CaROS/meta-selinux
3
0
Fork 0
mirror of git://git.yoctoproject.org/meta-selinux synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

refpolicy: upgrade 20240226+git -> 20240916+git

Browse Source 
ChangeLog:
https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20240916

Notable Changes
  Added sechecker configuration for GitHub CI actions.
  Cleaned up concerning permissions uncovered by sechecker
  Removed extremely deprecated domains in cups (ptal) and xen (xend/xm)
  Systemd updates up to v256
  Various container fixes

New Modules
  haproxy

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Joe MacDonald <joe.macdonald@siemens.com>
This commit is contained in:
Yi Zhao 2024-10-08 12:43:57 +08:00 committed by Joe MacDonald
parent 7886cda8a5
commit 98456e0868
62 changed files with 224 additions and 135 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
recipes-security/refpolicy/refpolicy-minimum_git.bb
View File

@ -13,6 +13,7 @@ domains are unconfined. \
SRC_URI += " \
file://0001-refpolicy-minimum-make-sysadmin-module-optional.patch \
file://0002-refpolicy-minimum-enable-nscd_use_shm.patch \
"
POLICY_NAME = "minimum"

2
recipes-security/refpolicy/refpolicy/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch
View File

@ -1,4 +1,4 @@
From 9fdb576862d6a373b4a50e149fcfd4571e01dd1a Mon Sep 17 00:00:00 2001
From 2627c403bb84d710a2469e501e6a0ccf5c7fb438 Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Thu, 28 Mar 2019 16:14:09 -0400
Subject: [PATCH] fc/subs/volatile: alias common /var/volatile paths

8
recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch
View File

@ -1,4 +1,4 @@
From 2d04fadd54814ce01d143262f36edbf0b1700a9b Mon Sep 17 00:00:00 2001
From 923dec0f0231024680bb6f7d48ff7edf82ed8082 Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Fri, 5 Apr 2019 11:53:28 -0400
Subject: [PATCH] refpolicy-minimum: make sysadmin module optional
@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2 files changed, 11 insertions(+), 7 deletions(-)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index c2380d8b4..31f77cf43 100644
index 8af34aa7e..fdd64fb5b 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -645,13 +645,15 @@ ifdef(`init_systemd',`
@@ -653,13 +653,15 @@ ifdef(`init_systemd',`
unconfined_write_keys(init_t)
')
',`
@ -48,7 +48,7 @@ index c2380d8b4..31f77cf43 100644
')
')
diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
index 8330be8a9..933e94b24 100644
index 4ba131d29..9c4b0a1d8 100644
--- a/policy/modules/system/locallogin.te
+++ b/policy/modules/system/locallogin.te
@@ -277,7 +277,9 @@ userdom_use_unpriv_users_fds(sulogin_t)

4
recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch
View File

@ -1,4 +1,4 @@
From 15b4f9a17d1f45dc6e15e4a3b0e6490a9a518df6 Mon Sep 17 00:00:00 2001
From 38cac8a2f2ec94bbc9b6d04ffcc35b7459c05b11 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Mon, 20 Apr 2020 11:50:03 +0800
Subject: [PATCH] refpolicy-targeted: make unconfined_u the default selinux
@ -38,7 +38,7 @@ index ce614b41b..c0903d98b 100644
+root:unconfined_u:s0-mcs_systemhigh
+__default__:unconfined_u:s0
diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
index 6c9769b04..01c9a7243 100644
index 68b78ff24..d54fe2fd4 100644
--- a/policy/modules/system/unconfined.te
+++ b/policy/modules/system/unconfined.te
@@ -20,6 +20,11 @@ type unconfined_execmem_t alias ada_t;

2
recipes-security/refpolicy/refpolicy/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch
View File

@ -1,4 +1,4 @@
From a3269d08232045835f341e5796da66d9bf948aca Mon Sep 17 00:00:00 2001
From bd8d0af36d8f6eb0f25c43b94e31e93d4ac7513b Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Thu, 28 Mar 2019 20:48:10 -0400
Subject: [PATCH] fc/subs/busybox: set aliases for bin, sbin and usr

47
recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-enable-nscd_use_shm.patch Normal file
View File

@ -0,0 +1,47 @@
From 9494c078e1aea2ab6ecdf0c3ca01e2d3941b11a7 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 26 Feb 2021 09:13:23 +0800
Subject: [PATCH] refpolicy-minimum: enable nscd_use_shm
Fixes:
avc: denied { listen } for pid=340 comm="systemd-network"
path="/run/systemd/netif/io.systemd.Network"
scontext=system_u:system_r:systemd_networkd_t:s0
tcontext=system_u:system_r:systemd_networkd_t:s0
tclass=unix_stream_socket permissive=1
avc: denied { accept } for pid=312 comm="systemd-nsresou"
path="/run/systemd/io.systemd.NamespaceResource"
scontext=system_u:system_r:systemd_nsresourced_t:s0
tcontext=system_u:system_r:systemd_nsresourced_t:s0
tclass=unix_stream_socket permissive=1
avc: denied { accept } for pid=309 comm="systemd-nsresou"
path="/run/systemd/io.systemd.NamespaceResource"
scontext=system_u:system_r:systemd_nsresourced_t:s0
tcontext=system_u:system_r:systemd_nsresourced_t:s0
tclass=unix_stream_socket permissive=1
Upstream-Status: Inappropriate [embedded specific]
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
policy/modules/services/nscd.te | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/policy/modules/services/nscd.te b/policy/modules/services/nscd.te
index ffc60497c..d226f1145 100644
--- a/policy/modules/services/nscd.te
+++ b/policy/modules/services/nscd.te
@@ -15,7 +15,7 @@ gen_require(`
## can use nscd shared memory.
## </p>
## </desc>
-gen_tunable(nscd_use_shm, false)
+gen_tunable(nscd_use_shm, true)
attribute_role nscd_roles;
--
2.25.1

2
recipes-security/refpolicy/refpolicy/0003-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch
View File

@ -1,4 +1,4 @@
From a78f1bf10f489d1abe8a4db9c8ee29af6ac9d02c Mon Sep 17 00:00:00 2001
From b8ec557e6aa310c65d9183ae741e649eae1c3619 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] fc/hostname: apply policy to common yocto hostname

2
recipes-security/refpolicy/refpolicy/0004-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch
View File

