diff --git a/policy/modules/admin/sudo.if b/policy/modules/admin/sudo.if
index a9468b9..9cdaeda 100644
--- a/policy/modules/admin/sudo.if
+++ b/policy/modules/admin/sudo.if
@@ -32,6 +32,7 @@ template(`sudo_role_template',`
gen_require(`
type sudo_exec_t;
+ attribute sudodomain;
')
##############################
@@ -39,9 +40,10 @@ template(`sudo_role_template',`
# Declarations
#
- type $1_sudo_t;
+ type $1_sudo_t, sudodomain;
application_domain($1_sudo_t, sudo_exec_t)
domain_interactive_fd($1_sudo_t)
+ domain_role_change_exemption($1_sudo_t)
ubac_constrained($1_sudo_t)
role $2 types $1_sudo_t;
@@ -51,7 +53,7 @@ template(`sudo_role_template',`
#
# Use capabilities.
- allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_resource };
+ allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_nice sys_resource };
allow $1_sudo_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow $1_sudo_t self:process { setexec setrlimit };
allow $1_sudo_t self:fd use;
@@ -64,27 +66,37 @@ template(`sudo_role_template',`
allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms;
allow $1_sudo_t self:unix_dgram_socket sendto;
allow $1_sudo_t self:unix_stream_socket connectto;
- allow $1_sudo_t self:netlink_audit_socket { create bind write nlmsg_read read };
+
+ allow $1_sudo_t $3:key search;
# Enter this derived domain from the user domain
domtrans_pattern($3, sudo_exec_t, $1_sudo_t)
# By default, revert to the calling domain when a shell is executed.
corecmd_shell_domtrans($1_sudo_t, $3)
+ corecmd_bin_domtrans($1_sudo_t, $3)
allow $3 $1_sudo_t:fd use;
allow $3 $1_sudo_t:fifo_file rw_file_perms;
allow $3 $1_sudo_t:process sigchld;
kernel_read_kernel_sysctls($1_sudo_t)
kernel_read_system_state($1_sudo_t)
- kernel_search_key($1_sudo_t)
+ kernel_link_key($1_sudo_t)
dev_read_urand($1_sudo_t)
+ dev_rw_generic_usb_dev($1_sudo_t)
+ dev_read_sysfs($1_sudo_t)
fs_search_auto_mountpoints($1_sudo_t)
fs_getattr_xattr_fs($1_sudo_t)
- auth_domtrans_chk_passwd($1_sudo_t)
+ selinux_validate_context($1_sudo_t)
+ selinux_compute_relabel_context($1_sudo_t)
+
+ term_relabel_all_user_ttys($1_sudo_t)
+ term_relabel_all_user_ptys($1_sudo_t)
+
+ auth_run_chk_passwd($1_sudo_t, $2)
# sudo stores a token in the pam_pid directory
auth_manage_pam_pid($1_sudo_t)
auth_use_nsswitch($1_sudo_t)
@@ -102,18 +114,55 @@ template(`sudo_role_template',`
files_getattr_usr_files($1_sudo_t)
# for some PAM modules and for cwd
files_dontaudit_search_home($1_sudo_t)
+ files_list_tmp($1_sudo_t)
init_rw_utmp($1_sudo_t)
+ logging_send_audit_msgs($1_sudo_t)
logging_send_syslog_msg($1_sudo_t)
miscfiles_read_localization($1_sudo_t)
+ seutil_search_default_contexts($1_sudo_t)
+ seutil_libselinux_linked($1_sudo_t)
+
+ userdom_spec_domtrans_all_users($1_sudo_t)
userdom_manage_user_home_content_files($1_sudo_t)
userdom_manage_user_home_content_symlinks($1_sudo_t)
userdom_manage_user_tmp_files($1_sudo_t)
userdom_manage_user_tmp_symlinks($1_sudo_t)
userdom_use_user_terminals($1_sudo_t)
+ userdom_use_user_terminals($1_sudo_t)
# for some PAM modules and for cwd
userdom_dontaudit_search_user_home_content($1_sudo_t)
+
+ tunable_policy(`use_nfs_home_dirs',`
+ fs_manage_nfs_files($1_sudo_t)
+ ')
+
+ tunable_policy(`use_samba_home_dirs',`
+ fs_manage_cifs_files($1_sudo_t)
+ ')
+
+ optional_policy(`
+ dbus_system_bus_client($1_sudo_t)
+ ')
+')
+
+########################################
+##
+## Send a SIGCHLD signal to the sudo domain.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`sudo_sigchld',`
+ gen_require(`
+ attribute sudodomain;
+ ')
+
+ allow $1 sudodomain:process sigchld;
')
diff --git a/policy/modules/admin/sudo.te b/policy/modules/admin/sudo.te
index 425fb3f..f2613f5 100644
--- a/policy/modules/admin/sudo.te
+++ b/policy/modules/admin/sudo.te
@@ -1,9 +1,10 @@
-policy_module(sudo, 1.4.0)
+policy_module(sudo, 1.4.1)
########################################
#
# Declarations
+attribute sudodomain;
type sudo_exec_t;
application_executable_file(sudo_exec_t)