diff --git a/docker-selinux.tgz b/docker-selinux.tgz index 53d3064..9b3e5ae 100644 Binary files a/docker-selinux.tgz and b/docker-selinux.tgz differ diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index eae8615..ddf081b 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -1279,7 +1279,7 @@ index 216b3d1..064ec83 100644 + ') dnl end enable_mcs diff --git a/policy/mls b/policy/mls -index f11e5e2..2d2ab83 100644 +index f11e5e2..464a121 100644 --- a/policy/mls +++ b/policy/mls @@ -156,15 +156,12 @@ mlsconstrain filesystem { mount remount unmount relabelfrom quotamod } @@ -1345,6 +1345,32 @@ index f11e5e2..2d2ab83 100644 # # MLS policy for the process class # +@@ -763,13 +763,14 @@ mlsconstrain context contains + # + + # make sure these database classes are "single level" +-mlsconstrain { db_database db_schema db_table db_sequence db_view db_procedure db_language db_column db_blob } { create relabelto } ++mlsconstrain { db_sequence db_view db_procedure db_language db_blob } { create relabelto } + ( l2 eq h2 ); ++ + mlsconstrain { db_tuple } { insert relabelto } + ( l2 eq h2 ); + + # new database labels must be dominated by the relabeling subjects clearance +-mlsconstrain { db_database db_schema db_table db_sequence db_view db_procedure db_language db_column db_tuple db_blob } { relabelto } ++mlsconstrain { db_database db_schema db_table db_column } { relabelto } + ( h1 dom h2 ); + + # the database "read" ops (note the check is dominance of the low level) +@@ -833,7 +834,7 @@ mlsconstrain { db_tuple } { use select } + ( t1 == mlsdbread ) or + ( t2 == mlstrustedobject )); + +-# the "single level" file "write" ops ++# the "single level" database "write" ops + mlsconstrain { db_database } { create drop setattr relabelfrom install_module load_module set_param } + (( l1 eq l2 ) or + (( t1 == mlsdbwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or diff --git a/policy/modules/admin/bootloader.fc b/policy/modules/admin/bootloader.fc index 2626ebf..5745bb2 100644 --- a/policy/modules/admin/bootloader.fc @@ -31047,7 +31073,7 @@ index 6bf0ecc..e6be63a 100644 +') + diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te -index 8b40377..fe6657c 100644 +index 8b40377..5d9d50d 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -26,28 +26,66 @@ gen_require(` @@ -31641,7 +31667,7 @@ index 8b40377..fe6657c 100644 storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t) -@@ -442,28 +643,45 @@ storage_dontaudit_raw_read_removable_device(xdm_t) +@@ -442,28 +643,46 @@ storage_dontaudit_raw_read_removable_device(xdm_t) storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t) @@ -31688,10 +31714,11 @@ index 8b40377..fe6657c 100644 +systemd_dbus_chat_localed(xdm_t) +systemd_dbus_chat_hostnamed(xdm_t) +systemd_start_power_services(xdm_t) ++systemd_status_power_services(xdm_t) userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_create_all_users_keys(xdm_t) -@@ -472,24 +690,163 @@ userdom_read_user_home_content_files(xdm_t) +@@ -472,24 +691,163 @@ userdom_read_user_home_content_files(xdm_t) # Search /proc for any user domain processes. userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) @@ -31861,7 +31888,7 @@ index 8b40377..fe6657c 100644 tunable_policy(`xdm_sysadm_login',` userdom_xsession_spec_domtrans_all_users(xdm_t) # FIXME: -@@ -502,12 +859,31 @@ tunable_policy(`xdm_sysadm_login',` +@@ -502,12 +860,31 @@ tunable_policy(`xdm_sysadm_login',` # allow xserver_t xdm_tmpfs_t:file rw_file_perms; ') @@ -31893,7 +31920,7 @@ index 8b40377..fe6657c 100644 ') optional_policy(` -@@ -518,8 +894,36 @@ optional_policy(` +@@ -518,8 +895,36 @@ optional_policy(` dbus_system_bus_client(xdm_t) dbus_connect_system_bus(xdm_t) @@ -31931,7 +31958,7 @@ index 8b40377..fe6657c 100644 ') ') -@@ -530,6 +934,20 @@ optional_policy(` +@@ -530,6 +935,20 @@ optional_policy(` ') optional_policy(` @@ -31952,7 +31979,7 @@ index 8b40377..fe6657c 100644 hostname_exec(xdm_t) ') -@@ -547,28 +965,78 @@ optional_policy(` +@@ -547,28 +966,78 @@ optional_policy(` ') optional_policy(` @@ -32040,7 +32067,7 @@ index 8b40377..fe6657c 100644 ') optional_policy(` -@@ -580,6 +1048,14 @@ optional_policy(` +@@ -580,6 +1049,14 @@ optional_policy(` ') optional_policy(` @@ -32055,7 +32082,7 @@ index 8b40377..fe6657c 100644 