From 0c6eef95d36a608144653622bb38f842a5560de2 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Aug 28 2017 16:08:50 +0000 Subject: * Mon Aug 28 2017 Lukas Vrabec - 3.13.1-277 - Allow cupsd_t to execute ld_so_cache - Add cgroup_seclabel policycap. - Allow xdm_t to read systemd hwdb - Add new interface systemd_hwdb_mmap_config() - Allow auditd_t domain to mmap conf files labeled as auditd_etc_t BZ(1485050) --- diff --git a/container-selinux.tgz b/container-selinux.tgz index cbeb3df..a7e7037 100644 Binary files a/container-selinux.tgz and b/container-selinux.tgz differ diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index 9a64a86..5fc6730 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -31132,7 +31132,7 @@ index 6bf0ecc2d..29db5fd25 100644 +') + diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te -index 8b403774f..fc04c66d5 100644 +index 8b403774f..a03fa4661 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -26,28 +26,66 @@ gen_require(` @@ -31733,7 +31733,7 @@ index 8b403774f..fc04c66d5 100644 storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t) -@@ -442,28 +650,48 @@ storage_dontaudit_raw_read_removable_device(xdm_t) +@@ -442,28 +650,50 @@ storage_dontaudit_raw_read_removable_device(xdm_t) storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t) @@ -31773,20 +31773,23 @@ index 8b403774f..fc04c66d5 100644 -miscfiles_read_localization(xdm_t) +miscfiles_search_man_pages(xdm_t) miscfiles_read_fonts(xdm_t) +- +-sysnet_read_config(xdm_t) +miscfiles_manage_fonts_cache(xdm_t) +miscfiles_manage_localization(xdm_t) +miscfiles_read_hwdata(xdm_t) - --sysnet_read_config(xdm_t) ++ +systemd_write_inhibit_pipes(xdm_t) +systemd_dbus_chat_localed(xdm_t) +systemd_dbus_chat_hostnamed(xdm_t) +systemd_start_power_services(xdm_t) +systemd_status_power_services(xdm_t) ++systemd_hwdb_mmap_config(xdm_t) ++systemd_hwdb_read_config(xdm_t) userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_create_all_users_keys(xdm_t) -@@ -472,24 +700,167 @@ userdom_read_user_home_content_files(xdm_t) +@@ -472,24 +702,167 @@ userdom_read_user_home_content_files(xdm_t) # Search /proc for any user domain processes. userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) @@ -31960,7 +31963,7 @@ index 8b403774f..fc04c66d5 100644 tunable_policy(`xdm_sysadm_login',` userdom_xsession_spec_domtrans_all_users(xdm_t) # FIXME: -@@ -502,12 +873,31 @@ tunable_policy(`xdm_sysadm_login',` +@@ -502,12 +875,31 @@ tunable_policy(`xdm_sysadm_login',` # allow xserver_t xdm_tmpfs_t:file rw_file_perms; ') @@ -31992,7 +31995,7 @@ index 8b403774f..fc04c66d5 100644 ') optional_policy(` -@@ -518,8 +908,36 @@ optional_policy(` +@@ -518,8 +910,36 @@ optional_policy(` dbus_system_bus_client(xdm_t) dbus_connect_system_bus(xdm_t) @@ -32016,12 +32019,12 @@ index 8b403774f..fc04c66d5 100644 + devicekit_dbus_chat_power(xdm_t) + ') + - optional_policy(` -- accountsd_dbus_chat(xdm_t) ++ optional_policy(` + hal_dbus_chat(xdm_t) + ') + -+ optional_policy(` + optional_policy(` +- accountsd_dbus_chat(xdm_t) + gnomeclock_dbus_chat(xdm_t) + ') + @@ -32030,7 +32033,7 @@ index 8b403774f..fc04c66d5 100644 ') ') -@@ -530,6 +948,20 @@ optional_policy(` +@@ -530,6 +950,20 @@ optional_policy(` ') optional_policy(` @@ -32051,7 +32054,7 @@ index 8b403774f..fc04c66d5 100644 hostname_exec(xdm_t) ') -@@ -547,28 +979,78 @@ optional_policy(` +@@ -547,28 +981,78 @@ optional_policy(` ') optional_policy(` @@ -32139,7 +32142,7 @@ index 8b403774f..fc04c66d5 100644 ') optional_policy(` -@@ -580,6 +1062,14 @@ optional_policy(` +@@ -580,6 +1064,14 @@ optional_policy(` ') optional_policy(` @@ -32154,7 +32157,7 @@ index 8b403774f..fc04c66d5 100644 xfs_stream_connect(xdm_t) ') -@@ -594,7 +1084,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t; +@@ -594,7 +1086,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t; type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t; allow xserver_t { root_xdrawable_t x_domain }:x_drawable send; @@ -32163,7 +32166,7 @@ index 8b403774f..fc04c66d5 100644 # setuid/setgid for the wrapper program to change UID # sys_rawio is for iopl access - should not be needed for frame-buffer -@@ -604,8 +1094,11 @@ allow xserver_t input_xevent_t:x_event send; +@@ -604,8 +1096,11 @@ allow xserver_t input_xevent_t:x_event send; # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack @@ -32176,7 +32179,7 @@ index 8b403774f..fc04c66d5 100644 allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow xserver_t self:fd use; allow xserver_t self:fifo_file rw_fifo_file_perms; -@@ -618,8 +1111,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; +@@ -618,8 +1113,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:udp_socket create_socket_perms; @@ -32192,7 +32195,7 @@ index 8b403774f..fc04c66d5 100644 manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) -@@ -627,6 +1127,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) +@@ -627,6 +1129,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file) @@ -32203,7 +32206,7 @@ index 8b403774f..fc04c66d5 100644 manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) -@@ -638,25 +1142,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) +@@ -638,25 +1144,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) files_search_var_lib(xserver_t) @@ -32245,7 +32248,7 @@ index 8b403774f..fc04c66d5 100644 corenet_all_recvfrom_netlabel(xserver_t) corenet_tcp_sendrecv_generic_if(xserver_t) corenet_udp_sendrecv_generic_if(xserver_t) -@@ -677,23 +1193,28 @@ dev_rw_apm_bios(xserver_t) +@@ -677,23 +1195,28 @@ dev_rw_apm_bios(xserver_t) dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) @@ -32277,7 +32280,7 @@ index 8b403774f..fc04c66d5 100644 # brought on by rhgb files_search_mnt(xserver_t) -@@ -705,6 +1226,14 @@ fs_search_nfs(xserver_t) +@@ -705,6 +1228,14 @@ fs_search_nfs(xserver_t) fs_search_auto_mountpoints(xserver_t) fs_search_ramfs(xserver_t) @@ -32292,7 +32295,7 @@ index 8b403774f..fc04c66d5 100644 mls_xwin_read_to_clearance(xserver_t) selinux_validate_context(xserver_t) -@@ -718,20 +1247,18 @@ init_getpgid(xserver_t) +@@ -718,20 +1249,18 @@ init_getpgid(xserver_t) term_setattr_unallocated_ttys(xserver_t) term_use_unallocated_ttys(xserver_t) @@ -32316,7 +32319,7 @@ index 8b403774f..fc04c66d5 100644 userdom_search_user_home_dirs(xserver_t) userdom_use_user_ttys(xserver_t) -@@ -739,8 +1266,6 @@ userdom_setattr_user_ttys(xserver_t) +@@ -739,8 +1268,6 @@ userdom_setattr_user_ttys(xserver_t) userdom_read_user_tmp_files(xserver_t) userdom_rw_user_tmpfs_files(xserver_t) @@ -32325,7 +32328,7 @@ index 8b403774f..fc04c66d5 100644 ifndef(`distro_redhat',` allow xserver_t self:process { execmem execheap execstack }; domain_mmap_low_uncond(xserver_t) -@@ -785,17 +1310,54 @@ optional_policy(` +@@ -785,17 +1312,54 @@ optional_policy(` ') optional_policy(` @@ -32382,7 +32385,7 @@ index 8b403774f..fc04c66d5 100644 ') optional_policy(` -@@ -803,6 +1365,10 @@ optional_policy(` +@@ -803,6 +1367,10 @@ optional_policy(` ') optional_policy(` @@ -32393,7 +32396,7 @@ index 8b403774f..fc04c66d5 100644 xfs_stream_connect(xserver_t) ') -@@ -818,18 +1384,17 @@ allow xserver_t xdm_t:shm rw_shm_perms; +@@ -818,18 +1386,17 @@ allow xserver_t xdm_t:shm rw_shm_perms; # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open # handle of a file inside the dir!!! @@ -32418,7 +32421,7 @@ index 8b403774f..fc04c66d5 100644 can_exec(xserver_t, xkb_var_lib_t) # VNC v4 module in X server -@@ -842,26 +1407,21 @@ init_use_fds(xserver_t) +@@ -842,26 +1409,21 @@ init_use_fds(xserver_t) # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_user_home_content_files(xserver_t) @@ -32453,7 +32456,7 @@ index 8b403774f..fc04c66d5 100644 ') optional_policy(` -@@ -912,7 +1472,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy +@@ -912,7 +1474,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show }; # operations allowed on my windows allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; @@ -32462,7 +32465,7 @@ index 8b403774f..fc04c66d5 100644 # operations allowed on all windows allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child }; -@@ -966,11 +1526,31 @@ allow x_domain self:x_resource { read write }; +@@ -966,11 +1528,31 @@ allow x_domain self:x_resource { read write }; # can mess with the screensaver allow x_domain xserver_t:x_screen { getattr saver_getattr }; @@ -32494,7 +32497,7 @@ index 8b403774f..fc04c66d5 100644 tunable_policy(`! xserver_object_manager',` # should be xserver_unconfined(x_domain), # but typeattribute doesnt work in conditionals -@@ -992,18 +1572,148 @@ tunable_policy(`! xserver_object_manager',` +@@ -992,18 +1574,148 @@ tunable_policy(`! xserver_object_manager',` allow x_domain xevent_type:{ x_event x_synthetic_event } *; ') @@ -41166,7 +41169,7 @@ index 4e9488463..e7d5f42a5 100644 +') + diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te -index 59b04c1a2..483fb780e 100644 +index 59b04c1a2..370f8a825 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -4,6 +4,29 @@ policy_module(logging, 1.20.1) @@ -41269,9 +41272,12 @@ index 59b04c1a2..483fb780e 100644 init_dontaudit_use_fds(auditctl_t) -@@ -136,9 +175,10 @@ allow auditd_t self:tcp_socket create_stream_socket_perms; +@@ -134,11 +173,12 @@ allow auditd_t self:fifo_file rw_fifo_file_perms; + allow auditd_t self:tcp_socket create_stream_socket_perms; + allow auditd_t auditd_etc_t:dir list_dir_perms; - allow auditd_t auditd_etc_t:file read_file_perms; +-allow auditd_t auditd_etc_t:file read_file_perms; ++allow auditd_t auditd_etc_t:file { read_file_perms map }; +manage_dirs_pattern(auditd_t, auditd_log_t, auditd_log_t) manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t) @@ -47157,10 +47163,10 @@ index 000000000..121b42208 +/var/run/initramfs(/.*)? <> diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if new file mode 100644 -index 000000000..278a1f69b +index 000000000..634d9596a --- /dev/null +++ b/policy/modules/system/systemd.if -@@ -0,0 +1,1843 @@ +@@ -0,0 +1,1862 @@ +## SELinux policy for systemd components + +###################################### @@ -48944,6 +48950,25 @@ index 000000000..278a1f69b + +######################################## +## ++## Allow process to mmap hwdb config file. ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++# ++interface(`systemd_hwdb_mmap_config',` ++ gen_require(` ++ type systemd_hwdb_etc_t; ++ ') ++ ++ allow $1 systemd_hwdb_etc_t:file map; ++') ++ ++######################################## ++## +## Allow process to manage hwdb config file. +## +## @@ -57067,15 +57092,22 @@ index f4ac38dc7..1589d6065 100644 + ssh_signal(confined_admindomain) +') diff --git a/policy/policy_capabilities b/policy/policy_capabilities -index db3cbca45..710bd7cd2 100644 +index db3cbca45..0728639e8 100644 --- a/policy/policy_capabilities +++ b/policy/policy_capabilities -@@ -31,3 +31,14 @@ policycap network_peer_controls; +@@ -31,3 +31,21 @@ policycap network_peer_controls; # blk_file: open # policycap open_perms; + + ++# Enable fine-grained labeling of cgroup and cgroup2 filesystems. ++# Requires Linux v4.11 and later. ++# ++# Added checks: ++# (none) ++#policycap cgroup_seclabel; ++ +# Enable NoNewPrivileges support. Requires libsepol 2.7+ +# and kernel 4.14 (estimated). +# diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index b27035a..0a5c4e1 