From d6000907520f45d9be9a5969a5373a1eea665014 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Nov 16 2017 14:45:04 +0000 Subject: * Thu Nov 16 2017 Lukas Vrabec - 3.13.1-283.16 - Allow pcp_pmlogger to send logs to journal BZ(1512367) - Allow services to use kerberos KCM BZ(1512128) - Allow system_mail_t domain to be system_dbus_client BZ(1512476) - Allow aide domain to stream connect to sssd_t BZ(1512500) - Allow squid_t domain to mmap files with label squid_tmpfs_t BZ(1498809) - Allow nsd_t domain to mmap files with labels nsd_tmp_t and nsd_zone_t BZ(1511269) - Include cupsd_config_t domain into cups_execmem boolean. BZ(1417584) - Allow samba_net_t domain to mmap samba_var_t files BZ(1512227) - Allow lircd_t domain to execute shell BZ(1512787) - Allow thumb_t domain to setattr on cache_home_t dirs BZ(1487814) - Allow redis to creating tmp files with own label BZ(1513518) - Create new interface thumb_nnp_domtrans allowing domaintransition with NoNewPrivs. This interface added to thumb_run() BZ(1509502) - Allow httpd_t to mmap httpd_tmp_t files BZ(1502303) - Add map permission to samba_rw_var_files interface. BZ(1513908) - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t - Add dac_read_search and dac_override capabilities to ganesha - Allow ldap_t domain to manage also slapd_tmp_t lnk files - Allow snapperd_t domain to relabeling from snapperd_data_t BZ(1510584) - Allow snapperd_t to remove old snaps BZ(1510862) - Allow chkpwd_t domain to mmap system_db_t files and be dbus system client BZ(1513704) - Allow xdm_t send signull to all xserver unconfined types BZ(1499390) - Allow fs associate for sysctl_vm_t BZ(1447301) - Label /etc/init.d/vboxdrv as bin_t to run virtualbox as unconfined_service_t BZ(1451479) - Allow xdm_t domain to read usermodehelper_t state BZ(1412609) - Allow dhcpc_t domain to stream connect to userdomain domains BZ(1511948) - Allow systemd to mmap kernel modules BZ(1513399) - Allow userdomains to mmap fifo_files BZ(1512242) - Container runtimes are running iptables within a different user namespace - Add map permission to init_domtrans() interface BZ(1513832) - Allow xdm_t domain to mmap and execute files in xdm_var_run_t BZ(1513883) - Add interface files_rmdir_all_dirs() --- diff --git a/container-selinux.tgz b/container-selinux.tgz index 1a73cbb..f16aba7 100644 Binary files a/container-selinux.tgz and b/container-selinux.tgz differ diff --git a/policy-f27-base.patch b/policy-f27-base.patch index 36a5c7f..2c50ad7 100644 --- a/policy-f27-base.patch +++ b/policy-f27-base.patch @@ -3854,7 +3854,7 @@ index 759016583..f50f79935 100644 + fs_mounton_fusefs(seunshare_domain) ') diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc -index 33e0f8dad..1eb3faaa3 100644 +index 33e0f8dad..6fd767031 100644 --- a/policy/modules/kernel/corecommands.fc +++ b/policy/modules/kernel/corecommands.fc @@ -1,9 +1,10 @@ @@ -3911,19 +3911,23 @@ index 33e0f8dad..1eb3faaa3 100644 /etc/netplug\.d(/.*)? gen_context(system_u:object_r:bin_t,s0) -@@ -101,11 +118,8 @@ ifdef(`distro_redhat',` +@@ -99,13 +116,12 @@ ifdef(`distro_redhat',` - /etc/rc\.d/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0) + /etc/racoon/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0) + +-/etc/rc\.d/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0) ++/etc/init\.d/vboxdrv.* gen_context(system_u:object_r:bin_t,s0) -/etc/security/namespace.init -- gen_context(system_u:object_r:bin_t,s0) -- ++/etc/rc\.d/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0) + /etc/sysconfig/crond -- gen_context(system_u:object_r:bin_t,s0) /etc/sysconfig/init -- gen_context(system_u:object_r:bin_t,s0) -/etc/sysconfig/libvirtd -- gen_context(system_u:object_r:bin_t,s0) /etc/sysconfig/netconsole -- gen_context(system_u:object_r:bin_t,s0) /etc/sysconfig/readonly-root -- gen_context(system_u:object_r:bin_t,s0) -@@ -116,6 +130,9 @@ ifdef(`distro_redhat',` +@@ -116,6 +132,9 @@ ifdef(`distro_redhat',` /etc/vmware-tools(/.*)? gen_context(system_u:object_r:bin_t,s0) @@ -3933,7 +3937,7 @@ index 33e0f8dad..1eb3faaa3 100644 /etc/X11/xdm/GiveConsole -- gen_context(system_u:object_r:bin_t,s0) /etc/X11/xdm/TakeConsole -- gen_context(system_u:object_r:bin_t,s0) /etc/X11/xdm/Xsetup_0 -- gen_context(system_u:object_r:bin_t,s0) -@@ -128,6 +145,8 @@ ifdef(`distro_debian',` +@@ -128,6 +147,8 @@ ifdef(`distro_debian',` /etc/mysql/debian-start -- gen_context(system_u:object_r:bin_t,s0) ') @@ -3942,7 +3946,7 @@ index 33e0f8dad..1eb3faaa3 100644 # # /lib # -@@ -135,10 +154,12 @@ ifdef(`distro_debian',` +@@ -135,10 +156,12 @@ ifdef(`distro_debian',` /lib/nut/.* -- gen_context(system_u:object_r:bin_t,s0) /lib/readahead(/.*)? gen_context(system_u:object_r:bin_t,s0) /lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0) @@ -3956,7 +3960,7 @@ index 33e0f8dad..1eb3faaa3 100644 ifdef(`distro_gentoo',` /lib/dhcpcd/dhcpcd-run-hooks -- gen_context(system_u:object_r:bin_t,s0) -@@ -149,10 +170,12 @@ ifdef(`distro_gentoo',` +@@ -149,10 +172,12 @@ ifdef(`distro_gentoo',` /lib/rcscripts/net\.modules\.d/helpers\.d/udhcpc-.* -- gen_context(system_u:object_r:bin_t,s0) ') @@ -3970,7 +3974,7 @@ index 33e0f8dad..1eb3faaa3 100644 /sbin/.* gen_context(system_u:object_r:bin_t,s0) /sbin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0) /sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0) -@@ -168,6 +191,7 @@ ifdef(`distro_gentoo',` +@@ -168,6 +193,7 @@ ifdef(`distro_gentoo',` /opt/(.*/)?sbin(/.*)? gen_context(system_u:object_r:bin_t,s0) /opt/google/talkplugin(/.*)? gen_context(system_u:object_r:bin_t,s0) @@ -3978,7 +3982,7 @@ index 33e0f8dad..1eb3faaa3 100644 /opt/gutenprint/cups/lib/filter(/.*)? gen_context(system_u:object_r:bin_t,s0) -@@ -179,34 +203,50 @@ ifdef(`distro_gentoo',` +@@ -179,34 +205,50 @@ ifdef(`distro_gentoo',` /opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0) ') @@ -4038,7 +4042,7 @@ index 33e0f8dad..1eb3faaa3 100644 /usr/lib/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0) /usr/lib/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0) -@@ -218,19 +258,32 @@ ifdef(`distro_gentoo',` +@@ -218,19 +260,32 @@ ifdef(`distro_gentoo',` /usr/lib/mailman/mail(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/mediawiki/math/texvc.* gen_context(system_u:object_r:bin_t,s0) /usr/lib/misc/sftp-server -- gen_context(system_u:object_r:bin_t,s0) @@ -4078,7 +4082,7 @@ index 33e0f8dad..1eb3faaa3 100644 /usr/lib/xfce4/exo-1/exo-compose-mail-1 -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/xfce4/exo-1/exo-helper-1 -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/xfce4/panel/migrate -- gen_context(system_u:object_r:bin_t,s0) -@@ -245,26 +298,41 @@ ifdef(`distro_gentoo',` +@@ -245,26 +300,41 @@ ifdef(`distro_gentoo',` /usr/lib/debug/sbin(/.*)? -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/debug/usr/bin(/.*)? -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/debug/usr/sbin(/.*)? -- gen_context(system_u:object_r:bin_t,s0) @@ -4125,7 +4129,7 @@ index 33e0f8dad..1eb3faaa3 100644 /usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/sbin/smrsh -- gen_context(system_u:object_r:shell_exec_t,s0) -@@ -280,10 +348,14 @@ ifdef(`distro_gentoo',` +@@ -280,10 +350,14 @@ ifdef(`distro_gentoo',` /usr/share/cluster/.*\.sh gen_context(system_u:object_r:bin_t,s0) /usr/share/cluster/ocf-shellfuncs -- gen_context(system_u:object_r:bin_t,s0) /usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0) @@ -4140,7 +4144,7 @@ index 33e0f8dad..1eb3faaa3 100644 /usr/share/gnucash/finance-quote-check -- gen_context(system_u:object_r:bin_t,s0) /usr/share/gnucash/finance-quote-helper -- gen_context(system_u:object_r:bin_t,s0) /usr/share/hal/device-manager/hal-device-manager -- gen_context(system_u:object_r:bin_t,s0) -@@ -298,16 +370,22 @@ ifdef(`distro_gentoo',` +@@ -298,16 +372,22 @@ ifdef(`distro_gentoo',` /usr/share/selinux/devel/policygentool -- gen_context(system_u:object_r:bin_t,s0) /usr/share/smolt/client(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall/compiler\.pl -- gen_context(system_u:object_r:bin_t,s0) @@ -4165,7 +4169,7 @@ index 33e0f8dad..1eb3faaa3 100644 ifdef(`distro_debian',` /usr/lib/ConsoleKit/.* -- gen_context(system_u:object_r:bin_t,s0) -@@ -325,20 +403,27 @@ ifdef(`distro_redhat', ` +@@ -325,20 +405,27 @@ ifdef(`distro_redhat', ` /etc/gdm/[^/]+ -d gen_context(system_u:object_r:bin_t,s0) /etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0) @@ -4194,7 +4198,7 @@ index 33e0f8dad..1eb3faaa3 100644 /usr/share/pwlib/make/ptlib-config -- gen_context(system_u:object_r:bin_t,s0) /usr/share/pydict/pydict\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/rhn/rhn_applet/applet\.py -- gen_context(system_u:object_r:bin_t,s0) -@@ -346,6 +431,7 @@ ifdef(`distro_redhat', ` +@@ -346,6 +433,7 @@ ifdef(`distro_redhat', ` /usr/share/ssl/misc(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/switchdesk/switchdesk-gui\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-date/system-config-date\.py -- gen_context(system_u:object_r:bin_t,s0) @@ -4202,7 +4206,7 @@ index 33e0f8dad..1eb3faaa3 100644 /usr/share/system-config-selinux/polgen\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-selinux/system-config-selinux\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-display/system-config-display -- gen_context(system_u:object_r:bin_t,s0) -@@ -387,17 +473,36 @@ ifdef(`distro_suse', ` +@@ -387,17 +475,36 @@ ifdef(`distro_suse', ` # # /var # @@ -12607,7 +12611,7 @@ index b876c48ad..2e591a538 100644 + +/sysroot/ostree/deploy/.*-atomic/deploy(/.*)? gen_context(system_u:object_r:root_t,s0) diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if -index f962f76ad..f2b8e4558 100644 +index f962f76ad..851fb7e6d 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -19,6 +19,136 @@ @@ -13441,37 +13445,44 @@ index f962f76ad..f2b8e4558 100644 ## Do not audit attempts to set the attributes on all mount points. ## ## -@@ -1691,44 +2139,44 @@ interface(`files_dontaudit_list_all_mountpoints',` +@@ -1691,6 +2139,24 @@ interface(`files_dontaudit_list_all_mountpoints',` ######################################## ## --## Do not audit attempts to write to mount points. +## Write all mount points. - ## - ## - ## --## Domain to not audit. ++## ++## ++## +## Domain allowed access. - ## - ## - # --interface(`files_dontaudit_write_all_mountpoints',` -- gen_require(` -- attribute mountpoint; -- ') ++## ++## ++# +interface(`files_write_all_mountpoints',` + gen_require(` + attribute mountpoint; + ') - -- dontaudit $1 mountpoint:dir write; ++ + allow $1 mountpoint:dir write; ++') ++ ++######################################## ++## + ## Do not audit attempts to write to mount points. + ## + ## +@@ -1703,104 +2169,233 @@ interface(`files_dontaudit_write_all_mountpoints',` + gen_require(` + attribute mountpoint; + ') ++ dontaudit $1 self:capability { dac_read_search dac_override }; + + dontaudit $1 mountpoint:dir write; ') ######################################## ## -## List the contents of the root directory. -+## Do not audit attempts to write to mount points. ++## Do not audit attempts to unmount all mount points. ## ## ## @@ -13481,46 +13492,47 @@ index f962f76ad..f2b8e4558 100644 ## # -interface(`files_list_root',` -+interface(`files_dontaudit_write_all_mountpoints',` ++interface(`files_dontaudit_unmount_all_mountpoints',` gen_require(` - type root_t; + attribute mountpoint; ') -+ dontaudit $1 self:capability { dac_read_search dac_override }; - allow $1 root_t:dir list_dir_perms; - allow $1 root_t:lnk_file { read_lnk_file_perms ioctl lock }; -+ dontaudit $1 mountpoint:dir write; ++ dontaudit $1 mountpoint:filesystem unmount; ') ######################################## ## -## Do not audit attempts to write to / dirs. -+## Do not audit attempts to unmount all mount points. ++## Read all mountpoint symbolic links. ## ## ## -@@ -1736,79 +2184,208 @@ interface(`files_list_root',` +-## Domain to not audit. ++## Domain allowed access. ## ## # -interface(`files_dontaudit_write_root_dirs',` -+interface(`files_dontaudit_unmount_all_mountpoints',` ++interface(`files_read_all_mountpoint_symlinks',` gen_require(` - type root_t; + attribute mountpoint; ') - dontaudit $1 root_t:dir write; -+ dontaudit $1 mountpoint:filesystem unmount; ++ allow $1 mountpoint:lnk_file read_lnk_file_perms; ') -################### ++ +######################################## ## -## Do not audit attempts to write -## files in the root directory. -+## Read all mountpoint symbolic links. ++## Make all mountpoint as entrypoint. ## ## ## @@ -13530,22 +13542,21 @@ index f962f76ad..f2b8e4558 100644 ## # -interface(`files_dontaudit_rw_root_dir',` -+interface(`files_read_all_mountpoint_symlinks',` ++interface(`files_entrypoint_all_mountpoint',` gen_require(` - type root_t; + attribute mountpoint; ') - dontaudit $1 root_t:dir rw_dir_perms; -+ allow $1 mountpoint:lnk_file read_lnk_file_perms; ++ allow $1 mountpoint:file entrypoint; ') -+ ######################################## ## -## Create an object in the root directory, with a private -## type using a type transition. -+## Make all mountpoint as entrypoint. ++## Remove all file type directories. ## ## ## @@ -13569,14 +13580,14 @@ index f962f76ad..f2b8e4558 100644 -## # -interface(`files_root_filetrans',` -+interface(`files_entrypoint_all_mountpoint',` ++interface(`files_rmdir_all_dirs',` gen_require(` - type root_t; -+ attribute mountpoint; ++ attribute file_type; ') - filetrans_pattern($1, root_t, $2, $3, $4) -+ allow $1 mountpoint:file entrypoint; ++ allow $1 file_type:dir rmdir; ') ######################################## @@ -13584,15 +13595,13 @@ index f962f76ad..f2b8e4558 100644 -## Do not audit attempts to read files in -## the root directory. +## Write all file type directories. - ## - ## - ## --## Domain to not audit. ++## ++## ++## +## Domain allowed access. - ## - ## - # --interface(`files_dontaudit_read_root_files',` ++## ++## ++# +interface(`files_write_all_dirs',` + gen_require(` + attribute file_type; @@ -13732,18 +13741,10 @@ index f962f76ad..f2b8e4558 100644 +## +## Do not audit attempts to read files in +## the root directory. -+## -+## -+## -+## Domain to not audit. -+## -+## -+# -+interface(`files_dontaudit_read_root_files',` - gen_require(` - type root_t; - ') -@@ -1892,25 +2469,25 @@ interface(`files_delete_root_dir_entry',` + ## + ## + ## +@@ -1892,25 +2487,25 @@ interface(`files_delete_root_dir_entry',` ######################################## ## @@ -13775,7 +13776,7 @@ index f962f76ad..f2b8e4558 100644 ## ## ## -@@ -1923,7 +2500,7 @@ interface(`files_relabel_rootfs',` +@@ -1923,7 +2518,7 @@ interface(`files_relabel_rootfs',` type root_t; ') @@ -13784,7 +13785,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -1946,6 +2523,42 @@ interface(`files_unmount_rootfs',` +@@ -1946,6 +2541,42 @@ interface(`files_unmount_rootfs',` ######################################## ## @@ -13827,7 +13828,7 @@ index f962f76ad..f2b8e4558 100644 ## Get attributes of the /boot directory. ## ## -@@ -2181,6 +2794,24 @@ interface(`files_relabelfrom_boot_files',` +@@ -2181,6 +2812,24 @@ interface(`files_relabelfrom_boot_files',` relabelfrom_files_pattern($1, boot_t, boot_t) ') @@ -13852,7 +13853,7 @@ index f962f76ad..f2b8e4558 100644 ###################################### ## ## Read symbolic links in the /boot directory. -@@ -2557,6 +3188,24 @@ interface(`files_read_default_pipes',` +@@ -2557,6 +3206,24 @@ interface(`files_read_default_pipes',` ######################################## ## @@ -13877,7 +13878,7 @@ index f962f76ad..f2b8e4558 100644 ## Search the contents of /etc directories. ## ## -@@ -2645,6 +3294,24 @@ interface(`files_rw_etc_dirs',` +@@ -2645,6 +3312,24 @@ interface(`files_rw_etc_dirs',` allow $1 etc_t:dir rw_dir_perms; ') @@ -13902,7 +13903,7 @@ index f962f76ad..f2b8e4558 100644 ########################################## ## ## Manage generic directories in /etc -@@ -2716,6 +3383,7 @@ interface(`files_read_etc_files',` +@@ -2716,6 +3401,7 @@ interface(`files_read_etc_files',` allow $1 etc_t:dir list_dir_perms; read_files_pattern($1, etc_t, etc_t) read_lnk_files_pattern($1, etc_t, etc_t) @@ -13910,7 +13911,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -2724,7 +3392,7 @@ interface(`files_read_etc_files',` +@@ -2724,7 +3410,7 @@ interface(`files_read_etc_files',` ## ## ## @@ -13919,7 +13920,7 @@ index f962f76ad..f2b8e4558 100644 ## ## # -@@ -2780,6 +3448,25 @@ interface(`files_manage_etc_files',` +@@ -2780,6 +3466,25 @@ interface(`files_manage_etc_files',` ######################################## ## @@ -13945,7 +13946,7 @@ index f962f76ad..f2b8e4558 100644 ## Delete system configuration files in /etc. ## ## -@@ -2798,6 +3485,24 @@ interface(`files_delete_etc_files',` +@@ -2798,6 +3503,24 @@ interface(`files_delete_etc_files',` ######################################## ## @@ -13970,7 +13971,7 @@ index f962f76ad..f2b8e4558 100644 ## Execute generic files in /etc. ## ## -@@ -2963,26 +3668,8 @@ interface(`files_delete_boot_flag',` +@@ -2963,26 +3686,8 @@ interface(`files_delete_boot_flag',` ######################################## ## @@ -13999,7 +14000,7 @@ index f962f76ad..f2b8e4558 100644 ## ## ##

-@@ -3021,9 +3708,7 @@ interface(`files_read_etc_runtime_files',` +@@ -3021,9 +3726,7 @@ interface(`files_read_etc_runtime_files',` ######################################## ##

