summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorShrikant Bobade <shrikant_bobade@mentor.com>2015-08-03 19:04:37 +0530
committerJoe MacDonald <joe_macdonald@mentor.com>2015-08-07 17:33:21 -0400
commit6a775bb8ed866fac87f2a9b11a8ff11988a40ac6 (patch)
tree4373dff0fef6f2ef4b7b8c8a7289d10bfc11d2cf
parente59f3b7d04bea0a8897a6458f5f5427a364d3388 (diff)
downloadmeta-selinux-6a775bb8ed866fac87f2a9b11a8ff11988a40ac6.tar.gz
refpolicy git: update refpolicy to git repository
A straight update from refpolicy 2.20140311 to refpolicy git repository for the core policy variants and forward-porting of policy patches as appropriate. This approach is useful for building refpolicy & refpolicy-contrib directly from the git repos, rather than release tarballs. It helps to check the refpolicy based on source commits by just updating the git repo rev. as appropriate in refpolicy_git.inc ref: https://github.com/TresysTechnology/refpolicy/wiki Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Diffstat
-rw-r--r--recipes-security/refpolicy/refpolicy-git/ftp-add-ftpd_t-to-mlsfilewrite.patch39
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-clock.patch22
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-corecommands.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-dmesg.patch20
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-bind.patch30
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_login.patch37
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_resolv.conf.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_shadow.patch34
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_su.patch25
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch65
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-ftpwho-dir.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-iptables.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-mta.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-netutils.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-nscd.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-rpm.patch25
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-screen.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-ssh.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-su.patch23
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-subs_dist.patch29
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch41
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-udevd.patch35
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_hostname.patch23
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysklogd.patch59
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysvinit.patch53
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-bsdpty_device_t.patch121
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-syslogd_t-symlink.patch30
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-tmp-symlink.patch99
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-cache-symlink.patch34
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch31
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch29
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch145
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-syslogd_t-to-trusted-object.patch31
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-allow-nfsd-to-exec-shell-commands.patch58
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch29
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-allow-sysadm-to-run-rpcinfo.patch33
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-don-t-audit-tty_device_t.patch35
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-dmesg-to-use-dev-kmsg.patch37
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-new-SELINUXMNT-in-sys.patch229
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch65
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch31
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-seutils-manage-config-files.patch43
-rw-r--r--recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch46
-rw-r--r--recipes-security/refpolicy/refpolicy_git.inc62
44 files changed, 1976 insertions, 0 deletions
diff --git a/recipes-security/refpolicy/refpolicy-git/ftp-add-ftpd_t-to-mlsfilewrite.patch b/recipes-security/refpolicy/refpolicy-git/ftp-add-ftpd_t-to-mlsfilewrite.patch
new file mode 100644
index 0000000..49da4b6
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/ftp-add-ftpd_t-to-mlsfilewrite.patch
@@ -0,0 +1,39 @@
1From e4e95b723d31c7b678a05cd81a96b10185978b4e Mon Sep 17 00:00:00 2001
2From: Roy Li <rongqing.li@windriver.com>
3Date: Mon, 10 Feb 2014 18:10:12 +0800
4Subject: [PATCH] ftp: add ftpd_t to mls_file_write_all_levels
5
6Proftpd will create file under /var/run, but its mls is in high, and
7can not write to lowlevel
8
9Upstream-Status: Pending
10
11type=AVC msg=audit(1392347709.621:15): avc: denied { write } for pid=545 comm="proftpd" name="/" dev="tmpfs" ino=5853 scontext=system_u:system_r:ftpd_t:s15:c0.c1023 tcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 tclass=dir
12type=AVC msg=audit(1392347709.621:15): avc: denied { add_name } for pid=545 comm="proftpd" name="proftpd.delay" scontext=system_u:system_r:ftpd_t:s15:c0.c1023 tcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 tclass=dir
13type=SYSCALL msg=audit(1392347709.621:15): arch=c000003e syscall=2 success=yes exit=3 a0=471910 a1=42 a2=1b6 a3=8 items=0 ppid=539 pid=545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s15:c0.c1023 key=(null)
14
15root@localhost:~# sesearch --allow -s ftpd_t -t var_run_t|grep dir|grep add_name
16 allow ftpd_t var_run_t : dir { ioctl read write getattr lock add_name remove_name search open } ;
17root@localhost:~#
18
19Signed-off-by: Roy Li <rongqing.li@windriver.com>
20---
21 policy/modules/contrib/ftp.te | 2 ++
22 1 file changed, 2 insertions(+)
23
24diff --git a/policy/modules/contrib/ftp.te b/policy/modules/contrib/ftp.te
25index 544c512..12a31dd 100644
26--- a/policy/modules/contrib/ftp.te
27+++ b/policy/modules/contrib/ftp.te
28@@ -144,6 +144,8 @@ role ftpdctl_roles types ftpdctl_t;
29 type ftpdctl_tmp_t;
30 files_tmp_file(ftpdctl_tmp_t)
31
32+mls_file_write_all_levels(ftpd_t)
33+
34 type sftpd_t;
35 domain_type(sftpd_t)
36 role system_r types sftpd_t;
37--
381.7.10.4
39
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-clock.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-clock.patch
new file mode 100644
index 0000000..3ff8f55
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-clock.patch
@@ -0,0 +1,22 @@
1Subject: [PATCH] refpolicy: fix real path for clock
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/clock.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/system/clock.fc b/policy/modules/system/clock.fc
11index c5e05ca..a74c40c 100644
12--- a/policy/modules/system/clock.fc
13+++ b/policy/modules/system/clock.fc
14@@ -2,4 +2,5 @@
15 /etc/adjtime -- gen_context(system_u:object_r:adjtime_t,s0)
16
17 /sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)
18+/sbin/hwclock\.util-linux -- gen_context(system_u:object_r:hwclock_exec_t,s0)
19
20--
211.7.11.7
22
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-corecommands.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-corecommands.patch
new file mode 100644
index 0000000..24b67c3
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-corecommands.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for corecommands
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/kernel/corecommands.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
11index f051c4a..ab624f3 100644
12--- a/policy/modules/kernel/corecommands.fc
13+++ b/policy/modules/kernel/corecommands.fc
14@@ -153,6 +153,7 @@ ifdef(`distro_gentoo',`
15 /sbin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0)
16 /sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0)
17 /sbin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
18+/usr/sbin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
19
20 #
21 # /opt
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-dmesg.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-dmesg.patch
new file mode 100644
index 0000000..db4c4d4
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-dmesg.patch
@@ -0,0 +1,20 @@
1Subject: [PATCH] refpolicy: fix real path for dmesg
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/dmesg.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/admin/dmesg.fc b/policy/modules/admin/dmesg.fc
11index d6cc2d9..7f3e5b0 100644
12--- a/policy/modules/admin/dmesg.fc
13+++ b/policy/modules/admin/dmesg.fc
14@@ -1,2 +1,3 @@
15
16 /bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)
17+/bin/dmesg\.util-linux -- gen_context(system_u:object_r:dmesg_exec_t,s0)
18--
191.7.11.7
20
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-bind.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-bind.patch
new file mode 100644
index 0000000..59ba5bc
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-bind.patch
@@ -0,0 +1,30 @@
1From e438a9466a615db3f63421157d5ee3bd6d055403 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:09:11 +0800
4Subject: [PATCH] refpolicy: fix real path for bind.
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/bind.fc | 2 ++
11 1 file changed, 2 insertions(+)
12
13diff --git a/policy/modules/contrib/bind.fc b/policy/modules/contrib/bind.fc
14index 2b9a3a1..fd45d53 100644
15--- a/policy/modules/contrib/bind.fc
16+++ b/policy/modules/contrib/bind.fc
17@@ -1,8 +1,10 @@
18 /etc/rc\.d/init\.d/named -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
19+/etc/rc\.d/init\.d/bind -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
20 /etc/rc\.d/init\.d/unbound -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
21
22 /etc/bind(/.*)? gen_context(system_u:object_r:named_zone_t,s0)
23 /etc/bind/named\.conf.* -- gen_context(system_u:object_r:named_conf_t,s0)
24+/etc/bind/rndc\.conf -- gen_context(system_u:object_r:named_conf_t,s0)
25 /etc/bind/rndc\.key -- gen_context(system_u:object_r:dnssec_t,s0)
26 /etc/dnssec-trigger/dnssec_trigger_server\.key -- gen_context(system_u:object_r:dnssec_t,s0)
27 /etc/named\.rfc1912\.zones -- gen_context(system_u:object_r:named_conf_t,s0)
28--
291.7.9.5
30
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_login.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_login.patch
new file mode 100644
index 0000000..427181e
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_login.patch
@@ -0,0 +1,37 @@
1Subject: [PATCH] fix real path for login commands.