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -21269,7 +21269,7 @@ index 3023be7f6..5afde8039 100644 + files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups") ') diff --git a/cups.te b/cups.te -index c91813ccb..8c014f781 100644 +index c91813ccb..e0ba2f7d9 100644 --- a/cups.te +++ b/cups.te @@ -5,19 +5,31 @@ policy_module(cups, 1.16.2) @@ -21546,7 +21546,7 @@ index c91813ccb..8c014f781 100644 selinux_compute_access_vector(cupsd_t) selinux_validate_context(cupsd_t) -@@ -244,22 +289,28 @@ auth_dontaudit_read_pam_pid(cupsd_t) +@@ -244,22 +289,29 @@ auth_dontaudit_read_pam_pid(cupsd_t) auth_rw_faillog(cupsd_t) auth_use_nsswitch(cupsd_t) @@ -21554,6 +21554,7 @@ index c91813ccb..8c014f781 100644 libs_exec_lib_files(cupsd_t) +libs_exec_ldconfig(cupsd_t) +libs_exec_ld_so(cupsd_t) ++libs_use_ld_so(cupsd_t) logging_send_audit_msgs(cupsd_t) logging_send_syslog_msg(cupsd_t) @@ -21580,7 +21581,7 @@ index c91813ccb..8c014f781 100644 optional_policy(` apm_domtrans_client(cupsd_t) -@@ -272,6 +323,8 @@ optional_policy(` +@@ -272,6 +324,8 @@ optional_policy(` optional_policy(` dbus_system_bus_client(cupsd_t) @@ -21589,7 +21590,7 @@ index c91813ccb..8c014f781 100644 userdom_dbus_send_all_users(cupsd_t) optional_policy(` -@@ -279,11 +332,17 @@ optional_policy(` +@@ -279,11 +333,17 @@ optional_policy(` ') optional_policy(` @@ -21607,7 +21608,7 @@ index c91813ccb..8c014f781 100644 ') ') -@@ -296,8 +355,8 @@ optional_policy(` +@@ -296,8 +356,8 @@ optional_policy(` ') optional_policy(` @@ -21617,7 +21618,7 @@ index c91813ccb..8c014f781 100644 ') optional_policy(` -@@ -306,7 +365,6 @@ optional_policy(` +@@ -306,7 +366,6 @@ optional_policy(` optional_policy(` lpd_exec_lpr(cupsd_t) @@ -21625,7 +21626,7 @@ index c91813ccb..8c014f781 100644 lpd_read_config(cupsd_t) lpd_relabel_spool(cupsd_t) ') -@@ -316,6 +374,10 @@ optional_policy(` +@@ -316,6 +375,10 @@ optional_policy(` ') optional_policy(` @@ -21636,7 +21637,7 @@ index c91813ccb..8c014f781 100644 samba_read_config(cupsd_t) samba_rw_var_files(cupsd_t) samba_stream_connect_nmbd(cupsd_t) -@@ -326,7 +388,7 @@ optional_policy(` +@@ -326,7 +389,7 @@ optional_policy(` ') optional_policy(` @@ -21645,7 +21646,7 @@ index c91813ccb..8c014f781 100644 ') optional_policy(` -@@ -334,7 +396,11 @@ optional_policy(` +@@ -334,7 +397,11 @@ optional_policy(` ') optional_policy(` @@ -21658,7 +21659,7 @@ index c91813ccb..8c014f781 100644 ') ######################################## -@@ -342,12 +408,11 @@ optional_policy(` +@@ -342,12 +409,11 @@ optional_policy(` # Configuration daemon local policy # @@ -21674,7 +21675,7 @@ index c91813ccb..8c014f781 100644 allow cupsd_config_t cupsd_t:process signal; ps_process_pattern(cupsd_config_t, cupsd_t) -@@ -367,23 +432,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t) +@@ -367,23 +433,23 @@ manage_dirs_pattern(cupsd_config_t, cupsd_tmp_t, cupsd_tmp_t) files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir }) allow cupsd_config_t cupsd_var_run_t:file read_file_perms; @@ -21702,7 +21703,7 @@ index c91813ccb..8c014f781 100644 corenet_all_recvfrom_netlabel(cupsd_config_t) corenet_tcp_sendrecv_generic_if(cupsd_config_t) corenet_tcp_sendrecv_generic_node(cupsd_config_t) -@@ -392,20 +457,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t) +@@ -392,20 +458,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t) corenet_sendrecv_all_client_packets(cupsd_config_t) corenet_tcp_connect_all_ports(cupsd_config_t) @@ -21723,7 +21724,7 @@ index c91813ccb..8c014f781 100644 fs_search_auto_mountpoints(cupsd_config_t) domain_use_interactive_fds(cupsd_config_t) -@@ -417,11 +474,6 @@ auth_use_nsswitch(cupsd_config_t) +@@ -417,11 +475,6 @@ auth_use_nsswitch(cupsd_config_t) logging_send_syslog_msg(cupsd_config_t) @@ -21735,7 +21736,7 @@ index c91813ccb..8c014f781 100644 userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t) userdom_dontaudit_search_user_home_dirs(cupsd_config_t) userdom_read_all_users_state(cupsd_config_t) -@@ -449,9 +501,12 @@ optional_policy(` +@@ -449,9 +502,12 @@ optional_policy(` ') optional_policy(` @@ -21749,7 +21750,7 @@ index c91813ccb..8c014f781 100644 ') optional_policy(` -@@ -467,6 +522,10 @@ optional_policy(` +@@ -467,6 +523,10 @@ optional_policy(` ') optional_policy(` @@ -21760,7 +21761,7 @@ index c91813ccb..8c014f781 100644 rpm_read_db(cupsd_config_t) ') -@@ -487,10 +546,6 @@ optional_policy(` +@@ -487,10 +547,6 @@ optional_policy(` # Lpd local policy # @@ -21771,7 +21772,7 @@ index c91813ccb..8c014f781 100644 allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms; allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms; -@@ -508,15 +563,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t) +@@ -508,15 +564,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t) kernel_read_kernel_sysctls(cupsd_lpd_t) kernel_read_system_state(cupsd_lpd_t) @@ -21789,7 +21790,7 @@ index c91813ccb..8c014f781 100644 corenet_tcp_sendrecv_ipp_port(cupsd_lpd_t) corenet_sendrecv_printer_server_packets(cupsd_lpd_t) -@@ -537,9 +592,6 @@ auth_use_nsswitch(cupsd_lpd_t) +@@ -537,9 +593,6 @@ auth_use_nsswitch(cupsd_lpd_t) logging_send_syslog_msg(cupsd_lpd_t) @@ -21799,7 +21800,7 @@ index c91813ccb..8c014f781 100644 optional_policy(` inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t) ') -@@ -549,9 +601,9 @@ optional_policy(` +@@ -549,9 +602,9 @@ optional_policy(` # Pdf local policy # @@ -21811,7 +21812,7 @@ index c91813ccb..8c014f781 100644 append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t) create_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t) -@@ -566,148 +618,23 @@ fs_search_auto_mountpoints(cups_pdf_t) +@@ -566,148 +619,23 @@ fs_search_auto_mountpoints(cups_pdf_t) kernel_read_system_state(cups_pdf_t) @@ -21963,7 +21964,7 @@ index c91813ccb..8c014f781 100644 ######################################## # -@@ -735,7 +662,6 @@ kernel_read_kernel_sysctls(ptal_t) +@@ -735,7 +663,6 @@ kernel_read_kernel_sysctls(ptal_t) kernel_list_proc(ptal_t) kernel_read_proc_symlinks(ptal_t) @@ -21971,7 +21972,7 @@ index c91813ccb..8c014f781 100644 corenet_all_recvfrom_netlabel(ptal_t) corenet_tcp_sendrecv_generic_if(ptal_t) corenet_tcp_sendrecv_generic_node(ptal_t) -@@ -745,13 +671,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t) +@@ -745,13 +672,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t) corenet_tcp_bind_ptal_port(ptal_t) corenet_tcp_sendrecv_ptal_port(ptal_t) @@ -21985,7 +21986,7 @@ index c91813ccb..8c014f781 100644 files_read_etc_runtime_files(ptal_t) fs_getattr_all_fs(ptal_t) -@@ -759,8 +683,6 @@ fs_search_auto_mountpoints(ptal_t) +@@ -759,8 +684,6 @@ fs_search_auto_mountpoints(ptal_t) logging_send_syslog_msg(ptal_t) @@ -21994,7 +21995,7 @@ index c91813ccb..8c014f781 100644 sysnet_read_config(ptal_t) userdom_dontaudit_use_unpriv_user_fds(ptal_t) -@@ -773,3 +695,4 @@ optional_policy(` +@@ -773,3 +696,4 @@ optional_policy(` optional_policy(` udev_read_db(ptal_t) ') diff --git a/selinux-policy.spec b/selinux-policy.spec index 56debab..dfdb9a1 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 276%{?dist} +Release: 277%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -681,6 +681,13 @@ exit 0 %endif %changelog +* Mon Aug 28 2017 Lukas Vrabec - 3.13.1-277 +- Allow cupsd_t to execute ld_so_cache +- Add cgroup_seclabel policycap. +- Allow xdm_t to read systemd hwdb +- Add new interface systemd_hwdb_mmap_config() +- Allow auditd_t domain to mmap conf files labeled as auditd_etc_t BZ(1485050) + * Sat Aug 26 2017 Lukas Vrabec - 3.13.1-276 - Allow couple map rules