From 99d063dffd4d0193fa72de48798e44c84e2e4c00 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Sep 29 2017 12:17:37 +0000 Subject: * Fri Sep 29 2017 Lukas Vrabec - 3.13.1-283.5 - Allow virtlogd_t domain to write inhibit systemd pipes. - Allow smbd_t domain to mmap samba_var_t files BZ(1496319) - Allow tlp_t domain stream connect to sssd_t domain - Allow cloud-init to create /var/run/cloud-init dir with net_conf_t SELinux label.BZ(1489166) - Make systemd resolved to create resolv.conf with correct label. --- diff --git a/container-selinux.tgz b/container-selinux.tgz index 37bef33..e209ecc 100644 Binary files a/container-selinux.tgz and b/container-selinux.tgz differ diff --git a/policy-f27-base.patch b/policy-f27-base.patch index 9786913..129df47 100644 --- a/policy-f27-base.patch +++ b/policy-f27-base.patch @@ -37846,7 +37846,7 @@ index 79a45f62e..6ed0c399a 100644 + allow $1 init_var_lib_t:dir search_dir_perms; +') diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te -index 17eda2480..7d76c87ce 100644 +index 17eda2480..f049f18e3 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -11,10 +11,31 @@ gen_require(` @@ -38255,17 +38255,16 @@ index 17eda2480..7d76c87ce 100644 +optional_policy(` + modutils_domtrans_insmod(init_t) + modutils_list_module_config(init_t) - ') - - optional_policy(` -- auth_rw_login_records(init_t) ++') ++ ++optional_policy(` + postfix_exec(init_t) + postfix_list_spool(init_t) + mta_read_config(init_t) + mta_manage_aliases(init_t) - ') - - optional_policy(` ++') ++ ++optional_policy(` + systemd_allow_mount_dir(init_t) +') + @@ -38426,13 +38425,14 @@ index 17eda2480..7d76c87ce 100644 +optional_policy(` + lvm_rw_pipes(init_t) + lvm_read_config(init_t) -+') -+ -+optional_policy(` + ') + + optional_policy(` +- auth_rw_login_records(init_t) + lldpad_relabel_tmpfs(init_t) -+') -+ -+optional_policy(` + ') + + optional_policy(` + consolekit_manage_log(init_t) +') + @@ -38452,10 +38452,9 @@ index 17eda2480..7d76c87ce 100644 + # the directory. But we do not want to allow this. + # The master process of dovecot will manage this file. + dovecot_dontaudit_unlink_lib_files(initrc_t) - ') - - optional_policy(` -- nscd_use(init_t) ++') ++ ++optional_policy(` + networkmanager_stream_connect(init_t) + networkmanager_stream_connect(initrc_t) +') @@ -38464,14 +38463,15 @@ index 17eda2480..7d76c87ce 100644 + plymouthd_stream_connect(init_t) + plymouthd_exec_plymouth(init_t) + plymouthd_filetrans_named_content(init_t) -+') -+ -+optional_policy(` + ') + + optional_policy(` +- nscd_use(init_t) + ssh_getattr_server_keys(init_t) ') optional_policy(` -@@ -216,7 +641,30 @@ optional_policy(` +@@ -216,7 +641,34 @@ optional_policy(` ') optional_policy(` @@ -38485,6 +38485,10 @@ index 17eda2480..7d76c87ce 100644 +') + +optional_policy(` ++ sysnet_filetrans_cloud_net_conf(init_t) ++') ++ ++optional_policy(` + udev_read_db(init_t) + udev_relabelto_db(init_t) + udev_create_kobject_uevent_socket(init_t) @@ -38503,7 +38507,7 @@ index 17eda2480..7d76c87ce 100644 ') ######################################## -@@ -225,9 +673,9 @@ optional_policy(` +@@ -225,9 +677,9 @@ optional_policy(` # allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; @@ -38515,7 +38519,7 @@ index 17eda2480..7d76c87ce 100644 allow initrc_t self:passwd rootok; allow initrc_t self:key manage_key_perms; -@@ -258,12 +706,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) +@@ -258,12 +710,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) allow initrc_t initrc_var_run_t:file manage_file_perms; files_pid_filetrans(initrc_t, initrc_var_run_t, file) @@ -38532,7 +38536,7 @@ index 17eda2480..7d76c87ce 100644 manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) -@@ -279,23 +731,36 @@ kernel_change_ring_buffer_level(initrc_t) +@@ -279,23 +735,36 @@ kernel_change_ring_buffer_level(initrc_t) kernel_clear_ring_buffer(initrc_t) kernel_get_sysvipc_info(initrc_t) kernel_read_all_sysctls(initrc_t) @@ -38575,7 +38579,7 @@ index 17eda2480..7d76c87ce 100644 corenet_tcp_sendrecv_all_ports(initrc_t) corenet_udp_sendrecv_all_ports(initrc_t) corenet_tcp_connect_all_ports(initrc_t) -@@ -303,9 +768,11 @@ corenet_sendrecv_all_client_packets(initrc_t) +@@ -303,9 +772,11 @@ corenet_sendrecv_all_client_packets(initrc_t) dev_read_rand(initrc_t) dev_read_urand(initrc_t) @@ -38587,7 +38591,7 @@ index 17eda2480..7d76c87ce 100644 dev_rw_sysfs(initrc_t) dev_list_usbfs(initrc_t) dev_read_framebuffer(initrc_t) -@@ -313,8 +780,10 @@ dev_write_framebuffer(initrc_t) +@@ -313,8 +784,10 @@ dev_write_framebuffer(initrc_t) dev_read_realtime_clock(initrc_t) dev_read_sound_mixer(initrc_t) dev_write_sound_mixer(initrc_t) @@ -38598,7 +38602,7 @@ index 17eda2480..7d76c87ce 100644 dev_delete_lvm_control_dev(initrc_t) dev_manage_generic_symlinks(initrc_t) dev_manage_generic_files(initrc_t) -@@ -322,8 +791,7 @@ dev_manage_generic_files(initrc_t) +@@ -322,8 +795,7 @@ dev_manage_generic_files(initrc_t) dev_delete_generic_symlinks(initrc_t) dev_getattr_all_blk_files(initrc_t) dev_getattr_all_chr_files(initrc_t) @@ -38608,7 +38612,7 @@ index 17eda2480..7d76c87ce 100644 domain_kill_all_domains(initrc_t) domain_signal_all_domains(initrc_t) -@@ -332,7 +800,6 @@ domain_sigstop_all_domains(initrc_t) +@@ -332,7 +804,6 @@ domain_sigstop_all_domains(initrc_t) domain_sigchld_all_domains(initrc_t) domain_read_all_domains_state(initrc_t) domain_getattr_all_domains(initrc_t) @@ -38616,7 +38620,7 @@ index 17eda2480..7d76c87ce 100644 domain_getsession_all_domains(initrc_t) domain_use_interactive_fds(initrc_t) # for lsof which is used by alsa shutdown: -@@ -340,6 +807,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) +@@ -340,6 +811,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) domain_dontaudit_getattr_all_tcp_sockets(initrc_t) domain_dontaudit_getattr_all_dgram_sockets(initrc_t) domain_dontaudit_getattr_all_pipes(initrc_t) @@ -38624,7 +38628,7 @@ index 17eda2480..7d76c87ce 100644 files_getattr_all_dirs(initrc_t) files_getattr_all_files(initrc_t) -@@ -347,14 +815,15 @@ files_getattr_all_symlinks(initrc_t) +@@ -347,14 +819,15 @@ files_getattr_all_symlinks(initrc_t) files_getattr_all_pipes(initrc_t) files_getattr_all_sockets(initrc_t) files_purge_tmp(initrc_t) @@ -38642,7 +38646,7 @@ index 17eda2480..7d76c87ce 100644 files_read_usr_files(initrc_t) files_manage_urandom_seed(initrc_t) files_manage_generic_spool(initrc_t) -@@ -364,8 +833,12 @@ files_list_isid_type_dirs(initrc_t) +@@ -364,8 +837,12 @@ files_list_isid_type_dirs(initrc_t) files_mounton_isid_type_dirs(initrc_t) files_list_default(initrc_t) files_mounton_default(initrc_t) @@ -38656,7 +38660,7 @@ index 17eda2480..7d76c87ce 100644 fs_list_inotifyfs(initrc_t) fs_register_binary_executable_type(initrc_t) # rhgb-console writes to ramfs -@@ -375,10 +848,11 @@ fs_mount_all_fs(initrc_t) +@@ -375,10 +852,11 @@ fs_mount_all_fs(initrc_t) fs_unmount_all_fs(initrc_t) fs_remount_all_fs(initrc_t) fs_getattr_all_fs(initrc_t) @@ -38670,7 +38674,7 @@ index 17eda2480..7d76c87ce 100644 mcs_process_set_categories(initrc_t) mls_file_read_all_levels(initrc_t) -@@ -387,8 +861,10 @@ mls_process_read_up(initrc_t) +@@ -387,8 +865,10 @@ mls_process_read_up(initrc_t) mls_process_write_down(initrc_t) mls_rangetrans_source(initrc_t) mls_fd_share_all_levels(initrc_t) @@ -38681,7 +38685,7 @@ index 17eda2480..7d76c87ce 100644 storage_getattr_fixed_disk_dev(initrc_t) storage_setattr_fixed_disk_dev(initrc_t) -@@ -398,6 +874,7 @@ term_use_all_terms(initrc_t) +@@ -398,6 +878,7 @@ term_use_all_terms(initrc_t) term_reset_tty_labels(initrc_t) auth_rw_login_records(initrc_t) @@ -38689,7 +38693,7 @@ index 17eda2480..7d76c87ce 100644 auth_setattr_login_records(initrc_t) auth_rw_lastlog(initrc_t) auth_read_pam_pid(initrc_t) -@@ -416,20 +893,18 @@ logging_read_all_logs(initrc_t) +@@ -416,20 +897,18 @@ logging_read_all_logs(initrc_t) logging_append_all_logs(initrc_t) logging_read_audit_config(initrc_t) @@ -38713,7 +38717,7 @@ index 17eda2480..7d76c87ce 100644 ifdef(`distro_debian',` dev_setattr_generic_dirs(initrc_t) -@@ -451,7 +926,6 @@ ifdef(`distro_gentoo',` +@@ -451,7 +930,6 @@ ifdef(`distro_gentoo',` allow initrc_t self:process setfscreate; dev_create_null_dev(initrc_t) dev_create_zero_dev(initrc_t) @@ -38721,7 +38725,7 @@ index 17eda2480..7d76c87ce 100644 term_create_console_dev(initrc_t) # unfortunately /sbin/rc does stupid tricks -@@ -486,6 +960,10 @@ ifdef(`distro_gentoo',` +@@ -486,6 +964,10 @@ ifdef(`distro_gentoo',` sysnet_setattr_config(initrc_t) optional_policy(` @@ -38732,7 +38736,7 @@ index 17eda2480..7d76c87ce 100644 alsa_read_lib(initrc_t) ') -@@ -506,7 +984,7 @@ ifdef(`distro_redhat',` +@@ -506,7 +988,7 @@ ifdef(`distro_redhat',` # Red Hat systems seem to have a stray # fd open from the initrd @@ -38741,7 +38745,7 @@ index 17eda2480..7d76c87ce 100644 files_dontaudit_read_root_files(initrc_t) # These seem to be from the initrd -@@ -521,6 +999,7 @@ ifdef(`distro_redhat',` +@@ -521,6 +1003,7 @@ ifdef(`distro_redhat',` files_create_boot_dirs(initrc_t) files_create_boot_flag(initrc_t) files_rw_boot_symlinks(initrc_t) @@ -38749,7 +38753,7 @@ index 17eda2480..7d76c87ce 100644 # wants to read /.fonts directory files_read_default_files(initrc_t) files_mountpoint(initrc_tmp_t) -@@ -541,6 +1020,7 @@ ifdef(`distro_redhat',` +@@ -541,6 +1024,7 @@ ifdef(`distro_redhat',` miscfiles_rw_localization(initrc_t) miscfiles_setattr_localization(initrc_t) miscfiles_relabel_localization(initrc_t) @@ -38757,7 +38761,7 @@ index 17eda2480..7d76c87ce 100644 miscfiles_read_fonts(initrc_t) miscfiles_read_hwdata(initrc_t) -@@ -550,8 +1030,44 @@ ifdef(`distro_redhat',` +@@ -550,8 +1034,44 @@ ifdef(`distro_redhat',` ') optional_policy(` @@ -38802,7 +38806,7 @@ index 17eda2480..7d76c87ce 100644 ') optional_policy(` -@@ -559,14 +1075,31 @@ ifdef(`distro_redhat',` +@@ -559,14 +1079,31 @@ ifdef(`distro_redhat',` rpc_write_exports(initrc_t) rpc_manage_nfs_state_data(initrc_t) ') @@ -38834,7 +38838,7 @@ index 17eda2480..7d76c87ce 100644 ') ') -@@ -577,6 +1110,39 @@ ifdef(`distro_suse',` +@@ -577,6 +1114,39 @@ ifdef(`distro_suse',` ') ') @@ -38874,7 +38878,7 @@ index 17eda2480..7d76c87ce 100644 optional_policy(` amavis_search_lib(initrc_t) amavis_setattr_pid_files(initrc_t) -@@ -589,6 +1155,8 @@ optional_policy(` +@@ -589,6 +1159,8 @@ optional_policy(` optional_policy(` apache_read_config(initrc_t) apache_list_modules(initrc_t) @@ -38883,7 +38887,7 @@ index 17eda2480..7d76c87ce 100644 ') optional_policy(` -@@ -610,6 +1178,7 @@ optional_policy(` +@@ -610,6 +1182,7 @@ optional_policy(` optional_policy(` cgroup_stream_connect_cgred(initrc_t) @@ -38891,7 +38895,7 @@ index 17eda2480..7d76c87ce 100644 ') optional_policy(` -@@ -626,6 +1195,17 @@ optional_policy(` +@@ -626,6 +1199,17 @@ optional_policy(` ') optional_policy(` @@ -38909,7 +38913,7 @@ index 17eda2480..7d76c87ce 100644 dev_getattr_printer_dev(initrc_t) cups_read_log(initrc_t) -@@ -642,9 +1222,13 @@ optional_policy(` +@@ -642,9 +1226,13 @@ optional_policy(` dbus_connect_system_bus(initrc_t) dbus_system_bus_client(initrc_t) dbus_read_config(initrc_t) @@ -38923,7 +38927,7 @@ index 17eda2480..7d76c87ce 100644 ') optional_policy(` -@@ -657,15 +1241,11 @@ optional_policy(` +@@ -657,15 +1245,11 @@ optional_policy(` ') optional_policy(` @@ -38941,7 +38945,7 @@ index 17eda2480..7d76c87ce 100644 ') optional_policy(` -@@ -686,6 +1266,15 @@ optional_policy(` +@@ -686,6 +1270,15 @@ optional_policy(` ') optional_policy(` @@ -38957,7 +38961,7 @@ index 17eda2480..7d76c87ce 100644 inn_exec_config(initrc_t) ') -@@ -726,6 +1315,7 @@ optional_policy(` +@@ -726,6 +1319,7 @@ optional_policy(` lpd_list_spool(initrc_t) lpd_read_config(initrc_t) @@ -38965,7 +38969,7 @@ index 17eda2480..7d76c87ce 100644 ') optional_policy(` -@@ -743,7 +1333,13 @@ optional_policy(` +@@ -743,7 +1337,13 @@ optional_policy(` ') optional_policy(` @@ -38980,7 +38984,7 @@ index 17eda2480..7d76c87ce 100644 mta_dontaudit_read_spool_symlinks(initrc_t) ') -@@ -766,6 +1362,10 @@ optional_policy(` +@@ -766,6 +1366,10 @@ optional_policy(` ') optional_policy(` @@ -38991,7 +38995,7 @@ index 17eda2480..7d76c87ce 100644 