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/authlogin.fc | 7 ++++---
8 1 files changed, 4 insertions(+), 3 deletions(-)
9
10diff --git a/policy/modules/system/authlogin.fc b/policy/modules/system/authlogin.fc
11index 28ad538..c8dd17f 100644
12--- a/policy/modules/system/authlogin.fc
13+++ b/policy/modules/system/authlogin.fc
14@@ -1,5 +1,7 @@
15
16 /bin/login -- gen_context(system_u:object_r:login_exec_t,s0)
17+/bin/login\.shadow -- gen_context(system_u:object_r:login_exec_t,s0)
18+/bin/login\.tinylogin -- gen_context(system_u:object_r:login_exec_t,s0)
19
20 /etc/\.pwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
21 /etc/group\.lock -- gen_context(system_u:object_r:shadow_t,s0)
22@@ -9,9 +11,9 @@
23
24 /sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0)
25 /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
26-/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
27-/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
28-/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
29+/usr/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
30+/usr/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
31+/usr/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
32 ifdef(`distro_suse', `
33 /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
34 ')
35--
361.7.5.4
37
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_resolv.conf.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_resolv.conf.patch
new file mode 100644
index 0000000..80cca67
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_resolv.conf.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] fix real path for resolv.conf
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/sysnetwork.fc | 1 +
8 1 files changed, 1 insertions(+), 0 deletions(-)
9
10diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
11index 346a7cc..dec8632 100644
12--- a/policy/modules/system/sysnetwork.fc
13+++ b/policy/modules/system/sysnetwork.fc
14@@ -24,6 +24,7 @@ ifdef(`distro_debian',`
15 /etc/hosts\.deny.* -- gen_context(system_u:object_r:net_conf_t,s0)
16 /etc/denyhosts.* -- gen_context(system_u:object_r:net_conf_t,s0)
17 /etc/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
18+/var/run/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
19 /etc/yp\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
20
21 /etc/dhcp3(/.*)? gen_context(system_u:object_r:dhcp_etc_t,s0)
22--
231.7.5.4
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_shadow.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_shadow.patch
new file mode 100644
index 0000000..29ac2c3
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_shadow.patch
@@ -0,0 +1,34 @@
1Subject: [PATCH] fix real path for shadow commands.
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/usermanage.fc | 6 ++++++
8 1 file changed, 6 insertions(+)
9
10diff --git a/policy/modules/admin/usermanage.fc b/policy/modules/admin/usermanage.fc
11index f82f0ce..841ba9b 100644
12--- a/policy/modules/admin/usermanage.fc
13+++ b/policy/modules/admin/usermanage.fc
14@@ -4,11 +4,17 @@ ifdef(`distro_gentoo',`
15
16 /usr/bin/chage -- gen_context(system_u:object_r:passwd_exec_t,s0)
17 /usr/bin/chfn -- gen_context(system_u:object_r:chfn_exec_t,s0)
18+/usr/bin/chfn\.shadow -- gen_context(system_u:object_r:chfn_exec_t,s0)
19 /usr/bin/chsh -- gen_context(system_u:object_r:chfn_exec_t,s0)
20+/usr/bin/chsh\.shadow -- gen_context(system_u:object_r:chfn_exec_t,s0)
21 /usr/bin/gpasswd -- gen_context(system_u:object_r:groupadd_exec_t,s0)
22 /usr/bin/passwd -- gen_context(system_u:object_r:passwd_exec_t,s0)
23+/usr/bin/passwd\.shadow -- gen_context(system_u:object_r:passwd_exec_t,s0)
24+/usr/bin/passwd\.tinylogin -- gen_context(system_u:object_r:passwd_exec_t,s0)
25 /usr/bin/vigr -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
26+/sbin/vigr\.shadow -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
27 /usr/bin/vipw -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
28+/sbin/vipw\.shadow -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
29
30 /usr/lib/cracklib_dict.* -- gen_context(system_u:object_r:crack_db_t,s0)
31
32--
331.7.9.5
34
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_su.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_su.patch
new file mode 100644
index 0000000..b0392ce
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_su.patch
@@ -0,0 +1,25 @@
1From 4affa5e9797f5d51597c9b8e0f2503883c766699 Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Thu, 13 Feb 2014 00:33:07 -0500
4Subject: [PATCH] fix real path for su.shadow command
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9---
10 policy/modules/admin/su.fc | 2 ++
11 1 file changed, 2 insertions(+)
12
13diff --git a/policy/modules/admin/su.fc b/policy/modules/admin/su.fc
14index a563687..0f43827 100644
15--- a/policy/modules/admin/su.fc
16+++ b/policy/modules/admin/su.fc
17@@ -4,3 +4,5 @@
18
19 /usr/(local/)?bin/ksu -- gen_context(system_u:object_r:su_exec_t,s0)
20 /usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0)
21+
22+/bin/su.shadow -- gen_context(system_u:object_r:su_exec_t,s0)
23--
241.7.9.5
25
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch
new file mode 100644
index 0000000..38c96c4
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch
@@ -0,0 +1,65 @@
1From 7fdfd2ef8764ddfaeb43e53a756af83d42d8ac8b Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Mon, 27 Jan 2014 03:54:01 -0500
4Subject: [PATCH] refpolicy: fix real path for fstools
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/system/fstools.fc | 11 +++++++++++
12 1 file changed, 11 insertions(+)
13
14--- a/policy/modules/system/fstools.fc
15+++ b/policy/modules/system/fstools.fc
16@@ -1,6 +1,8 @@
17 /sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
18 /sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
19+/sbin/blkid\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
20 /sbin/blockdev -- gen_context(system_u:object_r:fsadm_exec_t,s0)
21+/sbin/blockdev\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
22 /sbin/cfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
23 /sbin/dosfsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
24 /sbin/dump -- gen_context(system_u:object_r:fsadm_exec_t,s0)
25@@ -9,9 +11,11 @@
26 /sbin/e4fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
27 /sbin/e2label -- gen_context(system_u:object_r:fsadm_exec_t,s0)
28 /sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
29+/sbin/fdisk\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
30 /sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
31 /sbin/fsck.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
32 /sbin/hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
33+/sbin/hdparm\.hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
34 /sbin/install-mbr -- gen_context(system_u:object_r:fsadm_exec_t,s0)
35 /sbin/jfs_.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
36 /sbin/losetup.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
37@@ -24,6 +28,7 @@
38 /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
39 /sbin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
40 /sbin/mkswap -- gen_context(system_u:object_r:fsadm_exec_t,s0)
41+/sbin/mkswap\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
42 /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
43 /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
44 /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
45@@ -34,6 +39,7 @@
46 /sbin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0)
47 /sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
48 /sbin/swapoff -- gen_context(system_u:object_r:fsadm_exec_t,s0)
49+/sbin/swapoff\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
50 /sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
51 /sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
52 /sbin/zdb -- gen_context(system_u:object_r:fsadm_exec_t,s0)
53@@ -50,7 +56,12 @@
54
55 /usr/sbin/clubufflush -- gen_context(system_u:object_r:fsadm_exec_t,s0)
56 /usr/sbin/fatsort -- gen_context(system_u:object_r:fsadm_exec_t,s0)
57+/usr/sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
58 /usr/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
59+/usr/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
60+/usr/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
61+/usr/sbin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0)
62+/usr/sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
63 /usr/sbin/smartctl -- gen_context(system_u:object_r:fsadm_exec_t,s0)
64
65 /var/log/fsck(/.*)? gen_context(system_u:object_r:fsadm_log_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-ftpwho-dir.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-ftpwho-dir.patch
new file mode 100644
index 0000000..a7d434f
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-ftpwho-dir.patch
@@ -0,0 +1,27 @@
1fix ftpwho install dir
2
3Upstream-Status: Pending
4
5ftpwho is installed into /usr/bin/, not /usr/sbin, so fix it
6
7Signed-off-by: Roy Li <rongqing.li@windriver.com>
8---
9 policy/modules/contrib/ftp.fc | 2 +-
10 1 file changed, 1 insertion(+), 1 deletion(-)
11
12diff --git a/policy/modules/contrib/ftp.fc b/policy/modules/contrib/ftp.fc
13index ddb75c1..26fec47 100644
14--- a/policy/modules/contrib/ftp.fc
15+++ b/policy/modules/contrib/ftp.fc
16@@ -9,7 +9,7 @@
17
18 /usr/kerberos/sbin/ftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
19
20-/usr/sbin/ftpwho -- gen_context(system_u:object_r:ftpd_exec_t,s0)
21+/usr/bin/ftpwho -- gen_context(system_u:object_r:ftpd_exec_t,s0)
22 /usr/sbin/in\.ftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
23 /usr/sbin/muddleftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
24 /usr/sbin/proftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
25--
261.7.10.4
27
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-iptables.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-iptables.patch
new file mode 100644
index 0000000..89b1547
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-iptables.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for iptables
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/iptables.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
11index 14cffd2..84ac92b 100644
12--- a/policy/modules/system/iptables.fc
13+++ b/policy/modules/system/iptables.fc
14@@ -13,6 +13,7 @@
15 /sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
16 /sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
17 /sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
18+/usr/sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
19
20 /usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
21 /usr/sbin/iptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-mta.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-mta.patch
new file mode 100644
index 0000000..bbd83ec
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-mta.patch
@@ -0,0 +1,27 @@
1From c0bb2996db4f55f3987967bacfb99805fc45d027 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:21:55 +0800
4Subject: [PATCH] refpolicy: fix real path for mta
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/mta.fc | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/policy/modules/contrib/mta.fc b/policy/modules/contrib/mta.fc
14index f42896c..0d4bcef 100644
15--- a/policy/modules/contrib/mta.fc
16+++ b/policy/modules/contrib/mta.fc
17@@ -22,6 +22,7 @@ HOME_DIR/\.maildir(/.*)? gen_context(system_u:object_r:mail_home_rw_t,s0)
18 /usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
19 /usr/sbin/sendmail\.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0)
20 /usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0)
21+/usr/sbin/msmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
22 /usr/sbin/ssmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
23
24 /var/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0)
25--
261.7.9.5
27
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-netutils.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-netutils.patch
new file mode 100644
index 0000000..b45d03e
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-netutils.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for netutils
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/netutils.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/admin/netutils.fc b/policy/modules/admin/netutils.fc
11index 407078f..f2ed3dc 100644
12--- a/policy/modules/admin/netutils.fc
13+++ b/policy/modules/admin/netutils.fc
14@@ -3,6 +3,7 @@
15 /bin/traceroute.* -- gen_context(system_u:object_r:traceroute_exec_t,s0)
16
17 /sbin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
18+/bin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
19
20 /usr/bin/lft -- gen_context(system_u:object_r:traceroute_exec_t,s0)
21 /usr/bin/nmap -- gen_context(system_u:object_r:traceroute_exec_t,s0)