@@ -14010,7 +14011,7 @@ index f962f76ad..f2b8e4558 100644 ## ## ## -@@ -3031,18 +3716,17 @@ interface(`files_read_etc_runtime_files',` +@@ -3031,18 +3734,17 @@ interface(`files_read_etc_runtime_files',` ## ## # @@ -14032,7 +14033,7 @@ index f962f76ad..f2b8e4558 100644 ## ## ## -@@ -3060,6 +3744,26 @@ interface(`files_dontaudit_write_etc_runtime_files',` +@@ -3060,6 +3762,26 @@ interface(`files_dontaudit_write_etc_runtime_files',` ######################################## ## @@ -14059,7 +14060,7 @@ index f962f76ad..f2b8e4558 100644 ## Read and write files in /etc that are dynamically ## created on boot, such as mtab. ## -@@ -3077,6 +3781,7 @@ interface(`files_rw_etc_runtime_files',` +@@ -3077,6 +3799,7 @@ interface(`files_rw_etc_runtime_files',` allow $1 etc_t:dir list_dir_perms; rw_files_pattern($1, etc_t, etc_runtime_t) @@ -14067,7 +14068,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3098,6 +3803,7 @@ interface(`files_manage_etc_runtime_files',` +@@ -3098,6 +3821,7 @@ interface(`files_manage_etc_runtime_files',` ') manage_files_pattern($1, { etc_t etc_runtime_t }, etc_runtime_t) @@ -14075,7 +14076,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3142,10 +3848,48 @@ interface(`files_etc_filetrans_etc_runtime',` +@@ -3142,10 +3866,48 @@ interface(`files_etc_filetrans_etc_runtime',` # interface(`files_getattr_isid_type_dirs',` gen_require(` @@ -14126,7 +14127,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3161,10 +3905,10 @@ interface(`files_getattr_isid_type_dirs',` +@@ -3161,10 +3923,10 @@ interface(`files_getattr_isid_type_dirs',` # interface(`files_dontaudit_search_isid_type_dirs',` gen_require(` @@ -14139,7 +14140,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3180,10 +3924,10 @@ interface(`files_dontaudit_search_isid_type_dirs',` +@@ -3180,10 +3942,10 @@ interface(`files_dontaudit_search_isid_type_dirs',` # interface(`files_list_isid_type_dirs',` gen_require(` @@ -14152,7 +14153,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3199,10 +3943,10 @@ interface(`files_list_isid_type_dirs',` +@@ -3199,10 +3961,10 @@ interface(`files_list_isid_type_dirs',` # interface(`files_rw_isid_type_dirs',` gen_require(` @@ -14165,7 +14166,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3218,10 +3962,66 @@ interface(`files_rw_isid_type_dirs',` +@@ -3218,10 +3980,66 @@ interface(`files_rw_isid_type_dirs',` # interface(`files_delete_isid_type_dirs',` gen_require(` @@ -14234,7 +14235,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3237,10 +4037,10 @@ interface(`files_delete_isid_type_dirs',` +@@ -3237,10 +4055,10 @@ interface(`files_delete_isid_type_dirs',` # interface(`files_manage_isid_type_dirs',` gen_require(` @@ -14247,7 +14248,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3256,10 +4056,29 @@ interface(`files_manage_isid_type_dirs',` +@@ -3256,10 +4074,29 @@ interface(`files_manage_isid_type_dirs',` # interface(`files_mounton_isid_type_dirs',` gen_require(` @@ -14279,7 +14280,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3275,10 +4094,10 @@ interface(`files_mounton_isid_type_dirs',` +@@ -3275,10 +4112,10 @@ interface(`files_mounton_isid_type_dirs',` # interface(`files_read_isid_type_files',` gen_require(` @@ -14292,7 +14293,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3294,10 +4113,10 @@ interface(`files_read_isid_type_files',` +@@ -3294,10 +4131,10 @@ interface(`files_read_isid_type_files',` # interface(`files_delete_isid_type_files',` gen_require(` @@ -14305,7 +14306,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3313,10 +4132,10 @@ interface(`files_delete_isid_type_files',` +@@ -3313,10 +4150,10 @@ interface(`files_delete_isid_type_files',` # interface(`files_delete_isid_type_symlinks',` gen_require(` @@ -14318,7 +14319,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3332,10 +4151,10 @@ interface(`files_delete_isid_type_symlinks',` +@@ -3332,10 +4169,10 @@ interface(`files_delete_isid_type_symlinks',` # interface(`files_delete_isid_type_fifo_files',` gen_require(` @@ -14331,7 +14332,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3351,10 +4170,10 @@ interface(`files_delete_isid_type_fifo_files',` +@@ -3351,10 +4188,10 @@ interface(`files_delete_isid_type_fifo_files',` # interface(`files_delete_isid_type_sock_files',` gen_require(` @@ -14344,7 +14345,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3370,10 +4189,10 @@ interface(`files_delete_isid_type_sock_files',` +@@ -3370,10 +4207,10 @@ interface(`files_delete_isid_type_sock_files',` # interface(`files_delete_isid_type_blk_files',` gen_require(` @@ -14357,7 +14358,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3389,10 +4208,10 @@ interface(`files_delete_isid_type_blk_files',` +@@ -3389,10 +4226,10 @@ interface(`files_delete_isid_type_blk_files',` # interface(`files_dontaudit_write_isid_chr_files',` gen_require(` @@ -14370,7 +14371,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3408,10 +4227,10 @@ interface(`files_dontaudit_write_isid_chr_files',` +@@ -3408,10 +4245,10 @@ interface(`files_dontaudit_write_isid_chr_files',` # interface(`files_delete_isid_type_chr_files',` gen_require(` @@ -14383,7 +14384,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3427,10 +4246,10 @@ interface(`files_delete_isid_type_chr_files',` +@@ -3427,10 +4264,10 @@ interface(`files_delete_isid_type_chr_files',` # interface(`files_manage_isid_type_files',` gen_require(` @@ -14396,7 +14397,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3446,10 +4265,10 @@ interface(`files_manage_isid_type_files',` +@@ -3446,10 +4283,10 @@ interface(`files_manage_isid_type_files',` # interface(`files_manage_isid_type_symlinks',` gen_require(` @@ -14409,7 +14410,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3465,10 +4284,29 @@ interface(`files_manage_isid_type_symlinks',` +@@ -3465,10 +4302,29 @@ interface(`files_manage_isid_type_symlinks',` # interface(`files_rw_isid_type_blk_files',` gen_require(` @@ -14441,7 +14442,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3484,10 +4322,10 @@ interface(`files_rw_isid_type_blk_files',` +@@ -3484,10 +4340,10 @@ interface(`files_rw_isid_type_blk_files',` # interface(`files_manage_isid_type_blk_files',` gen_require(` @@ -14454,7 +14455,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3503,10 +4341,29 @@ interface(`files_manage_isid_type_blk_files',` +@@ -3503,10 +4359,29 @@ interface(`files_manage_isid_type_blk_files',` # interface(`files_manage_isid_type_chr_files',` gen_require(` @@ -14486,7 +14487,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3552,6 +4409,27 @@ interface(`files_dontaudit_getattr_home_dir',` +@@ -3552,6 +4427,27 @@ interface(`files_dontaudit_getattr_home_dir',` ######################################## ## @@ -14514,7 +14515,7 @@ index f962f76ad..f2b8e4558 100644 ## Search home directories root (/home). ## ## -@@ -3814,20 +4692,38 @@ interface(`files_list_mnt',` +@@ -3814,20 +4710,38 @@ interface(`files_list_mnt',` ###################################### ## @@ -14558,7 +14559,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -3921,6 +4817,45 @@ interface(`files_read_mnt_symlinks',` +@@ -3921,6 +4835,45 @@ interface(`files_read_mnt_symlinks',` read_lnk_files_pattern($1, mnt_t, mnt_t) ') @@ -14604,7 +14605,7 @@ index f962f76ad..f2b8e4558 100644 ######################################## ## ## Create, read, write, and delete symbolic links in /mnt. -@@ -4012,6 +4947,7 @@ interface(`files_read_kernel_modules',` +@@ -4012,6 +4965,7 @@ interface(`files_read_kernel_modules',` allow $1 modules_object_t:dir list_dir_perms; read_files_pattern($1, modules_object_t, modules_object_t) read_lnk_files_pattern($1, modules_object_t, modules_object_t) @@ -14612,7 +14613,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -4217,48 +5153,218 @@ interface(`files_read_world_readable_sockets',` +@@ -4217,48 +5171,235 @@ interface(`files_read_world_readable_sockets',` allow $1 readable_t:sock_file read_sock_file_perms; ') @@ -14792,6 +14793,23 @@ index f962f76ad..f2b8e4558 100644 + files_filetrans_system_db_named_files($1) +') + ++###################################### ++## ++## Map manageable system db files in /var/lib. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_map_system_db_files',` ++ gen_require(` ++ type system_db_t; ++ ') ++ allow $1 system_db_t:file map; ++') ++ +##################################### +## +## File name transition for system db files in /var/lib. @@ -14857,7 +14875,7 @@ index f962f76ad..f2b8e4558 100644 ## ## ## -@@ -4266,6 +5372,45 @@ interface(`files_getattr_tmp_dirs',` +@@ -4266,6 +5407,45 @@ interface(`files_getattr_tmp_dirs',` ## ## # @@ -14903,7 +14921,7 @@ index f962f76ad..f2b8e4558 100644 interface(`files_dontaudit_getattr_tmp_dirs',` gen_require(` type tmp_t; -@@ -4289,6 +5434,8 @@ interface(`files_search_tmp',` +@@ -4289,6 +5469,8 @@ interface(`files_search_tmp',` type tmp_t; ') @@ -14912,7 +14930,7 @@ index f962f76ad..f2b8e4558 100644 allow $1 tmp_t:dir search_dir_perms; ') -@@ -4325,6 +5472,7 @@ interface(`files_list_tmp',` +@@ -4325,6 +5507,7 @@ interface(`files_list_tmp',` type tmp_t; ') @@ -14920,7 +14938,7 @@ index f962f76ad..f2b8e4558 100644 allow $1 tmp_t:dir list_dir_perms; ') -@@ -4334,7 +5482,7 @@ interface(`files_list_tmp',` +@@ -4334,7 +5517,7 @@ interface(`files_list_tmp',` ## ## ## @@ -14929,7 +14947,7 @@ index f962f76ad..f2b8e4558 100644 ## ## # -@@ -4346,6 +5494,25 @@ interface(`files_dontaudit_list_tmp',` +@@ -4346,6 +5529,25 @@ interface(`files_dontaudit_list_tmp',` dontaudit $1 tmp_t:dir list_dir_perms; ') @@ -14955,7 +14973,7 @@ index f962f76ad..f2b8e4558 100644 ######################################## ## ## Remove entries from the tmp directory. -@@ -4361,6 +5528,7 @@ interface(`files_delete_tmp_dir_entry',` +@@ -4361,6 +5563,7 @@ interface(`files_delete_tmp_dir_entry',` type tmp_t; ') @@ -14963,7 +14981,7 @@ index f962f76ad..f2b8e4558 100644 allow $1 tmp_t:dir del_entry_dir_perms; ') -@@ -4402,6 +5570,32 @@ interface(`files_manage_generic_tmp_dirs',` +@@ -4402,6 +5605,32 @@ interface(`files_manage_generic_tmp_dirs',` ######################################## ## @@ -14996,7 +15014,7 @@ index f962f76ad..f2b8e4558 100644 ## Manage temporary files and directories in /tmp. ## ## -@@ -4456,6 +5650,42 @@ interface(`files_rw_generic_tmp_sockets',` +@@ -4456,6 +5685,42 @@ interface(`files_rw_generic_tmp_sockets',` ######################################## ## @@ -15039,7 +15057,7 @@ index f962f76ad..f2b8e4558 100644 ## Set the attributes of all tmp directories. ## ## -@@ -4474,6 +5704,60 @@ interface(`files_setattr_all_tmp_dirs',` +@@ -4474,6 +5739,60 @@ interface(`files_setattr_all_tmp_dirs',` ######################################## ## @@ -15100,7 +15118,7 @@ index f962f76ad..f2b8e4558 100644 ## List all tmp directories. ## ## -@@ -4519,7 +5803,7 @@ interface(`files_relabel_all_tmp_dirs',` +@@ -4519,7 +5838,7 @@ interface(`files_relabel_all_tmp_dirs',` ## ## ## @@ -15109,7 +15127,7 @@ index f962f76ad..f2b8e4558 100644 ## ## # -@@ -4579,7 +5863,7 @@ interface(`files_relabel_all_tmp_files',` +@@ -4579,7 +5898,7 @@ interface(`files_relabel_all_tmp_files',` ## ## ## @@ -15118,7 +15136,7 @@ index f962f76ad..f2b8e4558 100644 ## ## # -@@ -4611,17 +5895,55 @@ interface(`files_read_all_tmp_files',` +@@ -4611,20 +5930,58 @@ interface(`files_read_all_tmp_files',` ######################################## ## @@ -15130,10 +15148,15 @@ index f962f76ad..f2b8e4558 100644 ## ## -## Domain allowed access. +-## +-## +-## +-## +-## The type of the object to be created. +## Domain to not audit. ## ## --## +-## +# +interface(`files_dontaudit_tmp_file_leaks',` + gen_require(` @@ -15149,8 +15172,7 @@ index f962f76ad..f2b8e4558 100644 +## all leaked tmpfiles files. +## +## - ## --## The type of the object to be created. ++## +## Domain to not audit. +## +## @@ -15176,10 +15198,13 @@ index f962f76ad..f2b8e4558 100644 +## +## +## The type of the object to be created. ++## ++## ++## + ## + ## The object class of the object being created. ## - ## - ## -@@ -4664,6 +5986,16 @@ interface(`files_purge_tmp',` +@@ -4664,6 +6021,16 @@ interface(`files_purge_tmp',` delete_lnk_files_pattern($1, tmpfile, tmpfile) delete_fifo_files_pattern($1, tmpfile, tmpfile) delete_sock_files_pattern($1, tmpfile, tmpfile) @@ -15196,7 +15221,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -4814,6 +6146,24 @@ interface(`files_delete_usr_files',` +@@ -4814,6 +6181,24 @@ interface(`files_delete_usr_files',` ######################################## ## @@ -15221,7 +15246,7 @@ index f962f76ad..f2b8e4558 100644 ## Get the attributes of files in /usr. ## ## -@@ -5112,6 +6462,24 @@ interface(`files_create_kernel_symbol_table',` +@@ -5112,6 +6497,24 @@ interface(`files_create_kernel_symbol_table',` ######################################## ## @@ -15246,7 +15271,7 @@ index f962f76ad..f2b8e4558 100644 ## Read system.map in the /boot directory. ## ## -@@ -5241,6 +6609,24 @@ interface(`files_list_var',` +@@ -5241,6 +6644,24 @@ interface(`files_list_var',` ######################################## ## @@ -15271,7 +15296,7 @@ index f962f76ad..f2b8e4558 100644 ## Create, read, write, and delete directories ## in the /var directory. ## -@@ -5328,7 +6714,7 @@ interface(`files_dontaudit_rw_var_files',` +@@ -5328,7 +6749,7 @@ interface(`files_dontaudit_rw_var_files',` type var_t; ') @@ -15280,7 +15305,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -5419,6 +6805,24 @@ interface(`files_var_filetrans',` +@@ -5419,6 +6840,24 @@ interface(`files_var_filetrans',` filetrans_pattern($1, var_t, $2, $3, $4) ') @@ -15305,7 +15330,7 @@ index f962f76ad..f2b8e4558 100644 ######################################## ## ## Get the attributes of the /var/lib directory. -@@ -5527,6 +6931,25 @@ interface(`files_rw_var_lib_dirs',` +@@ -5527,6 +6966,25 @@ interface(`files_rw_var_lib_dirs',` ######################################## ## @@ -15331,7 +15356,7 @@ index f962f76ad..f2b8e4558 100644 ## Create objects in the /var/lib directory ## ## -@@ -5596,6 +7019,25 @@ interface(`files_read_var_lib_symlinks',` +@@ -5596,6 +7054,25 @@ interface(`files_read_var_lib_symlinks',` read_lnk_files_pattern($1, { var_t var_lib_t }, var_lib_t) ') @@ -15357,7 +15382,7 @@ index f962f76ad..f2b8e4558 100644 # cjp: the next two interfaces really need to be fixed # in some way. They really neeed their own types. -@@ -5619,6 +7061,42 @@ interface(`files_manage_urandom_seed',` +@@ -5619,6 +7096,42 @@ interface(`files_manage_urandom_seed',` manage_files_pattern($1, var_lib_t, var_lib_t) ') @@ -15400,7 +15425,7 @@ index f962f76ad..f2b8e4558 100644 ######################################## ## ## Allow domain to manage mount tables -@@ -5641,7 +7119,7 @@ interface(`files_manage_mounttab',` +@@ -5641,7 +7154,7 @@ interface(`files_manage_mounttab',` ######################################## ## @@ -15409,7 +15434,7 @@ index f962f76ad..f2b8e4558 100644 ## ## ## -@@ -5649,12 +7127,13 @@ interface(`files_manage_mounttab',` +@@ -5649,12 +7162,13 @@ interface(`files_manage_mounttab',` ## ## # @@ -15425,7 +15450,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -5672,6 +7151,7 @@ interface(`files_search_locks',` +@@ -5672,6 +7186,7 @@ interface(`files_search_locks',` type var_t, var_lock_t; ') @@ -15433,7 +15458,7 @@ index f962f76ad..f2b8e4558 100644 allow $1 var_lock_t:lnk_file read_lnk_file_perms; search_dirs_pattern($1, var_t, var_lock_t) ') -@@ -5698,7 +7178,26 @@ interface(`files_dontaudit_search_locks',` +@@ -5698,7 +7213,26 @@ interface(`files_dontaudit_search_locks',` ######################################## ## @@ -15461,7 +15486,7 @@ index f962f76ad..f2b8e4558 100644 ## ## ## -@@ -5706,13 +7205,12 @@ interface(`files_dontaudit_search_locks',` +@@ -5706,13 +7240,12 @@ interface(`files_dontaudit_search_locks',` ## ## # @@ -15478,7 +15503,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -5731,7 +7229,7 @@ interface(`files_rw_lock_dirs',` +@@ -5731,7 +7264,7 @@ interface(`files_rw_lock_dirs',` type var_t, var_lock_t; ') @@ -15487,7 +15512,7 @@ index f962f76ad..f2b8e4558 100644 rw_dirs_pattern($1, var_t, var_lock_t) ') -@@ -5764,7 +7262,6 @@ interface(`files_create_lock_dirs',` +@@ -5764,7 +7297,6 @@ interface(`files_create_lock_dirs',` ## Domain allowed access. ## ## @@ -15495,7 +15520,7 @@ index f962f76ad..f2b8e4558 100644 # interface(`files_relabel_all_lock_dirs',` gen_require(` -@@ -5779,7 +7276,7 @@ interface(`files_relabel_all_lock_dirs',` +@@ -5779,7 +7311,7 @@ interface(`files_relabel_all_lock_dirs',` ######################################## ## @@ -15504,7 +15529,7 @@ index f962f76ad..f2b8e4558 100644 ## ## ## -@@ -5787,13 +7284,33 @@ interface(`files_relabel_all_lock_dirs',` +@@ -5787,13 +7319,33 @@ interface(`files_relabel_all_lock_dirs',` ## ## # @@ -15539,7 +15564,7 @@ index f962f76ad..f2b8e4558 100644 allow $1 var_lock_t:dir list_dir_perms; getattr_files_pattern($1, var_lock_t, var_lock_t) ') -@@ -5809,13 +7326,12 @@ interface(`files_getattr_generic_locks',` +@@ -5809,13 +7361,12 @@ interface(`files_getattr_generic_locks',` ## # interface(`files_delete_generic_locks',` @@ -15557,7 +15582,7 @@ index f962f76ad..f2b8e4558 100644 ') ######################################## -@@ -5834,9 +7350,7 @@ interface(`files_manage_generic_locks',` +@@ -5834,9 +7385,7 @@ interface(`files_manage_generic_locks',` type var_t, var_lock_t; ') @@ -15568,7 +15593,7 @@ index f962f76ad..f2b8e4558 100644 manage_files_pattern($1, var_lock_t, var_lock_t) ') -@@ -5878,8 +7392,7 @@ interface(`files_read_all_locks',` +@@ -5878,8 +7427,7 @@ interface(`files_read_all_locks',` type var_t, var_lock_t; ') @@ -15578,7 +15603,7 @@ index f962f76ad..f2b8e4558 100644 allow $1 lockfile:dir list_dir_perms; read_files_pattern($1, lockfile, lockfile) read_lnk_files_pattern($1, lockfile, lockfile) -@@ -5901,8 +7414,7 @@ interface(`files_manage_all_locks',` +@@ -5901,8 +7449,7 @@ interface(`files_manage_all_locks',` type var_t, var_lock_t; ') @@ -15588,7 +15613,7 @@ index f962f76ad..f2b8e4558 100644 manage_dirs_pattern($1, lockfile, lockfile) manage_files_pattern($1, lockfile, lockfile) manage_lnk_files_pattern($1, lockfile, lockfile) -@@ -5939,8 +7451,7 @@ interface(`files_lock_filetrans',` +@@ -5939,8 +7486,7 @@ interface(`files_lock_filetrans',` type var_t, var_lock_t; ') @@ -15598,7 +15623,7 @@ index f962f76ad..f2b8e4558 100644 filetrans_pattern($1, var_lock_t, $2, $3, $4) ') -@@ -5979,7 +7490,7 @@ interface(`files_setattr_pid_dirs',` +@@ -5979,7 +7525,7 @@ interface(`files_setattr_pid_dirs',` type var_run_t; ') @@ -15607,7 +15632,7 @@ index f962f76ad..f2b8e4558 100644 allow $1 var_run_t:dir setattr; ') -@@ -5999,10 +7510,48 @@ interface(`files_search_pids',` +@@ -5999,10 +7545,48 @@ interface(`files_search_pids',` type var_t, var_run_t; ') @@ -15656,69 +15681,101 @@ index f962f76ad..f2b8e4558 100644 ######################################## ## ## Do not audit attempts to search -@@ -6025,6 +7574,43 @@ interface(`files_dontaudit_search_pids',` +@@ -6025,42 +7609,79 @@ interface(`files_dontaudit_search_pids',` ######################################## ## +-## List the contents of the runtime process +-## ID directories (/var/run). +## Do not audit attempts to search +## the all /var/run directory. + ## + ## + ## +-## Domain allowed access. ++## Domain to not audit. + ## + ## + # +-interface(`files_list_pids',` ++interface(`files_dontaudit_search_all_pids',` + gen_require(` +- type var_t, var_run_t; ++ attribute pidfile; + ') + +- allow $1 var_run_t:lnk_file read_lnk_file_perms; +- list_dirs_pattern($1, var_t, var_run_t) ++ dontaudit $1 pidfile:dir search_dir_perms; + ') + + ######################################## + ## +-## Read generic process ID files. ++## Allow search the all /var/run directory. + ## + ## + ## +-## Domain allowed access. ++## Domain to not audit. + ## + ## + # +-interface(`files_read_generic_pids',` ++interface(`files_search_all_pids',` + gen_require(` +- type var_t, var_run_t; ++ attribute pidfile; + ') + +- allow $1 var_run_t:lnk_file read_lnk_file_perms; +- list_dirs_pattern($1, var_t, var_run_t) +- read_files_pattern($1, var_run_t, var_run_t) ++ allow $1 pidfile:dir search_dir_perms; ++') ++ ++######################################## ++## ++## List the contents of the runtime process ++## ID directories (/var/run). +## +## +## -+## Domain to not audit. ++## Domain allowed access. +## +## +# -+interface(`files_dontaudit_search_all_pids',` ++interface(`files_list_pids',` + gen_require(` -+ attribute pidfile; ++ type var_t, var_run_t; + ') + -+ dontaudit $1 pidfile:dir search_dir_perms; ++ files_search_pids($1) ++ list_dirs_pattern($1, var_t, var_run_t) +') + +######################################## +## -+## Allow search the all /var/run directory. ++## Read generic process ID files. +## +## +## -+## Domain to not audit. ++## Domain allowed access. +## +## +# -+interface(`files_search_all_pids',` ++interface(`files_read_generic_pids',` + gen_require(` -+ attribute pidfile; ++ type var_t, var_run_t; + ') + -+ allow $1 pidfile:dir search_dir_perms; -+') -+ -+######################################## -+## - ## List the contents of the runtime process - ## ID directories (/var/run). - ## -@@ -6039,7 +7625,7 @@ interface(`files_list_pids',` - type var_t, var_run_t; - ') - -- allow $1 var_run_t:lnk_file read_lnk_file_perms; + files_search_pids($1) - list_dirs_pattern($1, var_t, var_run_t) ++ list_dirs_pattern($1, var_t, var_run_t) ++ read_files_pattern($1, var_run_t, var_run_t) ') -@@ -6058,7 +7644,7 @@ interface(`files_read_generic_pids',` - type var_t, var_run_t; - ') - -- allow $1 var_run_t:lnk_file read_lnk_file_perms; -+ files_search_pids($1) - list_dirs_pattern($1, var_t, var_run_t) - read_files_pattern($1, var_run_t, var_run_t) - ') -@@ -6078,7 +7664,7 @@ interface(`files_write_generic_pid_pipes',` + ######################################## +@@ -6078,7 +7699,7 @@ interface(`files_write_generic_pid_pipes',` type var_run_t; ') @@ -15727,7 +15784,7 @@ index f962f76ad..f2b8e4558 100644 allow $1 var_run_t:fifo_file write; ') -@@ -6140,7 +7726,6 @@ interface(`files_pid_filetrans',` +@@ -6140,7 +7761,6 @@ interface(`files_pid_filetrans',` ') allow $1 var_t:dir search_dir_perms; @@ -15735,7 +15792,7 @@ index f962f76ad..f2b8e4558 100644 filetrans_pattern($1, var_run_t, $2, $3, $4) ') -@@ -6169,6 +7754,24 @@ interface(`files_pid_filetrans_lock_dir',` +@@ -6169,6 +7789,24 @@ interface(`files_pid_filetrans_lock_dir',` ######################################## ## @@ -15760,7 +15817,7 @@ index f962f76ad..f2b8e4558 100644 ## Read and write generic process ID files. ## ## -@@ -6182,7 +7785,7 @@ interface(`files_rw_generic_pids',` +@@ -6182,7 +7820,7 @@ interface(`files_rw_generic_pids',` type var_t, var_run_t; ') @@ -15769,221 +15826,307 @@ index f962f76ad..f2b8e4558 100644 list_dirs_pattern($1, var_t, var_run_t) rw_files_pattern($1, var_run_t, var_run_t) ') -@@ -6249,6 +7852,116 @@ interface(`files_dontaudit_ioctl_all_pids',` +@@ -6249,55 +7887,43 @@ interface(`files_dontaudit_ioctl_all_pids',` ######################################## ## +-## Read all process ID files. +## Relable all pid directories -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## + ## Domain