CaROS/meta-selinux
3
0
Fork 0
mirror of git://git.yoctoproject.org/meta-selinux synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

refpolicy: firewalld - fix firewalld_t firewalld_tmpfs_t exec

Browse Source 
Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
This commit is contained in:
Clayton Casciato 2025-04-06 21:40:01 -06:00 committed by Yi Zhao
parent bd1238adbf
commit 311c945900
2 changed files with 50 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
recipes-security/refpolicy/refpolicy/0061-policy-modules-services-firewalld-fix-firewalld_t-fi.patch Normal file
View File

@ -0,0 +1,49 @@
From 05da7b33197569f1a2c650cea77c53c6a143f2f0 Mon Sep 17 00:00:00 2001
From: Clayton Casciato <ccasciato@21sw.us>
Date: Mon, 10 Mar 2025 14:15:39 -0600
Subject: [PATCH] firewalld: fix firewalld_t firewalld_tmpfs_t exec
type=PROCTITLE proctitle=/usr/bin/python3 /usr/sbin/firewalld --nofork
--nopid
type=MMAP fd=9 flags=MAP_SHARED
type=SYSCALL arch=armeb syscall=mmap2 per=PER_LINUX success=yes
exit=(null)(Unknown error 1238224896) a0=0x0 a1=0x1000 a2=0x5 a3=0x1
items=0 ppid=1 pid=270 auid=unset uid=root gid=root euid=root suid=root
fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset
comm=firewalld exe=/usr/bin/python3.12
subj=system_u:system_r:firewalld_t:s0 key=(null)
type=AVC avc: denied { execute } for pid=270 comm=firewalld
path=/memfd:libffi (deleted) dev="tmpfs" ino=44
scontext=system_u:system_r:firewalld_t:s0
tcontext=system_u:object_r:firewalld_tmpfs_t:s0 tclass=file
Fedora:
$ sesearch -A --source firewalld_t --target firewalld_tmpfs_t --perm execute
allow firewalld_t firewalld_tmpfs_t:file { append create execute getattr
ioctl link lock map open read rename setattr unlink watch watch_reads
write };
https://github.com/fedora-selinux/selinux-policy/blob/v41.33/policy/modules/contrib/firewalld.te#L66
Signed-off-by: Clayton Casciato <ccasciato@21sw.us>
Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/commit/c5a76add70965ae8c988310f79c8cb750afc9bc4]
Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com>
---
policy/modules/services/firewalld.te | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/policy/modules/services/firewalld.te b/policy/modules/services/firewalld.te
index f592cf4f6..7573f3cc0 100644
--- a/policy/modules/services/firewalld.te
+++ b/policy/modules/services/firewalld.te
@@ -62,7 +62,7 @@ files_runtime_filetrans(firewalld_t, firewalld_runtime_t, { dir file })
manage_dirs_pattern(firewalld_t, firewalld_tmpfs_t, firewalld_tmpfs_t)
manage_files_pattern(firewalld_t, firewalld_tmpfs_t, firewalld_tmpfs_t)
-mmap_read_files_pattern(firewalld_t, firewalld_tmpfs_t, firewalld_tmpfs_t)
+mmap_exec_files_pattern(firewalld_t, firewalld_tmpfs_t, firewalld_tmpfs_t)
fs_tmpfs_filetrans(firewalld_t, firewalld_tmpfs_t, { dir file })
kernel_read_network_state(firewalld_t)

1
recipes-security/refpolicy/refpolicy_common.inc
View File

@ -76,6 +76,7 @@ SRC_URI += " \
file://0058-policy-modules-services-chronyd-allow_dac_read_searc.patch \
file://0059-policy-modules-system-unconfined-fix-oddjob-security.patch \
file://0060-policy-modules-services-firewalld-fix-lib_t-python_c.patch \
file://0061-policy-modules-services-firewalld-fix-firewalld_t-fi.patch \
"
S = "${WORKDIR}/refpolicy"