summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--recipes-security/refpolicy/refpolicy-git/ftp-add-ftpd_t-to-mlsfilewrite.patch39
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-clock.patch22
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-corecommands.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-dmesg.patch20
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-bind.patch30
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_login.patch37
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_resolv.conf.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_shadow.patch34
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_su.patch25
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch65
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-ftpwho-dir.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-iptables.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-mta.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-netutils.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-nscd.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-rpm.patch25
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-screen.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-ssh.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-su.patch23
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-subs_dist.patch29
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch41
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-udevd.patch35
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_hostname.patch23
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysklogd.patch59
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysvinit.patch53
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-bsdpty_device_t.patch121
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-syslogd_t-symlink.patch30
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-tmp-symlink.patch99
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-cache-symlink.patch34
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch31
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch29
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch145
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-syslogd_t-to-trusted-object.patch31
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-allow-nfsd-to-exec-shell-commands.patch58
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch29
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-allow-sysadm-to-run-rpcinfo.patch33
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-don-t-audit-tty_device_t.patch35
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-dmesg-to-use-dev-kmsg.patch37
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-new-SELINUXMNT-in-sys.patch229
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch65
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch31
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-seutils-manage-config-files.patch43
-rw-r--r--recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch46
-rw-r--r--recipes-security/refpolicy/refpolicy_git.inc62
44 files changed, 1976 insertions, 0 deletions
diff --git a/recipes-security/refpolicy/refpolicy-git/ftp-add-ftpd_t-to-mlsfilewrite.patch b/recipes-security/refpolicy/refpolicy-git/ftp-add-ftpd_t-to-mlsfilewrite.patch
new file mode 100644
index 0000000..49da4b6
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/ftp-add-ftpd_t-to-mlsfilewrite.patch
@@ -0,0 +1,39 @@
1From e4e95b723d31c7b678a05cd81a96b10185978b4e Mon Sep 17 00:00:00 2001
2From: Roy Li <rongqing.li@windriver.com>
3Date: Mon, 10 Feb 2014 18:10:12 +0800
4Subject: [PATCH] ftp: add ftpd_t to mls_file_write_all_levels
5
6Proftpd will create file under /var/run, but its mls is in high, and
7can not write to lowlevel
8
9Upstream-Status: Pending
10
11type=AVC msg=audit(1392347709.621:15): avc: denied { write } for pid=545 comm="proftpd" name="/" dev="tmpfs" ino=5853 scontext=system_u:system_r:ftpd_t:s15:c0.c1023 tcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 tclass=dir
12type=AVC msg=audit(1392347709.621:15): avc: denied { add_name } for pid=545 comm="proftpd" name="proftpd.delay" scontext=system_u:system_r:ftpd_t:s15:c0.c1023 tcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 tclass=dir
13type=SYSCALL msg=audit(1392347709.621:15): arch=c000003e syscall=2 success=yes exit=3 a0=471910 a1=42 a2=1b6 a3=8 items=0 ppid=539 pid=545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s15:c0.c1023 key=(null)
14
15root@localhost:~# sesearch --allow -s ftpd_t -t var_run_t|grep dir|grep add_name
16 allow ftpd_t var_run_t : dir { ioctl read write getattr lock add_name remove_name search open } ;
17root@localhost:~#
18
19Signed-off-by: Roy Li <rongqing.li@windriver.com>
20---
21 policy/modules/contrib/ftp.te | 2 ++
22 1 file changed, 2 insertions(+)
23
24diff --git a/policy/modules/contrib/ftp.te b/policy/modules/contrib/ftp.te
25index 544c512..12a31dd 100644
26--- a/policy/modules/contrib/ftp.te
27+++ b/policy/modules/contrib/ftp.te
28@@ -144,6 +144,8 @@ role ftpdctl_roles types ftpdctl_t;
29 type ftpdctl_tmp_t;
30 files_tmp_file(ftpdctl_tmp_t)
31
32+mls_file_write_all_levels(ftpd_t)
33+
34 type sftpd_t;
35 domain_type(sftpd_t)
36 role system_r types sftpd_t;
37--
381.7.10.4
39
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-clock.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-clock.patch
new file mode 100644
index 0000000..3ff8f55
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-clock.patch
@@ -0,0 +1,22 @@
1Subject: [PATCH] refpolicy: fix real path for clock
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/clock.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/system/clock.fc b/policy/modules/system/clock.fc
11index c5e05ca..a74c40c 100644
12--- a/policy/modules/system/clock.fc
13+++ b/policy/modules/system/clock.fc
14@@ -2,4 +2,5 @@
15 /etc/adjtime -- gen_context(system_u:object_r:adjtime_t,s0)
16
17 /sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)
18+/sbin/hwclock\.util-linux -- gen_context(system_u:object_r:hwclock_exec_t,s0)
19
20--
211.7.11.7
22
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-corecommands.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-corecommands.patch
new file mode 100644
index 0000000..24b67c3
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-corecommands.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for corecommands
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/kernel/corecommands.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
11index f051c4a..ab624f3 100644
12--- a/policy/modules/kernel/corecommands.fc
13+++ b/policy/modules/kernel/corecommands.fc
14@@ -153,6 +153,7 @@ ifdef(`distro_gentoo',`
15 /sbin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0)
16 /sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0)
17 /sbin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
18+/usr/sbin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
19
20 #
21 # /opt
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-dmesg.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-dmesg.patch
new file mode 100644
index 0000000..db4c4d4
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-dmesg.patch
@@ -0,0 +1,20 @@
1Subject: [PATCH] refpolicy: fix real path for dmesg
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/dmesg.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/admin/dmesg.fc b/policy/modules/admin/dmesg.fc
11index d6cc2d9..7f3e5b0 100644
12--- a/policy/modules/admin/dmesg.fc
13+++ b/policy/modules/admin/dmesg.fc
14@@ -1,2 +1,3 @@
15
16 /bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)
17+/bin/dmesg\.util-linux -- gen_context(system_u:object_r:dmesg_exec_t,s0)
18--
191.7.11.7
20
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-bind.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-bind.patch
new file mode 100644
index 0000000..59ba5bc
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-bind.patch
@@ -0,0 +1,30 @@
1From e438a9466a615db3f63421157d5ee3bd6d055403 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:09:11 +0800
4Subject: [PATCH] refpolicy: fix real path for bind.
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/bind.fc | 2 ++
11 1 file changed, 2 insertions(+)
12
13diff --git a/policy/modules/contrib/bind.fc b/policy/modules/contrib/bind.fc
14index 2b9a3a1..fd45d53 100644
15--- a/policy/modules/contrib/bind.fc
16+++ b/policy/modules/contrib/bind.fc
17@@ -1,8 +1,10 @@
18 /etc/rc\.d/init\.d/named -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
19+/etc/rc\.d/init\.d/bind -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
20 /etc/rc\.d/init\.d/unbound -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
21
22 /etc/bind(/.*)? gen_context(system_u:object_r:named_zone_t,s0)
23 /etc/bind/named\.conf.* -- gen_context(system_u:object_r:named_conf_t,s0)
24+/etc/bind/rndc\.conf -- gen_context(system_u:object_r:named_conf_t,s0)
25 /etc/bind/rndc\.key -- gen_context(system_u:object_r:dnssec_t,s0)
26 /etc/dnssec-trigger/dnssec_trigger_server\.key -- gen_context(system_u:object_r:dnssec_t,s0)
27 /etc/named\.rfc1912\.zones -- gen_context(system_u:object_r:named_conf_t,s0)
28--
291.7.9.5
30
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_login.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_login.patch
new file mode 100644
index 0000000..427181e
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_login.patch
@@ -0,0 +1,37 @@
1Subject: [PATCH] fix real path for login commands.
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/authlogin.fc | 7 ++++---
8 1 files changed, 4 insertions(+), 3 deletions(-)
9
10diff --git a/policy/modules/system/authlogin.fc b/policy/modules/system/authlogin.fc
11index 28ad538..c8dd17f 100644
12--- a/policy/modules/system/authlogin.fc
13+++ b/policy/modules/system/authlogin.fc
14@@ -1,5 +1,7 @@
15
16 /bin/login -- gen_context(system_u:object_r:login_exec_t,s0)
17+/bin/login\.shadow -- gen_context(system_u:object_r:login_exec_t,s0)
18+/bin/login\.tinylogin -- gen_context(system_u:object_r:login_exec_t,s0)
19
20 /etc/\.pwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
21 /etc/group\.lock -- gen_context(system_u:object_r:shadow_t,s0)
22@@ -9,9 +11,9 @@
23
24 /sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0)
25 /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
26-/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
27-/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
28-/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
29+/usr/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
30+/usr/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
31+/usr/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
32 ifdef(`distro_suse', `
33 /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
34 ')
35--
361.7.5.4
37
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_resolv.conf.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_resolv.conf.patch
new file mode 100644
index 0000000..80cca67
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_resolv.conf.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] fix real path for resolv.conf
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/sysnetwork.fc | 1 +
8 1 files changed, 1 insertions(+), 0 deletions(-)
9
10diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
11index 346a7cc..dec8632 100644
12--- a/policy/modules/system/sysnetwork.fc
13+++ b/policy/modules/system/sysnetwork.fc
14@@ -24,6 +24,7 @@ ifdef(`distro_debian',`
15 /etc/hosts\.deny.* -- gen_context(system_u:object_r:net_conf_t,s0)
16 /etc/denyhosts.* -- gen_context(system_u:object_r:net_conf_t,s0)
17 /etc/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
18+/var/run/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
19 /etc/yp\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
20
21 /etc/dhcp3(/.*)? gen_context(system_u:object_r:dhcp_etc_t,s0)
22--
231.7.5.4
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_shadow.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_shadow.patch
new file mode 100644
index 0000000..29ac2c3
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_shadow.patch
@@ -0,0 +1,34 @@
1Subject: [PATCH] fix real path for shadow commands.
