diff --git a/Changelog b/Changelog index 444c5b0..f32025a 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,4 @@ +- Merge restorecon into setfiles. - Patch to begin separating out hald helper programs from Dan Walsh. - Fixes for squid, dovecot, and snmp from Dan Walsh. - Miscellaneous consolekit fixes from Dan Walsh. diff --git a/policy/modules/admin/dpkg.te b/policy/modules/admin/dpkg.te index 5b506cf..932d12f 100644 --- a/policy/modules/admin/dpkg.te +++ b/policy/modules/admin/dpkg.te @@ -1,5 +1,5 @@ -policy_module(dpkg,1.1.0) +policy_module(dpkg,1.1.1) ######################################## # @@ -194,7 +194,7 @@ miscfiles_read_localization(dpkg_t) modutils_domtrans_depmod(dpkg_t) modutils_domtrans_insmod(dpkg_t) seutil_domtrans_loadpolicy(dpkg_t) -seutil_domtrans_restorecon(dpkg_t) +seutil_domtrans_setfiles(dpkg_t) userdom_use_all_users_fds(dpkg_t) optional_policy(` mta_send_mail(dpkg_t) @@ -304,7 +304,7 @@ modutils_domtrans_depmod(dpkg_script_t) modutils_domtrans_insmod(dpkg_script_t) seutil_domtrans_loadpolicy(dpkg_script_t) -seutil_domtrans_restorecon(dpkg_script_t) +seutil_domtrans_setfiles(dpkg_script_t) userdom_use_all_users_fds(dpkg_script_t) diff --git a/policy/modules/admin/rpm.if b/policy/modules/admin/rpm.if index 57fc54f..08d7809 100644 --- a/policy/modules/admin/rpm.if +++ b/policy/modules/admin/rpm.if @@ -74,7 +74,6 @@ interface(`rpm_run',` seutil_run_loadpolicy(rpm_script_t,$2,$3) seutil_run_semanage(rpm_script_t,$2,$3) seutil_run_setfiles(rpm_script_t,$2,$3) - seutil_run_restorecon(rpm_script_t,$2,$3) allow rpm_t $3:chr_file rw_term_perms; ') diff --git a/policy/modules/admin/rpm.te b/policy/modules/admin/rpm.te index d5b2e01..b1ccc1b 100644 --- a/policy/modules/admin/rpm.te +++ b/policy/modules/admin/rpm.te @@ -1,5 +1,5 @@ -policy_module(rpm,1.6.0) +policy_module(rpm,1.6.1) ######################################## # @@ -325,7 +325,7 @@ modutils_domtrans_depmod(rpm_script_t) modutils_domtrans_insmod(rpm_script_t) seutil_domtrans_loadpolicy(rpm_script_t) -seutil_domtrans_restorecon(rpm_script_t) +seutil_domtrans_setfiles(rpm_script_t) seutil_domtrans_semanage(rpm_script_t) userdom_use_all_users_fds(rpm_script_t) diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te index 9793065..b653656 100644 --- a/policy/modules/admin/usermanage.te +++ b/policy/modules/admin/usermanage.te @@ -1,5 +1,5 @@ -policy_module(usermanage,1.6.0) +policy_module(usermanage,1.6.1) ######################################## # @@ -507,7 +507,7 @@ seutil_read_config(useradd_t) seutil_read_file_contexts(useradd_t) seutil_read_default_contexts(useradd_t) seutil_domtrans_semanage(useradd_t) -seutil_domtrans_restorecon(useradd_t) +seutil_domtrans_setfiles(useradd_t) userdom_use_unpriv_users_fds(useradd_t) # for when /root is the cwd diff --git a/policy/modules/services/cron.te b/policy/modules/services/cron.te index 82160f8..74293df 100644 --- a/policy/modules/services/cron.te +++ b/policy/modules/services/cron.te @@ -1,5 +1,5 @@ -policy_module(cron,1.6.0) +policy_module(cron,1.6.1) gen_require(` class passwd rootok; @@ -394,7 +394,6 @@ ifdef(`targeted_policy',` tunable_policy(`cron_can_relabel',` seutil_domtrans_setfiles(system_crond_t) - seutil_domtrans_restorecon(system_crond_t) ',` selinux_get_fs_mount(system_crond_t) selinux_validate_context(system_crond_t) diff --git a/policy/modules/system/selinuxutil.fc b/policy/modules/system/selinuxutil.fc index abd65da..2cc4bda 100644 --- a/policy/modules/system/selinuxutil.fc +++ b/policy/modules/system/selinuxutil.fc @@ -23,7 +23,7 @@ # /sbin # /sbin/load_policy -- gen_context(system_u:object_r:load_policy_exec_t,s0) -/sbin/restorecon -- gen_context(system_u:object_r:restorecon_exec_t,s0) +/sbin/restorecon -- gen_context(system_u:object_r:setfiles_exec_t,s0) /sbin/setfiles.