diff --git a/container-selinux.tgz b/container-selinux.tgz index 0fd402a..fb4b70a 100644 Binary files a/container-selinux.tgz and b/container-selinux.tgz differ diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index e9c57db..2a56ec0 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -6640,7 +6640,7 @@ index b31c054..3ad1127 100644 +/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0) +/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0) diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if -index 76f285e..47c1b4d 100644 +index 76f285e..519431d 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',` @@ -7739,7 +7739,7 @@ index 76f285e..47c1b4d 100644 ') ######################################## -@@ -3144,6 +3767,61 @@ interface(`dev_create_null_dev',` +@@ -3144,6 +3767,80 @@ interface(`dev_create_null_dev',` ######################################## ## @@ -7798,10 +7798,29 @@ index 76f285e..47c1b4d 100644 + +######################################## +## ++## Read/Write Non-Volatile Memory Host Controller Interface. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_rw_nvme',` ++ gen_require(` ++ type nvme_device_t; ++ ') ++ ++ rw_chr_files_pattern($1, device_t, nvme_device_t) ++ rw_blk_files_pattern($1, device_t, nvme_device_t) ++') ++ ++######################################## ++## ## Do not audit attempts to get the attributes ## of the BIOS non-volatile RAM device. ## -@@ -3163,6 +3841,24 @@ interface(`dev_dontaudit_getattr_nvram_dev',` +@@ -3163,6 +3860,24 @@ interface(`dev_dontaudit_getattr_nvram_dev',` ######################################## ## @@ -7826,7 +7845,7 @@ index 76f285e..47c1b4d 100644 ## Read and write BIOS non-volatile RAM. ## ## -@@ -3254,7 +3950,25 @@ interface(`dev_rw_printer',` +@@ -3254,7 +3969,25 @@ interface(`dev_rw_printer',` ######################################## ## @@ -7853,7 +7872,7 @@ index 76f285e..47c1b4d 100644 ## ## ## -@@ -3262,12 +3976,13 @@ interface(`dev_rw_printer',` +@@ -3262,12 +3995,13 @@ interface(`dev_rw_printer',` ## ## # @@ -7870,7 +7889,7 @@ index 76f285e..47c1b4d 100644 ') ######################################## -@@ -3399,7 +4114,7 @@ interface(`dev_dontaudit_read_rand',` +@@ -3399,7 +4133,7 @@ interface(`dev_dontaudit_read_rand',` ######################################## ## @@ -7879,7 +7898,7 @@ index 76f285e..47c1b4d 100644 ## number generator devices (e.g., /dev/random) ## ## -@@ -3413,7 +4128,7 @@ interface(`dev_dontaudit_append_rand',` +@@ -3413,7 +4147,7 @@ interface(`dev_dontaudit_append_rand',` type random_device_t; ') @@ -7888,7 +7907,7 @@ index 76f285e..47c1b4d 100644 ') ######################################## -@@ -3855,7 +4570,7 @@ interface(`dev_getattr_sysfs_dirs',` +@@ -3855,7 +4589,7 @@ interface(`dev_getattr_sysfs_dirs',` ######################################## ## @@ -7897,7 +7916,7 @@ index 76f285e..47c1b4d 100644 ## ## ## -@@ -3863,91 +4578,89 @@ interface(`dev_getattr_sysfs_dirs',` +@@ -3863,91 +4597,89 @@ interface(`dev_getattr_sysfs_dirs',` ## ## # @@ -8008,7 +8027,7 @@ index 76f285e..47c1b4d 100644 ## ## ## -@@ -3955,68 +4668,53 @@ interface(`dev_dontaudit_write_sysfs_dirs',` +@@ -3955,60 +4687,215 @@ interface(`dev_dontaudit_write_sysfs_dirs',` ## ## # @@ -8074,38 +8093,30 @@ index 76f285e..47c1b4d 100644 ') - rw_files_pattern($1, sysfs_t, sysfs_t) -- read_lnk_files_pattern($1, sysfs_t, sysfs_t) -- -- list_dirs_pattern($1, sysfs_t, sysfs_t) + dontaudit $1 sysfs_t:dir search_dir_perms; - ') - - ######################################## - ## --## Read and write the TPM device. ++') ++ ++######################################## ++## +## List the contents of the sysfs directories. - ## - ## - ## -@@ -4024,17 +4722,262 @@ interface(`dev_rw_sysfs',` - ## - ## - # --interface(`dev_rw_tpm',` ++## ++## ++## ++## Domain allowed access. ++## ++## ++# +interface(`dev_list_sysfs',` - gen_require(` -- type device_t, tpm_device_t; ++ gen_require(` + type sysfs_t; - ') - -- rw_chr_files_pattern($1, device_t, tpm_device_t) ++ ') ++ + read_lnk_files_pattern($1, sysfs_t, sysfs_t) + list_dirs_pattern($1, sysfs_t, sysfs_t) - ') - - ######################################## - ## --## Read from pseudo random number generator devices (e.g., /dev/urandom). ++') ++ ++######################################## ++## +## Write in a sysfs directories. +## +## @@ -8250,13 +8261,13 @@ index 76f285e..47c1b4d 100644 + ') + + rw_files_pattern($1, sysfs_t, sysfs_t) -+ read_lnk_files_pattern($1, sysfs_t, sysfs_t) -+ -+ list_dirs_pattern($1, sysfs_t, sysfs_t) -+') -+ -+######################################## -+## + read_lnk_files_pattern($1, sysfs_t, sysfs_t) + + list_dirs_pattern($1, sysfs_t, sysfs_t) +@@ -4016,6 +4903,81 @@ interface(`dev_rw_sysfs',` + + ######################################## + ## +## Relabel hardware state directories. +## +## @@ -8332,29 +8343,10 @@ index 76f285e..47c1b4d 100644 + +######################################## +## -+## Read and write the TPM device. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_rw_tpm',` -+ gen_require(` -+ type device_t, tpm_device_t; -+ ') -+ -+ rw_chr_files_pattern($1, device_t, tpm_device_t) -+') -+ -+######################################## -+## -+## Read from pseudo random number generator devices (e.g., /dev/urandom). + ## Read and write the TPM device. ## - ## - ##

-@@ -4113,6 +5056,25 @@ interface(`dev_write_urand',` + ## +@@ -4113,6 +5075,25 @@ interface(`dev_write_urand',` ######################################## ##

@@ -8380,7 +8372,7 @@ index 76f285e..47c1b4d 100644 ## Getattr generic the USB devices. ## ## -@@ -4123,7 +5085,7 @@ interface(`dev_write_urand',` +@@ -4123,7 +5104,7 @@ interface(`dev_write_urand',` # interface(`dev_getattr_generic_usb_dev',` gen_require(` @@ -8389,12 +8381,62 @@ index 76f285e..47c1b4d 100644 ') getattr_chr_files_pattern($1, device_t, usb_device_t) -@@ -4351,7 +5313,159 @@ interface(`dev_list_usbfs',` +@@ -4409,9 +5390,9 @@ interface(`dev_rw_usbfs',` + read_lnk_files_pattern($1, usbfs_t, usbfs_t) + ') + +-######################################## ++###################################### + ## +-## Get the attributes of video4linux devices. ++## Read and write userio device. + ## + ## + ## +@@ -4419,17 +5400,17 @@ interface(`dev_rw_usbfs',` + ## + ## + # +-interface(`dev_getattr_video_dev',` ++interface(`dev_rw_userio_dev',` + gen_require(` +- type device_t, v4l_device_t; ++ type device_t, userio_device_t; + ') + +- getattr_chr_files_pattern($1, device_t, v4l_device_t) ++ rw_chr_files_pattern($1, device_t, userio_device_t) + ') + +-###################################### ++######################################## + ## +-## Read and write userio device. ++## Get the attributes of video4linux devices. + ## + ## + ## +@@ -4437,12 +5418,12 @@ interface(`dev_getattr_video_dev',` + ## + ## + # +-interface(`dev_rw_userio_dev',` ++interface(`dev_getattr_video_dev',` + gen_require(` +- type device_t, userio_device_t; ++ type device_t, v4l_device_t; + ') + +- rw_chr_files_pattern($1, device_t, userio_device_t) ++ getattr_chr_files_pattern($1, device_t, v4l_device_t) + ') + + ######################################## +@@ -4539,6 +5520,134 @@ interface(`dev_write_video_dev',` ######################################## ## --## Set the attributes of usbfs filesystem. -+## Set the attributes of usbfs filesystem. ++## Get the attributes of vfio devices. +## +## +## @@ -8402,39 +8444,36 @@ index 76f285e..47c1b4d 100644 +## +## +# -+interface(`dev_setattr_usbfs_files',` ++interface(`dev_getattr_vfio_dev',` + gen_require(` -+ type usbfs_t; ++ type device_t, vfio_device_t; + ') + -+ setattr_files_pattern($1, usbfs_t, usbfs_t) -+ list_dirs_pattern($1, usbfs_t, usbfs_t) ++ getattr_chr_files_pattern($1, device_t, vfio_device_t) +') + +######################################## +## -+## Read USB hardware information using -+## the usbfs filesystem interface. ++## Do not audit attempts to get the attributes ++## of vfio device nodes. +## +## +## -+## Domain allowed access. ++## Domain to not audit. +## +## +# -+interface(`dev_read_usbfs',` ++interface(`dev_dontaudit_getattr_vfio_dev',` + gen_require(` -+ type usbfs_t; ++ type vfio_device_t; + ') + -+ read_files_pattern($1, usbfs_t, usbfs_t) -+ read_lnk_files_pattern($1, usbfs_t, usbfs_t) -+ list_dirs_pattern($1, usbfs_t, usbfs_t) ++ dontaudit $1 vfio_device_t:chr_file getattr; +') + +######################################## +## -+## Allow caller to modify usb hardware configuration files. ++## Set the attributes of vfio device nodes. +## +## +## @@ -8442,37 +8481,36 @@ index 76f285e..47c1b4d 100644 +## +## +# -+interface(`dev_rw_usbfs',` ++interface(`dev_setattr_vfio_dev',` + gen_require(` -+ type usbfs_t; ++ type device_t, vfio_device_t; + ') + -+ list_dirs_pattern($1, usbfs_t, usbfs_t) -+ rw_files_pattern($1, usbfs_t, usbfs_t) -+ read_lnk_files_pattern($1, usbfs_t, usbfs_t) ++ setattr_chr_files_pattern($1, device_t, vfio_device_t) +') + -+###################################### ++######################################## +## -+## Read and write userio device. ++## Do not audit attempts to set the attributes ++## of vfio device nodes. +## +## +## -+## Domain allowed access. ++## Domain to not audit. +## +## +# -+interface(`dev_rw_userio_dev',` ++interface(`dev_dontaudit_setattr_vfio_dev',` + gen_require(` -+ type device_t, userio_device_t; ++ type vfio_device_t; + ') + -+ rw_chr_files_pattern($1, device_t, userio_device_t) ++ dontaudit $1 vfio_device_t:chr_file setattr; +') + +######################################## +## -+## Get the attributes of video4linux devices. ++## Read the vfio devices. +## +## +## @@ -8480,36 +8518,35 @@ index 76f285e..47c1b4d 100644 +## +## +# -+interface(`dev_getattr_video_dev',` ++interface(`dev_read_vfio_dev',` + gen_require(` -+ type device_t, v4l_device_t; ++ type device_t, vfio_device_t; + ') + -+ getattr_chr_files_pattern($1, device_t, v4l_device_t) ++ read_chr_files_pattern($1, device_t, vfio_device_t) +') + +######################################## +## -+## Do not audit attempts to get the attributes -+## of video4linux device nodes. ++## Write the vfio devices. +## +## +## -+## Domain to not audit. ++## Domain allowed access. +## +## +# -+interface(`dev_dontaudit_getattr_video_dev',` ++interface(`dev_write_vfio_dev',` + gen_require(` -+ type v4l_device_t; ++ type device_t, vfio_device_t; + ') + -+ dontaudit $1 v4l_device_t:chr_file getattr; ++ write_chr_files_pattern($1, device_t, vfio_device_t) +') + +######################################## +## -+## Set the attributes of video4linux device nodes. ++## Read and write the VFIO devices. +## +## +## @@ -8517,288 +8554,45 @@ index 76f285e..47c1b4d 100644 +## +## +# -+interface(`dev_setattr_video_dev',` ++interface(`dev_rw_vfio_dev',` + gen_require(` -+ type device_t, v4l_device_t; ++ type device_t, vfio_device_t; + ') + -+ setattr_chr_files_pattern($1, device_t, v4l_device_t) ++ rw_chr_files_pattern($1, device_t, vfio_device_t) +') + +######################################## +## -+## Do not audit attempts to set the attributes -+## of video4linux device nodes. + ## Allow read/write the vhost net device + ## + ## +@@ -4557,6 +5666,24 @@ interface(`dev_rw_vhost',` + + ######################################## + ## ++## Allow read/write inheretid the vhost net device +## +## +## -+## Domain to not audit. ++## Domain allowed access. +## +## +# -+interface(`dev_dontaudit_setattr_video_dev',` ++interface(`dev_rw_inherited_vhost',` + gen_require(` -+ type v4l_device_t; ++ type device_t, vhost_device_t; + ') + -+ dontaudit $1 v4l_device_t:chr_file setattr; ++ allow $1 vhost_device_t:chr_file rw_inherited_chr_file_perms; +') + +######################################## +## -+## Read the video4linux devices. + ## Read and write VMWare devices. ## ## - ## -@@ -4359,19 +5473,17 @@ interface(`dev_list_usbfs',` - ## - ## - # --interface(`dev_setattr_usbfs_files',` -+interface(`dev_read_video_dev',` - gen_require(` -- type usbfs_t; -+ type device_t, v4l_device_t; - ') - -- setattr_files_pattern($1, usbfs_t, usbfs_t) -- list_dirs_pattern($1, usbfs_t, usbfs_t) -+ read_chr_files_pattern($1, device_t, v4l_device_t) - ') - - ######################################## - ## --## Read USB hardware information using --## the usbfs filesystem interface. -+## Write the video4linux devices. - ## - ## - ## -@@ -4379,19 +5491,17 @@ interface(`dev_setattr_usbfs_files',` - ## - ## - # --interface(`dev_read_usbfs',` -+interface(`dev_write_video_dev',` - gen_require(` -- type usbfs_t; -+ type device_t, v4l_device_t; - ') - -- read_files_pattern($1, usbfs_t, usbfs_t) -- read_lnk_files_pattern($1, usbfs_t, usbfs_t) -- list_dirs_pattern($1, usbfs_t, usbfs_t) -+ write_chr_files_pattern($1, device_t, v4l_device_t) - ') - - ######################################## - ## --## Allow caller to modify usb hardware configuration files. -+## Get the attributes of vfio devices. - ## - ## - ## -@@ -4399,37 +5509,36 @@ interface(`dev_read_usbfs',` - ## - ## - # --interface(`dev_rw_usbfs',` -+interface(`dev_getattr_vfio_dev',` - gen_require(` -- type usbfs_t; -+ type device_t, vfio_device_t; - ') - -- list_dirs_pattern($1, usbfs_t, usbfs_t) -- rw_files_pattern($1, usbfs_t, usbfs_t) -- read_lnk_files_pattern($1, usbfs_t, usbfs_t) -+ getattr_chr_files_pattern($1, device_t, vfio_device_t) - ') - - ######################################## - ## --## Get the attributes of video4linux devices. -+## Do not audit attempts to get the attributes -+## of vfio device nodes. - ## - ## - ## --## Domain allowed access. -+## Domain to not audit. - ## - ## - # --interface(`dev_getattr_video_dev',` -+interface(`dev_dontaudit_getattr_vfio_dev',` - gen_require(` -- type device_t, v4l_device_t; -+ type vfio_device_t; - ') - -- getattr_chr_files_pattern($1, device_t, v4l_device_t) -+ dontaudit $1 vfio_device_t:chr_file getattr; - ') - --###################################### -+######################################## - ## --## Read and write userio device. -+## Set the attributes of vfio device nodes. - ## - ## - ## -@@ -4437,18 +5546,18 @@ interface(`dev_getattr_video_dev',` - ## - ## - # --interface(`dev_rw_userio_dev',` -+interface(`dev_setattr_vfio_dev',` - gen_require(` -- type device_t, userio_device_t; -+ type device_t, vfio_device_t; - ') - -- rw_chr_files_pattern($1, device_t, userio_device_t) -+ setattr_chr_files_pattern($1, device_t, vfio_device_t) - ') - - ######################################## - ## --## Do not audit attempts to get the attributes --## of video4linux device nodes. -+## Do not audit attempts to set the attributes -+## of vfio device nodes. - ## - ## - ## -@@ -4456,17 +5565,17 @@ interface(`dev_rw_userio_dev',` - ## - ## - # --interface(`dev_dontaudit_getattr_video_dev',` -+interface(`dev_dontaudit_setattr_vfio_dev',` - gen_require(` -- type v4l_device_t; -+ type vfio_device_t; - ') - -- dontaudit $1 v4l_device_t:chr_file getattr; -+ dontaudit $1 vfio_device_t:chr_file setattr; - ') - - ######################################## - ## --## Set the attributes of video4linux device nodes. -+## Read the vfio devices. - ## - ## - ## -@@ -4474,36 +5583,35 @@ interface(`dev_dontaudit_getattr_video_dev',` - ## - ## - # --interface(`dev_setattr_video_dev',` -+interface(`dev_read_vfio_dev',` - gen_require(` -- type device_t, v4l_device_t; -+ type device_t, vfio_device_t; - ') - -- setattr_chr_files_pattern($1, device_t, v4l_device_t) -+ read_chr_files_pattern($1, device_t, vfio_device_t) - ') - - ######################################## - ## --## Do not audit attempts to set the attributes --## of video4linux device nodes. -+## Write the vfio devices. - ## - ## - ## --## Domain to not audit. -+## Domain allowed access. - ## - ## - # --interface(`dev_dontaudit_setattr_video_dev',` -+interface(`dev_write_vfio_dev',` - gen_require(` -- type v4l_device_t; -+ type device_t, vfio_device_t; - ') - -- dontaudit $1 v4l_device_t:chr_file setattr; -+ write_chr_files_pattern($1, device_t, vfio_device_t) - ') - - ######################################## - ## --## Read the video4linux devices. -+## Read and write the VFIO devices. - ## - ## - ## -@@ -4511,17 +5619,17 @@ interface(`dev_dontaudit_setattr_video_dev',` - ## - ## - # --interface(`dev_read_video_dev',` -+interface(`dev_rw_vfio_dev',` - gen_require(` -- type device_t, v4l_device_t; -+ type device_t, vfio_device_t; - ') - -- read_chr_files_pattern($1, device_t, v4l_device_t) -+ rw_chr_files_pattern($1, device_t, vfio_device_t) - ') - - ######################################## - ## --## Write the video4linux devices. -+## Allow read/write the vhost net device - ## - ## - ## -@@ -4529,17 +5637,17 @@ interface(`dev_read_video_dev',` - ## - ## - # --interface(`dev_write_video_dev',` -+interface(`dev_rw_vhost',` - gen_require(` -- type device_t, v4l_device_t; -+ type device_t, vhost_device_t; - ') - -- write_chr_files_pattern($1, device_t, v4l_device_t) -+ rw_chr_files_pattern($1, device_t, vhost_device_t) - ') - - ######################################## - ## --## Allow read/write the vhost net device -+## Allow read/write inheretid the vhost net device - ## - ## - ## -@@ -4547,12 +5655,12 @@ interface(`dev_write_video_dev',` - ## - ## - # --interface(`dev_rw_vhost',` -+interface(`dev_rw_inherited_vhost',` - gen_require(` - type device_t, vhost_device_t; - ') - -- rw_chr_files_pattern($1, device_t, vhost_device_t) -+ allow $1 vhost_device_t:chr_file rw_inherited_chr_file_perms; - ') - - ######################################## -@@ -4630,6 +5738,24 @@ interface(`dev_write_watchdog',` +@@ -4630,6 +5757,24 @@ interface(`dev_write_watchdog',` ######################################## ## @@ -8823,7 +8617,7 @@ index 76f285e..47c1b4d 100644 ## Read and write the the wireless device. ## ## -@@ -4762,6 +5888,44 @@ interface(`dev_rw_xserver_misc',` +@@ -4762,6 +5907,44 @@ interface(`dev_rw_xserver_misc',` ######################################## ## @@ -8868,7 +8662,7 @@ index 76f285e..47c1b4d 100644 ## Read and write to the zero device (/dev/zero). ## ## -@@ -4851,3 +6015,1042 @@ interface(`dev_unconfined',` +@@ -4851,3 +6034,1042 @@ interface(`dev_unconfined',` typeattribute $1 devices_unconfined_type; ') diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index 5022173..7111dab 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -5533,7 +5533,7 @@ index f6eb485..fe461a3 100644 + ps_process_pattern(httpd_t, $1) ') diff --git a/apache.te b/apache.te -index 6649962..248b38c 100644 +index 6649962..0d0ffbd 100644 --- a/apache.te +++ b/apache.te @@ -5,280 +5,346 @@ policy_module(apache, 2.7.2) @@ -6101,30 +6101,30 @@ index 6649962..248b38c 100644 type httpd_tmp_t; files_tmp_file(httpd_tmp_t) -@@ -324,14 +418,21 @@ files_tmp_file(httpd_tmp_t) +@@ -324,14 +418,16 @@ files_tmp_file(httpd_tmp_t) type httpd_tmpfs_t; files_tmpfs_file(httpd_tmpfs_t) -apache_content_template(user) +apache_user_content_template(httpd_user) ubac_constrained(httpd_user_script_t) +-userdom_user_home_content(httpd_user_content_t) +-userdom_user_home_content(httpd_user_htaccess_t) +-userdom_user_home_content(httpd_user_script_exec_t) +-userdom_user_home_content(httpd_user_ra_content_t) +-userdom_user_home_content(httpd_user_rw_content_t) + +typeattribute httpd_user_content_t httpdcontent; +typeattribute httpd_user_rw_content_t httpdcontent; +typeattribute httpd_user_ra_content_t httpdcontent; + - userdom_user_home_content(httpd_user_content_t) - userdom_user_home_content(httpd_user_htaccess_t) - userdom_user_home_content(httpd_user_script_exec_t) - userdom_user_home_content(httpd_user_ra_content_t) - userdom_user_home_content(httpd_user_rw_content_t) +typeattribute httpd_user_script_t httpd_script_domains; typealias httpd_user_content_t alias { httpd_staff_content_t httpd_sysadm_content_t }; +typealias httpd_user_content_t alias httpd_unconfined_content_t; typealias httpd_user_content_t alias { httpd_auditadm_content_t httpd_secadm_content_t }; typealias httpd_user_content_t alias { httpd_staff_script_ro_t httpd_sysadm_script_ro_t }; typealias httpd_user_content_t alias { httpd_auditadm_script_ro_t httpd_secadm_script_ro_t }; -@@ -346,33 +447,40 @@ typealias httpd_user_rw_content_t