allowed access. + ## + ## +-## + # +-interface(`files_read_all_pids',` +interface(`files_relabel_all_pid_dirs',` -+ gen_require(` -+ attribute pidfile; -+ ') -+ + gen_require(` + attribute pidfile; +- type var_t, var_run_t; + ') + +- allow $1 var_run_t:lnk_file read_lnk_file_perms; +- list_dirs_pattern($1, var_t, pidfile) +- read_files_pattern($1, pidfile, pidfile) + relabel_dirs_pattern($1, pidfile, pidfile) -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Delete all process IDs. +## Delete all pid sockets -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## + ## Domain allowed access. + ## + ## +-## + # +-interface(`files_delete_all_pids',` +interface(`files_delete_all_pid_sockets',` -+ gen_require(` -+ attribute pidfile; -+ ') -+ + gen_require(` + attribute pidfile; +- type var_t, var_run_t; + ') + +- allow $1 var_t:dir search_dir_perms; +- allow $1 var_run_t:lnk_file read_lnk_file_perms; +- allow $1 var_run_t:dir rmdir; +- allow $1 var_run_t:lnk_file delete_lnk_file_perms; +- delete_files_pattern($1, pidfile, pidfile) +- delete_fifo_files_pattern($1, pidfile, pidfile) +- delete_sock_files_pattern($1, pidfile, { pidfile var_run_t }) + allow $1 pidfile:sock_file delete_sock_file_perms; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Delete all process ID directories. +## Create all pid sockets -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -6305,42 +7931,35 @@ interface(`files_delete_all_pids',` + ## + ## + # +-interface(`files_delete_all_pid_dirs',` +interface(`files_create_all_pid_sockets',` -+ gen_require(` -+ attribute pidfile; -+ ') -+ + gen_require(` + attribute pidfile; +- type var_t, var_run_t; + ') + +- allow $1 var_t:dir search_dir_perms; +- allow $1 var_run_t:lnk_file read_lnk_file_perms; +- delete_dirs_pattern($1, pidfile, pidfile) + allow $1 pidfile:sock_file create_sock_file_perms; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Create, read, write and delete all +-## var_run (pid) content +## Create all pid named pipes -+## -+## -+## + ## + ## + ## +-## Domain alloed access. +## Domain allowed access. -+## -+## -+# + ## + ## + # +-interface(`files_manage_all_pids',` +interface(`files_create_all_pid_pipes',` -+ gen_require(` -+ attribute pidfile; -+ ') -+ + gen_require(` + attribute pidfile; + ') + +- manage_dirs_pattern($1, pidfile, pidfile) +- manage_files_pattern($1, pidfile, pidfile) +- manage_lnk_files_pattern($1, pidfile, pidfile) + allow $1 pidfile:fifo_file create_fifo_file_perms; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Mount filesystems on all polyinstantiation +-## member directories. +## Delete all pid named pipes -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -6348,18 +7967,18 @@ interface(`files_manage_all_pids',` + ## + ## + # +-interface(`files_mounton_all_poly_members',` +interface(`files_delete_all_pid_pipes',` -+ gen_require(` + gen_require(` +- attribute polymember; + attribute pidfile; -+ ') -+ + ') + +- allow $1 polymember:dir mounton; + allow $1 pidfile:fifo_file delete_fifo_file_perms; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Search the contents of generic spool +-## directories (/var/spool). +## manage all pidfile directories +## in the /var/run directory. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -6367,37 +7986,40 @@ interface(`files_mounton_all_poly_members',` + ## + ## + # +-interface(`files_search_spool',` +interface(`files_manage_all_pid_dirs',` -+ gen_require(` + gen_require(` +- type var_t, var_spool_t; + attribute pidfile; -+ ') -+ + ') + +- search_dirs_pattern($1, var_t, var_spool_t) + manage_dirs_pattern($1,pidfile,pidfile) -+') -+ + ') + + -+######################################## -+## - ## Read all process ID files. + ######################################## + ## +-## Do not audit attempts to search generic +-## spool directories. ++## Read all process ID files. ## ## -@@ -6261,12 +7974,105 @@ interface(`files_dontaudit_ioctl_all_pids',` - interface(`files_read_all_pids',` + ## +-## Domain to not audit. ++## Domain allowed access. + ## + ## ++## + # +-interface(`files_dontaudit_search_spool',` ++interface(`files_read_all_pids',` gen_require(` - attribute pidfile; -- type var_t, var_run_t; +- type var_spool_t; ++ attribute pidfile; + type var_t; ') -- allow $1 var_run_t:lnk_file read_lnk_file_perms; - list_dirs_pattern($1, var_t, pidfile) - read_files_pattern($1, pidfile, pidfile) +- dontaudit $1 var_spool_t:dir search_dir_perms; ++ list_dirs_pattern($1, var_t, pidfile) ++ read_files_pattern($1, pidfile, pidfile) + read_lnk_files_pattern($1, pidfile, pidfile) -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## List the contents of generic spool +-## (/var/spool) directories. +## Relable all pid files -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -6405,18 +8027,17 @@ interface(`files_dontaudit_search_spool',` + ## + ## + # +-interface(`files_list_spool',` +interface(`files_relabel_all_pid_files',` -+ gen_require(` + gen_require(` +- type var_t, var_spool_t; + attribute pidfile; -+ ') -+ + ') + +- list_dirs_pattern($1, var_t, var_spool_t) + relabel_files_pattern($1, pidfile, pidfile) -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Create, read, write, and delete generic +-## spool directories (/var/spool). +## Execute generic programs in /var/run in the caller domain. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -6424,18 +8045,18 @@ interface(`files_list_spool',` + ## + ## + # +-interface(`files_manage_generic_spool_dirs',` +interface(`files_exec_generic_pid_files',` -+ gen_require(` + gen_require(` +- type var_t, var_spool_t; + type var_run_t; -+ ') -+ + ') + +- allow $1 var_t:dir search_dir_perms; +- manage_dirs_pattern($1, var_spool_t, var_spool_t) + exec_files_pattern($1, var_run_t, var_run_t) -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Read generic spool files. +## Write all sockets +## in the /var/run directory. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -6443,19 +8064,18 @@ interface(`files_manage_generic_spool_dirs',` + ## + ## + # +-interface(`files_read_generic_spool',` +interface(`files_write_all_pid_sockets',` -+ gen_require(` + gen_require(` +- type var_t, var_spool_t; + attribute pidfile; -+ ') -+ + ') + +- list_dirs_pattern($1, var_t, var_spool_t) +- read_files_pattern($1, var_spool_t, var_spool_t) + allow $1 pidfile:sock_file write_sock_file_perms; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Create, read, write, and delete generic +-## spool files. +## manage all pidfiles +## in the /var/run directory. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -6463,55 +8083,62 @@ interface(`files_read_generic_spool',` + ## + ## + # +-interface(`files_manage_generic_spool',` +interface(`files_manage_all_pids',` -+ gen_require(` + gen_require(` +- type var_t, var_spool_t; + attribute pidfile; -+ ') -+ + ') + +- allow $1 var_t:dir search_dir_perms; +- manage_files_pattern($1, var_spool_t, var_spool_t) + manage_files_pattern($1,pidfile,pidfile) -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Create objects in the spool directory +-## with a private type with a type transition. +## Mount filesystems on all polyinstantiation +## member directories. -+## -+## -+## -+## Domain allowed access. -+## -+## + ## + ## + ## + ## Domain allowed access. + ## + ## +-## +-## +-## Type to which the created node will be transitioned. +-## +-## +-## +-## +-## Object class(es) (single or set including {}) for which this +-## the transition will occur. +-## +-## +-## +# +interface(`files_mounton_all_poly_members',` + gen_require(` @@ -15991,36 +16134,107 @@ index f962f76ad..f2b8e4558 100644 + ') + + allow $1 polymember:dir mounton; - ') - - ######################################## -@@ -6286,8 +8092,8 @@ interface(`files_delete_all_pids',` - type var_t, var_run_t; ++') ++ ++######################################## ++## ++## Delete all process IDs. ++## ++## + ## +-## The name of the object being created. ++## Domain allowed access. + ## + ## ++## + # +-interface(`files_spool_filetrans',` ++interface(`files_delete_all_pids',` + gen_require(` +- type var_t, var_spool_t; ++ attribute pidfile; ++ type var_t, var_run_t; ') + files_search_pids($1) allow $1 var_t:dir search_dir_perms; -- allow $1 var_run_t:lnk_file read_lnk_file_perms; - allow $1 var_run_t:dir rmdir; - allow $1 var_run_t:lnk_file delete_lnk_file_perms; - delete_files_pattern($1, pidfile, pidfile) -@@ -6311,36 +8117,80 @@ interface(`files_delete_all_pid_dirs',` - type var_t, var_run_t; +- filetrans_pattern($1, var_spool_t, $2, $3, $4) ++ allow $1 var_run_t:dir rmdir; ++ allow $1 var_run_t:lnk_file delete_lnk_file_perms; ++ delete_files_pattern($1, pidfile, pidfile) ++ delete_fifo_files_pattern($1, pidfile, pidfile) ++ delete_sock_files_pattern($1, pidfile, { pidfile var_run_t }) + ') + + ######################################## + ## +-## Allow access to manage all polyinstantiated +-## directories on the system. ++## Delete all process ID directories. + ## + ## + ## +@@ -6519,64 +8146,963 @@ interface(`files_spool_filetrans',` + ## + ## + # +-interface(`files_polyinstantiate_all',` ++interface(`files_delete_all_pid_dirs',` + gen_require(` +- attribute polydir, polymember, polyparent; +- type poly_t; ++ attribute pidfile; ++ type var_t, var_run_t; ') +- # Need to give access to /selinux/member +- selinux_compute_member($1) +- +- # Need sys_admin capability for mounting +- allow $1 self:capability { chown fsetid sys_admin fowner }; +- +- # Need to give access to the directories to be polyinstantiated +- allow $1 polydir:dir { create open getattr search write add_name setattr mounton rmdir }; +- +- # Need to give access to the polyinstantiated subdirectories +- allow $1 polymember:dir search_dir_perms; +- +- # Need to give access to parent directories where original +- # is remounted for polyinstantiation aware programs (like gdm) +- allow $1 polyparent:dir { getattr mounton }; +- +- # Need to give permission to create directories where applicable +- allow $1 self:process setfscreate; +- allow $1 polymember: dir { create setattr relabelto }; +- allow $1 polydir: dir { write add_name open }; +- allow $1 polyparent:dir { open read write remove_name add_name relabelfrom relabelto }; +- +- # Default type for mountpoints +- allow $1 poly_t:dir { create mounton }; +- fs_unmount_xattr_fs($1) +- +- fs_mount_tmpfs($1) +- fs_unmount_tmpfs($1) +- +- ifdef(`distro_redhat',` +- # namespace.init +- files_search_tmp($1) +- files_search_home($1) +- corecmd_exec_bin($1) +- seutil_domtrans_setfiles($1) +- ') + files_search_pids($1) - allow $1 var_t:dir search_dir_perms; -- allow $1 var_run_t:lnk_file read_lnk_file_perms; - delete_dirs_pattern($1, pidfile, pidfile) ++ allow $1 var_t:dir search_dir_perms; ++ delete_dirs_pattern($1, pidfile, pidfile) ') ######################################## ## --## Create, read, write and delete all --## var_run (pid) content +-## Unconfined access to files. +## Make the specified type a file +## used for spool files. -+## + ## +-## +## +##

+## Make the specified type usable for spool files. @@ -16048,18 +16262,22 @@ index f962f76ad..f2b8e4558 100644 +##

+## +## -+## + ## +-## Domain allowed access. +## Type of the file to be used as a +## spool file. -+## -+## + ## + ## +## -+# + # +-interface(`files_unconfined',` +interface(`files_spool_file',` -+ gen_require(` + gen_require(` +- attribute files_unconfined_type; + attribute spoolfile; -+ ') -+ + ') + +- typeattribute $1 files_unconfined_type; + files_type($1) + typeattribute $1 spoolfile; +') @@ -16067,47 +16285,36 @@ index f962f76ad..f2b8e4558 100644 +######################################## +## +## Create all spool sockets - ## - ## - ## --## Domain alloed access. ++## ++## ++## +## Domain allowed access. - ## - ## - # --interface(`files_manage_all_pids',` ++## ++## ++# +interface(`files_create_all_spool_sockets',` - gen_require(` -- attribute pidfile; ++ gen_require(` + attribute spoolfile; - ') - -- manage_dirs_pattern($1, pidfile, pidfile) -- manage_files_pattern($1, pidfile, pidfile) -- manage_lnk_files_pattern($1, pidfile, pidfile) ++ ') ++ + allow $1 spoolfile:sock_file create_sock_file_perms; - ') - - ######################################## - ## --## Mount filesystems on all polyinstantiation --## member directories. ++') ++ ++######################################## ++## +## Delete all spool sockets - ## - ## - ## -@@ -6348,12 +8198,33 @@ interface(`files_manage_all_pids',` - ## - ## - # --interface(`files_mounton_all_poly_members',` ++## ++## ++## ++## Domain allowed access. ++## ++## ++# +interface(`files_delete_all_spool_sockets',` - gen_require(` -- attribute polymember; ++ gen_require(` + attribute spoolfile; - ') - -- allow $1 polymember:dir mounton; ++ ') ++ + allow $1 spoolfile:sock_file delete_sock_file_perms; +') + @@ -16130,13 +16337,232 @@ index f962f76ad..f2b8e4558 100644 + ') + + relabel_dirs_pattern($1, spoolfile, spoolfile) - ') - - ######################################## -@@ -6580,3 +8451,623 @@ interface(`files_unconfined',` - - typeattribute $1 files_unconfined_type; - ') ++') ++ ++######################################## ++## ++## Search the contents of generic spool ++## directories (/var/spool). ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_search_spool',` ++ gen_require(` ++ type var_t, var_spool_t; ++ ') ++ ++ search_dirs_pattern($1, var_t, var_spool_t) ++') ++ ++######################################## ++## ++## Do not audit attempts to search generic ++## spool directories. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`files_dontaudit_search_spool',` ++ gen_require(` ++ type var_spool_t; ++ ') ++ ++ dontaudit $1 var_spool_t:dir search_dir_perms; ++') ++ ++######################################## ++## ++## List the contents of generic spool ++## (/var/spool) directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_list_spool',` ++ gen_require(` ++ type var_t, var_spool_t; ++ ') ++ ++ list_dirs_pattern($1, var_t, var_spool_t) ++') ++ ++######################################## ++## ++## Create, read, write, and delete generic ++## spool directories (/var/spool). ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_manage_generic_spool_dirs',` ++ gen_require(` ++ type var_t, var_spool_t; ++ ') ++ ++ allow $1 var_t:dir search_dir_perms; ++ manage_dirs_pattern($1, var_spool_t, var_spool_t) ++') ++ ++######################################## ++## ++## Read generic spool files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_read_generic_spool',` ++ gen_require(` ++ type var_t, var_spool_t; ++ ') ++ ++ list_dirs_pattern($1, var_t, var_spool_t) ++ read_files_pattern($1, var_spool_t, var_spool_t) ++') ++ ++######################################## ++## ++## Create, read, write, and delete generic ++## spool files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_manage_generic_spool',` ++ gen_require(` ++ type var_t, var_spool_t; ++ ') ++ ++ allow $1 var_t:dir search_dir_perms; ++ manage_files_pattern($1, var_spool_t, var_spool_t) ++') ++ ++######################################## ++## ++## Create objects in the spool directory ++## with a private type with a type transition. ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++## ++## Type to which the created node will be transitioned. ++## ++## ++## ++## ++## Object class(es) (single or set including {}) for which this ++## the transition will occur. ++## ++## ++## ++## ++## The name of the object being created. ++## ++## ++# ++interface(`files_spool_filetrans',` ++ gen_require(` ++ type var_t, var_spool_t; ++ ') ++ ++ allow $1 var_t:dir search_dir_perms; ++ filetrans_pattern($1, var_spool_t, $2, $3, $4) ++') ++ ++######################################## ++## ++## Allow access to manage all polyinstantiated ++## directories on the system. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_polyinstantiate_all',` ++ gen_require(` ++ attribute polydir, polymember, polyparent; ++ type poly_t; ++ ') ++ ++ # Need to give access to /selinux/member ++ selinux_compute_member($1) ++ ++ # Need sys_admin capability for mounting ++ allow $1 self:capability { chown fsetid sys_admin fowner }; ++ ++ # Need to give access to the directories to be polyinstantiated ++ allow $1 polydir:dir { create open getattr search write add_name setattr mounton rmdir }; ++ ++ # Need to give access to the polyinstantiated subdirectories ++ allow $1 polymember:dir search_dir_perms; ++ ++ # Need to give access to parent directories where original ++ # is remounted for polyinstantiation aware programs (like gdm) ++ allow $1 polyparent:dir { getattr mounton }; ++ ++ # Need to give permission to create directories where applicable ++ allow $1 self:process setfscreate; ++ allow $1 polymember: dir { create setattr relabelto }; ++ allow $1 polydir: dir { write add_name open }; ++ allow $1 polyparent:dir { open read write remove_name add_name relabelfrom relabelto }; ++ ++ # Default type for mountpoints ++ allow $1 poly_t:dir { create mounton }; ++ fs_unmount_xattr_fs($1) ++ ++ fs_mount_tmpfs($1) ++ fs_unmount_tmpfs($1) ++ ++ ifdef(`distro_redhat',` ++ # namespace.init ++ files_search_tmp($1) ++ files_search_home($1) ++ corecmd_exec_bin($1) ++ seutil_domtrans_setfiles($1) ++ ') ++') ++ ++######################################## ++## ++## Unconfined access to files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_unconfined',` ++ gen_require(` ++ attribute files_unconfined_type; ++ ') ++ ++ typeattribute $1 files_unconfined_type; ++') + +######################################## +## @@ -16756,7 +17182,7 @@ index f962f76ad..f2b8e4558 100644 + ') + + allow $1 modules_object_t:dir mounton; -+') + ') diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te index 1a03abdd7..3221f8018 100644 --- a/policy/modules/kernel/files.te @@ -22774,7 +23200,7 @@ index e100d886b..355a67b18 100644 +') + diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te -index 8dbab4c5e..2d283007a 100644 +index 8dbab4c5e..4818adb52 100644 --- a/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te @@ -25,6 +25,9 @@ attribute kern_unconfined; @@ -22865,8 +23291,11 @@ index 8dbab4c5e..2d283007a 100644 # /proc/sys/net directory and files type sysctl_net_t, sysctl_type; genfscon proc /sys/net gen_context(system_u:object_r:sysctl_net_t,s0) -@@ -153,6 +176,10 @@ genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0) +@@ -151,8 +174,13 @@ genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0) + + # /proc/sys/vm directory and files type sysctl_vm_t, sysctl_type; ++fs_associate(sysctl_vm_t) genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0) +# /proc/sys/vm/overcommit_memory @@ -22876,7 +23305,7 @@ index 8dbab4c5e..2d283007a 100644 # /proc/sys/dev directory and files type sysctl_dev_t, sysctl_type; genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0) -@@ -165,6 +192,14 @@ genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0) +@@ -165,6 +193,14 @@ genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0) type unlabeled_t; fs_associate(unlabeled_t) sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) @@ -22891,7 +23320,7 @@ index 8dbab4c5e..2d283007a 100644 # These initial sids are no longer used, and can be removed: sid any_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) -@@ -189,6 +224,7 @@ sid tcp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) +@@ -189,6 +225,7 @@ sid tcp_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) # kernel local policy # @@ -22899,7 +23328,7 @@ index 8dbab4c5e..2d283007a 100644 allow kernel_t self:capability ~sys_module; allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow kernel_t self:shm create_shm_perms; -@@ -233,7 +269,6 @@ allow unlabeled_t unlabeled_t:packet { forward_in forward_out }; +@@ -233,7 +270,6 @@ allow unlabeled_t unlabeled_t:packet { forward_in forward_out }; corenet_in_generic_if(unlabeled_t) corenet_in_generic_node(unlabeled_t) @@ -22907,7 +23336,7 @@ index 8dbab4c5e..2d283007a 100644 corenet_all_recvfrom_netlabel(kernel_t) # Kernel-generated traffic e.g., ICMP replies: corenet_raw_sendrecv_all_if(kernel_t) -@@ -244,17 +279,26 @@ corenet_tcp_sendrecv_all_if(kernel_t) +@@ -244,17 +280,26 @@ corenet_tcp_sendrecv_all_if(kernel_t) corenet_tcp_sendrecv_all_nodes(kernel_t) corenet_raw_send_generic_node(kernel_t) corenet_send_all_packets(kernel_t) @@ -22938,7 +23367,7 @@ index 8dbab4c5e..2d283007a 100644 # Mount root file system. Used when loading a policy # from initrd, then mounting the root filesystem -@@ -263,7 +307,8 @@ fs_unmount_all_fs(kernel_t) +@@ -263,7 +308,8 @@ fs_unmount_all_fs(kernel_t) selinux_load_policy(kernel_t) @@ -22948,7 +23377,7 @@ index 8dbab4c5e..2d283007a 100644 corecmd_exec_shell(kernel_t) corecmd_list_bin(kernel_t) -@@ -277,13 +322,23 @@ files_list_root(kernel_t) +@@ -277,13 +323,23 @@ files_list_root(kernel_t) files_list_etc(kernel_t) files_list_home(kernel_t) files_read_usr_files(kernel_t) @@ -22972,7 +23401,7 @@ index 8dbab4c5e..2d283007a 100644 ifdef(`distro_redhat',` # Bugzilla 222337 -@@ -291,11 +346,29 @@ ifdef(`distro_redhat',` +@@ -291,11 +347,29 @@ ifdef(`distro_redhat',` ') optional_policy(` @@ -23002,7 +23431,7 @@ index 8dbab4c5e..2d283007a 100644 ') optional_policy(` -@@ -305,6 +378,19 @@ optional_policy(` +@@ -305,6 +379,19 @@ optional_policy(` optional_policy(` logging_send_syslog_msg(kernel_t) @@ -23022,7 +23451,7 @@ index 8dbab4c5e..2d283007a 100644 ') optional_policy(` -@@ -312,6 +398,11 @@ optional_policy(` +@@ -312,6 +399,11 @@ optional_policy(` ') optional_policy(` @@ -23034,7 +23463,7 @@ index 8dbab4c5e..2d283007a 100644 # nfs kernel server needs kernel UDP access. It is less risky and painful # to just give it everything. allow kernel_t self:tcp_socket create_stream_socket_perms; -@@ -332,9 +423,6 @@ optional_policy(` +@@ -332,9 +424,6 @@ optional_policy(` sysnet_read_config(kernel_t) @@ -23044,7 +23473,7 @@ index 8dbab4c5e..2d283007a 100644 rpc_udp_rw_nfs_sockets(kernel_t) tunable_policy(`nfs_export_all_ro',` -@@ -343,9 +431,7 @@ optional_policy(` +@@ -343,9 +432,7 @@ optional_policy(` fs_read_noxattr_fs_files(kernel_t) fs_read_noxattr_fs_symlinks(kernel_t) @@ -23055,7 +23484,7 @@ index 8dbab4c5e..2d283007a 100644 ') tunable_policy(`nfs_export_all_rw',` -@@ -354,7 +440,7 @@ optional_policy(` +@@ -354,7 +441,7 @@ optional_policy(` fs_read_noxattr_fs_files(kernel_t) fs_read_noxattr_fs_symlinks(kernel_t) @@ -23064,7 +23493,7 @@ index 8dbab4c5e..2d283007a 100644 ') ') -@@ -364,9 +450,22 @@ optional_policy(` +@@ -364,9 +451,22 @@ optional_policy(` ') optional_policy(` @@ -23087,7 +23516,7 @@ index 8dbab4c5e..2d283007a 100644 ######################################## # # Unlabeled process local policy -@@ -388,6 +487,8 @@ optional_policy(` +@@ -388,6 +488,8 @@ optional_policy(` if( ! secure_mode_insmod ) { allow can_load_kernmodule self:capability sys_module; @@ -23096,7 +23525,7 @@ index 8dbab4c5e..2d283007a 100644 # load_module() calls stop_machine() which # calls sched_setscheduler() allow can_load_kernmodule self:capability sys_nice; -@@ -399,14 +500,38 @@ if( ! secure_mode_insmod ) { +@@ -399,14 +501,38 @@ if( ! secure_mode_insmod ) { # Rules for unconfined acccess to this module # @@ -32011,7 +32440,7 @@ index 6bf0ecc2d..75b2f31f9 100644 +') + diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te -index 8b403774f..c92883696 100644 +index 8b403774f..cc3f2671f 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -26,28 +26,66 @@ gen_require(` @@ -32370,7 +32799,7 @@ index 8b403774f..c92883696 100644 ssh_sigchld(xauth_t) ssh_read_pipes(xauth_t) ssh_dontaudit_rw_tcp_sockets(xauth_t) -@@ -300,64 +420,108 @@ optional_policy(` +@@ -300,64 +420,110 @@ optional_policy(` # XDM Local policy # @@ -32403,11 +32832,13 @@ index 8b403774f..c92883696 100644 + +allow xdm_t xauth_home_t:file manage_file_perms; + ++allow xdm_t xserver_unconfined_type:process { signull }; + +-allow xdm_t xconsole_device_t:fifo_file { getattr setattr }; +allow xdm_t xconsole_device_t:fifo_file { getattr_fifo_file_perms setattr_fifo_file_perms }; +manage_dirs_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t) +manage_files_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t) - --allow xdm_t xconsole_device_t:fifo_file { getattr setattr }; ++ +manage_dirs_pattern(xdm_t, xdm_home_t, xdm_home_t) +manage_files_pattern(xdm_t, xdm_home_t, xdm_home_t) +xserver_filetrans_home_content(xdm_t) @@ -32464,12 +32895,12 @@ index 8b403774f..c92883696 100644 manage_dirs_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t) manage_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t) ++exec_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t) +manage_lnk_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t) manage_fifo_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t) -files_pid_filetrans(xdm_t, xdm_var_run_t, { dir file fifo_file }) +manage_sock_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t) +files_pid_filetrans(xdm_t, xdm_var_run_t, { dir file fifo_file sock_file }) -+allow xdm_t xdm_var_run_t:file map; -allow xdm_t xserver_t:process signal; +allow xdm_t xserver_t:process { signal signull }; @@ -32492,7 +32923,7 @@ index 8b403774f..c92883696 100644 # connect to xdm xserver over stream socket stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) -@@ -366,20 +530,31 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) +@@ -366,20 +532,32 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) @@ -32517,6 +32948,7 @@ index 8b403774f..c92883696 100644 +kernel_request_load_module(xdm_t) +kernel_stream_connect(xdm_t) +kernel_view_key(xdm_t) ++kernel_read_usermodehelper_state(xdm_t) corecmd_exec_shell(xdm_t) corecmd_exec_bin(xdm_t) @@ -32526,7 +32958,7 @@ index 8b403774f..c92883696 100644 corenet_all_recvfrom_netlabel(xdm_t) corenet_tcp_sendrecv_generic_if(xdm_t) corenet_udp_sendrecv_generic_if(xdm_t) -@@ -389,38 +564,51 @@ corenet_tcp_sendrecv_all_ports(xdm_t) +@@ -389,38 +567,51 @@ corenet_tcp_sendrecv_all_ports(xdm_t) corenet_udp_sendrecv_all_ports(xdm_t) corenet_tcp_bind_generic_node(xdm_t) corenet_udp_bind_generic_node(xdm_t) @@ -32582,7 +33014,7 @@ index 8b403774f..c92883696 100644 files_read_etc_files(xdm_t) files_read_var_files(xdm_t) -@@ -431,9 +619,30 @@ files_list_mnt(xdm_t) +@@ -431,9 +622,30 @@ files_list_mnt(xdm_t) files_read_usr_files(xdm_t) # Poweroff wants to create the /poweroff file when run from xdm files_create_boot_flag(xdm_t) @@ -32613,7 +33045,7 @@ index 8b403774f..c92883696 100644 storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t) -@@ -442,28 +651,50 @@ storage_dontaudit_raw_read_removable_device(xdm_t) +@@ -442,28 +654,50 @@ storage_dontaudit_raw_read_removable_device(xdm_t) storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t) @@ -32669,7 +33101,7 @@ index 8b403774f..c92883696 100644 userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_create_all_users_keys(xdm_t) -@@ -472,24 +703,171 @@ userdom_read_user_home_content_files(xdm_t) +@@ -472,24 +706,171 @@ userdom_read_user_home_content_files(xdm_t) # Search /proc for any user domain processes. userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) @@ -32847,7 +33279,7 @@ index 8b403774f..c92883696 100644 tunable_policy(`xdm_sysadm_login',` userdom_xsession_spec_domtrans_all_users(xdm_t) # FIXME: -@@ -502,12 +880,31 @@ tunable_policy(`xdm_sysadm_login',` +@@ -502,12 +883,31 @@ tunable_policy(`xdm_sysadm_login',` # allow xserver_t xdm_tmpfs_t:file rw_file_perms; ') @@ -32879,7 +33311,7 @@ index 8b403774f..c92883696 100644 ') optional_policy(` -@@ -518,8 +915,36 @@ optional_policy(` +@@ -518,8 +918,36 @@ optional_policy(` dbus_system_bus_client(xdm_t) dbus_connect_system_bus(xdm_t) @@ -32898,7 +33330,8 @@ index 8b403774f..c92883696 100644 + cpufreqselector_dbus_chat(xdm_t) + ') + -+ optional_policy(` + optional_policy(` +- accountsd_dbus_chat(xdm_t) + devicekit_dbus_chat_disk(xdm_t) + devicekit_dbus_chat_power(xdm_t) + ') @@ -32907,8 +33340,7 @@ index 8b403774f..c92883696 100644 + hal_dbus_chat(xdm_t) + ') + - optional_policy(` -- accountsd_dbus_chat(xdm_t) ++ optional_policy(` + gnomeclock_dbus_chat(xdm_t) + ') + @@ -32917,7 +33349,7 @@ index 8b403774f..c92883696 100644 ') ') -@@ -530,6 +955,20 @@ optional_policy(` +@@ -530,6 +958,20 @@ optional_policy(` ') optional_policy(` @@ -32938,7 +33370,7 @@ index 8b403774f..c92883696 100644 hostname_exec(xdm_t) ') -@@ -547,28 +986,78 @@ optional_policy(` +@@ -547,28 +989,78 @@ optional_policy(` ') optional_policy(` @@ -33026,7 +33458,7 @@ index 8b403774f..c92883696 100644 ') optional_policy(` -@@ -580,6 +1069,14 @@ optional_policy(` +@@ -580,6 +1072,14 @@ optional_policy(` ') optional_policy(` @@ -33041,7 +33473,7 @@ index 8b403774f..c92883696 100644 xfs_stream_connect(xdm_t) ') -@@ -594,7 +1091,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t; +@@ -594,7 +1094,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t; type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t; allow xserver_t { root_xdrawable_t x_domain }:x_drawable send; @@ -33050,7 +33482,7 @@ index 8b403774f..c92883696 100644 # setuid/setgid for the wrapper program to change UID # sys_rawio is for iopl access - should not be needed for frame-buffer -@@ -604,8 +1101,11 @@ allow xserver_t input_xevent_t:x_event send; +@@ -604,8 +1104,11 @@ allow xserver_t input_xevent_t:x_event send; # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack @@ -33063,7 +33495,7 @@ index 8b403774f..c92883696 100644 allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow xserver_t self:fd use; allow xserver_t self:fifo_file rw_fifo_file_perms; -@@ -618,8 +1118,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; +@@ -618,8 +1121,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:udp_socket create_socket_perms; @@ -33079,7 +33511,7 @@ index 8b403774f..c92883696 100644 manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) -@@ -627,36 +1134,53 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) +@@ -627,36 +1137,53 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file) @@ -33137,7 +33569,7 @@ index 8b403774f..c92883696 100644 corenet_all_recvfrom_netlabel(xserver_t) corenet_tcp_sendrecv_generic_if(xserver_t) corenet_udp_sendrecv_generic_if(xserver_t) -@@ -677,23 +1201,29 @@ dev_rw_apm_bios(xserver_t) +@@ -677,23 +1204,29 @@ dev_rw_apm_bios(xserver_t) dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) @@ -33170,7 +33602,7 @@ index 8b403774f..c92883696 100644 # brought on by rhgb files_search_mnt(xserver_t) -@@ -705,6 +1235,14 @@ fs_search_nfs(xserver_t) +@@ -705,6 +1238,14 @@ fs_search_nfs(xserver_t) fs_search_auto_mountpoints(xserver_t) fs_search_ramfs(xserver_t) @@ -33185,7 +33617,7 @@ index 8b403774f..c92883696 100644 mls_xwin_read_to_clearance(xserver_t) selinux_validate_context(xserver_t) -@@ -718,28 +1256,25 @@ init_getpgid(xserver_t) +@@ -718,28 +1259,25 @@ init_getpgid(xserver_t) term_setattr_unallocated_ttys(xserver_t) term_use_unallocated_ttys(xserver_t) @@ -33218,7 +33650,7 @@ index 8b403774f..c92883696 100644 ifndef(`distro_redhat',` allow xserver_t self:process { execmem execheap execstack }; -@@ -785,17 +1320,54 @@ optional_policy(` +@@ -785,17 +1323,54 @@ optional_policy(` ') optional_policy(` @@ -33275,7 +33707,7 @@ index 8b403774f..c92883696 100644 ') optional_policy(` -@@ -803,6 +1375,10 @@ optional_policy(` +@@ -803,6 +1378,10 @@ optional_policy(` ') optional_policy(` @@ -33286,7 +33718,7 @@ index 8b403774f..c92883696 100644 xfs_stream_connect(xserver_t) ') -@@ -818,18 +1394,17 @@ allow xserver_t xdm_t:shm rw_shm_perms; +@@ -818,18 +1397,17 @@ allow xserver_t xdm_t:shm rw_shm_perms; # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open # handle of a file inside the dir!!! @@ -33311,7 +33743,7 @@ index 8b403774f..c92883696 100644 can_exec(xserver_t, xkb_var_lib_t) # VNC v4 module in X server -@@ -842,26 +1417,21 @@ init_use_fds(xserver_t) +@@ -842,26 +1420,21 @@ init_use_fds(xserver_t) # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_user_home_content_files(xserver_t) @@ -33346,7 +33778,7 @@ index 8b403774f..c92883696 100644 ') optional_policy(` -@@ -912,7 +1482,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy +@@ -912,7 +1485,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show }; # operations allowed on my windows allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; @@ -33355,7 +33787,7 @@ index 8b403774f..c92883696 100644 # operations allowed on all windows allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child }; -@@ -966,11 +1536,31 @@ allow x_domain self:x_resource { read write }; +@@ -966,11 +1539,31 @@ allow x_domain self:x_resource { read write }; # can mess with the screensaver allow x_domain xserver_t:x_screen { getattr saver_getattr }; @@ -33387,7 +33819,7 @@ index 8b403774f..c92883696 100644 tunable_policy(`! xserver_object_manager',` # should be xserver_unconfined(x_domain), # but typeattribute doesnt work in conditionals -@@ -992,18 +1582,148 @@ tunable_policy(`! xserver_object_manager',` +@@ -992,18 +1585,148 @@ tunable_policy(`! xserver_object_manager',` allow x_domain xevent_type:{ x_event x_synthetic_event } *; ') @@ -34766,7 +35198,7 @@ index 3efd5b669..a8cb6df3d 100644 + allow $1 login_pgm:key manage_key_perms; +') diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te -index 09b791dcc..2fb4d0413 100644 +index 09b791dcc..53f079629 100644 --- a/policy/modules/system/authlogin.te +++ b/policy/modules/system/authlogin.te @@ -5,6 +5,19 @@ policy_module(authlogin, 2.5.1) @@ -34859,16 +35291,17 @@ index 09b791dcc..2fb4d0413 100644 dontaudit chkpwd_t self:capability sys_tty_config; allow chkpwd_t self:process { getattr signal }; -@@ -109,6 +131,8 @@ dev_read_urand(chkpwd_t) +@@ -109,6 +131,9 @@ dev_read_urand(chkpwd_t) files_read_etc_files(chkpwd_t) # for nscd files_dontaudit_search_var(chkpwd_t) +files_read_usr_symlinks(chkpwd_t) +files_list_tmp(chkpwd_t) ++files_map_system_db_files(chkpwd_t) fs_dontaudit_getattr_xattr_fs(chkpwd_t) -@@ -122,12 +146,11 @@ auth_use_nsswitch(chkpwd_t) +@@ -122,12 +147,11 @@ auth_use_nsswitch(chkpwd_t) logging_send_audit_msgs(chkpwd_t) logging_send_syslog_msg(chkpwd_t) @@ -34882,7 +35315,18 @@ index 09b791dcc..2fb4d0413 100644 ifdef(`distro_ubuntu',` optional_policy(` -@@ -153,53 +176,52 @@ optional_policy(` +@@ -141,6 +165,10 @@ optional_policy(` + ') + + optional_policy(` ++ dbus_system_bus_client(chkpwd_t) ++') ++ ++optional_policy(` + kerberos_use(chkpwd_t) + ') + +@@ -153,53 +181,52 @@ optional_policy(` # PAM local policy # @@ -34964,7 +35408,7 @@ index 09b791dcc..2fb4d0413 100644 ') ######################################## -@@ -289,7 +311,6 @@ init_use_script_ptys(pam_console_t) +@@ -289,7 +316,6 @@ init_use_script_ptys(pam_console_t) logging_send_syslog_msg(pam_console_t) @@ -34972,7 +35416,7 @@ index 09b791dcc..2fb4d0413 100644 miscfiles_read_generic_certs(pam_console_t) seutil_read_file_contexts(pam_console_t) -@@ -330,7 +351,7 @@ optional_policy(` +@@ -330,7 +356,7 @@ optional_policy(` # updpwd local policy # @@ -34981,7 +35425,7 @@ index 09b791dcc..2fb4d0413 100644 allow updpwd_t self:process setfscreate; allow updpwd_t self:fifo_file rw_fifo_file_perms; allow updpwd_t self:unix_stream_socket create_stream_socket_perms; -@@ -341,6 +362,11 @@ kernel_read_system_state(updpwd_t) +@@ -341,6 +367,11 @@ kernel_read_system_state(updpwd_t) dev_read_urand(updpwd_t) files_manage_etc_files(updpwd_t) @@ -34993,7 +35437,7 @@ index 09b791dcc..2fb4d0413 100644 term_dontaudit_use_console(updpwd_t) term_dontaudit_use_unallocated_ttys(updpwd_t) -@@ -350,9 +376,7 @@ auth_use_nsswitch(updpwd_t) +@@ -350,9 +381,7 @@ auth_use_nsswitch(updpwd_t) logging_send_syslog_msg(updpwd_t) @@ -35004,7 +35448,7 @@ index 09b791dcc..2fb4d0413 100644 ifdef(`distro_ubuntu',` optional_policy(` -@@ -380,13 +404,15 @@ term_dontaudit_use_all_ttys(utempter_t) +@@ -380,13 +409,15 @@ term_dontaudit_use_all_ttys(utempter_t) term_dontaudit_use_all_ptys(utempter_t) term_dontaudit_use_ptmx(utempter_t) @@ -35021,7 +35465,7 @@ index 09b791dcc..2fb4d0413 100644 # Allow utemper to write to /tmp/.xses-* userdom_write_user_tmp_files(utempter_t) -@@ -397,19 +423,29 @@ ifdef(`distro_ubuntu',` +@@ -397,19 +428,29 @@ ifdef(`distro_ubuntu',` ') optional_policy(` @@ -35055,7 +35499,7 @@ index 09b791dcc..2fb4d0413 100644 files_list_var_lib(nsswitch_domain) # read /etc/nsswitch.conf -@@ -417,15 +453,42 @@ files_read_etc_files(nsswitch_domain) +@@ -417,15 +458,42 @@ files_read_etc_files(nsswitch_domain) sysnet_dns_name_resolve(nsswitch_domain) @@ -35100,7 +35544,7 @@ index 09b791dcc..2fb4d0413 100644 ldap_stream_connect(nsswitch_domain) ') ') -@@ -438,6 +501,7 @@ optional_policy(` +@@ -438,6 +506,7 @@ optional_policy(` likewise_stream_connect_lsassd(nsswitch_domain) ') @@ -35108,7 +35552,7 @@ index 09b791dcc..2fb4d0413 100644 optional_policy(` kerberos_use(nsswitch_domain) ') -@@ -456,10 +520,163 @@ optional_policy(` +@@ -456,10 +525,163 @@ optional_policy(` optional_policy(` sssd_stream_connect(nsswitch_domain) @@ -36045,7 +36489,7 @@ index bc0ffc84e..37b8ea5ec 100644 ') +/var/run/systemd(/.*)? gen_context(system_u:object_r:init_var_run_t,s0) diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if -index 79a45f62e..b25993d41 100644 +index 79a45f62e..0244681f0 100644 --- a/policy/modules/system/init.if +++ b/policy/modules/system/init.if @@ -1,5 +1,21 @@ @@ -36276,10 +36720,13 @@ index 79a45f62e..b25993d41 100644 ######################################## ## ## Mark the file type as a daemon run dir, allowing initrc_t -@@ -460,6 +512,25 @@ interface(`init_domtrans',` - domtrans_pattern($1, init_exec_t, init_t) - ') +@@ -458,6 +510,26 @@ interface(`init_domtrans',` + ') + domtrans_pattern($1, init_exec_t, init_t) ++ allow $1 init_exec_t:file map; ++') ++ + +######################################## +## @@ -36297,12 +36744,10 @@ index 79a45f62e..b25993d41 100644 + ') + + allow $1 init_exec_t:file entrypoint; -+') -+ + ') + ######################################## - ## - ## Execute the init program in the caller domain. -@@ -469,7 +540,6 @@ interface(`init_domtrans',` +@@ -469,7 +541,6 @@ interface(`init_domtrans',` ## Domain allowed access. ## ## @@ -36310,7 +36755,7 @@ index 79a45f62e..b25993d41 100644 # interface(`init_exec',` gen_require(` -@@ -478,6 +548,48 @@ interface(`init_exec',` +@@ -478,6 +549,48 @@ interface(`init_exec',` corecmd_search_bin($1) can_exec($1, init_exec_t) @@ -36359,7 +36804,7 @@ index 79a45f62e..b25993d41 100644 ') ######################################## -@@ -566,6 +678,58 @@ interface(`init_sigchld',` +@@ -566,6 +679,58 @@ interface(`init_sigchld',` ######################################## ## @@ -36418,7 +36863,7 @@ index 79a45f62e..b25993d41 100644 ## Connect to init with a unix socket. ## ## -@@ -576,12 +740,87 @@ interface(`init_sigchld',` +@@ -576,12 +741,87 @@ interface(`init_sigchld',` # interface(`init_stream_connect',` gen_require(` @@ -36506,7 +36951,7 @@ index 79a45f62e..b25993d41 100644 ######################################## ## ## Inherit and use file descriptors from init. -@@ -743,22 +982,24 @@ interface(`init_write_initctl',` +@@ -743,22 +983,24 @@ interface(`init_write_initctl',` interface(`init_telinit',` gen_require(` type initctl_t; @@ -36540,7 +36985,7 @@ index 79a45f62e..b25993d41 100644 ') ######################################## -@@ -787,7 +1028,7 @@ interface(`init_rw_initctl',` +@@ -787,7 +1029,7 @@ interface(`init_rw_initctl',` ## ## ## @@ -36549,7 +36994,7 @@ index 79a45f62e..b25993d41 100644 ## ## # -@@ -830,11 +1071,12 @@ interface(`init_script_file_entry_type',` +@@ -830,11 +1072,12 @@ interface(`init_script_file_entry_type',` # interface(`init_spec_domtrans_script',` gen_require(` @@ -36564,7 +37009,7 @@ index 79a45f62e..b25993d41 100644 ifdef(`distro_gentoo',` gen_require(` -@@ -845,11 +1087,11 @@ interface(`init_spec_domtrans_script',` +@@ -845,11 +1088,11 @@ interface(`init_spec_domtrans_script',` ') ifdef(`enable_mcs',` @@ -36578,7 +37023,7 @@ index 79a45f62e..b25993d41 100644 ') ') -@@ -865,23 +1107,45 @@ interface(`init_spec_domtrans_script',` +@@ -865,23 +1108,45 @@ interface(`init_spec_domtrans_script',` # interface(`init_domtrans_script',` gen_require(` @@ -36628,7 +37073,7 @@ index 79a45f62e..b25993d41 100644 ## Execute a init script in a specified domain. ## ## -@@ -933,9 +1197,14 @@ interface(`init_script_file_domtrans',` +@@ -933,9 +1198,14 @@ interface(`init_script_file_domtrans',` interface(`init_labeled_script_domtrans',` gen_require(` type initrc_t; @@ -36643,7 +37088,7 @@ index 79a45f62e..b25993d41 100644 files_search_etc($1) ') -@@ -992,7 +1261,7 @@ interface(`init_run_daemon',` +@@ -992,7 +1262,7 @@ interface(`init_run_daemon',` ######################################## ## @@ -36652,7 +37097,7 @@ index 79a45f62e..b25993d41 100644 ## ## ## -@@ -1000,38 +1269,37 @@ interface(`init_run_daemon',` +@@ -1000,38 +1270,37 @@ interface(`init_run_daemon',` ## ## # @@ -36700,7 +37145,7 @@ index 79a45f62e..b25993d41 100644 ## ## ## -@@ -1039,17 +1307,19 @@ interface(`init_ptrace',` +@@ -1039,17 +1308,19 @@ interface(`init_ptrace',` ## ## # @@ -36724,7 +37169,7 @@ index 79a45f62e..b25993d41 100644 ## ## ## -@@ -1057,18 +1327,17 @@ interface(`init_write_script_pipes',` +@@ -1057,18 +1328,17 @@ interface(`init_write_script_pipes',` ## ## # @@ -36747,7 +37192,7 @@ index 79a45f62e..b25993d41 100644 ## ## ## -@@ -1076,18 +1345,94 @@ interface(`init_getattr_script_files',` +@@ -1076,18 +1346,94 @@ interface(`init_getattr_script_files',` ## ## # @@ -36847,7 +37292,7 @@ index 79a45f62e..b25993d41 100644 ## ## ## -@@ -1125,6 +1470,63 @@ interface(`init_getattr_all_script_files',` +@@ -1125,6 +1471,63 @@ interface(`init_getattr_all_script_files',` ######################################## ## @@ -36911,7 +37356,7 @@ index 79a45f62e..b25993d41 100644 ## Read all init script files. ## ## -@@ -1144,6 +1546,24 @@ interface(`init_read_all_script_files',` +@@ -1144,6 +1547,24 @@ interface(`init_read_all_script_files',` ####################################### ## @@ -36936,7 +37381,7 @@ index 79a45f62e..b25993d41 100644 ## Dontaudit read all init script files. ## ## -@@ -1195,12 +1615,7 @@ interface(`init_read_script_state',` +@@ -1195,12 +1616,7 @@ interface(`init_read_script_state',` ') kernel_search_proc($1) @@ -36950,7 +37395,7 @@ index 79a45f62e..b25993d41 100644 ') ######################################## -@@ -1314,6 +1729,24 @@ interface(`init_signal_script',` +@@ -1314,6 +1730,24 @@ interface(`init_signal_script',` ######################################## ## @@ -36975,7 +37420,7 @@ index 79a45f62e..b25993d41 100644 ## Send null signals to init scripts. ## ## -@@ -1440,6 +1873,27 @@ interface(`init_dbus_send_script',` +@@ -1440,6 +1874,27 @@ interface(`init_dbus_send_script',` ######################################## ## ## Send and receive messages from @@ -37003,7 +37448,7 @@ index 79a45f62e..b25993d41 100644 ## init scripts over dbus. ## ## -@@ -1547,6 +2001,25 @@ interface(`init_getattr_script_status_files',` +@@ -1547,6 +2002,25 @@ interface(`init_getattr_script_status_files',` ######################################## ## @@ -37029,7 +37474,7 @@ index 79a45f62e..b25993d41 100644 ## Do not audit attempts to read init script ## status files. ## -@@ -1605,6 +2078,42 @@ interface(`init_rw_script_tmp_files',` +@@ -1605,6 +2079,42 @@ interface(`init_rw_script_tmp_files',` ######################################## ## @@ -37072,7 +37517,7 @@ index 79a45f62e..b25993d41 100644 ## Create files in a init script ## temporary data directory. ## -@@ -1677,6 +2186,43 @@ interface(`init_read_utmp',` +@@ -1677,6 +2187,43 @@ interface(`init_read_utmp',` ######################################## ## @@ -37116,7 +37561,7 @@ index 79a45f62e..b25993d41 100644 ## Do not audit attempts to write utmp. ## ## -@@ -1765,7 +2311,7 @@ interface(`init_dontaudit_rw_utmp',` +@@ -1765,7 +2312,7 @@ interface(`init_dontaudit_rw_utmp',` type initrc_var_run_t; ') @@ -37125,7 +37570,7 @@ index 79a45f62e..b25993d41 100644 ') ######################################## -@@ -1806,30 +2352,157 @@ interface(`init_pid_filetrans_utmp',` +@@ -1806,30 +2353,157 @@ interface(`init_pid_filetrans_utmp',` files_pid_filetrans($1, initrc_var_run_t, file, "utmp") ') @@ -37296,7 +37741,7 @@ index 79a45f62e..b25993d41 100644 ## Domain allowed access. ## ## -@@ -1840,3 +2513,584 @@ interface(`init_udp_recvfrom_all_daemons',` +@@ -1840,3 +2514,584 @@ interface(`init_udp_recvfrom_all_daemons',` ') corenet_udp_recvfrom_labeled($1, daemon) ') @@ -37882,7 +38327,7 @@ index 79a45f62e..b25993d41 100644 +') + diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te -index 17eda2480..cc1720cf2 100644 +index 17eda2480..09d9144cb 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -11,10 +11,31 @@ gen_require(` @@ -38205,7 +38650,7 @@ index 17eda2480..cc1720cf2 100644 ifdef(`distro_gentoo',` allow init_t self:process { getcap setcap }; -@@ -186,29 +348,294 @@ ifdef(`distro_gentoo',` +@@ -186,29 +348,295 @@ ifdef(`distro_gentoo',` ') ifdef(`distro_redhat',` @@ -38370,6 +38815,7 @@ index 17eda2480..cc1720cf2 100644 +files_relabel_var_dirs(init_t) +files_relabel_var_lib_dirs(init_t) +files_read_kernel_modules(init_t) ++files_map_kernel_modules(init_t) +files_dontaudit_mounton_isid(init_t) +fs_getattr_all_fs(init_t) +fs_manage_cgroup_dirs(init_t) @@ -38509,7 +38955,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -216,7 +643,35 @@ optional_policy(` +@@ -216,7 +644,35 @@ optional_policy(` ') optional_policy(` @@ -38546,7 +38992,7 @@ index 17eda2480..cc1720cf2 100644 ') ######################################## -@@ -225,9 +680,9 @@ optional_policy(` +@@ -225,9 +681,9 @@ optional_policy(` # allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; @@ -38558,7 +39004,7 @@ index 17eda2480..cc1720cf2 100644 allow initrc_t self:passwd rootok; allow initrc_t self:key manage_key_perms; -@@ -258,12 +713,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) +@@ -258,12 +714,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) allow initrc_t initrc_var_run_t:file manage_file_perms; files_pid_filetrans(initrc_t, initrc_var_run_t, file) @@ -38575,7 +39021,7 @@ index 17eda2480..cc1720cf2 100644 manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) -@@ -279,23 +738,36 @@ kernel_change_ring_buffer_level(initrc_t) +@@ -279,23 +739,36 @@ kernel_change_ring_buffer_level(initrc_t) kernel_clear_ring_buffer(initrc_t) kernel_get_sysvipc_info(initrc_t) kernel_read_all_sysctls(initrc_t) @@ -38618,7 +39064,7 @@ index 17eda2480..cc1720cf2 100644 corenet_tcp_sendrecv_all_ports(initrc_t) corenet_udp_sendrecv_all_ports(initrc_t) corenet_tcp_connect_all_ports(initrc_t) -@@ -303,9 +775,11 @@ corenet_sendrecv_all_client_packets(initrc_t) +@@ -303,9 +776,11 @@ corenet_sendrecv_all_client_packets(initrc_t) dev_read_rand(initrc_t) dev_read_urand(initrc_t) @@ -38630,7 +39076,7 @@ index 17eda2480..cc1720cf2 100644 dev_rw_sysfs(initrc_t) dev_list_usbfs(initrc_t) dev_read_framebuffer(initrc_t) -@@ -313,8 +787,10 @@ dev_write_framebuffer(initrc_t) +@@ -313,8 +788,10 @@ dev_write_framebuffer(initrc_t) dev_read_realtime_clock(initrc_t) dev_read_sound_mixer(initrc_t) dev_write_sound_mixer(initrc_t) @@ -38641,7 +39087,7 @@ index 17eda2480..cc1720cf2 100644 dev_delete_lvm_control_dev(initrc_t) dev_manage_generic_symlinks(initrc_t) dev_manage_generic_files(initrc_t) -@@ -322,8 +798,7 @@ dev_manage_generic_files(initrc_t) +@@ -322,8 +799,7 @@ dev_manage_generic_files(initrc_t) dev_delete_generic_symlinks(initrc_t) dev_getattr_all_blk_files(initrc_t) dev_getattr_all_chr_files(initrc_t) @@ -38651,7 +39097,7 @@ index 17eda2480..cc1720cf2 100644 domain_kill_all_domains(initrc_t) domain_signal_all_domains(initrc_t) -@@ -332,7 +807,6 @@ domain_sigstop_all_domains(initrc_t) +@@ -332,7 +808,6 @@ domain_sigstop_all_domains(initrc_t) domain_sigchld_all_domains(initrc_t) domain_read_all_domains_state(initrc_t) domain_getattr_all_domains(initrc_t) @@ -38659,7 +39105,7 @@ index 17eda2480..cc1720cf2 100644 domain_getsession_all_domains(initrc_t) domain_use_interactive_fds(initrc_t) # for lsof which is used by alsa shutdown: -@@ -340,6 +814,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) +@@ -340,6 +815,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) domain_dontaudit_getattr_all_tcp_sockets(initrc_t) domain_dontaudit_getattr_all_dgram_sockets(initrc_t) domain_dontaudit_getattr_all_pipes(initrc_t) @@ -38667,7 +39113,7 @@ index 17eda2480..cc1720cf2 100644 files_getattr_all_dirs(initrc_t) files_getattr_all_files(initrc_t) -@@ -347,14 +822,15 @@ files_getattr_all_symlinks(initrc_t) +@@ -347,14 +823,15 @@ files_getattr_all_symlinks(initrc_t) files_getattr_all_pipes(initrc_t) files_getattr_all_sockets(initrc_t) files_purge_tmp(initrc_t) @@ -38685,7 +39131,7 @@ index 17eda2480..cc1720cf2 100644 files_read_usr_files(initrc_t) files_manage_urandom_seed(initrc_t) files_manage_generic_spool(initrc_t) -@@ -364,8 +840,12 @@ files_list_isid_type_dirs(initrc_t) +@@ -364,8 +841,12 @@ files_list_isid_type_dirs(initrc_t) files_mounton_isid_type_dirs(initrc_t) files_list_default(initrc_t) files_mounton_default(initrc_t) @@ -38699,7 +39145,7 @@ index 17eda2480..cc1720cf2 100644 fs_list_inotifyfs(initrc_t) fs_register_binary_executable_type(initrc_t) # rhgb-console writes to ramfs -@@ -375,10 +855,11 @@ fs_mount_all_fs(initrc_t) +@@ -375,10 +856,11 @@ fs_mount_all_fs(initrc_t) fs_unmount_all_fs(initrc_t) fs_remount_all_fs(initrc_t) fs_getattr_all_fs(initrc_t) @@ -38713,7 +39159,7 @@ index 17eda2480..cc1720cf2 100644 mcs_process_set_categories(initrc_t) mls_file_read_all_levels(initrc_t) -@@ -387,8 +868,10 @@ mls_process_read_up(initrc_t) +@@ -387,8 +869,10 @@ mls_process_read_up(initrc_t) mls_process_write_down(initrc_t) mls_rangetrans_source(initrc_t) mls_fd_share_all_levels(initrc_t) @@ -38724,7 +39170,7 @@ index 17eda2480..cc1720cf2 100644 storage_getattr_fixed_disk_dev(initrc_t) storage_setattr_fixed_disk_dev(initrc_t) -@@ -398,6 +881,7 @@ term_use_all_terms(initrc_t) +@@ -398,6 +882,7 @@ term_use_all_terms(initrc_t) term_reset_tty_labels(initrc_t) auth_rw_login_records(initrc_t) @@ -38732,7 +39178,7 @@ index 17eda2480..cc1720cf2 100644 auth_setattr_login_records(initrc_t) auth_rw_lastlog(initrc_t) auth_read_pam_pid(initrc_t) -@@ -416,20 +900,18 @@ logging_read_all_logs(initrc_t) +@@ -416,20 +901,18 @@ logging_read_all_logs(initrc_t) logging_append_all_logs(initrc_t) logging_read_audit_config(initrc_t) @@ -38756,7 +39202,7 @@ index 17eda2480..cc1720cf2 100644 ifdef(`distro_debian',` dev_setattr_generic_dirs(initrc_t) -@@ -451,7 +933,6 @@ ifdef(`distro_gentoo',` +@@ -451,7 +934,6 @@ ifdef(`distro_gentoo',` allow initrc_t self:process setfscreate; dev_create_null_dev(initrc_t) dev_create_zero_dev(initrc_t) @@ -38764,7 +39210,7 @@ index 17eda2480..cc1720cf2 100644 term_create_console_dev(initrc_t) # unfortunately /sbin/rc does stupid tricks -@@ -486,6 +967,10 @@ ifdef(`distro_gentoo',` +@@ -486,6 +968,10 @@ ifdef(`distro_gentoo',` sysnet_setattr_config(initrc_t) optional_policy(` @@ -38775,7 +39221,7 @@ index 17eda2480..cc1720cf2 100644 alsa_read_lib(initrc_t) ') -@@ -506,7 +991,7 @@ ifdef(`distro_redhat',` +@@ -506,7 +992,7 @@ ifdef(`distro_redhat',` # Red Hat systems seem to have a stray # fd open from the initrd @@ -38784,7 +39230,7 @@ index 17eda2480..cc1720cf2 100644 files_dontaudit_read_root_files(initrc_t) # These seem to be from the initrd -@@ -521,6 +1006,7 @@ ifdef(`distro_redhat',` +@@ -521,6 +1007,7 @@ ifdef(`distro_redhat',` files_create_boot_dirs(initrc_t) files_create_boot_flag(initrc_t) files_rw_boot_symlinks(initrc_t) @@ -38792,7 +39238,7 @@ index 17eda2480..cc1720cf2 100644 # wants to read /.fonts directory files_read_default_files(initrc_t) files_mountpoint(initrc_tmp_t) -@@ -541,6 +1027,7 @@ ifdef(`distro_redhat',` +@@ -541,6 +1028,7 @@ ifdef(`distro_redhat',` miscfiles_rw_localization(initrc_t) miscfiles_setattr_localization(initrc_t) miscfiles_relabel_localization(initrc_t) @@ -38800,7 +39246,7 @@ index 17eda2480..cc1720cf2 100644 miscfiles_read_fonts(initrc_t) miscfiles_read_hwdata(initrc_t) -@@ -550,8 +1037,44 @@ ifdef(`distro_redhat',` +@@ -550,8 +1038,44 @@ ifdef(`distro_redhat',` ') optional_policy(` @@ -38845,7 +39291,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -559,14 +1082,31 @@ ifdef(`distro_redhat',` +@@ -559,14 +1083,31 @@ ifdef(`distro_redhat',` rpc_write_exports(initrc_t) rpc_manage_nfs_state_data(initrc_t) ') @@ -38877,7 +39323,7 @@ index 17eda2480..cc1720cf2 100644 ') ') -@@ -577,6 +1117,39 @@ ifdef(`distro_suse',` +@@ -577,6 +1118,39 @@ ifdef(`distro_suse',` ') ') @@ -38917,7 +39363,7 @@ index 17eda2480..cc1720cf2 100644 optional_policy(` amavis_search_lib(initrc_t) amavis_setattr_pid_files(initrc_t) -@@ -589,6 +1162,8 @@ optional_policy(` +@@ -589,6 +1163,8 @@ optional_policy(` optional_policy(` apache_read_config(initrc_t) apache_list_modules(initrc_t) @@ -38926,7 +39372,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -610,6 +1185,7 @@ optional_policy(` +@@ -610,6 +1186,7 @@ optional_policy(` optional_policy(` cgroup_stream_connect_cgred(initrc_t) @@ -38934,7 +39380,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -626,6 +1202,17 @@ optional_policy(` +@@ -626,6 +1203,17 @@ optional_policy(` ') optional_policy(` @@ -38952,7 +39398,7 @@ index 17eda2480..cc1720cf2 100644 dev_getattr_printer_dev(initrc_t) cups_read_log(initrc_t) -@@ -642,9 +1229,13 @@ optional_policy(` +@@ -642,9 +1230,13 @@ optional_policy(` dbus_connect_system_bus(initrc_t) dbus_system_bus_client(initrc_t) dbus_read_config(initrc_t) @@ -38966,7 +39412,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -657,15 +1248,11 @@ optional_policy(` +@@ -657,15 +1249,11 @@ optional_policy(` ') optional_policy(` @@ -38984,7 +39430,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -686,6 +1273,15 @@ optional_policy(` +@@ -686,6 +1274,15 @@ optional_policy(` ') optional_policy(` @@ -39000,7 +39446,7 @@ index 17eda2480..cc1720cf2 100644 inn_exec_config(initrc_t) ') -@@ -726,6 +1322,7 @@ optional_policy(` +@@ -726,6 +1323,7 @@ optional_policy(` lpd_list_spool(initrc_t) lpd_read_config(initrc_t) @@ -39008,7 +39454,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -743,7 +1340,13 @@ optional_policy(` +@@ -743,7 +1341,13 @@ optional_policy(` ') optional_policy(` @@ -39023,7 +39469,7 @@ index 17eda2480..cc1720cf2 100644 mta_dontaudit_read_spool_symlinks(initrc_t) ') -@@ -766,6 +1369,10 @@ optional_policy(` +@@ -766,6 +1370,10 @@ optional_policy(` ') optional_policy(` @@ -39034,7 +39480,7 @@ index 17eda2480..cc1720cf2 100644 postgresql_manage_db(initrc_t) postgresql_read_config(initrc_t) ') -@@ -775,10 +1382,20 @@ optional_policy(` +@@ -775,10 +1383,20 @@ optional_policy(` ') optional_policy(` @@ -39055,7 +39501,7 @@ index 17eda2480..cc1720cf2 100644 quota_manage_flags(initrc_t) ') -@@ -787,6 +1404,10 @@ optional_policy(` +@@ -787,6 +1405,10 @@ optional_policy(` ') optional_policy(` @@ -39066,7 +39512,7 @@ index 17eda2480..cc1720cf2 100644 fs_write_ramfs_sockets(initrc_t) fs_search_ramfs(initrc_t) -@@ -808,8 +1429,6 @@ optional_policy(` +@@ -808,8 +1430,6 @@ optional_policy(` # bash tries ioctl for some reason files_dontaudit_ioctl_all_pids(initrc_t) @@ -39075,7 +39521,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -818,6 +1437,10 @@ optional_policy(` +@@ -818,6 +1438,10 @@ optional_policy(` ') optional_policy(` @@ -39086,7 +39532,7 @@ index 17eda2480..cc1720cf2 100644 # shorewall-init script run /var/lib/shorewall/firewall shorewall_lib_domtrans(initrc_t) ') -@@ -827,10 +1450,12 @@ optional_policy(` +@@ -827,10 +1451,12 @@ optional_policy(` squid_manage_logs(initrc_t) ') @@ -39099,7 +39545,7 @@ index 17eda2480..cc1720cf2 100644 optional_policy(` ssh_dontaudit_read_server_keys(initrc_t) -@@ -857,21 +1482,62 @@ optional_policy(` +@@ -857,21 +1483,62 @@ optional_policy(` ') optional_policy(` @@ -39163,7 +39609,7 @@ index 17eda2480..cc1720cf2 100644 ') optional_policy(` -@@ -887,6 +1553,10 @@ optional_policy(` +@@ -887,6 +1554,10 @@ optional_policy(` ') optional_policy(` @@ -39174,7 +39620,7 @@ index 17eda2480..cc1720cf2 100644 # Set device ownerships/modes. xserver_setattr_console_pipes(initrc_t) -@@ -897,3 +1567,218 @@ optional_policy(` +@@ -897,3 +1568,218 @@ optional_policy(` optional_policy(` zebra_read_config(initrc_t) ') @@ -40183,10 +40629,10 @@ index c42fbc329..bf211dbee 100644 + files_pid_filetrans($1, iptables_var_run_t, file, "xtables.lock") +') diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te -index be8ed1e6c..aa787ff35 100644 +index be8ed1e6c..8f8a6f0bf 100644 --- a/policy/modules/system/iptables.te +++ b/policy/modules/system/iptables.te -@@ -16,15 +16,21 @@ role iptables_roles types iptables_t; +@@ -16,44 +16,62 @@ role iptables_roles types iptables_t; type iptables_initrc_exec_t; init_script_file(iptables_initrc_exec_t) @@ -40211,7 +40657,11 @@ index be8ed1e6c..aa787ff35 100644 ######################################## # # Iptables local policy -@@ -35,25 +41,36 @@ dontaudit iptables_t self:capability sys_tty_config; + # + + allow iptables_t self:capability { dac_read_search dac_override net_admin net_raw }; ++allow iptables_t self:cap_userns { dac_read_search net_admin net_raw }; + dontaudit iptables_t self:capability sys_tty_config; allow iptables_t self:fifo_file rw_fifo_file_perms; allow iptables_t self:process { sigchld sigkill sigstop signull signal }; allow iptables_t self:netlink_socket create_socket_perms; @@ -40251,7 +40701,7 @@ index be8ed1e6c..aa787ff35 100644 kernel_use_fds(iptables_t) # needed by ipvsadm -@@ -64,19 +81,24 @@ corenet_relabelto_all_packets(iptables_t) +@@ -64,19 +82,24 @@ corenet_relabelto_all_packets(iptables_t) corenet_dontaudit_rw_tun_tap_dev(iptables_t) dev_read_sysfs(iptables_t) @@ -40278,7 +40728,7 @@ index be8ed1e6c..aa787ff35 100644 auth_use_nsswitch(iptables_t) -@@ -85,15 +107,14 @@ init_use_script_ptys(iptables_t) +@@ -85,15 +108,14 @@ init_use_script_ptys(iptables_t) # to allow rules to be saved on reboot: init_rw_script_tmp_files(iptables_t) init_rw_script_stream_sockets(iptables_t) @@ -40296,7 +40746,7 @@ index be8ed1e6c..aa787ff35 100644 userdom_use_all_users_fds(iptables_t) ifdef(`hide_broken_symptoms',` -@@ -101,7 +122,14 @@ ifdef(`hide_broken_symptoms',` +@@ -101,7 +123,14 @@ ifdef(`hide_broken_symptoms',` ') optional_policy(` @@ -40311,7 +40761,7 @@ index be8ed1e6c..aa787ff35 100644 ') optional_policy(` -@@ -110,7 +138,16 @@ optional_policy(` +@@ -110,7 +139,16 @@ optional_policy(` ') optional_policy(` @@ -40328,7 +40778,7 @@ index be8ed1e6c..aa787ff35 100644 ') optional_policy(` -@@ -119,11 +156,25 @@ optional_policy(` +@@ -119,11 +157,25 @@ optional_policy(` ') optional_policy(` @@ -40354,7 +40804,7 @@ index be8ed1e6c..aa787ff35 100644 ') optional_policy(` -@@ -132,12 +183,13 @@ optional_policy(` +@@ -132,12 +184,13 @@ optional_policy(` optional_policy(` seutil_sigchld_newrole(iptables_t) @@ -47741,7 +48191,7 @@ index 2cea692c0..853ddefe4 100644 + files_pid_filetrans($1, net_conf_t, dir, "cloud-init") +') diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te -index a392fc4bc..0d6c36da5 100644 +index a392fc4bc..6365b8834 100644 --- a/policy/modules/system/sysnetwork.te +++ b/policy/modules/system/sysnetwork.te @@ -5,6 +5,13 @@ policy_module(sysnetwork, 1.15.4) @@ -47869,7 +48319,7 @@ index a392fc4bc..0d6c36da5 100644 fs_getattr_all_fs(dhcpc_t) fs_search_auto_mountpoints(dhcpc_t) -@@ -137,11 +158,17 @@ term_dontaudit_use_all_ptys(dhcpc_t) +@@ -137,16 +158,23 @@ term_dontaudit_use_all_ptys(dhcpc_t) term_dontaudit_use_unallocated_ttys(dhcpc_t) term_dontaudit_use_generic_ptys(dhcpc_t) @@ -47888,7 +48338,13 @@ index a392fc4bc..0d6c36da5 100644 modutils_run_insmod(dhcpc_t, dhcpc_roles) -@@ -161,7 +188,21 @@ ifdef(`distro_ubuntu',` + sysnet_run_ifconfig(dhcpc_t, dhcpc_roles) + ++userdom_stream_connect(dhcpc_t) + userdom_use_user_terminals(dhcpc_t) + userdom_dontaudit_search_user_home_dirs(dhcpc_t) + +@@ -161,7 +189,21 @@ ifdef(`distro_ubuntu',` ') optional_policy(` @@ -47911,7 +48367,7 @@ index a392fc4bc..0d6c36da5 100644 ') optional_policy(` -@@ -179,10 +220,6 @@ optional_policy(` +@@ -179,10 +221,6 @@ optional_policy(` ') optional_policy(` @@ -47922,7 +48378,7 @@ index a392fc4bc..0d6c36da5 100644 hotplug_getattr_config_dirs(dhcpc_t) hotplug_search_config(dhcpc_t) -@@ -195,23 +232,31 @@ optional_policy(` +@@ -195,23 +233,31 @@ optional_policy(` optional_policy(` netutils_run_ping(dhcpc_t, dhcpc_roles) netutils_run(dhcpc_t, dhcpc_roles) @@ -47957,7 +48413,7 @@ index a392fc4bc..0d6c36da5 100644 ') optional_policy(` -@@ -221,7 +266,16 @@ optional_policy(` +@@ -221,7 +267,16 @@ optional_policy(` optional_policy(` seutil_sigchld_newrole(dhcpc_t) @@ -47975,7 +48431,7 @@ index a392fc4bc..0d6c36da5 100644 ') optional_policy(` -@@ -233,6 +287,10 @@ optional_policy(` +@@ -233,6 +288,10 @@ optional_policy(` ') optional_policy(` @@ -47986,7 +48442,7 @@ index a392fc4bc..0d6c36da5 100644 vmware_append_log(dhcpc_t) ') -@@ -264,32 +322,73 @@ allow ifconfig_t self:msgq create_msgq_perms; +@@ -264,32 +323,73 @@ allow ifconfig_t self:msgq create_msgq_perms; allow ifconfig_t self:msg { send receive }; # Create UDP sockets, necessary when called from dhcpc allow ifconfig_t self:udp_socket create_socket_perms; @@ -48060,7 +48516,7 @@ index a392fc4bc..0d6c36da5 100644 selinux_dontaudit_getattr_fs(ifconfig_t) -@@ -299,33 +398,51 @@ term_dontaudit_use_all_ptys(ifconfig_t) +@@ -299,33 +399,51 @@ term_dontaudit_use_all_ptys(ifconfig_t) term_dontaudit_use_ptmx(ifconfig_t) term_dontaudit_use_generic_ptys(ifconfig_t) @@ -48118,7 +48574,7 @@ index a392fc4bc..0d6c36da5 100644 optional_policy(` dev_dontaudit_rw_cardmgr(ifconfig_t) ') -@@ -336,7 +453,11 @@ ifdef(`hide_broken_symptoms',` +@@ -336,7 +454,11 @@ ifdef(`hide_broken_symptoms',` ') optional_policy(` @@ -48131,7 +48587,7 @@ index a392fc4bc..0d6c36da5 100644 ') optional_policy(` -@@ -350,7 +471,16 @@ optional_policy(` +@@ -350,7 +472,16 @@ optional_policy(` ') optional_policy(` @@ -48149,7 +48605,7 @@ index a392fc4bc..0d6c36da5 100644 ') optional_policy(` -@@ -371,3 +501,17 @@ optional_policy(` +@@ -371,3 +502,17 @@ optional_policy(` xen_append_log(ifconfig_t) xen_dontaudit_rw_unix_stream_sockets(ifconfig_t) ') @@ -57772,7 +58228,7 @@ index 9dc60c6c0..6a26bba87 100644 + ') ') diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te -index f4ac38dc7..1589d6065 100644 +index f4ac38dc7..e4733e828 100644 --- a/policy/modules/system/userdomain.te +++ b/policy/modules/system/userdomain.te @@ -7,48 +7,43 @@ policy_module(userdomain, 4.9.1) @@ -57922,7 +58378,7 @@ index f4ac38dc7..1589d6065 100644 +') + +allow userdomain userdomain:process signull; -+allow userdomain userdomain:fifo_file rw_inherited_fifo_file_perms; ++allow userdomain userdomain:fifo_file { map rw_inherited_fifo_file_perms }; +dontaudit unpriv_userdomain self:rawip_socket create_socket_perms; + +# Nautilus causes this avc diff --git a/policy-f27-contrib.patch b/policy-f27-contrib.patch index 539b17d..0b22ba1 100644 --- a/policy-f27-contrib.patch +++ b/policy-f27-contrib.patch @@ -1813,7 +1813,7 @@ index 01cbb67df..94a4a2406 100644 files_list_etc($1) diff --git a/aide.te b/aide.te -index 03831e6e5..3d35fff8e 100644 +index 03831e6e5..f6625dcd7 100644 --- a/aide.te +++ b/aide.te @@ -10,6 +10,7 @@ attribute_role aide_roles; @@ -1824,7 +1824,7 @@ index 03831e6e5..3d35fff8e 100644 role aide_roles types aide_t; type aide_log_t; -@@ -23,22 +24,34 @@ files_type(aide_db_t) +@@ -23,23 +24,39 @@ files_type(aide_db_t) # Local policy # @@ -1864,6 +1864,11 @@ index 03831e6e5..3d35fff8e 100644 optional_policy(` seutil_use_newrole_fds(aide_t) + ') ++ ++optional_policy(` ++ sssd_stream_connect(aide_t) ++') diff --git a/aisexec.if b/aisexec.if index a2997fa57..861cebdf9 100644 --- a/aisexec.if @@ -5626,7 +5631,7 @@ index f6eb4851f..3628a384f 100644 + allow $1 httpd_t:process { noatsecure }; ') diff --git a/apache.te b/apache.te -index 6649962b6..308bab964 100644 +index 6649962b6..338f2b7e4 100644 --- a/apache.te +++ b/apache.te @@ -5,280 +5,346 @@ policy_module(apache, 2.7.2) @@ -6337,7 +6342,15 @@ index 6649962b6..308bab964 100644 allow httpd_t httpd_sys_script_t:unix_stream_socket connectto; -@@ -438,6 +558,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi +@@ -428,6 +548,7 @@ manage_sock_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) + manage_lnk_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t) + files_tmp_filetrans(httpd_t, httpd_tmp_t, { file dir lnk_file sock_file }) + userdom_user_tmp_filetrans(httpd_t, httpd_tmp_t, dir) ++allow httpd_t httpd_tmp_t:file map; + + manage_dirs_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t) + manage_files_pattern(httpd_t, httpd_tmpfs_t, httpd_tmpfs_t) +@@ -438,6 +559,7 @@ fs_tmpfs_filetrans(httpd_t, httpd_tmpfs_t, { dir file lnk_file sock_file fifo_fi manage_dirs_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t) @@ -6345,7 +6358,7 @@ index 6649962b6..308bab964 100644 files_var_lib_filetrans(httpd_t, httpd_var_lib_t, { dir file }) setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) -@@ -450,140 +571,179 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) +@@ -450,140 +572,179 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) manage_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t) @@ -6589,7 +6602,7 @@ index 6649962b6..308bab964 100644 ') tunable_policy(`httpd_enable_cgi && httpd_use_nfs',` -@@ -594,28 +754,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',` +@@ -594,28 +755,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',` fs_cifs_domtrans(httpd_t, httpd_sys_script_t) ') @@ -6649,7 +6662,7 @@ index 6649962b6..308bab964 100644 ') tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` -@@ -624,68 +806,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` +@@ -624,68 +807,56 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',` fs_read_nfs_symlinks(httpd_t) ') @@ -6752,7 +6765,7 @@ index 6649962b6..308bab964 100644 ') tunable_policy(`httpd_setrlimit',` -@@ -695,49 +865,48 @@ tunable_policy(`httpd_setrlimit',` +@@ -695,49 +866,48 @@ tunable_policy(`httpd_setrlimit',` tunable_policy(`httpd_ssi_exec',` corecmd_shell_domtrans(httpd_t, httpd_sys_script_t) @@ -6833,7 +6846,7 @@ index 6649962b6..308bab964 100644 ') optional_policy(` -@@ -749,24 +918,32 @@ optional_policy(` +@@ -749,24 +919,32 @@ optional_policy(` ') optional_policy(` @@ -6872,7 +6885,7 @@ index 6649962b6..308bab964 100644 ') optional_policy(` -@@ -775,6 +952,10 @@ optional_policy(` +@@ -775,6 +953,10 @@ optional_policy(` tunable_policy(`httpd_dbus_avahi',` avahi_dbus_chat(httpd_t) ') @@ -6883,7 +6896,7 @@ index 6649962b6..308bab964 100644 ') optional_policy(` -@@ -786,35 +967,62 @@ optional_policy(` +@@ -786,35 +968,62 @@ optional_policy(` ') optional_policy(` @@ -6959,7 +6972,7 @@ index 6649962b6..308bab964 100644 tunable_policy(`httpd_manage_ipa',` memcached_manage_pid_files(httpd_t) -@@ -822,8 +1030,31 @@ optional_policy(` +@@ -822,8 +1031,31 @@ optional_policy(` ') optional_policy(` @@ -6991,7 +7004,7 @@ index 6649962b6..308bab964 100644 tunable_policy(`httpd_can_network_connect_db',` mysql_tcp_connect(httpd_t) -@@ -832,6 +1063,8 @@ optional_policy(` +@@ -832,6 +1064,8 @@ optional_policy(` optional_policy(` nagios_read_config(httpd_t) @@ -7000,7 +7013,7 @@ index 6649962b6..308bab964 100644 ') optional_policy(` -@@ -842,20 +1075,48 @@ optional_policy(` +@@ -842,20 +1076,48 @@ optional_policy(` ') optional_policy(` @@ -7055,7 +7068,7 @@ index 6649962b6..308bab964 100644 ') optional_policy(` -@@ -863,16 +1124,31 @@ optional_policy(` +@@ -863,16 +1125,31 @@ optional_policy(` ') optional_policy(` @@ -7089,7 +7102,7 @@ index 6649962b6..308bab964 100644 ') optional_policy(` -@@ -883,65 +1159,189 @@ optional_policy(` +@@ -883,65 +1160,189 @@ optional_policy(` yam_read_content(httpd_t) ') @@ -7301,7 +7314,7 @@ index 6649962b6..308bab964 100644 files_dontaudit_search_pids(httpd_suexec_t) files_search_home(httpd_suexec_t) -@@ -950,123 +1350,75 @@ auth_use_nsswitch(httpd_suexec_t) +@@ -950,123 +1351,75 @@ auth_use_nsswitch(httpd_suexec_t) logging_search_logs(httpd_suexec_t) logging_send_syslog_msg(httpd_suexec_t) @@ -7455,7 +7468,7 @@ index 6649962b6..308bab964 100644 mysql_read_config(httpd_suexec_t) tunable_policy(`httpd_can_network_connect_db',` -@@ -1083,172 +1435,107 @@ optional_policy(` +@@ -1083,172 +1436,107 @@ optional_policy(` ') ') @@ -7693,7 +7706,7 @@ index 6649962b6..308bab964 100644 ') tunable_policy(`httpd_read_user_content',` -@@ -1256,64 +1543,74 @@ tunable_policy(`httpd_read_user_content',` +@@ -1256,64 +1544,74 @@ tunable_policy(`httpd_read_user_content',` ') tunable_policy(`httpd_use_cifs',` @@ -7791,7 +7804,7 @@ index 6649962b6..308bab964 100644 ######################################## # -@@ -1321,8 +1618,15 @@ miscfiles_read_localization(httpd_rotatelogs_t) +@@ -1321,8 +1619,15 @@ miscfiles_read_localization(httpd_rotatelogs_t) # optional_policy(` @@ -7808,7 +7821,7 @@ index 6649962b6..308bab964 100644 ') ######################################## -@@ -1330,49 +1634,43 @@ optional_policy(` +@@ -1330,49 +1635,43 @@ optional_policy(` # User content local policy # @@ -7877,7 +7890,7 @@ index 6649962b6..308bab964 100644 kernel_read_system_state(httpd_passwd_t) corecmd_exec_bin(httpd_passwd_t) -@@ -1382,38 +1680,109 @@ dev_read_urand(httpd_passwd_t) +@@ -1382,38 +1681,109 @@ dev_read_urand(httpd_passwd_t) domain_use_interactive_fds(httpd_passwd_t) @@ -21398,7 +21411,7 @@ index 3023be7f6..5afde8039 100644 + files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups") ') diff --git a/cups.te b/cups.te -index c91813ccb..03b417f70 100644 +index c91813ccb..466ae9b70 100644 --- a/cups.te +++ b/cups.te @@ -5,19 +5,31 @@ policy_module(cups, 1.16.2) @@ -21675,7 +21688,7 @@ index c91813ccb..03b417f70 100644 selinux_compute_access_vector(cupsd_t) selinux_validate_context(cupsd_t) -@@ -244,22 +289,30 @@ auth_dontaudit_read_pam_pid(cupsd_t) +@@ -244,23 +289,31 @@ auth_dontaudit_read_pam_pid(cupsd_t) auth_rw_faillog(cupsd_t) auth_use_nsswitch(cupsd_t) @@ -21700,17 +21713,18 @@ index c91813ccb..03b417f70 100644 userdom_dontaudit_use_unpriv_user_fds(cupsd_t) +userdom_dontaudit_search_user_home_dirs(cupsd_t) - userdom_dontaudit_search_user_home_content(cupsd_t) -+userdom_dontaudit_use_unpriv_user_fds(cupsd_t) +userdom_dontaudit_search_user_home_content(cupsd_t) -+ ++userdom_dontaudit_use_unpriv_user_fds(cupsd_t) + userdom_dontaudit_search_user_home_content(cupsd_t) + +tunable_policy(`cups_execmem',` + allow cupsd_t self:process { execmem execstack }; +') + - ++ optional_policy(` apm_domtrans_client(cupsd_t) + ') @@ -272,6 +325,8 @@ optional_policy(` optional_policy(` dbus_system_bus_client(cupsd_t) @@ -21854,7 +21868,7 @@ index c91813ccb..03b417f70 100644 fs_search_auto_mountpoints(cupsd_config_t) domain_use_interactive_fds(cupsd_config_t) -@@ -417,11 +476,6 @@ auth_use_nsswitch(cupsd_config_t) +@@ -417,17 +476,16 @@ auth_use_nsswitch(cupsd_config_t) logging_send_syslog_msg(cupsd_config_t) @@ -21866,7 +21880,17 @@ index c91813ccb..03b417f70 100644 userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t) userdom_dontaudit_search_user_home_dirs(cupsd_config_t) userdom_read_all_users_state(cupsd_config_t) -@@ -449,9 +503,12 @@ optional_policy(` + userdom_read_user_tmp_symlinks(cupsd_config_t) + userdom_rw_user_tmp_files(cupsd_config_t) + ++tunable_policy(`cups_execmem',` ++ allow cupsd_config_t self:process { execmem execstack }; ++') ++ + optional_policy(` + term_use_generic_ptys(cupsd_config_t) + ') +@@ -449,9 +507,12 @@ optional_policy(` ') optional_policy(` @@ -21880,7 +21904,7 @@ index c91813ccb..03b417f70 100644 ') optional_policy(` -@@ -467,6 +524,10 @@ optional_policy(` +@@ -467,6 +528,10 @@ optional_policy(` ') optional_policy(` @@ -21891,7 +21915,7 @@ index c91813ccb..03b417f70 100644 rpm_read_db(cupsd_config_t) ') -@@ -487,10 +548,6 @@ optional_policy(` +@@ -487,10 +552,6 @@ optional_policy(` # Lpd local policy # @@ -21902,7 +21926,7 @@ index c91813ccb..03b417f70 100644 allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms; allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms; -@@ -508,15 +565,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t) +@@ -508,15 +569,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t) kernel_read_kernel_sysctls(cupsd_lpd_t) kernel_read_system_state(cupsd_lpd_t) @@ -21920,7 +21944,7 @@ index c91813ccb..03b417f70 100644 corenet_tcp_sendrecv_ipp_port(cupsd_lpd_t) corenet_sendrecv_printer_server_packets(cupsd_lpd_t) -@@ -537,9 +594,6 @@ auth_use_nsswitch(cupsd_lpd_t) +@@ -537,9 +598,6 @@ auth_use_nsswitch(cupsd_lpd_t) logging_send_syslog_msg(cupsd_lpd_t) @@ -21930,7 +21954,7 @@ index c91813ccb..03b417f70 100644 optional_policy(` inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t) ') -@@ -549,9 +603,9 @@ optional_policy(` +@@ -549,9 +607,9 @@ optional_policy(` # Pdf local policy # @@ -21942,7 +21966,7 @@ index c91813ccb..03b417f70 100644 append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t) create_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t) -@@ -566,148 +620,23 @@ fs_search_auto_mountpoints(cups_pdf_t) +@@ -566,148 +624,23 @@ fs_search_auto_mountpoints(cups_pdf_t) kernel_read_system_state(cups_pdf_t) @@ -21971,13 +21995,11 @@ index c91813ccb..03b417f70 100644 - fs_manage_cifs_dirs(cups_pdf_t) - fs_manage_cifs_files(cups_pdf_t) -') -+userdom_home_manager(cups_pdf_t) - - optional_policy(` +- +-optional_policy(` - lpd_manage_spool(cups_pdf_t) -+ gnome_read_config(cups_pdf_t) - ') - +-') +- -######################################## -# -# HPLIP local policy @@ -22079,11 +22101,13 @@ index c91813ccb..03b417f70 100644 - lpd_read_config(hplip_t) - lpd_manage_spool(hplip_t) -') -- --optional_policy(` ++userdom_home_manager(cups_pdf_t) + + optional_policy(` - seutil_sigchld_newrole(hplip_t) --') -- ++ gnome_read_config(cups_pdf_t) + ') + -optional_policy(` - snmp_read_snmp_var_lib_files(hplip_t) -') @@ -22094,7 +22118,7 @@ index c91813ccb..03b417f70 100644 ######################################## # -@@ -735,7 +664,6 @@ kernel_read_kernel_sysctls(ptal_t) +@@ -735,7 +668,6 @@ kernel_read_kernel_sysctls(ptal_t) kernel_list_proc(ptal_t) kernel_read_proc_symlinks(ptal_t) @@ -22102,7 +22126,7 @@ index c91813ccb..03b417f70 100644 corenet_all_recvfrom_netlabel(ptal_t) corenet_tcp_sendrecv_generic_if(ptal_t) corenet_tcp_sendrecv_generic_node(ptal_t) -@@ -745,13 +673,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t) +@@ -745,13 +677,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t) corenet_tcp_bind_ptal_port(ptal_t) corenet_tcp_sendrecv_ptal_port(ptal_t) @@ -22116,7 +22140,7 @@ index c91813ccb..03b417f70 100644 files_read_etc_runtime_files(ptal_t) fs_getattr_all_fs(ptal_t) -@@ -759,8 +685,6 @@ fs_search_auto_mountpoints(ptal_t) +@@ -759,8 +689,6 @@ fs_search_auto_mountpoints(ptal_t) logging_send_syslog_msg(ptal_t) @@ -22125,7 +22149,7 @@ index c91813ccb..03b417f70 100644 sysnet_read_config(ptal_t) userdom_dontaudit_use_unpriv_user_fds(ptal_t) -@@ -773,3 +697,4 @@ optional_policy(` +@@ -773,3 +701,4 @@ optional_policy(` optional_policy(` udev_read_db(ptal_t) ') @@ -31757,10 +31781,10 @@ index 000000000..d9ba5fa27 +') diff --git a/ganesha.te b/ganesha.te new file mode 100644 -index 000000000..0fdeecfd6 +index 000000000..f25a3f34d --- /dev/null +++ b/ganesha.te -@@ -0,0 +1,110 @@ +@@ -0,0 +1,111 @@ +policy_module(ganesha, 1.0.0) + +######################################## @@ -31797,6 +31821,7 @@ index 000000000..0fdeecfd6 +# +dontaudit ganesha_t self:capability net_admin; + ++allow ganesha_t self:capability { dac_read_search dac_override }; +allow ganesha_t self:capability2 block_suspend; +allow ganesha_t self:process { setcap setrlimit }; +allow ganesha_t self:fifo_file rw_fifo_file_perms; @@ -43708,7 +43733,7 @@ index 4fe75fd63..3504a9bf7 100644 +/var/tmp/ldap_487 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/tmp/ldap_55 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) diff --git a/kerberos.if b/kerberos.if -index f6c00d8e6..79ea4d8d2 100644 +index f6c00d8e6..1233a5ba2 100644 --- a/kerberos.if +++ b/kerberos.if @@ -1,27 +1,29 @@ @@ -43847,7 +43872,16 @@ index f6c00d8e6..79ea4d8d2 100644 pcscd_stream_connect($1) ') ') -@@ -119,7 +119,7 @@ interface(`kerberos_use',` +@@ -115,11 +115,16 @@ interface(`kerberos_use',` + optional_policy(` + sssd_read_public_files($1) + ') ++ ++ # Allow to use kerberos KCM daemon (sssd-kcm) ++ optional_policy(` ++ sssd_run_stream_connect($1) ++ ') + ') ######################################## ## @@ -43856,7 +43890,7 @@ index f6c00d8e6..79ea4d8d2 100644 ## ## ## -@@ -135,15 +135,13 @@ interface(`kerberos_read_config',` +@@ -135,15 +140,13 @@ interface(`kerberos_read_config',` files_search_etc($1) allow $1 krb5_conf_t:file read_file_perms; @@ -43874,7 +43908,7 @@ index f6c00d8e6..79ea4d8d2 100644 ## ## ## -@@ -156,13 +154,12 @@ interface(`kerberos_dontaudit_write_config',` +@@ -156,13 +159,12 @@ interface(`kerberos_dontaudit_write_config',` type krb5_conf_t; ') @@ -43890,7 +43924,7 @@ index f6c00d8e6..79ea4d8d2 100644 ## ## ## -@@ -182,27 +179,27 @@ interface(`kerberos_rw_config',` +@@ -182,27 +184,27 @@ interface(`kerberos_rw_config',` ######################################## ## @@ -43925,7 +43959,7 @@ index f6c00d8e6..79ea4d8d2 100644 ## ## ## -@@ -210,220 +207,252 @@ interface(`kerberos_manage_krb5_home_files',` +@@ -210,220 +212,252 @@ interface(`kerberos_manage_krb5_home_files',` ## ## # @@ -44268,7 +44302,7 @@ index f6c00d8e6..79ea4d8d2 100644 ## ## ## -@@ -432,17 +461,18 @@ interface(`kerberos_manage_host_rcache',` +@@ -432,17 +466,18 @@ interface(`kerberos_manage_host_rcache',` ## ## # @@ -44291,7 +44325,7 @@ index f6c00d8e6..79ea4d8d2 100644 ## ## ## -@@ -450,82 +480,109 @@ interface(`kerberos_tmp_filetrans_host_rcache',` +@@ -450,82 +485,109 @@ interface(`kerberos_tmp_filetrans_host_rcache',` ## ## # @@ -46622,7 +46656,7 @@ index 3602712d0..af83a5b6b 100644 + allow $1 slapd_unit_file_t:service all_service_perms; ') diff --git a/ldap.te b/ldap.te -index 4c2b1110e..a3ca80b27 100644 +index 4c2b1110e..a3d898007 100644 --- a/ldap.te +++ b/ldap.te @@ -21,6 +21,9 @@ files_config_file(slapd_etc_t) @@ -46656,7 +46690,17 @@ index 4c2b1110e..a3ca80b27 100644 logging_log_filetrans(slapd_t, slapd_log_t, { file dir }) manage_dirs_pattern(slapd_t, slapd_replog_t, slapd_replog_t) -@@ -93,7 +95,6 @@ files_pid_filetrans(slapd_t, slapd_var_run_t, { dir file sock_file }) +@@ -80,7 +82,8 @@ manage_lnk_files_pattern(slapd_t, slapd_replog_t, slapd_replog_t) + + manage_dirs_pattern(slapd_t, slapd_tmp_t, slapd_tmp_t) + manage_files_pattern(slapd_t, slapd_tmp_t, slapd_tmp_t) +-files_tmp_filetrans(slapd_t, slapd_tmp_t, { file dir }) ++manage_lnk_files_pattern(slapd_t, slapd_tmp_t, slapd_tmp_t) ++files_tmp_filetrans(slapd_t, slapd_tmp_t, { file lnk_file dir }) + + manage_files_pattern(slapd_t, slapd_tmpfs_t, slapd_tmpfs_t) + fs_tmpfs_filetrans(slapd_t, slapd_tmpfs_t, file) +@@ -93,7 +96,6 @@ files_pid_filetrans(slapd_t, slapd_var_run_t, { dir file sock_file }) kernel_read_system_state(slapd_t) kernel_read_kernel_sysctls(slapd_t) @@ -46664,7 +46708,7 @@ index 4c2b1110e..a3ca80b27 100644 corenet_all_recvfrom_netlabel(slapd_t) corenet_tcp_sendrecv_generic_if(slapd_t) corenet_tcp_sendrecv_generic_node(slapd_t) -@@ -115,25 +116,26 @@ fs_getattr_all_fs(slapd_t) +@@ -115,25 +117,26 @@ fs_getattr_all_fs(slapd_t) fs_search_auto_mountpoints(slapd_t) files_read_etc_runtime_files(slapd_t) @@ -47352,7 +47396,7 @@ index dff21a7c4..b6981c846 100644 init_labeled_script_domtrans($1, lircd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/lircd.te b/lircd.te -index 483c87bb6..eecd4c158 100644 +index 483c87bb6..2ade17890 100644 --- a/lircd.te +++ b/lircd.te @@ -13,7 +13,7 @@ type lircd_initrc_exec_t; @@ -47377,15 +47421,16 @@ index 483c87bb6..eecd4c158 100644 read_files_pattern(lircd_t, lircd_etc_t, lircd_etc_t) -@@ -39,6 +40,7 @@ dev_filetrans(lircd_t, lircd_var_run_t, sock_file) +@@ -39,6 +40,8 @@ dev_filetrans(lircd_t, lircd_var_run_t, sock_file) kernel_request_load_module(lircd_t) ++corecmd_exec_shell(lircd_t) + corenet_all_recvfrom_unlabeled(lircd_t) corenet_all_recvfrom_netlabel(lircd_t) corenet_tcp_sendrecv_generic_if(lircd_t) -@@ -56,7 +58,7 @@ dev_read_mouse(lircd_t) +@@ -56,7 +59,7 @@ dev_read_mouse(lircd_t) dev_filetrans_lirc(lircd_t) dev_rw_lirc(lircd_t) dev_rw_input_dev(lircd_t) @@ -47394,7 +47439,7 @@ index 483c87bb6..eecd4c158 100644 files_read_config_files(lircd_t) files_list_var(lircd_t) -@@ -64,9 +66,11 @@ files_manage_generic_locks(lircd_t) +@@ -64,9 +67,11 @@ files_manage_generic_locks(lircd_t) files_read_all_locks(lircd_t) term_use_ptmx(lircd_t) @@ -56535,7 +56580,7 @@ index ed81cac5a..cd52baf59 100644 + mta_filetrans_admin_home_content($1) +') diff --git a/mta.te b/mta.te -index ff1d68c6a..630956deb 100644 +index ff1d68c6a..8bb22f6cc 100644 --- a/mta.te +++ b/mta.te @@ -14,8 +14,6 @@ attribute mailserver_sender; @@ -56683,14 +56728,14 @@ index ff1d68c6a..630956deb 