xfs_stream_connect(xdm_t) ') -@@ -594,7 +1070,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t; +@@ -594,7 +1071,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t; type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t; allow xserver_t { root_xdrawable_t x_domain }:x_drawable send; @@ -32064,7 +32091,7 @@ index 8b40377..fe6657c 100644 # setuid/setgid for the wrapper program to change UID # sys_rawio is for iopl access - should not be needed for frame-buffer -@@ -604,8 +1080,11 @@ allow xserver_t input_xevent_t:x_event send; +@@ -604,8 +1081,11 @@ allow xserver_t input_xevent_t:x_event send; # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack @@ -32077,7 +32104,7 @@ index 8b40377..fe6657c 100644 allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow xserver_t self:fd use; allow xserver_t self:fifo_file rw_fifo_file_perms; -@@ -618,8 +1097,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; +@@ -618,8 +1098,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:udp_socket create_socket_perms; @@ -32093,7 +32120,7 @@ index 8b40377..fe6657c 100644 manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) -@@ -627,6 +1113,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) +@@ -627,6 +1114,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file) @@ -32104,7 +32131,7 @@ index 8b40377..fe6657c 100644 manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) -@@ -638,25 +1128,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) +@@ -638,25 +1129,37 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) files_search_var_lib(xserver_t) @@ -32146,7 +32173,7 @@ index 8b40377..fe6657c 100644 corenet_all_recvfrom_netlabel(xserver_t) corenet_tcp_sendrecv_generic_if(xserver_t) corenet_udp_sendrecv_generic_if(xserver_t) -@@ -677,23 +1179,28 @@ dev_rw_apm_bios(xserver_t) +@@ -677,23 +1180,28 @@ dev_rw_apm_bios(xserver_t) dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) @@ -32178,7 +32205,7 @@ index 8b40377..fe6657c 100644 # brought on by rhgb files_search_mnt(xserver_t) -@@ -705,6 +1212,14 @@ fs_search_nfs(xserver_t) +@@ -705,6 +1213,14 @@ fs_search_nfs(xserver_t) fs_search_auto_mountpoints(xserver_t) fs_search_ramfs(xserver_t) @@ -32193,7 +32220,7 @@ index 8b40377..fe6657c 100644 mls_xwin_read_to_clearance(xserver_t) selinux_validate_context(xserver_t) -@@ -718,20 +1233,18 @@ init_getpgid(xserver_t) +@@ -718,20 +1234,18 @@ init_getpgid(xserver_t) term_setattr_unallocated_ttys(xserver_t) term_use_unallocated_ttys(xserver_t) @@ -32217,7 +32244,7 @@ index 8b40377..fe6657c 100644 userdom_search_user_home_dirs(xserver_t) userdom_use_user_ttys(xserver_t) -@@ -739,8 +1252,6 @@ userdom_setattr_user_ttys(xserver_t) +@@ -739,8 +1253,6 @@ userdom_setattr_user_ttys(xserver_t) userdom_read_user_tmp_files(xserver_t) userdom_rw_user_tmpfs_files(xserver_t) @@ -32226,7 +32253,7 @@ index 8b40377..fe6657c 100644 ifndef(`distro_redhat',` allow xserver_t self:process { execmem execheap execstack }; domain_mmap_low_uncond(xserver_t) -@@ -785,17 +1296,54 @@ optional_policy(` +@@ -785,17 +1297,54 @@ optional_policy(` ') optional_policy(` @@ -32283,7 +32310,7 @@ index 8b40377..fe6657c 100644 ') optional_policy(` -@@ -803,6 +1351,10 @@ optional_policy(` +@@ -803,6 +1352,10 @@ optional_policy(` ') optional_policy(` @@ -32294,7 +32321,7 @@ index 8b40377..fe6657c 100644 xfs_stream_connect(xserver_t) ') -@@ -818,18 +1370,17 @@ allow xserver_t xdm_t:shm rw_shm_perms; +@@ -818,18 +1371,17 @@ allow xserver_t xdm_t:shm rw_shm_perms; # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open # handle of a file inside the dir!!! @@ -32319,7 +32346,7 @@ index 8b40377..fe6657c 100644 can_exec(xserver_t, xkb_var_lib_t) # VNC v4 module in X server -@@ -842,26 +1393,21 @@ init_use_fds(xserver_t) +@@ -842,26 +1394,21 @@ init_use_fds(xserver_t) # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_user_home_content_files(xserver_t) @@ -32354,7 +32381,7 @@ index 8b40377..fe6657c 100644 ') optional_policy(` -@@ -912,7 +1458,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy +@@ -912,7 +1459,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show }; # operations allowed on my windows allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; @@ -32363,7 +32390,7 @@ index 8b40377..fe6657c 100644 # operations