alias { httpd_auditadm_script_rw_t httpd_secad +@@ -346,33 +442,40 @@ typealias httpd_user_rw_content_t alias { httpd_auditadm_script_rw_t httpd_secad typealias httpd_user_ra_content_t alias { httpd_staff_script_ra_t httpd_sysadm_script_ra_t }; typealias httpd_user_ra_content_t alias { httpd_auditadm_script_ra_t httpd_secadm_script_ra_t }; @@ -6176,7 +6176,7 @@ index 6649962..248b38c 100644 allow httpd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow httpd_t self:fd use; allow httpd_t self:sock_file read_sock_file_perms; -@@ -381,30 +489,39 @@ allow httpd_t self:shm create_shm_perms; +@@ -381,30 +484,39 @@ allow httpd_t self:shm create_shm_perms; allow httpd_t self:sem create_sem_perms; allow httpd_t self:msgq create_msgq_perms; allow httpd_t self:msg { send receive }; @@ -6221,7 +6221,7 @@ index 6649962..248b38c 100644 logging_log_filetrans(httpd_t, httpd_log_t, file) allow httpd_t httpd_modules_t:dir list_dir_perms; -@@ -412,13 +529,20 @@ mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) +@@ -412,13 +524,20 @@ mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) read_lnk_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) @@ -6243,7 +6243,7 @@ index 6649962..248b38c 100644 allow httpd_t httpd_sys_script_t:unix_stream_socket connectto; -@@ -438,6 +562,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi +@@ -438,6 +557,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi manage_dirs_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) @@ -6251,7 +6251,7 @@ index 6649962..248b38c 100644 files_var_lib_filetrans(httpd_t, httpd_var_lib_t, { dir file }) setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) -@@ -450,140 +575,177 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) +@@ -450,140 +570,177 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) manage_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) @@ -6493,7 +6493,7 @@ index 6649962..248b38c 100644 ') tunable_policy(`httpd_enable_cgi && httpd_use_nfs',` -@@ -594,28 +756,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',` +@@ -594,28 +751,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',` fs_cifs_domtrans(httpd_t, httpd_sys_script_t) ') @@ -6553,7 +6553,7 @@ index 6649962..248b38c 100644 ') tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` -@@ -624,68 +808,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` +@@ -624,68 +803,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` fs_read_nfs_symlinks(httpd_t) ') @@ -6656,7 +6656,7 @@ index 6649962..248b38c 100644 ') tunable_policy(`httpd_setrlimit',` -@@ -695,49 +867,48 @@ tunable_policy(`httpd_setrlimit',` +@@ -695,49 +862,48 @@ tunable_policy(`httpd_setrlimit',` tunable_policy(`httpd_ssi_exec',` corecmd_shell_domtrans(httpd_t, httpd_sys_script_t) @@ -6737,7 +6737,7 @@ index 6649962..248b38c 100644 ') optional_policy(` -@@ -749,24 +920,32 @@ optional_policy(` +@@ -749,24 +915,32 @@ optional_policy(` ') optional_policy(` @@ -6776,7 +6776,7 @@ index 6649962..248b38c 100644 ') optional_policy(` -@@ -775,6 +954,10 @@ optional_policy(` +@@ -775,6 +949,10 @@ optional_policy(` tunable_policy(`httpd_dbus_avahi',` avahi_dbus_chat(httpd_t) ') @@ -6787,7 +6787,7 @@ index 6649962..248b38c 100644 ') optional_policy(` -@@ -786,35 +969,60 @@ optional_policy(` +@@ -786,35 +964,60 @@ optional_policy(` ') optional_policy(` @@ -6861,7 +6861,7 @@ index 6649962..248b38c 100644 tunable_policy(`httpd_manage_ipa',` memcached_manage_pid_files(httpd_t) -@@ -822,8 +1030,30 @@ optional_policy(` +@@ -822,8 +1025,30 @@ optional_policy(` ') optional_policy(` @@ -6892,7 +6892,7 @@ index 6649962..248b38c 100644 tunable_policy(`httpd_can_network_connect_db',` mysql_tcp_connect(httpd_t) -@@ -832,6 +1062,8 @@ optional_policy(` +@@ -832,6 +1057,8 @@ optional_policy(` optional_policy(` nagios_read_config(httpd_t) @@ -6901,7 +6901,7 @@ index 6649962..248b38c 100644 ') optional_policy(` -@@ -842,20 +1074,44 @@ optional_policy(` +@@ -842,20 +1069,44 @@ optional_policy(` ') optional_policy(` @@ -6952,7 +6952,7 @@ index 6649962..248b38c 100644 ') optional_policy(` -@@ -863,16 +1119,31 @@ optional_policy(` +@@ -863,16 +1114,31 @@ optional_policy(` ') optional_policy(` @@ -6986,7 +6986,7 @@ index 6649962..248b38c 100644 ') optional_policy(` -@@ -883,65 +1154,189 @@ optional_policy(` +@@ -883,65 +1149,189 @@ optional_policy(` yam_read_content(httpd_t) ') @@ -7198,7 +7198,7 @@ index 6649962..248b38c 100644 files_dontaudit_search_pids(httpd_suexec_t) files_search_home(httpd_suexec_t) -@@ -950,123 +1345,75 @@ auth_use_nsswitch(httpd_suexec_t) +@@ -950,123 +1340,75 @@ auth_use_nsswitch(httpd_suexec_t) logging_search_logs(httpd_suexec_t) logging_send_syslog_msg(httpd_suexec_t) @@ -7352,7 +7352,7 @@ index 6649962..248b38c 100644 mysql_read_config(httpd_suexec_t) tunable_policy(`httpd_can_network_connect_db',` -@@ -1083,172 +1430,107 @@ optional_policy(` +@@ -1083,172 +1425,107 @@ optional_policy(` ') ') @@ -7590,7 +7590,7 @@ index 6649962..248b38c 100644 ') tunable_policy(`httpd_read_user_content',` -@@ -1256,64 +1538,74 @@ tunable_policy(`httpd_read_user_content',` +@@ -1256,64 +1533,74 @@ tunable_policy(`httpd_read_user_content',` ') tunable_policy(`httpd_use_cifs',` @@ -7687,7 +7687,7 @@ index 6649962..248b38c 100644 ######################################## # -@@ -1321,8 +1613,15 @@ miscfiles_read_localization(httpd_rotatelogs_t) +@@ -1321,8 +1608,15 @@ miscfiles_read_localization(httpd_rotatelogs_t) # optional_policy(` @@ -7704,7 +7704,7 @@ index 6649962..248b38c 100644 ') ######################################## -@@ -1330,49 +1629,40 @@ optional_policy(` +@@ -1330,49 +1624,40 @@ optional_policy(` # User content local policy # @@ -7770,7 +7770,7 @@ index 6649962..248b38c 100644 kernel_read_system_state(httpd_passwd_t) corecmd_exec_bin(httpd_passwd_t) -@@ -1382,38 +1672,109 @@ dev_read_urand(httpd_passwd_t) +@@ -1382,38 +1667,109 @@ dev_read_urand(httpd_passwd_t) domain_use_interactive_fds(httpd_passwd_t) @@ -30765,10 +30765,10 @@ index 0000000..daef190 +') diff --git a/fwupd.te b/fwupd.te new file mode 100644 -index 0000000..77a7b23 +index 0000000..7bf263a --- /dev/null +++ b/fwupd.te -@@ -0,0 +1,69 @@ +@@ -0,0 +1,70 @@ +policy_module(fwupd, 1.0.0) + +######################################## @@ -30788,6 +30788,7 @@ index 0000000..77a7b23 + +type fwupd_var_lib_t; +files_type(fwupd_var_lib_t) ++files_mountpoint(fwupd_var_lib_t) + +type fwupd_unit_file_t; +systemd_unit_file(fwupd_unit_file_t) @@ -84741,7 +84742,7 @@ index 951db7f..00e699d 100644 + files_etc_filetrans($1, mdadm_conf_t, file, "mdadm.conf.anacbak") ') diff --git a/raid.te b/raid.te -index c99753f..0255b7e 100644 +index c99753f..6d4d0e9 100644 --- a/raid.te +++ b/raid.te @@ -15,54 +15,104 @@ role mdadm_roles types mdadm_t; @@ -84834,11 +84835,11 @@ index c99753f..0255b7e 100644 +dev_read_kvm(mdadm_t) +dev_read_mei(mdadm_t) +dev_read_nvram(mdadm_t) -+dev_read_nvme(mdadm_t) +dev_read_generic_files(mdadm_t) +dev_read_generic_usb_dev(mdadm_t) +dev_read_urand(mdadm_t) +dev_read_rand(mdadm_t) ++dev_rw_nvme(mdadm_t) + +domain_read_all_domains_state(mdadm_t) domain_use_interactive_fds(mdadm_t) @@ -98229,10 +98230,10 @@ index cd6c213..6d3cdc4 100644 + ') ') diff --git a/sanlock.te b/sanlock.te -index 0045465..5080a66 100644 +index 0045465..5be86bf 100644 --- a/sanlock.te +++ b/sanlock.te -@@ -6,25 +6,37 @@ policy_module(sanlock, 1.1.0) +@@ -6,25 +6,44 @@ policy_module(sanlock, 1.1.0) # ## @@ -98247,16 +98248,12 @@ index 0045465..5080a66 100644 gen_tunable(sanlock_use_nfs, false) ## --##

--## Determine whether sanlock can use --## cifs file systems. --##

+##

+## Allow sanlock to manage cifs files +##

- ## - gen_tunable(sanlock_use_samba, false) - ++## ++gen_tunable(sanlock_use_samba, false) ++ +## +##

+## Allow sanlock to read/write fuse files @@ -98264,6 +98261,16 @@ index 0045465..5080a66 100644 +## +gen_tunable(sanlock_use_fusefs, false) + ++## + ##

+-## Determine whether sanlock can use +-## cifs file systems. ++## Allow sanlock to read/write user home directories. + ##

