summaryrefslogtreecommitdiffstats
path: root/recipes-security/refpolicy/refpolicy-2.20170204
diff options
context:
space:
mode:
Diffstat (limited to 'recipes-security/refpolicy/refpolicy-2.20170204')
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/ftp-add-ftpd_t-to-mlsfilewrite.patch39
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-clock.patch20
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-corecommands.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-dmesg.patch18
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-bind.patch28
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_login.patch37
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_resolv.conf.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_shadow.patch34
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_su.patch22
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fstools.patch75
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-ftpwho-dir.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-iptables.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-mta.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-netutils.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-nscd.patch25
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-rpm.patch23
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-screen.patch23
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-ssh.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-su.patch20
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-subs_dist.patch33
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-sysnetwork.patch48
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-udevd.patch38
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_bash.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_hostname.patch21
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch62
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysvinit.patch57
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-bsdpty_device_t.patch149
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-syslogd_t-symlink.patch30
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-tmp-symlink.patch129
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-cache-symlink.patch34
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch31
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch29
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink.patch185
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-syslogd_t-to-trusted-object.patch31
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-allow-nfsd-to-exec-shell-commands.patch60
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-allow-setfiles_t-to-read-symlinks.patch30
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-allow-sysadm-to-run-rpcinfo.patch33
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-don-t-audit-tty_device_t.patch35
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-dmesg-to-use-dev-kmsg.patch37
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-new-SELINUXMNT-in-sys.patch259
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch79
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-setfiles-statvfs-get-file-count.patch32
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-seutils-manage-config-files.patch45
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/refpolicy-update-for_systemd.patch27
44 files changed, 0 insertions, 2076 deletions
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/ftp-add-ftpd_t-to-mlsfilewrite.patch b/recipes-security/refpolicy/refpolicy-2.20170204/ftp-add-ftpd_t-to-mlsfilewrite.patch
deleted file mode 100644
index 85c40a4..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/ftp-add-ftpd_t-to-mlsfilewrite.patch
+++ /dev/null
@@ -1,39 +0,0 @@
1From e4e95b723d31c7b678a05cd81a96b10185978b4e Mon Sep 17 00:00:00 2001
2From: Roy Li <rongqing.li@windriver.com>
3Date: Mon, 10 Feb 2014 18:10:12 +0800
4Subject: [PATCH] ftp: add ftpd_t to mls_file_write_all_levels
5
6Proftpd will create file under /var/run, but its mls is in high, and
7can not write to lowlevel
8
9Upstream-Status: Pending
10
11type=AVC msg=audit(1392347709.621:15): avc: denied { write } for pid=545 comm="proftpd" name="/" dev="tmpfs" ino=5853 scontext=system_u:system_r:ftpd_t:s15:c0.c1023 tcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 tclass=dir
12type=AVC msg=audit(1392347709.621:15): avc: denied { add_name } for pid=545 comm="proftpd" name="proftpd.delay" scontext=system_u:system_r:ftpd_t:s15:c0.c1023 tcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 tclass=dir
13type=SYSCALL msg=audit(1392347709.621:15): arch=c000003e syscall=2 success=yes exit=3 a0=471910 a1=42 a2=1b6 a3=8 items=0 ppid=539 pid=545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s15:c0.c1023 key=(null)
14
15root@localhost:~# sesearch --allow -s ftpd_t -t var_run_t|grep dir|grep add_name
16 allow ftpd_t var_run_t : dir { ioctl read write getattr lock add_name remove_name search open } ;
17root@localhost:~#
18
19Signed-off-by: Roy Li <rongqing.li@windriver.com>
20Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
21---
22 policy/modules/contrib/ftp.te | 2 ++
23 1 file changed, 2 insertions(+)
24
25--- a/policy/modules/contrib/ftp.te
26+++ b/policy/modules/contrib/ftp.te
27@@ -148,10 +148,12 @@ init_system_domain(ftpdctl_t, ftpdctl_ex
28 role ftpdctl_roles types ftpdctl_t;
29
30 type ftpdctl_tmp_t;
31 files_tmp_file(ftpdctl_tmp_t)
32
33+mls_file_write_all_levels(ftpd_t)
34+
35 type sftpd_t;
36 domain_type(sftpd_t)
37 role system_r types sftpd_t;
38
39 type xferlog_t;
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-clock.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-clock.patch
deleted file mode 100644
index b2102af..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-clock.patch
+++ /dev/null
@@ -1,20 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for clock
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
7---
8 policy/modules/system/clock.fc | 1 +
9 1 file changed, 1 insertion(+)
10
11--- a/policy/modules/system/clock.fc
12+++ b/policy/modules/system/clock.fc
13@@ -1,6 +1,7 @@
14
15 /etc/adjtime -- gen_context(system_u:object_r:adjtime_t,s0)
16
17 /sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)
18+/sbin/hwclock\.util-linux -- gen_context(system_u:object_r:hwclock_exec_t,s0)
19
20 /usr/sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-corecommands.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-corecommands.patch
deleted file mode 100644
index 3739059..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-corecommands.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for corecommands
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
7---
8 policy/modules/kernel/corecommands.fc | 1 +
9 1 file changed, 1 insertion(+)
10
11--- a/policy/modules/kernel/corecommands.fc
12+++ b/policy/modules/kernel/corecommands.fc
13@@ -154,10 +154,11 @@ ifdef(`distro_gentoo',`
14 /sbin -d gen_context(system_u:object_r:bin_t,s0)
15 /sbin/.* gen_context(system_u:object_r:bin_t,s0)
16 /sbin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0)
17 /sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0)
18 /sbin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
19+/usr/sbin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
20
21 #
22 # /opt
23 #
24 /opt/(.*/)?bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-dmesg.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-dmesg.patch
deleted file mode 100644
index 2a567da..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-dmesg.patch
+++ /dev/null
@@ -1,18 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for dmesg
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
7---
8 policy/modules/admin/dmesg.fc | 1 +
9 1 file changed, 1 insertion(+)
10
11--- a/policy/modules/admin/dmesg.fc
12+++ b/policy/modules/admin/dmesg.fc
13@@ -1,4 +1,5 @@
14
15 /bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)
16+/bin/dmesg\.util-linux -- gen_context(system_u:object_r:dmesg_exec_t,s0)
17
18 /usr/bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-bind.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-bind.patch
deleted file mode 100644
index 3218c88..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-bind.patch
+++ /dev/null
@@ -1,28 +0,0 @@
1From e438a9466a615db3f63421157d5ee3bd6d055403 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:09:11 +0800
4Subject: [PATCH] refpolicy: fix real path for bind.
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/contrib/bind.fc | 2 ++
12 1 file changed, 2 insertions(+)
13
14--- a/policy/modules/contrib/bind.fc
15+++ b/policy/modules/contrib/bind.fc
16@@ -1,10 +1,12 @@
17 /etc/rc\.d/init\.d/named -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
18+/etc/rc\.d/init\.d/bind -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
19 /etc/rc\.d/init\.d/unbound -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
20
21 /etc/bind(/.*)? gen_context(system_u:object_r:named_zone_t,s0)
22 /etc/bind/named\.conf.* -- gen_context(system_u:object_r:named_conf_t,s0)
23+/etc/bind/rndc\.conf -- gen_context(system_u:object_r:named_conf_t,s0)
24 /etc/bind/rndc\.key -- gen_context(system_u:object_r:dnssec_t,s0)
25 /etc/dnssec-trigger/dnssec_trigger_server\.key -- gen_context(system_u:object_r:dnssec_t,s0)
26 /etc/named\.rfc1912\.zones -- gen_context(system_u:object_r:named_conf_t,s0)
27 /etc/named\.root\.hints -- gen_context(system_u:object_r:named_conf_t,s0)
28 /etc/named\.conf -- gen_context(system_u:object_r:named_conf_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_login.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_login.patch
deleted file mode 100644
index dfb7544..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_login.patch
+++ /dev/null
@@ -1,37 +0,0 @@
1Subject: [PATCH] fix real path for login commands.
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
7---
8 policy/modules/system/authlogin.fc | 7 ++++---
9 1 files changed, 4 insertions(+), 3 deletions(-)
10
11--- a/policy/modules/system/authlogin.fc
12+++ b/policy/modules/system/authlogin.fc
13@@ -1,19 +1,21 @@
14
15 /bin/login -- gen_context(system_u:object_r:login_exec_t,s0)
16+/bin/login\.shadow -- gen_context(system_u:object_r:login_exec_t,s0)
17+/bin/login\.tinylogin -- gen_context(system_u:object_r:login_exec_t,s0)
18
19 /etc/\.pwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
20 /etc/group\.lock -- gen_context(system_u:object_r:shadow_t,s0)
21 /etc/gshadow.* -- gen_context(system_u:object_r:shadow_t,s0)
22 /etc/passwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
23 /etc/shadow.* -- gen_context(system_u:object_r:shadow_t,s0)
24
25 /sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0)
26 /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
27-/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
28-/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
29-/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
30+/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
31+/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
32+/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
33 ifdef(`distro_suse', `
34 /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
35 ')
36
37 /usr/bin/login -- gen_context(system_u:object_r:login_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_resolv.conf.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_resolv.conf.patch
deleted file mode 100644
index b90b744..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_resolv.conf.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] fix real path for resolv.conf
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
7---
8 policy/modules/system/sysnetwork.fc | 1 +
9 1 files changed, 1 insertions(+), 0 deletions(-)
10
11--- a/policy/modules/system/sysnetwork.fc
12+++ b/policy/modules/system/sysnetwork.fc
13@@ -23,10 +23,11 @@ ifdef(`distro_debian',`
14 /etc/ethers -- gen_context(system_u:object_r:net_conf_t,s0)
15 /etc/hosts -- gen_context(system_u:object_r:net_conf_t,s0)
16 /etc/hosts\.deny.* -- gen_context(system_u:object_r:net_conf_t,s0)
17 /etc/denyhosts.* -- gen_context(system_u:object_r:net_conf_t,s0)
18 /etc/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
19+/var/run/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
20 /etc/yp\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
21
22 /etc/dhcp3(/.*)? gen_context(system_u:object_r:dhcp_etc_t,s0)
23 /etc/dhcp3?/dhclient.* gen_context(system_u:object_r:dhcp_etc_t,s0)
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_shadow.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_shadow.patch
deleted file mode 100644
index 9819c1d..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_shadow.patch
+++ /dev/null
@@ -1,34 +0,0 @@
1Subject: [PATCH] fix real path for shadow commands.