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-nscd.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-nscd.patch
new file mode 100644
index 0000000..1db328c
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-nscd.patch
@@ -0,0 +1,27 @@
1From 642fab321a5f1f40495b4ca07f1fca4145024986 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:25:36 +0800
4Subject: [PATCH] refpolicy: fix real path for nscd
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/nscd.fc | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/policy/modules/contrib/nscd.fc b/policy/modules/contrib/nscd.fc
14index ba64485..61a6f24 100644
15--- a/policy/modules/contrib/nscd.fc
16+++ b/policy/modules/contrib/nscd.fc
17@@ -1,6 +1,7 @@
18 /etc/rc\.d/init\.d/nscd -- gen_context(system_u:object_r:nscd_initrc_exec_t,s0)
19
20 /usr/sbin/nscd -- gen_context(system_u:object_r:nscd_exec_t,s0)
21+/usr/bin/nscd -- gen_context(system_u:object_r:nscd_exec_t,s0)
22
23 /var/cache/nscd(/.*)? gen_context(system_u:object_r:nscd_var_run_t,s0)
24
25--
261.7.9.5
27
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-rpm.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-rpm.patch
new file mode 100644
index 0000000..7ba3380
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-rpm.patch
@@ -0,0 +1,25 @@
1From 3ecbd842d51a8e70b3403e857a24203285d4983b Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Mon, 27 Jan 2014 01:13:06 -0500
4Subject: [PATCH] refpolicy: fix real path for cpio
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9---
10 policy/modules/contrib/rpm.fc | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/policy/modules/contrib/rpm.fc b/policy/modules/contrib/rpm.fc
14index ebe91fc..539063c 100644
15--- a/policy/modules/contrib/rpm.fc
16+++ b/policy/modules/contrib/rpm.fc
17@@ -58,4 +58,5 @@ ifdef(`distro_redhat',`
18
19 ifdef(`enable_mls',`
20 /usr/sbin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
21+/bin/cpio.cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
22 ')
23--
241.7.9.5
25
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-screen.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-screen.patch
new file mode 100644
index 0000000..3218194
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-screen.patch
@@ -0,0 +1,27 @@
1From 3615e2d67f402a37ae7333e62b54f1d9d0a3bfd1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:27:19 +0800
4Subject: [PATCH] refpolicy: fix real path for screen
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/screen.fc | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/policy/modules/contrib/screen.fc b/policy/modules/contrib/screen.fc
14index e7c2cf7..49ddca2 100644
15--- a/policy/modules/contrib/screen.fc
16+++ b/policy/modules/contrib/screen.fc
17@@ -3,6 +3,7 @@ HOME_DIR/\.screenrc -- gen_context(system_u:object_r:screen_home_t,s0)
18 HOME_DIR/\.tmux\.conf -- gen_context(system_u:object_r:screen_home_t,s0)
19
20 /usr/bin/screen -- gen_context(system_u:object_r:screen_exec_t,s0)
21+/usr/bin/screen-.* -- gen_context(system_u:object_r:screen_exec_t,s0)
22 /usr/bin/tmux -- gen_context(system_u:object_r:screen_exec_t,s0)
23
24 /var/run/screen(/.*)? gen_context(system_u:object_r:screen_var_run_t,s0)
25--
261.7.9.5
27
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-ssh.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-ssh.patch
new file mode 100644
index 0000000..9aeb3a2
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-ssh.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for ssh
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/services/ssh.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
11index 078bcd7..9717428 100644
12--- a/policy/modules/services/ssh.fc
13+++ b/policy/modules/services/ssh.fc
14@@ -6,6 +6,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
15 /etc/ssh/ssh_host_rsa_key -- gen_context(system_u:object_r:sshd_key_t,s0)
16
17 /usr/bin/ssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
18+/usr/bin/ssh\.openssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
19 /usr/bin/ssh-agent -- gen_context(system_u:object_r:ssh_agent_exec_t,s0)
20 /usr/bin/ssh-keygen -- gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
21
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-su.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-su.patch
new file mode 100644
index 0000000..358e4ef
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-su.patch
@@ -0,0 +1,23 @@
1Subject: [PATCH] refpolicy: fix real path for su
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/su.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/admin/su.fc b/policy/modules/admin/su.fc
11index 688abc2..a563687 100644
12--- a/policy/modules/admin/su.fc
13+++ b/policy/modules/admin/su.fc
14@@ -1,5 +1,6 @@
15
16 /bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
17+/usr/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
18
19 /usr/(local/)?bin/ksu -- gen_context(system_u:object_r:su_exec_t,s0)
20 /usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0)
21--
221.7.11.7
23
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-subs_dist.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-subs_dist.patch
new file mode 100644
index 0000000..cfec7d9
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-subs_dist.patch
@@ -0,0 +1,29 @@
1Subject: [PATCH] fix file_contexts.subs_dist for poky
2
3This file is used for Linux distros to define specific pathes
4mapping to the pathes in file_contexts.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 config/file_contexts.subs_dist | 10 ++++++++++
12 1 file changed, 10 insertions(+)
13
14--- a/config/file_contexts.subs_dist
15+++ b/config/file_contexts.subs_dist
16@@ -19,3 +19,13 @@
17 /usr/local/lib64 /usr/lib
18 /usr/local/lib /usr/lib
19 /var/run/lock /var/lock
20+/var/volatile/log /var/log
21+/var/volatile/run /var/run
22+/var/volatile/cache /var/cache
23+/var/volatile/tmp /var/tmp
24+/var/volatile/lock /var/lock
25+/var/volatile/run/lock /var/lock
26+/www /var/www
27+/usr/lib/busybox/bin /bin
28+/usr/lib/busybox/sbin /sbin
29+/usr/lib/busybox/usr /usr
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch
new file mode 100644
index 0000000..e0af6a1
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch
@@ -0,0 +1,41 @@
1Subject: [PATCH] refpolicy: fix real path for sysnetwork
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/sysnetwork.fc | 4 ++++
8 1 file changed, 4 insertions(+)
9
10diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
11index dec8632..2e602e4 100644
12--- a/policy/modules/system/sysnetwork.fc
13+++ b/policy/modules/system/sysnetwork.fc
14@@ -3,6 +3,7 @@
15 # /bin
16 #
17 /bin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
18+/sbin/ip\.iproute2 -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
19
20 #
21 # /dev
22@@ -43,13 +44,16 @@ ifdef(`distro_redhat',`
23 /sbin/dhcdbd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
24 /sbin/dhcpcd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
25 /sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
26+/usr/sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
27 /sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
28+/sbin/ifconfig\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
29 /sbin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
30 /sbin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
31 /sbin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
32 /sbin/ipx_internal_net -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
33 /sbin/iwconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
34 /sbin/mii-tool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
35+/sbin/mii-tool\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
36 /sbin/pump -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
37 /sbin/tc -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
38
39--
401.7.11.7
41
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-udevd.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-udevd.patch
new file mode 100644
index 0000000..c6c19be
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-udevd.patch
@@ -0,0 +1,35 @@
1From 025bd3c77d3eeb0e316413bf7e6353f1ccd7f6b2 Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Sat, 25 Jan 2014 23:40:05 -0500
4Subject: [PATCH] refpolicy: fix real path for udevd/udevadm
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9---
10 policy/modules/system/udev.fc | 2 ++
11 1 file changed, 2 insertions(+)
12
13diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc
14index 40928d8..491bb23 100644
15--- a/policy/modules/system/udev.fc
16+++ b/policy/modules/system/udev.fc
17@@ -10,6 +10,7 @@
18 /etc/udev/scripts/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
19
20 /lib/udev/udev-acl -- gen_context(system_u:object_r:udev_exec_t,s0)
21+/lib/udev/udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
22
23 ifdef(`distro_debian',`
24 /lib/udev/create_static_nodes -- gen_context(system_u:object_r:udev_exec_t,s0)
25@@ -27,6 +28,7 @@ ifdef(`distro_redhat',`
26 ')
27
28 /usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0)
29+/usr/bin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
30
31 /usr/lib/systemd/systemd-udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
32
33--
341.7.9.5
35
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_hostname.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_hostname.patch
new file mode 100644
index 0000000..cedb5b5
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_hostname.patch
@@ -0,0 +1,23 @@
1From 845518a6f196e6e8c49ba38791c85e17276920e1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 3/4] fix update-alternatives for hostname
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/system/hostname.fc | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/policy/modules/system/hostname.fc b/policy/modules/system/hostname.fc
14index 9dfecf7..4003b6d 100644
15--- a/policy/modules/system/hostname.fc
16+++ b/policy/modules/system/hostname.fc
17@@ -1,2 +1,3 @@
18
19 /bin/hostname -- gen_context(system_u:object_r:hostname_exec_t,s0)
20+/bin/hostname\.net-tools -- gen_context(system_u:object_r:hostname_exec_t,s0)
21--
221.7.9.5
23
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysklogd.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysklogd.patch
new file mode 100644
index 0000000..868ee6b
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysklogd.patch
@@ -0,0 +1,59 @@
1From 4964fa5593349916d8f5c69edb0b16f611586098 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:39:41 +0800
4Subject: [PATCH 2/4] fix update-alternatives for sysklogd
5
6/etc/syslog.conf is a symlink to /etc/syslog.conf.sysklogd, so a allow rule
7for syslogd_t to read syslog_conf_t lnk_file is needed.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12---
13 policy/modules/system/logging.fc | 4 ++++
14 policy/modules/system/logging.te | 1 +
15 2 files changed, 5 insertions(+)
16
17diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
18index b50c5fe..c005f33 100644
19--- a/policy/modules/system/logging.fc
20+++ b/policy/modules/system/logging.fc
21@@ -2,19 +2,23 @@
22
23 /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
24 /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
25+/etc/syslog.conf\.sysklogd gen_context(system_u:object_r:syslog_conf_t,s0)
26 /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
27 /etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0)
28 /etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
29+/etc/rc\.d/init\.d/syslog\.sysklogd -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
30
31 /sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0)
32 /sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0)
33 /sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)
34 /sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
35 /sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
36+/sbin/klogd\.sysklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
37 /sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
38 /sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
39 /sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
40 /sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
41+/sbin/syslogd\.sysklogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
42 /sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
43
44 /usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
45diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
46index 87e3db2..2914b0b 100644
47--- a/policy/modules/system/logging.te
48+++ b/policy/modules/system/logging.te
49@@ -371,6 +371,7 @@ allow syslogd_t self:udp_socket create_socket_perms;
50 allow syslogd_t self:tcp_socket create_stream_socket_perms;
51
52 allow syslogd_t syslog_conf_t:file read_file_perms;
53+allow syslogd_t syslog_conf_t:lnk_file read_file_perms;
54
55 # Create and bind to /dev/log or /var/run/log.