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/usermanage.fc | 6 ++++++
8 1 file changed, 6 insertions(+)
9
10diff --git a/policy/modules/admin/usermanage.fc b/policy/modules/admin/usermanage.fc
11index f82f0ce..841ba9b 100644
12--- a/policy/modules/admin/usermanage.fc
13+++ b/policy/modules/admin/usermanage.fc
14@@ -4,11 +4,17 @@ ifdef(`distro_gentoo',`
15
16 /usr/bin/chage -- gen_context(system_u:object_r:passwd_exec_t,s0)
17 /usr/bin/chfn -- gen_context(system_u:object_r:chfn_exec_t,s0)
18+/usr/bin/chfn\.shadow -- gen_context(system_u:object_r:chfn_exec_t,s0)
19 /usr/bin/chsh -- gen_context(system_u:object_r:chfn_exec_t,s0)
20+/usr/bin/chsh\.shadow -- gen_context(system_u:object_r:chfn_exec_t,s0)
21 /usr/bin/gpasswd -- gen_context(system_u:object_r:groupadd_exec_t,s0)
22 /usr/bin/passwd -- gen_context(system_u:object_r:passwd_exec_t,s0)
23+/usr/bin/passwd\.shadow -- gen_context(system_u:object_r:passwd_exec_t,s0)
24+/usr/bin/passwd\.tinylogin -- gen_context(system_u:object_r:passwd_exec_t,s0)
25 /usr/bin/vigr -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
26+/sbin/vigr\.shadow -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
27 /usr/bin/vipw -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
28+/sbin/vipw\.shadow -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
29
30 /usr/lib/cracklib_dict.* -- gen_context(system_u:object_r:crack_db_t,s0)
31
32--
331.7.9.5
34
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_su.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_su.patch
new file mode 100644
index 0000000..b0392ce
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_su.patch
@@ -0,0 +1,25 @@
1From 4affa5e9797f5d51597c9b8e0f2503883c766699 Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Thu, 13 Feb 2014 00:33:07 -0500
4Subject: [PATCH] fix real path for su.shadow command
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9---
10 policy/modules/admin/su.fc | 2 ++
11 1 file changed, 2 insertions(+)
12
13diff --git a/policy/modules/admin/su.fc b/policy/modules/admin/su.fc
14index a563687..0f43827 100644
15--- a/policy/modules/admin/su.fc
16+++ b/policy/modules/admin/su.fc
17@@ -4,3 +4,5 @@
18
19 /usr/(local/)?bin/ksu -- gen_context(system_u:object_r:su_exec_t,s0)
20 /usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0)
21+
22+/bin/su.shadow -- gen_context(system_u:object_r:su_exec_t,s0)
23--
241.7.9.5
25
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch
new file mode 100644
index 0000000..38c96c4
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch
@@ -0,0 +1,65 @@
1From 7fdfd2ef8764ddfaeb43e53a756af83d42d8ac8b Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Mon, 27 Jan 2014 03:54:01 -0500
4Subject: [PATCH] refpolicy: fix real path for fstools
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/system/fstools.fc | 11 +++++++++++
12 1 file changed, 11 insertions(+)
13
14--- a/policy/modules/system/fstools.fc
15+++ b/policy/modules/system/fstools.fc
16@@ -1,6 +1,8 @@
17 /sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
18 /sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
19+/sbin/blkid\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
20 /sbin/blockdev -- gen_context(system_u:object_r:fsadm_exec_t,s0)
21+/sbin/blockdev\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
22 /sbin/cfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
23 /sbin/dosfsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
24 /sbin/dump -- gen_context(system_u:object_r:fsadm_exec_t,s0)
25@@ -9,9 +11,11 @@
26 /sbin/e4fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
27 /sbin/e2label -- gen_context(system_u:object_r:fsadm_exec_t,s0)
28 /sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
29+/sbin/fdisk\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
30 /sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
31 /sbin/fsck.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
32 /sbin/hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
33+/sbin/hdparm\.hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
34 /sbin/install-mbr -- gen_context(system_u:object_r:fsadm_exec_t,s0)
35 /sbin/jfs_.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
36 /sbin/losetup.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
37@@ -24,6 +28,7 @@
38 /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
39 /sbin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
40 /sbin/mkswap -- gen_context(system_u:object_r:fsadm_exec_t,s0)
41+/sbin/mkswap\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
42 /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
43 /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
44 /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
45@@ -34,6 +39,7 @@
46 /sbin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0)
47 /sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
48 /sbin/swapoff -- gen_context(system_u:object_r:fsadm_exec_t,s0)
49+/sbin/swapoff\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
50 /sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
51 /sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
52 /sbin/zdb -- gen_context(system_u:object_r:fsadm_exec_t,s0)
53@@ -50,7 +56,12 @@
54
55 /usr/sbin/clubufflush -- gen_context(system_u:object_r:fsadm_exec_t,s0)
56 /usr/sbin/fatsort -- gen_context(system_u:object_r:fsadm_exec_t,s0)
57+/usr/sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
58 /usr/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
59+/usr/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
60+/usr/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
61+/usr/sbin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0)
62+/usr/sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
63 /usr/sbin/smartctl -- gen_context(system_u:object_r:fsadm_exec_t,s0)
64
65 /var/log/fsck(/.*)? gen_context(system_u:object_r:fsadm_log_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-ftpwho-dir.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-ftpwho-dir.patch
new file mode 100644
index 0000000..a7d434f
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-ftpwho-dir.patch
@@ -0,0 +1,27 @@
1fix ftpwho install dir
2
3Upstream-Status: Pending
4
5ftpwho is installed into /usr/bin/, not /usr/sbin, so fix it
6
7Signed-off-by: Roy Li <rongqing.li@windriver.com>
8---
9 policy/modules/contrib/ftp.fc | 2 +-
10 1 file changed, 1 insertion(+), 1 deletion(-)
11
12diff --git a/policy/modules/contrib/ftp.fc b/policy/modules/contrib/ftp.fc
13index ddb75c1..26fec47 100644
14--- a/policy/modules/contrib/ftp.fc
15+++ b/policy/modules/contrib/ftp.fc
16@@ -9,7 +9,7 @@
17
18 /usr/kerberos/sbin/ftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
19
20-/usr/sbin/ftpwho -- gen_context(system_u:object_r:ftpd_exec_t,s0)
21+/usr/bin/ftpwho -- gen_context(system_u:object_r:ftpd_exec_t,s0)
22 /usr/sbin/in\.ftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
23 /usr/sbin/muddleftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
24 /usr/sbin/proftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
25--
261.7.10.4
27
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-iptables.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-iptables.patch
new file mode 100644
index 0000000..89b1547
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-iptables.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for iptables
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/iptables.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
11index 14cffd2..84ac92b 100644
12--- a/policy/modules/system/iptables.fc
13+++ b/policy/modules/system/iptables.fc
14@@ -13,6 +13,7 @@
15 /sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
16 /sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
17 /sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
18+/usr/sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
19
20 /usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
21 /usr/sbin/iptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-mta.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-mta.patch
new file mode 100644
index 0000000..bbd83ec
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-mta.patch
@@ -0,0 +1,27 @@
1From c0bb2996db4f55f3987967bacfb99805fc45d027 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:21:55 +0800
4Subject: [PATCH] refpolicy: fix real path for mta
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/mta.fc | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/policy/modules/contrib/mta.fc b/policy/modules/contrib/mta.fc
14index f42896c..0d4bcef 100644
15--- a/policy/modules/contrib/mta.fc
16+++ b/policy/modules/contrib/mta.fc
17@@ -22,6 +22,7 @@ HOME_DIR/\.maildir(/.*)? gen_context(system_u:object_r:mail_home_rw_t,s0)
18 /usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
19 /usr/sbin/sendmail\.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0)
20 /usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0)
21+/usr/sbin/msmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
22 /usr/sbin/ssmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
23
24 /var/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0)
25--
261.7.9.5
27
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-netutils.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-netutils.patch
new file mode 100644
index 0000000..b45d03e
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-netutils.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for netutils
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/netutils.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/admin/netutils.fc b/policy/modules/admin/netutils.fc
11index 407078f..f2ed3dc 100644
12--- a/policy/modules/admin/netutils.fc
13+++ b/policy/modules/admin/netutils.fc
14@@ -3,6 +3,7 @@
15 /bin/traceroute.* -- gen_context(system_u:object_r:traceroute_exec_t,s0)
16
17 /sbin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
18+/bin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
19
20 /usr/bin/lft -- gen_context(system_u:object_r:traceroute_exec_t,s0)
21 /usr/bin/nmap -- gen_context(system_u:object_r:traceroute_exec_t,s0)
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-nscd.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-nscd.patch
new file mode 100644
index 0000000..1db328c
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-nscd.patch
@@ -0,0 +1,27 @@
1From 642fab321a5f1f40495b4ca07f1fca4145024986 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:25:36 +0800
4Subject: [PATCH] refpolicy: fix real path for nscd
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/nscd.fc | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/policy/modules/contrib/nscd.fc b/policy/modules/contrib/nscd.fc
14index ba64485..61a6f24 100644
15--- a/policy/modules/contrib/nscd.fc
16+++ b/policy/modules/contrib/nscd.fc
17@@ -1,6 +1,7 @@
18 /etc/rc\.d/init\.d/nscd -- gen_context(system_u:object_r:nscd_initrc_exec_t,s0)
19
20 /usr/sbin/nscd -- gen_context(system_u:object_r:nscd_exec_t,s0)
21+/usr/bin/nscd -- gen_context(system_u:object_r:nscd_exec_t,s0)
22
23 /var/cache/nscd(/.*)? gen_context(system_u:object_r:nscd_var_run_t,s0)
24
25--
261.7.9.5
27
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-rpm.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-rpm.patch
new file mode 100644
index 0000000..7ba3380
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-rpm.patch
@@ -0,0 +1,25 @@
1From 3ecbd842d51a8e70b3403e857a24203285d4983b Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Mon, 27 Jan 2014 01:13:06 -0500
