diff --git a/recipes-security/refpolicy/refpolicy-minimum_git.bb b/recipes-security/refpolicy/refpolicy-minimum_git.bb index 67c3785..562ccac 100644 --- a/recipes-security/refpolicy/refpolicy-minimum_git.bb +++ b/recipes-security/refpolicy/refpolicy-minimum_git.bb @@ -13,7 +13,6 @@ domains are unconfined. \ SRC_URI += " \ file://0001-refpolicy-minimum-make-sysadmin-module-optional.patch \ - file://0002-refpolicy-minimum-make-xdg-module-optional.patch \ " POLICY_NAME = "minimum" diff --git a/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch b/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch deleted file mode 100644 index cc8c0b7..0000000 --- a/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 39b825d24a34864c3d9bae684b083a9b656f641a Mon Sep 17 00:00:00 2001 -From: Yi Zhao -Date: Wed, 29 Sep 2021 11:08:49 +0800 -Subject: [PATCH] refpolicy-minimum: make xdg module optional - -The systemd module invokes xdg_config_content and xdg_data_content -interfaces which are from xdg module. Since xdg is not a core module, we -could make it optional in minimum policy. - -Upstream-Status: Inappropriate [embedded specific] - -Signed-off-by: Yi Zhao ---- - policy/modules/system/systemd.te | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - -diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te -index a0e6bb405..b1fc414ea 100644 ---- a/policy/modules/system/systemd.te -+++ b/policy/modules/system/systemd.te -@@ -313,10 +313,14 @@ init_unit_file(systemd_user_manager_unit_t) - - type systemd_conf_home_t; - init_unit_file(systemd_conf_home_t) --xdg_config_content(systemd_conf_home_t) -+optional_policy(` -+ xdg_config_content(systemd_conf_home_t) -+') - - type systemd_data_home_t; --xdg_data_content(systemd_data_home_t) -+optional_policy(` -+ xdg_data_content(systemd_data_home_t) -+') - - type systemd_user_runtime_notify_t; - userdom_user_runtime_content(systemd_user_runtime_notify_t) --- -2.25.1 - diff --git a/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-grant-getpcap-capabili.patch b/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-logging-grant-getpcap-capabili.patch similarity index 100% rename from recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-grant-getpcap-capabili.patch rename to recipes-security/refpolicy/refpolicy/0040-policy-modules-system-logging-grant-getpcap-capabili.patch diff --git a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd-logind-t.patch b/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd-logind-t.patch deleted file mode 100644 index 4322590..0000000 --- a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd-logind-t.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 1b8a639bfdce84c9b39cd9e89b6da4c1d06cc7ab Mon Sep 17 00:00:00 2001 -From: Yi Zhao -Date: Sun, 4 Feb 2024 19:40:32 +0800 -Subject: [PATCH] policy/modules/system/systemd: allow systemd-logind to - inherit local login file descriptors - -Fix reboot timeout error: -$ reboot -Failed to set wall message, ignoring: Failed to activate service 'org.freedesktop.login1': timed out (service_start_timeout=25000ms) -Call to Reboot failed: Failed to activate service 'org.freedesktop.login1': timed out (service_start_timeout=25000ms) - -avc: denied { use } for pid=287 comm="systemd-logind" -path="anon_inode:[pidfd]" dev="anon_inodefs" ino=1044 -scontext=system_u:system_r:systemd_logind_t -tcontext=system_u:system_r:local_login_t tclass=fd permissive=0 - -Upstream-Status: Pending - -Signed-off-by: Yi Zhao ---- - policy/modules/system/systemd.te | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te -index ffce3c0e8..03aeb8515 100644 ---- a/policy/modules/system/systemd.te -+++ b/policy/modules/system/systemd.te -@@ -973,6 +973,7 @@ init_stop_system(systemd_logind_t) - miscfiles_read_localization(systemd_logind_t) - - locallogin_read_state(systemd_logind_t) -+locallogin_use_fds(systemd_logind_t) - - seutil_libselinux_linked(systemd_logind_t) - seutil_read_default_contexts(systemd_logind_t) --- -2.25.1 - diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc index 05dca2c..7b45882 100644 --- a/recipes-security/refpolicy/refpolicy_common.inc +++ b/recipes-security/refpolicy/refpolicy_common.inc @@ -55,7 +55,7 @@ SRC_URI += " \ file://0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch \ file://0038-policy-modules-system-systemd-systemd-user-fixes.patch \ file://0039-policy-modules-system-authlogin-fix-login-errors-aft.patch \ - file://0040-policy-modules-system-systemd-allow-systemd-logind-t.patch \ + file://0040-policy-modules-system-logging-grant-getpcap-capabili.patch \ file://0041-policy-modules-system-mount-make-mount_t-domain-MLS-.patch \ file://0042-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch \ file://0043-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch \ @@ -72,7 +72,6 @@ SRC_URI += " \ file://0054-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \ file://0055-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \ file://0056-policy-modules-system-logging-make-syslogd_runtime_t.patch \ - file://0057-policy-modules-system-logging-grant-getpcap-capabili.patch \ " S = "${WORKDIR}/refpolicy" diff --git a/recipes-security/refpolicy/refpolicy_git.inc b/recipes-security/refpolicy/refpolicy_git.inc index ee69664..80d92ac 100644 --- a/recipes-security/refpolicy/refpolicy_git.inc +++ b/recipes-security/refpolicy/refpolicy_git.inc @@ -2,7 +2,7 @@ PV = "2.20240226+git" SRC_URI = "git://github.com/SELinuxProject/refpolicy.git;protocol=https;branch=main;name=refpolicy;destsuffix=refpolicy" -SRCREV_refpolicy ?= "c920fc5d9e626874b9af8693e5aa697200f76a12" +SRCREV_refpolicy ?= "71f4bd1992e05bcd79dc5234f8a30deeb141aa3d" UPSTREAM_CHECK_GITTAGREGEX = "RELEASE_(?P\d+_\d+)"