@ -1,4 +1,4 @@
From 0f549b970d42109994c5736e78f0b7d9267b1ae5 Mon Sep 17 00:00:00 2001
From ddba777d85a78cb372a84f4ff003888e1ba06afa Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Thu, 28 Mar 2019 21:37:32 -0400
Subject: [PATCH] fc/bash: apply /usr/bin/bash context to /bin/bash.bash

6
recipes-security/refpolicy/refpolicy/0005-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch
View File

@ -1,4 +1,4 @@
From d9348cee43dd6d6e2ea971ef22c796956b9677fd Mon Sep 17 00:00:00 2001
From 3f24037dd9c0c468d4182d6b047a9baa2469726a Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Thu, 4 Apr 2019 10:45:03 -0400
Subject: [PATCH] fc/resolv.conf: label resolv.conf in var/run/ properly
@ -13,10 +13,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
index 14505efe9..c9ec4e5ab 100644
index d792422f5..a20f74820 100644
--- a/policy/modules/system/sysnetwork.fc
+++ b/policy/modules/system/sysnetwork.fc
@@ -84,6 +84,7 @@ ifdef(`distro_redhat',`
@@ -85,6 +85,7 @@ ifdef(`distro_redhat',`
/run/dhcpcd(/.*)? gen_context(system_u:object_r:dhcpc_runtime_t,s0)
/run/netns -d gen_context(system_u:object_r:ifconfig_runtime_t,s0)
/run/netns/[^/]+ -- <<none>>

4
recipes-security/refpolicy/refpolicy/0006-fc-login-apply-login-context-to-login.shadow.patch
View File

@ -1,4 +1,4 @@
From df2801c3f9689d6c173dca05ee970756ba3b3d04 Mon Sep 17 00:00:00 2001
From b318d4d8feb1a021e63d38ac2bea4abe834c4e3b Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Thu, 28 Mar 2019 21:43:53 -0400
Subject: [PATCH] fc/login: apply login context to login.shadow
@ -12,7 +12,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/authlogin.fc b/policy/modules/system/authlogin.fc
index adb53a05a..a25a9d607 100644
index fcdd38d6d..c7e7b64a9 100644
--- a/policy/modules/system/authlogin.fc
+++ b/policy/modules/system/authlogin.fc
@@ -8,6 +8,7 @@

2
recipes-security/refpolicy/refpolicy/0007-fc-hwclock-add-hwclock-alternatives.patch
View File

@ -1,4 +1,4 @@
From f274bbf18ef930a506c7fe7cc90c32698e51b318 Mon Sep 17 00:00:00 2001
From 78e157da0424e06347030577dcdd00f3e6c085ef Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Thu, 28 Mar 2019 21:59:18 -0400
Subject: [PATCH] fc/hwclock: add hwclock alternatives

2
recipes-security/refpolicy/refpolicy/0008-fc-dmesg-apply-policy-to-dmesg-alternatives.patch
View File

@ -1,4 +1,4 @@
From c69e143640f73d13d82aa6cfcbfce64a02bcb13d Mon Sep 17 00:00:00 2001
From d15ee4e3684c52af2caa3af2c24af73ab7ceb677 Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Fri, 29 Mar 2019 08:26:55 -0400
Subject: [PATCH] fc/dmesg: apply policy to dmesg alternatives

4
recipes-security/refpolicy/refpolicy/0009-fc-ssh-apply-policy-to-ssh-alternatives.patch
View File

@ -1,4 +1,4 @@
From 6cb433b296b2085bf1aa54c7722a8bcf7a69cba8 Mon Sep 17 00:00:00 2001
From f287a7b6b9a41963cec1e9bf70eff99e840c9cc3 Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Fri, 29 Mar 2019 09:20:58 -0400
Subject: [PATCH] fc/ssh: apply policy to ssh alternatives
@ -12,7 +12,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
index 5c512e972..0448c1877 100644
index a30d01afc..e033d1a70 100644
--- a/policy/modules/services/ssh.fc
+++ b/policy/modules/services/ssh.fc
@@ -4,6 +4,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)

8
recipes-security/refpolicy/refpolicy/0010-fc-sysnetwork-apply-policy-to-network-commands-alter.patch
View File

@ -1,4 +1,4 @@
From 89f23ef679f8f0f842b7b41b85c48266d292bcfc Mon Sep 17 00:00:00 2001
From fcfd91661ea05b5967f75927116056924e972214 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Tue, 9 Jun 2015 21:22:52 +0530
Subject: [PATCH] fc/sysnetwork: apply policy to network commands alternatives
@ -14,10 +14,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 4 insertions(+)
diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
index c9ec4e5ab..4ca151524 100644
index a20f74820..6f2e3f8f0 100644
--- a/policy/modules/system/sysnetwork.fc
+++ b/policy/modules/system/sysnetwork.fc
@@ -44,6 +44,7 @@ ifdef(`distro_redhat',`
@@ -45,6 +45,7 @@ ifdef(`distro_redhat',`
/usr/bin/dhcpcd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
/usr/bin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
/usr/bin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
@ -25,7 +25,7 @@ index c9ec4e5ab..4ca151524 100644
/usr/bin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
/usr/bin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
/usr/bin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
@@ -60,13 +61,16 @@ ifdef(`distro_redhat',`
@@ -61,13 +62,16 @@ ifdef(`distro_redhat',`
/usr/sbin/dhcpcd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
/usr/sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
/usr/sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)

2
recipes-security/refpolicy/refpolicy/0011-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch
View File

@ -1,4 +1,4 @@
From 2fb2dc1ab37da9d6d1f885b7f4b3eae8db66844a Mon Sep 17 00:00:00 2001
From 6e5d4763c0e3e7b2b819694d85710128f4e0ff28 Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Fri, 29 Mar 2019 09:54:07 -0400
Subject: [PATCH] fc/rpm: apply rpm_exec policy to cpio binaries

2
recipes-security/refpolicy/refpolicy/0012-fc-su-apply-policy-to-su-alternatives.patch
View File

@ -1,4 +1,4 @@
From 95920611d43a3e6352fc16fcac05977844d57398 Mon Sep 17 00:00:00 2001
From ca60691cffdf516f3f09cee23874a49d890c9de8 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Thu, 13 Feb 2014 00:33:07 -0500
Subject: [PATCH] fc/su: apply policy to su alternatives

2
recipes-security/refpolicy/refpolicy/0013-fc-fstools-fix-real-path-for-fstools.patch
View File