2
3Upstream-Status: Inappropriate [only for Poky]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
7---
8 policy/modules/admin/usermanage.fc | 6 ++++++
9 1 file changed, 6 insertions(+)
10
11--- a/policy/modules/admin/usermanage.fc
12+++ b/policy/modules/admin/usermanage.fc
13@@ -6,15 +6,21 @@ ifdef(`distro_debian',`
14 /etc/cron\.daily/cracklib-runtime -- gen_context(system_u:object_r:crack_exec_t,s0)
15 ')
16
17 /usr/bin/chage -- gen_context(system_u:object_r:passwd_exec_t,s0)
18 /usr/bin/chfn -- gen_context(system_u:object_r:chfn_exec_t,s0)
19+/usr/bin/chfn\.shadow -- gen_context(system_u:object_r:chfn_exec_t,s0)
20 /usr/bin/chsh -- gen_context(system_u:object_r:chfn_exec_t,s0)
21+/usr/bin/chsh\.shadow -- gen_context(system_u:object_r:chfn_exec_t,s0)
22 /usr/bin/gpasswd -- gen_context(system_u:object_r:groupadd_exec_t,s0)
23 /usr/bin/passwd -- gen_context(system_u:object_r:passwd_exec_t,s0)
24+/usr/bin/passwd\.shadow -- gen_context(system_u:object_r:passwd_exec_t,s0)
25+/usr/bin/passwd\.tinylogin -- gen_context(system_u:object_r:passwd_exec_t,s0)
26 /usr/bin/vigr -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
27+/sbin/vigr\.shadow -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
28 /usr/bin/vipw -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
29+/sbin/vipw\.shadow -- gen_context(system_u:object_r:admin_passwd_exec_t,s0)
30
31 /usr/lib/cracklib_dict.* -- gen_context(system_u:object_r:crack_db_t,s0)
32
33 /usr/sbin/crack_[a-z]* -- gen_context(system_u:object_r:crack_exec_t,s0)
34 /usr/sbin/cracklib-[a-z]* -- gen_context(system_u:object_r:crack_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_su.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_su.patch
deleted file mode 100644
index b8597f9..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fix-real-path_su.patch
+++ /dev/null
@@ -1,22 +0,0 @@
1From 4affa5e9797f5d51597c9b8e0f2503883c766699 Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Thu, 13 Feb 2014 00:33:07 -0500
4Subject: [PATCH] fix real path for su.shadow command
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/admin/su.fc | 2 ++
12 1 file changed, 2 insertions(+)
13
14--- a/policy/modules/admin/su.fc
15+++ b/policy/modules/admin/su.fc
16@@ -2,5 +2,6 @@
17 /bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
18
19 /usr/(local/)?bin/ksu -- gen_context(system_u:object_r:su_exec_t,s0)
20 /usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0)
21 /usr/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
22+/bin/su.shadow -- gen_context(system_u:object_r:su_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fstools.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fstools.patch
deleted file mode 100644
index 66bef0f..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-fstools.patch
+++ /dev/null
@@ -1,75 +0,0 @@
1From b420621f7bacdb803bfd104686e9b1785d7a6309 Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Mon, 27 Jan 2014 03:54:01 -0500
4Subject: [PATCH] refpolicy: fix real path for fstools
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
11---
12 policy/modules/system/fstools.fc | 9 +++++++++
13 1 file changed, 9 insertions(+)
14
15--- a/policy/modules/system/fstools.fc
16+++ b/policy/modules/system/fstools.fc
17@@ -1,19 +1,23 @@
18 /sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
19 /sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
20+/sbin/blkid/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
21 /sbin/blockdev -- gen_context(system_u:object_r:fsadm_exec_t,s0)
22+/sbin/blockdev/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
23 /sbin/cfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
24 /sbin/dosfsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
25 /sbin/dump -- gen_context(system_u:object_r:fsadm_exec_t,s0)
26 /sbin/dumpe2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
27 /sbin/e2fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
28 /sbin/e4fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
29 /sbin/e2label -- gen_context(system_u:object_r:fsadm_exec_t,s0)
30 /sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
31+/sbin/fdisk/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
32 /sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
33 /sbin/fsck.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
34 /sbin/hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
35+/sbin/hdparm/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
36 /sbin/install-mbr -- gen_context(system_u:object_r:fsadm_exec_t,s0)
37 /sbin/jfs_.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
38 /sbin/losetup.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
39 /sbin/lsraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
40 /sbin/make_reiser4 -- gen_context(system_u:object_r:fsadm_exec_t,s0)
41@@ -22,20 +26,22 @@
42 /sbin/mke4fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
43 /sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
44 /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
45 /sbin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
46 /sbin/mkswap -- gen_context(system_u:object_r:fsadm_exec_t,s0)
47+/sbin/mkswap/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
48 /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
49 /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
50 /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
51 /sbin/raidautorun -- gen_context(system_u:object_r:fsadm_exec_t,s0)
52 /sbin/raidstart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
53 /sbin/reiserfs(ck|tune) -- gen_context(system_u:object_r:fsadm_exec_t,s0)
54 /sbin/resize.*fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
55 /sbin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0)
56 /sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
57 /sbin/swapoff -- gen_context(system_u:object_r:fsadm_exec_t,s0)
58+/sbin/swapoff/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
59 /sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
60 /sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
61 /sbin/zdb -- gen_context(system_u:object_r:fsadm_exec_t,s0)
62 /sbin/zhack -- gen_context(system_u:object_r:fsadm_exec_t,s0)
63 /sbin/zinject -- gen_context(system_u:object_r:fsadm_exec_t,s0)
64@@ -83,10 +89,11 @@
65 /usr/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
66 /usr/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
67 /usr/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
68 /usr/sbin/raidautorun -- gen_context(system_u:object_r:fsadm_exec_t,s0)
69 /usr/sbin/raidstart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
70+/usr/sbin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0)
71 /usr/sbin/reiserfs(ck|tune) -- gen_context(system_u:object_r:fsadm_exec_t,s0)
72 /usr/sbin/resize.*fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
73 /usr/sbin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0)
74 /usr/sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
75 /usr/sbin/smartctl -- gen_context(system_u:object_r:fsadm_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-ftpwho-dir.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-ftpwho-dir.patch
deleted file mode 100644
index d58de6a..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-ftpwho-dir.patch
+++ /dev/null
@@ -1,27 +0,0 @@
1fix ftpwho install dir
2
3Upstream-Status: Pending
4
5ftpwho is installed into /usr/bin/, not /usr/sbin, so fix it
6
7Signed-off-by: Roy Li <rongqing.li@windriver.com>
8Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
9---
10 policy/modules/contrib/ftp.fc | 2 +-
11 1 file changed, 1 insertion(+), 1 deletion(-)
12
13--- a/policy/modules/contrib/ftp.fc
14+++ b/policy/modules/contrib/ftp.fc
15@@ -10,11 +10,11 @@
16 /usr/kerberos/sbin/ftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
17
18 /usr/lib/systemd/system/proftpd.*\.service -- gen_context(system_u:object_r:ftpd_unit_t,s0)
19 /usr/lib/systemd/system/vsftpd.*\.service -- gen_context(system_u:object_r:ftpd_unit_t,s0)
20
21-/usr/sbin/ftpwho -- gen_context(system_u:object_r:ftpd_exec_t,s0)
22+/usr/bin/ftpwho -- gen_context(system_u:object_r:ftpd_exec_t,s0)
23 /usr/sbin/in\.ftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
24 /usr/sbin/muddleftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
25 /usr/sbin/proftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
26 /usr/sbin/vsftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
27
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-iptables.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-iptables.patch
deleted file mode 100644
index 9e1196a..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-iptables.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for iptables
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
7---
8 policy/modules/system/iptables.fc | 1 +
9 1 file changed, 1 insertion(+)
10
11--- a/policy/modules/system/iptables.fc
12+++ b/policy/modules/system/iptables.fc
13@@ -14,10 +14,11 @@
14 /sbin/ipvsadm -- gen_context(system_u:object_r:iptables_exec_t,s0)
15 /sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
16 /sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
17 /sbin/nft -- gen_context(system_u:object_r:iptables_exec_t,s0)
18 /sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
19+/usr/sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
20
21 /usr/lib/systemd/system/[^/]*arptables.* -- gen_context(system_u:object_r:iptables_unit_t,s0)
22 /usr/lib/systemd/system/[^/]*ebtables.* -- gen_context(system_u:object_r:iptables_unit_t,s0)
23 /usr/lib/systemd/system/[^/]*ip6tables.* -- gen_context(system_u:object_r:iptables_unit_t,s0)
24 /usr/lib/systemd/system/[^/]*iptables.* -- gen_context(system_u:object_r:iptables_unit_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-mta.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-mta.patch
deleted file mode 100644
index 5d2b0cf..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-mta.patch
+++ /dev/null
@@ -1,27 +0,0 @@
1From c0bb2996db4f55f3987967bacfb99805fc45d027 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:21:55 +0800
4Subject: [PATCH] refpolicy: fix real path for mta
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/contrib/mta.fc | 1 +
12 1 file changed, 1 insertion(+)
13
