summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorXin Ouyang <Xin.Ouyang@windriver.com>2013-09-23 21:18:04 +0800
committerJoe MacDonald <joe@deserted.net>2013-10-02 13:24:45 -0400
commit20153c8810cecc31873fbe14bb1695a85b77cef4 (patch)
treeaed65a5afc3a6e3fbe4e6f7cc7b33e6c64c18660
parent292e6f4ac670d2f5ae5dbb53d6c7c265f006975d (diff)
downloadmeta-selinux-20153c8810cecc31873fbe14bb1695a85b77cef4.tar.gz
refpolicy*: remove old version recipes and patches.
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
Diffstat
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-cgroup.patch26
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-clock.patch22
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-corecommands.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-dmesg.patch20
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-bind.patch36
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-portmap.patch34
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-prefix-path_rpc.patch43
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-real-path_login.patch37
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-real-path_resolv.conf.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-real-path_shadow.patch34
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fstools.patch65
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-iptables.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-mta.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-netutils.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-networkmanager.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-nscd.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-screen.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-ssh.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-su.patch23
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-subs_dist.patch31
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-sysnetwork.patch41
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_hostname.patch20
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_sysklogd.patch55
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_sysvinit.patch47
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_tinylogin.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-bsdpty_device_t.patch118
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-tmp-symlink.patch96
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-var-cache-symlink.patch509
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-var-log-symlink-apache.patch28
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-var-log-symlink.patch140
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-syslogd_t-to-trusted-object.patch28
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-dbusd-to-exec-shell-commands.patch25
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-dbusd-to-setrlimit-itself.patch29
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-nfsd-to-bind-nfs-port.patch63
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-nfsd-to-exec-shell-commands.patch67
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-setfiles_t-to-read-symlinks.patch26
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-don-t-audit-tty_device_t.patch32
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-new-SELINUXMNT-in-sys.patch213
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch70
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-seutils-manage-config-files.patch39
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-xconsole_device_t-as-a-dev_node.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-mls_2.20120725.bb24
-rw-r--r--recipes-security/refpolicy/refpolicy-standard_2.20120725.bb18
-rw-r--r--recipes-security/refpolicy/refpolicy_2.20120725.inc57
44 files changed, 0 insertions, 2380 deletions
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-cgroup.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-cgroup.patch
deleted file mode 100644
index e5cfaa1..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-cgroup.patch
+++ /dev/null
@@ -1,26 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for cgroup
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/cgroup.fc | 3 +++
8 1 file changed, 3 insertions(+)
9
10diff --git a/policy/modules/contrib/cgroup.fc b/policy/modules/contrib/cgroup.fc
11index b6bb46c..e214727 100644
12--- a/policy/modules/contrib/cgroup.fc
13+++ b/policy/modules/contrib/cgroup.fc
14@@ -10,6 +10,9 @@
15 /sbin/cgconfigparser -- gen_context(system_u:object_r:cgconfig_exec_t,s0)
16 /sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0)
17 /sbin/cgclear -- gen_context(system_u:object_r:cgclear_exec_t,s0)
18+/usr/sbin/cgconfigparser -- gen_context(system_u:object_r:cgconfig_exec_t,s0)
19+/usr/sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0)
20+/usr/sbin/cgclear -- gen_context(system_u:object_r:cgclear_exec_t,s0)
21
22 /var/log/cgrulesengd\.log -- gen_context(system_u:object_r:cgred_log_t,s0)
23 /var/run/cgred.* gen_context(system_u:object_r:cgred_var_run_t,s0)
24--
251.7.11.7
26
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-clock.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-clock.patch
deleted file mode 100644
index 3ff8f55..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-clock.patch
+++ /dev/null
@@ -1,22 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for clock
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/clock.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/system/clock.fc b/policy/modules/system/clock.fc
11index c5e05ca..a74c40c 100644
12--- a/policy/modules/system/clock.fc
13+++ b/policy/modules/system/clock.fc
14@@ -2,4 +2,5 @@
15 /etc/adjtime -- gen_context(system_u:object_r:adjtime_t,s0)
16
17 /sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)
18+/sbin/hwclock\.util-linux -- gen_context(system_u:object_r:hwclock_exec_t,s0)
19
20--
211.7.11.7
22
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-corecommands.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-corecommands.patch
deleted file mode 100644
index 24b67c3..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-corecommands.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for corecommands
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/kernel/corecommands.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
11index f051c4a..ab624f3 100644
12--- a/policy/modules/kernel/corecommands.fc
13+++ b/policy/modules/kernel/corecommands.fc
14@@ -153,6 +153,7 @@ ifdef(`distro_gentoo',`
15 /sbin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0)
16 /sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0)
17 /sbin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
18+/usr/sbin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
19
20 #
21 # /opt
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-dmesg.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-dmesg.patch
deleted file mode 100644
index db4c4d4..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-dmesg.patch
+++ /dev/null
@@ -1,20 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for dmesg
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/dmesg.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/admin/dmesg.fc b/policy/modules/admin/dmesg.fc
11index d6cc2d9..7f3e5b0 100644
12--- a/policy/modules/admin/dmesg.fc
13+++ b/policy/modules/admin/dmesg.fc
14@@ -1,2 +1,3 @@
15
16 /bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)
17+/bin/dmesg\.util-linux -- gen_context(system_u:object_r:dmesg_exec_t,s0)
18--
191.7.11.7
20
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-bind.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-bind.patch
deleted file mode 100644
index 95ed172..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-bind.patch
+++ /dev/null
@@ -1,36 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for bind.
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/bind.fc | 9 +++++++++
8 1 file changed, 9 insertions(+)
9
10diff --git a/policy/modules/contrib/bind.fc b/policy/modules/contrib/bind.fc
11index 59aa54f..3275671 100644
12--- a/policy/modules/contrib/bind.fc
13+++ b/policy/modules/contrib/bind.fc
14@@ -1,10 +1,19 @@
15 /etc/rc\.d/init\.d/named -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
16+/etc/rc\.d/init\.d/bind -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
17 /etc/rc\.d/init\.d/unbound -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
18
19 /etc/rndc.* -- gen_context(system_u:object_r:named_conf_t,s0)
20 /etc/rndc\.key -- gen_context(system_u:object_r:dnssec_t,s0)
21 /etc/unbound(/.*)? gen_context(system_u:object_r:named_conf_t,s0)
22
23+/etc/bind(/.*)? gen_context(system_u:object_r:named_zone_t,s0)
24+/etc/bind/named\.conf -- gen_context(system_u:object_r:named_conf_t,s0)
25+/etc/bind/named\.conf\.local -- gen_context(system_u:object_r:named_conf_t,s0)
26+/etc/bind/named\.conf\.options -- gen_context(system_u:object_r:named_conf_t,s0)
27+/etc/bind/rndc\.conf -- gen_context(system_u:object_r:named_conf_t,s0)
28+/etc/bind/rndc\.key -- gen_context(system_u:object_r:dnssec_t,s0)
29+/var/cache/bind(/.*)? gen_context(system_u:object_r:named_cache_t,s0)
30+
31 /usr/sbin/lwresd -- gen_context(system_u:object_r:named_exec_t,s0)
32 /usr/sbin/named -- gen_context(system_u:object_r:named_exec_t,s0)
33 /usr/sbin/named-checkconf -- gen_context(system_u:object_r:named_checkconf_exec_t,s0)
34--
351.7.9.5
36
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-portmap.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-portmap.patch
deleted file mode 100644
index 25d449d..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-portmap.patch
+++ /dev/null
@@ -1,34 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for portmap.
2
3Fix file contexts for portmap files to match the oe-core install
4paths.
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/portmap.fc | 7 ++-----
11 1 file changed, 2 insertions(+), 5 deletions(-)
12
13diff --git a/policy/modules/contrib/portmap.fc b/policy/modules/contrib/portmap.fc
14index 3cdcd9f..3faf697 100644
15--- a/policy/modules/contrib/portmap.fc
16+++ b/policy/modules/contrib/portmap.fc
17@@ -5,12 +5,9 @@ ifdef(`distro_debian',`
18 /sbin/pmap_dump -- gen_context(system_u:object_r:portmap_helper_exec_t,s0)
19 /sbin/pmap_set -- gen_context(system_u:object_r:portmap_helper_exec_t,s0)
20 ', `
21-/usr/sbin/pmap_dump -- gen_context(system_u:object_r:portmap_helper_exec_t,s0)
22-/usr/sbin/pmap_set -- gen_context(system_u:object_r:portmap_helper_exec_t,s0)
23+/sbin/pmap_dump -- gen_context(system_u:object_r:portmap_helper_exec_t,s0)
24+/sbin/pmap_set -- gen_context(system_u:object_r:portmap_helper_exec_t,s0)
25 ')
26
27 /var/run/portmap\.upgrade-state -- gen_context(system_u:object_r:portmap_var_run_t,s0)
28-
29-ifdef(`distro_debian',`
30 /var/run/portmap_mapping -- gen_context(system_u:object_r:portmap_var_run_t,s0)
31-')
32--
331.7.9.5
34
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-prefix-path_rpc.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-prefix-path_rpc.patch
deleted file mode 100644
index ef7287c..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-prefix-path_rpc.patch
+++ /dev/null
@@ -1,43 +0,0 @@
1Subject: [PATCH] fc: fix prefix path for rpc*
2
3rpc* packages have installed files with the /usr prefix in poky, so fix
4file contexts for them.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/rpc.fc | 4 ++--
11 policy/modules/contrib/rpcbind.fc | 2 +-
12 2 files changed, 3 insertions(+), 3 deletions(-)
13
14diff --git a/policy/modules/contrib/rpc.fc b/policy/modules/contrib/rpc.fc
15index 5c70c0c..52db849 100644
16--- a/policy/modules/contrib/rpc.fc
17+++ b/policy/modules/contrib/rpc.fc
18@@ -9,8 +9,8 @@
19 #
20 # /sbin
21 #
22-/sbin/rpc\..* -- gen_context(system_u:object_r:rpcd_exec_t,s0)
23-/sbin/sm-notify -- gen_context(system_u:object_r:rpcd_exec_t,s0)
24+/usr/sbin/rpc\..* -- gen_context(system_u:object_r:rpcd_exec_t,s0)
25+/usr/sbin/sm-notify -- gen_context(system_u:object_r:rpcd_exec_t,s0)
26
27 #
28 # /usr
29diff --git a/policy/modules/contrib/rpcbind.fc b/policy/modules/contrib/rpcbind.fc
30index f5c47d6..3cd9e62 100644
31--- a/policy/modules/contrib/rpcbind.fc
32+++ b/policy/modules/contrib/rpcbind.fc
33@@ -1,6 +1,6 @@
34 /etc/rc\.d/init\.d/rpcbind -- gen_context(system_u:object_r:rpcbind_initrc_exec_t,s0)
35
36-/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0)
37+/usr/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0)
38
39 /var/lib/rpcbind(/.*)? gen_context(system_u:object_r:rpcbind_var_lib_t,s0)
40
41--
421.7.5.4
43
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-real-path_login.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-real-path_login.patch
deleted file mode 100644
index 427181e..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-real-path_login.patch
+++ /dev/null
@@ -1,37 +0,0 @@
1Subject: [PATCH] fix real path for login commands.
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/authlogin.fc | 7 ++++---
8 1 files changed, 4 insertions(+), 3 deletions(-)
9
10diff --git a/policy/modules/system/authlogin.fc b/policy/modules/system/authlogin.fc
11index 28ad538..c8dd17f 100644
12--- a/policy/modules/system/authlogin.fc
13+++ b/policy/modules/system/authlogin.fc
14@@ -1,5 +1,7 @@
15
16 /bin/login -- gen_context(system_u:object_r:login_exec_t,s0)
17+/bin/login\.shadow -- gen_context(system_u:object_r:login_exec_t,s0)
18+/bin/login\.tinylogin -- gen_context(system_u:object_r:login_exec_t,s0)
19
20 /etc/\.pwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
21 /etc/group\.lock -- gen_context(system_u:object_r:shadow_t,s0)
22@@ -9,9 +11,9 @@
23
24 /sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0)
25 /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
26-/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
27-/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
28-/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
29+/usr/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
30+/usr/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
31+/usr/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
32 ifdef(`distro_suse', `
33 /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
34 ')
35--
361.7.5.4
37
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-real-path_resolv.conf.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-real-path_resolv.conf.patch
deleted file mode 100644
index 80cca67..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-real-path_resolv.conf.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] fix real path for resolv.conf
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/sysnetwork.fc | 1 +
8 1 files changed, 1 insertions(+), 0 deletions(-)
9
10diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
11index 346a7cc..dec8632 100644
12--- a/policy/modules/system/sysnetwork.fc
13+++ b/policy/modules/system/sysnetwork.fc
14@@ -24,6 +24,7 @@ ifdef(`distro_debian',`
15 /etc/hosts\.deny.* -- gen_context(system_u:object_r:net_conf_t,s0)
16 /etc/denyhosts.* -- gen_context(system_u:object_r:net_conf_t,s0)
17 /etc/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
18+/var/run/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
19 /etc/yp\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
20
21 /etc/dhcp3(/.*)? gen_context(system_u:object_r:dhcp_etc_t,s0)
22--
231.7.5.4
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-real-path_shadow.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-real-path_shadow.patch
deleted file mode 100644
index 29ac2c3..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fix-real-path_shadow.patch
+++ /dev/null
@@ -1,34 +0,0 @@
1Subject: [PATCH] fix real path for shadow commands.