56 allow syslogd_t devlog_t:sock_file manage_sock_file_perms;
57--
581.7.9.5
59
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysvinit.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysvinit.patch
new file mode 100644
index 0000000..3a617d8
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysvinit.patch
@@ -0,0 +1,53 @@
1From 22cd030a8118faae37c0835eb7875e482efe5dc1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 1/4] fix update-alternatives for sysvinit
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/shutdown.fc | 1 +
11 policy/modules/kernel/corecommands.fc | 1 +
12 policy/modules/system/init.fc | 1 +
13 3 files changed, 3 insertions(+)
14
15diff --git a/policy/modules/contrib/shutdown.fc b/policy/modules/contrib/shutdown.fc
16index a91f33b..90e51e0 100644
17--- a/policy/modules/contrib/shutdown.fc
18+++ b/policy/modules/contrib/shutdown.fc
19@@ -3,6 +3,7 @@
20 /lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
21
22 /sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
23+/sbin/shutdown\.sysvinit -- gen_context(system_u:object_r:shutdown_exec_t,s0)
24
25 /usr/lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
26
27diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
28index bcfdba7..87502a3 100644
29--- a/policy/modules/kernel/corecommands.fc
30+++ b/policy/modules/kernel/corecommands.fc
31@@ -10,6 +10,7 @@
32 /bin/ksh.* -- gen_context(system_u:object_r:shell_exec_t,s0)
33 /bin/mksh -- gen_context(system_u:object_r:shell_exec_t,s0)
34 /bin/mountpoint -- gen_context(system_u:object_r:bin_t,s0)
35+/bin/mountpoint\.sysvinit -- gen_context(system_u:object_r:bin_t,s0)
36 /bin/sash -- gen_context(system_u:object_r:shell_exec_t,s0)
37 /bin/tcsh -- gen_context(system_u:object_r:shell_exec_t,s0)
38 /bin/yash -- gen_context(system_u:object_r:shell_exec_t,s0)
39diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
40index bc0ffc8..020b9fe 100644
41--- a/policy/modules/system/init.fc
42+++ b/policy/modules/system/init.fc
43@@ -30,6 +30,7 @@ ifdef(`distro_gentoo', `
44 # /sbin
45 #
46 /sbin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0)
47+/sbin/init\.sysvinit -- gen_context(system_u:object_r:init_exec_t,s0)
48 # because nowadays, /sbin/init is often a symlink to /sbin/upstart
49 /sbin/upstart -- gen_context(system_u:object_r:init_exec_t,s0)
50
51--
521.7.9.5
53
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-bsdpty_device_t.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-bsdpty_device_t.patch
new file mode 100644
index 0000000..9a3322f
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-bsdpty_device_t.patch
@@ -0,0 +1,121 @@
1From c0b65c327b9354ee5c403cbde428e762ce3f327e Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 5/6] add rules for bsdpty_device_t to complete pty devices.
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/kernel/terminal.if | 16 ++++++++++++++++
11 1 file changed, 16 insertions(+)
12
13diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
14index 771bce1..7519d0e 100644
15--- a/policy/modules/kernel/terminal.if
16+++ b/policy/modules/kernel/terminal.if
17@@ -531,9 +531,11 @@ interface(`term_dontaudit_manage_pty_dirs',`
18 interface(`term_dontaudit_getattr_generic_ptys',`
19 gen_require(`
20 type devpts_t;
21+ type bsdpty_device_t;
22 ')
23
24 dontaudit $1 devpts_t:chr_file getattr;
25+ dontaudit $1 bsdpty_device_t:chr_file getattr;
26 ')
27 ########################################
28 ## <summary>
29@@ -549,11 +551,13 @@ interface(`term_dontaudit_getattr_generic_ptys',`
30 interface(`term_ioctl_generic_ptys',`
31 gen_require(`
32 type devpts_t;
33+ type bsdpty_device_t;
34 ')
35
36 dev_list_all_dev_nodes($1)
37 allow $1 devpts_t:dir search;
38 allow $1 devpts_t:chr_file ioctl;
39+ allow $1 bsdpty_device_t:chr_file ioctl;
40 ')
41
42 ########################################
43@@ -571,9 +575,11 @@ interface(`term_ioctl_generic_ptys',`
44 interface(`term_setattr_generic_ptys',`
45 gen_require(`
46 type devpts_t;
47+ type bsdpty_device_t;
48 ')
49
50 allow $1 devpts_t:chr_file setattr;
51+ allow $1 bsdpty_device_t:chr_file setattr;
52 ')
53
54 ########################################
55@@ -591,9 +597,11 @@ interface(`term_setattr_generic_ptys',`
56 interface(`term_dontaudit_setattr_generic_ptys',`
57 gen_require(`
58 type devpts_t;
59+ type bsdpty_device_t;
60 ')
61
62 dontaudit $1 devpts_t:chr_file setattr;
63+ dontaudit $1 bsdpty_device_t:chr_file setattr;
64 ')
65
66 ########################################
67@@ -611,11 +619,13 @@ interface(`term_dontaudit_setattr_generic_ptys',`
68 interface(`term_use_generic_ptys',`
69 gen_require(`
70 type devpts_t;
71+ type bsdpty_device_t;
72 ')
73
74 dev_list_all_dev_nodes($1)
75 allow $1 devpts_t:dir list_dir_perms;
76 allow $1 devpts_t:chr_file { rw_term_perms lock append };
77+ allow $1 bsdpty_device_t:chr_file { rw_term_perms lock append };
78 ')
79
80 ########################################
81@@ -633,9 +643,11 @@ interface(`term_use_generic_ptys',`
82 interface(`term_dontaudit_use_generic_ptys',`
83 gen_require(`
84 type devpts_t;
85+ type bsdpty_device_t;
86 ')
87
88 dontaudit $1 devpts_t:chr_file { getattr read write ioctl };
89+ dontaudit $1 bsdpty_device_t:chr_file { getattr read write ioctl };
90 ')
91
92 #######################################
93@@ -651,10 +663,12 @@ interface(`term_dontaudit_use_generic_ptys',`
94 interface(`term_setattr_controlling_term',`
95 gen_require(`
96 type devtty_t;
97+ type bsdpty_device_t;
98 ')
99
100 dev_list_all_dev_nodes($1)
101 allow $1 devtty_t:chr_file setattr;
102+ allow $1 bsdpty_device_t:chr_file setattr;
103 ')
104
105 ########################################
106@@ -671,10 +685,12 @@ interface(`term_setattr_controlling_term',`
107 interface(`term_use_controlling_term',`
108 gen_require(`
109 type devtty_t;
110+ type bsdpty_device_t;
111 ')
112
113 dev_list_all_dev_nodes($1)
114 allow $1 devtty_t:chr_file { rw_term_perms lock append };
115+ allow $1 bsdpty_device_t:chr_file { rw_term_perms lock append };
116 ')
117
118 #######################################
119--
1201.7.9.5
121
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-syslogd_t-symlink.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-syslogd_t-symlink.patch
new file mode 100644
index 0000000..aa9734a
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-syslogd_t-symlink.patch
@@ -0,0 +1,30 @@
1Subject: [PATCH] add rules for the symlink of /var/log - syslogd_t
2
3We have added rules for the symlink of /var/log in logging.if,
4while syslogd_t uses /var/log but does not use the
5interfaces in logging.if. So still need add a individual rule for
6syslogd_t.