4Subject: [PATCH] refpolicy: fix real path for cpio
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9---
10 policy/modules/contrib/rpm.fc | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/policy/modules/contrib/rpm.fc b/policy/modules/contrib/rpm.fc
14index ebe91fc..539063c 100644
15--- a/policy/modules/contrib/rpm.fc
16+++ b/policy/modules/contrib/rpm.fc
17@@ -58,4 +58,5 @@ ifdef(`distro_redhat',`
18
19 ifdef(`enable_mls',`
20 /usr/sbin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
21+/bin/cpio.cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
22 ')
23--
241.7.9.5
25
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-screen.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-screen.patch
new file mode 100644
index 0000000..3218194
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-screen.patch
@@ -0,0 +1,27 @@
1From 3615e2d67f402a37ae7333e62b54f1d9d0a3bfd1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:27:19 +0800
4Subject: [PATCH] refpolicy: fix real path for screen
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/screen.fc | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/policy/modules/contrib/screen.fc b/policy/modules/contrib/screen.fc
14index e7c2cf7..49ddca2 100644
15--- a/policy/modules/contrib/screen.fc
16+++ b/policy/modules/contrib/screen.fc
17@@ -3,6 +3,7 @@ HOME_DIR/\.screenrc -- gen_context(system_u:object_r:screen_home_t,s0)
18 HOME_DIR/\.tmux\.conf -- gen_context(system_u:object_r:screen_home_t,s0)
19
20 /usr/bin/screen -- gen_context(system_u:object_r:screen_exec_t,s0)
21+/usr/bin/screen-.* -- gen_context(system_u:object_r:screen_exec_t,s0)
22 /usr/bin/tmux -- gen_context(system_u:object_r:screen_exec_t,s0)
23
24 /var/run/screen(/.*)? gen_context(system_u:object_r:screen_var_run_t,s0)
25--
261.7.9.5
27
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-ssh.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-ssh.patch
new file mode 100644
index 0000000..9aeb3a2
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-ssh.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for ssh
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/services/ssh.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
11index 078bcd7..9717428 100644
12--- a/policy/modules/services/ssh.fc
13+++ b/policy/modules/services/ssh.fc
14@@ -6,6 +6,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
15 /etc/ssh/ssh_host_rsa_key -- gen_context(system_u:object_r:sshd_key_t,s0)
16
17 /usr/bin/ssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
18+/usr/bin/ssh\.openssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
19 /usr/bin/ssh-agent -- gen_context(system_u:object_r:ssh_agent_exec_t,s0)
20 /usr/bin/ssh-keygen -- gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
21
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-su.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-su.patch
new file mode 100644
index 0000000..358e4ef
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-su.patch
@@ -0,0 +1,23 @@
1Subject: [PATCH] refpolicy: fix real path for su
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/su.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/admin/su.fc b/policy/modules/admin/su.fc
11index 688abc2..a563687 100644
12--- a/policy/modules/admin/su.fc
13+++ b/policy/modules/admin/su.fc
14@@ -1,5 +1,6 @@
15
16 /bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
17+/usr/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
18
19 /usr/(local/)?bin/ksu -- gen_context(system_u:object_r:su_exec_t,s0)
20 /usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0)
21--
221.7.11.7
23
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-subs_dist.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-subs_dist.patch
new file mode 100644
index 0000000..cfec7d9
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-subs_dist.patch
@@ -0,0 +1,29 @@
1Subject: [PATCH] fix file_contexts.subs_dist for poky
2
3This file is used for Linux distros to define specific pathes
4mapping to the pathes in file_contexts.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 config/file_contexts.subs_dist | 10 ++++++++++
12 1 file changed, 10 insertions(+)
13
14--- a/config/file_contexts.subs_dist
15+++ b/config/file_contexts.subs_dist
16@@ -19,3 +19,13 @@
17 /usr/local/lib64 /usr/lib
18 /usr/local/lib /usr/lib
19 /var/run/lock /var/lock
20+/var/volatile/log /var/log
21+/var/volatile/run /var/run
22+/var/volatile/cache /var/cache
23+/var/volatile/tmp /var/tmp
24+/var/volatile/lock /var/lock
25+/var/volatile/run/lock /var/lock
26+/www /var/www
27+/usr/lib/busybox/bin /bin
28+/usr/lib/busybox/sbin /sbin
29+/usr/lib/busybox/usr /usr
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch
new file mode 100644
index 0000000..e0af6a1
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch
@@ -0,0 +1,41 @@
1Subject: [PATCH] refpolicy: fix real path for sysnetwork
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/sysnetwork.fc | 4 ++++
8 1 file changed, 4 insertions(+)
9
10diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
11index dec8632..2e602e4 100644
12--- a/policy/modules/system/sysnetwork.fc
13+++ b/policy/modules/system/sysnetwork.fc
14@@ -3,6 +3,7 @@
15 # /bin
16 #
17 /bin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
18+/sbin/ip\.iproute2 -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
19
20 #
21 # /dev
22@@ -43,13 +44,16 @@ ifdef(`distro_redhat',`
23 /sbin/dhcdbd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
24 /sbin/dhcpcd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
25 /sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
26+/usr/sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
27 /sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
28+/sbin/ifconfig\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
29 /sbin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
30 /sbin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
31 /sbin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
32 /sbin/ipx_internal_net -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
33 /sbin/iwconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
34 /sbin/mii-tool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
35+/sbin/mii-tool\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
36 /sbin/pump -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
37 /sbin/tc -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
38
39--
401.7.11.7
41
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-udevd.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-udevd.patch
new file mode 100644
index 0000000..c6c19be
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-udevd.patch
@@ -0,0 +1,35 @@
1From 025bd3c77d3eeb0e316413bf7e6353f1ccd7f6b2 Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Sat, 25 Jan 2014 23:40:05 -0500
4Subject: [PATCH] refpolicy: fix real path for udevd/udevadm
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9---
10 policy/modules/system/udev.fc | 2 ++
11 1 file changed, 2 insertions(+)
12
13diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc
14index 40928d8..491bb23 100644
15--- a/policy/modules/system/udev.fc
16+++ b/policy/modules/system/udev.fc
17@@ -10,6 +10,7 @@
18 /etc/udev/scripts/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
19
20 /lib/udev/udev-acl -- gen_context(system_u:object_r:udev_exec_t,s0)
21+/lib/udev/udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
22
23 ifdef(`distro_debian',`
24 /lib/udev/create_static_nodes -- gen_context(system_u:object_r:udev_exec_t,s0)
25@@ -27,6 +28,7 @@ ifdef(`distro_redhat',`
26 ')
27
28 /usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0)
29+/usr/bin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
30
31 /usr/lib/systemd/systemd-udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
32
33--
341.7.9.5
35
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_hostname.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_hostname.patch
new file mode 100644
index 0000000..cedb5b5
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_hostname.patch
@@ -0,0 +1,23 @@
1From 845518a6f196e6e8c49ba38791c85e17276920e1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 3/4] fix update-alternatives for hostname
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/system/hostname.fc | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/policy/modules/system/hostname.fc b/policy/modules/system/hostname.fc
14index 9dfecf7..4003b6d 100644
15--- a/policy/modules/system/hostname.fc
16+++ b/policy/modules/system/hostname.fc
17@@ -1,2 +1,3 @@
18
19 /bin/hostname -- gen_context(system_u:object_r:hostname_exec_t,s0)
20+/bin/hostname\.net-tools -- gen_context(system_u:object_r:hostname_exec_t,s0)
21--
221.7.9.5
23
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysklogd.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysklogd.patch
new file mode 100644
index 0000000..868ee6b
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysklogd.patch
@@ -0,0 +1,59 @@
1From 4964fa5593349916d8f5c69edb0b16f611586098 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:39:41 +0800
4Subject: [PATCH 2/4] fix update-alternatives for sysklogd
5
6/etc/syslog.conf is a symlink to /etc/syslog.conf.sysklogd, so a allow rule
7for syslogd_t to read syslog_conf_t lnk_file is needed.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12---
13 policy/modules/system/logging.fc | 4 ++++
14 policy/modules/system/logging.te | 1 +
15 2 files changed, 5 insertions(+)
16
17diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
18index b50c5fe..c005f33 100644
19--- a/policy/modules/system/logging.fc
20+++ b/policy/modules/system/logging.fc
21@@ -2,19 +2,23 @@
22
23 /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
24 /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
25+/etc/syslog.conf\.sysklogd gen_context(system_u:object_r:syslog_conf_t,s0)
26 /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
27 /etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0)
28 /etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
29+/etc/rc\.d/init\.d/syslog\.sysklogd -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
30
31 /sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0)
32 /sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0)
33 /sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)
34 /sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
35 /sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
36+/sbin/klogd\.sysklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
37 /sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
38 /sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
39 /sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
40 /sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
41+/sbin/syslogd\.sysklogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
42 /sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
43
44 /usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
45diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
46index 87e3db2..2914b0b 100644
47--- a/policy/modules/system/logging.te
48+++ b/policy/modules/system/logging.te
49@@ -371,6 +371,7 @@ allow syslogd_t self:udp_socket create_socket_perms;
50 allow syslogd_t self:tcp_socket create_stream_socket_perms;
51
52 allow syslogd_t syslog_conf_t:file read_file_perms;
53+allow syslogd_t syslog_conf_t:lnk_file read_file_perms;
54
55 # Create and bind to /dev/log or /var/run/log.