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/usermanage.fc | 6 ++++++
8 1 file changed, 6 insertions(+)
9
10diff --git a/policy/modules/admin/usermanage.fc b/policy/modules/admin/usermanage.fc
11index f82f0ce..841ba9b 100644
12--- a/policy/modules/admin/usermanage.fc
13+++ b/policy/modules/admin/usermanage.fc
14@@ -4,11 +4,17 @@ ifdef(`distro_gentoo',`
15
16 /usr/bin/chage -- gen_context(system_u:object_r:passwd_exec_t,s0)
17 /usr/bin/chfn -- gen_context(system_u:object_r:chfn_exec_t,s0)
18+/usr/bin/chfn\.shadow -- gen_context(system_u:object_r:chfn_exec_t,s0)
19 /usr/bin/chsh -- gen_context(system_u:object_r:chfn_exec_t,s0)
20+/usr/bin/chsh\.shadow -- gen_context(system_u:object_r:chfn_exec_t,s0)
21 /usr/bin/gpasswd -- gen_context(system_u:object_r:groupadd_exec_t,s0)
22 /usr/bin/passwd -- gen_context(system_u:object_r:passwd_exec_t,s0)
23+/usr/bin/passwd\.shadow -- gen_context(system_u:object_r:passwd_exec_t,s0)
24+/usr/bin/passwd\.tinylogin -- gen_context(system_u:object_r:passwd_exec_t,s0)
25 /usr/bin/vigr -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
26+/sbin/vigr\.shadow -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
27 /usr/bin/vipw -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
28+/sbin/vipw\.shadow -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
29
30 /usr/lib/cracklib_dict.* -- gen_context(system_u:object_r:crack_db_t,s0)
31
32--
331.7.9.5
34
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fstools.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fstools.patch
deleted file mode 100644
index b74f8d3..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fstools.patch
+++ /dev/null
@@ -1,65 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for fstools
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/fstools.fc | 11 +++++++++++
8 1 file changed, 11 insertions(+)
9
10diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
11index a97a096..d996b29 100644
12--- a/policy/modules/system/fstools.fc
13+++ b/policy/modules/system/fstools.fc
14@@ -1,6 +1,8 @@
15 /sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
16 /sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
17+/sbin/blkid\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
18 /sbin/blockdev -- gen_context(system_u:object_r:fsadm_exec_t,s0)
19+/sbin/blockdev\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
20 /sbin/cfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
21 /sbin/dosfsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
22 /sbin/dump -- gen_context(system_u:object_r:fsadm_exec_t,s0)
23@@ -9,9 +11,12 @@
24 /sbin/e4fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
25 /sbin/e2label -- gen_context(system_u:object_r:fsadm_exec_t,s0)
26 /sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
27+/sbin/fdisk\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
28 /sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
29+/usr/sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
30 /sbin/fsck.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
31 /sbin/hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
32+/sbin/hdparm\.hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
33 /sbin/install-mbr -- gen_context(system_u:object_r:fsadm_exec_t,s0)
34 /sbin/jfs_.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
35 /sbin/losetup.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
36@@ -24,20 +29,26 @@
37 /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
38 /sbin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
39 /sbin/mkswap -- gen_context(system_u:object_r:fsadm_exec_t,s0)
40+/sbin/mkswap\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
41 /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
42+/usr/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
43 /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
44+/usr/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
45 /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
46+/usr/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
47 /sbin/raidautorun -- gen_context(system_u:object_r:fsadm_exec_t,s0)
48 /sbin/raidstart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
49 /sbin/reiserfs(ck|tune) -- gen_context(system_u:object_r:fsadm_exec_t,s0)
50 /sbin/resize.*fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
51 /sbin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0)
52 /sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
53+/usr/sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
54 /sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
55 /sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
56
57 /usr/bin/partition_uuid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
58 /usr/bin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0)
59+/usr/sbin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0)
60 /usr/bin/scsi_unique_id -- gen_context(system_u:object_r:fsadm_exec_t,s0)
61 /usr/bin/syslinux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
62
63--
641.7.11.7
65
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-iptables.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-iptables.patch
deleted file mode 100644
index 89b1547..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-iptables.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for iptables
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/iptables.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
11index 14cffd2..84ac92b 100644
12--- a/policy/modules/system/iptables.fc
13+++ b/policy/modules/system/iptables.fc
14@@ -13,6 +13,7 @@
15 /sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
16 /sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
17 /sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
18+/usr/sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
19
20 /usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
21 /usr/sbin/iptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-mta.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-mta.patch
deleted file mode 100644
index 3b4da9e..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-mta.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for mta
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/mta.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/contrib/mta.fc b/policy/modules/contrib/mta.fc
11index afa18c8..aeea97a 100644
12--- a/policy/modules/contrib/mta.fc
13+++ b/policy/modules/contrib/mta.fc
14@@ -18,6 +18,7 @@ ifdef(`distro_redhat',`
15
16 /usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
17 /usr/sbin/sendmail\.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0)
18+/usr/bin/msmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
19 /usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0)
20 /usr/sbin/ssmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
21
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-netutils.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-netutils.patch
deleted file mode 100644
index b45d03e..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-netutils.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for netutils
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/netutils.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/admin/netutils.fc b/policy/modules/admin/netutils.fc
11index 407078f..f2ed3dc 100644
12--- a/policy/modules/admin/netutils.fc
13+++ b/policy/modules/admin/netutils.fc
14@@ -3,6 +3,7 @@
15 /bin/traceroute.* -- gen_context(system_u:object_r:traceroute_exec_t,s0)
16
17 /sbin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
18+/bin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
19
20 /usr/bin/lft -- gen_context(system_u:object_r:traceroute_exec_t,s0)
21 /usr/bin/nmap -- gen_context(system_u:object_r:traceroute_exec_t,s0)
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-networkmanager.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-networkmanager.patch
deleted file mode 100644
index 1da6d22..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-networkmanager.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for networkmanager
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/networkmanager.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/contrib/networkmanager.fc b/policy/modules/contrib/networkmanager.fc
11index 386543b..e0739b5 100644
12--- a/policy/modules/contrib/networkmanager.fc
13+++ b/policy/modules/contrib/networkmanager.fc
14@@ -5,6 +5,7 @@
15 /usr/libexec/nm-dispatcher.action -- gen_context(system_u:object_r:NetworkManager_initrc_exec_t,s0)
16
17 /sbin/wpa_cli -- gen_context(system_u:object_r:wpa_cli_exec_t,s0)
18+/usr/sbin/wpa_cli -- gen_context(system_u:object_r:wpa_cli_exec_t,s0)
19 /sbin/wpa_supplicant -- gen_context(system_u:object_r:NetworkManager_exec_t,s0)
20
21 /usr/s?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0)
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-nscd.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-nscd.patch
deleted file mode 100644
index c347919..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-nscd.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for nscd
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/nscd.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/contrib/nscd.fc b/policy/modules/contrib/nscd.fc
11index 623b731..9e4b3d0 100644
12--- a/policy/modules/contrib/nscd.fc
13+++ b/policy/modules/contrib/nscd.fc
14@@ -1,6 +1,7 @@
15 /etc/rc\.d/init\.d/nscd -- gen_context(system_u:object_r:nscd_initrc_exec_t,s0)
16
17 /usr/sbin/nscd -- gen_context(system_u:object_r:nscd_exec_t,s0)
18+/usr/bin/nscd -- gen_context(system_u:object_r:nscd_exec_t,s0)
19
20 /var/db/nscd(/.*)? gen_context(system_u:object_r:nscd_var_run_t,s0)
21 /var/cache/nscd(/.*)? gen_context(system_u:object_r:nscd_var_run_t,s0)
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-screen.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-screen.patch
deleted file mode 100644
index ff4a2fd..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-screen.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for screen
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/screen.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/contrib/screen.fc b/policy/modules/contrib/screen.fc
11index c8254dd..4a321d1 100644
12--- a/policy/modules/contrib/screen.fc
13+++ b/policy/modules/contrib/screen.fc
14@@ -8,6 +8,7 @@ HOME_DIR/\.screenrc -- gen_context(system_u:object_r:screen_home_t,s0)
15 # /usr
16 #
17 /usr/bin/screen -- gen_context(system_u:object_r:screen_exec_t,s0)
18+/usr/bin/screen-.* -- gen_context(system_u:object_r:screen_exec_t,s0)
19
20 #
21 # /var
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-ssh.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-ssh.patch
deleted file mode 100644
index 9aeb3a2..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-ssh.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for ssh
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/services/ssh.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
11index 078bcd7..9717428 100644
12--- a/policy/modules/services/ssh.fc
13+++ b/policy/modules/services/ssh.fc
14@@ -6,6 +6,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
15 /etc/ssh/ssh_host_rsa_key -- gen_context(system_u:object_r:sshd_key_t,s0)
16
17 /usr/bin/ssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
18+/usr/bin/ssh\.openssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
19 /usr/bin/ssh-agent -- gen_context(system_u:object_r:ssh_agent_exec_t,s0)
20 /usr/bin/ssh-keygen -- gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
21
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-su.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-su.patch
deleted file mode 100644
index 358e4ef..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-su.patch
+++ /dev/null
@@ -1,23 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for su
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/su.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/admin/su.fc b/policy/modules/admin/su.fc
11index 688abc2..a563687 100644
12--- a/policy/modules/admin/su.fc
13+++ b/policy/modules/admin/su.fc
14@@ -1,5 +1,6 @@
15
16 /bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
17+/usr/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
18
19 /usr/(local/)?bin/ksu -- gen_context(system_u:object_r:su_exec_t,s0)
20 /usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0)
21--
221.7.11.7
23
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-subs_dist.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-subs_dist.patch
deleted file mode 100644
index 2eaecdf..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-subs_dist.patch
+++ /dev/null
@@ -1,31 +0,0 @@
1Subject: [PATCH] fix file_contexts.subs_dist for poky
2
3This file is used for Linux distros to define specific pathes
4mapping to the pathes in file_contexts.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 config/file_contexts.subs_dist | 8 ++++++++
11 1 files changed, 8 insertions(+), 0 deletions(-)
12
13diff --git a/config/file_contexts.subs_dist b/config/file_contexts.subs_dist
14index 32b87a4..ebba73d 100644
15--- a/config/file_contexts.subs_dist
16+++ b/config/file_contexts.subs_dist
17@@ -5,3 +5,11 @@
18 /usr/lib32 /usr/lib
19 /usr/lib64 /usr/lib
20 /var/run/lock /var/lock
21+/etc/init.d /etc/rc.d/init.d
22+/var/volatile/log /var/log
23+/var/volatile/run /var/run
24+/var/volatile/cache /var/cache
25+/var/volatile/tmp /var/tmp
26+/var/volatile/lock /var/lock
27+/var/volatile/run/lock /var/lock
28+/www /var/www
29--
301.7.5.4
31
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-sysnetwork.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-sysnetwork.patch
deleted file mode 100644
index e0af6a1..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-sysnetwork.patch
+++ /dev/null
@@ -1,41 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for sysnetwork
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/sysnetwork.fc | 4 ++++
8 1 file changed, 4 insertions(+)
9
10diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
11index dec8632..2e602e4 100644
12--- a/policy/modules/system/sysnetwork.fc
13+++ b/policy/modules/system/sysnetwork.fc
14@@ -3,6 +3,7 @@
15 # /bin
16 #
17 /bin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
18+/sbin/ip\.iproute2 -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
19
20 #
21 # /dev
22@@ -43,13 +44,16 @@ ifdef(`distro_redhat',`
23 /sbin/dhcdbd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
24 /sbin/dhcpcd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
25 /sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
26+/usr/sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
27 /sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
28+/sbin/ifconfig\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
29 /sbin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
30 /sbin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
31 /sbin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
32 /sbin/ipx_internal_net -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
33 /sbin/iwconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
34 /sbin/mii-tool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
35+/sbin/mii-tool\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
36 /sbin/pump -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
37 /sbin/tc -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
38
39--
401.7.11.7
41
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_hostname.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_hostname.patch
deleted file mode 100644
index e647668..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_hostname.patch
+++ /dev/null
@@ -1,20 +0,0 @@
1Subject: [PATCH] fix update-alternatives for hostname
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/hostname.fc | 1 +
8 1 files changed, 1 insertions(+), 0 deletions(-)
9
10diff --git a/policy/modules/system/hostname.fc b/policy/modules/system/hostname.fc
11index 9dfecf7..4003b6d 100644
12--- a/policy/modules/system/hostname.fc
13+++ b/policy/modules/system/hostname.fc
14@@ -1,2 +1,3 @@
15
16 /bin/hostname -- gen_context(system_u:object_r:hostname_exec_t,s0)
17+/bin/hostname\.net-tools -- gen_context(system_u:object_r:hostname_exec_t,s0)
18--
191.7.5.4
20
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_sysklogd.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_sysklogd.patch
deleted file mode 100644
index c3c5fe1..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_sysklogd.patch
+++ /dev/null
@@ -1,55 +0,0 @@
1Subject: [PATCH] fix update-alternatives for sysklogd
2
3/etc/syslog.conf is a symlink to /etc/syslog.conf.sysklogd, so a allow rule
4for syslogd_t to read syslog_conf_t lnk_file is needed.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/system/logging.fc | 4 ++++
11 1 files changed, 4 insertions(+), 0 deletions(-)
12
13diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
14index 02f4c97..3cb65f1 100644
15--- a/policy/modules/system/logging.fc
16+++ b/policy/modules/system/logging.fc
17@@ -2,19 +2,23 @@
18
19 /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
20 /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
21+/etc/syslog.conf\.sysklogd gen_context(system_u:object_r:syslog_conf_t,s0)
22 /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
23 /etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0)
24 /etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
25+/etc/rc\.d/init\.d/syslog\.sysklogd -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
26
27 /sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0)
28 /sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0)
29 /sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)
30 /sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
31 /sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
32+/sbin/klogd\.sysklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
33 /sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
34 /sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
35 /sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
36 /sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
37+/sbin/syslogd\.sysklogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
38 /sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
39
40 /usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
41diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
42index b6b0ddf..a3a25c2 100644
43--- a/policy/modules/system/logging.te
44+++ b/policy/modules/system/logging.te
45@@ -369,6 +369,7 @@ allow syslogd_t self:udp_socket create_socket_perms;
46 allow syslogd_t self:tcp_socket create_stream_socket_perms;
47
48 allow syslogd_t syslog_conf_t:file read_file_perms;
49+allow syslogd_t syslog_conf_t:lnk_file read_file_perms;
50
51 # Create and bind to /dev/log or /var/run/log.