postgresql_manage_db(initrc_t) postgresql_read_config(initrc_t) ') -@@ -775,10 +1375,20 @@ optional_policy(` +@@ -775,10 +1379,20 @@ optional_policy(` ') optional_policy(` @@ -39012,7 +39016,7 @@ index 17eda2480..7d76c87ce 100644 quota_manage_flags(initrc_t) ') -@@ -787,6 +1397,10 @@ optional_policy(` +@@ -787,6 +1401,10 @@ optional_policy(` ') optional_policy(` @@ -39023,7 +39027,7 @@ index 17eda2480..7d76c87ce 100644 fs_write_ramfs_sockets(initrc_t) fs_search_ramfs(initrc_t) -@@ -808,8 +1422,6 @@ optional_policy(` +@@ -808,8 +1426,6 @@ optional_policy(` # bash tries ioctl for some reason files_dontaudit_ioctl_all_pids(initrc_t) @@ -39032,7 +39036,7 @@ index 17eda2480..7d76c87ce 100644 ') optional_policy(` -@@ -818,6 +1430,10 @@ optional_policy(` +@@ -818,6 +1434,10 @@ optional_policy(` ') optional_policy(` @@ -39043,7 +39047,7 @@ index 17eda2480..7d76c87ce 100644 # shorewall-init script run /var/lib/shorewall/firewall shorewall_lib_domtrans(initrc_t) ') -@@ -827,10 +1443,12 @@ optional_policy(` +@@ -827,10 +1447,12 @@ optional_policy(` squid_manage_logs(initrc_t) ') @@ -39056,7 +39060,7 @@ index 17eda2480..7d76c87ce 100644 optional_policy(` ssh_dontaudit_read_server_keys(initrc_t) -@@ -857,21 +1475,62 @@ optional_policy(` +@@ -857,21 +1479,62 @@ optional_policy(` ') optional_policy(` @@ -39120,7 +39124,7 @@ index 17eda2480..7d76c87ce 100644 ') optional_policy(` -@@ -887,6 +1546,10 @@ optional_policy(` +@@ -887,6 +1550,10 @@ optional_policy(` ') optional_policy(` @@ -39131,7 +39135,7 @@ index 17eda2480..7d76c87ce 100644 # Set device ownerships/modes. xserver_setattr_console_pipes(initrc_t) -@@ -897,3 +1560,218 @@ optional_policy(` +@@ -897,3 +1564,218 @@ optional_policy(` optional_policy(` zebra_read_config(initrc_t) ') @@ -47002,10 +47006,10 @@ index 1447687d5..0b1da4d3e 100644 seutil_read_config(setrans_t) diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc -index 40edc18ab..95f4458d2 100644 +index 40edc18ab..be7317733 100644 --- a/policy/modules/system/sysnetwork.fc +++ b/policy/modules/system/sysnetwork.fc -@@ -17,23 +17,29 @@ ifdef(`distro_debian',` +@@ -17,23 +17,31 @@ ifdef(`distro_debian',` /etc/dhclient.*conf -- gen_context(system_u:object_r:dhcp_etc_t,s0) /etc/dhclient-script -- gen_context(system_u:object_r:dhcp_etc_t,s0) /etc/dhcpc.* gen_context(system_u:object_r:dhcp_etc_t,s0) @@ -47037,10 +47041,12 @@ index 40edc18ab..95f4458d2 100644 +/var/run/systemd/resolve/resolv\.conf -- gen_context(system_u:object_r:net_conf_t,s0) ') +/var/run/NetworkManager/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0) ++ ++/var/run/cloud-init(/.*)? gen_context(system_u:object_r:net_conf_t,s0) # # /sbin -@@ -44,6 +50,7 @@ ifdef(`distro_redhat',` +@@ -44,6 +52,7 @@ ifdef(`distro_redhat',` /sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0) /sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0) /sbin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0) @@ -47048,7 +47054,7 @@ index 40edc18ab..95f4458d2 100644 /sbin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0) /sbin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0) /sbin/ipx_internal_net -- gen_context(system_u:object_r:ifconfig_exec_t,s0) -@@ -55,6 +62,21 @@ ifdef(`distro_redhat',` +@@ -55,6 +64,21 @@ ifdef(`distro_redhat',` # # /usr # @@ -47070,7 +47076,7 @@ index 40edc18ab..95f4458d2 100644 /usr/sbin/tc -- gen_context(system_u:object_r:ifconfig_exec_t,s0) # -@@ -77,3 +99,6 @@ ifdef(`distro_debian',` +@@ -77,3 +101,6 @@ ifdef(`distro_debian',` /var/run/network(/.*)? gen_context(system_u:object_r:net_conf_t,s0) ') @@ -47078,7 +47084,7 @@ index 40edc18ab..95f4458d2 100644 +/etc/firestarter/firestarter\.sh gen_context(system_u:object_r:dhcpc_helper_exec_t,s0) + diff --git a/policy/modules/system/sysnetwork.if b/policy/modules/system/sysnetwork.if -index 2cea692c0..e3cb4f2ef 100644 +index 2cea692c0..853ddefe4 100644 --- a/policy/modules/system/sysnetwork.if +++ b/policy/modules/system/sysnetwork.if @@ -38,11 +38,30 @@ interface(`sysnet_domtrans_dhcpc',` @@ -47505,7 +47511,7 @@ index 2cea692c0..e3cb4f2ef 100644 corenet_tcp_sendrecv_generic_if($1) corenet_udp_sendrecv_generic_if($1) corenet_tcp_sendrecv_generic_node($1) -@@ -796,3 +1057,144 @@ interface(`sysnet_use_portmap',` +@@ -796,3 +1057,162 @@ interface(`sysnet_use_portmap',` sysnet_read_config($1) ') @@ -47650,6 +47656,24 @@ index 2cea692c0..e3cb4f2ef 100644 + + files_etc_filetrans($1, net_conf_t, file) +') ++ ++######################################## ++## ++## Transition to cloud-init named content ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`sysnet_filetrans_cloud_net_conf',` ++ gen_require(` ++ type net_conf_t; ++ ') ++ ++ files_pid_filetrans($1, net_conf_t, dir, "cloud-init") ++') diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te index a392fc4bc..95c64150b 100644 --- a/policy/modules/system/sysnetwork.te @@ -50034,10 +50058,10 @@ index 000000000..634d9596a +') diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te new file mode 100644 -index 000000000..1927b4fc0 +index 000000000..9be88b524 --- /dev/null +++ b/policy/modules/system/systemd.te -@@ -0,0 +1,1025 @@ +@@ -0,0 +1,1027 @@ +policy_module(systemd, 1.0.0) + +####################################### @@ -50972,6 +50996,8 @@ index 000000000..1927b4fc0 +dev_read_sysfs(systemd_resolved_t) + +sysnet_manage_config(systemd_resolved_t) ++sysnet_filetrans_config_fromdir(systemd_resolved_t,systemd_resolved_var_run_t, file, "resolv.conf") ++sysnet_filetrans_config_fromdir(systemd_resolved_t,systemd_resolved_var_run_t, file, "resolv.conf.tmp") + +userdom_dbus_send_all_users(systemd_resolved_t) + diff --git a/policy-f27-contrib.patch b/policy-f27-contrib.patch index e27883e..500c1ec 100644 --- a/policy-f27-contrib.patch +++ b/policy-f27-contrib.patch @@ -97090,7 +97090,7 @@ index 50d07fb2e..a34db489c 100644 + allow $1 samba_unit_file_t:service all_service_perms; ') diff --git a/samba.te b/samba.te -index 2b7c441e7..5d52fba0f 100644 +index 2b7c441e7..fe92353b2 100644 --- a/samba.te +++ b/samba.te @@ -6,99 +6,86 @@ policy_module(samba, 1.16.3) @@ -97459,10 +97459,12 @@ index 2b7c441e7..5d52fba0f 100644 manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t) allow smbd_t samba_share_t:filesystem { getattr quotaget }; -@@ -298,65 +322,72 @@ manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t) +@@ -297,66 +321,74 @@ manage_files_pattern(smbd_t, samba_var_t, samba_var_t) + manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_sock_files_pattern(smbd_t, samba_var_t, samba_var_t) files_var_filetrans(smbd_t, samba_var_t, dir, "samba") - ++allow smbd_t samba_var_t:file { map } ; ++ +manage_dirs_pattern(smbd_t, samba_spool_t, samba_spool_t) +manage_files_pattern(smbd_t, samba_spool_t, samba_spool_t) +manage_lnk_files_pattern(smbd_t, samba_spool_t, samba_spool_t) @@ -97471,7 +97473,7 @@ index 2b7c441e7..5d52fba0f 100644 + +allow smbd_t smbcontrol_t:process { signal signull }; +allow smbd_t smbcontrol_t:unix_dgram_socket sendto; -+ + manage_dirs_pattern(smbd_t, smbd_tmp_t, smbd_tmp_t) manage_files_pattern(smbd_t, smbd_tmp_t, smbd_tmp_t) files_tmp_filetrans(smbd_t, smbd_tmp_t, { file dir }) @@ -97556,7 +97558,7 @@ index 2b7c441e7..5d52fba0f 100644 fs_getattr_all_fs(smbd_t) fs_getattr_all_dirs(smbd_t) -@@ -366,44 +397,53 @@ fs_getattr_rpc_dirs(smbd_t) +@@ -366,44 +398,53 @@ fs_getattr_rpc_dirs(smbd_t) fs_list_inotifyfs(smbd_t) fs_get_all_fs_quotas(smbd_t) @@ -97622,7 +97624,7 @@ index 2b7c441e7..5d52fba0f 100644 ') tunable_policy(`samba_domain_controller',` -@@ -419,20 +459,16 @@ tunable_policy(`samba_domain_controller',` +@@ -419,20 +460,16 @@ tunable_policy(`samba_domain_controller',` ') tunable_policy(`samba_enable_home_dirs',` @@ -97649,7 +97651,7 @@ index 2b7c441e7..5d52fba0f 100644 tunable_policy(`samba_share_nfs',` fs_manage_nfs_dirs(smbd_t) fs_manage_nfs_files(smbd_t) -@@ -441,6 +477,7 @@ tunable_policy(`samba_share_nfs',` +@@ -441,6 +478,7 @@ tunable_policy(`samba_share_nfs',` fs_manage_nfs_named_sockets(smbd_t) ') @@ -97657,7 +97659,7 @@ index 2b7c441e7..5d52fba0f 100644 tunable_policy(`samba_share_fusefs',` fs_manage_fusefs_dirs(smbd_t) fs_manage_fusefs_files(smbd_t) -@@ -448,15 +485,10 @@ tunable_policy(`samba_share_fusefs',` +@@ -448,15 +486,10 @@ tunable_policy(`samba_share_fusefs',` fs_search_fusefs(smbd_t) ') @@ -97677,7 +97679,7 @@ index 2b7c441e7..5d52fba0f 100644 ') optional_policy(` -@@ -466,6 +498,7 @@ optional_policy(` +@@ -466,6 +499,7 @@ optional_policy(` optional_policy(` ctdbd_stream_connect(smbd_t) ctdbd_manage_lib_files(smbd_t) @@ -97685,7 +97687,7 @@ index 2b7c441e7..5d52fba0f 100644 ') optional_policy(` -@@ -474,11 +507,31 @@ optional_policy(` +@@ -474,11 +508,31 @@ optional_policy(` ') optional_policy(` @@ -97717,7 +97719,7 @@ index 2b7c441e7..5d52fba0f 100644 lpd_exec_lpr(smbd_t) ') -@@ -488,6 +541,10 @@ optional_policy(` +@@ -488,6 +542,10 @@ optional_policy(` ') optional_policy(` @@ -97728,7 +97730,7 @@ index 2b7c441e7..5d52fba0f 100644 rpc_search_nfs_state_data(smbd_t) ') -@@ -499,12 +556,53 @@ optional_policy(` +@@ -499,12 +557,53 @@ optional_policy(` udev_read_db(smbd_t) ') @@ -97783,7 +97785,7 @@ index 2b7c441e7..5d52fba0f 100644 allow nmbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow nmbd_t self:fd use; allow nmbd_t self:fifo_file rw_fifo_file_perms; -@@ -512,9 +610,11 @@ allow nmbd_t self:msg { send receive }; +@@ -512,9 +611,11 @@ allow nmbd_t self:msg { send receive }; allow nmbd_t self:msgq create_msgq_perms; allow nmbd_t self:sem create_sem_perms; allow nmbd_t self:shm create_shm_perms; @@ -97798,7 +97800,7 @@ index 2b7c441e7..5d52fba0f 100644 manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t) manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t) -@@ -526,20 +626,16 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) +@@ -526,20 +627,16 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t) @@ -97823,7 +97825,7 @@ index 2b7c441e7..5d52fba0f 100644 kernel_getattr_core_if(nmbd_t) kernel_getattr_message_if(nmbd_t) -@@ -547,53 +643,44 @@ kernel_read_kernel_sysctls(nmbd_t) +@@ -547,53 +644,44 @@ kernel_read_kernel_sysctls(nmbd_t) kernel_read_network_state(nmbd_t) kernel_read_software_raid_state(nmbd_t) kernel_read_system_state(nmbd_t) @@ -97892,7 +97894,7 @@ index 2b7c441e7..5d52fba0f 100644 ') optional_policy(` -@@ -606,18 +693,29 @@ optional_policy(` +@@ -606,18 +694,29 @@ optional_policy(` ######################################## # @@ -97928,7 +97930,7 @@ index 2b7c441e7..5d52fba0f 100644 samba_read_config(smbcontrol_t) samba_search_var(smbcontrol_t) -@@ -627,39 +725,38 @@ domain_use_interactive_fds(smbcontrol_t) +@@ -627,39 +726,38 @@ domain_use_interactive_fds(smbcontrol_t) dev_read_urand(smbcontrol_t) @@ -97980,7 +97982,7 @@ index 2b7c441e7..5d52fba0f 100644 allow smbmount_t samba_secrets_t:file manage_file_perms; -@@ -668,26 +765,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) +@@ -668,26 +766,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t) files_var_filetrans(smbmount_t, samba_var_t, dir, "samba") @@ -98016,7 +98018,7 @@ index 2b7c441e7..5d52fba0f 100644 fs_getattr_cifs(smbmount_t) fs_mount_cifs(smbmount_t) -@@ -699,58 +792,77 @@ fs_read_cifs_files(smbmount_t) +@@ -699,58 +793,77 @@ fs_read_cifs_files(smbmount_t) storage_raw_read_fixed_disk(smbmount_t) storage_raw_write_fixed_disk(smbmount_t) @@ -98109,7 +98111,7 @@ index 2b7c441e7..5d52fba0f 100644 manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t) manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t) -@@ -759,17 +871,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) +@@ -759,17 +872,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t) files_pid_filetrans(swat_t, swat_var_run_t, file) @@ -98133,7 +98135,7 @@ index 2b7c441e7..5d52fba0f 100644 kernel_read_kernel_sysctls(swat_t) kernel_read_system_state(swat_t) -@@ -777,36 +885,25 @@ kernel_read_network_state(swat_t) +@@ -777,36 +886,25 @@ kernel_read_network_state(swat_t) corecmd_search_bin(swat_t) @@ -98176,7 +98178,7 @@ index 2b7c441e7..5d52fba0f 100644 auth_domtrans_chk_passwd(swat_t) auth_use_nsswitch(swat_t) -@@ -818,10 +915,11 @@ logging_send_syslog_msg(swat_t) +@@ -818,10 +916,11 @@ logging_send_syslog_msg(swat_t) logging_send_audit_msgs(swat_t) logging_search_logs(swat_t) @@ -98190,7 +98192,7 @@ index 2b7c441e7..5d52fba0f 100644 optional_policy(` cups_read_rw_config(swat_t) cups_stream_connect(swat_t) -@@ -840,17 +938,20 @@ optional_policy(` +@@ -840,17 +939,20 @@ optional_policy(` # Winbind local policy # @@ -98217,7 +98219,7 @@ index 2b7c441e7..5d52fba0f 100644 allow winbind_t samba_etc_t:dir list_dir_perms; read_files_pattern(winbind_t, samba_etc_t, samba_etc_t) -@@ -860,9 +961,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) +@@ -860,9 +962,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file) manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t) @@ -98228,7 +98230,7 @@ index 2b7c441e7..5d52fba0f 100644 manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t) manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t) -@@ -871,40 +970,44 @@ manage_lnk_files_pattern(winbind_t, samba_var_t, samba_var_t) +@@ -871,40 +971,44 @@ manage_lnk_files_pattern(winbind_t, samba_var_t, samba_var_t) manage_sock_files_pattern(winbind_t, samba_var_t, samba_var_t) files_var_filetrans(winbind_t, samba_var_t, dir, "samba") @@ -98285,7 +98287,7 @@ index 2b7c441e7..5d52fba0f 100644 corenet_tcp_connect_smbd_port(winbind_t) corenet_tcp_connect_epmap_port(winbind_t) corenet_tcp_connect_all_unreserved_ports(winbind_t) -@@ -912,38 +1015,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) +@@ -912,38 +1016,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) dev_read_sysfs(winbind_t) dev_read_urand(winbind_t) @@ -98344,7 +98346,7 @@ index 2b7c441e7..5d52fba0f 100644 ') optional_policy(` -@@ -959,31 +1076,36 @@ optional_policy(` +@@ -959,31 +1077,36 @@ optional_policy(` # Winbind helper local policy # @@ -98388,7 +98390,7 @@ index 2b7c441e7..5d52fba0f 100644 optional_policy(` apache_append_log(winbind_helper_t) -@@ -997,25 +1119,38 @@ optional_policy(` +@@ -997,25 +1120,38 @@ optional_policy(` ######################################## # @@ -111592,10 +111594,10 @@ index 000000000..368e18842 +') diff --git a/tlp.te b/tlp.te new file mode 100644 -index 000000000..761cc35b0 +index 000000000..1ef713150 --- /dev/null +++ b/tlp.te -@@ -0,0 +1,80 @@ +@@ -0,0 +1,84 @@ +policy_module(tlp, 1.0.0) + +######################################## @@ -111676,6 +111678,10 @@ index 000000000..761cc35b0 +optional_policy(` + mount_domtrans(tlp_t) +') ++ ++optional_policy(` ++ sssd_stream_connect(tlp_t) ++') diff --git a/tmpreaper.te b/tmpreaper.te index 585a77f95..a7cb3263d 100644 --- a/tmpreaper.te @@ -117063,7 +117069,7 @@ index facdee8b3..2a619ba9e 100644 + dgram_send_pattern($1, virt_var_run_t, virt_var_run_t, virtd_t) ') diff --git a/virt.te b/virt.te -index f03dcf567..cf9950e36 100644 +index f03dcf567..915a13a07 100644 --- a/virt.te +++ b/virt.te @@ -1,451 +1,424 @@ @@ -117301,11 +117307,11 @@ index f03dcf567..cf9950e36 100644 -virt_domain_template(svirt_prot_exec) +role system_r types svirt_t; +typealias svirt_t alias qemu_t; - --type virt_cache_t alias svirt_cache_t; ++ +virt_domain_template(svirt_tcg) +role system_r types svirt_tcg_t; -+ + +-type virt_cache_t alias svirt_cache_t; +type qemu_exec_t, virt_file_type; + +type virt_cache_t alias svirt_cache_t, virt_file_type; @@ -117668,37 +117674,37 @@ index f03dcf567..cf9950e36 100644 -list_dirs_pattern(svirt_t, virt_content_t, virt_content_t) -read_files_pattern(svirt_t, virt_content_t, virt_content_t) -+allow svirt_t self:process ptrace; - +- -dontaudit svirt_t virt_content_t:file write_file_perms; -dontaudit svirt_t virt_content_t:dir rw_dir_perms; -+# it was a part of auth_use_nsswitch -+allow svirt_t self:netlink_route_socket r_netlink_socket_perms; - +- -append_files_pattern(svirt_t, virt_home_t, virt_home_t) -manage_dirs_pattern(svirt_t, svirt_home_t, svirt_home_t) -manage_files_pattern(svirt_t, svirt_home_t, svirt_home_t) -manage_sock_files_pattern(svirt_t, svirt_home_t, svirt_home_t) -- ++allow svirt_t self:process ptrace; + -filetrans_pattern(svirt_t, virt_home_t, svirt_home_t, dir, "qemu") - -stream_connect_pattern(svirt_t, svirt_home_t, svirt_home_t, virtd_t) -- --corenet_udp_sendrecv_generic_if(svirt_t) --corenet_udp_sendrecv_generic_node(svirt_t) --corenet_udp_sendrecv_all_ports(svirt_t) --corenet_udp_bind_generic_node(svirt_t) ++# it was a part of auth_use_nsswitch ++allow svirt_t self:netlink_route_socket r_netlink_socket_perms; + + corenet_udp_sendrecv_generic_if(svirt_t) + corenet_udp_sendrecv_generic_node(svirt_t) + corenet_udp_sendrecv_all_ports(svirt_t) + corenet_udp_bind_generic_node(svirt_t) - -corenet_all_recvfrom_unlabeled(svirt_t) -corenet_all_recvfrom_netlabel(svirt_t) -corenet_tcp_sendrecv_generic_if(svirt_t) - corenet_udp_sendrecv_generic_if(svirt_t) +-corenet_udp_sendrecv_generic_if(svirt_t) -corenet_tcp_sendrecv_generic_node(svirt_t) - corenet_udp_sendrecv_generic_node(svirt_t) +-corenet_udp_sendrecv_generic_node(svirt_t) -corenet_tcp_sendrecv_all_ports(svirt_t) - corenet_udp_sendrecv_all_ports(svirt_t) +-corenet_udp_sendrecv_all_ports(svirt_t) -corenet_tcp_bind_generic_node(svirt_t) - corenet_udp_bind_generic_node(svirt_t) +-corenet_udp_bind_generic_node(svirt_t) - -corenet_sendrecv_all_server_packets(svirt_t) corenet_udp_bind_all_ports(svirt_t) @@ -117863,12 +117869,12 @@ index f03dcf567..cf9950e36 100644 -stream_connect_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t, virtd_lxc_t) -stream_connect_pattern(virtd_t, svirt_var_run_t, svirt_var_run_t, virt_domain) -- --can_exec(virtd_t, virt_tmp_t) +# libvirtd is permitted to talk to virtlogd +stream_connect_pattern(virtd_t, virt_var_run_t, virtlogd_var_run_t, virtlogd_t) +allow virtd_t virtlogd_t:fifo_file rw_inherited_fifo_file_perms; +-can_exec(virtd_t, virt_tmp_t) +- -kernel_read_crypto_sysctls(virtd_t) kernel_read_system_state(virtd_t) kernel_read_network_state(virtd_t) @@ -117968,13 +117974,13 @@ index f03dcf567..cf9950e36 100644 +sysnet_read_config(virtd_t) -userdom_read_all_users_state(virtd_t) -+systemd_dbus_chat_logind(virtd_t) -+systemd_write_inhibit_pipes(virtd_t) - +- -ifdef(`hide_broken_symptoms',` - dontaudit virtd_t self:capability { sys_module sys_ptrace }; -') -- ++systemd_dbus_chat_logind(virtd_t) ++systemd_write_inhibit_pipes(virtd_t) + -tunable_policy(`virt_use_fusefs',` - fs_manage_fusefs_dirs(virtd_t) - fs_manage_fusefs_files(virtd_t) @@ -118028,7 +118034,7 @@ index f03dcf567..cf9950e36 100644 ') optional_policy(` -@@ -691,99 +653,433 @@ optional_policy(` +@@ -691,99 +653,437 @@ optional_policy(` dnsmasq_kill(virtd_t) dnsmasq_signull(virtd_t) dnsmasq_create_pid_dirs(virtd_t) @@ -118172,6 +118178,10 @@ index f03dcf567..cf9950e36 100644 + fs_append_nfs_files(virtlogd_t) +') + ++optional_policy(` ++ systemd_write_inhibit_pipes(virtlogd_t) ++') ++ +######################################## +# +# virtual domains common policy @@ -118359,18 +118369,16 @@ index f03dcf567..cf9950e36 100644 + fs_manage_fusefs_files(virt_domain) + fs_read_fusefs_symlinks(virt_domain) + fs_getattr_fusefs(virt_domain) - ') - - optional_policy(` -- lvm_domtrans(virtd_t) ++') ++ ++optional_policy(` + tunable_policy(`virt_use_glusterd',` + glusterd_manage_pid(virt_domain) + ') ') -optional_policy(` -- mount_domtrans(virtd_t) -- mount_signal(virtd_t) +- lvm_domtrans(virtd_t) +tunable_policy(`virt_use_nfs',` + fs_manage_nfs_dirs(virt_domain) + fs_manage_nfs_files(virt_domain) @@ -118380,9 +118388,8 @@ index f03dcf567..cf9950e36 100644 ') -optional_policy(` -- policykit_domtrans_auth(virtd_t) -- policykit_domtrans_resolve(virtd_t) -- policykit_read_lib(virtd_t) +- mount_domtrans(virtd_t) +- mount_signal(virtd_t) +tunable_policy(`virt_use_samba',` + fs_manage_cifs_dirs(virt_domain) + fs_manage_cifs_files(virt_domain) @@ -118392,7 +118399,9 @@ index f03dcf567..cf9950e36 100644 ') -optional_policy(` -- qemu_exec(virtd_t) +- policykit_domtrans_auth(virtd_t) +- policykit_domtrans_resolve(virtd_t) +- policykit_read_lib(virtd_t) +tunable_policy(`virt_use_usb',` + dev_rw_usbfs(virt_domain) + dev_read_sysfs(virt_domain) @@ -118403,20 +118412,23 @@ index f03dcf567..cf9950e36 100644 ') optional_policy(` -- sasl_connect(virtd_t) +- qemu_exec(virtd_t) + tunable_policy(`virt_use_pcscd',` + pcscd_stream_connect(virt_domain) + ') ') optional_policy(` -- kernel_read_xen_state(virtd_t) -- kernel_write_xen_state(virtd_t) +- sasl_connect(virtd_t) + tunable_policy(`virt_use_sanlock',` + sanlock_stream_connect(virt_domain) + ') -+') + ') +-optional_policy(` +- kernel_read_xen_state(virtd_t) +- kernel_write_xen_state(virtd_t) +- - xen_exec(virtd_t) - xen_stream_connect(virtd_t) - xen_stream_connect_xenstore(virtd_t) @@ -118511,7 +118523,7 @@ index f03dcf567..cf9950e36 100644 kernel_read_system_state(virsh_t) kernel_read_network_state(virsh_t) kernel_read_kernel_sysctls(virsh_t) -@@ -794,25 +1090,18 @@ kernel_write_xen_state(virsh_t) +@@ -794,25 +1094,18 @@ kernel_write_xen_state(virsh_t) corecmd_exec_bin(virsh_t) corecmd_exec_shell(virsh_t) @@ -118538,7 +118550,7 @@ index f03dcf567..cf9950e36 100644 fs_getattr_all_fs(virsh_t) fs_manage_xenfs_dirs(virsh_t) -@@ -821,23 +1110,25 @@ fs_search_auto_mountpoints(virsh_t) +@@ -821,23 +1114,25 @@ fs_search_auto_mountpoints(virsh_t) storage_raw_read_fixed_disk(virsh_t) @@ -118572,7 +118584,7 @@ index f03dcf567..cf9950e36 100644 tunable_policy(`virt_use_nfs',` fs_manage_nfs_dirs(virsh_t) -@@ -856,14 +1147,20 @@ optional_policy(` +@@ -856,14 +1151,20 @@ optional_policy(` ') optional_policy(` @@ -118594,7 +118606,7 @@ index f03dcf567..cf9950e36 100644 xen_stream_connect(virsh_t) xen_stream_connect_xenstore(virsh_t) ') -@@ -888,49 +1185,66 @@ optional_policy(` +@@ -888,49 +1189,66 @@ optional_policy(` kernel_read_xen_state(virsh_ssh_t) kernel_write_xen_state(virsh_ssh_t) @@ -118679,7 +118691,7 @@ index f03dcf567..cf9950e36 100644 corecmd_exec_bin(virtd_lxc_t) corecmd_exec_shell(virtd_lxc_t) -@@ -942,17 +1256,16 @@ dev_read_urand(virtd_lxc_t) +@@ -942,17 +1260,16 @@ dev_read_urand(virtd_lxc_t) domain_use_interactive_fds(virtd_lxc_t) @@ -118699,7 +118711,7 @@ index f03dcf567..cf9950e36 100644 fs_getattr_all_fs(virtd_lxc_t) fs_manage_tmpfs_dirs(virtd_lxc_t) fs_manage_tmpfs_chr_files(virtd_lxc_t) -@@ -964,8 +1277,23 @@ fs_rw_cgroup_files(virtd_lxc_t) +@@ -964,15 +1281,11 @@ fs_rw_cgroup_files(virtd_lxc_t) fs_unmount_all_fs(virtd_lxc_t) fs_relabelfrom_tmpfs(virtd_lxc_t) @@ -118707,72 +118719,125 @@ index f03dcf567..cf9950e36 100644 + selinux_mount_fs(virtd_lxc_t) selinux_unmount_fs(virtd_lxc_t) +-selinux_get_enforce_mode(virtd_lxc_t) +-selinux_get_fs_mount(virtd_lxc_t) +-selinux_validate_context(virtd_lxc_t) +-selinux_compute_access_vector(virtd_lxc_t) +-selinux_compute_create_context(virtd_lxc_t) +-selinux_compute_relabel_context(virtd_lxc_t) +-selinux_compute_user_contexts(virtd_lxc_t) +seutil_read_config(virtd_lxc_t) -+ -+term_use_generic_ptys(virtd_lxc_t) -+term_use_ptmx(virtd_lxc_t) -+term_relabel_pty_fs(virtd_lxc_t) -+ -+auth_use_nsswitch(virtd_lxc_t) -+ -+logging_send_syslog_msg(virtd_lxc_t) -+ -+seutil_domtrans_setfiles(virtd_lxc_t) -+seutil_read_default_contexts(virtd_lxc_t) -+ - selinux_get_enforce_mode(virtd_lxc_t) - selinux_get_fs_mount(virtd_lxc_t) - selinux_validate_context(virtd_lxc_t) -@@ -974,194 +1302,296 @@ selinux_compute_create_context(virtd_lxc_t) - selinux_compute_relabel_context(virtd_lxc_t) - selinux_compute_user_contexts(virtd_lxc_t) --term_use_generic_ptys(virtd_lxc_t) --term_use_ptmx(virtd_lxc_t) --term_relabel_pty_fs(virtd_lxc_t) + term_use_generic_ptys(virtd_lxc_t) + term_use_ptmx(virtd_lxc_t) +@@ -982,186 +1295,307 @@ auth_use_nsswitch(virtd_lxc_t) + + logging_send_syslog_msg(virtd_lxc_t) + +-miscfiles_read_localization(virtd_lxc_t) +- + seutil_domtrans_setfiles(virtd_lxc_t) +-seutil_read_config(virtd_lxc_t) + seutil_read_default_contexts(virtd_lxc_t) + +-sysnet_domtrans_ifconfig(virtd_lxc_t) +- +-######################################## +-# +-# Common virt lxc domain local policy +-# +- +-allow svirt_lxc_domain self:capability { kill setuid setgid dac_override sys_boot }; +-allow svirt_lxc_domain