56 allow syslogd_t devlog_t:sock_file manage_sock_file_perms;
57--
581.7.9.5
59
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysvinit.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysvinit.patch
new file mode 100644
index 0000000..3a617d8
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysvinit.patch
@@ -0,0 +1,53 @@
1From 22cd030a8118faae37c0835eb7875e482efe5dc1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 1/4] fix update-alternatives for sysvinit
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/shutdown.fc | 1 +
11 policy/modules/kernel/corecommands.fc | 1 +
12 policy/modules/system/init.fc | 1 +
13 3 files changed, 3 insertions(+)
14
15diff --git a/policy/modules/contrib/shutdown.fc b/policy/modules/contrib/shutdown.fc
16index a91f33b..90e51e0 100644
17--- a/policy/modules/contrib/shutdown.fc
18+++ b/policy/modules/contrib/shutdown.fc
19@@ -3,6 +3,7 @@
20 /lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
21
22 /sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
23+/sbin/shutdown\.sysvinit -- gen_context(system_u:object_r:shutdown_exec_t,s0)
24
25 /usr/lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
26
27diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
28index bcfdba7..87502a3 100644
29--- a/policy/modules/kernel/corecommands.fc
30+++ b/policy/modules/kernel/corecommands.fc
31@@ -10,6 +10,7 @@
32 /bin/ksh.* -- gen_context(system_u:object_r:shell_exec_t,s0)
33 /bin/mksh -- gen_context(system_u:object_r:shell_exec_t,s0)
34 /bin/mountpoint -- gen_context(system_u:object_r:bin_t,s0)
35+/bin/mountpoint\.sysvinit -- gen_context(system_u:object_r:bin_t,s0)
36 /bin/sash -- gen_context(system_u:object_r:shell_exec_t,s0)
37 /bin/tcsh -- gen_context(system_u:object_r:shell_exec_t,s0)
38 /bin/yash -- gen_context(system_u:object_r:shell_exec_t,s0)
39diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
40index bc0ffc8..020b9fe 100644
41--- a/policy/modules/system/init.fc
42+++ b/policy/modules/system/init.fc
43@@ -30,6 +30,7 @@ ifdef(`distro_gentoo', `
44 # /sbin
45 #
46 /sbin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0)
47+/sbin/init\.sysvinit -- gen_context(system_u:object_r:init_exec_t,s0)
48 # because nowadays, /sbin/init is often a symlink to /sbin/upstart
49 /sbin/upstart -- gen_context(system_u:object_r:init_exec_t,s0)
50
51--
521.7.9.5
53
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-bsdpty_device_t.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-bsdpty_device_t.patch
new file mode 100644
index 0000000..9a3322f
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-bsdpty_device_t.patch
@@ -0,0 +1,121 @@
1From c0b65c327b9354ee5c403cbde428e762ce3f327e Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 5/6] add rules for bsdpty_device_t to complete pty devices.
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/kernel/terminal.if | 16 ++++++++++++++++
11 1 file changed, 16 insertions(+)
12
13diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
14index 771bce1..7519d0e 100644
15--- a/policy/modules/kernel/terminal.if
16+++ b/policy/modules/kernel/terminal.if
17@@ -531,9 +531,11 @@ interface(`term_dontaudit_manage_pty_dirs',`
18 interface(`term_dontaudit_getattr_generic_ptys',`
19 gen_require(`
20 type devpts_t;
21+ type bsdpty_device_t;
22 ')
23
24 dontaudit $1 devpts_t:chr_file getattr;
25+ dontaudit $1 bsdpty_device_t:chr_file getattr;
26 ')
27 ########################################
28 ## <summary>
29@@ -549,11 +551,13 @@ interface(`term_dontaudit_getattr_generic_ptys',`
30 interface(`term_ioctl_generic_ptys',`
31 gen_require(`
32 type devpts_t;
33+ type bsdpty_device_t;
34 ')
35
36 dev_list_all_dev_nodes($1)
37 allow $1 devpts_t:dir search;
38 allow $1 devpts_t:chr_file ioctl;
39+ allow $1 bsdpty_device_t:chr_file ioctl;
40 ')
41
42 ########################################
43@@ -571,9 +575,11 @@ interface(`term_ioctl_generic_ptys',`
44 interface(`term_setattr_generic_ptys',`
45 gen_require(`
46 type devpts_t;
47+ type bsdpty_device_t;
48 ')
49
50 allow $1 devpts_t:chr_file setattr;
51+ allow $1 bsdpty_device_t:chr_file setattr;
52 ')
53
54 ########################################
55@@ -591,9 +597,11 @@ interface(`term_setattr_generic_ptys',`
56 interface(`term_dontaudit_setattr_generic_ptys',`
57 gen_require(`
58 type devpts_t;
59+ type bsdpty_device_t;
60 ')
61
62 dontaudit $1 devpts_t:chr_file setattr;
63+ dontaudit $1 bsdpty_device_t:chr_file setattr;
64 ')
65
66 ########################################
67@@ -611,11 +619,13 @@ interface(`term_dontaudit_setattr_generic_ptys',`
68 interface(`term_use_generic_ptys',`
69 gen_require(`
70 type devpts_t;
71+ type bsdpty_device_t;
72 ')
73
74 dev_list_all_dev_nodes($1)
75 allow $1 devpts_t:dir list_dir_perms;
76 allow $1 devpts_t:chr_file { rw_term_perms lock append };
77+ allow $1 bsdpty_device_t:chr_file { rw_term_perms lock append };
78 ')
79
80 ########################################
81@@ -633,9 +643,11 @@ interface(`term_use_generic_ptys',`
82 interface(`term_dontaudit_use_generic_ptys',`
83 gen_require(`
84 type devpts_t;
85+ type bsdpty_device_t;
86 ')
87
88 dontaudit $1 devpts_t:chr_file { getattr read write ioctl };
89+ dontaudit $1 bsdpty_device_t:chr_file { getattr read write ioctl };
90 ')
91
92 #######################################
93@@ -651,10 +663,12 @@ interface(`term_dontaudit_use_generic_ptys',`
94 interface(`term_setattr_controlling_term',`
95 gen_require(`
96 type devtty_t;
97+ type bsdpty_device_t;
98 ')
99
100 dev_list_all_dev_nodes($1)
101 allow $1 devtty_t:chr_file setattr;
102+ allow $1 bsdpty_device_t:chr_file setattr;
103 ')
104
105 ########################################
106@@ -671,10 +685,12 @@ interface(`term_setattr_controlling_term',`
107 interface(`term_use_controlling_term',`
108 gen_require(`
109 type devtty_t;
110+ type bsdpty_device_t;
111 ')
112
113 dev_list_all_dev_nodes($1)
114 allow $1 devtty_t:chr_file { rw_term_perms lock append };
115+ allow $1 bsdpty_device_t:chr_file { rw_term_perms lock append };
116 ')
117
118 #######################################
119--
1201.7.9.5
121
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-syslogd_t-symlink.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-syslogd_t-symlink.patch
new file mode 100644
index 0000000..aa9734a
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-syslogd_t-symlink.patch
@@ -0,0 +1,30 @@
1Subject: [PATCH] add rules for the symlink of /var/log - syslogd_t
2
3We have added rules for the symlink of /var/log in logging.if,
4while syslogd_t uses /var/log but does not use the
5interfaces in logging.if. So still need add a individual rule for
6syslogd_t.
7
8Upstream-Status: Inappropriate [only for Poky]
9
10Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
11---
12 policy/modules/system/logging.te | 2 ++
13 1 file changed, 2 insertions(+)
14
15diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
16index 2ad9ea5..70427d8 100644
17--- a/policy/modules/system/logging.te
18+++ b/policy/modules/system/logging.te
19@@ -384,6 +384,8 @@ rw_fifo_files_pattern(syslogd_t, var_log_t, var_log_t)
20 # Allow access for syslog-ng
21 allow syslogd_t var_log_t:dir { create setattr };
22
23+allow syslogd_t var_log_t:lnk_file read_lnk_file_perms;
24+
25 # manage temporary files
26 manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
27 manage_files_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
28--
291.7.11.7
30
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-tmp-symlink.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-tmp-symlink.patch
new file mode 100644
index 0000000..210c297
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-tmp-symlink.patch
@@ -0,0 +1,99 @@
1From 22cd030a8118faae37c0835eb7875e482efe5dc1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH] add rules for the symlink of /tmp
5
6/tmp is a symlink in poky, so we need allow rules for files to read
7lnk_file while doing search/list/delete/rw.. in /tmp/ directory.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12---
13 policy/modules/kernel/files.fc | 1 +
14 policy/modules/kernel/files.if | 8 ++++++++
15 2 files changed, 9 insertions(+), 0 deletions(-)
16
17diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
18index 8796ca3..a0db748 100644
19--- a/policy/modules/kernel/files.fc
20+++ b/policy/modules/kernel/files.fc
21@@ -185,6 +185,7 @@ ifdef(`distro_debian',`
22 # /tmp
23 #
24 /tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
25+/tmp -l gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
26 /tmp/.* <<none>>
27 /tmp/\.journal <<none>>
28
29diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
30index e1e814d..a7384b0 100644
31--- a/policy/modules/kernel/files.if
32+++ b/policy/modules/kernel/files.if
33@@ -4199,6 +4199,7 @@ interface(`files_search_tmp',`
34 ')
35
36 allow $1 tmp_t:dir search_dir_perms;
37+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
38 ')
39
40 ########################################
41@@ -4235,6 +4236,7 @@ interface(`files_list_tmp',`
42 ')
43
44 allow $1 tmp_t:dir list_dir_perms;
45+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
46 ')
47
48 ########################################
49@@ -4271,6 +4273,7 @@ interface(`files_delete_tmp_dir_entry',`
50 ')
51
52 allow $1 tmp_t:dir del_entry_dir_perms;
53+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
54 ')
55
56 ########################################
57@@ -4289,6 +4292,7 @@ interface(`files_read_generic_tmp_files',`
58 ')
59
60 read_files_pattern($1, tmp_t, tmp_t)
61+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
62 ')
63
64 ########################################
65@@ -4307,6 +4311,7 @@ interface(`files_manage_generic_tmp_dirs',`
66 ')
67
68 manage_dirs_pattern($1, tmp_t, tmp_t)
69+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
70 ')
71
72 ########################################
73@@ -4325,6 +4330,7 @@ interface(`files_manage_generic_tmp_files',`
74 ')
75
76 manage_files_pattern($1, tmp_t, tmp_t)
77+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
78 ')
79
80 ########################################
81@@ -4361,6 +4367,7 @@ interface(`files_rw_generic_tmp_sockets',`
82 ')
83
84 rw_sock_files_pattern($1, tmp_t, tmp_t)
85+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
86 ')
87
88 ########################################
89@@ -4550,6 +4557,7 @@ interface(`files_tmp_filetrans',`
90 ')
91
92 filetrans_pattern($1, tmp_t, $2, $3, $4)
93+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
94 ')
95
96 ########################################
97--
981.7.5.4
99
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-cache-symlink.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-cache-symlink.patch
new file mode 100644
index 0000000..18a92dd
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-cache-symlink.patch
@@ -0,0 +1,34 @@
1From bad816bc752369a6c1bf40231c505d21d95cab08 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 11:20:00 +0800
4Subject: [PATCH 4/6] add rules for the subdir symlinks in /var/
5
6Except /var/log,/var/run,/var/lock, there still other subdir symlinks in
7/var for poky, so we need allow rules for all domains to read these
8symlinks. Domains still need their practical allow rules to read the
9contents, so this is still a secure relax.
