416beb..cd82082 100644 +## Remount kdbus filesystems. +## +## - ## --## The object class of the object being created. ++## +## Domain allowed access. - ## - ## --## ++## ++## +# +interface(`fs_remount_kdbus', ` + gen_require(` @@ -15854,8 +15875,7 @@ index 8416beb..cd82082 100644 +## Unmount kdbus filesystems. +## +## - ## --## The name of the object being created. ++## +## Domain allowed access. +## +## @@ -15997,7 +16017,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -2214,19 +3040,19 @@ interface(`fs_hugetlbfs_filetrans',` +@@ -2214,19 +3059,19 @@ interface(`fs_hugetlbfs_filetrans',` ## ## # @@ -16024,7 +16044,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -2234,18 +3060,21 @@ interface(`fs_mount_iso9660_fs',` +@@ -2234,18 +3079,21 @@ interface(`fs_mount_iso9660_fs',` ## ## # @@ -16051,7 +16071,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -2253,38 +3082,61 @@ interface(`fs_remount_iso9660_fs',` +@@ -2253,38 +3101,61 @@ interface(`fs_remount_iso9660_fs',` ## ## # @@ -16124,7 +16144,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -2292,19 +3144,21 @@ interface(`fs_getattr_iso9660_fs',` +@@ -2292,19 +3163,21 @@ interface(`fs_getattr_iso9660_fs',` ## ## # @@ -16152,7 +16172,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -2312,16 +3166,15 @@ interface(`fs_getattr_iso9660_files',` +@@ -2312,16 +3185,15 @@ interface(`fs_getattr_iso9660_files',` ## ## # @@ -16173,7 +16193,7 @@ index 8416beb..cd82082 100644 ######################################## ## ## Mount a NFS filesystem. -@@ -2398,6 +3251,24 @@ interface(`fs_getattr_nfs',` +@@ -2398,6 +3270,24 @@ interface(`fs_getattr_nfs',` ######################################## ## @@ -16198,7 +16218,7 @@ index 8416beb..cd82082 100644 ## Search directories on a NFS filesystem. ## ## -@@ -2485,6 +3356,7 @@ interface(`fs_read_nfs_files',` +@@ -2485,6 +3375,7 @@ interface(`fs_read_nfs_files',` type nfs_t; ') @@ -16206,7 +16226,7 @@ index 8416beb..cd82082 100644 allow $1 nfs_t:dir list_dir_perms; read_files_pattern($1, nfs_t, nfs_t) ') -@@ -2523,6 +3395,7 @@ interface(`fs_write_nfs_files',` +@@ -2523,6 +3414,7 @@ interface(`fs_write_nfs_files',` type nfs_t; ') @@ -16214,7 +16234,7 @@ index 8416beb..cd82082 100644 allow $1 nfs_t:dir list_dir_perms; write_files_pattern($1, nfs_t, nfs_t) ') -@@ -2549,6 +3422,44 @@ interface(`fs_exec_nfs_files',` +@@ -2549,6 +3441,44 @@ interface(`fs_exec_nfs_files',` ######################################## ## @@ -16259,7 +16279,7 @@ index 8416beb..cd82082 100644 ## Append files ## on a NFS filesystem. ## -@@ -2569,7 +3480,7 @@ interface(`fs_append_nfs_files',` +@@ -2569,7 +3499,7 @@ interface(`fs_append_nfs_files',` ######################################## ## @@ -16268,7 +16288,7 @@ index 8416beb..cd82082 100644 ## on a NFS filesystem. ## ## -@@ -2589,6 +3500,42 @@ interface(`fs_dontaudit_append_nfs_files',` +@@ -2589,6 +3519,42 @@ interface(`fs_dontaudit_append_nfs_files',` ######################################## ## @@ -16311,7 +16331,7 @@ index 8416beb..cd82082 100644 ## Do not audit attempts to read or ## write files on a NFS filesystem. ## -@@ -2603,7 +3550,7 @@ interface(`fs_dontaudit_rw_nfs_files',` +@@ -2603,7 +3569,7 @@ interface(`fs_dontaudit_rw_nfs_files',` type nfs_t; ') @@ -16320,7 +16340,7 @@ index 8416beb..cd82082 100644 ') ######################################## -@@ -2627,7 +3574,7 @@ interface(`fs_read_nfs_symlinks',` +@@ -2627,7 +3593,7 @@ interface(`fs_read_nfs_symlinks',` ######################################## ## @@ -16329,7 +16349,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -2719,6 +3666,47 @@ interface(`fs_search_rpc',` +@@ -2719,6 +3685,47 @@ interface(`fs_search_rpc',` ######################################## ## @@ -16377,7 +16397,7 @@ index 8416beb..cd82082 100644 ## Search removable storage directories. ## ## -@@ -2741,7 +3729,7 @@ interface(`fs_search_removable',` +@@ -2741,7 +3748,7 @@ interface(`fs_search_removable',` ## ## ## @@ -16386,7 +16406,7 @@ index 8416beb..cd82082 100644 ## ## # -@@ -2777,7 +3765,7 @@ interface(`fs_read_removable_files',` +@@ -2777,7 +3784,7 @@ interface(`fs_read_removable_files',` ## ## ## @@ -16395,7 +16415,7 @@ index 8416beb..cd82082 100644 ## ## # -@@ -2970,6 +3958,7 @@ interface(`fs_manage_nfs_dirs',` +@@ -2970,6 +3977,7 @@ interface(`fs_manage_nfs_dirs',` type nfs_t; ') @@ -16403,7 +16423,7 @@ index 8416beb..cd82082 100644 allow $1 nfs_t:dir manage_dir_perms; ') -@@ -3010,6 +3999,7 @@ interface(`fs_manage_nfs_files',` +@@ -3010,6 +4018,7 @@ interface(`fs_manage_nfs_files',` type nfs_t; ') @@ -16411,7 +16431,7 @@ index 8416beb..cd82082 100644 manage_files_pattern($1, nfs_t, nfs_t) ') -@@ -3050,6 +4040,7 @@ interface(`fs_manage_nfs_symlinks',` +@@ -3050,6 +4059,7 @@ interface(`fs_manage_nfs_symlinks',` type nfs_t; ') @@ -16419,7 +16439,7 @@ index 8416beb..cd82082 100644 manage_lnk_files_pattern($1, nfs_t, nfs_t) ') -@@ -3137,6 +4128,24 @@ interface(`fs_nfs_domtrans',` +@@ -3137,6 +4147,24 @@ interface(`fs_nfs_domtrans',` ######################################## ## @@ -16444,7 +16464,7 @@ index 8416beb..cd82082 100644 ## Mount a NFS server pseudo filesystem. ## ## -@@ -3263,6 +4272,24 @@ interface(`fs_getattr_nfsd_files',` +@@ -3263,6 +4291,24 @@ interface(`fs_getattr_nfsd_files',` getattr_files_pattern($1, nfsd_fs_t, nfsd_fs_t) ') @@ -16469,7 +16489,7 @@ index 8416beb..cd82082 100644 ######################################## ## ## Read and write NFS server files. -@@ -3283,6 +4310,24 @@ interface(`fs_rw_nfsd_fs',` +@@ -3283,6 +4329,24 @@ interface(`fs_rw_nfsd_fs',` ######################################## ## @@ -16494,7 +16514,7 @@ index 8416beb..cd82082 100644 ## Allow the type to associate to ramfs filesystems. ## ## -@@ -3392,7 +4437,7 @@ interface(`fs_search_ramfs',` +@@ -3392,7 +4456,7 @@ interface(`fs_search_ramfs',` ######################################## ## @@ -16503,7 +16523,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -3429,7 +4474,7 @@ interface(`fs_manage_ramfs_dirs',` +@@ -3429,7 +4493,7 @@ interface(`fs_manage_ramfs_dirs',` ######################################## ## @@ -16512,7 +16532,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -3447,7 +4492,7 @@ interface(`fs_dontaudit_read_ramfs_files',` +@@ -3447,7 +4511,7 @@ interface(`fs_dontaudit_read_ramfs_files',` ######################################## ## @@ -16521,7 +16541,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -3743,25 +4788,61 @@ interface(`fs_getattr_rpc_pipefs',` +@@ -3743,25 +4807,61 @@ interface(`fs_getattr_rpc_pipefs',` ######################################### ## @@ -16589,7 +16609,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -3769,17 +4850,17 @@ interface(`fs_rw_rpc_named_pipes',` +@@ -3769,17 +4869,17 @@ interface(`fs_rw_rpc_named_pipes',` ## ## # @@ -16610,7 +16630,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -3787,17 +4868,17 @@ interface(`fs_mount_tmpfs',` +@@ -3787,17 +4887,17 @@ interface(`fs_mount_tmpfs',` ## ## # @@ -16631,7 +16651,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -3805,12 +4886,12 @@ interface(`fs_remount_tmpfs',` +@@ -3805,12 +4905,12 @@ interface(`fs_remount_tmpfs',` ## ## # @@ -16646,7 +16666,7 @@ index 8416beb..cd82082 100644 ') ######################################## -@@ -3908,7 +4989,7 @@ interface(`fs_dontaudit_getattr_tmpfs_dirs',` +@@ -3908,7 +5008,7 @@ interface(`fs_dontaudit_getattr_tmpfs_dirs',` ######################################## ## @@ -16655,7 +16675,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -3916,17 +4997,17 @@ interface(`fs_dontaudit_getattr_tmpfs_dirs',` +@@ -3916,17 +5016,17 @@ interface(`fs_dontaudit_getattr_tmpfs_dirs',` ## ## # @@ -16676,7 +16696,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -3934,17 +5015,17 @@ interface(`fs_mounton_tmpfs',` +@@ -3934,17 +5034,17 @@ interface(`fs_mounton_tmpfs',` ## ## # @@ -16697,7 +16717,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -3952,17 +5033,36 @@ interface(`fs_setattr_tmpfs_dirs',` +@@ -3952,17 +5052,36 @@ interface(`fs_setattr_tmpfs_dirs',` ## ## # @@ -16737,7 +16757,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -3970,31 +5070,48 @@ interface(`fs_search_tmpfs',` +@@ -3970,31 +5089,48 @@ interface(`fs_search_tmpfs',` ## ## # @@ -16793,7 +16813,7 @@ index 8416beb..cd82082 100644 ') ######################################## -@@ -4105,7 +5222,7 @@ interface(`fs_dontaudit_rw_tmpfs_files',` +@@ -4105,7 +5241,7 @@ interface(`fs_dontaudit_rw_tmpfs_files',` type tmpfs_t; ') @@ -16802,7 +16822,7 @@ index 8416beb..cd82082 100644 ') ######################################## -@@ -4165,6 +5282,24 @@ interface(`fs_rw_tmpfs_files',` +@@ -4165,6 +5301,24 @@ interface(`fs_rw_tmpfs_files',` ######################################## ## @@ -16827,7 +16847,7 @@ index 8416beb..cd82082 100644 ## Read tmpfs link files. ## ## -@@ -4202,7 +5337,7 @@ interface(`fs_rw_tmpfs_chr_files',` +@@ -4202,7 +5356,7 @@ interface(`fs_rw_tmpfs_chr_files',` ######################################## ## @@ -16836,7 +16856,7 @@ index 8416beb..cd82082 100644 ## ## ## -@@ -4221,6 +5356,60 @@ interface(`fs_dontaudit_use_tmpfs_chr_dev',` +@@ -4221,6 +5375,60 @@ interface(`fs_dontaudit_use_tmpfs_chr_dev',` ######################################## ## @@ -16897,7 +16917,7 @@ index 8416beb..cd82082 100644 ## Relabel character nodes on tmpfs filesystems. ## ## -@@ -4278,6 +5467,44 @@ interface(`fs_relabel_tmpfs_blk_file',` +@@ -4278,6 +5486,44 @@ interface(`fs_relabel_tmpfs_blk_file',` ######################################## ## @@ -16942,7 +16962,7 @@ index 8416beb..cd82082 100644 ## Read and write, create and delete generic ## files on tmpfs filesystems. ## -@@ -4297,6 +5524,25 @@ interface(`fs_manage_tmpfs_files',` +@@ -4297,6 +5543,25 @@ interface(`fs_manage_tmpfs_files',` ######################################## ## @@ -16968,7 +16988,7 @@ index 8416beb..cd82082 100644 ## Read and write, create and delete symbolic ## links on tmpfs filesystems. ## -@@ -4503,6 +5749,8 @@ interface(`fs_mount_all_fs',` +@@ -4503,6 +5768,8 @@ interface(`fs_mount_all_fs',` ') allow $1 filesystem_type:filesystem mount; @@ -16977,7 +16997,7 @@ index 8416beb..cd82082 100644 ') ######################################## -@@ -4549,7 +5797,7 @@ interface(`fs_unmount_all_fs',` +@@ -4549,7 +5816,7 @@ interface(`fs_unmount_all_fs',` ## ##

## Allow the specified domain to @@ -16986,7 +17006,7 @@ index 8416beb..cd82082 100644 ## Example attributes: ##

##
    -@@ -4596,6 +5844,26 @@ interface(`fs_dontaudit_getattr_all_fs',` +@@ -4596,6 +5863,26 @@ interface(`fs_dontaudit_getattr_all_fs',` ######################################## ## @@ -17013,7 +17033,7 @@ index 8416beb..cd82082 100644 ## Get the quotas of all filesystems. ## ## -@@ -4671,6 +5939,25 @@ interface(`fs_getattr_all_dirs',` +@@ -4671,6 +5958,25 @@ interface(`fs_getattr_all_dirs',` ######################################## ## @@ -17039,7 +17059,7 @@ index 8416beb..cd82082 100644 ## Search all directories with a filesystem type. ## ## -@@ -4912,3 +6199,43 @@ interface(`fs_unconfined',` +@@ -4912,3 +6218,43 @@ interface(`fs_unconfined',` typeattribute $1 filesystem_unconfined_type; ') @@ -34685,10 +34705,10 @@ index 312cd04..dd6638a 100644 +userdom_use_inherited_user_terminals(setkey_t) +userdom_read_user_tmp_files(setkey_t) diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc -index 73a1c4e..51548c7 100644 +index 73a1c4e..ec4c7c7 100644 --- a/policy/modules/system/iptables.fc +++ b/policy/modules/system/iptables.fc -@@ -1,22 +1,41 @@ +@@ -1,22 +1,43 @@ /etc/rc\.d/init\.d/ip6?tables -- gen_context(system_u:object_r:iptables_initrc_exec_t,s0) -/etc/rc\.d/init\.d/ebtables -- gen_context(system_u:object_r:iptables_initrc_exec_t,s0) -/etc/sysconfig/ip6?tables.* -- gen_context(system_u:object_r:iptables_conf_t,s0) @@ -34746,6 +34766,8 @@ index 73a1c4e..51548c7 100644 +/usr/sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0) + +/var/lib/ebtables(/.*)? gen_context(system_u:object_r:iptables_var_lib_t,s0) ++ ++/var/run/xtables.