100644 init_use_script_ptys(system_mail_t) +init_dontaudit_rw_stream_socket(system_mail_t) -+ + +-userdom_use_user_terminals(system_mail_t) +userdom_use_inherited_user_terminals(system_mail_t) +userdom_dontaudit_list_user_home_dirs(system_mail_t) +userdom_dontaudit_list_admin_dir(system_mail_t) +userdom_dontaudit_list_user_tmp(system_mail_t) +userdom_dontaudit_read_inherited_admin_home_files(system_mail_t) - --userdom_use_user_terminals(system_mail_t) ++ +manage_dirs_pattern(system_mail_t, mail_home_rw_t, mail_home_rw_t) +manage_files_pattern(system_mail_t, mail_home_rw_t, mail_home_rw_t) + @@ -56757,13 +56802,17 @@ index ff1d68c6a..630956deb 100644 courier_stream_connect_authdaemon(system_mail_t) ') -@@ -244,9 +270,10 @@ optional_policy(` +@@ -244,9 +270,14 @@ optional_policy(` ') optional_policy(` - fail2ban_dontaudit_rw_stream_sockets(system_mail_t) - fail2ban_append_log(system_mail_t) - fail2ban_rw_inherited_tmp_files(system_mail_t) ++ dbus_system_bus_client(system_mail_t) ++') ++ ++optional_policy(` + fail2ban_append_log(user_mail_domain) + fail2ban_dontaudit_leaks(user_mail_domain) + fail2ban_rw_inherited_tmp_files(mta_user_agent) @@ -56771,7 +56820,7 @@ index ff1d68c6a..630956deb 100644 ') optional_policy(` -@@ -258,10 +285,17 @@ optional_policy(` +@@ -258,10 +289,17 @@ optional_policy(` ') optional_policy(` @@ -56789,7 +56838,7 @@ index ff1d68c6a..630956deb 100644 nagios_read_tmp_files(system_mail_t) ') -@@ -272,6 +306,19 @@ optional_policy(` +@@ -272,6 +310,19 @@ optional_policy(` manage_fifo_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t) manage_sock_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t) files_etc_filetrans(system_mail_t, etc_aliases_t, { file lnk_file sock_file fifo_file }) @@ -56809,7 +56858,7 @@ index ff1d68c6a..630956deb 100644 ') optional_policy(` -@@ -279,6 +326,10 @@ optional_policy(` +@@ -279,6 +330,10 @@ optional_policy(` ') optional_policy(` @@ -56820,7 +56869,7 @@ index ff1d68c6a..630956deb 100644 userdom_dontaudit_use_user_ptys(system_mail_t) optional_policy(` -@@ -287,42 +338,36 @@ optional_policy(` +@@ -287,42 +342,36 @@ optional_policy(` ') optional_policy(` @@ -56873,7 +56922,7 @@ index ff1d68c6a..630956deb 100644 allow mailserver_delivery mail_spool_t:dir list_dir_perms; create_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) -@@ -331,44 +376,48 @@ append_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) +@@ -331,44 +380,48 @@ append_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) create_lnk_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) read_lnk_files_pattern(mailserver_delivery, mail_spool_t, mail_spool_t) @@ -56943,7 +56992,7 @@ index ff1d68c6a..630956deb 100644 ') optional_policy(` -@@ -381,24 +430,49 @@ optional_policy(` +@@ -381,24 +434,49 @@ optional_policy(` ######################################## # @@ -63206,7 +63255,7 @@ index a9c60ff87..ad4f14ad6 100644 + refpolicywarn(`$0($*) has been deprecated.') ') diff --git a/nsd.te b/nsd.te -index 47bb1d204..1e5567367 100644 +index 47bb1d204..94070d223 100644 --- a/nsd.te +++ b/nsd.te @@ -9,9 +9,7 @@ type nsd_t; @@ -63220,7 +63269,7 @@ index 47bb1d204..1e5567367 100644 type nsd_conf_t; files_type(nsd_conf_t) -@@ -20,41 +18,50 @@ domain_type(nsd_crond_t) +@@ -20,40 +18,51 @@ domain_type(nsd_crond_t) domain_entry_file(nsd_crond_t, nsd_exec_t) role system_r types nsd_crond_t; @@ -63275,15 +63324,16 @@ index 47bb1d204..1e5567367 100644 manage_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t) manage_lnk_files_pattern(nsd_t, nsd_zone_t, nsd_zone_t) files_var_lib_filetrans(nsd_t, nsd_zone_t, dir) - ++allow nsd_t nsd_zone_t:file { map } ; ++ +manage_dirs_pattern(nsd_t, nsd_tmp_t, nsd_tmp_t) +manage_files_pattern(nsd_t, nsd_tmp_t, nsd_tmp_t) +files_tmp_filetrans(nsd_t, nsd_tmp_t, { file dir }) -+ ++allow nsd_t nsd_tmp_t:file { map } ; + can_exec(nsd_t, nsd_exec_t) - kernel_read_system_state(nsd_t) -@@ -62,7 +69,6 @@ kernel_read_kernel_sysctls(nsd_t) +@@ -62,7 +71,6 @@ kernel_read_kernel_sysctls(nsd_t) corecmd_exec_bin(nsd_t) @@ -63291,7 +63341,7 @@ index 47bb1d204..1e5567367 100644 corenet_all_recvfrom_netlabel(nsd_t) corenet_tcp_sendrecv_generic_if(nsd_t) corenet_udp_sendrecv_generic_if(nsd_t) -@@ -72,16 +78,20 @@ corenet_tcp_sendrecv_all_ports(nsd_t) +@@ -72,16 +80,20 @@ corenet_tcp_sendrecv_all_ports(nsd_t) corenet_udp_sendrecv_all_ports(nsd_t) corenet_tcp_bind_generic_node(nsd_t) corenet_udp_bind_generic_node(nsd_t) @@ -63314,7 +63364,7 @@ index 47bb1d204..1e5567367 100644 fs_getattr_all_fs(nsd_t) fs_search_auto_mountpoints(nsd_t) -@@ -90,8 +100,6 @@ auth_use_nsswitch(nsd_t) +@@ -90,8 +102,6 @@ auth_use_nsswitch(nsd_t) logging_send_syslog_msg(nsd_t) @@ -63323,7 +63373,7 @@ index 47bb1d204..1e5567367 100644 userdom_dontaudit_use_unpriv_user_fds(nsd_t) userdom_dontaudit_search_user_home_dirs(nsd_t) -@@ -105,23 +113,24 @@ optional_policy(` +@@ -105,23 +115,24 @@ optional_policy(` ######################################## # @@ -63357,7 +63407,7 @@ index 47bb1d204..1e5567367 100644 manage_files_pattern(nsd_crond_t, nsd_zone_t, nsd_zone_t) filetrans_pattern(nsd_crond_t, nsd_conf_t, nsd_zone_t, file) -@@ -133,29 +142,33 @@ kernel_read_system_state(nsd_crond_t) +@@ -133,29 +144,33 @@ kernel_read_system_state(nsd_crond_t) corecmd_exec_bin(nsd_crond_t) corecmd_exec_shell(nsd_crond_t) @@ -70917,10 +70967,10 @@ index 000000000..abb250dba +') diff --git a/pcp.te b/pcp.te new file mode 100644 -index 000000000..372915272 +index 000000000..4a2a68db1 --- /dev/null +++ b/pcp.te -@@ -0,0 +1,313 @@ +@@ -0,0 +1,315 @@ +policy_module(pcp, 1.0.0) + +######################################## @@ -71227,6 +71277,8 @@ index 000000000..372915272 +init_read_utmp(pcp_pmlogger_t) +init_status(pcp_pmlogger_t) + ++logging_send_syslog_msg(pcp_pmlogger_t) ++ +systemd_exec_systemctl(pcp_pmlogger_t) +systemd_getattr_unit_files(pcp_pmlogger_t) + @@ -88223,7 +88275,7 @@ index 16c8ecbe3..4e021eca7 100644 + ') ') diff --git a/redis.te b/redis.te -index 25cd4175f..84c02e325 100644 +index 25cd4175f..cf565276c 100644 --- a/redis.te +++ b/redis.te @@ -12,6 +12,9 @@ init_daemon_domain(redis_t, redis_exec_t) @@ -88236,17 +88288,20 @@ index 25cd4175f..84c02e325 100644 type redis_log_t; logging_log_file(redis_log_t) -@@ -21,6 +24,9 @@ files_type(redis_var_lib_t) +@@ -21,6 +24,12 @@ files_type(redis_var_lib_t) type redis_var_run_t; files_pid_file(redis_var_run_t) ++type redis_tmp_t; ++files_tmp_file(redis_tmp_t) ++ +type redis_unit_file_t; +systemd_unit_file(redis_unit_file_t) + ######################################## # # Local policy -@@ -31,6 +37,8 @@ allow redis_t self:fifo_file rw_fifo_file_perms; +@@ -31,6 +40,8 @@ allow redis_t self:fifo_file rw_fifo_file_perms; allow redis_t self:unix_stream_socket create_stream_socket_perms; allow redis_t self:tcp_socket create_stream_socket_perms; @@ -88255,11 +88310,16 @@ index 25cd4175f..84c02e325 100644 manage_dirs_pattern(redis_t, redis_log_t, redis_log_t) manage_files_pattern(redis_t, redis_log_t, redis_log_t) manage_lnk_files_pattern(redis_t, redis_log_t, redis_log_t) -@@ -42,24 +50,27 @@ manage_lnk_files_pattern(redis_t, redis_var_lib_t, redis_var_lib_t) +@@ -42,24 +53,32 @@ manage_lnk_files_pattern(redis_t, redis_var_lib_t, redis_var_lib_t) manage_dirs_pattern(redis_t, redis_var_run_t, redis_var_run_t) manage_files_pattern(redis_t, redis_var_run_t, redis_var_run_t) manage_lnk_files_pattern(redis_t, redis_var_run_t, redis_var_run_t) +manage_sock_files_pattern(redis_t, redis_var_run_t, redis_var_run_t) ++ ++ ++manage_dirs_pattern(redis_t, redis_tmp_t, redis_tmp_t) ++manage_files_pattern(redis_t, redis_tmp_t, redis_tmp_t) ++files_tmp_filetrans(redis_t, redis_tmp_t, { dir file }) kernel_read_system_state(redis_t) +kernel_read_net_sysctls(redis_t) @@ -89087,7 +89147,7 @@ index 47de2d681..6baf5cdae 100644 +/var/log/pacemaker\.log.* -- gen_context(system_u:object_r:cluster_var_log_t,s0) +/var/log/pcsd(/.*)? gen_context(system_u:object_r:cluster_var_log_t,s0) diff --git a/rhcs.if b/rhcs.if -index c8bdea28d..beb2872e3 100644 +index c8bdea28d..96da15f8a 100644 --- a/rhcs.if +++ b/rhcs.if @@ -1,19 +1,19 @@ @@ -89416,8 +89476,10 @@ index c8bdea28d..beb2872e3 100644 + manage_files_pattern($1, groupd_tmpfs_t, groupd_tmpfs_t) +') + -+######################################## -+## + ######################################## + ## +-## Read and write all cluster domains +-## shared memory. +## Read and write to group shared memory. +## +## @@ -89437,10 +89499,8 @@ index c8bdea28d..beb2872e3 100644 + manage_files_pattern($1, groupd_tmpfs_t, groupd_tmpfs_t) +') + - ######################################## - ## --## Read and write all cluster domains --## shared memory. ++######################################## ++## +## Read and write to group shared memory. ## ## @@ -89538,7 +89598,7 @@ index c8bdea28d..beb2872e3 100644 ') ###################################### -@@ -446,52 +577,404 @@ interface(`rhcs_domtrans_qdiskd',` +@@ -446,52 +577,423 @@ interface(`rhcs_domtrans_qdiskd',` ######################################## ## @@ -89576,10 +89636,16 @@ index c8bdea28d..beb2872e3 100644 # -interface(`rhcs_admin',` +interface(`rhcs_read_cluster_lib_files',` -+ gen_require(` + gen_require(` +- attribute cluster_domain, cluster_pid, cluster_tmpfs; +- attribute cluster_log; +- type dlm_controld_initrc_exec_t, foghorn_initrc_exec_t, fenced_lock_t; +- type fenced_tmp_t, qdiskd_var_lib_t; + type cluster_var_lib_t; -+ ') -+ + ') + +- allow $1 cluster_domain:process { ptrace signal_perms }; +- ps_process_pattern($1, cluster_domain) + files_search_var_lib($1) + read_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) +') @@ -89598,11 +89664,17 @@ index c8bdea28d..beb2872e3 100644 + gen_require(` + type cluster_var_lib_t; + ') -+ + +- init_labeled_script_domtrans($1, { dlm_controld_initrc_exec_t foghorn_initrc_exec_t }) +- domain_system_change_exemption($1) +- role_transition $2 { dlm_controld_initrc_exec_t foghorn_initrc_exec_t } system_r; +- allow $2 system_r; + files_search_var_lib($1) + manage_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) +') -+ + +- files_search_pids($1) +- admin_pattern($1, cluster_pid) +#################################### +## +## Allow domain to relabel cluster lib files @@ -89622,7 +89694,9 @@ index c8bdea28d..beb2872e3 100644 + relabelto_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) + relabelfrom_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) +') -+ + +- files_search_locks($1) +- admin_pattern($1, fenced_lock_t) +###################################### +## +## Execute a domain transition to run cluster administrative domain. @@ -89637,11 +89711,15 @@ index c8bdea28d..beb2872e3 100644 + gen_require(` + type cluster_t, cluster_exec_t; + ') -+ + +- files_search_tmp($1) +- admin_pattern($1, fenced_tmp_t) + corecmd_search_bin($1) + domtrans_pattern($1, cluster_exec_t, cluster_t) +') -+ + +- files_search_var_lib($1) +- admin_pattern($1, qdiskd_var_lib_t) +####################################### +## +## Execute cluster init scripts in @@ -89657,7 +89735,9 @@ index c8bdea28d..beb2872e3 100644 + gen_require(` + type cluster_initrc_exec_t; + ') -+ + +- fs_search_tmpfs($1) +- admin_pattern($1, cluster_tmpfs) + init_labeled_script_domtrans($1, cluster_initrc_exec_t) +') + @@ -89868,31 +89948,17 @@ index c8bdea28d..beb2872e3 100644 +## +# +interface(`rhcs_dbus_chat_cluster',` - gen_require(` -- attribute cluster_domain, cluster_pid, cluster_tmpfs; -- attribute cluster_log; -- type dlm_controld_initrc_exec_t, foghorn_initrc_exec_t, fenced_lock_t; -- type fenced_tmp_t, qdiskd_var_lib_t; ++ gen_require(` + type cluster_t; + class dbus send_msg; - ') - -- allow $1 cluster_domain:process { ptrace signal_perms }; -- ps_process_pattern($1, cluster_domain) ++ ') ++ + allow $1 cluster_t:dbus send_msg; + allow cluster_t $1:dbus send_msg; +') - -- init_labeled_script_domtrans($1, { dlm_controld_initrc_exec_t foghorn_initrc_exec_t }) -- domain_system_change_exemption($1) -- role_transition $2 { dlm_controld_initrc_exec_t foghorn_initrc_exec_t } system_r; -- allow $2 system_r; - -- files_search_pids($1) -- admin_pattern($1, cluster_pid) - -- files_search_locks($1) -- admin_pattern($1, fenced_lock_t) ++ ++ ++ +##################################### +## +## All of the rules required to administrate @@ -89916,20 +89982,14 @@ index c8bdea28d..beb2872e3 100644 + type cluster_tmpfs_t, cluster_var_log_t, cluster_var_run_t; + type cluster_unit_file_t; + ') - -- files_search_tmp($1) -- admin_pattern($1, fenced_tmp_t) ++ + allow $1 cluster_t:process signal_perms; + ps_process_pattern($1, cluster_t) - -- files_search_var_lib($1) -- admin_pattern($1, qdiskd_var_lib_t) ++ + tunable_policy(`deny_ptrace',`',` + allow $1 cluster_t:process ptrace; + ') - -- fs_search_tmpfs($1) -- admin_pattern($1, cluster_tmpfs) ++ + init_labeled_script_domtrans($1, cluster_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 cluster_initrc_exec_t system_r; @@ -89965,14 +90025,33 @@ index c8bdea28d..beb2872e3 100644 + gen_require(` + type haproxy_unit_file_t; + ') ++ ++ systemd_exec_systemctl($1) ++ allow $1 haproxy_unit_file_t:service {status start}; ++') ++ ++######################################## ++## ++## Create log files with a named file ++## type transition. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`rhcs_named_filetrans_log_dir',` ++ gen_require(` ++ type var_log_t; ++ ') - logging_search_logs($1) - admin_pattern($1, cluster_log) -+ systemd_exec_systemctl($1) -+ allow $1 haproxy_unit_file_t:service {status start}; ++ logging_log_named_filetrans($1, var_log_t, dir, "bundles") ') diff --git a/rhcs.te b/rhcs.te -index 6cf79c449..11d931106 100644 +index 6cf79c449..5d19d53e3 100644 --- a/rhcs.te +++ b/rhcs.te @@ -20,6 +20,35 @@ gen_tunable(fenced_can_network_connect, false) @@ -90011,7 +90090,7 @@ index 6cf79c449..11d931106 100644 attribute cluster_domain; attribute cluster_log; attribute cluster_pid; -@@ -44,34 +73,291 @@ type foghorn_initrc_exec_t; +@@ -44,34 +73,295 @@ type foghorn_initrc_exec_t; init_script_file(foghorn_initrc_exec_t) rhcs_domain_template(gfs_controld) @@ -90266,6 +90345,10 @@ index 6cf79c449..11d931106 100644 +') + +optional_policy(` ++ rhcs_named_filetrans_log_dir(cluster_t) ++') ++ ++optional_policy(` + rpc_systemctl_nfsd(cluster_t) + rpc_systemctl_rpcd(cluster_t) + @@ -90307,7 +90390,7 @@ index 6cf79c449..11d931106 100644 ') ##################################### -@@ -79,13 +365,14 @@ optional_policy(` +@@ -79,13 +369,14 @@ optional_policy(` # dlm_controld local policy # @@ -90324,7 +90407,7 @@ index 6cf79c449..11d931106 100644 kernel_rw_net_sysctls(dlm_controld_t) corecmd_exec_bin(dlm_controld_t) -@@ -98,16 +385,30 @@ fs_manage_configfs_dirs(dlm_controld_t) +@@ -98,16 +389,30 @@ fs_manage_configfs_dirs(dlm_controld_t) init_rw_script_tmp_files(dlm_controld_t) @@ -90358,7 +90441,7 @@ index 6cf79c449..11d931106 100644 manage_files_pattern(fenced_t, fenced_lock_t, fenced_lock_t) files_lock_filetrans(fenced_t, fenced_lock_t, file) -@@ -118,9 +419,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir }) +@@ -118,9 +423,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir }) stream_connect_pattern(fenced_t, groupd_var_run_t, groupd_var_run_t, groupd_t) @@ -90370,7 +90453,7 @@ index 6cf79c449..11d931106 100644 corecmd_exec_bin(fenced_t) corecmd_exec_shell(fenced_t) -@@ -140,6 +440,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t) +@@ -140,6 +444,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t) corenet_sendrecv_zented_server_packets(fenced_t) corenet_tcp_bind_zented_port(fenced_t) @@ -90379,7 +90462,7 @@ index 6cf79c449..11d931106 100644 corenet_tcp_sendrecv_zented_port(fenced_t) corenet_sendrecv_http_client_packets(fenced_t) -@@ -148,9 +450,8 @@ corenet_tcp_sendrecv_http_port(fenced_t) +@@ -148,9 +454,8 @@ corenet_tcp_sendrecv_http_port(fenced_t) dev_read_sysfs(fenced_t) dev_read_urand(fenced_t) @@ -90391,7 +90474,7 @@ index 6cf79c449..11d931106 100644 storage_raw_read_fixed_disk(fenced_t) storage_raw_write_fixed_disk(fenced_t) -@@ -160,7 +461,7 @@ term_getattr_pty_fs(fenced_t) +@@ -160,7 +465,7 @@ term_getattr_pty_fs(fenced_t) term_use_generic_ptys(fenced_t) term_use_ptmx(fenced_t) @@ -90400,7 +90483,7 @@ index 6cf79c449..11d931106 100644 tunable_policy(`fenced_can_network_connect',` corenet_sendrecv_all_client_packets(fenced_t) -@@ -182,7 +483,8 @@ optional_policy(` +@@ -182,7 +487,8 @@ optional_policy(` ') optional_policy(` @@ -90410,7 +90493,7 @@ index 6cf79c449..11d931106 100644 ') optional_policy(` -@@ -190,12 +492,17 @@ optional_policy(` +@@ -190,12 +496,17 @@ optional_policy(` ') optional_policy(` @@ -90429,7 +90512,7 @@ index 6cf79c449..11d931106 100644 ') optional_policy(` -@@ -203,6 +510,21 @@ optional_policy(` +@@ -203,6 +514,21 @@ optional_policy(` snmp_manage_var_lib_dirs(fenced_t) ') @@ -90451,7 +90534,7 @@ index 6cf79c449..11d931106 100644 ####################################### # # foghorn local policy -@@ -221,16 +543,22 @@ corenet_sendrecv_agentx_client_packets(foghorn_t) +@@ -221,16 +547,22 @@ corenet_sendrecv_agentx_client_packets(foghorn_t) corenet_tcp_connect_agentx_port(foghorn_t) corenet_tcp_sendrecv_agentx_port(foghorn_t) @@ -90476,7 +90559,7 @@ index 6cf79c449..11d931106 100644 snmp_stream_connect(foghorn_t) ') -@@ -247,16 +575,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_ +@@ -247,16 +579,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_ stream_connect_pattern(gfs_controld_t, fenced_var_run_t, fenced_var_run_t, fenced_t) stream_connect_pattern(gfs_controld_t, groupd_var_run_t, groupd_var_run_t, groupd_t) @@ -90498,7 +90581,7 @@ index 6cf79c449..11d931106 100644 optional_policy(` lvm_exec(gfs_controld_t) dev_rw_lvm_control(gfs_controld_t) -@@ -275,10 +607,59 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) +@@ -275,10 +611,59 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) dev_list_sysfs(groupd_t) @@ -90560,7 +90643,7 @@ index 6cf79c449..11d931106 100644 ###################################### # # qdiskd local policy -@@ -292,7 +673,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) +@@ -292,7 +677,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) manage_sock_files_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) files_var_lib_filetrans(qdiskd_t, qdiskd_var_lib_t, { file dir sock_file }) @@ -90568,7 +90651,7 @@ index 6cf79c449..11d931106 100644 kernel_read_software_raid_state(qdiskd_t) kernel_getattr_core_if(qdiskd_t) -@@ -321,6 +701,8 @@ storage_raw_write_fixed_disk(qdiskd_t) +@@ -321,6 +705,8 @@ storage_raw_write_fixed_disk(qdiskd_t) auth_use_nsswitch(qdiskd_t) @@ -96457,7 +96540,7 @@ index b8b66ff4d..a93346efe 100644 +/var/lib/samba/scripts(/.