self:process { execstack execmem getattr signal_perms getsched setsched setcap setpgid }; +-allow svirt_lxc_domain self:fifo_file manage_file_perms; +-allow svirt_lxc_domain self:sem create_sem_perms; +-allow svirt_lxc_domain self:shm create_shm_perms; +-allow svirt_lxc_domain self:msgq create_msgq_perms; +-allow svirt_lxc_domain self:unix_stream_socket { create_stream_socket_perms connectto }; +-allow svirt_lxc_domain self:unix_dgram_socket { sendto create_socket_perms }; ++selinux_get_enforce_mode(virtd_lxc_t) ++selinux_get_fs_mount(virtd_lxc_t) ++selinux_validate_context(virtd_lxc_t) ++selinux_compute_access_vector(virtd_lxc_t) ++selinux_compute_create_context(virtd_lxc_t) ++selinux_compute_relabel_context(virtd_lxc_t) ++selinux_compute_user_contexts(virtd_lxc_t) + +-allow svirt_lxc_domain virtd_lxc_t:fd use; +-allow svirt_lxc_domain virtd_lxc_t:fifo_file rw_fifo_file_perms; +-allow svirt_lxc_domain virtd_lxc_t:process sigchld; +sysnet_exec_ifconfig(virtd_lxc_t) --auth_use_nsswitch(virtd_lxc_t) +-allow svirt_lxc_domain virtd_lxc_t:unix_stream_socket { connectto rw_socket_perms }; +systemd_dbus_chat_machined(virtd_lxc_t) --logging_send_syslog_msg(virtd_lxc_t) +-allow svirt_lxc_domain virsh_t:fd use; +-allow svirt_lxc_domain virsh_t:fifo_file rw_fifo_file_perms; +-allow svirt_lxc_domain virsh_t:process sigchld; +userdom_read_admin_home_files(virtd_lxc_t) --miscfiles_read_localization(virtd_lxc_t) +-allow svirt_lxc_domain virtd_lxc_var_run_t:dir list_dir_perms; +-allow svirt_lxc_domain virtd_lxc_var_run_t:file read_file_perms; +optional_policy(` + dbus_system_bus_client(virtd_lxc_t) + init_dbus_chat(virtd_lxc_t) --seutil_domtrans_setfiles(virtd_lxc_t) --seutil_read_config(virtd_lxc_t) --seutil_read_default_contexts(virtd_lxc_t) +-manage_dirs_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +-manage_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +-manage_lnk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +-manage_sock_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +-manage_fifo_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +-rw_chr_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) +-rw_blk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) + optional_policy(` + hal_dbus_chat(virtd_lxc_t) + ') +') --sysnet_domtrans_ifconfig(virtd_lxc_t) +-allow svirt_lxc_net_t svirt_lxc_file_t:dir mounton; +-allow svirt_lxc_net_t svirt_lxc_file_t:filesystem getattr; +optional_policy(` + container_exec_lib(virtd_lxc_t) +') -+ + +-can_exec(svirt_lxc_domain, svirt_lxc_file_t) +optional_policy(` + gnome_read_generic_cache_files(virtd_lxc_t) +') -+ + +-kernel_getattr_proc(svirt_lxc_domain) +-kernel_list_all_proc(svirt_lxc_domain) +-kernel_read_kernel_sysctls(svirt_lxc_domain) +-kernel_rw_net_sysctls(svirt_lxc_domain) +-kernel_read_system_state(svirt_lxc_domain) +-kernel_dontaudit_search_kernel_sysctl(svirt_lxc_domain) +optional_policy(` + setrans_manage_pid_files(virtd_lxc_t) +') -+ + +-corecmd_exec_all_executables(svirt_lxc_domain) +optional_policy(` + unconfined_domain(virtd_lxc_t) +') - ######################################## - # --# Common virt lxc domain local policy +-files_dontaudit_getattr_all_dirs(svirt_lxc_domain) +-files_dontaudit_getattr_all_files(svirt_lxc_domain) +-files_dontaudit_getattr_all_symlinks(svirt_lxc_domain) +-files_dontaudit_getattr_all_pipes(svirt_lxc_domain) +-files_dontaudit_getattr_all_sockets(svirt_lxc_domain) +-files_dontaudit_list_all_mountpoints(svirt_lxc_domain) +-files_dontaudit_write_etc_runtime_files(svirt_lxc_domain) +-# files_entrypoint_all_files(svirt_lxc_domain) +-files_list_var(svirt_lxc_domain) +-files_list_var_lib(svirt_lxc_domain) +-files_search_all(svirt_lxc_domain) +-files_read_config_files(svirt_lxc_domain) +-files_read_usr_files(svirt_lxc_domain) +-files_read_usr_symlinks(svirt_lxc_domain) ++######################################## ++# +# svirt_sandbox_domain local policy - # ++# +allow svirt_sandbox_domain self:key manage_key_perms; +dontaudit svirt_sandbox_domain svirt_sandbox_domain:key search; + @@ -118796,7 +118861,9 @@ index f03dcf567..cf9950e36 100644 +tunable_policy(`deny_ptrace',`',` + allow svirt_sandbox_domain self:process ptrace; +') -+ + +-fs_getattr_all_fs(svirt_lxc_domain) +-fs_list_inotifyfs(svirt_lxc_domain) +allow virtd_t svirt_sandbox_domain:unix_stream_socket { create_stream_socket_perms connectto }; +allow virtd_t svirt_sandbox_domain:process { signal_perms getattr }; +allow virtd_lxc_t svirt_sandbox_domain:process { getattr getsched setsched setrlimit transition signal_perms }; @@ -118886,113 +118953,43 @@ index f03dcf567..cf9950e36 100644 +userdom_use_inherited_user_terminals(svirt_sandbox_domain) +userdom_dontaudit_append_inherited_admin_home_file(svirt_sandbox_domain) +userdom_dontaudit_read_inherited_admin_home_files(svirt_sandbox_domain) -+ + +-# fs_rw_inherited_tmpfs_files(svirt_lxc_domain) +-# fs_rw_inherited_cifs_files(svirt_lxc_domain) +-# fs_rw_inherited_noxattr_fs_files(svirt_lxc_domain) +optional_policy(` +tunable_policy(`virt_sandbox_share_apache_content',` + apache_exec_modules(svirt_sandbox_domain) + apache_read_sys_content(svirt_sandbox_domain) + ') +') -+ -+optional_policy(` -+ mta_dontaudit_read_spool_symlinks(svirt_sandbox_domain) -+') --allow svirt_lxc_domain self:capability { kill setuid setgid dac_override sys_boot }; --allow svirt_lxc_domain self:process { execstack execmem getattr signal_perms getsched setsched setcap setpgid }; --allow svirt_lxc_domain self:fifo_file manage_file_perms; --allow svirt_lxc_domain self:sem create_sem_perms; --allow svirt_lxc_domain self:shm create_shm_perms; --allow svirt_lxc_domain self:msgq create_msgq_perms; --allow svirt_lxc_domain self:unix_stream_socket { create_stream_socket_perms connectto }; --allow svirt_lxc_domain self:unix_dgram_socket { sendto create_socket_perms }; -- --allow svirt_lxc_domain virtd_lxc_t:fd use; --allow svirt_lxc_domain virtd_lxc_t:fifo_file rw_fifo_file_perms; --allow svirt_lxc_domain virtd_lxc_t:process sigchld; -- --allow svirt_lxc_domain