@ -1,4 +1,4 @@
From 8b5320fbdb29ab1bf601d9cf81ffe7ea7b9bc55f Mon Sep 17 00:00:00 2001
From f6a42851e3abe274a733f92f90541de3047e5d74 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Mon, 27 Jan 2014 03:54:01 -0500
Subject: [PATCH] fc/fstools: fix real path for fstools

2
recipes-security/refpolicy/refpolicy/0014-fc-init-fix-update-alternatives-for-sysvinit.patch
View File

@ -1,4 +1,4 @@
From a733674bb530f070ce5363c0b50848d3cb4e113b Mon Sep 17 00:00:00 2001
From eecf36ae218ee0d85fd07a14bfbcb6636ab84095 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] fc/init: fix update-alternatives for sysvinit

2
recipes-security/refpolicy/refpolicy/0015-fc-brctl-apply-policy-to-brctl-alternatives.patch
View File

@ -1,4 +1,4 @@
From e4bdaafd9684b3b46a6d0a417967f596fbdc36c2 Mon Sep 17 00:00:00 2001
From e26d8e3eea2cab884562793221ce9b8c39c614cc Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 10:19:54 +0800
Subject: [PATCH] fc/brctl: apply policy to brctl alternatives

2
recipes-security/refpolicy/refpolicy/0016-fc-corecommands-apply-policy-to-nologin-alternatives.patch
View File

@ -1,4 +1,4 @@
From 762b0bd9cc26627f7361d5db92ae1cb366c0858b Mon Sep 17 00:00:00 2001
From 48b69b97a52cf782fbc54f5e55e92ee81466d0bc Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 10:21:51 +0800
Subject: [PATCH] fc/corecommands: apply policy to nologin alternatives

2
recipes-security/refpolicy/refpolicy/0017-fc-locallogin-apply-policy-to-sulogin-alternatives.patch
View File

@ -1,4 +1,4 @@
From d312aa5ea1da9c19eb214a55acb2d2b5347ed68f Mon Sep 17 00:00:00 2001
From 29e16342861e11d6463ec63ffbe55d1665d05e7d Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 10:43:28 +0800
Subject: [PATCH] fc/locallogin: apply policy to sulogin alternatives

2
recipes-security/refpolicy/refpolicy/0018-fc-ntp-apply-policy-to-ntpd-alternatives.patch
View File

@ -1,4 +1,4 @@
From 3085ae26b66d82f7c7b3db507153a5976ec26b48 Mon Sep 17 00:00:00 2001
From c1847b18ed1b1a18dbafc735bfb1368c2abb9d55 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 10:45:23 +0800
Subject: [PATCH] fc/ntp: apply policy to ntpd alternatives

2
recipes-security/refpolicy/refpolicy/0019-fc-kerberos-apply-policy-to-kerberos-alternatives.patch
View File

@ -1,4 +1,4 @@
From 4f377178aff842dc4ce9c6e705a761478d21f4d3 Mon Sep 17 00:00:00 2001
From 1400afd28f2cd886bae487fb17811a5fd98b86b9 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 10:55:05 +0800
Subject: [PATCH] fc/kerberos: apply policy to kerberos alternatives

2
recipes-security/refpolicy/refpolicy/0020-fc-ldap-apply-policy-to-ldap-alternatives.patch
View File

@ -1,4 +1,4 @@
From 6de6e53b41602b50ebec3627ceede5e13bad3bb6 Mon Sep 17 00:00:00 2001
From 53370099eb97c008460bb7b99817737beb94a9bf Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 11:06:13 +0800
Subject: [PATCH] fc/ldap: apply policy to ldap alternatives

2
recipes-security/refpolicy/refpolicy/0021-fc-postgresql-apply-policy-to-postgresql-alternative.patch
View File

@ -1,4 +1,4 @@
From f523a63f9f209544b9a557e76e94354c23d93959 Mon Sep 17 00:00:00 2001
From 67fda1f031d70d1281b058a5f3a31e220b052d21 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 11:13:16 +0800
Subject: [PATCH] fc/postgresql: apply policy to postgresql alternatives

2
recipes-security/refpolicy/refpolicy/0022-fc-screen-apply-policy-to-screen-alternatives.patch
View File

@ -1,4 +1,4 @@
From 57c6a0e69aa9d308ec23dc60dc2420ee5c62bf7f Mon Sep 17 00:00:00 2001
From fb72a7ca4963a7537bcb98a730025f6f8941d146 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 11:15:33 +0800
Subject: [PATCH] fc/screen: apply policy to screen alternatives

2
recipes-security/refpolicy/refpolicy/0023-fc-usermanage-apply-policy-to-usermanage-alternative.patch
View File

@ -1,4 +1,4 @@
From f0706a85dca8801d87130102b701c7bc2fd7476d Mon Sep 17 00:00:00 2001
From 343389daef155325172928f7d5608e638897775d Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 11:25:34 +0800
Subject: [PATCH] fc/usermanage: apply policy to usermanage alternatives

2
recipes-security/refpolicy/refpolicy/0024-fc-getty-add-file-context-to-start_getty.patch
View File

@ -1,4 +1,4 @@
From 2ff44df5a5da2246f2198741a05786e89ac9f4e3 Mon Sep 17 00:00:00 2001
From 23cef56ad581ee4579ab6ee26c9dd8b114816b6b Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 16:07:30 +0800
Subject: [PATCH] fc/getty: add file context to start_getty

2
recipes-security/refpolicy/refpolicy/0025-fc-vlock-apply-policy-to-vlock-alternatives.patch
View File

@ -1,4 +1,4 @@
From 42676d53a9c8554ac3e05f826f23792edf8d3c27 Mon Sep 17 00:00:00 2001
From 32988df0a389ef480334dffce4d5cc96b0f1012e Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Wed, 18 Dec 2019 15:04:41 +0800
Subject: [PATCH] fc/vlock: apply policy to vlock alternatives

2
recipes-security/refpolicy/refpolicy/0026-fc-add-fcontext-for-init-scripts-and-systemd-service.patch
View File

@ -1,4 +1,4 @@
From 3cf1f270369d7a2c75faf1a90d1485fe699dbbfe Mon Sep 17 00:00:00 2001
From 8586fbe84abd716a425e13e8b48179a08e210db2 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Tue, 30 Jun 2020 10:45:57 +0800
Subject: [PATCH] fc: add fcontext for init scripts and systemd service files

2
recipes-security/refpolicy/refpolicy/0027-file_contexts.subs_dist-set-aliase-for-root-director.patch
View File