7
8Upstream-Status: Inappropriate [only for Poky]
9
10Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
11---
12 policy/modules/system/logging.te | 2 ++
13 1 file changed, 2 insertions(+)
14
15diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
16index 2ad9ea5..70427d8 100644
17--- a/policy/modules/system/logging.te
18+++ b/policy/modules/system/logging.te
19@@ -384,6 +384,8 @@ rw_fifo_files_pattern(syslogd_t, var_log_t, var_log_t)
20 # Allow access for syslog-ng
21 allow syslogd_t var_log_t:dir { create setattr };
22
23+allow syslogd_t var_log_t:lnk_file read_lnk_file_perms;
24+
25 # manage temporary files
26 manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
27 manage_files_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
28--
291.7.11.7
30
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-tmp-symlink.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-tmp-symlink.patch
new file mode 100644
index 0000000..210c297
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-tmp-symlink.patch
@@ -0,0 +1,99 @@
1From 22cd030a8118faae37c0835eb7875e482efe5dc1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH] add rules for the symlink of /tmp
5
6/tmp is a symlink in poky, so we need allow rules for files to read
7lnk_file while doing search/list/delete/rw.. in /tmp/ directory.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12---
13 policy/modules/kernel/files.fc | 1 +
14 policy/modules/kernel/files.if | 8 ++++++++
15 2 files changed, 9 insertions(+), 0 deletions(-)
16
17diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
18index 8796ca3..a0db748 100644
19--- a/policy/modules/kernel/files.fc
20+++ b/policy/modules/kernel/files.fc
21@@ -185,6 +185,7 @@ ifdef(`distro_debian',`
22 # /tmp
23 #
24 /tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
25+/tmp -l gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
26 /tmp/.* <<none>>
27 /tmp/\.journal <<none>>
28
29diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
30index e1e814d..a7384b0 100644
31--- a/policy/modules/kernel/files.if
32+++ b/policy/modules/kernel/files.if
33@@ -4199,6 +4199,7 @@ interface(`files_search_tmp',`
34 ')
35
36 allow $1 tmp_t:dir search_dir_perms;
37+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
38 ')
39
40 ########################################
41@@ -4235,6 +4236,7 @@ interface(`files_list_tmp',`
42 ')
43
44 allow $1 tmp_t:dir list_dir_perms;
45+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
46 ')
47
48 ########################################
49@@ -4271,6 +4273,7 @@ interface(`files_delete_tmp_dir_entry',`
50 ')
51
52 allow $1 tmp_t:dir del_entry_dir_perms;
53+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
54 ')
55
56 ########################################
57@@ -4289,6 +4292,7 @@ interface(`files_read_generic_tmp_files',`
58 ')
59
60 read_files_pattern($1, tmp_t, tmp_t)
61+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
62 ')
63
64 ########################################
65@@ -4307,6 +4311,7 @@ interface(`files_manage_generic_tmp_dirs',`
66 ')
67
68 manage_dirs_pattern($1, tmp_t, tmp_t)
69+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
70 ')
71
72 ########################################
73@@ -4325,6 +4330,7 @@ interface(`files_manage_generic_tmp_files',`
74 ')
75
76 manage_files_pattern($1, tmp_t, tmp_t)
77+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
78 ')
79
80 ########################################
81@@ -4361,6 +4367,7 @@ interface(`files_rw_generic_tmp_sockets',`
82 ')
83
84 rw_sock_files_pattern($1, tmp_t, tmp_t)
85+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
86 ')
87
88 ########################################
89@@ -4550,6 +4557,7 @@ interface(`files_tmp_filetrans',`
90 ')
91
92 filetrans_pattern($1, tmp_t, $2, $3, $4)
93+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
94 ')
95
96 ########################################
97--
981.7.5.4
99
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-cache-symlink.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-cache-symlink.patch
new file mode 100644
index 0000000..18a92dd
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-cache-symlink.patch
@@ -0,0 +1,34 @@
1From bad816bc752369a6c1bf40231c505d21d95cab08 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 11:20:00 +0800
4Subject: [PATCH 4/6] add rules for the subdir symlinks in /var/
5
6Except /var/log,/var/run,/var/lock, there still other subdir symlinks in
7/var for poky, so we need allow rules for all domains to read these
8symlinks. Domains still need their practical allow rules to read the
9contents, so this is still a secure relax.
10
11Upstream-Status: Inappropriate [only for Poky]
12
13Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
14---
15 policy/modules/kernel/domain.te | 3 +++
16 1 file changed, 3 insertions(+)
17
18diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
19index cf04cb5..9ffe6b0 100644
20--- a/policy/modules/kernel/domain.te
21+++ b/policy/modules/kernel/domain.te
22@@ -104,6 +104,9 @@ term_use_controlling_term(domain)
23 # list the root directory
24 files_list_root(domain)
25
26+# Yocto/oe-core use some var volatile links
27+files_read_var_symlinks(domain)
28+
29 ifdef(`hide_broken_symptoms',`
30 # This check is in the general socket
31 # listen code, before protocol-specific
32--
331.7.9.5
34
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch
new file mode 100644
index 0000000..8bc40c4
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch
@@ -0,0 +1,31 @@
1From ed2b0a00e2fb78056041b03c7e198e8f5adaf939 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:36:44 +0800
4Subject: [PATCH 3/6] add rules for the symlink of /var/log - apache2
5
6We have added rules for the symlink of /var/log in logging.if,
7while apache.te uses /var/log but does not use the interfaces in
8logging.if. So still need add a individual rule for apache.te.
9
10Upstream-Status: Inappropriate [only for Poky]
11
12Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
13---
14 policy/modules/contrib/apache.te | 1 +
15 1 file changed, 1 insertion(+)
16
17diff --git a/policy/modules/contrib/apache.te b/policy/modules/contrib/apache.te
18index ec8bd13..06f2e95 100644
19--- a/policy/modules/contrib/apache.te
20+++ b/policy/modules/contrib/apache.te
21@@ -400,6 +400,7 @@ create_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
22 append_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
23 read_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
24 read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
25+read_lnk_files_pattern(httpd_t, var_log_t, var_log_t)
26 logging_log_filetrans(httpd_t, httpd_log_t, file)
27
28 allow httpd_t httpd_modules_t:dir list_dir_perms;
29--
301.7.9.5
31
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch
new file mode 100644
index 0000000..cbf0f7d
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch
@@ -0,0 +1,29 @@
1Subject: [PATCH] add rules for the symlink of /var/log - audisp_remote_t
2
3We have added rules for the symlink of /var/log in logging.if,
4while audisp_remote_t uses /var/log but does not use the
5interfaces in logging.if. So still need add a individual rule for
6audisp_remote_t.
7
8Upstream-Status: Inappropriate [only for Poky]
9
10Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
11---
12 policy/modules/system/logging.te | 1 +
13 1 file changed, 1 insertion(+)
14
15diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
16index 8426a49..2ad9ea5 100644
17--- a/policy/modules/system/logging.te
18+++ b/policy/modules/system/logging.te
19@@ -262,6 +262,7 @@ allow audisp_remote_t self:capability { setuid setpcap };
20 allow audisp_remote_t self:process { getcap setcap };
21 allow audisp_remote_t self:tcp_socket create_socket_perms;
22 allow audisp_remote_t var_log_t:dir search_dir_perms;
23+allow audisp_remote_t var_log_t:lnk_file read_lnk_file_perms;
24
25 manage_dirs_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
26 manage_files_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
27--
281.7.11.7
29
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch
new file mode 100644
index 0000000..b06f3ef
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch
@@ -0,0 +1,145 @@
1From 03cb6534f75812f3a33ac768fe83861e0805b0e0 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 2/6] add rules for the symlink of /var/log
5
6/var/log is a symlink in poky, so we need allow rules for files to read
7lnk_file while doing search/list/delete/rw.. in /var/log/ directory.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12---
13 policy/modules/system/logging.fc | 1 +
14 policy/modules/system/logging.if | 14 +++++++++++++-
15 policy/modules/system/logging.te | 1 +
16 3 files changed, 15 insertions(+), 1 deletion(-)
17
18diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
19index c005f33..9529e40 100644
20--- a/policy/modules/system/logging.fc
21+++ b/policy/modules/system/logging.fc
22@@ -41,6 +41,7 @@ ifdef(`distro_suse', `
23 /var/dnscache/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
24
25 /var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
26+/var/log -l gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
27 /var/log/.* gen_context(system_u:object_r:var_log_t,s0)
28 /var/log/boot\.log -- gen_context(system_u:object_r:var_log_t,mls_systemhigh)
29 /var/log/messages[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
30diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
31index 4e94884..9a6f599 100644
32--- a/policy/modules/system/logging.if
33+++ b/policy/modules/system/logging.if
34@@ -136,12 +136,13 @@ interface(`logging_set_audit_parameters',`
35 #
36 interface(`logging_read_audit_log',`