+ ## +-gen_tunable(sanlock_use_samba, false) ++gen_tunable(sanlock_enable_home_dirs, false) + type sanlock_t; type sanlock_exec_t; init_daemon_domain(sanlock_t, sanlock_exec_t) @@ -98278,7 +98285,7 @@ index 0045465..5080a66 100644 type sanlock_var_run_t; files_pid_file(sanlock_var_run_t) -@@ -34,6 +46,12 @@ logging_log_file(sanlock_log_t) +@@ -34,6 +53,12 @@ logging_log_file(sanlock_log_t) type sanlock_initrc_exec_t; init_script_file(sanlock_initrc_exec_t) @@ -98291,7 +98298,7 @@ index 0045465..5080a66 100644 ifdef(`enable_mcs',` init_ranged_daemon_domain(sanlock_t, sanlock_exec_t, s0 - mcs_systemhigh) ') -@@ -44,17 +62,18 @@ ifdef(`enable_mls',` +@@ -44,17 +69,18 @@ ifdef(`enable_mls',` ######################################## # @@ -98305,18 +98312,18 @@ index 0045465..5080a66 100644 allow sanlock_t self:fifo_file rw_fifo_file_perms; -allow sanlock_t self:unix_stream_socket { accept listen }; +allow sanlock_t self:unix_stream_socket create_stream_socket_perms; ++ ++manage_files_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t) ++manage_dirs_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t) -append_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t) -create_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t) -setattr_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t) -+manage_files_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t) -+manage_dirs_pattern(sanlock_t, sanlock_conf_t, sanlock_conf_t) -+ +manage_files_pattern(sanlock_t, sanlock_log_t, sanlock_log_t) logging_log_filetrans(sanlock_t, sanlock_log_t, file) manage_dirs_pattern(sanlock_t, sanlock_var_run_t, sanlock_var_run_t) -@@ -65,13 +84,18 @@ files_pid_filetrans(sanlock_t, sanlock_var_run_t, { file dir sock_file }) +@@ -65,13 +91,18 @@ files_pid_filetrans(sanlock_t, sanlock_var_run_t, { file dir sock_file }) kernel_read_system_state(sanlock_t) kernel_read_kernel_sysctls(sanlock_t) @@ -98338,7 +98345,7 @@ index 0045465..5080a66 100644 auth_use_nsswitch(sanlock_t) init_read_utmp(sanlock_t) -@@ -79,20 +103,29 @@ init_dontaudit_write_utmp(sanlock_t) +@@ -79,20 +110,35 @@ init_dontaudit_write_utmp(sanlock_t) logging_send_syslog_msg(sanlock_t) @@ -98372,12 +98379,18 @@ index 0045465..5080a66 100644 + fs_read_cifs_symlinks(sanlock_t) +') + ++tunable_policy(`sanlock_enable_home_dirs',` ++ userdom_manage_user_home_content_dirs(sanlock_t) ++ userdom_manage_user_home_content_files(sanlock_t) ++ userdom_manage_user_home_content_symlinks(sanlock_t) ++') ++ +optional_policy(` + rhcs_domtrans_fenced(sanlock_t) ') optional_policy(` -@@ -100,7 +133,34 @@ optional_policy(` +@@ -100,7 +146,34 @@ optional_policy(` ') optional_policy(` @@ -110350,10 +110363,10 @@ index 0000000..e5cec8f +') diff --git a/tomcat.te b/tomcat.te new file mode 100644 -index 0000000..5a263b2 +index 0000000..3bc263e --- /dev/null +++ b/tomcat.te -@@ -0,0 +1,69 @@ +@@ -0,0 +1,60 @@ +policy_module(tomcat, 1.0.0) + +######################################## @@ -110368,15 +110381,6 @@ index 0000000..5a263b2 +type tomcat_unit_file_t; +systemd_unit_file(tomcat_unit_file_t) + -+####################################### -+# -+# tomcat local policy -+# -+ -+optional_policy(` -+ unconfined_domain(tomcat_t) -+') -+ +######################################## +# +# tomcat domain local policy diff --git a/selinux-policy.spec b/selinux-policy.spec index 9090419..637f5e2 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 246%{?dist} +Release: 247%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -682,6 +682,15 @@ exit 0 %endif %changelog +* Tue Mar 21 2017 Lukas Vrabec - 3.13.1-247 +- Make fwupd_var_lib_t type mountpoint. BZ(1429341) +- Remove tomcat_t domain from unconfined domains +- Create new boolean: sanlock_enable_home_dirs() +- Allow mdadm_t domain to read/write nvme_device_t +- Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content +- Add interface dev_rw_nvme +- Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555) + * Sat Mar 18 2017 Lukas Vrabec - 3.13.1-246 - Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555)