14--- a/policy/modules/contrib/mta.fc
15+++ b/policy/modules/contrib/mta.fc
16@@ -20,10 +20,11 @@ HOME_DIR/\.maildir(/.*)? gen_context(sys
17 /usr/lib/courier/bin/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
18
19 /usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
20 /usr/sbin/sendmail\.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0)
21 /usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0)
22+/usr/sbin/msmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
23 /usr/sbin/ssmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
24
25 /var/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0)
26
27 /var/qmail/bin/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-netutils.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-netutils.patch
deleted file mode 100644
index b41e6e4..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-netutils.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for netutils
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
7---
8 policy/modules/admin/netutils.fc | 1 +
9 1 file changed, 1 insertion(+)
10
11--- a/policy/modules/admin/netutils.fc
12+++ b/policy/modules/admin/netutils.fc
13@@ -1,10 +1,11 @@
14 /bin/ping.* -- gen_context(system_u:object_r:ping_exec_t,s0)
15 /bin/tracepath.* -- gen_context(system_u:object_r:traceroute_exec_t,s0)
16 /bin/traceroute.* -- gen_context(system_u:object_r:traceroute_exec_t,s0)
17
18 /sbin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
19+/bin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
20
21 /usr/bin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
22 /usr/bin/lft -- gen_context(system_u:object_r:traceroute_exec_t,s0)
23 /usr/bin/nmap -- gen_context(system_u:object_r:traceroute_exec_t,s0)
24 /usr/bin/ping.* -- gen_context(system_u:object_r:ping_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-nscd.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-nscd.patch
deleted file mode 100644
index 0adf7c2..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-nscd.patch
+++ /dev/null
@@ -1,25 +0,0 @@
1From 642fab321a5f1f40495b4ca07f1fca4145024986 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:25:36 +0800
4Subject: [PATCH] refpolicy: fix real path for nscd
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/contrib/nscd.fc | 1 +
12 1 file changed, 1 insertion(+)
13
14--- a/policy/modules/contrib/nscd.fc
15+++ b/policy/modules/contrib/nscd.fc
16@@ -1,8 +1,9 @@
17 /etc/rc\.d/init\.d/nscd -- gen_context(system_u:object_r:nscd_initrc_exec_t,s0)
18
19 /usr/sbin/nscd -- gen_context(system_u:object_r:nscd_exec_t,s0)
20+/usr/bin/nscd -- gen_context(system_u:object_r:nscd_exec_t,s0)
21
22 /var/cache/nscd(/.*)? gen_context(system_u:object_r:nscd_var_run_t,s0)
23
24 /var/db/nscd(/.*)? gen_context(system_u:object_r:nscd_var_run_t,s0)
25
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-rpm.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-rpm.patch
deleted file mode 100644
index 9de7532..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-rpm.patch
+++ /dev/null
@@ -1,23 +0,0 @@
1From 3ecbd842d51a8e70b3403e857a24203285d4983b Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Mon, 27 Jan 2014 01:13:06 -0500
4Subject: [PATCH] refpolicy: fix real path for cpio
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/contrib/rpm.fc | 1 +
12 1 file changed, 1 insertion(+)
13
14--- a/policy/modules/contrib/rpm.fc
15+++ b/policy/modules/contrib/rpm.fc
16@@ -61,6 +61,7 @@ ifdef(`distro_redhat',`
17 /run/yum.* -- gen_context(system_u:object_r:rpm_var_run_t,s0)
18 /run/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_run_t,s0)
19
20 ifdef(`enable_mls',`
21 /usr/sbin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
22+/bin/cpio.cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
23 ')
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-screen.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-screen.patch
deleted file mode 100644
index 8ea210e..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-screen.patch
+++ /dev/null
@@ -1,23 +0,0 @@
1From 3615e2d67f402a37ae7333e62b54f1d9d0a3bfd1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:27:19 +0800
4Subject: [PATCH] refpolicy: fix real path for screen
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/contrib/screen.fc | 1 +
12 1 file changed, 1 insertion(+)
13
14--- a/policy/modules/contrib/screen.fc
15+++ b/policy/modules/contrib/screen.fc
16@@ -4,6 +4,7 @@ HOME_DIR/\.tmux\.conf -- gen_context(sys
17
18 /run/screen(/.*)? gen_context(system_u:object_r:screen_runtime_t,s0)
19 /run/tmux(/.*)? gen_context(system_u:object_r:screen_runtime_t,s0)
20
21 /usr/bin/screen -- gen_context(system_u:object_r:screen_exec_t,s0)
22+/usr/bin/screen-.* -- gen_context(system_u:object_r:screen_exec_t,s0)
23 /usr/bin/tmux -- gen_context(system_u:object_r:screen_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-ssh.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-ssh.patch
deleted file mode 100644
index a01e2eb..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-ssh.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for ssh
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
7---
8 policy/modules/services/ssh.fc | 1 +
9 1 file changed, 1 insertion(+)
10
11--- a/policy/modules/services/ssh.fc
12+++ b/policy/modules/services/ssh.fc
13@@ -2,10 +2,11 @@ HOME_DIR/\.ssh(/.*)? gen_context(syste
14
15 /etc/ssh/primes -- gen_context(system_u:object_r:sshd_key_t,s0)
16 /etc/ssh/ssh_host.*_key -- gen_context(system_u:object_r:sshd_key_t,s0)
17
18 /usr/bin/ssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
19+/usr/bin/ssh\.openssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
20 /usr/bin/ssh-agent -- gen_context(system_u:object_r:ssh_agent_exec_t,s0)
21 /usr/bin/ssh-keygen -- gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
22
23 /usr/lib/openssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
24 /usr/lib/ssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-su.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-su.patch
deleted file mode 100644
index e3d156e..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-su.patch
+++ /dev/null
@@ -1,20 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for su
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
7---
8 policy/modules/admin/su.fc | 1 +
9 1 file changed, 1 insertion(+)
10
11--- a/policy/modules/admin/su.fc
12+++ b/policy/modules/admin/su.fc
13@@ -1,6 +1,7 @@
14
15 /bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
16+/usr/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
17
18 /usr/(local/)?bin/ksu -- gen_context(system_u:object_r:su_exec_t,s0)
19 /usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0)
20 /usr/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-subs_dist.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-subs_dist.patch
deleted file mode 100644
index c5fdc51..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-subs_dist.patch
+++ /dev/null
@@ -1,33 +0,0 @@
1Subject: [PATCH] fix file_contexts.subs_dist for poky
2
3This file is used for Linux distros to define specific pathes
4mapping to the pathes in file_contexts.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 config/file_contexts.subs_dist | 10 ++++++++++
12 1 file changed, 10 insertions(+)
13
14--- a/config/file_contexts.subs_dist
15+++ b/config/file_contexts.subs_dist
16@@ -21,5 +21,17 @@
17
18 # backward compatibility
19 # not for refpolicy intern, but for /var/run using applications,
20 # like systemd tmpfiles or systemd socket configurations
21 /var/run /run
22+
23+# Yocto compatibility
24+/var/volatile/log /var/log
25+/var/volatile/run /var/run
26+/var/volatile/cache /var/cache
27+/var/volatile/tmp /var/tmp
28+/var/volatile/lock /var/lock
29+/var/volatile/run/lock /var/lock
30+/www /var/www
31+/usr/lib/busybox/bin /bin
32+/usr/lib/busybox/sbin /sbin
33+/usr/lib/busybox/usr /usr
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-sysnetwork.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-sysnetwork.patch
deleted file mode 100644
index fa369ca..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-sysnetwork.patch
+++ /dev/null
@@ -1,48 +0,0 @@
1From 56ec3e527f2a03d217d5f07ebb708e6e26fa26ff Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Tue, 9 Jun 2015 21:22:52 +0530
4Subject: [PATCH] refpolicy: fix real path for sysnetwork
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
10Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
11---
12 policy/modules/system/sysnetwork.fc | 4 ++++
13 1 file changed, 4 insertions(+)
14
15--- a/policy/modules/system/sysnetwork.fc
16+++ b/policy/modules/system/sysnetwork.fc
17@@ -2,10 +2,11 @@
18 #
19 # /bin
20 #
21 /bin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
22 /bin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
23+/sbin/ip\.iproute2 -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
24
25 #
26 # /dev
27 #
28 ifdef(`distro_debian',`
29@@ -43,17 +44,19 @@ ifdef(`distro_redhat',`
30 /sbin/dhclient.* -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
31 /sbin/dhcdbd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
32 /sbin/dhcpcd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
33 /sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
34 /sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
35+/sbin/ifconfig\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
36 /sbin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
37 /sbin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
38 /sbin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
39 /sbin/ipx_internal_net -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
40 /sbin/iw -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
41 /sbin/iwconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
42 /sbin/mii-tool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
43+/sbin/mii-tool\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
44 /sbin/pump -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
45 /sbin/tc -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
46
47 #
48 # /usr
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-udevd.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-udevd.patch
deleted file mode 100644