* -- gen_context(system_u:object_r:iptables_var_run_t,s0) diff --git a/policy/modules/system/iptables.if b/policy/modules/system/iptables.if index c42fbc3..277fe6c 100644 --- a/policy/modules/system/iptables.if @@ -36538,7 +36560,7 @@ index 4e94884..7ab6191 100644 + filetrans_pattern($1, syslogd_var_run_t, $2, $3, $4) +') diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te -index 59b04c1..5ac28ce 100644 +index 59b04c1..e1ec2e8 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -4,6 +4,29 @@ policy_module(logging, 1.20.1) @@ -36717,15 +36739,19 @@ index 59b04c1..5ac28ce 100644 ') ######################################## -@@ -268,7 +314,6 @@ files_spool_filetrans(audisp_remote_t, audit_spool_t, { dir file }) +@@ -266,9 +312,10 @@ manage_dirs_pattern(audisp_remote_t, audit_spool_t, audit_spool_t) + manage_files_pattern(audisp_remote_t, audit_spool_t, audit_spool_t) + files_spool_filetrans(audisp_remote_t, audit_spool_t, { dir file }) ++kernel_read_system_state(audisp_remote_t) ++ corecmd_exec_bin(audisp_remote_t) -corenet_all_recvfrom_unlabeled(audisp_remote_t) corenet_all_recvfrom_netlabel(audisp_remote_t) corenet_tcp_sendrecv_generic_if(audisp_remote_t) corenet_tcp_sendrecv_generic_node(audisp_remote_t) -@@ -280,13 +325,27 @@ corenet_sendrecv_audit_client_packets(audisp_remote_t) +@@ -280,13 +327,26 @@ corenet_sendrecv_audit_client_packets(audisp_remote_t) files_read_etc_files(audisp_remote_t) @@ -36738,7 +36764,6 @@ index 59b04c1..5ac28ce 100644 +auth_use_nsswitch(audisp_remote_t) +auth_append_login_records(audisp_remote_t) + -+ +init_telinit(audisp_remote_t) +init_read_utmp(audisp_remote_t) +init_dontaudit_write_utmp(audisp_remote_t) @@ -36754,7 +36779,7 @@ index 59b04c1..5ac28ce 100644 ######################################## # # klogd local policy -@@ -326,7 +385,6 @@ files_read_etc_files(klogd_t) +@@ -326,7 +386,6 @@ files_read_etc_files(klogd_t) logging_send_syslog_msg(klogd_t) @@ -36762,7 +36787,7 @@ index 59b04c1..5ac28ce 100644 mls_file_read_all_levels(klogd_t) -@@ -355,13 +413,12 @@ optional_policy(` +@@ -355,13 +414,12 @@ optional_policy(` # sys_admin for the integrated klog of syslog-ng and metalog # sys_nice for rsyslog # cjp: why net_admin! @@ -36779,7 +36804,7 @@ index 59b04c1..5ac28ce 100644 # receive messages to be logged allow syslogd_t self:unix_dgram_socket create_socket_perms; allow syslogd_t self:unix_stream_socket create_stream_socket_perms; -@@ -369,11 +426,15 @@ allow syslogd_t self:unix_dgram_socket sendto; +@@ -369,11 +427,15 @@ allow syslogd_t self:unix_dgram_socket sendto; allow syslogd_t self:fifo_file rw_fifo_file_perms; allow syslogd_t self:udp_socket create_socket_perms; allow syslogd_t self:tcp_socket create_stream_socket_perms; @@ -36796,7 +36821,7 @@ index 59b04c1..5ac28ce 100644 files_pid_filetrans(syslogd_t, devlog_t, sock_file) # create/append log files. -@@ -389,30 +450,47 @@ manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t) +@@ -389,30 +451,47 @@ manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t) manage_files_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t) files_tmp_filetrans(syslogd_t, syslogd_tmp_t, { dir file }) @@ -36847,7 +36872,7 @@ index 59b04c1..5ac28ce 100644 # syslog-ng can listen and connect on tcp port 514 (rsh) corenet_tcp_sendrecv_generic_if(syslogd_t) corenet_tcp_sendrecv_generic_node(syslogd_t) -@@ -422,6 +500,8 @@ corenet_tcp_bind_rsh_port(syslogd_t) +@@ -422,6 +501,8 @@ corenet_tcp_bind_rsh_port(syslogd_t) corenet_tcp_connect_rsh_port(syslogd_t) # Allow users to define additional syslog ports to connect to corenet_tcp_bind_syslogd_port(syslogd_t) @@ -36856,7 +36881,7 @@ index 59b04c1..5ac28ce 100644 corenet_tcp_connect_syslogd_port(syslogd_t) corenet_tcp_connect_postgresql_port(syslogd_t) corenet_tcp_connect_mysqld_port(syslogd_t) -@@ -432,9 +512,32 @@ corenet_sendrecv_syslogd_server_packets(syslogd_t) +@@ -432,9 +513,32 @@ corenet_sendrecv_syslogd_server_packets(syslogd_t) corenet_sendrecv_postgresql_client_packets(syslogd_t) corenet_sendrecv_mysqld_client_packets(syslogd_t) @@ -36890,7 +36915,7 @@ index 59b04c1..5ac28ce 100644 domain_use_interactive_fds(syslogd_t) files_read_etc_files(syslogd_t) -@@ -448,13 +551,17 @@ files_var_lib_filetrans(syslogd_t, syslogd_var_lib_t, { file dir }) +@@ -448,13 +552,17 @@ files_var_lib_filetrans(syslogd_t, syslogd_var_lib_t, { file dir }) fs_getattr_all_fs(syslogd_t) fs_search_auto_mountpoints(syslogd_t) @@ -36908,7 +36933,7 @@ index 59b04c1..5ac28ce 100644 # for sending messages to logged in users init_read_utmp(syslogd_t) init_dontaudit_write_utmp(syslogd_t) -@@ -466,11 +573,12 @@ init_use_fds(syslogd_t) +@@ -466,11 +574,12 @@ init_use_fds(syslogd_t) # cjp: this doesnt make sense logging_send_syslog_msg(syslogd_t) @@ -36924,7 +36949,7 @@ index 59b04c1..5ac28ce 100644 ifdef(`distro_gentoo',` # default gentoo syslog-ng config appends kernel -@@ -497,6 +605,7 @@ optional_policy(` +@@ -497,6 +606,7 @@ optional_policy(` optional_policy(` cron_manage_log_files(syslogd_t) cron_generic_log_filetrans_log(syslogd_t, file, "cron.log") @@ -36932,7 +36957,7 @@ index 59b04c1..5ac28ce 100644 ') optional_policy(` -@@ -507,15 +616,40 @@ optional_policy(` +@@ -507,15 +617,40 @@ optional_policy(` ') optional_policy(` @@ -36973,7 +36998,7 @@ index 59b04c1..5ac28ce 100644 ') optional_policy(` -@@ -526,3 +660,26 @@ optional_policy(` +@@ -526,3 +661,26 @@ optional_policy(` # log to the xconsole xserver_rw_console(syslogd_t) ') @@ -43649,10 +43674,10 @@ index 0000000..cde0261 +') diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te new file mode 100644 -index 0000000..ea27f86 +index 0000000..11cbcf8 --- /dev/null +++ b/policy/modules/system/systemd.te -@@ -0,0 +1,721 @@ +@@ -0,0 +1,723 @@ +policy_module(systemd, 1.0.0) + +####################################### @@ -43924,6 +43949,8 @@ index 0000000..ea27f86 + +auth_use_nsswitch(systemd_networkd_t) + ++logging_send_syslog_msg(systemd_networkd_t) ++ +sysnet_manage_config(systemd_networkd_t) +sysnet_manage_config_dirs(systemd_networkd_t) + diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index 1fd3df8..b1f2938 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -5209,7 +5209,7 @@ index f6eb485..164501c 100644 + filetrans_pattern($1, { httpd_user_content_t httpd_user_script_exec_t }, httpd_user_htaccess_t, file, ".htaccess") ') diff --git a/apache.te b/apache.te -index 6649962..d007ab0 100644 +index 6649962..7abf562 100644 --- a/apache.te +++ b/apache.te @@ -5,280 +5,346 @@ policy_module(apache, 2.7.2) @@ -5919,7 +5919,15 @@ index 6649962..d007ab0 100644 allow httpd_t httpd_sys_script_t:unix_stream_socket connectto; -@@ -450,140 +574,174 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) +@@ -438,6 +562,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi + + manage_dirs_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) + manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) ++manage_lnk_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) + files_var_lib_filetrans(httpd_t, httpd_var_lib_t, { dir