37 gen_require(`
38- type auditd_log_t;
39+ type auditd_log_t, var_log_t;
40 ')
41
42 files_search_var($1)
43 read_files_pattern($1, auditd_log_t, auditd_log_t)
44 allow $1 auditd_log_t:dir list_dir_perms;
45+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
46 ')
47
48 ########################################
49@@ -626,6 +627,7 @@ interface(`logging_search_logs',`
50
51 files_search_var($1)
52 allow $1 var_log_t:dir search_dir_perms;
53+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
54 ')
55
56 #######################################
57@@ -663,6 +665,7 @@ interface(`logging_list_logs',`
58
59 files_search_var($1)
60 allow $1 var_log_t:dir list_dir_perms;
61+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
62 ')
63
64 #######################################
65@@ -682,6 +685,7 @@ interface(`logging_rw_generic_log_dirs',`
66
67 files_search_var($1)
68 allow $1 var_log_t:dir rw_dir_perms;
69+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
70 ')
71
72 #######################################
73@@ -793,10 +797,12 @@ interface(`logging_append_all_logs',`
74 interface(`logging_read_all_logs',`
75 gen_require(`
76 attribute logfile;
77+ type var_log_t;
78 ')
79
80 files_search_var($1)
81 allow $1 logfile:dir list_dir_perms;
82+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
83 read_files_pattern($1, logfile, logfile)
84 ')
85
86@@ -815,10 +821,12 @@ interface(`logging_read_all_logs',`
87 interface(`logging_exec_all_logs',`
88 gen_require(`
89 attribute logfile;
90+ type var_log_t;
91 ')
92
93 files_search_var($1)
94 allow $1 logfile:dir list_dir_perms;
95+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
96 can_exec($1, logfile)
97 ')
98
99@@ -880,6 +888,7 @@ interface(`logging_read_generic_logs',`
100
101 files_search_var($1)
102 allow $1 var_log_t:dir list_dir_perms;
103+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
104 read_files_pattern($1, var_log_t, var_log_t)
105 ')
106
107@@ -900,6 +909,7 @@ interface(`logging_write_generic_logs',`
108
109 files_search_var($1)
110 allow $1 var_log_t:dir list_dir_perms;
111+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
112 write_files_pattern($1, var_log_t, var_log_t)
113 ')
114
115@@ -938,6 +948,7 @@ interface(`logging_rw_generic_logs',`
116
117 files_search_var($1)
118 allow $1 var_log_t:dir list_dir_perms;
119+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
120 rw_files_pattern($1, var_log_t, var_log_t)
121 ')
122
123@@ -960,6 +971,7 @@ interface(`logging_manage_generic_logs',`
124
125 files_search_var($1)
126 manage_files_pattern($1, var_log_t, var_log_t)
127+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
128 ')
129
130 ########################################
131diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
132index 2ab0a49..2795d89 100644
133--- a/policy/modules/system/logging.te
134+++ b/policy/modules/system/logging.te
135@@ -139,6 +139,7 @@ allow auditd_t auditd_etc_t:file read_file_perms;
136 manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
137 manage_lnk_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
138 allow auditd_t var_log_t:dir search_dir_perms;
139+allow auditd_t var_log_t:lnk_file read_lnk_file_perms;
140
141 manage_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
142 manage_sock_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
143--
1441.7.9.5
145
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-syslogd_t-to-trusted-object.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-syslogd_t-to-trusted-object.patch
new file mode 100644
index 0000000..92b1592
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-syslogd_t-to-trusted-object.patch
@@ -0,0 +1,31 @@
1From 27e62a5d9ab9993760369ccdad83673e9148cbb2 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 1/6] Add the syslogd_t to trusted object
5
6We add the syslogd_t to trusted object, because other process need
7to have the right to connectto/sendto /dev/log.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Roy.Li <rongqing.li@windriver.com>
12Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
13---
14 policy/modules/system/logging.te | 1 +
15 1 file changed, 1 insertion(+)
16
17diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
18index 2914b0b..2ab0a49 100644
19--- a/policy/modules/system/logging.te
20+++ b/policy/modules/system/logging.te
21@@ -450,6 +450,7 @@ fs_getattr_all_fs(syslogd_t)
22 fs_search_auto_mountpoints(syslogd_t)
23
24 mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
25+mls_trusted_object(syslogd_t) # Other process need to have the right to connectto/sendto /dev/log
26
27 term_write_console(syslogd_t)
28 # Allow syslog to a terminal
29--
301.7.9.5
31
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-nfsd-to-exec-shell-commands.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-nfsd-to-exec-shell-commands.patch
new file mode 100644
index 0000000..e77a730
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-nfsd-to-exec-shell-commands.patch
@@ -0,0 +1,58 @@
1From 22cd030a8118faae37c0835eb7875e482efe5dc1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH] allow nfsd to exec shell commands.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/rpc.te | 2 +-
11 policy/modules/kernel/kernel.if | 18 ++++++++++++++++++
12 2 files changed, 19 insertions(+), 1 deletions(-)
13
14diff --git a/policy/modules/contrib/rpc.te b/policy/modules/contrib/rpc.te
15index 9566932..5605205 100644
16--- a/policy/modules/contrib/rpc.te
17+++ b/policy/modules/contrib/rpc.te
18@@ -203,7 +203,7 @@ kernel_read_network_state(nfsd_t)
19 kernel_dontaudit_getattr_core_if(nfsd_t)
20 kernel_setsched(nfsd_t)
21 kernel_request_load_module(nfsd_t)
22-# kernel_mounton_proc(nfsd_t)
23+kernel_mounton_proc(nfsd_t)
24
25 corenet_sendrecv_nfs_server_packets(nfsd_t)
26 corenet_tcp_bind_nfs_port(nfsd_t)
27diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
28index 649e458..8a669c5 100644
29--- a/policy/modules/kernel/kernel.if
30+++ b/policy/modules/kernel/kernel.if
31@@ -804,6 +804,24 @@ interface(`kernel_unmount_proc',`
32
33 ########################################
34 ## <summary>
35+## Mounton a proc filesystem.
36+## </summary>
37+## <param name="domain">
38+## <summary>
39+## Domain allowed access.
40+## </summary>
41+## </param>
42+#
43+interface(`kernel_mounton_proc',`
44+ gen_require(`
45+ type proc_t;
46+ ')
47+
48+ allow $1 proc_t:dir mounton;
49+')
50+
51+########################################
52+## <summary>
53 ## Get the attributes of the proc filesystem.
54 ## </summary>
55 ## <param name="domain">
56--
571.7.5.4
58
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch
new file mode 100644
index 0000000..71497fb
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch
@@ -0,0 +1,29 @@
1From 22cd030a8118faae37c0835eb7875e482efe5dc1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH] fix setfiles_t to read symlinks
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/system/selinuxutil.te | 3 +++
11 1 files changed, 3 insertions(+), 0 deletions(-)
12
13diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
14index ec01d0b..45ed81b 100644
15--- a/policy/modules/system/selinuxutil.te
16+++ b/policy/modules/system/selinuxutil.te
17@@ -553,6 +553,9 @@ files_list_all(setfiles_t)
18 files_relabel_all_files(setfiles_t)
19 files_read_usr_symlinks(setfiles_t)
20
21+# needs to be able to read symlinks to make restorecon on symlink working
22+files_read_all_symlinks(setfiles_t)
23+
24 fs_getattr_xattr_fs(setfiles_t)
25 fs_list_all(setfiles_t)
26 fs_search_auto_mountpoints(setfiles_t)
27--
281.7.5.4
29
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-sysadm-to-run-rpcinfo.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-sysadm-to-run-rpcinfo.patch
new file mode 100644
index 0000000..ec3dbf4
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-sysadm-to-run-rpcinfo.patch
@@ -0,0 +1,33 @@
1From 7005533d61770fed5a3312aa9dfd1c18dae88c16 Mon Sep 17 00:00:00 2001
2From: Roy Li <rongqing.li@windriver.com>
3Date: Sat, 15 Feb 2014 09:45:00 +0800
4Subject: [PATCH] allow sysadm to run rpcinfo
5
6Upstream-Status: Pending
7
8type=AVC msg=audit(1392427946.976:264): avc: denied { connectto } for pid=2111 comm="rpcinfo" path="/run/rpcbind.sock" scontext=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 tcontext=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 tclass=unix_stream_socket
9type=SYSCALL msg=audit(1392427946.976:264): arch=c000003e syscall=42 success=no exit=-13 a0=3 a1=7fff3aa20000 a2=17 a3=22 items=0 ppid=2108 pid=2111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts0 comm="rpcinfo" exe="/usr/sbin/rpcinfo" subj=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 key=(null)
10
11Signed-off-by: Roy Li <rongqing.li@windriver.com>
12---
13 policy/modules/roles/sysadm.te | 4 ++++
14 1 file changed, 4 insertions(+)
15
16diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
17index 1767217..5502c6a 100644
18--- a/policy/modules/roles/sysadm.te
19+++ b/policy/modules/roles/sysadm.te
20@@ -413,6 +413,10 @@ optional_policy(`
21 ')
22
23 optional_policy(`
24+ rpcbind_stream_connect(sysadm_t)
25+')
26+
27+optional_policy(`
28 vmware_role(sysadm_r, sysadm_t)
29 ')
30
31--
321.7.10.4
33
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-don-t-audit-tty_device_t.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-don-t-audit-tty_device_t.patch
new file mode 100644
index 0000000..82370d8
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-don-t-audit-tty_device_t.patch
@@ -0,0 +1,35 @@
1From 29a0d287880f8f83cf4337a3db7c8b94c0c36e1d Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 6/6] don't audit tty_device_t in term_dontaudit_use_console.