@ -1,4 +1,4 @@
From 8b5ff44ba4a7819efb694cba6237bc572835628b Mon Sep 17 00:00:00 2001
From 20f43a932c5f7369a446707624d12285035b72fc Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Sun, 5 Apr 2020 22:03:45 +0800
Subject: [PATCH] file_contexts.subs_dist: set aliase for /root directory

4
recipes-security/refpolicy/refpolicy/0028-policy-modules-system-logging-add-rules-for-the-syml.patch
View File

@ -1,4 +1,4 @@
From 6f73afe1d8647bd917f6c06b46b0f0cebc276776 Mon Sep 17 00:00:00 2001
From 97839d4388be64e168613c2ea3202a76e58fb656 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] policy/modules/system/logging: add rules for the symlink of
@ -30,7 +30,7 @@ index 0ce2bec4b..8957366b0 100644
/var/log/dmesg -- gen_context(system_u:object_r:var_log_t,s0)
/var/log/syslog -- gen_context(system_u:object_r:var_log_t,s0)
diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index 49028a0cb..4381d2e83 100644
index 7487a7053..6acf1f52b 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -1091,10 +1091,12 @@ interface(`logging_append_all_inherited_logs',`

4
recipes-security/refpolicy/refpolicy/0029-policy-modules-system-logging-add-rules-for-syslogd-.patch
View File

@ -1,4 +1,4 @@
From 9d4f8d201dbdea28a38b5faaef9abc016bcbaab3 Mon Sep 17 00:00:00 2001
From 9bd0c30476615fd4af29a9dd5b3b664398a9845a Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Fri, 29 Mar 2019 10:33:18 -0400
Subject: [PATCH] policy/modules/system/logging: add rules for syslogd symlink
@ -18,7 +18,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 9d9a01fcc..45584dba6 100644
index eea78ffc5..5f06428f1 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -425,6 +425,7 @@ files_search_spool(syslogd_t)

20
recipes-security/refpolicy/refpolicy/0030-policy-modules-kernel-files-add-rules-for-the-symlin.patch
View File

@ -1,4 +1,4 @@
From 1ed2b79828a7dd08079ec111b116f6d288450662 Mon Sep 17 00:00:00 2001
From 6293ec11e3c471b54c328f56f20c694b7287885f Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] policy/modules/kernel/files: add rules for the symlink of
@ -30,10 +30,10 @@ index b1728d37c..c5012e6b4 100644
/tmp/\.journal <<none>>
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 472b5bb38..a2aa85b1c 100644
index 811efef94..00146fc23 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -4819,6 +4819,7 @@ interface(`files_search_tmp',`
@@ -4880,6 +4880,7 @@ interface(`files_search_tmp',`
')
allow $1 tmp_t:dir search_dir_perms;
@ -41,7 +41,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
@@ -4855,6 +4856,7 @@ interface(`files_list_tmp',`
@@ -4916,6 +4917,7 @@ interface(`files_list_tmp',`
')
allow $1 tmp_t:dir list_dir_perms;
@ -49,7 +49,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
@@ -4891,6 +4893,7 @@ interface(`files_delete_tmp_dir_entry',`
@@ -4952,6 +4954,7 @@ interface(`files_delete_tmp_dir_entry',`
')
allow $1 tmp_t:dir del_entry_dir_perms;
@ -57,7 +57,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
@@ -4909,6 +4912,7 @@ interface(`files_read_generic_tmp_files',`
@@ -4970,6 +4973,7 @@ interface(`files_read_generic_tmp_files',`
')
read_files_pattern($1, tmp_t, tmp_t)
@ -65,7 +65,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
@@ -4927,6 +4931,7 @@ interface(`files_manage_generic_tmp_dirs',`
@@ -4988,6 +4992,7 @@ interface(`files_manage_generic_tmp_dirs',`
')
manage_dirs_pattern($1, tmp_t, tmp_t)
@ -73,7 +73,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
@@ -4963,6 +4968,7 @@ interface(`files_manage_generic_tmp_files',`
@@ -5024,6 +5029,7 @@ interface(`files_manage_generic_tmp_files',`
')
manage_files_pattern($1, tmp_t, tmp_t)
@ -81,7 +81,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
@@ -4999,6 +5005,7 @@ interface(`files_rw_generic_tmp_sockets',`
@@ -5060,6 +5066,7 @@ interface(`files_rw_generic_tmp_sockets',`
')
rw_sock_files_pattern($1, tmp_t, tmp_t)
@ -89,7 +89,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
@@ -5206,6 +5213,7 @@ interface(`files_tmp_filetrans',`
@@ -5267,6 +5274,7 @@ interface(`files_tmp_filetrans',`
')
filetrans_pattern($1, tmp_t, $2, $3, $4)

4
recipes-security/refpolicy/refpolicy/0031-policy-modules-system-logging-fix-auditd-startup-fai.patch
View File

@ -1,4 +1,4 @@
From 5b33f07f60b20eb6e07ea3f517c43a539ee21332 Mon Sep 17 00:00:00 2001
From 40ddb313a0cb04b3e9b180e04d3427715de58aee Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] policy/modules/system/logging: fix auditd startup failures
@ -17,7 +17,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 3 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 45584dba6..4fb2fb63c 100644
index 5f06428f1..3ffddcb0a 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -117,6 +117,7 @@ allow auditctl_t self:netlink_audit_socket nlmsg_readpriv;

4
recipes-security/refpolicy/refpolicy/0032-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch
View File

@ -1,4 +1,4 @@
From 3da00356bee8be72115652850d535c9ec5f1b333 Mon Sep 17 00:00:00 2001
From 857a2cf93f6194d04ae8d2a8a544422e8a021e85 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] policy/modules/kernel/terminal: don't audit tty_device_t in
@ -17,7 +17,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 3 insertions(+)
diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
index e5645c7c5..6e9f654ac 100644
index 4db1fd773..f3431fa21 100644
--- a/policy/modules/kernel/terminal.if
+++ b/policy/modules/kernel/terminal.if
@@ -335,9 +335,12 @@ interface(`term_use_console',`

4
recipes-security/refpolicy/refpolicy/0034-policy-modules-system-systemd-enable-support-for-sys.patch → recipes-security/refpolicy/refpolicy/0033-policy-modules-system-systemd-enable-support-for-sys.patch
View File