index 8e2cb1b..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-udevd.patch
+++ /dev/null
@@ -1,38 +0,0 @@
1From 025bd3c77d3eeb0e316413bf7e6353f1ccd7f6b2 Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Sat, 25 Jan 2014 23:40:05 -0500
4Subject: [PATCH] refpolicy: fix real path for udevd/udevadm
5
6Upstream-Status: Inappropriate [configuration]
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9---
10 policy/modules/system/udev.fc | 2 ++
11 1 file changed, 2 insertions(+)
12
13--- a/policy/modules/system/udev.fc
14+++ b/policy/modules/system/udev.fc
15@@ -8,10 +8,11 @@
16
17 /etc/udev/rules.d(/.*)? gen_context(system_u:object_r:udev_rules_t,s0)
18 /etc/udev/scripts/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
19
20 /lib/udev/udev-acl -- gen_context(system_u:object_r:udev_exec_t,s0)
21+/lib/udev/udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
22
23 ifdef(`distro_debian',`
24 /bin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
25 /lib/udev/create_static_nodes -- gen_context(system_u:object_r:udev_exec_t,s0)
26 ')
27@@ -26,10 +27,11 @@ ifdef(`distro_debian',`
28 ifdef(`distro_redhat',`
29 /sbin/start_udev -- gen_context(system_u:object_r:udev_exec_t,s0)
30 ')
31
32 /usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0)
33+/usr/bin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
34
35 /usr/sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
36 /usr/sbin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
37 /usr/sbin/udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
38 /usr/sbin/udevsend -- gen_context(system_u:object_r:udev_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_bash.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_bash.patch
deleted file mode 100644
index e0fdba1..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_bash.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1From 845518a6f196e6e8c49ba38791c85e17276920e1 Mon Sep 17 00:00:00 2001
2From: Mark Hatle <mark.hatle@windriver.com>
3Date: Thu, 14 Sep 2017 15:02:23 -0500
4Subject: [PATCH 3/4] fix update-alternatives for hostname
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
9---
10 policy/modules/system/corecommands.fc | 1 +
11 1 file changed, 1 insertion(+)
12
13Index: refpolicy/policy/modules/kernel/corecommands.fc
14===================================================================
15--- refpolicy.orig/policy/modules/kernel/corecommands.fc
16+++ refpolicy/policy/modules/kernel/corecommands.fc
17@@ -6,6 +6,7 @@
18 /bin/d?ash -- gen_context(system_u:object_r:shell_exec_t,s0)
19 /bin/bash -- gen_context(system_u:object_r:shell_exec_t,s0)
20 /bin/bash2 -- gen_context(system_u:object_r:shell_exec_t,s0)
21+/bin/bash\.bash -- gen_context(system_u:object_r:shell_exec_t,s0)
22 /bin/fish -- gen_context(system_u:object_r:shell_exec_t,s0)
23 /bin/ksh.* -- gen_context(system_u:object_r:shell_exec_t,s0)
24 /bin/mksh -- gen_context(system_u:object_r:shell_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_hostname.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_hostname.patch
deleted file mode 100644
index 038cb1f..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_hostname.patch
+++ /dev/null
@@ -1,21 +0,0 @@
1From 845518a6f196e6e8c49ba38791c85e17276920e1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 3/4] fix update-alternatives for hostname
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/system/hostname.fc | 1 +
12 1 file changed, 1 insertion(+)
13
14--- a/policy/modules/system/hostname.fc
15+++ b/policy/modules/system/hostname.fc
16@@ -1,4 +1,5 @@
17
18 /bin/hostname -- gen_context(system_u:object_r:hostname_exec_t,s0)
19+/bin/hostname\.net-tools -- gen_context(system_u:object_r:hostname_exec_t,s0)
20
21 /usr/bin/hostname -- gen_context(system_u:object_r:hostname_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch
deleted file mode 100644
index e9a0464..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch
+++ /dev/null
@@ -1,62 +0,0 @@
1From 4964fa5593349916d8f5c69edb0b16f611586098 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:39:41 +0800
4Subject: [PATCH 2/4] fix update-alternatives for sysklogd
5
6/etc/syslog.conf is a symlink to /etc/syslog.conf.sysklogd, so a allow rule
7for syslogd_t to read syslog_conf_t lnk_file is needed.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13---
14 policy/modules/system/logging.fc | 3 +++
15 policy/modules/system/logging.te | 2 ++
16 2 files changed, 5 insertions(+)
17
18--- a/policy/modules/system/logging.fc
19+++ b/policy/modules/system/logging.fc
20@@ -1,9 +1,10 @@
21 /dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
22
23 /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
24 /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
25+/etc/syslog.conf\.sysklogd gen_context(system_u:object_r:syslog_conf_t,s0)
26 /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
27 /etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0)
28 /etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
29
30 /usr/bin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0)
31@@ -27,14 +28,16 @@
32 /usr/sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0)
33 /usr/sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0)
34 /usr/sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)
35 /usr/sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
36 /usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
37+/usr/sbin/klogd\.sysklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
38 /usr/sbin/metalog -- gen_context(system_u:object_r:syslogd_exec_t,s0)
39 /usr/sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
40 /usr/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
41 /usr/sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
42+/usr/sbin/syslogd\.sysklogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
43 /usr/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
44 /usr/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
45
46 /var/lib/misc/syslog-ng.persist-? -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
47 /var/lib/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0)
48--- a/policy/modules/system/logging.te
49+++ b/policy/modules/system/logging.te
50@@ -390,10 +390,12 @@ allow syslogd_t self:unix_dgram_socket s
51 allow syslogd_t self:fifo_file rw_fifo_file_perms;
52 allow syslogd_t self:udp_socket create_socket_perms;
53 allow syslogd_t self:tcp_socket create_stream_socket_perms;
54
55 allow syslogd_t syslog_conf_t:file read_file_perms;
56+allow syslogd_t syslog_conf_t:lnk_file read_file_perms;
57+allow syslogd_t syslog_conf_t:dir list_dir_perms;
58
59 # Create and bind to /dev/log or /var/run/log.
60 allow syslogd_t devlog_t:sock_file manage_sock_file_perms;
61 files_pid_filetrans(syslogd_t, devlog_t, sock_file)
62 init_pid_filetrans(syslogd_t, devlog_t, sock_file, "dev-log")
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysvinit.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysvinit.patch
deleted file mode 100644
index d8c1642..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysvinit.patch
+++ /dev/null
@@ -1,57 +0,0 @@
1From 22cd030a8118faae37c0835eb7875e482efe5dc1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 1/4] fix update-alternatives for sysvinit
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/contrib/shutdown.fc | 1 +
12 policy/modules/kernel/corecommands.fc | 1 +
13 policy/modules/system/init.fc | 1 +
14 3 files changed, 3 insertions(+)
15
16--- a/policy/modules/contrib/shutdown.fc
17+++ b/policy/modules/contrib/shutdown.fc
18@@ -1,10 +1,11 @@
19 /etc/nologin -- gen_context(system_u:object_r:shutdown_etc_t,s0)
20
21 /lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
22
23 /sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
24+/sbin/shutdown\.sysvinit -- gen_context(system_u:object_r:shutdown_exec_t,s0)
25
26 /usr/lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
27
28 /usr/sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
29
30--- a/policy/modules/kernel/corecommands.fc
31+++ b/policy/modules/kernel/corecommands.fc
32@@ -8,10 +8,11 @@
33 /bin/bash2 -- gen_context(system_u:object_r:shell_exec_t,s0)
34 /bin/fish -- gen_context(system_u:object_r:shell_exec_t,s0)
35 /bin/ksh.* -- gen_context(system_u:object_r:shell_exec_t,s0)
36 /bin/mksh -- gen_context(system_u:object_r:shell_exec_t,s0)
37 /bin/mountpoint -- gen_context(system_u:object_r:bin_t,s0)
38+/bin/mountpoint\.sysvinit -- gen_context(system_u:object_r:bin_t,s0)
39 /bin/sash -- gen_context(system_u:object_r:shell_exec_t,s0)
40 /bin/tcsh -- gen_context(system_u:object_r:shell_exec_t,s0)
41 /bin/yash -- gen_context(system_u:object_r:shell_exec_t,s0)
42 /bin/zsh.* -- gen_context(system_u:object_r:shell_exec_t,s0)
43
44--- a/policy/modules/system/init.fc
45+++ b/policy/modules/system/init.fc
46@@ -30,10 +30,11 @@ ifdef(`distro_gentoo', `
47
48 #
49 # /sbin
50 #
51 /sbin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0)
52+/sbin/init\.sysvinit -- gen_context(system_u:object_r:init_exec_t,s0)
53 # because nowadays, /sbin/init is often a symlink to /sbin/upstart
54 /sbin/upstart -- gen_context(system_u:object_r:init_exec_t,s0)
55
56 ifdef(`distro_gentoo', `
57 /sbin/rc -- gen_context(system_u:object_r:rc_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-bsdpty_device_t.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-bsdpty_device_t.patch
deleted file mode 100644
index 7be7147..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-bsdpty_device_t.patch
+++ /dev/null
@@ -1,149 +0,0 @@
1From c0b65c327b9354ee5c403cbde428e762ce3f327e Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 5/6] add rules for bsdpty_device_t to complete pty devices.
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/kernel/terminal.if | 16 ++++++++++++++++
12 1 file changed, 16 insertions(+)
13
14--- a/policy/modules/kernel/terminal.if
15+++ b/policy/modules/kernel/terminal.if
16@@ -585,13 +585,15 @@ interface(`term_getattr_generic_ptys',`
17 ## </param>
18 #
19 interface(`term_dontaudit_getattr_generic_ptys',`
20 gen_require(`
21 type devpts_t;
22+ type bsdpty_device_t;
23 ')
24
25 dontaudit $1 devpts_t:chr_file getattr;
26+ dontaudit $1 bsdpty_device_t:chr_file getattr;
27 ')
28 ########################################
29 ## <summary>
30 ## ioctl of generic pty devices.