5
6We should also not audit terminal to rw tty_device_t and fds in
7term_dontaudit_use_console.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12---
13 policy/modules/kernel/terminal.if | 3 +++
14 1 file changed, 3 insertions(+)
15
16diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
17index 7519d0e..45de1ac 100644
18--- a/policy/modules/kernel/terminal.if
19+++ b/policy/modules/kernel/terminal.if
20@@ -299,9 +299,12 @@ interface(`term_use_console',`
21 interface(`term_dontaudit_use_console',`
22 gen_require(`
23 type console_device_t;
24+ type tty_device_t;
25 ')
26
27+ init_dontaudit_use_fds($1)
28 dontaudit $1 console_device_t:chr_file rw_chr_file_perms;
29+ dontaudit $1 tty_device_t:chr_file rw_chr_file_perms;
30 ')
31
32 ########################################
33--
341.7.9.5
35
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-dmesg-to-use-dev-kmsg.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-dmesg-to-use-dev-kmsg.patch
new file mode 100644
index 0000000..d6c8dbf
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-dmesg-to-use-dev-kmsg.patch
@@ -0,0 +1,37 @@
1From 2f5981f2244289a1cc79748e9ffdaaea168b1df2 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 16:36:09 +0800
4Subject: [PATCH] fix dmesg to use /dev/kmsg as default input
5
6Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
7---
8 policy/modules/admin/dmesg.if | 1 +
9 policy/modules/admin/dmesg.te | 2 ++
10 2 files changed, 3 insertions(+)
11
12diff --git a/policy/modules/admin/dmesg.if b/policy/modules/admin/dmesg.if
13index e1973c7..739a4bc 100644
14--- a/policy/modules/admin/dmesg.if
15+++ b/policy/modules/admin/dmesg.if
16@@ -37,4 +37,5 @@ interface(`dmesg_exec',`
17
18 corecmd_search_bin($1)
19 can_exec($1, dmesg_exec_t)
20+ dev_read_kmsg($1)
21 ')
22diff --git a/policy/modules/admin/dmesg.te b/policy/modules/admin/dmesg.te
23index 72bc6d8..c591aea 100644
24--- a/policy/modules/admin/dmesg.te
25+++ b/policy/modules/admin/dmesg.te
26@@ -28,6 +28,8 @@ kernel_read_proc_symlinks(dmesg_t)
27
28 dev_read_sysfs(dmesg_t)
29
30+dev_read_kmsg(dmesg_t)
31+
32 fs_search_auto_mountpoints(dmesg_t)
33
34 term_dontaudit_use_console(dmesg_t)
35--
361.7.9.5
37
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-new-SELINUXMNT-in-sys.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-new-SELINUXMNT-in-sys.patch
new file mode 100644
index 0000000..302a38f
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-new-SELINUXMNT-in-sys.patch
@@ -0,0 +1,229 @@
1From 0bd1187768c79ccf7d0563fa8e2bc01494fef167 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH] fix for new SELINUXMNT in /sys
5
6SELINUXMNT is now from /selinux to /sys/fs/selinux, so we should
7add rules to access sysfs.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13---
14 policy/modules/kernel/selinux.if | 34 ++++++++++++++++++++++++++++++++--
15 1 file changed, 32 insertions(+), 2 deletions(-)
16
17--- a/policy/modules/kernel/selinux.if
18+++ b/policy/modules/kernel/selinux.if
19@@ -58,6 +58,10 @@ interface(`selinux_get_fs_mount',`
20 type security_t;
21 ')
22
23+ # SELINUXMNT is now /sys/fs/selinux, so we should add rules to
24+ # access sysfs
25+ dev_getattr_sysfs_dirs($1)
26+ dev_search_sysfs($1)
27 # starting in libselinux 2.0.5, init_selinuxmnt() will
28 # attempt to short circuit by checking if SELINUXMNT
29 # (/selinux) is already a selinuxfs
30@@ -84,6 +88,7 @@ interface(`selinux_dontaudit_get_fs_moun
31 type security_t;
32 ')
33
34+ dev_dontaudit_search_sysfs($1)
35 # starting in libselinux 2.0.5, init_selinuxmnt() will
36 # attempt to short circuit by checking if SELINUXMNT
37 # (/selinux) is already a selinuxfs
38@@ -109,6 +114,8 @@ interface(`selinux_mount_fs',`
39 type security_t;
40 ')
41
42+ dev_getattr_sysfs_dirs($1)
43+ dev_search_sysfs($1)
44 allow $1 security_t:filesystem mount;
45 ')
46
47@@ -128,6 +135,8 @@ interface(`selinux_remount_fs',`
48 type security_t;
49 ')
50
51+ dev_getattr_sysfs_dirs($1)
52+ dev_search_sysfs($1)
53 allow $1 security_t:filesystem remount;
54 ')
55
56@@ -146,6 +155,8 @@ interface(`selinux_unmount_fs',`
57 type security_t;
58 ')
59
60+ dev_getattr_sysfs_dirs($1)
61+ dev_search_sysfs($1)
62 allow $1 security_t:filesystem unmount;
63 ')
64
65@@ -164,6 +175,8 @@ interface(`selinux_getattr_fs',`
66 type security_t;
67 ')
68
69+ dev_getattr_sysfs_dirs($1)
70+ dev_search_sysfs($1)
71 allow $1 security_t:filesystem getattr;
72 ')
73
74@@ -183,6 +196,7 @@ interface(`selinux_dontaudit_getattr_fs'
75 type security_t;
76 ')
77
78+ dev_dontaudit_search_sysfs($1)
79 dontaudit $1 security_t:filesystem getattr;
80 ')
81
82@@ -202,6 +216,7 @@ interface(`selinux_dontaudit_getattr_dir
83 type security_t;
84 ')
85
86+ dev_dontaudit_search_sysfs($1)
87 dontaudit $1 security_t:dir getattr;
88 ')
89
90@@ -220,6 +235,7 @@ interface(`selinux_search_fs',`
91 type security_t;
92 ')
93
94+ dev_getattr_sysfs_dirs($1)
95 dev_search_sysfs($1)
96 allow $1 security_t:dir search_dir_perms;
97 ')
98@@ -239,6 +255,7 @@ interface(`selinux_dontaudit_search_fs',
99 type security_t;
100 ')
101
102+ dev_dontaudit_search_sysfs($1)
103 dontaudit $1 security_t:dir search_dir_perms;
104 ')
105
106@@ -258,6 +275,7 @@ interface(`selinux_dontaudit_read_fs',`
107 type security_t;
108 ')
109
110+ dev_dontaudit_search_sysfs($1)
111 dontaudit $1 security_t:dir search_dir_perms;
112 dontaudit $1 security_t:file read_file_perms;
113 ')
114@@ -279,6 +297,7 @@ interface(`selinux_get_enforce_mode',`
115 type security_t;
116 ')
117
118+ dev_getattr_sysfs_dirs($1)
119 dev_search_sysfs($1)
120 allow $1 security_t:dir list_dir_perms;
121 allow $1 security_t:file read_file_perms;
122@@ -313,6 +332,7 @@ interface(`selinux_set_enforce_mode',`
123 bool secure_mode_policyload;
124 ')
125
126+ dev_getattr_sysfs_dirs($1)
127 dev_search_sysfs($1)
128 allow $1 security_t:dir list_dir_perms;
129 allow $1 security_t:file rw_file_perms;
130@@ -345,6 +365,7 @@ interface(`selinux_load_policy',`
131 bool secure_mode_policyload;
132 ')
133
134+ dev_getattr_sysfs_dirs($1)
135 dev_search_sysfs($1)
136 allow $1 security_t:dir list_dir_perms;
137 allow $1 security_t:file rw_file_perms;
138@@ -375,6 +396,7 @@ interface(`selinux_read_policy',`
139 type security_t;
140 ')
141
142+ dev_getattr_sysfs_dirs($1)
143 dev_search_sysfs($1)
144 allow $1 security_t:dir list_dir_perms;
145 allow $1 security_t:file read_file_perms;
146@@ -440,8 +462,8 @@ interface(`selinux_set_generic_booleans'
147 type security_t;
148 ')
149
150+ dev_getattr_sysfs_dirs($1)
151 dev_search_sysfs($1)
152-
153 allow $1 security_t:dir list_dir_perms;
154 allow $1 security_t:file rw_file_perms;
155
156@@ -482,8 +504,8 @@ interface(`selinux_set_all_booleans',`
157 bool secure_mode_policyload;
158 ')
159
160+ dev_getattr_sysfs_dirs($1)
161 dev_search_sysfs($1)
162-
163 allow $1 security_t:dir list_dir_perms;
164 allow $1 { boolean_type -secure_mode_policyload_t }:file rw_file_perms;
165 allow $1 secure_mode_policyload_t:file read_file_perms;
166@@ -528,6 +550,7 @@ interface(`selinux_set_parameters',`
167 attribute can_setsecparam;
168 ')
169
170+ dev_getattr_sysfs_dirs($1)
171 dev_search_sysfs($1)
172 allow $1 security_t:dir list_dir_perms;
173 allow $1 security_t:file rw_file_perms;
174@@ -552,6 +575,7 @@ interface(`selinux_validate_context',`
175 type security_t;
176 ')
177
178+ dev_getattr_sysfs_dirs($1)
179 dev_search_sysfs($1)
180 allow $1 security_t:dir list_dir_perms;
181 allow $1 security_t:file rw_file_perms;
182@@ -574,6 +598,7 @@ interface(`selinux_dontaudit_validate_co
183 type security_t;
184 ')
185
186+ dev_dontaudit_search_sysfs($1)
187 dontaudit $1 security_t:dir list_dir_perms;
188 dontaudit $1 security_t:file rw_file_perms;
189 dontaudit $1 security_t:security check_context;
190@@ -595,6 +620,7 @@ interface(`selinux_compute_access_vector
191 type security_t;
192 ')
193
194+ dev_getattr_sysfs_dirs($1)
195 dev_search_sysfs($1)
196 allow $1 security_t:dir list_dir_perms;
197 allow $1 security_t:file rw_file_perms;
198@@ -617,6 +643,7 @@ interface(`selinux_compute_create_contex
199 type security_t;
200 ')
201
202+ dev_getattr_sysfs_dirs($1)
203 dev_search_sysfs($1)
204 allow $1 security_t:dir list_dir_perms;
205 allow $1 security_t:file rw_file_perms;
206@@ -639,6 +666,7 @@ interface(`selinux_compute_member',`
207 type security_t;
208 ')
209
210+ dev_getattr_sysfs_dirs($1)
211 dev_search_sysfs($1)
212 allow $1 security_t:dir list_dir_perms;
213 allow $1 security_t:file rw_file_perms;
214@@ -669,6 +697,7 @@ interface(`selinux_compute_relabel_conte
215 type security_t;
216 ')
217
218+ dev_getattr_sysfs_dirs($1)
219 dev_search_sysfs($1)
220 allow $1 security_t:dir list_dir_perms;
221 allow $1 security_t:file rw_file_perms;
222@@ -690,6 +719,7 @@ interface(`selinux_compute_user_contexts
223 type security_t;
224 ')
225
226+ dev_getattr_sysfs_dirs($1)
227 dev_search_sysfs($1)
228 allow $1 security_t:dir list_dir_perms;
229 allow $1 security_t:file rw_file_perms;
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch
new file mode 100644
index 0000000..f04ebec
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch
@@ -0,0 +1,65 @@
1From 054a2d81a42bc127d29a916c64b43ad5a7c97f21 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 12:01:53 +0800
4Subject: [PATCH] fix policy for nfsserver to mount nfsd_fs_t.
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/contrib/rpc.te | 5 +++++
12 policy/modules/contrib/rpcbind.te | 5 +++++
13 policy/modules/kernel/filesystem.te | 1 +
14 policy/modules/kernel/kernel.te | 2 ++
15 4 files changed, 13 insertions(+)
16
17--- a/policy/modules/contrib/rpc.te
18+++ b/policy/modules/contrib/rpc.te
19@@ -263,6 +263,11 @@ tunable_policy(`nfs_export_all_ro',`
20
21 optional_policy(`
22 mount_exec(nfsd_t)
23+ # Should domtrans to mount_t while mounting nfsd_fs_t.
24+ mount_domtrans(nfsd_t)
25+ # nfsd_t need to chdir to /var/lib/nfs and read files.