@ -1,4 +1,4 @@
From 59b8730de7af45617a6125c7e23cecf896c30ce4 Mon Sep 17 00:00:00 2001
From 44fe25734126ae52d95456992d6a5257bb28a5c2 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Thu, 4 Feb 2016 06:03:19 -0500
Subject: [PATCH] policy/modules/system/systemd: enable support for
@ -29,7 +29,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index aa9198591..abc324cf1 100644
index d58aba30b..8ae917644 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -10,7 +10,7 @@ policy_module(systemd)

4
recipes-security/refpolicy/refpolicy/0035-policy-modules-system-logging-allow-systemd-tmpfiles.patch → recipes-security/refpolicy/refpolicy/0034-policy-modules-system-logging-allow-systemd-tmpfiles.patch
View File

@ -1,4 +1,4 @@
From feb50cfed6d7a08bb4e61b47f95df729a4fba9ea Mon Sep 17 00:00:00 2001
From 07582b5efbc4fd199e80d9cc9b8144e4c88e0a2b Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Sat, 30 Sep 2023 17:20:29 +0800
Subject: [PATCH] policy/modules/system/logging: allow systemd-tmpfiles to
@ -24,7 +24,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 4 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 8bc70b81d..3cab14381 100644
index 3ffddcb0a..df6095805 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -27,6 +27,10 @@ type auditd_log_t;

6
recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch → recipes-security/refpolicy/refpolicy/0035-policy-modules-system-systemd-allow-systemd_logind_t.patch
View File

@ -1,4 +1,4 @@
From c21d5186e0625fd83c9d674c3284cfd98c2f02b9 Mon Sep 17 00:00:00 2001
From 13ad5906311d8e0be5547326c106d9b5ce8481ab Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Sat, 18 Dec 2021 09:26:43 +0800
Subject: [PATCH] policy/modules/system/systemd: allow systemd_logind_t to read
@ -27,10 +27,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index abc324cf1..ffce3c0e8 100644
index 8ae917644..9375e8926 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1006,6 +1006,7 @@ userdom_relabelfrom_user_runtime_dirs(systemd_logind_t)
@@ -1056,6 +1056,7 @@ userdom_relabelfrom_user_runtime_dirs(systemd_logind_t)
userdom_relabelto_user_runtime_dirs(systemd_logind_t)
userdom_setattr_user_ttys(systemd_logind_t)
userdom_use_user_ttys(systemd_logind_t)

4
recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch → recipes-security/refpolicy/refpolicy/0036-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch
View File

@ -1,4 +1,4 @@
From e561ad9a73c949768f0b4e91943a32f10a9f4acc Mon Sep 17 00:00:00 2001
From be2a2d244fd95e4207986fa095988a02cb33cb32 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 28 Oct 2022 11:56:09 +0800
Subject: [PATCH] policy/modules/roles/sysadm: allow sysadm to use init file
@ -19,7 +19,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index 08cc0e117..c08226dc3 100644
index 69777df20..af5ccca9d 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -95,6 +95,8 @@ ifdef(`init_systemd',`

10
recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch → recipes-security/refpolicy/refpolicy/0037-policy-modules-system-systemd-systemd-user-fixes.patch
View File

@ -1,4 +1,4 @@
From 33164c889a759f4d4f2dc31244b9e2937cba854f Mon Sep 17 00:00:00 2001
From d57677139a8fc837ede3430986bea0c42f49fc97 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Thu, 4 Feb 2021 10:48:54 +0800
Subject: [PATCH] policy/modules/system/systemd: systemd --user fixes
@ -31,10 +31,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2 files changed, 34 insertions(+)
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
index 28f0ad089..d7219dc37 100644
index e62e8344a..96b5d31b4 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -228,6 +228,36 @@ template(`systemd_role_template',`
@@ -230,6 +230,36 @@ template(`systemd_role_template',`
')
')
@ -72,10 +72,10 @@ index 28f0ad089..d7219dc37 100644
## <summary>
## Allow the specified domain to be started as a daemon by the
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 088cb87b2..504747917 100644
index 73bb7c410..ea7a90a5d 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -1464,6 +1464,10 @@ template(`userdom_admin_user_template',`
@@ -1467,6 +1467,10 @@ template(`userdom_admin_user_template',`
optional_policy(`
userhelper_exec($1_t)
')

6
recipes-security/refpolicy/refpolicy/0040-policy-modules-system-logging-grant-getpcap-capabili.patch → recipes-security/refpolicy/refpolicy/0038-policy-modules-system-logging-grant-getpcap-capabili.patch
View File

@ -1,4 +1,4 @@
From f48edb588d799a7aab9110e4f67468d8e5e41c10 Mon Sep 17 00:00:00 2001
From c54c53f8765c4401aa4c1b4a6204c8b538c008ad Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Tue, 28 May 2024 11:21:48 +0800
Subject: [PATCH] policy/modules/system/logging: grant getpcap capability to
@ -21,10 +21,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 511604493..9c0a58aef 100644
index df6095805..086498936 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -404,6 +404,8 @@ optional_policy(`
@@ -402,6 +402,8 @@ optional_policy(`
# sys_admin for the integrated klog of syslog-ng and metalog
# sys_nice for rsyslog
allow syslogd_t self:capability { chown dac_override fsetid setgid setuid sys_admin sys_nice sys_resource sys_tty_config };

13
recipes-security/refpolicy/refpolicy/0057-Allow-services-to-read-tmpfs-under-run-credentials.patch → recipes-security/refpolicy/refpolicy/0039-policy-modules-system-allow-services-to-read-tmpfs-u.patch
View File

@ -1,7 +1,8 @@
From be681d155c6c62a2ec4939dedc921921fe73e277 Mon Sep 17 00:00:00 2001
From 33bc8d28c406ffd7a6aef2f390734b3f5bdfc5a3 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 30 Aug 2024 12:39:48 +0800
Subject: [PATCH] Allow services to read tmpfs under /run/credentials/
Subject: [PATCH] policy/modules/system: allow services to read tmpfs under
/run/credentials/
$ mount | grep credentials
tmpfs on /run/credentials/systemd-journald.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,seclabel,size=1024k,nr_inodes=1024,mode=700,noswap)
@ -66,10 +67,10 @@ index a900226bf..75b94785b 100644
mcs_process_set_categories(getty_t)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index fc73825fa..d5878876b 100644
index 086498936..dca46f105 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -495,6 +495,7 @@ files_read_kernel_symbol_table(syslogd_t)
@@ -491,6 +491,7 @@ files_read_kernel_symbol_table(syslogd_t)
files_var_lib_filetrans(syslogd_t, syslogd_var_lib_t, { file dir })
fs_getattr_all_fs(syslogd_t)
@ -78,10 +79,10 @@ index fc73825fa..d5878876b 100644
mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 22a319c36..0440b4795 100644
index 9375e8926..24fc90838 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1303,6 +1303,7 @@ files_watch_root_dirs(systemd_networkd_t)
@@ -1294,6 +1294,7 @@ files_watch_root_dirs(systemd_networkd_t)
files_list_runtime(systemd_networkd_t)
fs_getattr_all_fs(systemd_networkd_t)