52 allow syslogd_t devlog_t:sock_file manage_sock_file_perms;
53--
541.7.5.4
55
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_sysvinit.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_sysvinit.patch
deleted file mode 100644
index 9e0a71f..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_sysvinit.patch
+++ /dev/null
@@ -1,47 +0,0 @@
1Subject: [PATCH] fix update-alternatives for sysvinit
2
3Upstream-Status: Inappropriate [only for Poky]
4---
5 policy/modules/contrib/shutdown.fc | 1 +
6 policy/modules/kernel/corecommands.fc | 1 +
7 policy/modules/system/init.fc | 1 +
8 3 files changed, 3 insertions(+), 0 deletions(-)
9
10diff --git a/policy/modules/contrib/shutdown.fc b/policy/modules/contrib/shutdown.fc
11index 97671a3..6cad0fd 100644
12--- a/policy/modules/contrib/shutdown.fc
13+++ b/policy/modules/contrib/shutdown.fc
14@@ -3,5 +3,6 @@
15 /lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
16
17 /sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
18+/sbin/shutdown\.sysvinit -- gen_context(system_u:object_r:shutdown_exec_t,s0)
19
20 /var/run/shutdown\.pid -- gen_context(system_u:object_r:shutdown_var_run_t,s0)
21diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
22index db981df..f051c4a 100644
23--- a/policy/modules/kernel/corecommands.fc
24+++ b/policy/modules/kernel/corecommands.fc
25@@ -10,6 +10,7 @@
26 /bin/ksh.* -- gen_context(system_u:object_r:shell_exec_t,s0)
27 /bin/mksh -- gen_context(system_u:object_r:shell_exec_t,s0)
28 /bin/mountpoint -- gen_context(system_u:object_r:bin_t,s0)
29+/bin/mountpoint\.sysvinit -- gen_context(system_u:object_r:bin_t,s0)
30 /bin/sash -- gen_context(system_u:object_r:shell_exec_t,s0)
31 /bin/tcsh -- gen_context(system_u:object_r:shell_exec_t,s0)
32 /bin/yash -- gen_context(system_u:object_r:shell_exec_t,s0)
33diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
34index d2e40b8..80150ef 100644
35--- a/policy/modules/system/init.fc
36+++ b/policy/modules/system/init.fc
37@@ -32,6 +32,7 @@ ifdef(`distro_gentoo', `
38 # /sbin
39 #
40 /sbin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0)
41+/sbin/init\.sysvinit -- gen_context(system_u:object_r:init_exec_t,s0)
42 # because nowadays, /sbin/init is often a symlink to /sbin/upstart
43 /sbin/upstart -- gen_context(system_u:object_r:init_exec_t,s0)
44
45--
461.7.5.4
47
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_tinylogin.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_tinylogin.patch
deleted file mode 100644
index ae06dfa..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-update-alternatives_tinylogin.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] fix update-alternatives for tinylogin getty
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/getty.fc | 1 +
8 1 files changed, 1 insertions(+), 0 deletions(-)
9
10diff --git a/policy/modules/system/getty.fc b/policy/modules/system/getty.fc
11index e1a1848..a0bfd2e 100644
12--- a/policy/modules/system/getty.fc
13+++ b/policy/modules/system/getty.fc
14@@ -2,6 +2,7 @@
15 /etc/mgetty(/.*)? gen_context(system_u:object_r:getty_etc_t,s0)
16
17 /sbin/.*getty -- gen_context(system_u:object_r:getty_exec_t,s0)
18+/sbin/getty\.tinylogin -- gen_context(system_u:object_r:getty_exec_t,s0)
19
20 /var/log/mgetty\.log.* -- gen_context(system_u:object_r:getty_log_t,s0)
21 /var/log/vgetty\.log\..* -- gen_context(system_u:object_r:getty_log_t,s0)
22--
231.7.5.4
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-bsdpty_device_t.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-bsdpty_device_t.patch
deleted file mode 100644
index b5d0fa8..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-bsdpty_device_t.patch
+++ /dev/null
@@ -1,118 +0,0 @@
1Subject: [PATCH] add rules for bsdpty_device_t to complete pty devices.
2
3Upstream-Status: Pending
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/kernel/terminal.if | 16 ++++++++++++++++
8 1 files changed, 16 insertions(+), 0 deletions(-)
9
10diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
11index 01dd2f1..f9d46cc 100644
12--- a/policy/modules/kernel/terminal.if
13+++ b/policy/modules/kernel/terminal.if
14@@ -512,9 +512,11 @@ interface(`term_dontaudit_manage_pty_dirs',`
15 interface(`term_dontaudit_getattr_generic_ptys',`
16 gen_require(`
17 type devpts_t;
18+ type bsdpty_device_t;
19 ')
20
21 dontaudit $1 devpts_t:chr_file getattr;
22+ dontaudit $1 bsdpty_device_t:chr_file getattr;
23 ')
24 ########################################
25 ## <summary>
26@@ -530,11 +532,13 @@ interface(`term_dontaudit_getattr_generic_ptys',`
27 interface(`term_ioctl_generic_ptys',`
28 gen_require(`
29 type devpts_t;
30+ type bsdpty_device_t;
31 ')
32
33 dev_list_all_dev_nodes($1)
34 allow $1 devpts_t:dir search;
35 allow $1 devpts_t:chr_file ioctl;
36+ allow $1 bsdpty_device_t:chr_file ioctl;
37 ')
38
39 ########################################
40@@ -552,9 +556,11 @@ interface(`term_ioctl_generic_ptys',`
41 interface(`term_setattr_generic_ptys',`
42 gen_require(`
43 type devpts_t;
44+ type bsdpty_device_t;
45 ')
46
47 allow $1 devpts_t:chr_file setattr;
48+ allow $1 bsdpty_device_t:chr_file setattr;
49 ')
50
51 ########################################
52@@ -572,9 +578,11 @@ interface(`term_setattr_generic_ptys',`
53 interface(`term_dontaudit_setattr_generic_ptys',`
54 gen_require(`
55 type devpts_t;
56+ type bsdpty_device_t;
57 ')
58
59 dontaudit $1 devpts_t:chr_file setattr;
60+ dontaudit $1 bsdpty_device_t:chr_file setattr;
61 ')
62
63 ########################################
64@@ -592,11 +600,13 @@ interface(`term_dontaudit_setattr_generic_ptys',`
65 interface(`term_use_generic_ptys',`
66 gen_require(`
67 type devpts_t;
68+ type bsdpty_device_t;
69 ')
70
71 dev_list_all_dev_nodes($1)
72 allow $1 devpts_t:dir list_dir_perms;
73 allow $1 devpts_t:chr_file { rw_term_perms lock append };
74+ allow $1 bsdpty_device_t:chr_file { rw_term_perms lock append };
75 ')
76
77 ########################################
78@@ -614,9 +624,11 @@ interface(`term_use_generic_ptys',`
79 interface(`term_dontaudit_use_generic_ptys',`
80 gen_require(`
81 type devpts_t;
82+ type bsdpty_device_t;
83 ')
84
85 dontaudit $1 devpts_t:chr_file { getattr read write ioctl };
86+ dontaudit $1 bsdpty_device_t:chr_file { getattr read write ioctl };
87 ')
88
89 #######################################
90@@ -632,10 +644,12 @@ interface(`term_dontaudit_use_generic_ptys',`
91 interface(`term_setattr_controlling_term',`
92 gen_require(`
93 type devtty_t;
94+ type bsdpty_device_t;
95 ')
96
97 dev_list_all_dev_nodes($1)
98 allow $1 devtty_t:chr_file setattr;
99+ allow $1 bsdpty_device_t:chr_file setattr;
100 ')
101
102 ########################################
103@@ -652,10 +666,12 @@ interface(`term_setattr_controlling_term',`
104 interface(`term_use_controlling_term',`
105 gen_require(`
106 type devtty_t;
107+ type bsdpty_device_t;
108 ')
109
110 dev_list_all_dev_nodes($1)
111 allow $1 devtty_t:chr_file { rw_term_perms lock append };
112+ allow $1 bsdpty_device_t:chr_file { rw_term_perms lock append };
113 ')
114
115 #######################################
116--
1171.7.5.4
118
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-tmp-symlink.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-tmp-symlink.patch
deleted file mode 100644
index 45de2df..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-tmp-symlink.patch
+++ /dev/null
@@ -1,96 +0,0 @@
1Subject: [PATCH] add rules for the symlink of /tmp
2
3/tmp is a symlink in poky, so we need allow rules for files to read
4lnk_file while doing search/list/delete/rw.. in /tmp/ directory.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/kernel/files.fc | 1 +
11 policy/modules/kernel/files.if | 8 ++++++++
12 2 files changed, 9 insertions(+), 0 deletions(-)
13
14diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
15index 8796ca3..a0db748 100644
16--- a/policy/modules/kernel/files.fc
17+++ b/policy/modules/kernel/files.fc
18@@ -185,6 +185,7 @@ ifdef(`distro_debian',`
19 # /tmp
20 #
21 /tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
22+/tmp -l gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
23 /tmp/.* <<none>>
24 /tmp/\.journal <<none>>
25
26diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
27index e1e814d..a7384b0 100644
28--- a/policy/modules/kernel/files.if
29+++ b/policy/modules/kernel/files.if
30@@ -4199,6 +4199,7 @@ interface(`files_search_tmp',`
31 ')
32
33 allow $1 tmp_t:dir search_dir_perms;
34+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
35 ')
36
37 ########################################
38@@ -4235,6 +4236,7 @@ interface(`files_list_tmp',`
39 ')
40
41 allow $1 tmp_t:dir list_dir_perms;
42+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
43 ')
44
45 ########################################
46@@ -4271,6 +4273,7 @@ interface(`files_delete_tmp_dir_entry',`
47 ')
48
49 allow $1 tmp_t:dir del_entry_dir_perms;
50+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
51 ')
52
53 ########################################
54@@ -4289,6 +4292,7 @@ interface(`files_read_generic_tmp_files',`
55 ')
56
57 read_files_pattern($1, tmp_t, tmp_t)
58+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
59 ')
60
61 ########################################
62@@ -4307,6 +4311,7 @@ interface(`files_manage_generic_tmp_dirs',`
63 ')
64
65 manage_dirs_pattern($1, tmp_t, tmp_t)
66+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
67 ')
68
69 ########################################
70@@ -4325,6 +4330,7 @@ interface(`files_manage_generic_tmp_files',`
71 ')
72
73 manage_files_pattern($1, tmp_t, tmp_t)
74+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
75 ')
76
77 ########################################
78@@ -4361,6 +4367,7 @@ interface(`files_rw_generic_tmp_sockets',`
79 ')
80
81 rw_sock_files_pattern($1, tmp_t, tmp_t)
82+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
83 ')
84
85 ########################################
86@@ -4550,6 +4557,7 @@ interface(`files_tmp_filetrans',`
87 ')
88
89 filetrans_pattern($1, tmp_t, $2, $3, $4)
90+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
91 ')
92
93 ########################################
94--
951.7.5.4
96
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-var-cache-symlink.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-var-cache-symlink.patch
deleted file mode 100644
index 243cc7b..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-var-cache-symlink.patch
+++ /dev/null
@@ -1,509 +0,0 @@
1Subject: [PATCH] add rules for the symlink of /var/cache
2
3/var/cache is a symlink in poky, so we need allow rules for files to read
4lnk_file while doing search/list/delete/rw.. in /var/cache/ directory.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/abrt.te | 2 ++
11 policy/modules/contrib/afs.te | 1 +
12 policy/modules/contrib/apache.if | 5 +++++
13 policy/modules/contrib/apache.te | 1 +
14 policy/modules/contrib/apt.if | 2 ++
15 policy/modules/contrib/apt.te | 1 +
16 policy/modules/contrib/bind.if | 2 ++
17 policy/modules/contrib/bind.te | 1 +
18 policy/modules/contrib/logwatch.if | 2 ++