26+ files_list_var(nfsd_t)
27+ rpc_read_nfs_state_data(nfsd_t)
28 ')
29
30 ########################################
31--- a/policy/modules/contrib/rpcbind.te
32+++ b/policy/modules/contrib/rpcbind.te
33@@ -70,6 +70,11 @@ logging_send_syslog_msg(rpcbind_t)
34
35 miscfiles_read_localization(rpcbind_t)
36
37+# nfsd_t would not be allowed to send unix_stream_socket to rpcbind_t,
38+# because the are running in different level. So add rules to allow this.
39+mls_socket_read_all_levels(rpcbind_t)
40+mls_socket_write_all_levels(rpcbind_t)
41+
42 ifdef(`distro_debian',`
43 term_dontaudit_use_unallocated_ttys(rpcbind_t)
44 ')
45--- a/policy/modules/kernel/filesystem.te
46+++ b/policy/modules/kernel/filesystem.te
47@@ -119,6 +119,7 @@ genfscon mvfs / gen_context(system_u:obj
48
49 type nfsd_fs_t;
50 fs_type(nfsd_fs_t)
51+files_mountpoint(nfsd_fs_t)
52 genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
53
54 type oprofilefs_t;
55--- a/policy/modules/kernel/kernel.te
56+++ b/policy/modules/kernel/kernel.te
57@@ -293,6 +293,8 @@ mls_process_read_up(kernel_t)
58 mls_process_write_down(kernel_t)
59 mls_file_write_all_levels(kernel_t)
60 mls_file_read_all_levels(kernel_t)
61+mls_socket_write_all_levels(kernel_t)
62+mls_fd_use_all_levels(kernel_t)
63
64 ifdef(`distro_redhat',`
65 # Bugzilla 222337
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch
new file mode 100644
index 0000000..90efbd8
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch
@@ -0,0 +1,31 @@
1From 4d2c4c358602b246881210889756f229730505d3 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 14:38:53 +0800
4Subject: [PATCH] fix setfiles statvfs to get file count
5
6New setfiles will read /proc/mounts and use statvfs in
7file_system_count() to get file count of filesystems.
8
9Upstream-Status: pending
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12---
13 policy/modules/system/selinuxutil.te | 2 +-
14 1 file changed, 1 insertion(+), 1 deletion(-)
15
16diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
17index 45ed81b..12c3d2e 100644
18--- a/policy/modules/system/selinuxutil.te
19+++ b/policy/modules/system/selinuxutil.te
20@@ -556,7 +556,7 @@ files_read_usr_symlinks(setfiles_t)
21 # needs to be able to read symlinks to make restorecon on symlink working
22 files_read_all_symlinks(setfiles_t)
23
24-fs_getattr_xattr_fs(setfiles_t)
25+fs_getattr_all_fs(setfiles_t)
26 fs_list_all(setfiles_t)
27 fs_search_auto_mountpoints(setfiles_t)
28 fs_relabelfrom_noxattr_fs(setfiles_t)
29--
301.7.9.5
31
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-seutils-manage-config-files.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-seutils-manage-config-files.patch
new file mode 100644
index 0000000..be33bf1
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-seutils-manage-config-files.patch
@@ -0,0 +1,43 @@
1From be8e015aec19553d3753af132861d24da9ed0265 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 2/2] refpolicy: fix selinux utils to manage config files
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/system/selinuxutil.if | 1 +
11 policy/modules/system/userdomain.if | 4 ++++
12 2 files changed, 5 insertions(+)
13
14diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
15index 3822072..db03ca1 100644
16--- a/policy/modules/system/selinuxutil.if
17+++ b/policy/modules/system/selinuxutil.if
18@@ -680,6 +680,7 @@ interface(`seutil_manage_config',`
19 ')
20
21 files_search_etc($1)
22+ manage_dirs_pattern($1, selinux_config_t, selinux_config_t)
23 manage_files_pattern($1, selinux_config_t, selinux_config_t)
24 read_lnk_files_pattern($1, selinux_config_t, selinux_config_t)
25 ')
26diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
27index b4a691d..20c8bf8 100644
28--- a/policy/modules/system/userdomain.if
29+++ b/policy/modules/system/userdomain.if
30@@ -1277,6 +1277,10 @@ template(`userdom_security_admin_template',`
31 logging_read_audit_config($1)
32
33 seutil_manage_bin_policy($1)
34+ seutil_manage_default_contexts($1)
35+ seutil_manage_file_contexts($1)
36+ seutil_manage_module_store($1)
37+ seutil_manage_config($1)
38 seutil_run_checkpolicy($1, $2)
39 seutil_run_loadpolicy($1, $2)
40 seutil_run_semanage($1, $2)
41--
421.7.9.5
43
diff --git a/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch b/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch
new file mode 100644
index 0000000..80b420c
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch
@@ -0,0 +1,46 @@
1refpolicy: update for systemd
2
3It provides the systemd support for refpolicy
4and related allow rules.
5The restorecon provides systemd init labeled
6as init_exec_t.
7
8Upstream-Status: Pending
9
10
11Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
12
13--- a/policy/modules/contrib/shutdown.fc
14+++ b/policy/modules/contrib/shutdown.fc
15@@ -5,6 +5,9 @@
16 /sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
17 /sbin/shutdown\.sysvinit -- gen_context(system_u:object_r:shutdown_exec_t,s0)
18
19+# systemd support
20+/bin/systemctl -- gen_context(system_u:object_r:shutdown_exec_t,s0)
21+
22 /usr/lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
23
24 /usr/sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
25--- a/policy/modules/system/init.fc
26+++ b/policy/modules/system/init.fc
27@@ -31,6 +31,8 @@
28 #
29 /sbin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0)
30 /sbin/init\.sysvinit -- gen_context(system_u:object_r:init_exec_t,s0)
31+# systemd support
32+/lib/systemd/systemd -- gen_context(system_u:object_r:init_exec_t,s0)
33 # because nowadays, /sbin/init is often a symlink to /sbin/upstart
34 /sbin/upstart -- gen_context(system_u:object_r:init_exec_t,s0)
35
36--- a/policy/modules/system/init.te
37+++ b/policy/modules/system/init.te
38@@ -913,3 +913,8 @@
39 optional_policy(`
40 zebra_read_config(initrc_t)
41 ')
42+
43+# systemd related allow rules
44+allow kernel_t init_t:process dyntransition;
45+allow devpts_t device_t:filesystem associate;
46+allow init_t self:capability2 block_suspend;
diff --git a/recipes-security/refpolicy/refpolicy_git.inc b/recipes-security/refpolicy/refpolicy_git.inc
new file mode 100644
index 0000000..47db820
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy_git.inc
@@ -0,0 +1,62 @@
1SRC_URI = "git://github.com/TresysTechnology/refpolicy.git;protocol=git;branch=master;name=refpolicy;destsuffix=refpolicy"
2SRC_URI += "git://github.com/TresysTechnology/refpolicy-contrib.git;protocol=git;branch=master;name=refpolicy-contrib;destsuffix=refpolicy/policy/modules/contrib"
3
4SRCREV_refpolicy = "${AUTOREV}"
5SRCREV_refpolicy-contrib = "${AUTOREV}"
6
7FILESEXTRAPATHS_prepend := "${THISDIR}/refpolicy-git:"
8
9# Fix file contexts for Poky
10SRC_URI += "file://poky-fc-subs_dist.patch \
11 file://poky-fc-update-alternatives_sysvinit.patch \
12 file://poky-fc-update-alternatives_sysklogd.patch \
13 file://poky-fc-update-alternatives_hostname.patch \
14 file://poky-fc-fix-real-path_resolv.conf.patch \
15 file://poky-fc-fix-real-path_login.patch \
16 file://poky-fc-fix-real-path_shadow.patch \
17 file://poky-fc-fix-bind.patch \
18 file://poky-fc-clock.patch \
19 file://poky-fc-corecommands.patch \
20 file://poky-fc-dmesg.patch \
21 file://poky-fc-fstools.patch \
22 file://poky-fc-iptables.patch \
23 file://poky-fc-mta.patch \
24 file://poky-fc-netutils.patch \
25 file://poky-fc-nscd.patch \
26 file://poky-fc-screen.patch \
27 file://poky-fc-ssh.patch \
28 file://poky-fc-su.patch \
29 file://poky-fc-sysnetwork.patch \
30 file://poky-fc-udevd.patch \
31 file://poky-fc-rpm.patch \
32 file://poky-fc-ftpwho-dir.patch \
33 file://poky-fc-fix-real-path_su.patch \
34 file://refpolicy-update-for_systemd.patch \
35 "
36
37# Specific policy for Poky
38SRC_URI += "file://poky-policy-add-syslogd_t-to-trusted-object.patch \
39 file://poky-policy-add-rules-for-var-log-symlink.patch \
40 file://poky-policy-add-rules-for-var-log-symlink-apache.patch \
41 file://poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch \
42 file://poky-policy-add-rules-for-syslogd_t-symlink.patch \
43 file://poky-policy-add-rules-for-var-cache-symlink.patch \
44 file://poky-policy-add-rules-for-tmp-symlink.patch \
45 file://poky-policy-add-rules-for-bsdpty_device_t.patch \
46 file://poky-policy-don-t-audit-tty_device_t.patch \
47 file://poky-policy-allow-nfsd-to-exec-shell-commands.patch \
48 file://poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch \
49 file://poky-policy-allow-setfiles_t-to-read-symlinks.patch \
50 file://poky-policy-fix-new-SELINUXMNT-in-sys.patch \
51 file://poky-policy-allow-sysadm-to-run-rpcinfo.patch \
52 "
53
54# Other policy fixes
55SRC_URI += " \
56 file://poky-policy-fix-seutils-manage-config-files.patch \
57 file://poky-policy-fix-setfiles-statvfs-get-file-count.patch \
58 file://poky-policy-fix-dmesg-to-use-dev-kmsg.patch \
59 file://ftp-add-ftpd_t-to-mlsfilewrite.patch \
60 "
61
62include refpolicy_common.inc
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-06-05 18:11:59 +0000