39
recipes-security/refpolicy/refpolicy/0040-policy-modules-kernel-domain-allow-all-domains-to-co.patch Normal file
View File

@ -0,0 +1,39 @@
From 58adf54a5ef927cda85c11e2c73151d6e91e8294 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Thu, 3 Oct 2024 21:12:33 +0800
Subject: [PATCH] policy/modules/kernel/domain: allow all domains to connect to
systemd-nsresourced over a unix socket
Refer to Fedora selinux policy[1], allow all domains to connect to
systemd-nsresourced over a unix socket.
As said in [2]: Each subsystem that needs to define users and groups on
the local system is supposed to implement this API, and offer its
interfaces on a Varlink AF_UNIX/SOCK_STREAM file system socket bound
into the /run/systemd/userdb/ directory.
[1] https://github.com/fedora-selinux/selinux-policy/commit/8c784a48c0833a83de9d2d120f4cb76f0d87895c
[2] https://systemd.io/USER_GROUP_API/
Upstream-Status: Pending
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
policy/modules/kernel/domain.te | 1 +
1 file changed, 1 insertion(+)
diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
index 0f38015b6..e3eee0590 100644
--- a/policy/modules/kernel/domain.te
+++ b/policy/modules/kernel/domain.te
@@ -131,6 +131,7 @@ files_list_root(domain)
ifdef(`init_systemd',`
optional_policy(`
shutdown_sigchld(domain)
+ systemd_stream_connect_nsresourced(domain)
')
')
--
2.25.1

6
recipes-security/refpolicy/refpolicy/0041-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
View File

@ -1,4 +1,4 @@
From 53a770736133d84be9cab23732811f96304bf737 Mon Sep 17 00:00:00 2001
From fe5fe08deab5f02a3609e5333e09e5e3af05140a Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Sat, 15 Feb 2014 04:22:47 -0500
Subject: [PATCH] policy/modules/system/mount: make mount_t domain MLS trusted
@ -19,10 +19,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
index 8cd51d563..3fc37619e 100644
index d9e431a84..20d6aaba1 100644
--- a/policy/modules/system/mount.te
+++ b/policy/modules/system/mount.te
@@ -117,6 +117,7 @@ fs_dontaudit_write_all_image_files(mount_t)
@@ -118,6 +118,7 @@ fs_dontaudit_write_all_image_files(mount_t)
mls_file_read_all_levels(mount_t)
mls_file_write_all_levels(mount_t)

4
recipes-security/refpolicy/refpolicy/0042-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
View File

@ -1,4 +1,4 @@
From 93225203c2a3a767cd1319d6620da1fd1f91b25f Mon Sep 17 00:00:00 2001
From 7a0339aeba7cfe38b62c81ee4074446bba60e801 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Mon, 28 Jan 2019 14:05:18 +0800
Subject: [PATCH] policy/modules/roles/sysadm: MLS - sysadm rw to clearance
@ -23,7 +23,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index c08226dc3..4f3207d52 100644
index af5ccca9d..10cebdc53 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -48,6 +48,8 @@ logging_watch_all_logs(sysadm_t)

8
recipes-security/refpolicy/refpolicy/0043-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
View File

@ -1,4 +1,4 @@
From 3b260a0dc07f61b9bf873a8ac976430c80a653c3 Mon Sep 17 00:00:00 2001
From a563f59fe223aa9c74df7a482b5da80ce05fbbf5 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Fri, 23 Aug 2013 12:01:53 +0800
Subject: [PATCH] policy/modules/services/rpc: make nfsd_t domain MLS trusted
@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2 files changed, 7 insertions(+)
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index 887ca3332..f6ca775e6 100644
index 8fd1875d3..6c35a2374 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -380,6 +380,8 @@ mls_process_read_all_levels(kernel_t)
@@ -381,6 +381,8 @@ mls_process_read_all_levels(kernel_t)
mls_process_write_all_levels(kernel_t)
mls_file_write_all_levels(kernel_t)
mls_file_read_all_levels(kernel_t)
@ -28,7 +28,7 @@ index 887ca3332..f6ca775e6 100644
ifdef(`distro_redhat',`
# Bugzilla 222337
diff --git a/policy/modules/services/rpcbind.te b/policy/modules/services/rpcbind.te
index 2a712192b..923e48db7 100644
index 137c21ece..d2ee1edcf 100644
--- a/policy/modules/services/rpcbind.te
+++ b/policy/modules/services/rpcbind.te
@@ -73,6 +73,11 @@ logging_send_syslog_msg(rpcbind_t)

2
recipes-security/refpolicy/refpolicy/0044-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
View File

@ -1,4 +1,4 @@
From faad8b18adb9a4f155ec0ec6317522baffff9117 Mon Sep 17 00:00:00 2001
From 6bd19ab1f6adac7722ef35c70982efea04b5d91f Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Tue, 30 Jun 2020 10:18:20 +0800
Subject: [PATCH] policy/modules/admin/dmesg: make dmesg_t MLS trusted reading

6
recipes-security/refpolicy/refpolicy/0045-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
View File

@ -1,4 +1,4 @@
From 2892de4636a61c237688d73c277edbf7a46163ab Mon Sep 17 00:00:00 2001
From a196f11f4a7f2f96cbf05614513204ca17aa0691 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Fri, 13 Oct 2017 07:20:40 +0000
Subject: [PATCH] policy/modules/kernel/kernel: make kernel_t MLS trusted for
@ -59,10 +59,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index f6ca775e6..b4b089823 100644
index 6c35a2374..ebde22e02 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -382,6 +382,8 @@ mls_file_write_all_levels(kernel_t)
@@ -383,6 +383,8 @@ mls_file_write_all_levels(kernel_t)
mls_file_read_all_levels(kernel_t)
mls_socket_write_all_levels(kernel_t)
mls_fd_use_all_levels(kernel_t)

4
recipes-security/refpolicy/refpolicy/0046-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
View File

