diff --git a/policy-f20-base.patch b/policy-f20-base.patch index adf837b..d0bca17 100644 --- a/policy-f20-base.patch +++ b/policy-f20-base.patch @@ -3452,7 +3452,7 @@ index 7590165..85186a9 100644 + fs_mounton_fusefs(seunshare_domain) ') diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc -index 644d4d7..ad789c2 100644 +index 644d4d7..6f006ec 100644 --- a/policy/modules/kernel/corecommands.fc +++ b/policy/modules/kernel/corecommands.fc @@ -1,9 +1,10 @@ @@ -3686,7 +3686,15 @@ index 644d4d7..ad789c2 100644 /usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/sbin/smrsh -- gen_context(system_u:object_r:shell_exec_t,s0) -@@ -276,10 +332,15 @@ ifdef(`distro_gentoo',` +@@ -269,6 +325,7 @@ ifdef(`distro_gentoo',` + /usr/share/ajaxterm/qweb.py.* -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/apr-0/build/[^/]+\.sh -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/apr-0/build/libtool -- gen_context(system_u:object_r:bin_t,s0) ++/usr/share/conman/exec/.*\.exp -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/dayplanner/dayplanner -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/debconf/.+ -- gen_context(system_u:object_r:bin_t,s0) + /usr/share/denyhosts/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0) +@@ -276,10 +333,15 @@ ifdef(`distro_gentoo',` /usr/share/cluster/.*\.sh gen_context(system_u:object_r:bin_t,s0) /usr/share/cluster/ocf-shellfuncs -- gen_context(system_u:object_r:bin_t,s0) /usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0) @@ -3702,7 +3710,7 @@ index 644d4d7..ad789c2 100644 /usr/share/gnucash/finance-quote-check -- gen_context(system_u:object_r:bin_t,s0) /usr/share/gnucash/finance-quote-helper -- gen_context(system_u:object_r:bin_t,s0) /usr/share/hal/device-manager/hal-device-manager -- gen_context(system_u:object_r:bin_t,s0) -@@ -294,16 +355,22 @@ ifdef(`distro_gentoo',` +@@ -294,16 +356,22 @@ ifdef(`distro_gentoo',` /usr/share/selinux/devel/policygentool -- gen_context(system_u:object_r:bin_t,s0) /usr/share/smolt/client(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall/compiler\.pl -- gen_context(system_u:object_r:bin_t,s0) @@ -3727,7 +3735,7 @@ index 644d4d7..ad789c2 100644 ifdef(`distro_debian',` /usr/lib/ConsoleKit/.* -- gen_context(system_u:object_r:bin_t,s0) -@@ -321,20 +388,27 @@ ifdef(`distro_redhat', ` +@@ -321,20 +389,27 @@ ifdef(`distro_redhat', ` /etc/gdm/[^/]+ -d gen_context(system_u:object_r:bin_t,s0) /etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0) @@ -3756,7 +3764,7 @@ index 644d4d7..ad789c2 100644 /usr/share/pwlib/make/ptlib-config -- gen_context(system_u:object_r:bin_t,s0) /usr/share/pydict/pydict\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/rhn/rhn_applet/applet\.py -- gen_context(system_u:object_r:bin_t,s0) -@@ -342,6 +416,7 @@ ifdef(`distro_redhat', ` +@@ -342,6 +417,7 @@ ifdef(`distro_redhat', ` /usr/share/ssl/misc(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/switchdesk/switchdesk-gui\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-date/system-config-date\.py -- gen_context(system_u:object_r:bin_t,s0) @@ -3764,7 +3772,7 @@ index 644d4d7..ad789c2 100644 /usr/share/system-config-selinux/polgen\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-selinux/system-config-selinux\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-display/system-config-display -- gen_context(system_u:object_r:bin_t,s0) -@@ -383,11 +458,16 @@ ifdef(`distro_suse', ` +@@ -383,11 +459,16 @@ ifdef(`distro_suse', ` # # /var # @@ -3782,7 +3790,7 @@ index 644d4d7..ad789c2 100644 /usr/lib/yp/.