virtd_lxc_t:unix_stream_socket { connectto rw_socket_perms }; -- --allow svirt_lxc_domain virsh_t:fd use; --allow svirt_lxc_domain virsh_t:fifo_file rw_fifo_file_perms; --allow svirt_lxc_domain virsh_t:process sigchld; -- --allow svirt_lxc_domain virtd_lxc_var_run_t:dir list_dir_perms; --allow svirt_lxc_domain virtd_lxc_var_run_t:file read_file_perms; -- --manage_dirs_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) --manage_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) --manage_lnk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) --manage_sock_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) --manage_fifo_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) --rw_chr_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) --rw_blk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t) -- --allow svirt_lxc_net_t svirt_lxc_file_t:dir mounton; --allow svirt_lxc_net_t svirt_lxc_file_t:filesystem getattr; -- --can_exec(svirt_lxc_domain, svirt_lxc_file_t) -- --kernel_getattr_proc(svirt_lxc_domain) --kernel_list_all_proc(svirt_lxc_domain) --kernel_read_kernel_sysctls(svirt_lxc_domain) --kernel_rw_net_sysctls(svirt_lxc_domain) --kernel_read_system_state(svirt_lxc_domain) --kernel_dontaudit_search_kernel_sysctl(svirt_lxc_domain) -- --corecmd_exec_all_executables(svirt_lxc_domain) -- --files_dontaudit_getattr_all_dirs(svirt_lxc_domain) --files_dontaudit_getattr_all_files(svirt_lxc_domain) --files_dontaudit_getattr_all_symlinks(svirt_lxc_domain) --files_dontaudit_getattr_all_pipes(svirt_lxc_domain) --files_dontaudit_getattr_all_sockets(svirt_lxc_domain) --files_dontaudit_list_all_mountpoints(svirt_lxc_domain) --files_dontaudit_write_etc_runtime_files(svirt_lxc_domain) --# files_entrypoint_all_files(svirt_lxc_domain) --files_list_var(svirt_lxc_domain) --files_list_var_lib(svirt_lxc_domain) --files_search_all(svirt_lxc_domain) --files_read_config_files(svirt_lxc_domain) --files_read_usr_files(svirt_lxc_domain) --files_read_usr_symlinks(svirt_lxc_domain) -- --fs_getattr_all_fs(svirt_lxc_domain) --fs_list_inotifyfs(svirt_lxc_domain) -- --# fs_rw_inherited_tmpfs_files(svirt_lxc_domain) --# fs_rw_inherited_cifs_files(svirt_lxc_domain) --# fs_rw_inherited_noxattr_fs_files(svirt_lxc_domain) -- -auth_dontaudit_read_login_records(svirt_lxc_domain) -auth_dontaudit_write_login_records(svirt_lxc_domain) -auth_search_pam_console_data(svirt_lxc_domain) -- ++optional_policy(` ++ mta_dontaudit_read_spool_symlinks(svirt_sandbox_domain) ++') + -clock_read_adjtime(svirt_lxc_domain) -- --init_read_utmp(svirt_lxc_domain) --init_dontaudit_write_utmp(svirt_lxc_domain) -- --libs_dontaudit_setattr_lib_files(svirt_lxc_domain) -- --miscfiles_read_localization(svirt_lxc_domain) --miscfiles_dontaudit_setattr_fonts_cache_dirs(svirt_lxc_domain) --miscfiles_read_fonts(svirt_lxc_domain) -- --mta_dontaudit_read_spool_symlinks(svirt_lxc_domain) +optional_policy(` + ssh_use_ptys(svirt_sandbox_domain) +') -+ + +-init_read_utmp(svirt_lxc_domain) +-init_dontaudit_write_utmp(svirt_lxc_domain) +optional_policy(` + udev_read_pid_files(svirt_sandbox_domain) +') - optional_policy(` -- udev_read_pid_files(svirt_lxc_domain) +-libs_dontaudit_setattr_lib_files(svirt_lxc_domain) ++optional_policy(` + userhelper_dontaudit_write_config(svirt_sandbox_domain) +') -+ + +-miscfiles_read_localization(svirt_lxc_domain) +-miscfiles_dontaudit_setattr_fonts_cache_dirs(svirt_lxc_domain) +-miscfiles_read_fonts(svirt_lxc_domain) +tunable_policy(`virt_use_nfs',` + fs_manage_nfs_dirs(svirt_sandbox_domain) + fs_manage_nfs_files(svirt_sandbox_domain) @@ -119003,7 +119000,8 @@ index f03dcf567..cf9950e36 100644 + fs_exec_nfs_files(svirt_sandbox_domain) + kernel_rw_fs_sysctls(svirt_sandbox_domain) +') -+ + +-mta_dontaudit_read_spool_symlinks(svirt_lxc_domain) +tunable_policy(`virt_use_samba',` + fs_manage_cifs_files(svirt_sandbox_domain) + fs_manage_cifs_dirs(svirt_sandbox_domain) @@ -119011,7 +119009,9 @@ index f03dcf567..cf9950e36 100644 + fs_manage_cifs_symlinks(svirt_sandbox_domain) + fs_exec_cifs_files(svirt_sandbox_domain) +') -+ + +-optional_policy(` +- udev_read_pid_files(svirt_lxc_domain) +tunable_policy(`virt_sandbox_use_fusefs',` + fs_manage_fusefs_dirs(svirt_sandbox_domain) + fs_manage_fusefs_files(svirt_sandbox_domain) @@ -119167,7 +119167,7 @@ index f03dcf567..cf9950e36 100644 allow virt_qmf_t self:tcp_socket create_stream_socket_perms; allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms; -@@ -1174,12 +1604,12 @@ dev_read_sysfs(virt_qmf_t) +@@ -1174,12 +1608,12 @@ dev_read_sysfs(virt_qmf_t) dev_read_rand(virt_qmf_t) dev_read_urand(virt_qmf_t) @@ -119182,7 +119182,7 @@ index f03dcf567..cf9950e36 100644 sysnet_read_config(virt_qmf_t) optional_policy(` -@@ -1192,7 +1622,7 @@ optional_policy(` +@@ -1192,7 +1626,7 @@ optional_policy(` ######################################## # @@ -119191,7 +119191,7 @@ index f03dcf567..cf9950e36 100644 # allow virt_bridgehelper_t self:process { setcap getcap }; -@@ -1201,11 +1631,264 @@ allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms; +@@ -1201,11 +1635,264 @@ allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms; allow virt_bridgehelper_t self:tun_socket create_socket_perms; allow virt_bridgehelper_t self:unix_dgram_socket create_socket_perms; diff --git a/selinux-policy.spec b/selinux-policy.spec index 7c70160..20de331 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 283.4%{?dist} +Release: 283.5%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -682,6 +682,13 @@ exit 0 %endif %changelog +* Fri Sep 29 2017 Lukas Vrabec - 3.13.1-283.5 +- Allow virtlogd_t domain to write inhibit systemd pipes. +- Allow smbd_t domain to mmap samba_var_t files BZ(1496319) +- Allow tlp_t domain stream connect to sssd_t domain +- Allow cloud-init to create /var/run/cloud-init dir with net_conf_t SELinux label.BZ(1489166) +- Make systemd resolved to create resolv.conf with correct label. + * Fri Sep 22 2017 Lukas Vrabec - 3.13.1-283.4 - Allow init noatsecure httpd_t - Allow mysqld_t domain to mmap mysqld db files. BZ(1483331)