@ -1,4 +1,4 @@
From f2ff5081b1a98272c803ccfd24aeea91e8d5c368 Mon Sep 17 00:00:00 2001
From 777e396d61c3af7b847fcc9ebc490f1e5f3969b9 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Fri, 15 Jan 2016 03:47:05 -0500
Subject: [PATCH] policy/modules/system/init: make init_t MLS trusted for
@ -27,7 +27,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 4 insertions(+)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 809019873..be9c75155 100644
index e724c295e..6ffdb547f 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -238,6 +238,10 @@ mls_process_write_all_levels(init_t)

6
recipes-security/refpolicy/refpolicy/0047-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
View File

@ -1,4 +1,4 @@
From 3fab5273a7721e603f2034badeaf73949aaa59a2 Mon Sep 17 00:00:00 2001
From f87ab013d4dffe5b588376b73c51fbfc5e9b1205 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Thu, 4 Feb 2016 06:03:19 -0500
Subject: [PATCH] policy/modules/system/systemd: make systemd-tmpfiles_t domain
@ -43,10 +43,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 5 insertions(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 03aeb8515..e483d8aea 100644
index 24fc90838..dc3badece 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1877,6 +1877,11 @@ sysnet_relabel_config(systemd_tmpfiles_t)
@@ -1970,6 +1970,11 @@ sysnet_relabel_config(systemd_tmpfiles_t)
systemd_log_parse_environment(systemd_tmpfiles_t)

12
recipes-security/refpolicy/refpolicy/0048-policy-modules-system-systemd-systemd-make-systemd_-.patch
View File

@ -1,4 +1,4 @@
From 4eaa766ef11cb053f010bcde5121e76031aae799 Mon Sep 17 00:00:00 2001
From ec080f2b0b18b29e46bded08a0880624e5380026 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Thu, 18 Jun 2020 09:59:58 +0800
Subject: [PATCH] policy/modules/system/systemd: systemd-*: make systemd_*_t
@ -43,10 +43,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 12 insertions(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index e483d8aea..a0e6bb405 100644
index dc3badece..0440b4795 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -391,6 +391,9 @@ files_search_var_lib(systemd_backlight_t)
@@ -430,6 +430,9 @@ files_search_var_lib(systemd_backlight_t)
fs_getattr_all_fs(systemd_backlight_t)
fs_search_cgroup_dirs(systemd_backlight_t)
@ -56,7 +56,7 @@ index e483d8aea..a0e6bb405 100644
#######################################
#
# Binfmt local policy
@@ -560,6 +563,9 @@ term_use_unallocated_ttys(systemd_generator_t)
@@ -603,6 +606,9 @@ term_use_unallocated_ttys(systemd_generator_t)
udev_read_runtime_files(systemd_generator_t)
@ -66,7 +66,7 @@ index e483d8aea..a0e6bb405 100644
ifdef(`distro_gentoo',`
corecmd_shell_entry_type(systemd_generator_t)
')
@@ -1009,6 +1015,9 @@ userdom_setattr_user_ttys(systemd_logind_t)
@@ -1058,6 +1064,9 @@ userdom_setattr_user_ttys(systemd_logind_t)
userdom_use_user_ttys(systemd_logind_t)
domain_read_all_domains_state(systemd_logind_t)
@ -76,7 +76,7 @@ index e483d8aea..a0e6bb405 100644
# Needed to work around patch not yet merged into the systemd-logind supported on RHEL 7.x
# The change in systemd by Nicolas Iooss on 02-Feb-2016 with hash 4b51966cf6c06250036e428608da92f8640beb96
# should fix the problem where user directories in /run/user/$UID/ are not getting the proper context
@@ -1591,6 +1600,9 @@ udev_read_runtime_files(systemd_rfkill_t)
@@ -1681,6 +1690,9 @@ udev_read_runtime_files(systemd_rfkill_t)
systemd_log_parse_environment(systemd_rfkill_t)

6
recipes-security/refpolicy/refpolicy/0049-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
View File

@ -1,4 +1,4 @@
From de58aa981e1c05ce06938704089c7c87c765add6 Mon Sep 17 00:00:00 2001
From 564d43016ed6dcbadb7a7203d8d639d0c782d4e7 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] policy/modules/system/logging: add the syslogd_t to trusted
@ -18,10 +18,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 3 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 3cab14381..caf319f04 100644
index dca46f105..cedcaeb36 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -491,6 +491,9 @@ fs_getattr_all_fs(syslogd_t)
@@ -495,6 +495,9 @@ fs_list_tmpfs(syslogd_t)
fs_search_auto_mountpoints(syslogd_t)
mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories

4
recipes-security/refpolicy/refpolicy/0050-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
View File

@ -1,4 +1,4 @@
From a9ceec99a527007a91ba6685d0b86c327fbb6443 Mon Sep 17 00:00:00 2001
From c49b89d2a6cfc33c0e6fe6347609fea09ae7fe2e Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Tue, 28 May 2019 16:41:37 +0800
Subject: [PATCH] policy/modules/system/init: make init_t MLS trusted for
@ -17,7 +17,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index be9c75155..458906ac5 100644
index 6ffdb547f..8bd8e2f63 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -237,6 +237,7 @@ mls_file_write_all_levels(init_t)

4
recipes-security/refpolicy/refpolicy/0051-policy-modules-system-init-all-init_t-to-read-any-le.patch
View File

@ -1,4 +1,4 @@
From 980d9d3f3c3e1e3517971715c351ec7b747105d0 Mon Sep 17 00:00:00 2001
From f8b5f66dd987609027d8e0381338e39b52a47138 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Wed, 3 Feb 2016 04:16:06 -0500
Subject: [PATCH] policy/modules/system/init: all init_t to read any level
@ -22,7 +22,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 3 insertions(+)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 458906ac5..c2380d8b4 100644
index 8bd8e2f63..8af34aa7e 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -243,6 +243,9 @@ mls_key_write_all_levels(init_t)

6
recipes-security/refpolicy/refpolicy/0052-policy-modules-system-logging-allow-auditd_t-to-writ.patch
View File

@ -1,4 +1,4 @@
From 2b64eabf0cf8982bbb3c537e84fc3a99085858d3 Mon Sep 17 00:00:00 2001
From d6573102f922b0e08d49cb5582612dfbaae10600 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Thu, 25 Feb 2016 04:25:08 -0500
Subject: [PATCH] policy/modules/system/logging: allow auditd_t to write socket
@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index caf319f04..25e1d1397 100644
index cedcaeb36..1b181f7cc 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -235,6 +235,8 @@ miscfiles_read_localization(auditd_t)
@@ -236,6 +236,8 @@ miscfiles_read_localization(auditd_t)
mls_file_read_all_levels(auditd_t)
mls_file_write_all_levels(auditd_t) # Need to be able to write to /var/run/ directory