19 policy/modules/contrib/logwatch.te | 1 +
20 policy/modules/contrib/podsleuth.te | 1 +
21 policy/modules/contrib/portage.te | 1 +
22 policy/modules/contrib/rpm.if | 4 ++++
23 policy/modules/contrib/rpm.te | 1 +
24 policy/modules/contrib/squid.if | 2 ++
25 policy/modules/contrib/squid.te | 1 +
26 policy/modules/contrib/virt.if | 2 ++
27 policy/modules/contrib/virt.te | 2 ++
28 policy/modules/services/xserver.if | 6 ++++++
29 policy/modules/system/authlogin.if | 10 ++++++++++
30 policy/modules/system/miscfiles.if | 8 ++++++++
31 21 files changed, 56 insertions(+)
32
33diff --git a/policy/modules/contrib/abrt.te b/policy/modules/contrib/abrt.te
34index 30861ec..10c941a 100644
35--- a/policy/modules/contrib/abrt.te
36+++ b/policy/modules/contrib/abrt.te
37@@ -73,6 +73,7 @@ files_tmp_filetrans(abrt_t, abrt_tmp_t, { file dir })
38 # abrt var/cache files
39 manage_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
40 manage_dirs_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
41+allow abrt_t var_t:lnk_file read_lnk_file_perms;
42 manage_lnk_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
43 files_var_filetrans(abrt_t, abrt_var_cache_t, { file dir })
44 files_spool_filetrans(abrt_t, abrt_var_cache_t, dir)
45@@ -193,6 +194,7 @@ read_files_pattern(abrt_helper_t, abrt_etc_t, abrt_etc_t)
46
47 files_search_spool(abrt_helper_t)
48 manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
49+allow abrt_helper_t var_t:lnk_file read_lnk_file_perms;
50 manage_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
51 manage_lnk_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
52 files_var_filetrans(abrt_helper_t, abrt_var_cache_t, { file dir })
53diff --git a/policy/modules/contrib/afs.te b/policy/modules/contrib/afs.te
54index a496fde..a739e1d 100644
55--- a/policy/modules/contrib/afs.te
56+++ b/policy/modules/contrib/afs.te
57@@ -78,6 +78,7 @@ allow afs_t self:unix_stream_socket create_stream_socket_perms;
58
59 manage_files_pattern(afs_t, afs_cache_t, afs_cache_t)
60 manage_dirs_pattern(afs_t, afs_cache_t, afs_cache_t)
61+allow afs_t var_t:lnk_file read_lnk_file_perms;
62 files_var_filetrans(afs_t, afs_cache_t, { file dir })
63
64 kernel_rw_afs_state(afs_t)
65diff --git a/policy/modules/contrib/apache.if b/policy/modules/contrib/apache.if
66index 6480167..1b3c593 100644
67--- a/policy/modules/contrib/apache.if
68+++ b/policy/modules/contrib/apache.if
69@@ -485,9 +485,11 @@ interface(`apache_manage_all_content',`
70 interface(`apache_setattr_cache_dirs',`
71 gen_require(`
72 type httpd_cache_t;
73+ type var_t;
74 ')
75
76 allow $1 httpd_cache_t:dir setattr;
77+ allow $1 var_t:lnk_file read_lnk_file_perms;
78 ')
79
80 ########################################
81@@ -504,9 +506,11 @@ interface(`apache_setattr_cache_dirs',`
82 interface(`apache_list_cache',`
83 gen_require(`
84 type httpd_cache_t;
85+ type var_t;
86 ')
87
88 list_dirs_pattern($1, httpd_cache_t, httpd_cache_t)
89+ allow $1 var_t:lnk_file read_lnk_file_perms;
90 ')
91
92 ########################################
93@@ -777,6 +781,7 @@ interface(`apache_list_modules',`
94 interface(`apache_exec_modules',`
95 gen_require(`
96 type httpd_modules_t;
97+ type var_t;
98 ')
99
100 allow $1 httpd_modules_t:dir list_dir_perms;
101diff --git a/policy/modules/contrib/apache.te b/policy/modules/contrib/apache.te
102index 0833afb..1115d37 100644
103--- a/policy/modules/contrib/apache.te
104+++ b/policy/modules/contrib/apache.te
105@@ -291,6 +291,7 @@ allow httpd_t self:udp_socket create_socket_perms;
106
107 # Allow httpd_t to put files in /var/cache/httpd etc
108 manage_dirs_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
109+allow httpd_t var_t:lnk_file read_lnk_file_perms;
110 manage_files_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
111 manage_lnk_files_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
112
113diff --git a/policy/modules/contrib/apt.if b/policy/modules/contrib/apt.if
114index e696b80..c6cc149 100644
115--- a/policy/modules/contrib/apt.if
116+++ b/policy/modules/contrib/apt.if
117@@ -152,10 +152,12 @@ interface(`apt_use_ptys',`
118 interface(`apt_read_cache',`
119 gen_require(`
120 type apt_var_cache_t;
121+ type var_t;
122 ')
123
124 files_search_var($1)
125 allow $1 apt_var_cache_t:dir list_dir_perms;
126+ allow $1 var_t:lnk_file read_lnk_file_perms;
127 dontaudit $1 apt_var_cache_t:dir write;
128 allow $1 apt_var_cache_t:file read_file_perms;
129 ')
130diff --git a/policy/modules/contrib/apt.te b/policy/modules/contrib/apt.te
131index 8555315..8bfd892 100644
132--- a/policy/modules/contrib/apt.te
133+++ b/policy/modules/contrib/apt.te
134@@ -78,6 +78,7 @@ fs_tmpfs_filetrans(apt_t, apt_tmpfs_t, { dir file lnk_file sock_file fifo_file }
135 # Access /var/cache/apt files
136 manage_files_pattern(apt_t, apt_var_cache_t, apt_var_cache_t)
137 files_var_filetrans(apt_t, apt_var_cache_t, dir)
138+allow apt_t var_t:lnk_file read_lnk_file_perms;
139
140 # Access /var/lib/apt files
141 manage_files_pattern(apt_t, apt_var_lib_t, apt_var_lib_t)
142diff --git a/policy/modules/contrib/bind.if b/policy/modules/contrib/bind.if
143index 44a1e3d..9b93562 100644
144--- a/policy/modules/contrib/bind.if
145+++ b/policy/modules/contrib/bind.if
146@@ -221,12 +221,14 @@ interface(`bind_manage_config_dirs',`
147 interface(`bind_search_cache',`
148 gen_require(`
149 type named_conf_t, named_cache_t, named_zone_t;
150+ type var_t;
151 ')
152
153 files_search_var($1)
154 allow $1 named_conf_t:dir search_dir_perms;
155 allow $1 named_zone_t:dir search_dir_perms;
156 allow $1 named_cache_t:dir search_dir_perms;
157+ allow $1 var_t:lnk_file read_lnk_file_perms;
158 ')
159
160 ########################################
161diff --git a/policy/modules/contrib/bind.te b/policy/modules/contrib/bind.te
162index 0968cb4..15c605c 100644
163--- a/policy/modules/contrib/bind.te
164+++ b/policy/modules/contrib/bind.te
165@@ -79,6 +79,7 @@ read_lnk_files_pattern(named_t, named_conf_t, named_conf_t)
166 # write cache for secondary zones
167 manage_files_pattern(named_t, named_cache_t, named_cache_t)
168 manage_lnk_files_pattern(named_t, named_cache_t, named_cache_t)
169+allow named_t var_t:lnk_file read_lnk_file_perms;
170
171 can_exec(named_t, named_exec_t)
172
173diff --git a/policy/modules/contrib/logwatch.if b/policy/modules/contrib/logwatch.if
174index d878e75..1484c1e 100644
175--- a/policy/modules/contrib/logwatch.if
176+++ b/policy/modules/contrib/logwatch.if
177@@ -32,7 +32,9 @@ interface(`logwatch_read_tmp_files',`
178 interface(`logwatch_search_cache_dir',`
179 gen_require(`
180 type logwatch_cache_t;
181+ type var_t;
182 ')
183
184 allow $1 logwatch_cache_t:dir search_dir_perms;
185+ allow $1 var_t:lnk_file read_lnk_file_perms;
186 ')
187diff --git a/policy/modules/contrib/logwatch.te b/policy/modules/contrib/logwatch.te
188index 75ce30f..31bff65 100644
189--- a/policy/modules/contrib/logwatch.te
190+++ b/policy/modules/contrib/logwatch.te
191@@ -30,6 +30,7 @@ allow logwatch_t self:fifo_file rw_file_perms;
192 allow logwatch_t self:unix_stream_socket create_stream_socket_perms;
193
194 manage_dirs_pattern(logwatch_t, logwatch_cache_t, logwatch_cache_t)
195+allow logwatch_t var_t:lnk_file read_lnk_file_perms;
196 manage_files_pattern(logwatch_t, logwatch_cache_t, logwatch_cache_t)
197
198 allow logwatch_t logwatch_lock_t:file manage_file_perms;
199diff --git a/policy/modules/contrib/podsleuth.te b/policy/modules/contrib/podsleuth.te
200index 4cffb07..32ab27e 100644
201--- a/policy/modules/contrib/podsleuth.te
202+++ b/policy/modules/contrib/podsleuth.te
203@@ -33,6 +33,7 @@ allow podsleuth_t self:tcp_socket create_stream_socket_perms;
204 allow podsleuth_t self:udp_socket create_socket_perms;
205
206 manage_dirs_pattern(podsleuth_t, podsleuth_cache_t, podsleuth_cache_t)
207+allow podsleuth_t var_t:lnk_file read_lnk_file_perms;
208 manage_files_pattern(podsleuth_t, podsleuth_cache_t, podsleuth_cache_t)
209 files_var_filetrans(podsleuth_t, podsleuth_cache_t, { file dir })
210
211diff --git a/policy/modules/contrib/portage.te b/policy/modules/contrib/portage.te
212index 630f16f..f4e43be 100644
213--- a/policy/modules/contrib/portage.te
214+++ b/policy/modules/contrib/portage.te
215@@ -339,5 +339,6 @@ portage_compile_domain(portage_sandbox_t)
216 ifdef(`hide_broken_symptoms',`
217 # leaked descriptors
218 dontaudit portage_sandbox_t portage_cache_t:dir { setattr };
219+ allow portage_sandbox_t var_t:lnk_file read_lnk_file_perms;
220 dontaudit portage_sandbox_t portage_cache_t:file { setattr write };
221 ')
222diff --git a/policy/modules/contrib/rpm.if b/policy/modules/contrib/rpm.if
223index 951d8f6..f4c6825 100644
224--- a/policy/modules/contrib/rpm.if
225+++ b/policy/modules/contrib/rpm.if
226@@ -408,10 +408,12 @@ interface(`rpm_read_script_tmp_files',`
227 interface(`rpm_read_cache',`
228 gen_require(`
229 type rpm_var_cache_t;
230+ type var_t;
231 ')
232
233 files_search_var($1)
234 allow $1 rpm_var_cache_t:dir list_dir_perms;
235+ allow $1 var_t:lnk_file read_lnk_file_perms;
236 read_files_pattern($1, rpm_var_cache_t, rpm_var_cache_t)
237 read_lnk_files_pattern($1, rpm_var_cache_t, rpm_var_cache_t)
238 ')
239@@ -429,10 +431,12 @@ interface(`rpm_read_cache',`
240 interface(`rpm_manage_cache',`
241 gen_require(`
242 type rpm_var_cache_t;
243+ type var_t;
244 ')
245
246 files_search_var_lib($1)
247 manage_dirs_pattern($1, rpm_var_cache_t, rpm_var_cache_t)
248+ allow $1 var_t:lnk_file read_lnk_file_perms;
249 manage_files_pattern($1, rpm_var_cache_t, rpm_var_cache_t)
250 manage_lnk_files_pattern($1, rpm_var_cache_t, rpm_var_cache_t)
251 ')
252diff --git a/policy/modules/contrib/rpm.te b/policy/modules/contrib/rpm.te
253index 60149a5..f3f0640 100644
254--- a/policy/modules/contrib/rpm.te
255+++ b/policy/modules/contrib/rpm.te
256@@ -98,6 +98,7 @@ fs_tmpfs_filetrans(rpm_t, rpm_tmpfs_t, { dir file lnk_file sock_file fifo_file }
257 can_exec(rpm_t, rpm_tmpfs_t)
258
259 manage_dirs_pattern(rpm_t, rpm_var_cache_t, rpm_var_cache_t)
260+allow rpm_t var_t:lnk_file read_lnk_file_perms;
261 manage_files_pattern(rpm_t, rpm_var_cache_t, rpm_var_cache_t)
262 files_var_filetrans(rpm_t, rpm_var_cache_t, dir)
263
264diff --git a/policy/modules/contrib/squid.if b/policy/modules/contrib/squid.if
265index d2496bd..28f8e2e 100644
266--- a/policy/modules/contrib/squid.if
267+++ b/policy/modules/contrib/squid.if
268@@ -88,9 +88,11 @@ interface(`squid_rw_stream_sockets',`
269 interface(`squid_dontaudit_search_cache',`
270 gen_require(`
271 type squid_cache_t;
272+ type var_t;
273 ')
274
275 dontaudit $1 squid_cache_t:dir search_dir_perms;
276+ allow $1 var_t:lnk_file read_lnk_file_perms;
277 ')
278
279 ########################################
280diff --git a/policy/modules/contrib/squid.te b/policy/modules/contrib/squid.te
281index c38de7a..01e1222 100644
282--- a/policy/modules/contrib/squid.te
283+++ b/policy/modules/contrib/squid.te
284@@ -67,6 +67,7 @@ allow squid_t self:udp_socket create_socket_perms;
285
286 # Grant permissions to create, access, and delete cache files.
