From 5a92976a8614e1eb639988ecef4cce890418d4e8 Mon Sep 17 00:00:00 2001 From: Yi Zhao Date: Wed, 24 Jul 2024 13:38:55 +0800 Subject: [PATCH] refpolicy: update to latest git rev * a6cf20736 filesystem, devices: move gadgetfs to usbfs_t * 75492f95f systemd: make xdg optional * 097d688ff sshd: label sshd-session as sshd_exec_t * b57b6005c Setting bluetooth helper domain for bluetoothctl * 30f451d6a Adding Sepolicy rules to allow pulseaudio to access bluetooth sockets. * 7037c341f systemd: allow logind to use locallogin pidfds * 5f7f494d1 userdomain: allow administrative user to get attributes of shadow history file * 0126cb1e6 node_exporter: allow reading RPC sysctls * 9c90f9f7d asterisk: allow reading certbot lib * bfcaec9ba postfix: allow postfix pipe to watch mail spool * 06a80c3d8 netutils: allow ping to read net sysctls * 2e0509c9e node_exporter: allow reading localization * 50a8cddd1 container: allow containers to execute tmpfs files * 09a747a16 sysadm: make haproxy admin * c8c3ae2cb haproxy: initial policy * 4e97f87ce init: use pidfds from local login * 7fd9032d8 dbus, init: add interface for pidfd usage * a6d6921a9 asterisk: allow watching spool dirs * 72c1d912f su, sudo: allow sudo to signal all su domains * 8b3178248 sudo: allow systemd-logind to read cgroup state of sudo * 871f0b0dd postfix: allow smtpd to mmap SASL keytab files * 578375480 sysnetwork: allow ifconfig to read usr files * 6916e9b20 systemd: allow systemd-logind to use sshd pidfds * 96ebb7c4e Reorder perms and classes * cb68df087 tests.yml: Add policy diff on PRs. * 99258825c tests.yml: Divide into reusable workflows. * 1e4b68930 Reorder perms and classes Drop 0002-refpolicy-minimum-make-xdg-module-optional.patch and 0040-policy-modules-system-systemd-allow-systemd-logind-t.patch which have been merged upstream. Signed-off-by: Yi Zhao Signed-off-by: Joe MacDonald --- .../refpolicy/refpolicy-minimum_git.bb | 1 - ...icy-minimum-make-xdg-module-optional.patch | 40 ------------------- ...stem-logging-grant-getpcap-capabili.patch} | 0 ...ystem-systemd-allow-systemd-logind-t.patch | 38 ------------------ .../refpolicy/refpolicy_common.inc | 3 +- recipes-security/refpolicy/refpolicy_git.inc | 2 +- 6 files changed, 2 insertions(+), 82 deletions(-) delete mode 100644 recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch rename recipes-security/refpolicy/refpolicy/{0057-policy-modules-system-logging-grant-getpcap-capabili.patch => 0040-policy-modules-system-logging-grant-getpcap-capabili.patch} (100%) delete mode 100644 recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd-logind-t.patch diff --git a/recipes-security/refpolicy/refpolicy-minimum_git.bb b/recipes-security/refpolicy/refpolicy-minimum_git.bb index 67c3785..562ccac 100644 --- a/recipes-security/refpolicy/refpolicy-minimum_git.bb +++ b/recipes-security/refpolicy/refpolicy-minimum_git.bb @@ -13,7 +13,6 @@ domains are unconfined. \ SRC_URI += " \ file://0001-refpolicy-minimum-make-sysadmin-module-optional.patch \ - file://0002-refpolicy-minimum-make-xdg-module-optional.patch \ " POLICY_NAME = "minimum" diff --git a/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch b/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch deleted file mode 100644 index cc8c0b7..0000000 --- a/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 39b825d24a34864c3d9bae684b083a9b656f641a Mon Sep 17 00:00:00 2001 -From: Yi Zhao -Date: Wed, 29 Sep 2021 11:08:49 +0800 -Subject: [PATCH] refpolicy-minimum: make xdg module optional - -The systemd module invokes xdg_config_content and xdg_data_content -interfaces which are from xdg module. Since xdg is not a core module, we -could make it optional in minimum policy. - -Upstream-Status: Inappropriate [embedded specific] - -Signed-off-by: Yi Zhao ---- - policy/modules/system/systemd.te | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - -diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te -index a0e6bb405..b1fc414ea 100644 ---- a/policy/modules/system/systemd.te -+++ b/policy/modules/system/systemd.te -@@ -313,10 +313,14 @@ init_unit_file(systemd_user_manager_unit_t) - - type