31 ## </summary>
32@@ -603,15 +605,17 @@ interface(`term_dontaudit_getattr_generi
33 #
34 # cjp: added for ppp
35 interface(`term_ioctl_generic_ptys',`
36 gen_require(`
37 type devpts_t;
38+ type bsdpty_device_t;
39 ')
40
41 dev_list_all_dev_nodes($1)
42 allow $1 devpts_t:dir search;
43 allow $1 devpts_t:chr_file ioctl;
44+ allow $1 bsdpty_device_t:chr_file ioctl;
45 ')
46
47 ########################################
48 ## <summary>
49 ## Allow setting the attributes of
50@@ -625,13 +629,15 @@ interface(`term_ioctl_generic_ptys',`
51 #
52 # dwalsh: added for rhgb
53 interface(`term_setattr_generic_ptys',`
54 gen_require(`
55 type devpts_t;
56+ type bsdpty_device_t;
57 ')
58
59 allow $1 devpts_t:chr_file setattr;
60+ allow $1 bsdpty_device_t:chr_file setattr;
61 ')
62
63 ########################################
64 ## <summary>
65 ## Dontaudit setting the attributes of
66@@ -645,13 +651,15 @@ interface(`term_setattr_generic_ptys',`
67 #
68 # dwalsh: added for rhgb
69 interface(`term_dontaudit_setattr_generic_ptys',`
70 gen_require(`
71 type devpts_t;
72+ type bsdpty_device_t;
73 ')
74
75 dontaudit $1 devpts_t:chr_file setattr;
76+ dontaudit $1 bsdpty_device_t:chr_file setattr;
77 ')
78
79 ########################################
80 ## <summary>
81 ## Read and write the generic pty
82@@ -665,15 +673,17 @@ interface(`term_dontaudit_setattr_generi
83 ## </param>
84 #
85 interface(`term_use_generic_ptys',`
86 gen_require(`
87 type devpts_t;
88+ type bsdpty_device_t;
89 ')
90
91 dev_list_all_dev_nodes($1)
92 allow $1 devpts_t:dir list_dir_perms;
93 allow $1 devpts_t:chr_file { rw_term_perms lock append };
94+ allow $1 bsdpty_device_t:chr_file { rw_term_perms lock append };
95 ')
96
97 ########################################
98 ## <summary>
99 ## Dot not audit attempts to read and
100@@ -687,13 +697,15 @@ interface(`term_use_generic_ptys',`
101 ## </param>
102 #
103 interface(`term_dontaudit_use_generic_ptys',`
104 gen_require(`
105 type devpts_t;
106+ type bsdpty_device_t;
107 ')
108
109 dontaudit $1 devpts_t:chr_file { getattr read write ioctl };
110+ dontaudit $1 bsdpty_device_t:chr_file { getattr read write ioctl };
111 ')
112
113 #######################################
114 ## <summary>
115 ## Set the attributes of the tty device
116@@ -705,14 +717,16 @@ interface(`term_dontaudit_use_generic_pt
117 ## </param>
118 #
119 interface(`term_setattr_controlling_term',`
120 gen_require(`
121 type devtty_t;
122+ type bsdpty_device_t;
123 ')
124
125 dev_list_all_dev_nodes($1)
126 allow $1 devtty_t:chr_file setattr;
127+ allow $1 bsdpty_device_t:chr_file setattr;
128 ')
129
130 ########################################
131 ## <summary>
132 ## Read and write the controlling
133@@ -725,14 +739,16 @@ interface(`term_setattr_controlling_term
134 ## </param>
135 #
136 interface(`term_use_controlling_term',`
137 gen_require(`
138 type devtty_t;
139+ type bsdpty_device_t;
140 ')
141
142 dev_list_all_dev_nodes($1)
143 allow $1 devtty_t:chr_file { rw_term_perms lock append };
144+ allow $1 bsdpty_device_t:chr_file { rw_term_perms lock append };
145 ')
146
147 #######################################
148 ## <summary>
149 ## Get the attributes of the pty multiplexor (/dev/ptmx).
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-syslogd_t-symlink.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-syslogd_t-symlink.patch
deleted file mode 100644
index e90aab5..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-syslogd_t-symlink.patch
+++ /dev/null
@@ -1,30 +0,0 @@
1Subject: [PATCH] add rules for the symlink of /var/log - syslogd_t
2
3We have added rules for the symlink of /var/log in logging.if,
4while syslogd_t uses /var/log but does not use the
5interfaces in logging.if. So still need add a individual rule for
6syslogd_t.
7
8Upstream-Status: Inappropriate [only for Poky]
9
10Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
11Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
12---
13 policy/modules/system/logging.te | 2 ++
14 1 file changed, 2 insertions(+)
15
16--- a/policy/modules/system/logging.te
17+++ b/policy/modules/system/logging.te
18@@ -404,10 +404,12 @@ rw_fifo_files_pattern(syslogd_t, var_log
19 files_search_spool(syslogd_t)
20
21 # Allow access for syslog-ng
22 allow syslogd_t var_log_t:dir { create setattr };
23
24+allow syslogd_t var_log_t:lnk_file read_lnk_file_perms;
25+
26 # manage temporary files
27 manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
28 manage_files_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
29 files_tmp_filetrans(syslogd_t, syslogd_tmp_t, { dir file })
30
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-tmp-symlink.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-tmp-symlink.patch
deleted file mode 100644
index 07ebf58..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-tmp-symlink.patch
+++ /dev/null
@@ -1,129 +0,0 @@
1From 22cd030a8118faae37c0835eb7875e482efe5dc1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH] add rules for the symlink of /tmp
5
6/tmp is a symlink in poky, so we need allow rules for files to read
7lnk_file while doing search/list/delete/rw.. in /tmp/ directory.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13---
14 policy/modules/kernel/files.fc | 1 +
15 policy/modules/kernel/files.if | 8 ++++++++
16 2 files changed, 9 insertions(+), 0 deletions(-)
17
18--- a/policy/modules/kernel/files.fc
19+++ b/policy/modules/kernel/files.fc
20@@ -191,10 +191,11 @@ ifdef(`distro_debian',`
21
22 #
23 # /tmp
24 #
25 /tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
26+/tmp -l gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
27 /tmp/.* <<none>>
28 /tmp/\.journal <<none>>
29
30 /tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
31 /tmp/lost\+found/.* <<none>>
32--- a/policy/modules/kernel/files.if
33+++ b/policy/modules/kernel/files.if
34@@ -4471,10 +4471,11 @@ interface(`files_search_tmp',`
35 gen_require(`
36 type tmp_t;
37 ')
38
39 allow $1 tmp_t:dir search_dir_perms;
40+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
41 ')
42
43 ########################################
44 ## <summary>
45 ## Do not audit attempts to search the tmp directory (/tmp).
46@@ -4507,10 +4508,11 @@ interface(`files_list_tmp',`
47 gen_require(`
48 type tmp_t;
49 ')
50
51 allow $1 tmp_t:dir list_dir_perms;
52+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
53 ')
54
55 ########################################
56 ## <summary>
57 ## Do not audit listing of the tmp directory (/tmp).
58@@ -4543,10 +4545,11 @@ interface(`files_delete_tmp_dir_entry',`
59 gen_require(`
60 type tmp_t;
61 ')
62
63 allow $1 tmp_t:dir del_entry_dir_perms;
64+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
65 ')
66
67 ########################################
68 ## <summary>
69 ## Read files in the tmp directory (/tmp).
70@@ -4561,10 +4564,11 @@ interface(`files_read_generic_tmp_files'
71 gen_require(`
72 type tmp_t;
73 ')
74
75 read_files_pattern($1, tmp_t, tmp_t)
76+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
77 ')
78
79 ########################################
80 ## <summary>
81 ## Manage temporary directories in /tmp.
82@@ -4579,10 +4583,11 @@ interface(`files_manage_generic_tmp_dirs
83 gen_require(`
84 type tmp_t;
85 ')
86
87 manage_dirs_pattern($1, tmp_t, tmp_t)
88+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
89 ')
90
91 ########################################
92 ## <summary>
93 ## Manage temporary files and directories in /tmp.
94@@ -4597,10 +4602,11 @@ interface(`files_manage_generic_tmp_file
95 gen_require(`
96 type tmp_t;
97 ')
98
99 manage_files_pattern($1, tmp_t, tmp_t)
100+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
101 ')
102
103 ########################################
104 ## <summary>
105 ## Read symbolic links in the tmp directory (/tmp).
106@@ -4633,10 +4639,11 @@ interface(`files_rw_generic_tmp_sockets'
107 gen_require(`
108 type tmp_t;
109 ')
110
111 rw_sock_files_pattern($1, tmp_t, tmp_t)
112+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
113 ')
114
115 ########################################
116 ## <summary>
117 ## Mount filesystems in the tmp directory (/tmp)
118@@ -4840,10 +4847,11 @@ interface(`files_tmp_filetrans',`
119 gen_require(`
120 type tmp_t;
121 ')
122
123 filetrans_pattern($1, tmp_t, $2, $3, $4)
124+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
125 ')
126
127 ########################################
128 ## <summary>
129 ## Delete the contents of /tmp.
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-cache-symlink.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-cache-symlink.patch
deleted file mode 100644
index b828b7a..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-cache-symlink.patch
+++ /dev/null
@@ -1,34 +0,0 @@
1From bad816bc752369a6c1bf40231c505d21d95cab08 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 11:20:00 +0800
4Subject: [PATCH 4/6] add rules for the subdir symlinks in /var/
5
6Except /var/log,/var/run,/var/lock, there still other subdir symlinks in
7/var for poky, so we need allow rules for all domains to read these
8symlinks. Domains still need their practical allow rules to read the
9contents, so this is still a secure relax.
10
11Upstream-Status: Inappropriate [only for Poky]
12
13Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
14Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
15---
16 policy/modules/kernel/domain.te | 3 +++
17 1 file changed, 3 insertions(+)
18
19--- a/policy/modules/kernel/domain.te
20+++ b/policy/modules/kernel/domain.te
21@@ -108,10 +108,13 @@ dev_rw_zero(domain)
22 term_use_controlling_term(domain)
23
24 # list the root directory
25 files_list_root(domain)
26
27+# Yocto/oe-core use some var volatile links
28+files_read_var_symlinks(domain)
29+
30 ifdef(`hide_broken_symptoms',`
31 # This check is in the general socket
32 # listen code, before protocol-specific
33 # listen function is called, so bad calls
34 # to listen on UDP sockets should be silenced
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch
deleted file mode 100644
index fb912b5..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch
+++ /dev/null
@@ -1,31 +0,0 @@
1From ed2b0a00e2fb78056041b03c7e198e8f5adaf939 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:36:44 +0800
4Subject: [PATCH 3/6] add rules for the symlink of /var/log - apache2
5
6We have added rules for the symlink of /var/log in logging.if,
7while apache.te uses /var/log but does not use the interfaces in
8logging.if. So still need add a individual rule for apache.te.