287 manage_dirs_pattern(squid_t, squid_cache_t, squid_cache_t)
288+allow squid_t var_t:lnk_file read_lnk_file_perms;
289 manage_files_pattern(squid_t, squid_cache_t, squid_cache_t)
290 manage_lnk_files_pattern(squid_t, squid_cache_t, squid_cache_t)
291
292diff --git a/policy/modules/contrib/virt.if b/policy/modules/contrib/virt.if
293index 6f0736b..2fcd979 100644
294--- a/policy/modules/contrib/virt.if
295+++ b/policy/modules/contrib/virt.if
296@@ -438,10 +438,12 @@ interface(`virt_read_images',`
297 interface(`virt_manage_svirt_cache',`
298 gen_require(`
299 type svirt_cache_t;
300+ type var_t;
301 ')
302
303 files_search_var($1)
304 manage_dirs_pattern($1, svirt_cache_t, svirt_cache_t)
305+ allow $1 var_t:lnk_file read_lnk_file_perms;
306 manage_files_pattern($1, svirt_cache_t, svirt_cache_t)
307 manage_lnk_files_pattern($1, svirt_cache_t, svirt_cache_t)
308 ')
309diff --git a/policy/modules/contrib/virt.te b/policy/modules/contrib/virt.te
310index 947bbc6..659abcc 100644
311--- a/policy/modules/contrib/virt.te
312+++ b/policy/modules/contrib/virt.te
313@@ -108,6 +108,7 @@ ifdef(`enable_mls',`
314 allow svirt_t self:udp_socket create_socket_perms;
315
316 manage_dirs_pattern(svirt_t, svirt_cache_t, svirt_cache_t)
317+allow svirt_t var_t:lnk_file read_lnk_file_perms;
318 manage_files_pattern(svirt_t, svirt_cache_t, svirt_cache_t)
319 files_var_filetrans(svirt_t, svirt_cache_t, { file dir })
320
321@@ -186,6 +187,7 @@ allow virtd_t self:tun_socket create_socket_perms;
322 allow virtd_t self:netlink_kobject_uevent_socket create_socket_perms;
323
324 manage_dirs_pattern(virtd_t, svirt_cache_t, svirt_cache_t)
325+allow virtd_t var_t:lnk_file read_lnk_file_perms;
326 manage_files_pattern(virtd_t, svirt_cache_t, svirt_cache_t)
327
328 manage_dirs_pattern(virtd_t, virt_content_t, virt_content_t)
329diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
330index 130ced9..ffef982 100644
331--- a/policy/modules/services/xserver.if
332+++ b/policy/modules/services/xserver.if
333@@ -22,6 +22,7 @@ interface(`xserver_restricted_role',`
334 type user_fonts_t, user_fonts_cache_t, user_fonts_config_t;
335 type iceauth_t, iceauth_exec_t, iceauth_home_t;
336 type xauth_t, xauth_exec_t, xauth_home_t;
337+ type var_t;
338 ')
339
340 role $1 types { xserver_t xauth_t iceauth_t };
341@@ -41,6 +42,7 @@ interface(`xserver_restricted_role',`
342 allow $2 user_fonts_config_t:file read_file_perms;
343
344 manage_dirs_pattern($2, user_fonts_cache_t, user_fonts_cache_t)
345+ allow $2 var_t:lnk_file read_lnk_file_perms;
346 manage_files_pattern($2, user_fonts_cache_t, user_fonts_cache_t)
347
348 stream_connect_pattern($2, xserver_tmp_t, xserver_tmp_t, xserver_t)
349@@ -134,6 +136,7 @@ interface(`xserver_role',`
350 gen_require(`
351 type iceauth_home_t, xserver_t, xserver_tmpfs_t, xauth_home_t;
352 type user_fonts_t, user_fonts_cache_t, user_fonts_config_t;
353+ type var_t;
354 ')
355
356 xserver_restricted_role($1, $2)
357@@ -154,6 +157,7 @@ interface(`xserver_role',`
358 relabel_files_pattern($2, user_fonts_t, user_fonts_t)
359
360 manage_dirs_pattern($2, user_fonts_cache_t, user_fonts_cache_t)
361+ allow $2 var_t:lnk_file read_lnk_file_perms;
362 manage_files_pattern($2, user_fonts_cache_t, user_fonts_cache_t)
363 relabel_dirs_pattern($2, user_fonts_cache_t, user_fonts_cache_t)
364 relabel_files_pattern($2, user_fonts_cache_t, user_fonts_cache_t)
365@@ -512,6 +516,7 @@ template(`xserver_user_x_domain_template',`
366 interface(`xserver_use_user_fonts',`
367 gen_require(`
368 type user_fonts_t, user_fonts_cache_t, user_fonts_config_t;
369+ type var_t;
370 ')
371
372 # Read per user fonts
373@@ -520,6 +525,7 @@ interface(`xserver_use_user_fonts',`
374
375 # Manipulate the global font cache
376 manage_dirs_pattern($1, user_fonts_cache_t, user_fonts_cache_t)
377+ allow $1 var_t:lnk_file read_lnk_file_perms;
378 manage_files_pattern($1, user_fonts_cache_t, user_fonts_cache_t)
379
380 # Read per user font config
381diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
382index f416ce9..00a209d 100644
383--- a/policy/modules/system/authlogin.if
384+++ b/policy/modules/system/authlogin.if
385@@ -95,6 +95,7 @@ interface(`auth_use_pam',`
386 interface(`auth_login_pgm_domain',`
387 gen_require(`
388 type var_auth_t, auth_cache_t;
389+ type var_t;
390 ')
391
392 domain_type($1)
393@@ -116,6 +117,7 @@ interface(`auth_login_pgm_domain',`
394 manage_files_pattern($1, var_auth_t, var_auth_t)
395
396 manage_dirs_pattern($1, auth_cache_t, auth_cache_t)
397+ allow $1 var_t:lnk_file read_lnk_file_perms;
398 manage_files_pattern($1, auth_cache_t, auth_cache_t)
399 manage_sock_files_pattern($1, auth_cache_t, auth_cache_t)
400 files_var_filetrans($1, auth_cache_t, dir)
401@@ -279,9 +281,11 @@ interface(`auth_ranged_domtrans_login_program',`
402 interface(`auth_search_cache',`
403 gen_require(`
404 type auth_cache_t;
405+ type var_t;
406 ')
407
408 allow $1 auth_cache_t:dir search_dir_perms;
409+ allow $1 var_t:lnk_file read_lnk_file_perms;
410 ')
411
412 ########################################
413@@ -333,9 +337,11 @@ interface(`auth_rw_cache',`
414 interface(`auth_manage_cache',`
415 gen_require(`
416 type auth_cache_t;
417+ type var_t;
418 ')
419
420 manage_dirs_pattern($1, auth_cache_t, auth_cache_t)
421+ allow $1 var_t:lnk_file read_lnk_file_perms;
422 manage_files_pattern($1, auth_cache_t, auth_cache_t)
423 ')
424
425@@ -352,9 +358,11 @@ interface(`auth_manage_cache',`
426 interface(`auth_var_filetrans_cache',`
427 gen_require(`
428 type auth_cache_t;
429+ type var_t;
430 ')
431
432 files_var_filetrans($1, auth_cache_t, { file dir } )
433+ allow $1 var_t:lnk_file read_lnk_file_perms;
434 ')
435
436 ########################################
437@@ -371,9 +379,11 @@ interface(`auth_domtrans_chk_passwd',`
438 gen_require(`
439 type chkpwd_t, chkpwd_exec_t, shadow_t;
440 type auth_cache_t;
441+ type var_t;
442 ')
443
444 allow $1 auth_cache_t:dir search_dir_perms;
445+ allow $1 var_t:lnk_file read_lnk_file_perms;
446
447 corecmd_search_bin($1)
448 domtrans_pattern($1, chkpwd_exec_t, chkpwd_t)
449diff --git a/policy/modules/system/miscfiles.if b/policy/modules/system/miscfiles.if
450index 926ba65..e2eaee6 100644
451--- a/policy/modules/system/miscfiles.if
452+++ b/policy/modules/system/miscfiles.if
453@@ -183,6 +183,7 @@ interface(`miscfiles_manage_cert_files',`
454 interface(`miscfiles_read_fonts',`
455 gen_require(`
456 type fonts_t, fonts_cache_t;
457+ type var_t;
458 ')
459
460 # cjp: fonts can be in either of these dirs
461@@ -194,6 +195,7 @@ interface(`miscfiles_read_fonts',`
462 read_lnk_files_pattern($1, fonts_t, fonts_t)
463
464 allow $1 fonts_cache_t:dir list_dir_perms;
465+ allow $1 var_t:lnk_file read_lnk_file_perms;
466 read_files_pattern($1, fonts_cache_t, fonts_cache_t)
467 read_lnk_files_pattern($1, fonts_cache_t, fonts_cache_t)
468 ')
469@@ -295,9 +297,11 @@ interface(`miscfiles_manage_fonts',`
470 interface(`miscfiles_setattr_fonts_cache_dirs',`
471 gen_require(`
472 type fonts_cache_t;
473+ type var_t;
474 ')
475
476 allow $1 fonts_cache_t:dir setattr;
477+ allow $1 var_t:lnk_file read_lnk_file_perms;
478 ')
479
480 ########################################
481@@ -314,9 +318,11 @@ interface(`miscfiles_setattr_fonts_cache_dirs',`
482 interface(`miscfiles_dontaudit_setattr_fonts_cache_dirs',`
483 gen_require(`
484 type fonts_cache_t;
485+ type var_t;
486 ')
487
488 dontaudit $1 fonts_cache_t:dir setattr;
489+ allow $1 var_t:lnk_file read_lnk_file_perms;
490 ')
491
492 ########################################
493@@ -333,11 +339,13 @@ interface(`miscfiles_dontaudit_setattr_fonts_cache_dirs',`
494 interface(`miscfiles_manage_fonts_cache',`
495 gen_require(`
496 type fonts_cache_t;
497+ type var_t;
498 ')
499
500 files_search_var($1)
501
502 manage_dirs_pattern($1, fonts_cache_t, fonts_cache_t)
503+ allow $1 var_t:lnk_file read_lnk_file_perms;
504 manage_files_pattern($1, fonts_cache_t, fonts_cache_t)
505 manage_lnk_files_pattern($1, fonts_cache_t, fonts_cache_t)
506 ')
507--
5081.7.9.5
509
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-var-log-symlink-apache.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-var-log-symlink-apache.patch
deleted file mode 100644
index 91492c4..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-var-log-symlink-apache.patch
+++ /dev/null
@@ -1,28 +0,0 @@
1Subject: [PATCH] add rules for the symlink of /var/log - apache2
2
3We have added rules for the symlink of /var/log in logging.if,
4while apache.te uses /var/log but does not use the interfaces in
5logging.if. So still need add a individual rule for apache.te.