file }) + + setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) +@@ -450,140 +575,174 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) manage_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) @@ -6159,7 +6167,7 @@ index 6649962..d007ab0 100644 ') tunable_policy(`httpd_enable_cgi && httpd_use_nfs',` -@@ -594,28 +752,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',` +@@ -594,28 +753,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',` fs_cifs_domtrans(httpd_t, httpd_sys_script_t) ') @@ -6219,7 +6227,7 @@ index 6649962..d007ab0 100644 ') tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` -@@ -624,68 +804,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` +@@ -624,68 +805,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` fs_read_nfs_symlinks(httpd_t) ') @@ -6322,7 +6330,7 @@ index 6649962..d007ab0 100644 ') tunable_policy(`httpd_setrlimit',` -@@ -695,49 +863,48 @@ tunable_policy(`httpd_setrlimit',` +@@ -695,49 +864,48 @@ tunable_policy(`httpd_setrlimit',` tunable_policy(`httpd_ssi_exec',` corecmd_shell_domtrans(httpd_t, httpd_sys_script_t) @@ -6403,7 +6411,7 @@ index 6649962..d007ab0 100644 ') optional_policy(` -@@ -749,24 +916,32 @@ optional_policy(` +@@ -749,24 +917,32 @@ optional_policy(` ') optional_policy(` @@ -6442,7 +6450,7 @@ index 6649962..d007ab0 100644 ') optional_policy(` -@@ -775,6 +950,10 @@ optional_policy(` +@@ -775,6 +951,10 @@ optional_policy(` tunable_policy(`httpd_dbus_avahi',` avahi_dbus_chat(httpd_t) ') @@ -6453,7 +6461,7 @@ index 6649962..d007ab0 100644 ') optional_policy(` -@@ -786,35 +965,60 @@ optional_policy(` +@@ -786,35 +966,60 @@ optional_policy(` ') optional_policy(` @@ -6527,7 +6535,7 @@ index 6649962..d007ab0 100644 tunable_policy(`httpd_manage_ipa',` memcached_manage_pid_files(httpd_t) -@@ -822,8 +1026,30 @@ optional_policy(` +@@ -822,8 +1027,30 @@ optional_policy(` ') optional_policy(` @@ -6558,7 +6566,7 @@ index 6649962..d007ab0 100644 tunable_policy(`httpd_can_network_connect_db',` mysql_tcp_connect(httpd_t) -@@ -832,6 +1058,8 @@ optional_policy(` +@@ -832,6 +1059,8 @@ optional_policy(` optional_policy(` nagios_read_config(httpd_t) @@ -6567,7 +6575,7 @@ index 6649962..d007ab0 100644 ') optional_policy(` -@@ -842,20 +1070,40 @@ optional_policy(` +@@ -842,20 +1071,40 @@ optional_policy(` ') optional_policy(` @@ -6614,7 +6622,7 @@ index 6649962..d007ab0 100644 ') optional_policy(` -@@ -863,16 +1111,31 @@ optional_policy(` +@@ -863,16 +1112,31 @@ optional_policy(` ') optional_policy(` @@ -6648,7 +6656,7 @@ index 6649962..d007ab0 100644 ') optional_policy(` -@@ -883,65 +1146,189 @@ optional_policy(` +@@ -883,65 +1147,189 @@ optional_policy(` yam_read_content(httpd_t) ') @@ -6860,7 +6868,7 @@ index 6649962..d007ab0 100644 files_dontaudit_search_pids(httpd_suexec_t) files_search_home(httpd_suexec_t) -@@ -950,123 +1337,75 @@ auth_use_nsswitch(httpd_suexec_t) +@@ -950,123 +1338,75 @@ auth_use_nsswitch(httpd_suexec_t) logging_search_logs(httpd_suexec_t) logging_send_syslog_msg(httpd_suexec_t) @@ -7014,7 +7022,7 @@ index 6649962..d007ab0 100644 mysql_read_config(httpd_suexec_t) tunable_policy(`httpd_can_network_connect_db',` -@@ -1083,172 +1422,107 @@ optional_policy(` +@@ -1083,172 +1423,107 @@ optional_policy(` ') ') @@ -7252,7 +7260,7 @@ index 6649962..d007ab0 100644 ') tunable_policy(`httpd_read_user_content',` -@@ -1256,64 +1530,74 @@ tunable_policy(`httpd_read_user_content',` +@@ -1256,64 +1531,74 @@ tunable_policy(`httpd_read_user_content',` ') tunable_policy(`httpd_use_cifs',` @@ -7349,7 +7357,7 @@ index 6649962..d007ab0 100644 ######################################## # -@@ -1321,8 +1605,15 @@ miscfiles_read_localization(httpd_rotatelogs_t) +@@ -1321,8 +1606,15 @@ miscfiles_read_localization(httpd_rotatelogs_t) # optional_policy(` @@ -7366,7 +7374,7 @@ index 6649962..d007ab0 100644 ') ######################################## -@@ -1330,49 +1621,38 @@ optional_policy(` +@@ -1330,49 +1622,38 @@ optional_policy(` # User content local policy # @@ -7431,7 +7439,7 @@ index 6649962..d007ab0 100644 kernel_read_system_state(httpd_passwd_t) corecmd_exec_bin(httpd_passwd_t) -@@ -1382,38 +1662,109 @@ dev_read_urand(httpd_passwd_t) +@@ -1382,38 +1663,109 @@ dev_read_urand(httpd_passwd_t) domain_use_interactive_fds(httpd_passwd_t) @@ -12740,10 +12748,10 @@ index 0000000..5955ff0 + gnome_dontaudit_write_config_files(chrome_sandbox_nacl_t) +') diff --git a/chronyd.fc b/chronyd.fc -index 4e4143e..e20f1b4 100644 +index 4e4143e..16d23e1 100644 --- a/chronyd.fc +++ b/chronyd.fc -@@ -1,8 +1,11 @@ +@@ -1,13 +1,17 @@ -/etc/chrony\.keys -- gen_context(system_u:object_r:chronyd_keys_t,s0) +/etc/chrony\.keys.* -- gen_context(system_u:object_r:chronyd_keys_t,s0) @@ -12756,11 +12764,42 @@ index 4e4143e..e20f1b4 100644 /var/lib/chrony(/.*)? gen_context(system_u:object_r:chronyd_var_lib_t,s0) + /var/log/chrony(/.*)? gen_context(system_u:object_r:chronyd_var_log_t,s0) + + /var/run/chronyd(/.*) gen_context(system_u:object_r:chronyd_var_run_t,s0) ++/var/run/chrony-helper(/.*) gen_context(system_u:object_r:chronyd_var_run_t,s0) + /var/run/chronyd\.pid -- gen_context(system_u:object_r:chronyd_var_run_t,s0) + /var/run/chronyd\.sock -s gen_context(system_u:object_r:chronyd_var_run_t,s0) diff --git a/chronyd.if b/chronyd.if -index 32e8265..74fd151 100644 +index 32e8265..c5a2913 100644 --- a/chronyd.if +++ b/chronyd.if -@@ -100,8 +100,7 @@ interface(`chronyd_rw_shm',` +@@ -57,6 +57,24 @@ interface(`chronyd_exec',` + can_exec($1, chronyd_exec_t) + ') + ++######################################## ++## ++## Send generic signals to chronyd. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`chronyd_signal',` ++ gen_require(` ++ type chronyd_t; ++ ') ++ ++ allow $1 chronyd_t:process signal; ++') ++ + ##################################### + ## + ## Read chronyd log files. +@@ -100,8 +118,7 @@ interface(`chronyd_rw_shm',` ######################################## ## @@ -12770,7 +12809,7 @@ index 32e8265..74fd151 100644 ## ## ## -@@ -109,19 +108,17 @@ interface(`chronyd_rw_shm',` +@@ -109,19 +126,17 @@ interface(`chronyd_rw_shm',` ## ## # @@ -12794,7 +12833,7 @@ index 32e8265..74fd151 100644 ## ## ## -@@ -129,18 +126,62 @@ interface(`chronyd_stream_connect',` +@@ -129,18 +144,62 @@ interface(`chronyd_stream_connect',` ## ## # @@ -12860,7 +12899,7 @@ index 32e8265..74fd151 100644 ##