9
10Upstream-Status: Inappropriate [only for Poky]
11
12Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
13Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
14---
15 policy/modules/contrib/apache.te | 1 +
16 1 file changed, 1 insertion(+)
17
18--- a/policy/modules/contrib/apache.te
19+++ b/policy/modules/contrib/apache.te
20@@ -407,10 +407,11 @@ allow httpd_t httpd_lock_t:file manage_f
21 files_lock_filetrans(httpd_t, httpd_lock_t, { file dir })
22
23 manage_dirs_pattern(httpd_t, httpd_log_t, httpd_log_t)
24 manage_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
25 read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
26+read_lnk_files_pattern(httpd_t, var_log_t, var_log_t)
27 logging_log_filetrans(httpd_t, httpd_log_t, file)
28
29 allow httpd_t httpd_modules_t:dir list_dir_perms;
30 mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
31 read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch
deleted file mode 100644
index 2e8e1f2..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch
+++ /dev/null
@@ -1,29 +0,0 @@
1Subject: [PATCH] add rules for the symlink of /var/log - audisp_remote_t
2
3We have added rules for the symlink of /var/log in logging.if,
4while audisp_remote_t uses /var/log but does not use the
5interfaces in logging.if. So still need add a individual rule for
6audisp_remote_t.
7
8Upstream-Status: Inappropriate [only for Poky]
9
10Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
11Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
12---
13 policy/modules/system/logging.te | 1 +
14 1 file changed, 1 insertion(+)
15
16--- a/policy/modules/system/logging.te
17+++ b/policy/modules/system/logging.te
18@@ -278,10 +278,11 @@ optional_policy(`
19
20 allow audisp_remote_t self:capability { setuid setpcap };
21 allow audisp_remote_t self:process { getcap setcap };
22 allow audisp_remote_t self:tcp_socket create_socket_perms;
23 allow audisp_remote_t var_log_t:dir search_dir_perms;
24+allow audisp_remote_t var_log_t:lnk_file read_lnk_file_perms;
25
26 manage_dirs_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
27 manage_files_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
28 files_spool_filetrans(audisp_remote_t, audit_spool_t, { dir file })
29
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink.patch
deleted file mode 100644
index a7161d5..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink.patch
+++ /dev/null
@@ -1,185 +0,0 @@
1From 03cb6534f75812f3a33ac768fe83861e0805b0e0 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 2/6] add rules for the symlink of /var/log
5
6/var/log is a symlink in poky, so we need allow rules for files to read
7lnk_file while doing search/list/delete/rw.. in /var/log/ directory.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13---
14 policy/modules/system/logging.fc | 1 +
15 policy/modules/system/logging.if | 14 +++++++++++++-
16 policy/modules/system/logging.te | 1 +
17 3 files changed, 15 insertions(+), 1 deletion(-)
18
19--- a/policy/modules/system/logging.fc
20+++ b/policy/modules/system/logging.fc
21@@ -49,10 +49,11 @@ ifdef(`distro_suse', `
22
23 /var/axfrdns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
24 /var/dnscache/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
25
26 /var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
27+/var/log -l gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
28 /var/log/.* gen_context(system_u:object_r:var_log_t,s0)
29 /var/log/boot\.log -- gen_context(system_u:object_r:var_log_t,mls_systemhigh)
30 /var/log/messages[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
31 /var/log/secure[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
32 /var/log/maillog[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
33--- a/policy/modules/system/logging.if
34+++ b/policy/modules/system/logging.if
35@@ -134,16 +134,17 @@ interface(`logging_set_audit_parameters'
36 ## </param>
37 ## <rolecap/>
38 #
39 interface(`logging_read_audit_log',`
40 gen_require(`
41- type auditd_log_t;
42+ type auditd_log_t, var_log_t;
43 ')
44
45 files_search_var($1)
46 read_files_pattern($1, auditd_log_t, auditd_log_t)
47 allow $1 auditd_log_t:dir list_dir_perms;
48+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
49 ')
50
51 ########################################
52 ## <summary>
53 ## Execute auditctl in the auditctl domain.
54@@ -665,10 +666,11 @@ interface(`logging_search_logs',`
55 type var_log_t;
56 ')
57
58 files_search_var($1)
59 allow $1 var_log_t:dir search_dir_perms;
60+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
61 ')
62
63 #######################################
64 ## <summary>
65 ## Do not audit attempts to search the var log directory.
66@@ -702,10 +704,11 @@ interface(`logging_list_logs',`
67 type var_log_t;
68 ')
69
70 files_search_var($1)
71 allow $1 var_log_t:dir list_dir_perms;
72+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
73 ')
74
75 #######################################
76 ## <summary>
77 ## Read and write the generic log directory (/var/log).
78@@ -721,10 +724,11 @@ interface(`logging_rw_generic_log_dirs',
79 type var_log_t;
80 ')
81
82 files_search_var($1)
83 allow $1 var_log_t:dir rw_dir_perms;
84+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
85 ')
86
87 #######################################
88 ## <summary>
89 ## Search through all log dirs.
90@@ -832,14 +836,16 @@ interface(`logging_append_all_logs',`
91 ## <rolecap/>
92 #
93 interface(`logging_read_all_logs',`
94 gen_require(`
95 attribute logfile;
96+ type var_log_t;
97 ')
98
99 files_search_var($1)
100 allow $1 logfile:dir list_dir_perms;
101+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
102 read_files_pattern($1, logfile, logfile)
103 ')
104
105 ########################################
106 ## <summary>
107@@ -854,14 +860,16 @@ interface(`logging_read_all_logs',`
108 # cjp: not sure why this is needed. This was added
109 # because of logrotate.
110 interface(`logging_exec_all_logs',`
111 gen_require(`
112 attribute logfile;
113+ type var_log_t;
114 ')
115
116 files_search_var($1)
117 allow $1 logfile:dir list_dir_perms;
118+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
119 can_exec($1, logfile)
120 ')
121
122 ########################################
123 ## <summary>
124@@ -919,10 +927,11 @@ interface(`logging_read_generic_logs',`
125 type var_log_t;
126 ')
127
128 files_search_var($1)
129 allow $1 var_log_t:dir list_dir_perms;
130+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
131 read_files_pattern($1, var_log_t, var_log_t)
132 ')
133
134 ########################################
135 ## <summary>
136@@ -939,10 +948,11 @@ interface(`logging_write_generic_logs',`
137 type var_log_t;
138 ')
139
140 files_search_var($1)
141 allow $1 var_log_t:dir list_dir_perms;
142+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
143 write_files_pattern($1, var_log_t, var_log_t)
144 ')
145
146 ########################################
147 ## <summary>
148@@ -977,10 +987,11 @@ interface(`logging_rw_generic_logs',`
149 type var_log_t;
150 ')
151
152 files_search_var($1)
153 allow $1 var_log_t:dir list_dir_perms;
154+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
155 rw_files_pattern($1, var_log_t, var_log_t)
156 ')
157
158 ########################################
159 ## <summary>
160@@ -999,10 +1010,11 @@ interface(`logging_manage_generic_logs',
161 type var_log_t;
162 ')
163
164 files_search_var($1)
165 manage_files_pattern($1, var_log_t, var_log_t)
166+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
167 ')
168
169 ########################################
170 ## <summary>
171 ## All of the rules required to administrate
172--- a/policy/modules/system/logging.te
173+++ b/policy/modules/system/logging.te
174@@ -151,10 +151,11 @@ allow auditd_t auditd_etc_t:file read_fi
175
176 manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
177 allow auditd_t auditd_log_t:dir setattr;
178 manage_lnk_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
179 allow auditd_t var_log_t:dir search_dir_perms;
180+allow auditd_t var_log_t:lnk_file read_lnk_file_perms;
181
182 manage_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
183 manage_sock_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
184 files_pid_filetrans(auditd_t, auditd_var_run_t, { file sock_file })
185
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-syslogd_t-to-trusted-object.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-syslogd_t-to-trusted-object.patch
deleted file mode 100644
index dc623d3..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-syslogd_t-to-trusted-object.patch
+++ /dev/null
@@ -1,31 +0,0 @@
1From 27e62a5d9ab9993760369ccdad83673e9148cbb2 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 1/6] Add the syslogd_t to trusted object
5
6We add the syslogd_t to trusted object, because other process need
7to have the right to connectto/sendto /dev/log.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Roy.Li <rongqing.li@windriver.com>
12Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
13Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
14---
15 policy/modules/system/logging.te | 1 +
16 1 file changed, 1 insertion(+)
17
18--- a/policy/modules/system/logging.te
19+++ b/policy/modules/system/logging.te
20@@ -477,10 +477,11 @@ files_var_lib_filetrans(syslogd_t, syslo
21
22 fs_getattr_all_fs(syslogd_t)
23 fs_search_auto_mountpoints(syslogd_t)
24
25 mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
26+mls_trusted_object(syslogd_t) # Other process need to have the right to connectto/sendto /dev/log
27
28 term_write_console(syslogd_t)
29 # Allow syslog to a terminal
30 term_write_unallocated_ttys(syslogd_t)
31
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-allow-nfsd-to-exec-shell-commands.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-allow-nfsd-to-exec-shell-commands.patch
deleted file mode 100644
index ca2796f..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-allow-nfsd-to-exec-shell-commands.patch
+++ /dev/null
@@ -1,60 +0,0 @@
1From 22cd030a8118faae37c0835eb7875e482efe5dc1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH] allow nfsd to exec shell commands.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/contrib/rpc.te | 2 +-
12 policy/modules/kernel/kernel.if | 18 ++++++++++++++++++
13 2 files changed, 19 insertions(+), 1 deletions(-)
14
15--- a/policy/modules/contrib/rpc.te
16+++ b/policy/modules/contrib/rpc.te
17@@ -222,11 +222,11 @@ allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir
18
19 kernel_read_network_state(nfsd_t)
20 kernel_dontaudit_getattr_core_if(nfsd_t)
21 kernel_setsched(nfsd_t)
22 kernel_request_load_module(nfsd_t)
23-# kernel_mounton_proc(nfsd_t)
24+kernel_mounton_proc(nfsd_t)
25
26 corenet_sendrecv_nfs_server_packets(nfsd_t)
27 corenet_tcp_bind_nfs_port(nfsd_t)
28 corenet_udp_bind_nfs_port(nfsd_t)
29
30--- a/policy/modules/kernel/kernel.if
31+++ b/policy/modules/kernel/kernel.if
32@@ -844,10 +844,28 @@ interface(`kernel_unmount_proc',`
33 allow $1 proc_t:filesystem unmount;
34 ')
35
36 ########################################
37 ## <summary>
38+## Mounton a proc filesystem.