6
7Upstream-Status: Inappropriate [only for Poky]
8
9Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
10---
11 policy/modules/contrib/apache.te | 1 +
12 1 file changed, 1 insertion(+)
13
14diff --git a/policy/modules/contrib/apache.te b/policy/modules/contrib/apache.te
15index 1115d37..4c6316d 100644
16--- a/policy/modules/contrib/apache.te
17+++ b/policy/modules/contrib/apache.te
18@@ -310,6 +310,7 @@ create_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
19 append_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
20 read_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
21 read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
22+read_lnk_files_pattern(httpd_t, var_log_t, var_log_t)
23 # cjp: need to refine create interfaces to
24 # cut this back to add_name only
25 logging_log_filetrans(httpd_t, httpd_log_t, file)
26--
271.7.9.5
28
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-var-log-symlink.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-var-log-symlink.patch
deleted file mode 100644
index a2f3c5d..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-rules-for-var-log-symlink.patch
+++ /dev/null
@@ -1,140 +0,0 @@
1Subject: [PATCH] add rules for the symlink of /var/log
2
3/var/log is a symlink in poky, so we need allow rules for files to read
4lnk_file while doing search/list/delete/rw.. in /var/log/ directory.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/system/logging.fc | 1 +
11 policy/modules/system/logging.if | 14 +++++++++++++-
12 2 files changed, 14 insertions(+), 1 deletion(-)
13
14diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
15index 3cb65f1..2419cd7 100644
16--- a/policy/modules/system/logging.fc
17+++ b/policy/modules/system/logging.fc
18@@ -41,6 +41,7 @@ ifdef(`distro_suse', `
19 /var/cfengine/outputs(/.*)? gen_context(system_u:object_r:var_log_t,s0)
20
21 /var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
22+/var/log -l gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
23 /var/log/.* gen_context(system_u:object_r:var_log_t,s0)
24 /var/log/boot\.log -- gen_context(system_u:object_r:var_log_t,mls_systemhigh)
25 /var/log/messages[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
26diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
27index 321bb13..4812d46 100644
28--- a/policy/modules/system/logging.if
29+++ b/policy/modules/system/logging.if
30@@ -136,12 +136,13 @@ interface(`logging_set_audit_parameters',`
31 #
32 interface(`logging_read_audit_log',`
33 gen_require(`
34- type auditd_log_t;
35+ type auditd_log_t, var_log_t;
36 ')
37
38 files_search_var($1)
39 read_files_pattern($1, auditd_log_t, auditd_log_t)
40 allow $1 auditd_log_t:dir list_dir_perms;
41+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
42 ')
43
44 ########################################
45@@ -626,6 +627,7 @@ interface(`logging_search_logs',`
46
47 files_search_var($1)
48 allow $1 var_log_t:dir search_dir_perms;
49+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
50 ')
51
52 #######################################
53@@ -663,6 +665,7 @@ interface(`logging_list_logs',`
54
55 files_search_var($1)
56 allow $1 var_log_t:dir list_dir_perms;
57+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
58 ')
59
60 #######################################
61@@ -682,6 +685,7 @@ interface(`logging_rw_generic_log_dirs',`
62
63 files_search_var($1)
64 allow $1 var_log_t:dir rw_dir_perms;
65+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
66 ')
67
68 #######################################
69@@ -756,10 +760,12 @@ interface(`logging_append_all_logs',`
70 interface(`logging_read_all_logs',`
71 gen_require(`
72 attribute logfile;
73+ type var_log_t;
74 ')
75
76 files_search_var($1)
77 allow $1 logfile:dir list_dir_perms;
78+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
79 read_files_pattern($1, logfile, logfile)
80 ')
81
82@@ -778,10 +784,12 @@ interface(`logging_read_all_logs',`
83 interface(`logging_exec_all_logs',`
84 gen_require(`
85 attribute logfile;
86+ type var_log_t;
87 ')
88
89 files_search_var($1)
90 allow $1 logfile:dir list_dir_perms;
91+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
92 can_exec($1, logfile)
93 ')
94
95@@ -843,6 +851,7 @@ interface(`logging_read_generic_logs',`
96
97 files_search_var($1)
98 allow $1 var_log_t:dir list_dir_perms;
99+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
100 read_files_pattern($1, var_log_t, var_log_t)
101 ')
102
103@@ -863,6 +872,7 @@ interface(`logging_write_generic_logs',`
104
105 files_search_var($1)
106 allow $1 var_log_t:dir list_dir_perms;
107+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
108 write_files_pattern($1, var_log_t, var_log_t)
109 ')
110
111@@ -901,6 +911,7 @@ interface(`logging_rw_generic_logs',`
112
113 files_search_var($1)
114 allow $1 var_log_t:dir list_dir_perms;
115+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
116 rw_files_pattern($1, var_log_t, var_log_t)
117 ')
118
119@@ -923,6 +934,7 @@ interface(`logging_manage_generic_logs',`
120
121 files_search_var($1)
122 manage_files_pattern($1, var_log_t, var_log_t)
123+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
124 ')
125
126 ########################################
127diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
128index a3a25c2..a45c68e 100644
129--- a/policy/modules/system/logging.te
130+++ b/policy/modules/system/logging.te
131@@ -139,6 +139,7 @@ allow auditd_t auditd_etc_t:file read_file_perms;
132 manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
133 manage_lnk_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
134 allow auditd_t var_log_t:dir search_dir_perms;
135+allow auditd_t var_log_t:lnk_file read_lnk_file_perms;
136
137 manage_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
138 manage_sock_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
139--
1401.7.9.5
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-syslogd_t-to-trusted-object.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-syslogd_t-to-trusted-object.patch
deleted file mode 100644
index 9b5db54..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-add-syslogd_t-to-trusted-object.patch
+++ /dev/null
@@ -1,28 +0,0 @@
1Subject: [PATCH] Add the syslogd_t to trusted object
2
3We add the syslogd_t to trusted object, because other process need
4to have the right to connectto/sendto /dev/log.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Roy.Li <rongqing.li@windriver.com>
9Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
10---
11 policy/modules/system/logging.te | 1 +
12 1 files changed, 1 insertions(+), 0 deletions(-)
13
14diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
15index 0034021..b6b0ddf 100644
16--- a/policy/modules/system/logging.te
17+++ b/policy/modules/system/logging.te
18@@ -444,6 +444,7 @@ fs_getattr_all_fs(syslogd_t)
19 fs_search_auto_mountpoints(syslogd_t)
20
21 mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
22+mls_trusted_object(syslogd_t) # Other process need to have the right to connectto/sendto /dev/log
23
24 term_write_console(syslogd_t)
25 # Allow syslog to a terminal
26--
271.7.5.4
28
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-dbusd-to-exec-shell-commands.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-dbusd-to-exec-shell-commands.patch
deleted file mode 100644
index 6207e40..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-dbusd-to-exec-shell-commands.patch
+++ /dev/null
@@ -1,25 +0,0 @@
1Subject: [PATCH] allow dbusd to exec shell commands.
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/dbus.te | 2 ++
8 1 files changed, 2 insertions(+), 0 deletions(-)
9
10diff --git a/policy/modules/contrib/dbus.te b/policy/modules/contrib/dbus.te
11index 529944b..bb76257 100644
12--- a/policy/modules/contrib/dbus.te
13+++ b/policy/modules/contrib/dbus.te
14@@ -111,6 +111,8 @@ corecmd_list_bin(system_dbusd_t)
15 corecmd_read_bin_pipes(system_dbusd_t)
16 corecmd_read_bin_sockets(system_dbusd_t)
17
18+corecmd_exec_shell(system_dbusd_t)
19+
20 domain_use_interactive_fds(system_dbusd_t)
21 domain_read_all_domains_state(system_dbusd_t)
22
23--
241.7.5.4
25
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-dbusd-to-setrlimit-itself.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-dbusd-to-setrlimit-itself.patch
deleted file mode 100644
index 6eded62..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-dbusd-to-setrlimit-itself.patch
+++ /dev/null
@@ -1,29 +0,0 @@
1Subject: [PATCH] allow system_dbusd_t to setrlimit itself.
2
3avc: denied { setrlimit } for pid=391 comm="dbus-daemon"
4 scontext=system_u:system_r:system_dbusd_t:s0-s15:c0.c1023
5 tcontext=system_u:system_r:system_dbusd_t:s0-s15:c0.c1023 tclass=proces
6
7Upstream-Status: Inappropriate [only for Poky]
8
9Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
10---
11 policy/modules/contrib/dbus.te | 2 +-
12 1 files changed, 1 insertions(+), 1 deletions(-)
13
14diff --git a/policy/modules/contrib/dbus.te b/policy/modules/contrib/dbus.te
15index 625cb32..529944b 100644
16--- a/policy/modules/contrib/dbus.te
17+++ b/policy/modules/contrib/dbus.te
18@@ -53,7 +53,7 @@ ifdef(`enable_mls',`
19 # cjp: dac_override should probably go in a distro_debian
20 allow system_dbusd_t self:capability { dac_override setgid setpcap setuid };
21 dontaudit system_dbusd_t self:capability sys_tty_config;
22-allow system_dbusd_t self:process { getattr getsched signal_perms setpgid getcap setcap };
23+allow system_dbusd_t self:process { getattr getsched signal_perms setpgid getcap setcap setrlimit };
24 allow system_dbusd_t self:fifo_file rw_fifo_file_perms;
25 allow system_dbusd_t self:dbus { send_msg acquire_svc };
26 allow system_dbusd_t self:unix_stream_socket { connectto create_stream_socket_perms connectto };
27--
281.7.5.4
29
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-nfsd-to-bind-nfs-port.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-nfsd-to-bind-nfs-port.patch
deleted file mode 100644
index e643b10..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-nfsd-to-bind-nfs-port.patch
+++ /dev/null
@@ -1,63 +0,0 @@
1Subject: [PATCH] refpolicy: allow nfsd to bind nfs port
2
3NFS server need bind to tcp/udp 2049,20048-20049 port, but no
4these rules in default refpolicy. So add the allow rules.
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/rpc.te | 2 ++
11 policy/modules/kernel/corenetwork.te | 10 ++++++++++
12 policy/modules/kernel/corenetwork.te.in | 1 +
13 3 files changed, 13 insertions(+)
14
15diff --git a/policy/modules/contrib/rpc.te b/policy/modules/contrib/rpc.te
16index 0fc7ddd..03783ae 100644
17--- a/policy/modules/contrib/rpc.te
18+++ b/policy/modules/contrib/rpc.te
19@@ -128,6 +128,8 @@ corecmd_exec_shell(nfsd_t)
20
21 corenet_tcp_bind_all_rpc_ports(nfsd_t)
22 corenet_udp_bind_all_rpc_ports(nfsd_t)
23+corenet_tcp_bind_nfs_port(nfsd_t)
24+corenet_udp_bind_nfs_port(nfsd_t)
25
26 dev_dontaudit_getattr_all_blk_files(nfsd_t)
27 dev_dontaudit_getattr_all_chr_files(nfsd_t)
28diff --git a/policy/modules/kernel/corenetwork.te b/policy/modules/kernel/corenetwork.te
29index a5276af..8fca50e 100644
30--- a/policy/modules/kernel/corenetwork.te
31+++ b/policy/modules/kernel/corenetwork.te
32@@ -849,6 +849,16 @@ portcon tcp 5405 gen_context(system_u:object_r:netsupport_port_t,s0)
33 portcon udp 5405 gen_context(system_u:object_r:netsupport_port_t,s0)
34
35
36+type nfs_port_t, port_type, defined_port_type;
37+type nfs_client_packet_t, packet_type, client_packet_type;
38+type nfs_server_packet_t, packet_type, server_packet_type;
39+typeattribute nfs_port_t unreserved_port_type;
40+portcon tcp 2049 gen_context(system_u:object_r:nfs_port_t,s0)
41+portcon udp 2049 gen_context(system_u:object_r:nfs_port_t,s0)
42+portcon tcp 20048-20049 gen_context(system_u:object_r:nfs_port_t,s0)
43+portcon udp 20048-20049 gen_context(system_u:object_r:nfs_port_t,s0)
44+
45+
46 type nmbd_port_t, port_type, defined_port_type;
47 type nmbd_client_packet_t, packet_type, client_packet_type;
48 type nmbd_server_packet_t, packet_type, server_packet_type;
49diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
50index fe2ee5e..fca0bc3 100644
51--- a/policy/modules/kernel/corenetwork.te.in
52+++ b/policy/modules/kernel/corenetwork.te.in
53@@ -164,6 +164,7 @@ network_port(mysqlmanagerd, tcp,2273,s0)
54 network_port(nessus, tcp,1241,s0)
55 network_port(netport, tcp,3129,s0, udp,3129,s0)
56 network_port(netsupport, tcp,5404,s0, udp,5404,s0, tcp,5405,s0, udp,5405,s0)
57+network_port(nfs, tcp,2049,s0, udp,2049,s0, tcp,20048-20049,s0, udp,20048-20049,s0)
58 network_port(nmbd, udp,137,s0, udp,138,s0)
59 network_port(ntop, tcp,3000-3001,s0, udp,3000-3001,s0)
60 network_port(ntp, udp,123,s0)
61--
621.7.11.7
63
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-nfsd-to-exec-shell-commands.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-nfsd-to-exec-shell-commands.patch
deleted file mode 100644
index f1fcc4c..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-nfsd-to-exec-shell-commands.patch
+++ /dev/null
@@ -1,67 +0,0 @@
1Subject: [PATCH] allow nfsd to exec shell commands.