10
11Upstream-Status: Inappropriate [only for Poky]
12
13Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
14---
15 policy/modules/kernel/domain.te | 3 +++
16 1 file changed, 3 insertions(+)
17
18diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
19index cf04cb5..9ffe6b0 100644
20--- a/policy/modules/kernel/domain.te
21+++ b/policy/modules/kernel/domain.te
22@@ -104,6 +104,9 @@ term_use_controlling_term(domain)
23 # list the root directory
24 files_list_root(domain)
25
26+# Yocto/oe-core use some var volatile links
27+files_read_var_symlinks(domain)
28+
29 ifdef(`hide_broken_symptoms',`
30 # This check is in the general socket
31 # listen code, before protocol-specific
32--
331.7.9.5
34
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch
new file mode 100644
index 0000000..8bc40c4
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch
@@ -0,0 +1,31 @@
1From ed2b0a00e2fb78056041b03c7e198e8f5adaf939 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:36:44 +0800
4Subject: [PATCH 3/6] add rules for the symlink of /var/log - apache2
5
6We have added rules for the symlink of /var/log in logging.if,
7while apache.te uses /var/log but does not use the interfaces in
8logging.if. So still need add a individual rule for apache.te.
9
10Upstream-Status: Inappropriate [only for Poky]
11
12Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
13---
14 policy/modules/contrib/apache.te | 1 +
15 1 file changed, 1 insertion(+)
16
17diff --git a/policy/modules/contrib/apache.te b/policy/modules/contrib/apache.te
18index ec8bd13..06f2e95 100644
19--- a/policy/modules/contrib/apache.te
20+++ b/policy/modules/contrib/apache.te
21@@ -400,6 +400,7 @@ create_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
22 append_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
23 read_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
24 read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
25+read_lnk_files_pattern(httpd_t, var_log_t, var_log_t)
26 logging_log_filetrans(httpd_t, httpd_log_t, file)
27
28 allow httpd_t httpd_modules_t:dir list_dir_perms;
29--
301.7.9.5
31
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch
new file mode 100644
index 0000000..cbf0f7d
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch
@@ -0,0 +1,29 @@
1Subject: [PATCH] add rules for the symlink of /var/log - audisp_remote_t
2
3We have added rules for the symlink of /var/log in logging.if,
4while audisp_remote_t uses /var/log but does not use the
5interfaces in logging.if. So still need add a individual rule for
6audisp_remote_t.
7
8Upstream-Status: Inappropriate [only for Poky]
9
10Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
11---
12 policy/modules/system/logging.te | 1 +
13 1 file changed, 1 insertion(+)
14
15diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
16index 8426a49..2ad9ea5 100644
17--- a/policy/modules/system/logging.te
18+++ b/policy/modules/system/logging.te
19@@ -262,6 +262,7 @@ allow audisp_remote_t self:capability { setuid setpcap };
20 allow audisp_remote_t self:process { getcap setcap };
21 allow audisp_remote_t self:tcp_socket create_socket_perms;
22 allow audisp_remote_t var_log_t:dir search_dir_perms;
23+allow audisp_remote_t var_log_t:lnk_file read_lnk_file_perms;
24
25 manage_dirs_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
26 manage_files_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
27--
281.7.11.7
29
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch
new file mode 100644
index 0000000..b06f3ef
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch
@@ -0,0 +1,145 @@
1From 03cb6534f75812f3a33ac768fe83861e0805b0e0 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 2/6] add rules for the symlink of /var/log
5
6/var/log is a symlink in poky, so we need allow rules for files to read
7lnk_file while doing search/list/delete/rw.. in /var/log/ directory.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12---
13 policy/modules/system/logging.fc | 1 +
14 policy/modules/system/logging.if | 14 +++++++++++++-
15 policy/modules/system/logging.te | 1 +
16 3 files changed, 15 insertions(+), 1 deletion(-)
17
18diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
19index c005f33..9529e40 100644
20--- a/policy/modules/system/logging.fc
21+++ b/policy/modules/system/logging.fc
22@@ -41,6 +41,7 @@ ifdef(`distro_suse', `
23 /var/dnscache/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
24
25 /var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
26+/var/log -l gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
27 /var/log/.* gen_context(system_u:object_r:var_log_t,s0)
28 /var/log/boot\.log -- gen_context(system_u:object_r:var_log_t,mls_systemhigh)
29 /var/log/messages[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
30diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
31index 4e94884..9a6f599 100644
32--- a/policy/modules/system/logging.if
33+++ b/policy/modules/system/logging.if
34@@ -136,12 +136,13 @@ interface(`logging_set_audit_parameters',`
35 #
36 interface(`logging_read_audit_log',`
37 gen_require(`
38- type auditd_log_t;
39+ type auditd_log_t, var_log_t;
40 ')
41
42 files_search_var($1)
43 read_files_pattern($1, auditd_log_t, auditd_log_t)
44 allow $1 auditd_log_t:dir list_dir_perms;
45+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
46 ')
47
48 ########################################
49@@ -626,6 +627,7 @@ interface(`logging_search_logs',`
50
51 files_search_var($1)
52 allow $1 var_log_t:dir search_dir_perms;
53+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
54 ')
55
56 #######################################
57@@ -663,6 +665,7 @@ interface(`logging_list_logs',`
58
59 files_search_var($1)
60 allow $1 var_log_t:dir list_dir_perms;
61+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
62 ')
63
64 #######################################
65@@ -682,6 +685,7 @@ interface(`logging_rw_generic_log_dirs',`
66
67 files_search_var($1)
68 allow $1 var_log_t:dir rw_dir_perms;
69+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
70 ')
71
72 #######################################
73@@ -793,10 +797,12 @@ interface(`logging_append_all_logs',`
74 interface(`logging_read_all_logs',`
75 gen_require(`
76 attribute logfile;
77+ type var_log_t;
78 ')
79
80 files_search_var($1)
81 allow $1 logfile:dir list_dir_perms;
82+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
83 read_files_pattern($1, logfile, logfile)
84 ')
85
86@@ -815,10 +821,12 @@ interface(`logging_read_all_logs',`
87 interface(`logging_exec_all_logs',`
88 gen_require(`
89 attribute logfile;
90+ type var_log_t;
91 ')
92
93 files_search_var($1)
94 allow $1 logfile:dir list_dir_perms;
95+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
96 can_exec($1, logfile)
97 ')
98
99@@ -880,6 +888,7 @@ interface(`logging_read_generic_logs',`
100
101 files_search_var($1)
102 allow $1 var_log_t:dir list_dir_perms;
103+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
104 read_files_pattern($1, var_log_t, var_log_t)
105 ')
106
107@@ -900,6 +909,7 @@ interface(`logging_write_generic_logs',`
108
109 files_search_var($1)
110 allow $1 var_log_t:dir list_dir_perms;
111+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
112 write_files_pattern($1, var_log_t, var_log_t)
113 ')
114
115@@ -938,6 +948,7 @@ interface(`logging_rw_generic_logs',`
116
117 files_search_var($1)
118 allow $1 var_log_t:dir list_dir_perms;
119+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
120 rw_files_pattern($1, var_log_t, var_log_t)
121 ')
122
123@@ -960,6 +971,7 @@ interface(`logging_manage_generic_logs',`
124
125 files_search_var($1)
126 manage_files_pattern($1, var_log_t, var_log_t)
127+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
128 ')
129
130 ########################################
131diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
132index 2ab0a49..2795d89 100644
133--- a/policy/modules/system/logging.te
134+++ b/policy/modules/system/logging.te
135@@ -139,6 +139,7 @@ allow auditd_t auditd_etc_t:file read_file_perms;
136 manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
137 manage_lnk_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
138 allow auditd_t var_log_t:dir search_dir_perms;
139+allow auditd_t var_log_t:lnk_file read_lnk_file_perms;
140
141 manage_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
142 manage_sock_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