39+## </summary>
40+## <param name="domain">
41+## <summary>
42+## Domain allowed access.
43+## </summary>
44+## </param>
45+#
46+interface(`kernel_mounton_proc',`
47+ gen_require(`
48+ type proc_t;
49+ ')
50+
51+ allow $1 proc_t:dir mounton;
52+')
53+
54+########################################
55+## <summary>
56 ## Get the attributes of the proc filesystem.
57 ## </summary>
58 ## <param name="domain">
59 ## <summary>
60 ## Domain allowed access.
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-allow-setfiles_t-to-read-symlinks.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-allow-setfiles_t-to-read-symlinks.patch
deleted file mode 100644
index d28bde0..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-allow-setfiles_t-to-read-symlinks.patch
+++ /dev/null
@@ -1,30 +0,0 @@
1From 87b6daf87a07350a58c1724db8fc0a99b849818a Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH] fix setfiles_t to read symlinks
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
10Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
11---
12 policy/modules/system/selinuxutil.te | 3 +++
13 1 file changed, 3 insertions(+)
14
15--- a/policy/modules/system/selinuxutil.te
16+++ b/policy/modules/system/selinuxutil.te
17@@ -553,10 +553,13 @@ files_read_etc_files(setfiles_t)
18 files_list_all(setfiles_t)
19 files_relabel_all_files(setfiles_t)
20 files_read_usr_symlinks(setfiles_t)
21 files_dontaudit_read_all_symlinks(setfiles_t)
22
23+# needs to be able to read symlinks to make restorecon on symlink working
24+files_read_all_symlinks(setfiles_t)
25+
26 fs_getattr_all_xattr_fs(setfiles_t)
27 fs_list_all(setfiles_t)
28 fs_search_auto_mountpoints(setfiles_t)
29 fs_relabelfrom_noxattr_fs(setfiles_t)
30
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-allow-sysadm-to-run-rpcinfo.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-allow-sysadm-to-run-rpcinfo.patch
deleted file mode 100644
index a1fda13..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-allow-sysadm-to-run-rpcinfo.patch
+++ /dev/null
@@ -1,33 +0,0 @@
1From 7005533d61770fed5a3312aa9dfd1c18dae88c16 Mon Sep 17 00:00:00 2001
2From: Roy Li <rongqing.li@windriver.com>
3Date: Sat, 15 Feb 2014 09:45:00 +0800
4Subject: [PATCH] allow sysadm to run rpcinfo
5
6Upstream-Status: Pending
7
8type=AVC msg=audit(1392427946.976:264): avc: denied { connectto } for pid=2111 comm="rpcinfo" path="/run/rpcbind.sock" scontext=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 tcontext=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 tclass=unix_stream_socket
9type=SYSCALL msg=audit(1392427946.976:264): arch=c000003e syscall=42 success=no exit=-13 a0=3 a1=7fff3aa20000 a2=17 a3=22 items=0 ppid=2108 pid=2111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts0 comm="rpcinfo" exe="/usr/sbin/rpcinfo" subj=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 key=(null)
10
11Signed-off-by: Roy Li <rongqing.li@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13---
14 policy/modules/roles/sysadm.te | 4 ++++
15 1 file changed, 4 insertions(+)
16
17--- a/policy/modules/roles/sysadm.te
18+++ b/policy/modules/roles/sysadm.te
19@@ -1169,10 +1169,14 @@ optional_policy(`
20 virt_admin(sysadm_t, sysadm_r)
21 virt_stream_connect(sysadm_t)
22 ')
23
24 optional_policy(`
25+ rpcbind_stream_connect(sysadm_t)
26+')
27+
28+optional_policy(`
29 vmware_role(sysadm_r, sysadm_t)
30 ')
31
32 optional_policy(`
33 vnstatd_admin(sysadm_t, sysadm_r)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-don-t-audit-tty_device_t.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-don-t-audit-tty_device_t.patch
deleted file mode 100644
index 346872a..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-don-t-audit-tty_device_t.patch
+++ /dev/null
@@ -1,35 +0,0 @@
1From 29a0d287880f8f83cf4337a3db7c8b94c0c36e1d Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 6/6] don't audit tty_device_t in term_dontaudit_use_console.
5
6We should also not audit terminal to rw tty_device_t and fds in
7term_dontaudit_use_console.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13---
14 policy/modules/kernel/terminal.if | 3 +++
15 1 file changed, 3 insertions(+)
16
17--- a/policy/modules/kernel/terminal.if
18+++ b/policy/modules/kernel/terminal.if
19@@ -297,13 +297,16 @@ interface(`term_use_console',`
20 ## </param>
21 #
22 interface(`term_dontaudit_use_console',`
23 gen_require(`
24 type console_device_t;
25+ type tty_device_t;
26 ')
27
28+ init_dontaudit_use_fds($1)
29 dontaudit $1 console_device_t:chr_file rw_chr_file_perms;
30+ dontaudit $1 tty_device_t:chr_file rw_chr_file_perms;
31 ')
32
33 ########################################
34 ## <summary>
35 ## Set the attributes of the console
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-dmesg-to-use-dev-kmsg.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-dmesg-to-use-dev-kmsg.patch
deleted file mode 100644
index 8443e31..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-dmesg-to-use-dev-kmsg.patch
+++ /dev/null
@@ -1,37 +0,0 @@
1From 2f5981f2244289a1cc79748e9ffdaaea168b1df2 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 16:36:09 +0800
4Subject: [PATCH] fix dmesg to use /dev/kmsg as default input
5
6Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
7Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
8---
9 policy/modules/admin/dmesg.if | 1 +
10 policy/modules/admin/dmesg.te | 2 ++
11 2 files changed, 3 insertions(+)
12
13--- a/policy/modules/admin/dmesg.if
14+++ b/policy/modules/admin/dmesg.if
15@@ -35,6 +35,7 @@ interface(`dmesg_exec',`
16 type dmesg_exec_t;
17 ')
18
19 corecmd_search_bin($1)
20 can_exec($1, dmesg_exec_t)
21+ dev_read_kmsg($1)
22 ')
23--- a/policy/modules/admin/dmesg.te
24+++ b/policy/modules/admin/dmesg.te
25@@ -28,10 +28,12 @@ kernel_read_proc_symlinks(dmesg_t)
26 # for when /usr is not mounted:
27 kernel_dontaudit_search_unlabeled(dmesg_t)
28
29 dev_read_sysfs(dmesg_t)
30
31+dev_read_kmsg(dmesg_t)
32+
33 fs_search_auto_mountpoints(dmesg_t)
34
35 term_dontaudit_use_console(dmesg_t)
36
37 domain_use_interactive_fds(dmesg_t)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-new-SELINUXMNT-in-sys.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-new-SELINUXMNT-in-sys.patch
deleted file mode 100644
index 58903ce..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-new-SELINUXMNT-in-sys.patch
+++ /dev/null
@@ -1,259 +0,0 @@
1From 0bd1187768c79ccf7d0563fa8e2bc01494fef167 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH] fix for new SELINUXMNT in /sys
5
6SELINUXMNT is now from /selinux to /sys/fs/selinux, so we should
7add rules to access sysfs.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13---
14 policy/modules/kernel/selinux.if | 34 ++++++++++++++++++++++++++++++++--
15 1 file changed, 32 insertions(+), 2 deletions(-)
16
17--- a/policy/modules/kernel/selinux.if
18+++ b/policy/modules/kernel/selinux.if
19@@ -56,10 +56,14 @@ interface(`selinux_labeled_boolean',`
20 interface(`selinux_get_fs_mount',`
21 gen_require(`
22 type security_t;
23 ')
24
25+ # SELINUXMNT is now /sys/fs/selinux, so we should add rules to
26+ # access sysfs
27+ dev_getattr_sysfs_dirs($1)
28+ dev_search_sysfs($1)
29 # starting in libselinux 2.0.5, init_selinuxmnt() will
30 # attempt to short circuit by checking if SELINUXMNT
31 # (/selinux) is already a selinuxfs
32 allow $1 security_t:filesystem getattr;
33
34@@ -86,10 +90,11 @@ interface(`selinux_get_fs_mount',`
35 interface(`selinux_dontaudit_get_fs_mount',`
36 gen_require(`
37 type security_t;
38 ')
39
40+ dev_dontaudit_search_sysfs($1)
41 # starting in libselinux 2.0.5, init_selinuxmnt() will
42 # attempt to short circuit by checking if SELINUXMNT
43 # (/selinux) is already a selinuxfs
44 dontaudit $1 security_t:filesystem getattr;
45
46@@ -115,10 +120,12 @@ interface(`selinux_dontaudit_get_fs_moun