allowed on all windows allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child }; -@@ -966,11 +1512,31 @@ allow x_domain self:x_resource { read write }; +@@ -966,11 +1513,31 @@ allow x_domain self:x_resource { read write }; # can mess with the screensaver allow x_domain xserver_t:x_screen { getattr saver_getattr }; @@ -32395,7 +32422,7 @@ index 8b40377..fe6657c 100644 tunable_policy(`! xserver_object_manager',` # should be xserver_unconfined(x_domain), # but typeattribute doesnt work in conditionals -@@ -992,18 +1558,148 @@ tunable_policy(`! xserver_object_manager',` +@@ -992,18 +1559,148 @@ tunable_policy(`! xserver_object_manager',` allow x_domain xevent_type:{ x_event x_synthetic_event } *; ') diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index 5a0637c..2d560ab 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -5451,7 +5451,7 @@ index f6eb485..ce5dba7 100644 + ps_process_pattern(httpd_t, $1) ') diff --git a/apache.te b/apache.te -index 6649962..84717e1 100644 +index 6649962..4cb64e5 100644 --- a/apache.te +++ b/apache.te @@ -5,280 +5,346 @@ policy_module(apache, 2.7.2) @@ -6235,7 +6235,7 @@ index 6649962..84717e1 100644 fs_read_iso9660_files(httpd_t) -fs_search_auto_mountpoints(httpd_t) +fs_rw_anon_inodefs_files(httpd_t) -+fs_read_hugetlbfs_files(httpd_t) ++fs_rw_hugetlbfs_files(httpd_t) + +auth_use_nsswitch(httpd_t) + @@ -66071,7 +66071,7 @@ index 9b15730..cb00f20 100644 + ') ') diff --git a/openvswitch.te b/openvswitch.te -index 44dbc99..ede6e1c 100644 +index 44dbc99..370dd38 100644 --- a/openvswitch.te +++ b/openvswitch.te @@ -9,11 +9,8 @@ type openvswitch_t; @@ -66103,9 +66103,9 @@ index 44dbc99..ede6e1c 100644 -allow openvswitch_t self:capability { net_admin sys_nice sys_resource ipc_lock }; -allow openvswitch_t self:process { setrlimit setsched signal }; -+allow openvswitch_t self:capability { net_admin ipc_lock sys_module sys_nice sys_rawio sys_resource }; ++allow openvswitch_t self:capability { net_admin ipc_lock sys_module sys_nice sys_rawio sys_resource chown setgid setpcap setuid }; +allow openvswitch_t self:capability2 block_suspend; -+allow openvswitch_t self:process { fork setsched setrlimit signal }; ++allow openvswitch_t self:process { fork setsched setrlimit signal setcap }; allow openvswitch_t self:fifo_file rw_fifo_file_perms; -allow openvswitch_t self:rawip_socket create_socket_perms; -allow openvswitch_t self:unix_stream_socket { accept connectto listen }; @@ -66137,12 +66137,15 @@ index 44dbc99..ede6e1c 100644 manage_lnk_files_pattern(openvswitch_t, openvswitch_log_t, openvswitch_log_t) logging_log_filetrans(openvswitch_t, openvswitch_log_t, { dir file lnk_file }) -@@ -65,33 +69,49 @@ manage_sock_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_ +@@ -63,35 +67,51 @@ manage_dirs_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t) + manage_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t) + manage_sock_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t) manage_lnk_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t) - files_pid_filetrans(openvswitch_t, openvswitch_var_run_t, { dir file lnk_file }) - --can_exec(openvswitch_t, openvswitch_exec_t) +-files_pid_filetrans(openvswitch_t, openvswitch_var_run_t, { dir file lnk_file }) - +-can_exec(openvswitch_t, openvswitch_exec_t) ++files_pid_filetrans(openvswitch_t, openvswitch_var_run_t, { dir file lnk_file sock_file }) + +kernel_load_module(openvswitch_t) kernel_read_network_state(openvswitch_t) kernel_read_system_state(openvswitch_t) diff --git a/selinux-policy.spec b/selinux-policy.spec index a06746b..94b2f6c 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 184%{?dist} +Release: 185%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -653,6 +653,12 @@ exit 0 %endif %changelog +* Wed Apr 27 2016 Lukas Vrabec 3.13.1-185 +- Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs. +- Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap. BZ(1330895) +- Allow KDM to get status about power services. This change allow kdm to be able do shutdown BZ(1330970) +- Add mls support for some db classes + * Tue Apr 26 2016 Lukas Vrabec 3.13.1-184 - Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits. - Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content Resolves: rhbz#1330448