systemd_conf_home_t; - init_unit_file(systemd_conf_home_t) --xdg_config_content(systemd_conf_home_t) -+optional_policy(` -+ xdg_config_content(systemd_conf_home_t) -+') - - type systemd_data_home_t; --xdg_data_content(systemd_data_home_t) -+optional_policy(` -+ xdg_data_content(systemd_data_home_t) -+') - - type systemd_user_runtime_notify_t; - userdom_user_runtime_content(systemd_user_runtime_notify_t) --- -2.25.1 - diff --git a/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-grant-getpcap-capabili.patch b/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-logging-grant-getpcap-capabili.patch similarity index 100% rename from recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-grant-getpcap-capabili.patch rename to recipes-security/refpolicy/refpolicy/0040-policy-modules-system-logging-grant-getpcap-capabili.patch diff --git a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd-logind-t.patch b/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd-logind-t.patch deleted file mode 100644 index 4322590..0000000 --- a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd-logind-t.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 1b8a639bfdce84c9b39cd9e89b6da4c1d06cc7ab Mon Sep 17 00:00:00 2001 -From: Yi Zhao -Date: Sun, 4 Feb 2024 19:40:32 +0800 -Subject: [PATCH] policy/modules/system/systemd: allow systemd-logind to - inherit local login file descriptors - -Fix reboot timeout error: -$ reboot -Failed to set wall message, ignoring: Failed to activate service 'org.freedesktop.login1': timed out (service_start_timeout=25000ms) -Call to Reboot failed: Failed to activate service 'org.freedesktop.login1': timed out (service_start_timeout=25000ms) - -avc: denied { use } for pid=287 comm="systemd-logind" -path="anon_inode:[pidfd]" dev="anon_inodefs" ino=1044 -scontext=system_u:system_r:systemd_logind_t -tcontext=system_u:system_r:local_login_t tclass=fd permissive=0 - -Upstream-Status: Pending - -Signed-off-by: Yi Zhao ---- - policy/modules/system/systemd.te | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te -index ffce3c0e8..03aeb8515 100644 ---- a/policy/modules/system/systemd.te -+++ b/policy/modules/system/systemd.te -@@ -973,6 +973,7 @@ init_stop_system(systemd_logind_t) - miscfiles_read_localization(systemd_logind_t) - - locallogin_read_state(systemd_logind_t) -+locallogin_use_fds(systemd_logind_t) - - seutil_libselinux_linked(systemd_logind_t) - seutil_read_default_contexts(systemd_logind_t) --- -2.25.1 - diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc index 05dca2c..7b45882 100644 --- a/recipes-security/refpolicy/refpolicy_common.inc +++ b/recipes-security/refpolicy/refpolicy_common.inc @@ -55,7 +55,7 @@ SRC_URI += " \ file://0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch \ file://0038-policy-modules-system-systemd-systemd-user-fixes.patch \ file://0039-policy-modules-system-authlogin-fix-login-errors-aft.patch \ - file://0040-policy-modules-system-systemd-allow-systemd-logind-t.patch \ + file://0040-policy-modules-system-logging-grant-getpcap-capabili.patch \ file://0041-policy-modules-system-mount-make-mount_t-domain-MLS-.patch \ file://0042-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch \ file://0043-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch \ @@ -72,7 +72,6 @@ SRC_URI += " \ file://0054-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \ file://0055-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \ file://0056-policy-modules-system-logging-make-syslogd_runtime_t.patch \ - file://0057-policy-modules-system-logging-grant-getpcap-capabili.patch \ " S = "${WORKDIR}/refpolicy" diff --git a/recipes-security/refpolicy/refpolicy_git.inc b/recipes-security/refpolicy/refpolicy_git.inc index ee69664..80d92ac 100644 --- a/recipes-security/refpolicy/refpolicy_git.inc +++ b/recipes-security/refpolicy/refpolicy_git.inc @@ -2,7 +2,7 @@ PV = "2.20240226+git" SRC_URI = "git://github.com/SELinuxProject/refpolicy.git;protocol=https;branch=main;name=refpolicy;destsuffix=refpolicy" -SRCREV_refpolicy ?= "c920fc5d9e626874b9af8693e5aa697200f76a12" +SRCREV_refpolicy ?= "71f4bd1992e05bcd79dc5234f8a30deeb141aa3d" UPSTREAM_CHECK_GITTAGREGEX = "RELEASE_(?P\d+_\d+)"