*)? gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0) +') diff --git a/samba.if b/samba.if -index 50d07fb2e..a34db489c 100644 +index 50d07fb2e..e1474fde7 100644 --- a/samba.if +++ b/samba.if @@ -1,8 +1,12 @@ @@ -96818,13 +96901,14 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -400,14 +515,15 @@ interface(`samba_rw_var_files',` +@@ -400,14 +515,16 @@ interface(`samba_rw_var_files',` type samba_var_t; ') + files_search_var($1) files_search_var_lib($1) rw_files_pattern($1, samba_var_t, samba_var_t) ++ allow $1 samba_var_t:file { map}; ') ######################################## @@ -96836,7 +96920,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -421,33 +537,55 @@ interface(`samba_manage_var_files',` +@@ -421,33 +538,55 @@ interface(`samba_manage_var_files',` ') files_search_var_lib($1) @@ -96899,7 +96983,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -462,16 +600,16 @@ interface(`samba_domtrans_smbcontrol',` +@@ -462,16 +601,16 @@ interface(`samba_domtrans_smbcontrol',` # interface(`samba_run_smbcontrol',` gen_require(` @@ -96919,7 +97003,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -488,9 +626,27 @@ interface(`samba_domtrans_smbd',` +@@ -488,9 +627,27 @@ interface(`samba_domtrans_smbd',` domtrans_pattern($1, smbd_exec_t, smbd_t) ') @@ -96948,7 +97032,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -505,10 +661,26 @@ interface(`samba_signal_smbd',` +@@ -505,10 +662,26 @@ interface(`samba_signal_smbd',` allow $1 smbd_t:process signal; ') @@ -96977,7 +97061,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -526,7 +698,7 @@ interface(`samba_dontaudit_use_fds',` +@@ -526,7 +699,7 @@ interface(`samba_dontaudit_use_fds',` ######################################## ## @@ -96986,7 +97070,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -544,7 +716,7 @@ interface(`samba_write_smbmount_tcp_sockets',` +@@ -544,7 +717,7 @@ interface(`samba_write_smbmount_tcp_sockets',` ######################################## ## @@ -96995,7 +97079,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -560,49 +732,47 @@ interface(`samba_rw_smbmount_tcp_sockets',` +@@ -560,49 +733,47 @@ interface(`samba_rw_smbmount_tcp_sockets',` allow $1 smbmount_t:tcp_socket { read write }; ') @@ -97064,7 +97148,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -618,16 +788,16 @@ interface(`samba_getattr_winbind_exec',` +@@ -618,16 +789,16 @@ interface(`samba_getattr_winbind_exec',` # interface(`samba_run_winbind_helper',` gen_require(` @@ -97084,7 +97168,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -637,17 +807,71 @@ interface(`samba_run_winbind_helper',` +@@ -637,17 +808,71 @@ interface(`samba_run_winbind_helper',` # interface(`samba_read_winbind_pid',` gen_require(` @@ -97160,7 +97244,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -657,17 +881,61 @@ interface(`samba_read_winbind_pid',` +@@ -657,17 +882,61 @@ interface(`samba_read_winbind_pid',` # interface(`samba_stream_connect_winbind',` gen_require(` @@ -97185,12 +97269,10 @@ index 50d07fb2e..a34db489c 100644 + files_search_tmp($1) + stream_connect_pattern($1, winbind_tmp_t, winbind_tmp_t, winbind_t) + ') - ') - - ######################################## - ## --## All of the rules required to --## administrate an samba environment. ++') ++ ++######################################## ++## +## Create a set of derived types for apache +## web content. +## @@ -97218,16 +97300,18 @@ index 50d07fb2e..a34db489c 100644 + + domtrans_pattern(smbd_t, samba_$1_script_exec_t, samba_$1_script_t) + allow smbd_t samba_$1_script_exec_t:file ioctl; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## All of the rules required to +-## administrate an samba environment. +## All of the rules required to administrate +## an samba environment ## ## ## -@@ -676,7 +944,7 @@ interface(`samba_stream_connect_winbind',` +@@ -676,7 +945,7 @@ interface(`samba_stream_connect_winbind',` ## ## ## @@ -97236,7 +97320,7 @@ index 50d07fb2e..a34db489c 100644 ## ## ## -@@ -689,11 +957,30 @@ interface(`samba_admin',` +@@ -689,11 +958,30 @@ interface(`samba_admin',` type samba_etc_t, samba_share_t, samba_initrc_exec_t; type swat_var_run_t, swat_tmp_t, winbind_log_t; type winbind_var_run_t, winbind_tmp_t; @@ -97270,7 +97354,7 @@ index 50d07fb2e..a34db489c 100644 init_labeled_script_domtrans($1, samba_initrc_exec_t) domain_system_change_exemption($1) -@@ -703,23 +990,34 @@ interface(`samba_admin',` +@@ -703,23 +991,34 @@ interface(`samba_admin',` files_list_etc($1) admin_pattern($1, { samba_etc_t smbd_keytab_t }) @@ -97317,7 +97401,7 @@ index 50d07fb2e..a34db489c 100644 + allow $1 samba_unit_file_t:service all_service_perms; ') diff --git a/samba.te b/samba.te -index 2b7c441e7..adf980ca1 100644 +index 2b7c441e7..86e4d0c67 100644 --- a/samba.te +++ b/samba.te @@ -6,99 +6,86 @@ policy_module(samba, 1.16.3) @@ -97556,12 +97640,13 @@ index 2b7c441e7..adf980ca1 100644 allow samba_net_t samba_etc_t:file read_file_perms; -@@ -208,19 +206,25 @@ files_tmp_filetrans(samba_net_t, samba_net_tmp_t, { file dir }) +@@ -208,19 +206,26 @@ files_tmp_filetrans(samba_net_t, samba_net_tmp_t, { file dir }) manage_dirs_pattern(samba_net_t, samba_var_t, samba_var_t) manage_files_pattern(samba_net_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(samba_net_t, samba_var_t, samba_var_t) +manage_sock_files_pattern(samba_net_t, samba_var_t, samba_var_t) files_var_filetrans(samba_net_t, samba_var_t, dir, "samba") ++allow samba_net_t samba_var_t:file { map } ; +kernel_read_proc_symlinks(samba_net_t) kernel_read_system_state(samba_net_t) @@ -97586,7 +97671,7 @@ index 2b7c441e7..adf980ca1 100644 dev_read_urand(samba_net_t) -@@ -233,15 +237,22 @@ auth_manage_cache(samba_net_t) +@@ -233,15 +238,22 @@ auth_manage_cache(samba_net_t) logging_send_syslog_msg(samba_net_t) @@ -97613,7 +97698,7 @@ index 2b7c441e7..adf980ca1 100644 ') optional_policy(` -@@ -249,46 +260,59 @@ optional_policy(` +@@ -249,46 +261,59 @@ optional_policy(` ') optional_policy(` @@ -97686,7 +97771,7 @@ index 2b7c441e7..adf980ca1 100644 manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t) allow smbd_t samba_share_t:filesystem { getattr quotaget }; -@@ -297,66 +321,74 @@ manage_files_pattern(smbd_t, samba_var_t, samba_var_t) +@@ -297,66 +322,74 @@ manage_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t) manage_sock_files_pattern(smbd_t, samba_var_t, samba_var_t) files_var_filetrans(smbd_t, samba_var_t, dir, "samba") @@ -97785,7 +97870,7 @@ index 2b7c441e7..adf980ca1 100644 fs_getattr_all_fs(smbd_t) fs_getattr_all_dirs(smbd_t) -@@ -366,44 +398,53 @@ fs_getattr_rpc_dirs(smbd_t) +@@ -366,44 +399,53 @@ fs_getattr_rpc_dirs(smbd_t) fs_list_inotifyfs(smbd_t) fs_get_all_fs_quotas(smbd_t) @@ -97851,7 +97936,7 @@ index 2b7c441e7..adf980ca1 100644 ') tunable_policy(`samba_domain_controller',` -@@ -419,20 +460,16 @@ tunable_policy(`samba_domain_controller',` +@@ -419,20 +461,16 @@ tunable_policy(`samba_domain_controller',` ') tunable_policy(`samba_enable_home_dirs',` @@ -97878,7 +97963,7 @@ index 2b7c441e7..adf980ca1 100644 tunable_policy(`samba_share_nfs',` fs_manage_nfs_dirs(smbd_t) fs_manage_nfs_files(smbd_t) -@@ -441,6 +478,7 @@ tunable_policy(`samba_share_nfs',` +@@ -441,6 +479,7 @@ tunable_policy(`samba_share_nfs',` fs_manage_nfs_named_sockets(smbd_t) ') @@ -97886,7 +97971,7 @@ index 2b7c441e7..adf980ca1 100644 tunable_policy(`samba_share_fusefs',` fs_manage_fusefs_dirs(smbd_t) fs_manage_fusefs_files(smbd_t) -@@ -448,15 +486,10 @@ tunable_policy(`samba_share_fusefs',` +@@ -448,15 +487,10 @@ tunable_policy(`samba_share_fusefs',` fs_search_fusefs(smbd_t) ') @@ -97906,7 +97991,7 @@ index 2b7c441e7..adf980ca1 100644 ') optional_policy(` -@@ -466,6 +499,7 @@ optional_policy(` +@@ -466,6 +500,7 @@ optional_policy(` optional_policy(` ctdbd_stream_connect(smbd_t) ctdbd_manage_lib_files(smbd_t) @@ -97914,7 +97999,7 @@ index 2b7c441e7..adf980ca1 100644 ') optional_policy(` -@@ -474,11 +508,31 @@ optional_policy(` +@@ -474,11 +509,31 @@ optional_policy(` ') optional_policy(` @@ -97946,7 +98031,7 @@ index 2b7c441e7..adf980ca1 100644 lpd_exec_lpr(smbd_t) ') -@@ -488,6 +542,10 @@ optional_policy(` +@@ -488,6 +543,10 @@ optional_policy(` ') optional_policy(` @@ -97957,7 +98042,7 @@ index 2b7c441e7..adf980ca1 100644 rpc_search_nfs_state_data(smbd_t) ') -@@ -499,12 +557,53 @@ optional_policy(` +@@ -499,12 +558,53 @@ optional_policy(` udev_read_db(smbd_t) ') @@ -98012,7 +98097,7 @@ index 2b7c441e7..adf980ca1 100644 allow nmbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow nmbd_t self:fd use; allow nmbd_t self:fifo_file rw_fifo_file_perms; -@@ -512,9 +611,11 @@ allow nmbd_t self:msg { send receive }; +@@ -512,9 +612,11 @@ allow nmbd_t self:msg { send receive }; allow nmbd_t self:msgq create_msgq_perms; allow nmbd_t self:sem create_sem_perms; allow nmbd_t self:shm create_shm_perms; @@ -98027,7 +98112,7 @@ index 2b7c441e7..adf980ca1 100644 manage_dirs_pattern(nmbd_t, { smbd_var_run_t nmbd_var_run_t }, nmbd_var_run_t) manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t) -@@ -526,20 +627,17 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) +@@ -526,20 +628,17 @@ read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t) manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t) @@ -98053,7 +98138,7 @@ index 2b7c441e7..adf980ca1 100644 kernel_getattr_core_if(nmbd_t) kernel_getattr_message_if(nmbd_t) -@@ -547,53 +645,44 @@ kernel_read_kernel_sysctls(nmbd_t) +@@ -547,53 +646,44 @@ kernel_read_kernel_sysctls(nmbd_t) kernel_read_network_state(nmbd_t) kernel_read_software_raid_state(nmbd_t) kernel_read_system_state(nmbd_t) @@ -98122,7 +98207,7 @@ index 2b7c441e7..adf980ca1 100644 ') optional_policy(` -@@ -606,18 +695,29 @@ optional_policy(` +@@ -606,18 +696,29 @@ optional_policy(` ######################################## # @@ -98158,7 +98243,7 @@ index 2b7c441e7..adf980ca1 100644 samba_read_config(smbcontrol_t) samba_search_var(smbcontrol_t) -@@ -627,39 +727,38 @@ domain_use_interactive_fds(smbcontrol_t) +@@ -627,39 +728,38 @@ domain_use_interactive_fds(smbcontrol_t) dev_read_urand(smbcontrol_t) @@ -98210,7 +98295,7 @@ index 2b7c441e7..adf980ca1 100644 allow smbmount_t samba_secrets_t:file manage_file_perms; -@@ -668,26 +767,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) +@@ -668,26 +768,22 @@ manage_files_pattern(smbmount_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t) files_var_filetrans(smbmount_t, samba_var_t, dir, "samba") @@ -98246,7 +98331,7 @@ index 2b7c441e7..adf980ca1 100644 fs_getattr_cifs(smbmount_t) fs_mount_cifs(smbmount_t) -@@ -699,58 +794,77 @@ fs_read_cifs_files(smbmount_t) +@@ -699,58 +795,77 @@ fs_read_cifs_files(smbmount_t) storage_raw_read_fixed_disk(smbmount_t) storage_raw_write_fixed_disk(smbmount_t) @@ -98339,7 +98424,7 @@ index 2b7c441e7..adf980ca1 100644 manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t) manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t) -@@ -759,17 +873,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) +@@ -759,17 +874,13 @@ files_tmp_filetrans(swat_t, swat_tmp_t, { file dir }) manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t) files_pid_filetrans(swat_t, swat_var_run_t, file) @@ -98363,7 +98448,7 @@ index 2b7c441e7..adf980ca1 100644 kernel_read_kernel_sysctls(swat_t) kernel_read_system_state(swat_t) -@@ -777,36 +887,25 @@ kernel_read_network_state(swat_t) +@@ -777,36 +888,25 @@ kernel_read_network_state(swat_t) corecmd_search_bin(swat_t) @@ -98406,7 +98491,7 @@ index 2b7c441e7..adf980ca1 100644 auth_domtrans_chk_passwd(swat_t) auth_use_nsswitch(swat_t) -@@ -818,10 +917,11 @@ logging_send_syslog_msg(swat_t) +@@ -818,10 +918,11 @@ logging_send_syslog_msg(swat_t) logging_send_audit_msgs(swat_t) logging_search_logs(swat_t) @@ -98420,7 +98505,7 @@ index 2b7c441e7..adf980ca1 100644 optional_policy(` cups_read_rw_config(swat_t) cups_stream_connect(swat_t) -@@ -840,17 +940,20 @@ optional_policy(` +@@ -840,17 +941,20 @@ optional_policy(` # Winbind local policy # @@ -98447,7 +98532,7 @@ index 2b7c441e7..adf980ca1 100644 allow winbind_t samba_etc_t:dir list_dir_perms; read_files_pattern(winbind_t, samba_etc_t, samba_etc_t) -@@ -860,9 +963,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) +@@ -860,9 +964,7 @@ manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t) filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file) manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t) @@ -98458,7 +98543,7 @@ index 2b7c441e7..adf980ca1 100644 manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t) manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t) -@@ -870,41 +971,46 @@ manage_files_pattern(winbind_t, samba_var_t, samba_var_t) +@@ -870,41 +972,46 @@ manage_files_pattern(winbind_t, samba_var_t, samba_var_t) manage_lnk_files_pattern(winbind_t, samba_var_t, samba_var_t) manage_sock_files_pattern(winbind_t, samba_var_t, samba_var_t) files_var_filetrans(winbind_t, samba_var_t, dir, "samba") @@ -98517,7 +98602,7 @@ index 2b7c441e7..adf980ca1 100644 corenet_tcp_connect_smbd_port(winbind_t) corenet_tcp_connect_epmap_port(winbind_t) corenet_tcp_connect_all_unreserved_ports(winbind_t) -@@ -912,38 +1018,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) +@@ -912,38 +1019,52 @@ corenet_tcp_connect_all_unreserved_ports(winbind_t) dev_read_sysfs(winbind_t) dev_read_urand(winbind_t) @@ -98576,7 +98661,7 @@ index 2b7c441e7..adf980ca1 100644 ') optional_policy(` -@@ -959,31 +1079,36 @@ optional_policy(` +@@ -959,31 +1080,36 @@ optional_policy(` # Winbind helper local policy # @@ -98620,7 +98705,7 @@ index 2b7c441e7..adf980ca1 100644 optional_policy(` apache_append_log(winbind_helper_t) -@@ -997,25 +1122,38 @@ optional_policy(` +@@ -997,25 +1123,38 @@ optional_policy(` ######################################## # @@ -104251,10 +104336,10 @@ index 000000000..88490d5c6 + diff --git a/snapper.te b/snapper.te new file mode 100644 -index 000000000..5c2cbe02d +index 000000000..3275f65cb --- /dev/null +++ b/snapper.te -@@ -0,0 +1,83 @@ +@@ -0,0 +1,85 @@ +policy_module(snapper, 1.0.0) + +######################################## @@ -104297,6 +104382,7 @@ index 000000000..5c2cbe02d +manage_dirs_pattern(snapperd_t, snapperd_data_t, snapperd_data_t) +manage_lnk_files_pattern(snapperd_t, snapperd_data_t, snapperd_data_t) +allow snapperd_t snapperd_data_t:dir mounton; ++allow snapperd_t snapperd_data_t:file relabelfrom; +snapper_filetrans_named_content(snapperd_t) + +domain_read_all_domains_state(snapperd_t) @@ -104310,6 +104396,7 @@ index 000000000..5c2cbe02d +files_relabelfrom_isid_type(snapperd_t) +files_read_all_files(snapperd_t) +files_list_all(snapperd_t) ++files_rmdir_all_dirs(snapperd_t) + +fs_getattr_all_fs(snapperd_t) + @@ -106696,7 +106783,7 @@ index 5e1f0534c..e7820bce3 100644 domain_system_change_exemption($1) role_transition $2 squid_initrc_exec_t system_r; diff --git a/squid.te b/squid.te -index 03472ed9b..9148ef5ae 100644 +index 03472ed9b..d230aff20 100644 --- a/squid.te +++ b/squid.te @@ -29,7 +29,7 @@ type squid_cache_t; @@ -106748,13 +106835,14 @@ index 03472ed9b..9148ef5ae 100644 allow squid_t squid_conf_t:dir list_dir_perms; allow squid_t squid_conf_t:file read_file_perms; -@@ -78,15 +86,18 @@ manage_files_pattern(squid_t, squid_log_t, squid_log_t) +@@ -78,15 +86,19 @@ manage_files_pattern(squid_t, squid_log_t, squid_log_t) manage_lnk_files_pattern(squid_t, squid_log_t, squid_log_t) logging_log_filetrans(squid_t, squid_log_t, { file dir }) +manage_files_pattern(squid_t, squid_tmpfs_t, squid_tmpfs_t) +manage_dirs_pattern(squid_t, squid_tmpfs_t, squid_tmpfs_t) +fs_tmpfs_filetrans(squid_t, squid_tmpfs_t, { dir file }) ++allow squid_t squid_tmpfs_t:file map; + manage_dirs_pattern(squid_t, squid_tmp_t, squid_tmp_t) manage_files_pattern(squid_t, squid_tmp_t, squid_tmp_t) @@ -106771,7 +106859,7 @@ index 03472ed9b..9148ef5ae 100644 can_exec(squid_t, squid_exec_t) -@@ -94,7 +105,6 @@ kernel_read_kernel_sysctls(squid_t) +@@ -94,7 +106,6 @@ kernel_read_kernel_sysctls(squid_t) kernel_read_system_state(squid_t) kernel_read_network_state(squid_t) @@ -106779,7 +106867,7 @@ index 03472ed9b..9148ef5ae 100644 corenet_all_recvfrom_netlabel(squid_t) corenet_tcp_sendrecv_generic_if(squid_t) corenet_udp_sendrecv_generic_if(squid_t) -@@ -132,6 +142,7 @@ corenet_tcp_sendrecv_gopher_port(squid_t) +@@ -132,6 +143,7 @@ corenet_tcp_sendrecv_gopher_port(squid_t) corenet_udp_sendrecv_gopher_port(squid_t) corenet_sendrecv_squid_server_packets(squid_t) @@ -106787,7 +106875,7 @@ index 03472ed9b..9148ef5ae 100644 corenet_tcp_bind_squid_port(squid_t) corenet_udp_bind_squid_port(squid_t) corenet_tcp_sendrecv_squid_port(squid_t) -@@ -154,7 +165,6 @@ dev_read_urand(squid_t) +@@ -154,7 +166,6 @@ dev_read_urand(squid_t) domain_use_interactive_fds(squid_t) files_read_etc_runtime_files(squid_t) @@ -106795,7 +106883,7 @@ index 03472ed9b..9148ef5ae 100644 files_search_spool(squid_t) files_dontaudit_getattr_tmp_dirs(squid_t) files_getattr_home_dir(squid_t) -@@ -176,7 +186,6 @@ libs_exec_lib_files(squid_t) +@@ -176,7 +187,6 @@ libs_exec_lib_files(squid_t) logging_send_syslog_msg(squid_t) miscfiles_read_generic_certs(squid_t) @@ -106803,7 +106891,7 @@ index 03472ed9b..9148ef5ae 100644 userdom_use_unpriv_users_fds(squid_t) userdom_dontaudit_search_user_home_dirs(squid_t) -@@ -197,28 +206,31 @@ tunable_policy(`squid_use_tproxy',` +@@ -197,28 +207,31 @@ tunable_policy(`squid_use_tproxy',` optional_policy(` apache_content_template(squid) @@ -106849,7 +106937,7 @@ index 03472ed9b..9148ef5ae 100644 ') optional_policy(` -@@ -236,3 +248,24 @@ optional_policy(` +@@ -236,3 +249,24 @@ optional_policy(` optional_policy(` udev_read_db(squid_t) ') @@ -111280,10 +111368,10 @@ index 000000000..115bf6c42 +/usr/lib/tumbler-?[^/]*/tumblerd -- gen_context(system_u:object_r:thumb_exec_t,s0) diff --git a/thumb.if b/thumb.if new file mode 100644 -index 000000000..9524b50aa +index 000000000..d371f62f6 --- /dev/null +++ b/thumb.if -@@ -0,0 +1,134 @@ +@@ -0,0 +1,153 @@ + +## policy for thumb + @@ -111307,6 +111395,24 @@ index 000000000..9524b50aa + dontaudit thumb_t $1:unix_stream_socket { getattr read write }; +') + ++######################################## ++## ++## NNP Transition to thumb. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`thumb_nnp_domtrans',` ++ gen_require(` ++ type thumb_t; ++ ') ++ ++ allow $1 thumb_t:process2 { nnp_transition nosuid_transition }; ++ ++') + +######################################## +## @@ -111330,6 +111436,7 @@ index 000000000..9524b50aa + ') + + thumb_domtrans($1) ++ thumb_nnp_domtrans($1) + role $2 types thumb_t; + + allow $1 thumb_t:process signal_perms; @@ -111420,10 +111527,10 @@ index 000000000..9524b50aa +') diff --git a/thumb.te b/thumb.te new file mode 100644 -index 000000000..d6affa561 +index 000000000..a34bf9b9f --- /dev/null +++ b/thumb.te -@@ -0,0 +1,173 @@ +@@ -0,0 +1,174 @@ +policy_module(thumb, 1.0.0) + +######################################## @@ -111573,6 +111680,7 @@ index 000000000..d6affa561 + gnome_manage_gstreamer_home_dirs(thumb_t) + gnome_exec_gstreamer_home_files(thumb_t) + gnome_create_generic_cache_dir(thumb_t) ++ gnome_setattr_cache_home_dir(thumb_t) + gnome_cache_filetrans(thumb_t, thumb_home_t, dir, "thumbnails") + gnome_cache_filetrans(thumb_t, thumb_home_t, file) +') diff --git a/selinux-policy.spec b/selinux-policy.spec index cf371c2..bf1086f 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 283.15%{?dist} +Release: 283.16%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -720,6 +720,39 @@ exit 0 %endif %changelog +* Thu Nov 16 2017 Lukas Vrabec - 3.13.1-283.16 +- Allow pcp_pmlogger to send logs to journal BZ(1512367) +- Allow services to use kerberos KCM BZ(1512128) +- Allow system_mail_t domain to be system_dbus_client BZ(1512476) +- Allow aide domain to stream connect to sssd_t BZ(1512500) +- Allow squid_t domain to mmap files with label squid_tmpfs_t BZ(1498809) +- Allow nsd_t domain to mmap files with labels nsd_tmp_t and nsd_zone_t BZ(1511269) +- Include cupsd_config_t domain into cups_execmem boolean. BZ(1417584) +- Allow samba_net_t domain to mmap samba_var_t files BZ(1512227) +- Allow lircd_t domain to execute shell BZ(1512787) +- Allow thumb_t domain to setattr on cache_home_t dirs BZ(1487814) +- Allow redis to creating tmp files with own label BZ(1513518) +- Create new interface thumb_nnp_domtrans allowing domaintransition with NoNewPrivs. This interface added to thumb_run() BZ(1509502) +- Allow httpd_t to mmap httpd_tmp_t files BZ(1502303) +- Add map permission to samba_rw_var_files interface. BZ(1513908) +- Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t +- Add dac_read_search and dac_override capabilities to ganesha +- Allow ldap_t domain to manage also slapd_tmp_t lnk files +- Allow snapperd_t domain to relabeling from snapperd_data_t BZ(1510584) +- Allow snapperd_t to remove old snaps BZ(1510862) +- Allow chkpwd_t domain to mmap system_db_t files and be dbus system client BZ(1513704) +- Allow xdm_t send signull to all xserver unconfined types BZ(1499390) +- Allow fs associate for sysctl_vm_t BZ(1447301) +- Label /etc/init.d/vboxdrv as bin_t to run virtualbox as unconfined_service_t BZ(1451479) +- Allow xdm_t domain to read usermodehelper_t state BZ(1412609) +- Allow dhcpc_t domain to stream connect to userdomain domains BZ(1511948) +- Allow systemd to mmap kernel modules BZ(1513399) +- Allow userdomains to mmap fifo_files BZ(1512242) +- Container runtimes are running iptables within a different user namespace +- Add map permission to init_domtrans() interface BZ(1513832) +- Allow xdm_t domain to mmap and execute files in xdm_var_run_t BZ(1513883) +- Add interface files_rmdir_all_dirs() + * Mon Nov 06 2017 Lukas Vrabec - 3.13.1-283.15 - Allow jabber domains to connect to postgresql ports - Dontaudit slapd_t to block suspend system