+ -- gen_context(system_u:object_r:bin_t,s0) /var/qmail/bin -d gen_context(system_u:object_r:bin_t,s0) -@@ -397,3 +477,12 @@ ifdef(`distro_suse', ` +@@ -397,3 +478,12 @@ ifdef(`distro_suse', ` ifdef(`distro_suse',` /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) ') @@ -5638,7 +5646,7 @@ index 8e0f9cd..b9f45b9 100644 define(`create_packet_interfaces',`` diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in -index 4edc40d..421e8b1 100644 +index 4edc40d..40073cb 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -5,6 +5,7 @@ policy_module(corenetwork, 1.18.4) @@ -5898,7 +5906,7 @@ index 4edc40d..421e8b1 100644 network_port(portmap, udp,111,s0, tcp,111,s0) network_port(postfix_policyd, tcp,10031,s0) network_port(postgresql, tcp,5432,s0) -@@ -214,64 +269,73 @@ network_port(prelude, tcp,4690,s0, udp,4690,s0) +@@ -214,64 +269,74 @@ network_port(prelude, tcp,4690,s0, udp,4690,s0) network_port(presence, tcp,5298-5299,s0, udp,5298-5299,s0) network_port(printer, tcp,515,s0) network_port(ptal, tcp,5703,s0) @@ -5953,6 +5961,7 @@ index 4edc40d..421e8b1 100644 network_port(svn, tcp,3690,s0, udp,3690,s0) network_port(svrloc, tcp,427,s0, udp,427,s0) network_port(swat, tcp,901,s0) ++network_port(swift, tcp,6200-6203,s0) network_port(sype_transport, tcp,9911,s0, udp,9911,s0) -network_port(syslogd, udp,514,s0) +network_port(syslogd, udp,514,s0, udp,601,s0, tcp,601,s0) @@ -5983,7 +5992,7 @@ index 4edc40d..421e8b1 100644 network_port(winshadow, tcp,3161,s0, udp,3261,s0) network_port(wsdapi, tcp,5357,s0, udp,5357,s0) network_port(wsicopy, tcp,3378,s0, udp,3378,s0) -@@ -285,19 +349,23 @@ network_port(zabbix_agent, tcp,10050,s0) +@@ -285,19 +350,23 @@ network_port(zabbix_agent, tcp,10050,s0) network_port(zookeeper_client, tcp,2181,s0) network_port(zookeeper_election, tcp,3888,s0) network_port(zookeeper_leader, tcp,2888,s0) @@ -6010,7 +6019,7 @@ index 4edc40d..421e8b1 100644 ######################################## # -@@ -330,6 +398,8 @@ sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh) +@@ -330,6 +399,8 @@ sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh) build_option(`enable_mls',` network_interface(lo, lo, s0 - mls_systemhigh) @@ -6019,7 +6028,7 @@ index 4edc40d..421e8b1 100644 ',` typealias netif_t alias { lo_netif_t netif_lo_t }; ') -@@ -342,9 +412,28 @@ typealias netif_t alias { lo_netif_t netif_lo_t }; +@@ -342,9 +413,28 @@ typealias netif_t alias { lo_netif_t netif_lo_t }; allow corenet_unconfined_type node_type:node *; allow corenet_unconfined_type netif_type:netif *; allow corenet_unconfined_type packet_type:packet *; @@ -24020,7 +24029,7 @@ index fe0c682..e8dcfa7 100644 + ps_process_pattern($1, sshd_t) +') diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te -index 5fc0391..9f1c453 100644 +index 5fc0391..97291d1 100644 --- a/policy/modules/services/ssh.te +++ b/policy/modules/services/ssh.te @@ -6,43 +6,65 @@ policy_module(ssh, 2.3.3) @@ -24521,7 +24530,7 @@ index 5fc0391..9f1c453 100644 optional_policy(` seutil_sigchld_newrole(ssh_keygen_t) -@@ -331,3 +516,141 @@ optional_policy(` +@@ -331,3 +516,148 @@ optional_policy(` optional_policy(` udev_read_db(ssh_keygen_t) ') @@ -24576,6 +24585,9 @@ index 5fc0391..9f1c453 100644 + +corecmd_exec_shell(chroot_user_t) + ++domain_subj_id_change_exemption(chroot_user_t) ++domain_role_change_exemption(chroot_user_t) ++ +term_search_ptys(chroot_user_t) +term_use_ptmx(chroot_user_t) + @@ -24625,6 +24637,10 @@ index 5fc0391..9f1c453 100644 + ssh_rw_dgram_sockets(chroot_user_t) +') + ++optional_policy(` ++ unconfined_shell_domtrans(chroot_user_t) ++') ++ +###################################### +# +# ssh_agent_type common policy local policy diff --git a/policy-f20-contrib.patch b/policy-f20-contrib.patch index 0083c80..dc357e4 100644 --- a/policy-f20-contrib.patch +++ b/policy-f20-contrib.patch @@ -28836,10 +28836,10 @@ index 3194b76..d3acb1a 100644 tunable_policy(`gitosis_can_sendmail',` diff --git a/glance.if b/glance.if -index 9eacb2c..229782f 100644 +index 9eacb2c..2769682 100644 --- a/glance.if +++ b/glance.if -@@ -1,5 +1,30 @@ +@@ -1,5 +1,33 @@ ## OpenStack image registry and delivery service. +####################################### @@ -28865,12 +28865,15 @@ index 9eacb2c..229782f 100644 + + corenet_all_recvfrom_unlabeled($1_t) + corenet_all_recvfrom_netlabel($1_t) ++ ++ logging_send_syslog_msg($1_t) ++ +') + ######################################## ## ## Execute a domain transition to -@@ -26,9 +51,9 @@ interface(`glance_domtrans_registry',` +@@ -26,9 +54,9 @@ interface(`glance_domtrans_registry',` ## run glance api. ## ## @@ -28882,7 +28885,7 @@ index 9eacb2c..229782f 100644 ## # interface(`glance_domtrans_api',` -@@ -242,8 +267,13 @@ interface(`glance_admin',` +@@ -242,8 +270,13 @@ interface(`glance_admin',` type glance_registry_initrc_exec_t, glance_api_initrc_exec_t; ') @@ -73845,10 +73848,10 @@ index 76f5b39..8bb80a2 100644 +') + diff --git a/quantum.fc b/quantum.fc -index 70ab68b..32dec67 100644 +index 70ab68b..2a8e41b 100644 --- a/quantum.fc +++ b/quantum.fc -@@ -1,10 +1,28 @@ +@@ -1,10 +1,31 @@ -/etc/rc\.d/init\.d/quantum.* -- gen_context(system_u:object_r:quantum_initrc_exec_t,s0) +/etc/rc\.d/init\.d/neutron.* -- gen_context(system_u:object_r:neutron_initrc_exec_t,s0) +/etc/rc\.d/init\.d/quantum.* -- gen_context(system_u:object_r:neutron_initrc_exec_t,s0) @@ -73860,6 +73863,9 @@ index 70ab68b..32dec67 100644 +/usr/bin/neutron-dhcp-agent -- gen_context(system_u:object_r:neutron_exec_t,s0) +/usr/bin/neutron-l3-agent -- gen_context(system_u:object_r:neutron_exec_t,s0) +/usr/bin/neutron-lbaas-agent -- gen_context(system_u:object_r:neutron_exec_t,s0) ++/usr/bin/neutron-metadata-agent -- gen_context(system_u:object_r:neutron_exec_t,s0) ++/usr/bin/neutron-netns-cleanup -- gen_context(system_u:object_r:neutron_exec_t,s0) ++/usr/bin/neutron-ns-metadata-proxy -- gen_context(system_u:object_r:neutron_exec_t,s0) +/usr/bin/neutron-rootwrap -- gen_context(system_u:object_r:neutron_exec_t,s0) +/usr/bin/neutron-linuxbridge-agent -- gen_context(system_u:object_r:neutron_exec_t,s0) +/usr/bin/neutron-openvswitch-agent -- gen_context(system_u:object_r:neutron_exec_t,s0) @@ -74200,10 +74206,10 @@ index afc0068..3105104 100644 + ') ') diff --git a/quantum.te b/quantum.te -index 769d1fd..ef91a41 100644 +index 769d1fd..ad29df7 100644 --- a/quantum.te +++ b/quantum.te -@@ -1,96 +1,145 @@ +@@ -1,96 +1,153 @@ -policy_module(quantum, 1.0.2) +policy_module(quantum, 1.0.3) @@ -74274,36 +74280,34 @@ index 769d1fd..ef91a41 100644 +manage_files_pattern(neutron_t, neutron_tmp_t, neutron_tmp_t) +manage_dirs_pattern(neutron_t, neutron_tmp_t, neutron_tmp_t) +files_tmp_filetrans(neutron_t, neutron_tmp_t, { file dir }) ++ ++manage_dirs_pattern(neutron_t, neutron_var_lib_t, neutron_var_lib_t) ++manage_files_pattern(neutron_t, neutron_var_lib_t, neutron_var_lib_t) ++manage_sock_files_pattern(neutron_t, neutron_var_lib_t, neutron_var_lib_t) ++files_var_lib_filetrans(neutron_t, neutron_var_lib_t, dir) -manage_dirs_pattern(quantum_t, quantum_log_t, quantum_log_t) -append_files_pattern(quantum_t, quantum_log_t, quantum_log_t) -create_files_pattern(quantum_t, quantum_log_t, quantum_log_t) -setattr_files_pattern(quantum_t, quantum_log_t, quantum_log_t) -logging_log_filetrans(quantum_t, quantum_log_t, dir) -+manage_dirs_pattern(neutron_t, neutron_var_lib_t, neutron_var_lib_t) -+manage_files_pattern(neutron_t, neutron_var_lib_t, neutron_var_lib_t) -+manage_sock_files_pattern(neutron_t, neutron_var_lib_t, neutron_var_lib_t) -+files_var_lib_filetrans(neutron_t, neutron_var_lib_t, dir) ++can_exec(neutron_t, neutron_tmp_t) -manage_files_pattern(quantum_t, quantum_tmp_t, quantum_tmp_t) -files_tmp_filetrans(quantum_t, quantum_tmp_t, file) -+can_exec(neutron_t, neutron_tmp_t) - --manage_dirs_pattern(quantum_t, quantum_var_lib_t, quantum_var_lib_t) --manage_files_pattern(quantum_t, quantum_var_lib_t, quantum_var_lib_t) --files_var_lib_filetrans(quantum_t, quantum_var_lib_t, dir) +kernel_read_system_state(neutron_t) +kernel_read_network_state(neutron_t) +kernel_request_load_module(neutron_t) +kernel_rw_kernel_sysctl(neutron_t) +kernel_rw_net_sysctls(neutron_t) --can_exec(quantum_t, quantum_tmp_t) +-manage_dirs_pattern(quantum_t, quantum_var_lib_t, quantum_var_lib_t) +-manage_files_pattern(quantum_t, quantum_var_lib_t, quantum_var_lib_t) +-files_var_lib_filetrans(quantum_t, quantum_var_lib_t, dir) +corecmd_exec_shell(neutron_t) +corecmd_exec_bin(neutron_t) --kernel_read_kernel_sysctls(quantum_t) --kernel_read_system_state(quantum_t) +-can_exec(quantum_t, quantum_tmp_t) +corenet_all_recvfrom_unlabeled(neutron_t) +corenet_all_recvfrom_netlabel(neutron_t) +corenet_tcp_sendrecv_generic_if(neutron_t) @@ -74311,49 +74315,49 @@ index 769d1fd..ef91a41 100644 +corenet_tcp_sendrecv_all_ports(neutron_t) +corenet_tcp_bind_generic_node(neutron_t) --corecmd_exec_shell(quantum_t) --corecmd_exec_bin(quantum_t) +-kernel_read_kernel_sysctls(quantum_t) +-kernel_read_system_state(quantum_t) +corenet_tcp_bind_neutron_port(neutron_t) +corenet_tcp_connect_keystone_port(neutron_t) +corenet_tcp_connect_amqp_port(neutron_t) +corenet_tcp_connect_mysqld_port(neutron_t) +corenet_tcp_connect_osapi_compute_port(neutron_t) +-corecmd_exec_shell(quantum_t) +-corecmd_exec_bin(quantum_t) ++domain_read_all_domains_state(neutron_t) ++domain_named_filetrans(neutron_t) + -corenet_all_recvfrom_unlabeled(quantum_t) -corenet_all_recvfrom_netlabel(quantum_t) -corenet_tcp_sendrecv_generic_if(quantum_t) -corenet_tcp_sendrecv_generic_node(quantum_t) -corenet_tcp_sendrecv_all_ports(quantum_t) -corenet_tcp_bind_generic_node(quantum_t) -+domain_read_all_domains_state(neutron_t) -+domain_named_filetrans(neutron_t) - --dev_list_sysfs(quantum_t) --dev_read_urand(quantum_t) +dev_read_sysfs(neutron_t) +dev_read_urand(neutron_t) +dev_mounton_sysfs(neutron_t) +dev_mount_sysfs_fs(neutron_t) +dev_unmount_sysfs_fs(neutron_t) --files_read_usr_files(quantum_t) +-dev_list_sysfs(quantum_t) +-dev_read_urand(quantum_t) +files_mounton_non_security(neutron_t) --auth_use_nsswitch(quantum_t) +-files_read_usr_files(quantum_t) +fs_getattr_all_fs(neutron_t) --libs_exec_ldconfig(quantum_t) +-auth_use_nsswitch(quantum_t) +auth_use_nsswitch(neutron_t) --logging_send_audit_msgs(quantum_t) --logging_send_syslog_msg(quantum_t) +-libs_exec_ldconfig(quantum_t) +libs_exec_ldconfig(neutron_t) --miscfiles_read_localization(quantum_t) +-logging_send_audit_msgs(quantum_t) +-logging_send_syslog_msg(quantum_t) +logging_send_audit_msgs(neutron_t) +logging_send_syslog_msg(neutron_t) - --sysnet_domtrans_ifconfig(quantum_t) ++ +netutils_exec(neutron_t) + +# need to stay in neutron @@ -74365,44 +74369,54 @@ index 769d1fd..ef91a41 100644 + brctl_domtrans(neutron_t) +') - optional_policy(` -- brctl_domtrans(quantum_t) +-miscfiles_read_localization(quantum_t) ++optional_policy(` + dnsmasq_domtrans(neutron_t) + dnsmasq_signal(neutron_t) + dnsmasq_kill(neutron_t) + dnsmasq_read_state(neutron_t) ++') + +-sysnet_domtrans_ifconfig(quantum_t) ++optional_policy(` ++ iptables_domtrans(neutron_t) ++') + + optional_policy(` +- brctl_domtrans(quantum_t) ++ modutils_domtrans_insmod(neutron_t) ') optional_policy(` - mysql_stream_connect(quantum_t) - mysql_read_config(quantum_t) -+ iptables_domtrans(neutron_t) -+') - -- mysql_tcp_connect(quantum_t) -+optional_policy(` + mysql_stream_connect(neutron_t) + mysql_read_db_lnk_files(neutron_t) + mysql_read_config(neutron_t) + mysql_tcp_connect(neutron_t) ++') + +- mysql_tcp_connect(quantum_t) ++optional_policy(` ++ postgresql_stream_connect(neutron_t) ++ postgresql_unpriv_client(neutron_t) ++ postgresql_tcp_connect(neutron_t) ') optional_policy(` - postgresql_stream_connect(quantum_t) - postgresql_unpriv_client(quantum_t) -+ postgresql_stream_connect(neutron_t) -+ postgresql_unpriv_client(neutron_t) -+ postgresql_tcp_connect(neutron_t) ++ openvswitch_domtrans(neutron_t) ++ openvswitch_stream_connect(neutron_t) +') - postgresql_tcp_connect(quantum_t) +optional_policy(` -+ openvswitch_domtrans(neutron_t) -+ openvswitch_stream_connect(neutron_t) ++ sudo_exec(neutron_t) ') + +optional_policy(` -+ sudo_exec(neutron_t) ++ udev_domtrans(neutron_t) +') diff --git a/quota.fc b/quota.fc index cadabe3..54ba01d 100644 @@ -95064,10 +95078,10 @@ index c6aaac7..84cdcac 100644 sysnet_dns_name_resolve(svnserve_t) diff --git a/swift.fc b/swift.fc new file mode 100644 -index 0000000..a4ec18a +index 0000000..d9a58dc --- /dev/null +++ b/swift.fc -@@ -0,0 +1,30 @@ +@@ -0,0 +1,31 @@ +/usr/bin/swift-account-auditor -- gen_context(system_u:object_r:swift_exec_t,s0) +/usr/bin/swift-account-reaper -- gen_context(system_u:object_r:swift_exec_t,s0) +/usr/bin/swift-account-replicator -- gen_context(system_u:object_r:swift_exec_t,s0) @@ -95081,6 +95095,7 @@ index 0000000..a4ec18a + +/usr/bin/swift-object-auditor -- gen_context(system_u:object_r:swift_exec_t,s0) +/usr/bin/swift-object-info -- gen_context(system_u:object_r:swift_exec_t,s0) ++/usr/bin/swift-object-expirer -- gen_context(system_u:object_r:swift_exec_t,s0) +/usr/bin/swift-object-replicator -- gen_context(system_u:object_r:swift_exec_t,s0) +/usr/bin/swift-object-server -- gen_context(system_u:object_r:swift_exec_t,s0) +/usr/bin/swift-object-updater -- gen_context(system_u:object_r:swift_exec_t,s0) diff --git a/selinux-policy.spec b/selinux-policy.spec index c1982d8..233422d 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.12.1 -Release: 172%{?dist} +Release: 173%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -579,6 +579,14 @@ SELinux Reference policy mls base module. %endif %changelog +* Thu Jun 26 2014 Lukas Vrabec 3.12.1-173 +- Added changes to fedora from bug bz#1082183 +- Back ported swift ports +- Label conman exec files in /usr/share/conman/exec as bin_t +- Add support for /usr/bin/swift-object-expirer and label it as swift_exec_t +- Allow glance domain to use syslog +- back port additional labeling for neutron + * Tue Jun 24 2014 Lukas Vrabec 3.12.1-172 - Allow keepalived connect to agentx port - Allow neutron-ns-metadata to connectto own unix stream socket