143--
1441.7.9.5
145
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-syslogd_t-to-trusted-object.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-syslogd_t-to-trusted-object.patch
new file mode 100644
index 0000000..92b1592
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-syslogd_t-to-trusted-object.patch
@@ -0,0 +1,31 @@
1From 27e62a5d9ab9993760369ccdad83673e9148cbb2 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 1/6] Add the syslogd_t to trusted object
5
6We add the syslogd_t to trusted object, because other process need
7to have the right to connectto/sendto /dev/log.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Roy.Li <rongqing.li@windriver.com>
12Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
13---
14 policy/modules/system/logging.te | 1 +
15 1 file changed, 1 insertion(+)
16
17diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
18index 2914b0b..2ab0a49 100644
19--- a/policy/modules/system/logging.te
20+++ b/policy/modules/system/logging.te
21@@ -450,6 +450,7 @@ fs_getattr_all_fs(syslogd_t)
22 fs_search_auto_mountpoints(syslogd_t)
23
24 mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
25+mls_trusted_object(syslogd_t) # Other process need to have the right to connectto/sendto /dev/log
26
27 term_write_console(syslogd_t)
28 # Allow syslog to a terminal
29--
301.7.9.5
31
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-nfsd-to-exec-shell-commands.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-nfsd-to-exec-shell-commands.patch
new file mode 100644
index 0000000..e77a730
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-nfsd-to-exec-shell-commands.patch
@@ -0,0 +1,58 @@
1From 22cd030a8118faae37c0835eb7875e482efe5dc1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH] allow nfsd to exec shell commands.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/contrib/rpc.te | 2 +-
11 policy/modules/kernel/kernel.if | 18 ++++++++++++++++++
12 2 files changed, 19 insertions(+), 1 deletions(-)
13
14diff --git a/policy/modules/contrib/rpc.te b/policy/modules/contrib/rpc.te
15index 9566932..5605205 100644
16--- a/policy/modules/contrib/rpc.te
17+++ b/policy/modules/contrib/rpc.te
18@@ -203,7 +203,7 @@ kernel_read_network_state(nfsd_t)
19 kernel_dontaudit_getattr_core_if(nfsd_t)
20 kernel_setsched(nfsd_t)
21 kernel_request_load_module(nfsd_t)
22-# kernel_mounton_proc(nfsd_t)
23+kernel_mounton_proc(nfsd_t)
24
25 corenet_sendrecv_nfs_server_packets(nfsd_t)
26 corenet_tcp_bind_nfs_port(nfsd_t)
27diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
28index 649e458..8a669c5 100644
29--- a/policy/modules/kernel/kernel.if
30+++ b/policy/modules/kernel/kernel.if
31@@ -804,6 +804,24 @@ interface(`kernel_unmount_proc',`
32
33 ########################################
34 ## <summary>
35+## Mounton a proc filesystem.
36+## </summary>
37+## <param name="domain">
38+## <summary>
39+## Domain allowed access.
40+## </summary>
41+## </param>
42+#
43+interface(`kernel_mounton_proc',`
44+ gen_require(`
45+ type proc_t;
46+ ')
47+
48+ allow $1 proc_t:dir mounton;
49+')
50+
51+########################################
52+## <summary>
53 ## Get the attributes of the proc filesystem.
54 ## </summary>
55 ## <param name="domain">
56--
571.7.5.4
58
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch
new file mode 100644
index 0000000..71497fb
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch
@@ -0,0 +1,29 @@
1From 22cd030a8118faae37c0835eb7875e482efe5dc1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH] fix setfiles_t to read symlinks
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/system/selinuxutil.te | 3 +++
11 1 files changed, 3 insertions(+), 0 deletions(-)
12
13diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
14index ec01d0b..45ed81b 100644
15--- a/policy/modules/system/selinuxutil.te
16+++ b/policy/modules/system/selinuxutil.te
17@@ -553,6 +553,9 @@ files_list_all(setfiles_t)
18 files_relabel_all_files(setfiles_t)
19 files_read_usr_symlinks(setfiles_t)
20
21+# needs to be able to read symlinks to make restorecon on symlink working
22+files_read_all_symlinks(setfiles_t)
23+
24 fs_getattr_xattr_fs(setfiles_t)
25 fs_list_all(setfiles_t)
26 fs_search_auto_mountpoints(setfiles_t)
27--
281.7.5.4
29
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-sysadm-to-run-rpcinfo.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-sysadm-to-run-rpcinfo.patch
new file mode 100644
index 0000000..ec3dbf4
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-sysadm-to-run-rpcinfo.patch
@@ -0,0 +1,33 @@
1From 7005533d61770fed5a3312aa9dfd1c18dae88c16 Mon Sep 17 00:00:00 2001
2From: Roy Li <rongqing.li@windriver.com>
3Date: Sat, 15 Feb 2014 09:45:00 +0800
4Subject: [PATCH] allow sysadm to run rpcinfo
5
6Upstream-Status: Pending
7
8type=AVC msg=audit(1392427946.976:264): avc: denied { connectto } for pid=2111 comm="rpcinfo" path="/run/rpcbind.sock" scontext=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 tcontext=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 tclass=unix_stream_socket
9type=SYSCALL msg=audit(1392427946.976:264): arch=c000003e syscall=42 success=no exit=-13 a0=3 a1=7fff3aa20000 a2=17 a3=22 items=0 ppid=2108 pid=2111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts0 comm="rpcinfo" exe="/usr/sbin/rpcinfo" subj=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 key=(null)
10
11Signed-off-by: Roy Li <rongqing.li@windriver.com>
12---
13 policy/modules/roles/sysadm.te | 4 ++++
14 1 file changed, 4 insertions(+)
15
16diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
17index 1767217..5502c6a 100644
18--- a/policy/modules/roles/sysadm.te
19+++ b/policy/modules/roles/sysadm.te
20@@ -413,6 +413,10 @@ optional_policy(`
21 ')
22
23 optional_policy(`
24+ rpcbind_stream_connect(sysadm_t)
25+')
26+
27+optional_policy(`
28 vmware_role(sysadm_r, sysadm_t)
29 ')
30
31--
321.7.10.4
33
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-don-t-audit-tty_device_t.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-don-t-audit-tty_device_t.patch
new file mode 100644
index 0000000..82370d8
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-don-t-audit-tty_device_t.patch
@@ -0,0 +1,35 @@
1From 29a0d287880f8f83cf4337a3db7c8b94c0c36e1d Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 6/6] don't audit tty_device_t in term_dontaudit_use_console.
5
6We should also not audit terminal to rw tty_device_t and fds in
7term_dontaudit_use_console.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12---
13 policy/modules/kernel/terminal.if | 3 +++
14 1 file changed, 3 insertions(+)
15
16diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
17index 7519d0e..45de1ac 100644
18--- a/policy/modules/kernel/terminal.if
19+++ b/policy/modules/kernel/terminal.if
20@@ -299,9 +299,12 @@ interface(`term_use_console',`
21 interface(`term_dontaudit_use_console',`
22 gen_require(`
23 type console_device_t;
24+ type tty_device_t;
25 ')
26
27+ init_dontaudit_use_fds($1)
28 dontaudit $1 console_device_t:chr_file rw_chr_file_perms;
29+ dontaudit $1 tty_device_t:chr_file rw_chr_file_perms;
30 ')
31
32 ########################################
33--
341.7.9.5
35
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-dmesg-to-use-dev-kmsg.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-dmesg-to-use-dev-kmsg.patch
new file mode 100644
index 0000000..d6c8dbf
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-dmesg-to-use-dev-kmsg.patch
@@ -0,0 +1,37 @@
1From 2f5981f2244289a1cc79748e9ffdaaea168b1df2 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 16:36:09 +0800
4Subject: [PATCH] fix dmesg to use /dev/kmsg as default input
5
6Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
7---
8 policy/modules/admin/dmesg.if | 1 +
9 policy/modules/admin/dmesg.te | 2 ++
10 2 files changed, 3 insertions(+)
11
12diff --git a/policy/modules/admin/dmesg.if b/policy/modules/admin/dmesg.if
13index e1973c7..739a4bc 100644
14--- a/policy/modules/admin/dmesg.if
15+++ b/policy/modules/admin/dmesg.if
16@@ -37,4 +37,5 @@ interface(`dmesg_exec',`
17
18 corecmd_search_bin($1)
19 can_exec($1, dmesg_exec_t)
20+ dev_read_kmsg($1)
21 ')
22diff --git a/policy/modules/admin/dmesg.te b/policy/modules/admin/dmesg.te
23index 72bc6d8..c591aea 100644
24--- a/policy/modules/admin/dmesg.te
25+++ b/policy/modules/admin/dmesg.te