6
recipes-security/refpolicy/refpolicy/0053-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
View File

@ -1,4 +1,4 @@
From 35351cd7cb07622b5e43254b95d7801a5669358d Mon Sep 17 00:00:00 2001
From 6b77c79af18f6dba52b7a63a7a2aefdd48c0fd33 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Thu, 31 Oct 2019 17:35:59 +0800
Subject: [PATCH] policy/modules/kernel/kernel: make kernel_t MLS trusted for
@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index b4b089823..5835d28b2 100644
index ebde22e02..60e805cb8 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -384,6 +384,7 @@ mls_socket_write_all_levels(kernel_t)
@@ -385,6 +385,7 @@ mls_socket_write_all_levels(kernel_t)
mls_fd_use_all_levels(kernel_t)
# https://bugzilla.redhat.com/show_bug.cgi?id=667370
mls_file_downgrade(kernel_t)

4
recipes-security/refpolicy/refpolicy/0054-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
View File

@ -1,4 +1,4 @@
From 6d6e2d34ec63771a01ef258c98f1ad49efdc2f67 Mon Sep 17 00:00:00 2001
From 03e4c0afc4a0aa432b30e9b5e8abbe069871fb9e Mon Sep 17 00:00:00 2001
From: Roy Li <rongqing.li@windriver.com>
Date: Sat, 22 Feb 2014 13:35:38 +0800
Subject: [PATCH] policy/modules/system/setrans: allow setrans_t use fd at any
@ -13,7 +13,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/setrans.te b/policy/modules/system/setrans.te
index 12e66aad9..5510f7fac 100644
index 0a87a8d70..738badc52 100644
--- a/policy/modules/system/setrans.te
+++ b/policy/modules/system/setrans.te
@@ -69,6 +69,8 @@ mls_net_receive_all_levels(setrans_t)

6
recipes-security/refpolicy/refpolicy/0055-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
View File

@ -1,4 +1,4 @@
From 3d5751659380eb04b63f8fc1e6113132dd1310d7 Mon Sep 17 00:00:00 2001
From 1ca4caa4600e9b742f0c7816efe8cff153fe412a Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Mon, 22 Feb 2021 11:28:12 +0800
Subject: [PATCH] policy/modules/system/systemd: make *_systemd_t MLS trusted
@ -24,10 +24,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 3 insertions(+)
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
index d7219dc37..7717e0034 100644
index 96b5d31b4..07c506e1c 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -226,6 +226,9 @@ template(`systemd_role_template',`
@@ -228,6 +228,9 @@ template(`systemd_role_template',`
xdg_read_config_files($1_systemd_t)
xdg_read_data_files($1_systemd_t)
')

6
recipes-security/refpolicy/refpolicy/0056-policy-modules-system-logging-make-syslogd_runtime_t.patch
View File

@ -1,4 +1,4 @@
From 2476910f6d7f116148bb9311498b5c98692c1ef3 Mon Sep 17 00:00:00 2001
From 8e5a17676c9976d163b70edd31834c4e16405ed9 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Sat, 18 Dec 2021 17:31:45 +0800
Subject: [PATCH] policy/modules/system/logging: make syslogd_runtime_t MLS
@ -31,10 +31,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 25e1d1397..ba0fd10e0 100644
index 1b181f7cc..d5878876b 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -456,6 +456,8 @@ allow syslogd_t syslogd_runtime_t:file map;
@@ -459,6 +459,8 @@ allow syslogd_t syslogd_runtime_t:file map;
manage_files_pattern(syslogd_t, syslogd_runtime_t, syslogd_runtime_t)
files_runtime_filetrans(syslogd_t, syslogd_runtime_t, file)

15
recipes-security/refpolicy/refpolicy_common.inc
View File

@ -48,12 +48,14 @@ SRC_URI += " \
file://0030-policy-modules-kernel-files-add-rules-for-the-symlin.patch \
file://0031-policy-modules-system-logging-fix-auditd-startup-fai.patch \
file://0032-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch \
file://0034-policy-modules-system-systemd-enable-support-for-sys.patch \
file://0035-policy-modules-system-logging-allow-systemd-tmpfiles.patch \
file://0036-policy-modules-system-systemd-allow-systemd_logind_t.patch \
file://0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch \
file://0038-policy-modules-system-systemd-systemd-user-fixes.patch \
file://0040-policy-modules-system-logging-grant-getpcap-capabili.patch \
file://0033-policy-modules-system-systemd-enable-support-for-sys.patch \
file://0034-policy-modules-system-logging-allow-systemd-tmpfiles.patch \
file://0035-policy-modules-system-systemd-allow-systemd_logind_t.patch \
file://0036-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch \
file://0037-policy-modules-system-systemd-systemd-user-fixes.patch \
file://0038-policy-modules-system-logging-grant-getpcap-capabili.patch \
file://0039-policy-modules-system-allow-services-to-read-tmpfs-u.patch \
file://0040-policy-modules-kernel-domain-allow-all-domains-to-co.patch \
file://0041-policy-modules-system-mount-make-mount_t-domain-MLS-.patch \
file://0042-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch \
file://0043-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch \
@ -70,7 +72,6 @@ SRC_URI += " \
file://0054-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \
file://0055-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \
file://0056-policy-modules-system-logging-make-syslogd_runtime_t.patch \
file://0057-Allow-services-to-read-tmpfs-under-run-credentials.patch \
"
S = "${WORKDIR}/refpolicy"

4
recipes-security/refpolicy/refpolicy_git.inc
View File

@ -1,8 +1,8 @@
PV = "2.20240226+git"
PV = "2.20240916+git"
SRC_URI = "git://github.com/SELinuxProject/refpolicy.git;protocol=https;branch=main;name=refpolicy;destsuffix=refpolicy"
SRCREV_refpolicy ?= "351a5a7f4dc959769aaa8fe47c6e77f94fe5b657"
SRCREV_refpolicy ?= "741dc96eb7e737bc2f00b7f4b4b394a66d32d913"
UPSTREAM_CHECK_GITTAGREGEX = "RELEASE_(?P<pver>\d+_\d+)"