## ## -@@ -148,13 +189,13 @@ interface(`chronyd_dgram_send',` +@@ -148,13 +207,13 @@ interface(`chronyd_dgram_send',` ## ## # @@ -12878,7 +12917,7 @@ index 32e8265..74fd151 100644 ') #################################### -@@ -176,28 +217,38 @@ interface(`chronyd_read_key_files',` +@@ -176,28 +235,38 @@ interface(`chronyd_read_key_files',` # interface(`chronyd_admin',` gen_require(` @@ -12927,7 +12966,7 @@ index 32e8265..74fd151 100644 + allow $1 chronyd_unit_file_t:service all_service_perms; ') diff --git a/chronyd.te b/chronyd.te -index e5b621c..08ecb52 100644 +index e5b621c..337110c 100644 --- a/chronyd.te +++ b/chronyd.te @@ -18,6 +18,9 @@ files_type(chronyd_keys_t) @@ -12958,7 +12997,7 @@ index e5b621c..08ecb52 100644 allow chronyd_t chronyd_keys_t:file read_file_perms; manage_dirs_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t) -@@ -76,18 +83,34 @@ corenet_sendrecv_chronyd_server_packets(chronyd_t) +@@ -76,18 +83,36 @@ corenet_sendrecv_chronyd_server_packets(chronyd_t) corenet_udp_bind_chronyd_port(chronyd_t) corenet_udp_sendrecv_chronyd_port(chronyd_t) @@ -12980,6 +13019,8 @@ index e5b621c..08ecb52 100644 +mta_send_mail(chronyd_t) + +sysnet_read_dhcpc_state(chronyd_t) ++ ++systemd_exec_systemctl(chronyd_t) optional_policy(` gpsd_rw_shm(chronyd_t) @@ -14869,7 +14910,7 @@ index 954309e..6780142 100644 ') + diff --git a/collectd.te b/collectd.te -index 6471fa8..294d8e0 100644 +index 6471fa8..3baa00b 100644 --- a/collectd.te +++ b/collectd.te @@ -26,43 +26,59 @@ files_type(collectd_var_lib_t) @@ -14941,10 +14982,16 @@ index 6471fa8..294d8e0 100644 logging_send_syslog_msg(collectd_t) -@@ -75,16 +91,35 @@ tunable_policy(`collectd_tcp_network_connect',` +@@ -74,17 +90,41 @@ tunable_policy(`collectd_tcp_network_connect',` + corenet_tcp_sendrecv_all_ports(collectd_t) ') - optional_policy(` ++ ++optional_policy(` ++ pdns_stream_connect(collectd_t) ++') ++ ++optional_policy(` + mysql_stream_connect(collectd_t) +') + @@ -14956,7 +15003,7 @@ index 6471fa8..294d8e0 100644 + snmp_read_snmp_var_lib_dirs(collectd_t) +') + -+optional_policy(` + optional_policy(` virt_read_config(collectd_t) + virt_stream_connect(collectd_t) ') @@ -35415,6 +35462,329 @@ index b9e60ec..0477728 100644 userdom_dontaudit_use_unpriv_user_fds(howl_t) userdom_dontaudit_search_user_home_dirs(howl_t) +diff --git a/hsqldb.fc b/hsqldb.fc +new file mode 100644 +index 0000000..aa92d71 +--- /dev/null ++++ b/hsqldb.fc +@@ -0,0 +1,7 @@ ++/usr/lib/hsqldb/hsqldb-post -- gen_context(system_u:object_r:hsqldb_exec_t,s0) ++/usr/lib/hsqldb/hsqldb-stop -- gen_context(system_u:object_r:hsqldb_exec_t,s0) ++/usr/lib/hsqldb/hsqldb-wrapper -- gen_context(system_u:object_r:hsqldb_exec_t,s0) ++ ++/usr/lib/systemd/system/hsqldb.* -- gen_context(system_u:object_r:hsqldb_unit_file_t,s0) ++ ++/var/lib/hsqldb(/.*)? gen_context(system_u:object_r:hsqldb_var_lib_t,s0) +diff --git a/hsqldb.if b/hsqldb.if +new file mode 100644 +index 0000000..f43f748 +--- /dev/null ++++ b/hsqldb.if +@@ -0,0 +1,241 @@ ++ ++## Hsqldb is transactional database engine with in-memory and disk-based tables, supporting embedded and server modes. ++ ++######################################## ++## ++## Execute hsqldb_exec_t in the hsqldb domain. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`hsqldb_domtrans',` ++ gen_require(` ++ type hsqldb_t, hsqldb_exec_t; ++ ') ++ ++ corecmd_search_bin($1) ++ domtrans_pattern($1, hsqldb_exec_t, hsqldb_t) ++') ++ ++###################################### ++## ++## Execute hsqldb in the caller domain. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`hsqldb_exec',` ++ gen_require(` ++ type hsqldb_exec_t; ++ ') ++ ++ corecmd_search_bin($1) ++ can_exec($1, hsqldb_exec_t) ++') ++ ++######################################## ++## ++## Do not audit attempts to read, ++## hsqldb tmp files ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`hsqldb_dontaudit_read_tmp_files',` ++ gen_require(` ++ type hsqldb_tmp_t; ++ ') ++ ++ dontaudit $1 hsqldb_tmp_t:file read_file_perms; ++') ++ ++######################################## ++## ++## Read hsqldb tmp files ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`hsqldb_read_tmp_files',` ++ gen_require(` ++ type hsqldb_tmp_t; ++ ') ++ ++ files_search_tmp($1) ++ read_files_pattern($1, hsqldb_tmp_t, hsqldb_tmp_t) ++') ++ ++######################################## ++## ++## Manage hsqldb tmp files ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`hsqldb_manage_tmp',` ++ gen_require(` ++ type hsqldb_tmp_t; ++ ') ++ ++ files_search_tmp($1) ++ manage_dirs_pattern($1, hsqldb_tmp_t, hsqldb_tmp_t) ++ manage_files_pattern($1, hsqldb_tmp_t, hsqldb_tmp_t) ++ manage_lnk_files_pattern($1, hsqldb_tmp_t, hsqldb_tmp_t) ++') ++ ++######################################## ++## ++## Search hsqldb lib directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`hsqldb_search_lib',` ++ gen_require(` ++ type hsqldb_var_lib_t; ++ ') ++ ++ allow $1 hsqldb_var_lib_t:dir search_dir_perms; ++ files_search_var_lib($1) ++') ++ ++######################################## ++## ++## Read hsqldb lib files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`hsqldb_read_lib_files',` ++ gen_require(` ++ type hsqldb_var_lib_t; ++ ') ++ ++ files_search_var_lib($1) ++ read_files_pattern($1, hsqldb_var_lib_t, hsqldb_var_lib_t) ++') ++ ++######################################## ++## ++## Manage hsqldb lib files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`hsqldb_manage_lib_files',` ++ gen_require(` ++ type hsqldb_var_lib_t; ++ ') ++ ++ files_search_var_lib($1) ++ manage_files_pattern($1, hsqldb_var_lib_t, hsqldb_var_lib_t) ++') ++ ++######################################## ++## ++## Manage hsqldb lib directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`hsqldb_manage_lib_dirs',` ++ gen_require(` ++ type hsqldb_var_lib_t; ++ ') ++ ++ files_search_var_lib($1) ++ manage_dirs_pattern($1, hsqldb_var_lib_t, hsqldb_var_lib_t) ++') ++ ++######################################## ++## ++## Execute hsqldb server in the hsqldb domain. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`hsqldb_systemctl',` ++ gen_require(` ++ type hsqldb_t; ++ type hsqldb_unit_file_t; ++ ') ++ ++ systemd_exec_systemctl($1) ++ systemd_read_fifo_file_passwd_run($1) ++ allow $1 hsqldb_unit_file_t:file read_file_perms; ++ allow $1 hsqldb_unit_file_t:service manage_service_perms; ++ ++ ps_process_pattern($1, hsqldb_t) ++') ++ ++ ++######################################## ++## ++## All of the rules required to administrate ++## an hsqldb environment ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`hsqldb_admin',` ++ gen_require(` ++ type hsqldb_t; ++ type hsqldb_tmp_t; ++ type hsqldb_var_lib_t; ++ type hsqldb_unit_file_t; ++ ') ++ ++ allow $1 hsqldb_t:process { signal_perms }; ++ ps_process_pattern($1, hsqldb_t) ++ ++ tunable_policy(`deny_ptrace',`',` ++ allow $1 hsqldb_t:process ptrace; ++ ') ++ ++ files_search_tmp($1) ++ admin_pattern($1, hsqldb_tmp_t) ++ ++ files_search_var_lib($1) ++ admin_pattern($1, hsqldb_var_lib_t) ++ ++ hsqldb_systemctl($1) ++ admin_pattern($1, hsqldb_unit_file_t) ++ allow $1 hsqldb_unit_file_t:service all_service_perms; ++ optional_policy(` ++ systemd_passwd_agent_exec($1) ++ systemd_read_fifo_file_passwd_run($1) ++ ') ++') +diff --git a/hsqldb.te b/hsqldb.te +new file mode 100644 +index 0000000..28816b4 +--- /dev/null ++++ b/hsqldb.te +@@ -0,0 +1,57 @@ ++policy_module(hsqldb, 1.0.0) ++ ++######################################## ++# ++# Declarations ++# ++ ++type hsqldb_t; ++type hsqldb_exec_t; ++init_daemon_domain(hsqldb_t, hsqldb_exec_t) ++ ++type hsqldb_tmp_t; ++files_tmp_file(hsqldb_tmp_t) ++ ++type hsqldb_var_lib_t; ++files_type(hsqldb_var_lib_t) ++ ++type hsqldb_unit_file_t; ++systemd_unit_file(hsqldb_unit_file_t) ++ ++######################################## ++# ++# hsqldb local policy ++# ++ ++allow hsqldb_t self:process execmem; ++ ++allow hsqldb_t self:fifo_file rw_fifo_file_perms; ++allow hsqldb_t self:stream_socket_class_set create_stream_socket_perms; ++ ++manage_dirs_pattern(hsqldb_t, hsqldb_tmp_t, hsqldb_tmp_t) ++manage_files_pattern(hsqldb_t, hsqldb_tmp_t, hsqldb_tmp_t) ++files_tmp_filetrans(hsqldb_t, hsqldb_tmp_t, { dir file }) ++ ++manage_dirs_pattern(hsqldb_t, hsqldb_var_lib_t, hsqldb_var_lib_t) ++manage_files_pattern(hsqldb_t, hsqldb_var_lib_t, hsqldb_var_lib_t) ++manage_lnk_files_pattern(hsqldb_t, hsqldb_var_lib_t, hsqldb_var_lib_t) ++manage_sock_files_pattern(hsqldb_t, hsqldb_var_lib_t, hsqldb_var_lib_t) ++files_var_lib_filetrans(hsqldb_t, hsqldb_var_lib_t, { dir }) ++ ++kernel_read_system_state(hsqldb_t) ++kernel_read_network_state(hsqldb_t) ++ ++corecmd_exec_bin(hsqldb_t) ++ ++corenet_tcp_bind_generic_node(hsqldb_t) ++corenet_tcp_bind_tor_port(hsqldb_t) ++corenet_tcp_connect_tor_port(hsqldb_t) ++ ++dev_list_sysfs(hsqldb_t) ++ ++dev_read_urand(hsqldb_t) ++dev_read_rand(hsqldb_t) ++ ++auth_use_nsswitch(hsqldb_t) ++ ++sysnet_read_config(hsqldb_t) diff --git a/hypervkvp.fc b/hypervkvp.fc index b46130e..e2ae3b2 100644 --- a/hypervkvp.fc @@ -39422,7 +39792,7 @@ index 0000000..20adcb3 + ') +') diff --git a/kerberos.fc b/kerberos.fc -index 4fe75fd..f01d946 100644 +index 4fe75fd..3504a9b 100644 --- a/kerberos.fc +++ b/kerberos.fc @@ -1,52 +1,54 @@ @@ -39508,7 +39878,7 @@ index 4fe75fd..f01d946 100644 + +/var/tmp/DNS_25 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/tmp/kadmin_0 -- gen_context(system_u:object_r:kadmind_tmp_t,s0) -+/var/tmp/kiprop_0 -- gen_context(system_u:object_r:krb5kdc_tmp_t,s0) ++/var/tmp/kiprop_0 -- gen_context(system_u:object_r:kadmind_tmp_t,s0) +/var/tmp/host_0 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/tmp/HTTP_23 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/tmp/HTTP_48 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) @@ -42881,10 +43251,10 @@ index 0000000..7ba5060 + diff --git a/linuxptp.te b/linuxptp.te new file mode 100644 -index 0000000..70dc4c3 +index 0000000..9f7ea8e --- /dev/null +++ b/linuxptp.te -@@ -0,0 +1,173 @@ +@@ -0,0 +1,179 @@ +policy_module(linuxptp, 1.0.0) + + @@ -42973,6 +43343,12 @@ index 0000000..70dc4c3 + gpsd_rw_shm(timemaster_t) +') + ++ ++optional_policy(` ++ chronyd_signal(timemaster_t) ++') ++ ++ +optional_policy(` + linuxptp_domtrans_ptp4l(timemaster_t) +') @@ -43183,6 +43559,16 @@ index 2f974bf..f6e97fa 100644 ') optional_policy(` +diff --git a/lldpad.fc b/lldpad.fc +index 8031a78..72e56ac 100644 +--- a/lldpad.fc ++++ b/lldpad.fc +@@ -5,3 +5,5 @@ + /var/lib/lldpad(/.*)? gen_context(system_u:object_r:lldpad_var_lib_t,s0) + + /var/run/lldpad.* gen_context(system_u:object_r:lldpad_var_run_t,s0) ++ ++/dev/shm/lldpad.* -- gen_context(system_u:object_r:lldpad_tmpfs_t,s0) diff --git a/lldpad.if b/lldpad.if index d18c960..fb5b674 100644 --- a/lldpad.if @@ -43229,7 +43615,7 @@ index d18c960..fb5b674 100644 domain_system_change_exemption($1) role_transition $2 lldpad_initrc_exec_t system_r; diff --git a/lldpad.te b/lldpad.te -index 2a491d9..dcd3ae6 100644 +index 2a491d9..42e5578 100644 --- a/lldpad.te +++ b/lldpad.te @@ -26,7 +26,7 @@ files_pid_file(lldpad_var_run_t) @@ -43241,12 +43627,13 @@ index 2a491d9..dcd3ae6 100644 allow lldpad_t self:shm create_shm_perms; allow lldpad_t self:fifo_file rw_fifo_file_perms; allow lldpad_t self:unix_stream_socket { accept listen }; -@@ -51,12 +51,14 @@ kernel_request_load_module(lldpad_t) +@@ -51,12 +51,16 @@ kernel_request_load_module(lldpad_t) dev_read_sysfs(lldpad_t) -files_read_etc_files(lldpad_t) -- ++fs_getattr_tmpfs(lldpad_t) + logging_send_syslog_msg(lldpad_t) -miscfiles_read_localization(lldpad_t) @@ -65188,10 +65575,10 @@ index 0000000..80246e6 + diff --git a/pcp.te b/pcp.te new file mode 100644 -index 0000000..530fe1d +index 0000000..e24db6b --- /dev/null +++ b/pcp.te -@@ -0,0 +1,258 @@ +@@ -0,0 +1,259 @@ +policy_module(pcp, 1.0.0) + +######################################## @@ -65259,6 +65646,7 @@ index 0000000..530fe1d +manage_dirs_pattern(pcp_domain, pcp_var_lib_t, pcp_var_lib_t) +manage_files_pattern(pcp_domain, pcp_var_lib_t, pcp_var_lib_t) +manage_sock_files_pattern(pcp_domain, pcp_var_lib_t, pcp_var_lib_t) ++manage_lnk_files_pattern(pcp_domain, pcp_var_lib_t, pcp_var_lib_t) +exec_files_pattern(pcp_domain, pcp_var_lib_t, pcp_var_lib_t) +files_var_lib_filetrans(pcp_domain, pcp_var_lib_t, { dir}) + @@ -65566,10 +65954,10 @@ index 0000000..22bc51b +/etc/pdns(/.