26@@ -28,6 +28,8 @@ kernel_read_proc_symlinks(dmesg_t)
27
28 dev_read_sysfs(dmesg_t)
29
30+dev_read_kmsg(dmesg_t)
31+
32 fs_search_auto_mountpoints(dmesg_t)
33
34 term_dontaudit_use_console(dmesg_t)
35--
361.7.9.5
37
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-new-SELINUXMNT-in-sys.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-new-SELINUXMNT-in-sys.patch
new file mode 100644
index 0000000..302a38f
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-new-SELINUXMNT-in-sys.patch
@@ -0,0 +1,229 @@
1From 0bd1187768c79ccf7d0563fa8e2bc01494fef167 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH] fix for new SELINUXMNT in /sys
5
6SELINUXMNT is now from /selinux to /sys/fs/selinux, so we should
7add rules to access sysfs.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13---
14 policy/modules/kernel/selinux.if | 34 ++++++++++++++++++++++++++++++++--
15 1 file changed, 32 insertions(+), 2 deletions(-)
16
17--- a/policy/modules/kernel/selinux.if
18+++ b/policy/modules/kernel/selinux.if
19@@ -58,6 +58,10 @@ interface(`selinux_get_fs_mount',`
20 type security_t;
21 ')
22
23+ # SELINUXMNT is now /sys/fs/selinux, so we should add rules to
24+ # access sysfs
25+ dev_getattr_sysfs_dirs($1)
26+ dev_search_sysfs($1)
27 # starting in libselinux 2.0.5, init_selinuxmnt() will
28 # attempt to short circuit by checking if SELINUXMNT
29 # (/selinux) is already a selinuxfs
30@@ -84,6 +88,7 @@ interface(`selinux_dontaudit_get_fs_moun
31 type security_t;
32 ')
33
34+ dev_dontaudit_search_sysfs($1)
35 # starting in libselinux 2.0.5, init_selinuxmnt() will
36 # attempt to short circuit by checking if SELINUXMNT
37 # (/selinux) is already a selinuxfs
38@@ -109,6 +114,8 @@ interface(`selinux_mount_fs',`
39 type security_t;
40 ')
41
42+ dev_getattr_sysfs_dirs($1)
43+ dev_search_sysfs($1)
44 allow $1 security_t:filesystem mount;
45 ')
46
47@@ -128,6 +135,8 @@ interface(`selinux_remount_fs',`
48 type security_t;
49 ')
50
51+ dev_getattr_sysfs_dirs($1)
52+ dev_search_sysfs($1)
53 allow $1 security_t:filesystem remount;
54 ')
55
56@@ -146,6 +155,8 @@ interface(`selinux_unmount_fs',`
57 type security_t;
58 ')
59
60+ dev_getattr_sysfs_dirs($1)
61+ dev_search_sysfs($1)
62 allow $1 security_t:filesystem unmount;
63 ')
64
65@@ -164,6 +175,8 @@ interface(`selinux_getattr_fs',`
66 type security_t;
67 ')
68
69+ dev_getattr_sysfs_dirs($1)
70+ dev_search_sysfs($1)
71 allow $1 security_t:filesystem getattr;
72 ')
73
74@@ -183,6 +196,7 @@ interface(`selinux_dontaudit_getattr_fs'
75 type security_t;
76 ')
77
78+ dev_dontaudit_search_sysfs($1)
79 dontaudit $1 security_t:filesystem getattr;
80 ')
81
82@@ -202,6 +216,7 @@ interface(`selinux_dontaudit_getattr_dir
83 type security_t;
84 ')
85
86+ dev_dontaudit_search_sysfs($1)
87 dontaudit $1 security_t:dir getattr;
88 ')
89
90@@ -220,6 +235,7 @@ interface(`selinux_search_fs',`
91 type security_t;
92 ')
93
94+ dev_getattr_sysfs_dirs($1)
95 dev_search_sysfs($1)
96 allow $1 security_t:dir search_dir_perms;
97 ')
98@@ -239,6 +255,7 @@ interface(`selinux_dontaudit_search_fs',
99 type security_t;
100 ')
101
102+ dev_dontaudit_search_sysfs($1)
103 dontaudit $1 security_t:dir search_dir_perms;
104 ')
105
106@@ -258,6 +275,7 @@ interface(`selinux_dontaudit_read_fs',`
107 type security_t;
108 ')
109
110+ dev_dontaudit_search_sysfs($1)
111 dontaudit $1 security_t:dir search_dir_perms;
112 dontaudit $1 security_t:file read_file_perms;
113 ')
114@@ -279,6 +297,7 @@ interface(`selinux_get_enforce_mode',`
115 type security_t;
116 ')
117
118+ dev_getattr_sysfs_dirs($1)
119 dev_search_sysfs($1)
120 allow $1 security_t:dir list_dir_perms;
121 allow $1 security_t:file read_file_perms;
122@@ -313,6 +332,7 @@ interface(`selinux_set_enforce_mode',`
123 bool secure_mode_policyload;
124 ')
125
126+ dev_getattr_sysfs_dirs($1)
127 dev_search_sysfs($1)
128 allow $1 security_t:dir list_dir_perms;
129 allow $1 security_t:file rw_file_perms;
130@@ -345,6 +365,7 @@ interface(`selinux_load_policy',`
131 bool secure_mode_policyload;
132 ')
133
134+ dev_getattr_sysfs_dirs($1)
135 dev_search_sysfs($1)
136 allow $1 security_t:dir list_dir_perms;
137 allow $1 security_t:file rw_file_perms;
138@@ -375,6 +396,7 @@ interface(`selinux_read_policy',`
139 type security_t;
140 ')
141
142+ dev_getattr_sysfs_dirs($1)
143 dev_search_sysfs($1)
144 allow $1 security_t:dir list_dir_perms;
145 allow $1 security_t:file read_file_perms;
146@@ -440,8 +462,8 @@ interface(`selinux_set_generic_booleans'
147 type security_t;
148 ')
149
150+ dev_getattr_sysfs_dirs($1)
151 dev_search_sysfs($1)
152-
153 allow $1 security_t:dir list_dir_perms;
154 allow $1 security_t:file rw_file_perms;
155
156@@ -482,8 +504,8 @@ interface(`selinux_set_all_booleans',`
157 bool secure_mode_policyload;
158 ')
159
160+ dev_getattr_sysfs_dirs($1)
161 dev_search_sysfs($1)
162-
163 allow $1 security_t:dir list_dir_perms;
164 allow $1 { boolean_type -secure_mode_policyload_t }:file rw_file_perms;
165 allow $1 secure_mode_policyload_t:file read_file_perms;
166@@ -528,6 +550,7 @@ interface(`selinux_set_parameters',`
167 attribute can_setsecparam;
168 ')
169
170+ dev_getattr_sysfs_dirs($1)
171 dev_search_sysfs($1)
172 allow $1 security_t:dir list_dir_perms;
173 allow $1 security_t:file rw_file_perms;
174@@ -552,6 +575,7 @@ interface(`selinux_validate_context',`
175 type security_t;
176 ')
177
178+ dev_getattr_sysfs_dirs($1)
179 dev_search_sysfs($1)
180 allow $1 security_t:dir list_dir_perms;
181 allow $1 security_t:file rw_file_perms;
182@@ -574,6 +598,7 @@ interface(`selinux_dontaudit_validate_co
183 type security_t;
184 ')
185
186+ dev_dontaudit_search_sysfs($1)
187 dontaudit $1 security_t:dir list_dir_perms;
188 dontaudit $1 security_t:file rw_file_perms;
189 dontaudit $1 security_t:security check_context;
190@@ -595,6 +620,7 @@ interface(`selinux_compute_access_vector
191 type security_t;
192 ')
193
194+ dev_getattr_sysfs_dirs($1)
195 dev_search_sysfs($1)
196 allow $1 security_t:dir list_dir_perms;
197 allow $1 security_t:file rw_file_perms;
198@@ -617,6 +643,7 @@ interface(`selinux_compute_create_contex
199 type security_t;
200 ')
201
202+ dev_getattr_sysfs_dirs($1)
203 dev_search_sysfs($1)
204 allow $1 security_t:dir list_dir_perms;
205 allow $1 security_t:file rw_file_perms;
206@@ -639,6 +666,7 @@ interface(`selinux_compute_member',`
207 type security_t;
208 ')
209
210+ dev_getattr_sysfs_dirs($1)
211 dev_search_sysfs($1)
212 allow $1 security_t:dir list_dir_perms;
213 allow $1 security_t:file rw_file_perms;
214@@ -669,6 +697,7 @@ interface(`selinux_compute_relabel_conte
215 type security_t;
216 ')
217
218+ dev_getattr_sysfs_dirs($1)
219 dev_search_sysfs($1)
220 allow $1 security_t:dir list_dir_perms;
221 allow $1 security_t:file rw_file_perms;
222@@ -690,6 +719,7 @@ interface(`selinux_compute_user_contexts
223 type security_t;
224 ')
225
226+ dev_getattr_sysfs_dirs($1)
227 dev_search_sysfs($1)
228 allow $1 security_t:dir list_dir_perms;
229 allow $1 security_t:file rw_file_perms;
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch
new file mode 100644
index 0000000..f04ebec
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch
@@ -0,0 +1,65 @@
1From 054a2d81a42bc127d29a916c64b43ad5a7c97f21 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 12:01:53 +0800
4Subject: [PATCH] fix policy for nfsserver to mount nfsd_fs_t.
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/contrib/rpc.te | 5 +++++
12 policy/modules/contrib/rpcbind.te | 5 +++++
13 policy/modules/kernel/filesystem.te | 1 +
14 policy/modules/kernel/kernel.te | 2 ++
15 4 files changed, 13 insertions(+)
16
17--- a/policy/modules/contrib/rpc.te
18+++ b/policy/modules/contrib/rpc.te
19@@ -263,6 +263,11 @@ tunable_policy(`nfs_export_all_ro',`
20
21 optional_policy(`
22 mount_exec(nfsd_t)
23+ # Should domtrans to mount_t while mounting nfsd_fs_t.
24+ mount_domtrans(nfsd_t)
25+ # nfsd_t need to chdir to /var/lib/nfs and read files.
26+ files_list_var(nfsd_t)
27+ rpc_read_nfs_state_data(nfsd_t)
28 ')
29
30 ########################################
31--- a/policy/modules/contrib/rpcbind.te
32+++ b/policy/modules/contrib/rpcbind.te
33@@ -70,6 +70,11 @@ logging_send_syslog_msg(rpcbind_t)
34
35 miscfiles_read_localization(rpcbind_t)
36
37+# nfsd_t would not be allowed to send unix_stream_socket to rpcbind_t,
38+# because the are running in different level. So add rules to allow this.