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/rpc.te | 7 +++++++
8 policy/modules/kernel/kernel.if | 18 ++++++++++++++++++
9 2 files changed, 25 insertions(+), 0 deletions(-)
10
11diff --git a/policy/modules/contrib/rpc.te b/policy/modules/contrib/rpc.te
12index 330d01f..fde39d2 100644
13--- a/policy/modules/contrib/rpc.te
14+++ b/policy/modules/contrib/rpc.te
15@@ -120,6 +120,11 @@ allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir list_dir_perms;
16 kernel_read_system_state(nfsd_t)
17 kernel_read_network_state(nfsd_t)
18 kernel_dontaudit_getattr_core_if(nfsd_t)
19+kernel_setsched(nfsd_t)
20+kernel_request_load_module(nfsd_t)
21+kernel_mounton_proc(nfsd_t)
22+
23+corecmd_exec_shell(nfsd_t)
24
25 corenet_tcp_bind_all_rpc_ports(nfsd_t)
26 corenet_udp_bind_all_rpc_ports(nfsd_t)
27@@ -174,6 +179,8 @@ tunable_policy(`nfs_export_all_ro',`
28 files_read_non_auth_files(nfsd_t)
29 ')
30
31+mount_exec(nfsd_t)
32+
33 ########################################
34 #
35 # GSSD local policy
36diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
37index 4bf45cb..25e7b1b 100644
38--- a/policy/modules/kernel/kernel.if
39+++ b/policy/modules/kernel/kernel.if
40@@ -785,6 +785,24 @@ interface(`kernel_unmount_proc',`
41
42 ########################################
43 ## <summary>
44+## Mounton a proc filesystem.
45+## </summary>
46+## <param name="domain">
47+## <summary>
48+## Domain allowed access.
49+## </summary>
50+## </param>
51+#
52+interface(`kernel_mounton_proc',`
53+ gen_require(`
54+ type proc_t;
55+ ')
56+
57+ allow $1 proc_t:dir mounton;
58+')
59+
60+########################################
61+## <summary>
62 ## Get the attributes of the proc filesystem.
63 ## </summary>
64 ## <param name="domain">
65--
661.7.5.4
67
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-setfiles_t-to-read-symlinks.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-setfiles_t-to-read-symlinks.patch
deleted file mode 100644
index 15dc506..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-allow-setfiles_t-to-read-symlinks.patch
+++ /dev/null
@@ -1,26 +0,0 @@
1Subject: [PATCH] fix setfiles_t to read symlinks
2
3Upstream-Status: Pending
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/selinuxutil.te | 3 +++
8 1 files changed, 3 insertions(+), 0 deletions(-)
9
10diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
11index ec01d0b..45ed81b 100644
12--- a/policy/modules/system/selinuxutil.te
13+++ b/policy/modules/system/selinuxutil.te
14@@ -553,6 +553,9 @@ files_list_all(setfiles_t)
15 files_relabel_all_files(setfiles_t)
16 files_read_usr_symlinks(setfiles_t)
17
18+# needs to be able to read symlinks to make restorecon on symlink working
19+files_read_all_symlinks(setfiles_t)
20+
21 fs_getattr_xattr_fs(setfiles_t)
22 fs_list_all(setfiles_t)
23 fs_search_auto_mountpoints(setfiles_t)
24--
251.7.5.4
26
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-don-t-audit-tty_device_t.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-don-t-audit-tty_device_t.patch
deleted file mode 100644
index d7e407b..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-don-t-audit-tty_device_t.patch
+++ /dev/null
@@ -1,32 +0,0 @@
1Subject: [PATCH] don't audit tty_device_t in term_dontaudit_use_console.
2
3We should also not audit terminal to rw tty_device_t and fds in
4term_dontaudit_use_console.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/kernel/terminal.if | 3 +++
11 1 files changed, 3 insertions(+), 0 deletions(-)
12
13diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
14index f9d46cc..234e0b8 100644
15--- a/policy/modules/kernel/terminal.if
16+++ b/policy/modules/kernel/terminal.if
17@@ -299,9 +299,12 @@ interface(`term_use_console',`
18 interface(`term_dontaudit_use_console',`
19 gen_require(`
20 type console_device_t;
21+ type tty_device_t;
22 ')
23
24+ init_dontaudit_use_fds($1)
25 dontaudit $1 console_device_t:chr_file rw_chr_file_perms;
26+ dontaudit $1 tty_device_t:chr_file rw_chr_file_perms;
27 ')
28
29 ########################################
30--
311.7.5.4
32
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-new-SELINUXMNT-in-sys.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-new-SELINUXMNT-in-sys.patch
deleted file mode 100644
index fa0a274..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-new-SELINUXMNT-in-sys.patch
+++ /dev/null
@@ -1,213 +0,0 @@
1Subject: [PATCH] fix for new SELINUXMNT in /sys
2
3SELINUXMNT is now from /selinux to /sys/fs/selinux, so we should
4add rules to access sysfs.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/kernel/selinux.if | 40 ++++++++++++++++++++++++++++++++++++++
11 1 files changed, 40 insertions(+), 0 deletions(-)
12
13diff --git a/policy/modules/kernel/selinux.if b/policy/modules/kernel/selinux.if
14index 81440c5..b57ec34 100644
15--- a/policy/modules/kernel/selinux.if
16+++ b/policy/modules/kernel/selinux.if
17@@ -58,6 +58,10 @@ interface(`selinux_get_fs_mount',`
18 type security_t;
19 ')
20
21+ # SELINUXMNT is now /sys/fs/selinux, so we should add rules to
22+ # access sysfs
23+ dev_getattr_sysfs_dirs($1)
24+ dev_search_sysfs($1)
25 # starting in libselinux 2.0.5, init_selinuxmnt() will
26 # attempt to short circuit by checking if SELINUXMNT
27 # (/selinux) is already a selinuxfs
28@@ -84,6 +88,7 @@ interface(`selinux_dontaudit_get_fs_mount',`
29 type security_t;
30 ')
31
32+ dev_dontaudit_search_sysfs($1)
33 # starting in libselinux 2.0.5, init_selinuxmnt() will
34 # attempt to short circuit by checking if SELINUXMNT
35 # (/selinux) is already a selinuxfs
36@@ -109,6 +114,8 @@ interface(`selinux_mount_fs',`
37 type security_t;
38 ')
39
40+ dev_getattr_sysfs_dirs($1)
41+ dev_search_sysfs($1)
42 allow $1 security_t:filesystem mount;
43 ')
44
45@@ -128,6 +135,8 @@ interface(`selinux_remount_fs',`
46 type security_t;
47 ')
48
49+ dev_getattr_sysfs_dirs($1)
50+ dev_search_sysfs($1)
51 allow $1 security_t:filesystem remount;
52 ')
53
54@@ -146,6 +155,8 @@ interface(`selinux_unmount_fs',`
55 type security_t;
56 ')
57
58+ dev_getattr_sysfs_dirs($1)
59+ dev_search_sysfs($1)
60 allow $1 security_t:filesystem unmount;
61 ')
62
63@@ -164,6 +175,8 @@ interface(`selinux_getattr_fs',`
64 type security_t;
65 ')
66
67+ dev_getattr_sysfs_dirs($1)
68+ dev_search_sysfs($1)
69 allow $1 security_t:filesystem getattr;
70 ')
71
72@@ -183,6 +196,7 @@ interface(`selinux_dontaudit_getattr_fs',`
73 type security_t;
74 ')
75
76+ dev_dontaudit_search_sysfs($1)
77 dontaudit $1 security_t:filesystem getattr;
78 ')
79
80@@ -202,6 +216,7 @@ interface(`selinux_dontaudit_getattr_dir',`
81 type security_t;
82 ')
83
84+ dev_dontaudit_search_sysfs($1)
85 dontaudit $1 security_t:dir getattr;
86 ')
87
88@@ -220,6 +235,8 @@ interface(`selinux_search_fs',`
89 type security_t;
90 ')
91
92+ dev_getattr_sysfs_dirs($1)
93+ dev_search_sysfs($1)
94 allow $1 security_t:dir search_dir_perms;
95 ')
96
97@@ -238,6 +255,7 @@ interface(`selinux_dontaudit_search_fs',`
98 type security_t;
99 ')
100
101+ dev_dontaudit_search_sysfs($1)
102 dontaudit $1 security_t:dir search_dir_perms;
103 ')
104
105@@ -257,6 +275,7 @@ interface(`selinux_dontaudit_read_fs',`
106 type security_t;
107 ')
108
109+ dev_dontaudit_search_sysfs($1)
110 dontaudit $1 security_t:dir search_dir_perms;
111 dontaudit $1 security_t:file read_file_perms;
112 ')
113@@ -342,6 +361,8 @@ interface(`selinux_load_policy',`
114 bool secure_mode_policyload;
115 ')
116
117+ dev_getattr_sysfs_dirs($1)
118+ dev_search_sysfs($1)
119 allow $1 security_t:dir list_dir_perms;
120 allow $1 security_t:file rw_file_perms;
121 typeattribute $1 can_load_policy;
122@@ -371,6 +392,8 @@ interface(`selinux_read_policy',`
123 type security_t;
124 ')
125
126+ dev_getattr_sysfs_dirs($1)
127+ dev_search_sysfs($1)
128 allow $1 security_t:dir list_dir_perms;
129 allow $1 security_t:file read_file_perms;
130 allow $1 security_t:security read_policy;
131@@ -435,6 +458,8 @@ interface(`selinux_set_generic_booleans',`
132 type security_t;
133 ')
134
135+ dev_getattr_sysfs_dirs($1)
136+ dev_search_sysfs($1)
137 allow $1 security_t:dir list_dir_perms;
138 allow $1 security_t:file rw_file_perms;
139
140@@ -475,6 +500,8 @@ interface(`selinux_set_all_booleans',`
141 bool secure_mode_policyload;
142 ')
143
144+ dev_getattr_sysfs_dirs($1)
145+ dev_search_sysfs($1)
146 allow $1 security_t:dir list_dir_perms;
147 allow $1 { boolean_type -secure_mode_policyload_t }:file rw_file_perms;
148 allow $1 secure_mode_policyload_t:file read_file_perms;
149@@ -519,6 +546,8 @@ interface(`selinux_set_parameters',`
150 attribute can_setsecparam;
151 ')
152
153+ dev_getattr_sysfs_dirs($1)
154+ dev_search_sysfs($1)
155 allow $1 security_t:dir list_dir_perms;
156 allow $1 security_t:file rw_file_perms;
157 allow $1 security_t:security setsecparam;
158@@ -563,6 +592,7 @@ interface(`selinux_dontaudit_validate_context',`
159 type security_t;
160 ')
161
162+ dev_dontaudit_search_sysfs($1)
163 dontaudit $1 security_t:dir list_dir_perms;
164 dontaudit $1 security_t:file rw_file_perms;
165 dontaudit $1 security_t:security check_context;
166@@ -584,6 +614,8 @@ interface(`selinux_compute_access_vector',`
167 type security_t;
168 ')
169
170+ dev_getattr_sysfs_dirs($1)
171+ dev_search_sysfs($1)
172 allow $1 security_t:dir list_dir_perms;
173 allow $1 security_t:file rw_file_perms;
174 allow $1 security_t:security compute_av;
175@@ -605,6 +637,8 @@ interface(`selinux_compute_create_context',`
176 type security_t;
177 ')
178
179+ dev_getattr_sysfs_dirs($1)
180+ dev_search_sysfs($1)
181 allow $1 security_t:dir list_dir_perms;
182 allow $1 security_t:file rw_file_perms;
183 allow $1 security_t:security compute_create;
184@@ -626,6 +660,8 @@ interface(`selinux_compute_member',`
185 type security_t;
186 ')
187
188+ dev_getattr_sysfs_dirs($1)
189+ dev_search_sysfs($1)
190 allow $1 security_t:dir list_dir_perms;
191 allow $1 security_t:file rw_file_perms;
192 allow $1 security_t:security compute_member;
193@@ -655,6 +691,8 @@ interface(`selinux_compute_relabel_context',`
194 type security_t;
195 ')
196
197+ dev_getattr_sysfs_dirs($1)
198+ dev_search_sysfs($1)
199 allow $1 security_t:dir list_dir_perms;
200 allow $1 security_t:file rw_file_perms;
201 allow $1 security_t:security compute_relabel;
202@@ -675,6 +713,8 @@ interface(`selinux_compute_user_contexts',`
203 type security_t;
204 ')
205
206+ dev_getattr_sysfs_dirs($1)
207+ dev_search_sysfs($1)
208 allow $1 security_t:dir list_dir_perms;
209 allow $1 security_t:file rw_file_perms;
210 allow $1 security_t:security compute_user;
211--
2121.7.5.4
213
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch
deleted file mode 100644
index 42ee31e..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch
+++ /dev/null
@@ -1,70 +0,0 @@
1Subject: [PATCH] fix policy for nfsserver to mount nfsd_fs_t.