*)? gen_context(system_u:object_r:pdns_conf_t,s0) diff --git a/pdns.if b/pdns.if new file mode 100644 -index 0000000..08314c4 +index 0000000..02df03a --- /dev/null +++ b/pdns.if -@@ -0,0 +1,63 @@ +@@ -0,0 +1,81 @@ +## PowerDNS DNS server. + +######################################## @@ -65632,7 +66020,25 @@ index 0000000..08314c4 + read_lnk_files_pattern($1, pdns_conf_t, pdns_conf_t) +') + ++######################################## ++## ++## Connect to pdns over an unix ++## stream socket. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`pdns_stream_connect',` ++ gen_require(` ++ type pdns_t, pdns_var_run_t; ++ ') + ++ files_search_pids($1) ++ stream_connect_pattern($1, pdns_var_run_t, pdns_var_run_t, pdns_t) ++') diff --git a/pdns.te b/pdns.te new file mode 100644 index 0000000..509d898 @@ -84719,7 +85125,7 @@ index 6dbc905..4b17c93 100644 - admin_pattern($1, rhsmcertd_lock_t) ') diff --git a/rhsmcertd.te b/rhsmcertd.te -index d32e1a2..e44a0d9 100644 +index d32e1a2..e030327 100644 --- a/rhsmcertd.te +++ b/rhsmcertd.te @@ -18,6 +18,9 @@ logging_log_file(rhsmcertd_log_t) @@ -84758,7 +85164,7 @@ index d32e1a2..e44a0d9 100644 manage_dirs_pattern(rhsmcertd_t, rhsmcertd_var_lib_t, rhsmcertd_var_lib_t) manage_files_pattern(rhsmcertd_t, rhsmcertd_var_lib_t, rhsmcertd_var_lib_t) -@@ -50,25 +56,75 @@ manage_files_pattern(rhsmcertd_t, rhsmcertd_var_run_t, rhsmcertd_var_run_t) +@@ -50,25 +56,78 @@ manage_files_pattern(rhsmcertd_t, rhsmcertd_var_run_t, rhsmcertd_var_run_t) files_pid_filetrans(rhsmcertd_t, rhsmcertd_var_run_t, { file dir }) kernel_read_network_state(rhsmcertd_t) @@ -84784,6 +85190,9 @@ index d32e1a2..e44a0d9 100644 +files_manage_generic_locks(rhsmcertd_t) +files_manage_system_conf_files(rhsmcertd_t) +files_create_boot_flag(rhsmcertd_t) ++files_dontaudit_write_all_mountpoints(rhsmcertd_t) ++ ++fs_dontaudit_write_configfs_dirs(rhsmcertd_t) + +auth_read_passwd(rhsmcertd_t) + @@ -90097,7 +90506,7 @@ index 50d07fb..337a3e7 100644 + allow $1 samba_unit_file_t:service all_service_perms; ') diff --git a/samba.te b/samba.te -index 2b7c441..b74b683 100644 +index 2b7c441..0c7bfd4 100644 --- a/samba.te +++ b/samba.te @@ -6,99 +6,86 @@ policy_module(samba, 1.16.3) @@ -90336,8 +90745,11 @@ index 2b7c441..b74b683 100644 allow samba_net_t samba_etc_t:file read_file_perms; -@@ -210,17 +208,22 @@ manage_files_pattern(samba_net_t, samba_var_t, samba_var_t) +@@ -208,19 +206,25 @@ files_tmp_filetrans(samba_net_t, samba_net_tmp_t, { file dir }) + manage_dirs_pattern(samba_net_t, samba_var_t, samba_var_t) + manage_files_pattern(samba_net_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(samba_net_t, samba_var_t, samba_var_t) ++manage_sock_files_pattern(samba_net_t, samba_var_t, samba_var_t) files_var_filetrans(samba_net_t, samba_var_t, dir, "samba") +kernel_read_proc_symlinks(samba_net_t) @@ -90363,7 +90775,7 @@ index 2b7c441..b74b683 100644 dev_read_urand(samba_net_t) -@@ -233,15 +236,22 @@ auth_manage_cache(samba_net_t) +@@ -233,15 +237,22 @@ auth_manage_cache(samba_net_t) logging_send_syslog_msg(samba_net_t) @@ -90390,7 +90802,7 @@ index 2b7c441..b74b683 100644 ') optional_policy(` -@@ -249,46 +259,59 @@ optional_policy(` +@@ -249,46 +260,59 @@ optional_policy(` ') optional_policy(` @@ -90463,7 +90875,7 @@ index 2b7c441..b74b683 100644 manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t) allow smbd_t samba_share_t:filesystem { getattr quotaget }; -@@ -298,65 +321,72 @@ manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t) +@@ -298,65 +322,72 @@ manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_sock_files_pattern(smbd_t, samba_var_t, samba_var_t) files_var_filetrans(smbd_t, samba_var_t, dir, "samba") @@ -90560,7 +90972,7 @@ index 2b7c441..b74b683 100644 fs_getattr_all_fs(smbd_t) fs_getattr_all_dirs(smbd_t) -@@ -366,44 +396,53 @@ fs_getattr_rpc_dirs(smbd_t) +@@ -366,44 +397,53 @@ fs_getattr_rpc_dirs(smbd_t) fs_list_inotifyfs(smbd_t) fs_get_all_fs_quotas(smbd_t) @@ -90626,7 +91038,7 @@ index 2b7c441..b74b683 100644 ') tunable_policy(`samba_domain_controller',` -@@ -419,20 +458,10 @@ tunable_policy(`samba_domain_controller',` +@@ -419,20 +459,10 @@ tunable_policy(`samba_domain_controller',` ') tunable_policy(`samba_enable_home_dirs',` @@ -90649,7 +91061,7 @@ index 2b7c441..b74b683 100644 tunable_policy(`samba_share_nfs',` fs_manage_nfs_dirs(smbd_t) fs_manage_nfs_files(smbd_t) -@@ -441,6 +470,7 @@ tunable_policy(`samba_share_nfs',` +@@ -441,6 +471,7 @@ tunable_policy(`samba_share_nfs',` fs_manage_nfs_named_sockets(smbd_t) ') @@ -90657,7 +91069,7 @@ index 2b7c441..b74b683 100644 tunable_policy(`samba_share_fusefs',` fs_manage_fusefs_dirs(smbd_t) fs_manage_fusefs_files(smbd_t) -@@ -448,15 +478,10 @@ tunable_policy(`samba_share_fusefs',` +@@ -448,15 +479,10 @@ tunable_policy(`samba_share_fusefs',` fs_search_fusefs(smbd_t) ') @@ -90677,7 +91089,7 @@ index 2b7c441..b74b683 100644 ') optional_policy(` -@@ -466,6 +491,7 @@ optional_policy(` +@@ -466,6 +492,7 @@ optional_policy(` optional_policy(` ctdbd_stream_connect(smbd_t) ctdbd_manage_lib_files(smbd_t) @@ -90685,7 +91097,7 @@ index 2b7c441..b74b683 100644 ') optional_policy(` -@@ -474,11 +500,30 @@ optional_policy(` +@@ -474,11 +501,30 @@ optional_policy(` ') optional_policy(` @@ -90716,7 +91128,7 @@ index 2b7c441..b74b683 100644 lpd_exec_lpr(smbd_t) ') -@@ -488,6 +533,10 @@ optional_policy(` +@@ -488,6 +534,10 @@ optional_policy(` ') optional_policy(` @@ -90727,7 +91139,7 @@ index 2b7c441..b74b683 100644 rpc_search_nfs_state_data(smbd_t) ') -@@ -499,9 +548,48 @@ optional_policy(` +@@ -499,9 +549,48 @@ optional_policy(` udev_read_db(smbd_t) ') @@ -90777,7 +91189,7 @@ index 2b7c441..b74b683 100644 # dontaudit nmbd_t self:capability sys_tty_config; -@@ -512,9 +600,11 @@ allow nmbd_t self:msg { send receive }; +@@ -512,9 +601,11 @@ allow nmbd_t self:msg { send receive }; allow nmbd_t self:msgq create_msgq_perms; allow nmbd_t self:sem create_sem_perms; allow nmbd_t self:shm create_shm_perms; @@ -90792,7 +91204,7 @@ index 2b7c441..b74b683 100644 manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t) manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t) -@@ -526,20 +616,15 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) +@@ -526,20 +617,15 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t) @@ -90816,7 +91228,7 @@ index 2b7c441..b74b683 100644 kernel_getattr_core_if(nmbd_t) kernel_getattr_message_if(nmbd_t) -@@ -547,53 +632,44 @@ kernel_read_kernel_sysctls(nmbd_t) +@@ -547,53 +633,44 @@ kernel_read_kernel_sysctls(nmbd_t) kernel_read_network_state(nmbd_t) kernel_read_software_raid_state(nmbd_t) kernel_read_system_state(nmbd_t) @@ -90885,7 +91297,7 @@ index 2b7c441..b74b683 100644 ') optional_policy(` -@@ -606,16 +682,22 @@ optional_policy(` +@@ -606,16 +683,22 @@ optional_policy(` ######################################## # @@ -90912,7 +91324,7 @@ index 2b7c441..b74b683 100644 manage_files_pattern(smbcontrol_t, samba_var_t, samba_var_t) -@@ -627,16 +709,13 @@ domain_use_interactive_fds(smbcontrol_t) +@@ -627,16 +710,13 @@ domain_use_interactive_fds(smbcontrol_t) dev_read_urand(smbcontrol_t) @@ -90931,7 +91343,7 @@ index 2b7c441..b74b683 100644 optional_policy(` ctdbd_stream_connect(smbcontrol_t) -@@ -644,22 +723,23 @@ optional_policy(` +@@ -644,22 +724,23 @@ optional_policy(` ######################################## # @@ -90963,7 +91375,7 @@ index 2b7c441..b74b683 100644 allow smbmount_t samba_secrets_t:file manage_file_perms; -@@ -668,26 +748,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) +@@ -668,26 +749,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t) files_var_filetrans(smbmount_t, samba_var_t, dir, "samba") @@ -90999,7 +91411,7 @@ index 2b7c441..b74b683 100644 fs_getattr_cifs(smbmount_t) fs_mount_cifs(smbmount_t) -@@ -699,58 +775,77 @@ fs_read_cifs_files(smbmount_t) +@@ -699,58 +776,77 @@ fs_read_cifs_files(smbmount_t) storage_raw_read_fixed_disk(smbmount_t) storage_raw_write_fixed_disk(smbmount_t) @@ -91091,7 +91503,7 @@ index 2b7c441..b74b683 100644 manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t) manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t) -@@ -759,17 +854,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) +@@ -759,17 +855,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t) files_pid_filetrans(swat_t, swat_var_run_t, file) @@ -91115,7 +91527,7 @@ index 2b7c441..b74b683 100644 kernel_read_kernel_sysctls(swat_t) kernel_read_system_state(swat_t) -@@ -777,36 +868,25 @@ kernel_read_network_state(swat_t) +@@ -777,36 +869,25 @@ kernel_read_network_state(swat_t) corecmd_search_bin(swat_t) @@ -91158,7 +91570,7 @@ index 2b7c441..b74b683 100644 auth_domtrans_chk_passwd(swat_t) auth_use_nsswitch(swat_t) -@@ -818,10 +898,11 @@ logging_send_syslog_msg(swat_t) +@@ -818,10 +899,11 @@ logging_send_syslog_msg(swat_t) logging_send_audit_msgs(swat_t) logging_search_logs(swat_t) @@ -91172,7 +91584,7 @@ index 2b7c441..b74b683 100644 optional_policy(` cups_read_rw_config(swat_t) cups_stream_connect(swat_t) -@@ -840,17 +921,20 @@ optional_policy(` +@@ -840,17 +922,20 @@ optional_policy(` # Winbind local policy # @@ -91198,7 +91610,7 @@ index 2b7c441..b74b683 100644 allow winbind_t samba_etc_t:dir list_dir_perms; read_files_pattern(winbind_t, samba_etc_t, samba_etc_t) -@@ -860,9 +944,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) +@@ -860,9 +945,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file) manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t) @@ -91209,7 +91621,7 @@ index 2b7c441..b74b683 100644 manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t) manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t) -@@ -873,38 +955,41 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba") +@@ -873,38 +956,41 @@ files_var_filetrans(winbind_t, samba_var_t, dir, "samba") rw_files_pattern(winbind_t, smbd_tmp_t, smbd_tmp_t) @@ -91262,7 +91674,7 @@ index 2b7c441..b74b683 100644 corenet_tcp_connect_smbd_port(winbind_t) corenet_tcp_connect_epmap_port(winbind_t) corenet_tcp_connect_all_unreserved_ports(winbind_t) -@@ -912,38 +997,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) +@@ -912,38 +998,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) dev_read_sysfs(winbind_t) dev_read_urand(winbind_t) @@ -91321,7 +91733,7 @@ index 2b7c441..b74b683 100644 ') optional_policy(` -@@ -959,31 +1058,35 @@ optional_policy(` +@@ -959,31 +1059,35 @@ optional_policy(` # Winbind helper local policy # @@ -91364,7 +91776,7 @@ index 2b7c441..b74b683 100644 optional_policy(` apache_append_log(winbind_helper_t) -@@ -997,25 +1100,38 @@ optional_policy(` +@@ -997,25 +1101,38 @@ optional_policy(` ######################################## # diff --git a/selinux-policy.spec b/selinux-policy.spec index b88f90a..779a794 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 141%{?dist} +Release: 142%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -647,6 +647,40 @@ exit 0 %endif %changelog +* Tue Aug 18 2015 Lukas Vrabec 3.13.1-142 +- Allow samba_net_t to manage samba_var_t sock files. +- Allow httpd daemon to manage httpd_var_lib_t lnk_files. +- Allow collectd stream connect to pdns.(BZ #1191044) +- Add interface pdns_stream_connect() +- Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib +- Allow chronyd exec systemctl +- Merge pull request #30 from vmojzis/rawhide-contrib +- Hsqldb policy upgrade -Allow sock_file management +- Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t. +- Hsqldb policy upgrade. -Disallow hsqldb_tmp_t link_file management +- Hsqldb policy upgrade: -Remove tmp link_file transition -Add policy summary -Remove redundant parameter for "hsqldb_admin" interface +- Label /var/run/chrony-helper dir as chronyd_var_run_t. +- Allow lldpad_t to getattr tmpfs_t. Label /dev/shm/lldpad.* as lldapd_tmpfs_t +- Fix label on /var/tmp/kiprop_0 +- Add mountpoint dontaudit access check in rhsmcertd policy. +- Allow pcp_domain to manage pcp_var_lib_t lnk_files. +- Allow chronyd to execute mkdir command. +- Allow chronyd_t to read dhcpc state. +- Label /usr/libexec/chrony-helper as chronyd_exec_t +- Allow openhpid liboa_soap plugin to read resolv.conf file. +- Allow openhpid liboa_soap plugin to read generic certs. +- Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device) +- Allow logrotate to reload services. +- Allow apcupsd_t to read /sys/devices +- Allow kpropd to connect to kropd tcp port. +- Allow systemd_networkd to send logs to syslog. +- Added interface fs_dontaudit_write_configfs_dirs +- Allow audisp client to read system state. +- Label /var/run/xtables.lock as iptables_var_run_t. +- Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde +- Add interface to read/write watchdog device. +- Add transition rule for iptables_var_lib_t + * Mon Aug 10 2015 Lukas Vrabec 3.13.1-141 - Allow chronyd to execute mkdir command. - Allow chronyd_t to read dhcpc state.