39+mls_socket_read_all_levels(rpcbind_t)
40+mls_socket_write_all_levels(rpcbind_t)
41+
42 ifdef(`distro_debian',`
43 term_dontaudit_use_unallocated_ttys(rpcbind_t)
44 ')
45--- a/policy/modules/kernel/filesystem.te
46+++ b/policy/modules/kernel/filesystem.te
47@@ -119,6 +119,7 @@ genfscon mvfs / gen_context(system_u:obj
48
49 type nfsd_fs_t;
50 fs_type(nfsd_fs_t)
51+files_mountpoint(nfsd_fs_t)
52 genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
53
54 type oprofilefs_t;
55--- a/policy/modules/kernel/kernel.te
56+++ b/policy/modules/kernel/kernel.te
57@@ -293,6 +293,8 @@ mls_process_read_up(kernel_t)
58 mls_process_write_down(kernel_t)
59 mls_file_write_all_levels(kernel_t)
60 mls_file_read_all_levels(kernel_t)
61+mls_socket_write_all_levels(kernel_t)
62+mls_fd_use_all_levels(kernel_t)
63
64 ifdef(`distro_redhat',`
65 # Bugzilla 222337
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch
new file mode 100644
index 0000000..90efbd8
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch
@@ -0,0 +1,31 @@
1From 4d2c4c358602b246881210889756f229730505d3 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 14:38:53 +0800
4Subject: [PATCH] fix setfiles statvfs to get file count
5
6New setfiles will read /proc/mounts and use statvfs in
7file_system_count() to get file count of filesystems.
8
9Upstream-Status: pending
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12---
13 policy/modules/system/selinuxutil.te | 2 +-
14 1 file changed, 1 insertion(+), 1 deletion(-)
15
16diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
17index 45ed81b..12c3d2e 100644
18--- a/policy/modules/system/selinuxutil.te
19+++ b/policy/modules/system/selinuxutil.te
20@@ -556,7 +556,7 @@ files_read_usr_symlinks(setfiles_t)
21 # needs to be able to read symlinks to make restorecon on symlink working
22 files_read_all_symlinks(setfiles_t)
23
24-fs_getattr_xattr_fs(setfiles_t)
25+fs_getattr_all_fs(setfiles_t)
26 fs_list_all(setfiles_t)
27 fs_search_auto_mountpoints(setfiles_t)
28 fs_relabelfrom_noxattr_fs(setfiles_t)
29--
301.7.9.5
31
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-seutils-manage-config-files.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-seutils-manage-config-files.patch
new file mode 100644
index 0000000..be33bf1
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-seutils-manage-config-files.patch
@@ -0,0 +1,43 @@
1From be8e015aec19553d3753af132861d24da9ed0265 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 2/2] refpolicy: fix selinux utils to manage config files
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9---
10 policy/modules/system/selinuxutil.if | 1 +
11 policy/modules/system/userdomain.if | 4 ++++
12 2 files changed, 5 insertions(+)
13
14diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
15index 3822072..db03ca1 100644
16--- a/policy/modules/system/selinuxutil.if
17+++ b/policy/modules/system/selinuxutil.if
18@@ -680,6 +680,7 @@ interface(`seutil_manage_config',`
19 ')
20
21 files_search_etc($1)
22+ manage_dirs_pattern($1, selinux_config_t, selinux_config_t)
23 manage_files_pattern($1, selinux_config_t, selinux_config_t)
24 read_lnk_files_pattern($1, selinux_config_t, selinux_config_t)
25 ')
26diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
27index b4a691d..20c8bf8 100644
28--- a/policy/modules/system/userdomain.if
29+++ b/policy/modules/system/userdomain.if
30@@ -1277,6 +1277,10 @@ template(`userdom_security_admin_template',`
31 logging_read_audit_config($1)
32
33 seutil_manage_bin_policy($1)
34+ seutil_manage_default_contexts($1)
35+ seutil_manage_file_contexts($1)
36+ seutil_manage_module_store($1)
37+ seutil_manage_config($1)
38 seutil_run_checkpolicy($1, $2)
39 seutil_run_loadpolicy($1, $2)
40 seutil_run_semanage($1, $2)
41--
421.7.9.5
43
diff --git a/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch b/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch
new file mode 100644
index 0000000..80b420c
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch
@@ -0,0 +1,46 @@
1refpolicy: update for systemd
2
3It provides the systemd support for refpolicy
4and related allow rules.
5The restorecon provides systemd init labeled
6as init_exec_t.
7
8Upstream-Status: Pending
9
10
11Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
12
13--- a/policy/modules/contrib/shutdown.fc
14+++ b/policy/modules/contrib/shutdown.fc
15@@ -5,6 +5,9 @@
16 /sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
17 /sbin/shutdown\.sysvinit -- gen_context(system_u:object_r:shutdown_exec_t,s0)
18
19+# systemd support
20+/bin/systemctl -- gen_context(system_u:object_r:shutdown_exec_t,s0)
21+
22 /usr/lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
23
24 /usr/sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
25--- a/policy/modules/system/init.fc
26+++ b/policy/modules/system/init.fc
27@@ -31,6 +31,8 @@
28 #
29 /sbin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0)
30 /sbin/init\.sysvinit -- gen_context(system_u:object_r:init_exec_t,s0)
31+# systemd support
32+/lib/systemd/systemd -- gen_context(system_u:object_r:init_exec_t,s0)
33 # because nowadays, /sbin/init is often a symlink to /sbin/upstart
34 /sbin/upstart -- gen_context(system_u:object_r:init_exec_t,s0)
35
36--- a/policy/modules/system/init.te
37+++ b/policy/modules/system/init.te
38@@ -913,3 +913,8 @@
39 optional_policy(`
40 zebra_read_config(initrc_t)
41 ')
42+
43+# systemd related allow rules
44+allow kernel_t init_t:process dyntransition;
45+allow devpts_t device_t:filesystem associate;
46+allow init_t self:capability2 block_suspend;
diff --git a/recipes-security/refpolicy/refpolicy_git.inc b/recipes-security/refpolicy/refpolicy_git.inc
new file mode 100644
index 0000000..47db820
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy_git.inc
@@ -0,0 +1,62 @@
1SRC_URI = "git://github.com/TresysTechnology/refpolicy.git;protocol=git;branch=master;name=refpolicy;destsuffix=refpolicy"
2SRC_URI += "git://github.com/TresysTechnology/refpolicy-contrib.git;protocol=git;branch=master;name=refpolicy-contrib;destsuffix=refpolicy/policy/modules/contrib"
3
4SRCREV_refpolicy = "${AUTOREV}"
5SRCREV_refpolicy-contrib = "${AUTOREV}"
6
7FILESEXTRAPATHS_prepend := "${THISDIR}/refpolicy-git:"
8
9# Fix file contexts for Poky
10SRC_URI += "file://poky-fc-subs_dist.patch \
11 file://poky-fc-update-alternatives_sysvinit.patch \
12 file://poky-fc-update-alternatives_sysklogd.patch \
13 file://poky-fc-update-alternatives_hostname.patch \
14 file://poky-fc-fix-real-path_resolv.conf.patch \
15 file://poky-fc-fix-real-path_login.patch \
16 file://poky-fc-fix-real-path_shadow.patch \
17 file://poky-fc-fix-bind.patch \
18 file://poky-fc-clock.patch \
19 file://poky-fc-corecommands.patch \
20 file://poky-fc-dmesg.patch \
21 file://poky-fc-fstools.patch \
22 file://poky-fc-iptables.patch \
23 file://poky-fc-mta.patch \
24 file://poky-fc-netutils.patch \
25 file://poky-fc-nscd.patch \
26 file://poky-fc-screen.patch \
27 file://poky-fc-ssh.patch \
28 file://poky-fc-su.patch \
29 file://poky-fc-sysnetwork.patch \
30 file://poky-fc-udevd.patch \
31 file://poky-fc-rpm.patch \
32 file://poky-fc-ftpwho-dir.patch \
33 file://poky-fc-fix-real-path_su.patch \
34 file://refpolicy-update-for_systemd.patch \
35 "
36
37# Specific policy for Poky
38SRC_URI += "file://poky-policy-add-syslogd_t-to-trusted-object.patch \
39 file://poky-policy-add-rules-for-var-log-symlink.patch \
40 file://poky-policy-add-rules-for-var-log-symlink-apache.patch \
41 file://poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch \
42 file://poky-policy-add-rules-for-syslogd_t-symlink.patch \
43 file://poky-policy-add-rules-for-var-cache-symlink.patch \
44 file://poky-policy-add-rules-for-tmp-symlink.patch \
45 file://poky-policy-add-rules-for-bsdpty_device_t.patch \
46 file://poky-policy-don-t-audit-tty_device_t.patch \
47 file://poky-policy-allow-nfsd-to-exec-shell-commands.patch \
48 file://poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch \
49 file://poky-policy-allow-setfiles_t-to-read-symlinks.patch \
50 file://poky-policy-fix-new-SELINUXMNT-in-sys.patch \
51 file://poky-policy-allow-sysadm-to-run-rpcinfo.patch \
52 "
53
54# Other policy fixes
55SRC_URI += " \
56 file://poky-policy-fix-seutils-manage-config-files.patch \
57 file://poky-policy-fix-setfiles-statvfs-get-file-count.patch \
58 file://poky-policy-fix-dmesg-to-use-dev-kmsg.patch \
59 file://ftp-add-ftpd_t-to-mlsfilewrite.patch \
60 "
61
62include refpolicy_common.inc
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-06-13 01:55:40 +0000