2
3Upstream-Status: Pending
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/rpc.te | 6 +++++-
8 policy/modules/contrib/rpcbind.te | 5 +++++
9 policy/modules/kernel/filesystem.te | 1 +
10 policy/modules/kernel/kernel.te | 1 +
11 4 files changed, 12 insertions(+), 1 deletions(-)
12
13diff --git a/policy/modules/contrib/rpc.te b/policy/modules/contrib/rpc.te
14index fde39d2..0fc7ddd 100644
15--- a/policy/modules/contrib/rpc.te
16+++ b/policy/modules/contrib/rpc.te
17@@ -179,7 +179,11 @@ tunable_policy(`nfs_export_all_ro',`
18 files_read_non_auth_files(nfsd_t)
19 ')
20
21-mount_exec(nfsd_t)
22+# Should domtrans to mount_t while mounting nfsd_fs_t.
23+mount_domtrans(nfsd_t)
24+# nfsd_t need to chdir to /var/lib/nfs and read files.
25+files_list_var(nfsd_t)
26+rpc_read_nfs_state_data(nfsd_t)
27
28 ########################################
29 #
30diff --git a/policy/modules/contrib/rpcbind.te b/policy/modules/contrib/rpcbind.te
31index a63e9ee..55397d9 100644
32--- a/policy/modules/contrib/rpcbind.te
33+++ b/policy/modules/contrib/rpcbind.te
34@@ -67,3 +67,8 @@ logging_send_syslog_msg(rpcbind_t)
35 miscfiles_read_localization(rpcbind_t)
36
37 sysnet_dns_name_resolve(rpcbind_t)
38+
39+# nfsd_t would not be allowed to send unix_stream_socket to rpcbind_t,
40+# because the are running in different level. So add rules to allow this.
41+mls_socket_read_all_levels(rpcbind_t)
42+mls_socket_write_all_levels(rpcbind_t)
43diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
44index 376bae8..310d992 100644
45--- a/policy/modules/kernel/filesystem.te
46+++ b/policy/modules/kernel/filesystem.te
47@@ -118,6 +118,7 @@ genfscon mvfs / gen_context(system_u:object_r:mvfs_t,s0)
48
49 type nfsd_fs_t;
50 fs_type(nfsd_fs_t)
51+files_mountpoint(nfsd_fs_t)
52 genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
53
54 type oprofilefs_t;
55diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
56index ab9b6cd..15d3814 100644
57--- a/policy/modules/kernel/kernel.te
58+++ b/policy/modules/kernel/kernel.te
59@@ -284,6 +284,8 @@ mls_process_read_up(kernel_t)
60 mls_process_write_down(kernel_t)
61 mls_file_write_all_levels(kernel_t)
62 mls_file_read_all_levels(kernel_t)
63+mls_socket_write_all_levels(kernel_t)
64+mls_fd_use_all_levels(kernel_t)
65
66 ifdef(`distro_redhat',`
67 # Bugzilla 222337
68--
691.7.5.4
70
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-seutils-manage-config-files.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-seutils-manage-config-files.patch
deleted file mode 100644
index bd76004..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-seutils-manage-config-files.patch
+++ /dev/null
@@ -1,39 +0,0 @@
1Subject: [PATCH] refpolicy: fix selinux utils to manage config files
2
3Upstream-Status: Pending
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/selinuxutil.if | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
11index 3822072..db03ca1 100644
12--- a/policy/modules/system/selinuxutil.if
13+++ b/policy/modules/system/selinuxutil.if
14@@ -680,6 +680,7 @@ interface(`seutil_manage_config',`
15 ')
16
17 files_search_etc($1)
18+ manage_dirs_pattern($1, selinux_config_t, selinux_config_t)
19 manage_files_pattern($1, selinux_config_t, selinux_config_t)
20 read_lnk_files_pattern($1, selinux_config_t, selinux_config_t)
21 ')
22diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
23index e720dcd..6b6a5b3 100644
24--- a/policy/modules/system/userdomain.if
25+++ b/policy/modules/system/userdomain.if
26@@ -1235,6 +1235,10 @@ template(`userdom_security_admin_template',`
27 logging_read_audit_config($1)
28
29 seutil_manage_bin_policy($1)
30+ seutil_manage_default_contexts($1)
31+ seutil_manage_file_contexts($1)
32+ seutil_manage_module_store($1)
33+ seutil_manage_config($1)
34 seutil_run_checkpolicy($1, $2)
35 seutil_run_loadpolicy($1, $2)
36 seutil_run_semanage($1, $2)
37--
381.7.9.5
39
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-xconsole_device_t-as-a-dev_node.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-xconsole_device_t-as-a-dev_node.patch
deleted file mode 100644
index 87ac790..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20120725/poky-policy-fix-xconsole_device_t-as-a-dev_node.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] fix xconsole_device_t as a dev_node.
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/services/xserver.te | 1 +
8 1 files changed, 1 insertions(+), 0 deletions(-)
9
10diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
11index d40f750..5bb97e9 100644
12--- a/policy/modules/services/xserver.te
13+++ b/policy/modules/services/xserver.te
14@@ -151,6 +151,7 @@ userdom_user_tmp_file(xauth_tmp_t)
15 # this is not actually a device, its a pipe
16 type xconsole_device_t;
17 files_type(xconsole_device_t)
18+dev_node(xconsole_device_t)
19 fs_associate_tmpfs(xconsole_device_t)
20 files_associate_tmp(xconsole_device_t)
21
22--
231.7.5.4
24
diff --git a/recipes-security/refpolicy/refpolicy-mls_2.20120725.bb b/recipes-security/refpolicy/refpolicy-mls_2.20120725.bb
deleted file mode 100644
index 4d75322..0000000
--- a/recipes-security/refpolicy/refpolicy-mls_2.20120725.bb
+++ /dev/null
@@ -1,24 +0,0 @@
1SUMMARY = "MLS (Multi Level Security) variant of the SELinux policy"
2DESCRIPTION = "\
3This is the reference policy for SE Linux built with MLS support. \
4It allows giving data labels such as \"Top Secret\" and preventing \
5such data from leaking to processes or files with lower classification. \
6"
7
8PR = "r3"
9
10POLICY_NAME = "mls"
11POLICY_TYPE = "mls"
12POLICY_DISTRO = "redhat"
13POLICY_UBAC = "n"
14POLICY_UNK_PERMS = "allow"
15POLICY_DIRECT_INITRC = "n"
16POLICY_MONOLITHIC = "n"
17POLICY_CUSTOM_BUILDOPT = ""
18POLICY_QUIET = "y"
19
20POLICY_MLS_SENS = "16"
21POLICY_MLS_CATS = "1024"
22POLICY_MCS_CATS = "1024"
23
24include refpolicy_${PV}.inc
diff --git a/recipes-security/refpolicy/refpolicy-standard_2.20120725.bb b/recipes-security/refpolicy/refpolicy-standard_2.20120725.bb
deleted file mode 100644
index 1f3030a..0000000
--- a/recipes-security/refpolicy/refpolicy-standard_2.20120725.bb
+++ /dev/null
@@ -1,18 +0,0 @@
1SUMMARY = "Standard variants of the SELinux policy"
2DESCRIPTION = "\
3This is the reference policy for SELinux built with type enforcement \
4only."
5
6PR = "r3"
7
8POLICY_NAME = "standard"
9POLICY_TYPE = "standard"
10POLICY_DISTRO = "redhat"
11POLICY_UBAC = "n"
12POLICY_UNK_PERMS = "allow"
13POLICY_DIRECT_INITRC = "n"
14POLICY_MONOLITHIC = "n"
15POLICY_CUSTOM_BUILDOPT = ""
16POLICY_QUIET = "y"
17
18include refpolicy_${PV}.inc
diff --git a/recipes-security/refpolicy/refpolicy_2.20120725.inc b/recipes-security/refpolicy/refpolicy_2.20120725.inc
deleted file mode 100644
index 5d1868d..0000000
--- a/recipes-security/refpolicy/refpolicy_2.20120725.inc
+++ /dev/null
@@ -1,57 +0,0 @@
1SRC_URI = "http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2;"
2SRC_URI[md5sum] = "8aaa8a23cc1b7b7045f6f134e879ddb7"
3SRC_URI[sha256sum] = "7cd46ed908a4001368e6509d93e306ec6c9af2bfa6b70db88c9eaaefe257c635"
4
5FILESEXTRAPATHS_prepend := "${THISDIR}/refpolicy-${PV}:"
6
7# Fix file contexts for Poky
8SRC_URI += "file://poky-fc-subs_dist.patch \
9 file://poky-fc-update-alternatives_sysvinit.patch \
10 file://poky-fc-update-alternatives_tinylogin.patch \
11 file://poky-fc-update-alternatives_sysklogd.patch \
12 file://poky-fc-update-alternatives_hostname.patch \
13 file://poky-fc-fix-prefix-path_rpc.patch \
14 file://poky-fc-fix-real-path_resolv.conf.patch \
15 file://poky-fc-fix-real-path_login.patch \
16 file://poky-fc-fix-real-path_shadow.patch \
17 file://poky-fc-fix-bind.patch \
18 file://poky-fc-fix-portmap.patch \
19 file://poky-fc-cgroup.patch \
20 file://poky-fc-clock.patch \
21 file://poky-fc-corecommands.patch \
22 file://poky-fc-dmesg.patch \
23 file://poky-fc-fstools.patch \
24 file://poky-fc-iptables.patch \
25 file://poky-fc-mta.patch \
26 file://poky-fc-netutils.patch \
27 file://poky-fc-networkmanager.patch \
28 file://poky-fc-nscd.patch \
29 file://poky-fc-screen.patch \
30 file://poky-fc-ssh.patch \
31 file://poky-fc-su.patch \
32 file://poky-fc-sysnetwork.patch \
33 "
34
35# Specific policy for Poky
36SRC_URI += "file://poky-policy-add-syslogd_t-to-trusted-object.patch \
37 file://poky-policy-add-rules-for-var-log-symlink.patch \
38 file://poky-policy-add-rules-for-var-log-symlink-apache.patch \
39 file://poky-policy-add-rules-for-var-cache-symlink.patch \
40 file://poky-policy-add-rules-for-tmp-symlink.patch \
41 file://poky-policy-add-rules-for-bsdpty_device_t.patch \
42 file://poky-policy-don-t-audit-tty_device_t.patch \
43 file://poky-policy-allow-dbusd-to-setrlimit-itself.patch \
44 file://poky-policy-allow-dbusd-to-exec-shell-commands.patch \
45 file://poky-policy-allow-nfsd-to-exec-shell-commands.patch \
46 file://poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch \
47 file://poky-policy-allow-nfsd-to-bind-nfs-port.patch \
48 file://poky-policy-allow-setfiles_t-to-read-symlinks.patch \
49 file://poky-policy-fix-new-SELINUXMNT-in-sys.patch \
50 "
51
52# Other policy fixes
53SRC_URI += "file://poky-policy-fix-xconsole_device_t-as-a-dev_node.patch \
54 file://poky-policy-fix-seutils-manage-config-files.patch \
55 "
56
57include refpolicy_common.inc
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-25 23:27:11 +0000