* -- gen_context(system_u:object_r:setfiles_exec_t,s0) # diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if index 0dcc740..811178a 100644 --- a/policy/modules/system/selinuxutil.if +++ b/policy/modules/system/selinuxutil.if @@ -294,7 +294,7 @@ interface(`seutil_use_newrole_fds',` ####################################### ## -## Execute restorecon in the restorecon domain. +## Execute restorecon in the restorecon domain. (Deprecated) ## ## ## @@ -303,19 +303,15 @@ interface(`seutil_use_newrole_fds',` ## # interface(`seutil_domtrans_restorecon',` - gen_require(` - type restorecon_t, restorecon_exec_t; - ') - - corecmd_search_bin($1) - domtrans_pattern($1,restorecon_exec_t,restorecon_t) + refpolicywarn(`$0($*) has been deprecated, please use seutil_domtrans_setfiles() instead.') + seutil_domtrans_setfiles($1) ') ######################################## ## ## Execute restorecon in the restorecon domain, and ## allow the specified role the restorecon domain, -## and use the caller's terminal. +## and use the caller's terminal. (Deprecated) ## ## ## @@ -335,18 +331,13 @@ interface(`seutil_domtrans_restorecon',` ## # interface(`seutil_run_restorecon',` - gen_require(` - type restorecon_t; - ') - - seutil_domtrans_restorecon($1) - role $2 types restorecon_t; - allow restorecon_t $3:chr_file rw_term_perms; + refpolicywarn(`$0($*) has been deprecated, please use seutil_run_setfiles() instead.') + seutil_run_setfiles($1,$2,$3) ') ######################################## ## -## Execute restorecon in the caller domain. +## Execute restorecon in the caller domain. (Deprecated) ## ## ## @@ -356,12 +347,8 @@ interface(`seutil_run_restorecon',` ## # interface(`seutil_exec_restorecon',` - gen_require(` - type restorecon_t, restorecon_exec_t; - ') - - corecmd_search_bin($1) - can_exec($1,restorecon_exec_t) + refpolicywarn(`$0($*) has been deprecated, please use seutil_exec_setfiles() instead.') + seutil_exec_setfiles($1) ') ######################################## diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te index 8c407c8..1f3c402 100644 --- a/policy/modules/system/selinuxutil.te +++ b/policy/modules/system/selinuxutil.te @@ -1,5 +1,5 @@ -policy_module(selinuxutil,1.5.0) +policy_module(selinuxutil,1.5.1) ifdef(`strict_policy',` gen_require(` @@ -79,12 +79,6 @@ neverallow ~can_relabelto_binary_policy policy_config_t:file relabelto; type policy_src_t; files_type(policy_src_t) -type restorecon_t, can_relabelto_binary_policy; -type restorecon_exec_t; -domain_obj_id_change_exemption(restorecon_t) -init_system_domain(restorecon_t,restorecon_exec_t) -role system_r types restorecon_t; - type restorecond_t; type restorecond_exec_t; init_daemon_domain(restorecond_t,restorecond_exec_t) @@ -120,13 +114,10 @@ files_tmp_file(semanage_tmp_t) type semanage_trans_lock_t; files_type(semanage_trans_lock_t) -type setfiles_t, can_relabelto_binary_policy; +type setfiles_t alias restorecon_t, can_relabelto_binary_policy; +type setfiles_exec_t alias restorecon_exec_t; +init_system_domain(setfiles_t,setfiles_exec_t) domain_obj_id_change_exemption(setfiles_t) -domain_type(setfiles_t) -role system_r types setfiles_t; - -type setfiles_exec_t; -domain_entry_file(setfiles_t,setfiles_exec_t) ifdef(`distro_redhat',` init_system_domain(setfiles_t,setfiles_exec_t) @@ -334,100 +325,6 @@ optional_policy(` ######################################## # -# Restorecon local policy -# - -allow restorecon_t self:capability { dac_override dac_read_search fowner }; -dontaudit restorecon_t self:capability sys_tty_config; -allow restorecon_t self:fifo_file rw_fifo_file_perms; - -allow restorecon_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:dir r_dir_perms; -allow restorecon_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:file r_file_perms; -allow restorecon_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:lnk_file r_file_perms; - -kernel_use_fds(restorecon_t) -kernel_rw_pipes(restorecon_t) -kernel_read_system_state(restorecon_t) -kernel_rw_unix_dgram_sockets(restorecon_t) -kernel_relabelfrom_unlabeled_dirs(restorecon_t) -kernel_relabelfrom_unlabeled_files(restorecon_t) -kernel_relabelfrom_unlabeled_symlinks(restorecon_t) -kernel_relabelfrom_unlabeled_pipes(restorecon_t) -kernel_relabelfrom_unlabeled_sockets(restorecon_t) -kernel_dontaudit_list_all_proc(restorecon_t) -kernel_dontaudit_list_all_sysctls(restorecon_t) - -dev_relabel_all_dev_nodes(restorecon_t) -# cjp: why is this needed? -dev_rw_generic_files(restorecon_t) - -fs_getattr_xattr_fs(restorecon_t) -fs_search_auto_mountpoints(restorecon_t) -fs_getattr_all_dirs(restorecon_t) - -mls_file_read_up(restorecon_t) -mls_file_write_down(restorecon_t) -mls_file_upgrade(restorecon_t) -mls_file_downgrade(restorecon_t) - -selinux_get_fs_mount(restorecon_t) -selinux_validate_context(restorecon_t) -selinux_compute_access_vector(restorecon_t) -selinux_compute_create_context(restorecon_t) -selinux_compute_relabel_context(restorecon_t) -selinux_compute_user_contexts(restorecon_t) - -term_use_unallocated_ttys(restorecon_t) -term_use_all_user_ttys(restorecon_t) -term_use_all_user_ptys(restorecon_t) - -init_use_fds(restorecon_t) -init_use_script_ptys(restorecon_t) - -domain_use_interactive_fds(restorecon_t) -domain_dontaudit_search_all_domains_state(restorecon_t) - -files_read_etc_runtime_files(restorecon_t) -files_read_etc_files(restorecon_t) - -libs_use_ld_so(restorecon_t) -libs_use_shared_libs(restorecon_t) - -logging_send_syslog_msg(restorecon_t) - -userdom_use_all_users_fds(restorecon_t) - -files_relabel_all_files(restorecon_t) -fs_relabelfrom_noxattr_fs(restorecon_t) - -files_list_all(restorecon_t) -# this is to satisfy the assertion: -auth_relabelto_shadow(restorecon_t) - -ifdef(`distro_redhat', ` - fs_rw_tmpfs_chr_files(restorecon_t) - fs_rw_tmpfs_blk_files(restorecon_t) - fs_relabel_tmpfs_blk_file(restorecon_t) - fs_relabel_tmpfs_chr_file(restorecon_t) -') - -ifdef(`hide_broken_symptoms',` - optional_policy(` - udev_dontaudit_rw_dgram_sockets(restorecon_t) - ') - - optional_policy(` - unconfined_dontaudit_rw_pipes(restorecon_t) - unconfined_dontaudit_rw_tcp_sockets(restorecon_t) - ') -') - -optional_policy(` - hotplug_use_fds(restorecon_t) -') - -######################################## -# # Restorecond local policy # @@ -636,6 +533,7 @@ ifdef(`enable_mls',` # allow setfiles_t self:capability { dac_override dac_read_search fowner }; +dontaudit setfiles_t self:capability sys_tty_config; allow setfiles_t self:fifo_file rw_file_perms; allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:dir r_dir_perms; @@ -648,11 +546,18 @@ kernel_relabelfrom_unlabeled_files(setfiles_t) kernel_relabelfrom_unlabeled_symlinks(setfiles_t) kernel_relabelfrom_unlabeled_pipes(setfiles_t) kernel_relabelfrom_unlabeled_sockets(setfiles_t) +kernel_use_fds(setfiles_t) +kernel_rw_pipes(setfiles_t) +kernel_rw_unix_dgram_sockets(setfiles_t) +kernel_dontaudit_list_all_proc(setfiles_t) +kernel_dontaudit_list_all_sysctls(setfiles_t) dev_relabel_all_dev_nodes(setfiles_t) fs_getattr_xattr_fs(setfiles_t) fs_list_all(setfiles_t) +fs_search_auto_mountpoints(setfiles_t) +fs_relabelfrom_noxattr_fs(setfiles_t) mls_file_read_up(setfiles_t) mls_file_write_down(setfiles_t) @@ -679,6 +584,7 @@ init_use_script_ptys(setfiles_t) init_exec_script_files(setfiles_t) domain_use_interactive_fds(setfiles_t) +domain_dontaudit_search_all_domains_state(setfiles_t) libs_use_ld_so(setfiles_t) libs_use_shared_libs(setfiles_t) @@ -687,7 +593,6 @@ files_read_etc_runtime_files(setfiles_t) files_read_etc_files(setfiles_t) files_list_all(setfiles_t) files_relabel_all_files(setfiles_t) -fs_relabelfrom_noxattr_fs(setfiles_t) logging_send_syslog_msg(setfiles_t) @@ -697,9 +602,25 @@ userdom_use_all_users_fds(setfiles_t) # for config files in a home directory userdom_read_all_users_home_content_files(setfiles_t) +ifdef(`distro_redhat', ` + fs_rw_tmpfs_chr_files(setfiles_t) + fs_rw_tmpfs_blk_files(setfiles_t) + fs_relabel_tmpfs_blk_file(setfiles_t) + fs_relabel_tmpfs_chr_file(setfiles_t) +') + ifdef(`hide_broken_symptoms',` + optional_policy(` + udev_dontaudit_rw_dgram_sockets(setfiles_t) + ') + # cjp: cover up stray file descriptors. optional_policy(` unconfined_dontaudit_read_pipes(setfiles_t) + unconfined_dontaudit_rw_tcp_sockets(setfiles_t) ') ') + +optional_policy(` + hotplug_use_fds(setfiles_t) +') diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te index ec06e56..67d1a06 100644 --- a/policy/modules/system/udev.te +++ b/policy/modules/system/udev.te @@ -1,5 +1,5 @@ -policy_module(udev,1.6.0) +policy_module(udev,1.6.1) ######################################## # @@ -140,7 +140,7 @@ modutils_read_module_deps(udev_t) seutil_read_config(udev_t) seutil_read_default_contexts(udev_t) seutil_read_file_contexts(udev_t) -seutil_domtrans_restorecon(udev_t) +seutil_domtrans_setfiles(udev_t) sysnet_domtrans_ifconfig(udev_t) sysnet_domtrans_dhcpc(udev_t) diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te index 243a902..4e4d2e9 100644 --- a/policy/modules/system/unconfined.te +++ b/policy/modules/system/unconfined.te @@ -1,5 +1,5 @@ -policy_module(unconfined,1.6.0) +policy_module(unconfined,1.6.1) ######################################## # @@ -44,7 +44,7 @@ ifdef(`targeted_policy',` mount_domtrans_unconfined(unconfined_t) - seutil_domtrans_restorecon(unconfined_t) + seutil_domtrans_setfiles(unconfined_t) seutil_domtrans_semanage(unconfined_t) userdom_unconfined(unconfined_t) diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index d600bd2..60f6fd8 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -1304,7 +1304,6 @@ template(`userdom_security_admin_template',` seutil_run_loadpolicy($1,$2,$3) seutil_run_semanage($1,$2,$3) seutil_run_setfiles($1, $2, $3) - seutil_run_restorecon($1,$2,$3) userdom_dontaudit_append_staff_home_content_files($1) userdom_dontaudit_read_sysadm_home_content_files($1) diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te index 1b42df9..1ad652d 100644 --- a/policy/modules/system/userdomain.te +++ b/policy/modules/system/userdomain.te @@ -1,5 +1,5 @@ -policy_module(userdomain,2.2.1) +policy_module(userdomain,2.2.2) gen_require(` role sysadm_r, staff_r, user_r; @@ -447,7 +447,7 @@ ifdef(`strict_policy',` ') optional_policy(` - seutil_run_restorecon(sysadm_t,sysadm_r,admin_terminal) + seutil_run_setfiles(sysadm_t,sysadm_r,admin_terminal) seutil_run_runinit(sysadm_t,sysadm_r,admin_terminal) ifdef(`enable_mls',`