47 interface(`selinux_mount_fs',`
48 gen_require(`
49 type security_t;
50 ')
51
52+ dev_getattr_sysfs_dirs($1)
53+ dev_search_sysfs($1)
54 allow $1 security_t:filesystem mount;
55 ')
56
57 ########################################
58 ## <summary>
59@@ -134,10 +141,12 @@ interface(`selinux_mount_fs',`
60 interface(`selinux_remount_fs',`
61 gen_require(`
62 type security_t;
63 ')
64
65+ dev_getattr_sysfs_dirs($1)
66+ dev_search_sysfs($1)
67 allow $1 security_t:filesystem remount;
68 ')
69
70 ########################################
71 ## <summary>
72@@ -152,10 +161,12 @@ interface(`selinux_remount_fs',`
73 interface(`selinux_unmount_fs',`
74 gen_require(`
75 type security_t;
76 ')
77
78+ dev_getattr_sysfs_dirs($1)
79+ dev_search_sysfs($1)
80 allow $1 security_t:filesystem unmount;
81 ')
82
83 ########################################
84 ## <summary>
85@@ -170,10 +181,12 @@ interface(`selinux_unmount_fs',`
86 interface(`selinux_getattr_fs',`
87 gen_require(`
88 type security_t;
89 ')
90
91+ dev_getattr_sysfs_dirs($1)
92+ dev_search_sysfs($1)
93 allow $1 security_t:filesystem getattr;
94
95 dev_getattr_sysfs($1)
96 dev_search_sysfs($1)
97 ')
98@@ -192,10 +205,11 @@ interface(`selinux_getattr_fs',`
99 interface(`selinux_dontaudit_getattr_fs',`
100 gen_require(`
101 type security_t;
102 ')
103
104+ dev_dontaudit_search_sysfs($1)
105 dontaudit $1 security_t:filesystem getattr;
106
107 dev_dontaudit_getattr_sysfs($1)
108 dev_dontaudit_search_sysfs($1)
109 ')
110@@ -214,10 +228,11 @@ interface(`selinux_dontaudit_getattr_fs'
111 interface(`selinux_dontaudit_getattr_dir',`
112 gen_require(`
113 type security_t;
114 ')
115
116+ dev_dontaudit_search_sysfs($1)
117 dontaudit $1 security_t:dir getattr;
118 ')
119
120 ########################################
121 ## <summary>
122@@ -232,10 +247,11 @@ interface(`selinux_dontaudit_getattr_dir
123 interface(`selinux_search_fs',`
124 gen_require(`
125 type security_t;
126 ')
127
128+ dev_getattr_sysfs_dirs($1)
129 dev_search_sysfs($1)
130 allow $1 security_t:dir search_dir_perms;
131 ')
132
133 ########################################
134@@ -251,10 +267,11 @@ interface(`selinux_search_fs',`
135 interface(`selinux_dontaudit_search_fs',`
136 gen_require(`
137 type security_t;
138 ')
139
140+ dev_dontaudit_search_sysfs($1)
141 dontaudit $1 security_t:dir search_dir_perms;
142 ')
143
144 ########################################
145 ## <summary>
146@@ -270,10 +287,11 @@ interface(`selinux_dontaudit_search_fs',
147 interface(`selinux_dontaudit_read_fs',`
148 gen_require(`
149 type security_t;
150 ')
151
152+ dev_dontaudit_search_sysfs($1)
153 dontaudit $1 security_t:dir search_dir_perms;
154 dontaudit $1 security_t:file read_file_perms;
155 ')
156
157 ########################################
158@@ -291,10 +309,11 @@ interface(`selinux_dontaudit_read_fs',`
159 interface(`selinux_get_enforce_mode',`
160 gen_require(`
161 type security_t;
162 ')
163
164+ dev_getattr_sysfs_dirs($1)
165 dev_search_sysfs($1)
166 allow $1 security_t:dir list_dir_perms;
167 allow $1 security_t:file read_file_perms;
168 ')
169
170@@ -359,10 +378,11 @@ interface(`selinux_load_policy',`
171 interface(`selinux_read_policy',`
172 gen_require(`
173 type security_t;
174 ')
175
176+ dev_getattr_sysfs_dirs($1)
177 dev_search_sysfs($1)
178 allow $1 security_t:dir list_dir_perms;
179 allow $1 security_t:file read_file_perms;
180 allow $1 security_t:security read_policy;
181 ')
182@@ -424,10 +444,11 @@ interface(`selinux_set_boolean',`
183 interface(`selinux_set_generic_booleans',`
184 gen_require(`
185 type security_t;
186 ')
187
188+ dev_getattr_sysfs_dirs($1)
189 dev_search_sysfs($1)
190
191 allow $1 security_t:dir list_dir_perms;
192 allow $1 security_t:file rw_file_perms;
193
194@@ -461,10 +482,11 @@ interface(`selinux_set_all_booleans',`
195 type security_t, secure_mode_policyload_t;
196 attribute boolean_type;
197 bool secure_mode_policyload;
198 ')
199
200+ dev_getattr_sysfs_dirs($1)
201 dev_search_sysfs($1)
202
203 allow $1 security_t:dir list_dir_perms;
204 allow $1 { boolean_type -secure_mode_policyload_t }:file rw_file_perms;
205 allow $1 secure_mode_policyload_t:file read_file_perms;
206@@ -520,10 +542,11 @@ interface(`selinux_set_parameters',`
207 interface(`selinux_validate_context',`
208 gen_require(`
209 type security_t;
210 ')
211
212+ dev_getattr_sysfs_dirs($1)
213 dev_search_sysfs($1)
214 allow $1 security_t:dir list_dir_perms;
215 allow $1 security_t:file rw_file_perms;
216 allow $1 security_t:security check_context;
217 ')
218@@ -542,10 +565,11 @@ interface(`selinux_validate_context',`
219 interface(`selinux_dontaudit_validate_context',`
220 gen_require(`
221 type security_t;
222 ')
223
224+ dev_dontaudit_search_sysfs($1)
225 dontaudit $1 security_t:dir list_dir_perms;
226 dontaudit $1 security_t:file rw_file_perms;
227 dontaudit $1 security_t:security check_context;
228 ')
229
230@@ -563,10 +587,11 @@ interface(`selinux_dontaudit_validate_co
231 interface(`selinux_compute_access_vector',`
232 gen_require(`
233 type security_t;
234 ')
235
236+ dev_getattr_sysfs_dirs($1)
237 dev_search_sysfs($1)
238 allow $1 security_t:dir list_dir_perms;
239 allow $1 security_t:file rw_file_perms;
240 allow $1 security_t:security compute_av;
241 ')
242@@ -658,10 +683,17 @@ interface(`selinux_compute_relabel_conte
243 interface(`selinux_compute_user_contexts',`
244 gen_require(`
245 type security_t;
246 ')
247
248+ dev_getattr_sysfs_dirs($1)
249+ dev_getattr_sysfs_dirs($1)
250+ dev_getattr_sysfs_dirs($1)
251+ dev_getattr_sysfs_dirs($1)
252+ dev_getattr_sysfs_dirs($1)
253+ dev_getattr_sysfs_dirs($1)
254+ dev_getattr_sysfs_dirs($1)
255 dev_search_sysfs($1)
256 allow $1 security_t:dir list_dir_perms;
257 allow $1 security_t:file rw_file_perms;
258 allow $1 security_t:security compute_user;
259 ')
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch
deleted file mode 100644
index 883daf8..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch
+++ /dev/null
@@ -1,79 +0,0 @@
1From 054a2d81a42bc127d29a916c64b43ad5a7c97f21 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 12:01:53 +0800
4Subject: [PATCH] fix policy for nfsserver to mount nfsd_fs_t.
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/contrib/rpc.te | 5 +++++
12 policy/modules/contrib/rpcbind.te | 5 +++++
13 policy/modules/kernel/filesystem.te | 1 +
14 policy/modules/kernel/kernel.te | 2 ++
15 4 files changed, 13 insertions(+)
16
17--- a/policy/modules/contrib/rpcbind.te
18+++ b/policy/modules/contrib/rpcbind.te
19@@ -71,8 +71,13 @@ auth_use_nsswitch(rpcbind_t)
20
21 logging_send_syslog_msg(rpcbind_t)
22
23 miscfiles_read_localization(rpcbind_t)
24
25+# nfsd_t would not be allowed to send unix_stream_socket to rpcbind_t,
26+# because the are running in different level. So add rules to allow this.
27+mls_socket_read_all_levels(rpcbind_t)
28+mls_socket_write_all_levels(rpcbind_t)
29+
30 ifdef(`distro_debian',`
31 term_dontaudit_use_unallocated_ttys(rpcbind_t)
32 ')
33--- a/policy/modules/contrib/rpc.te
34+++ b/policy/modules/contrib/rpc.te
35@@ -275,10 +275,15 @@ tunable_policy(`nfs_export_all_ro',`
36 files_read_non_auth_files(nfsd_t)
37 ')
38
39 optional_policy(`
40 mount_exec(nfsd_t)
41+ # Should domtrans to mount_t while mounting nfsd_fs_t.
42+ mount_domtrans(nfsd_t)
43+ # nfsd_t need to chdir to /var/lib/nfs and read files.
44+ files_list_var(nfsd_t)
45+ rpc_read_nfs_state_data(nfsd_t)
46 ')
47
48 ########################################
49 #
50 # GSSD local policy
51--- a/policy/modules/kernel/filesystem.te
52+++ b/policy/modules/kernel/filesystem.te
53@@ -127,10 +127,11 @@ fs_noxattr_type(mvfs_t)
54 allow mvfs_t self:filesystem associate;
55 genfscon mvfs / gen_context(system_u:object_r:mvfs_t,s0)
56
57 type nfsd_fs_t;
58 fs_type(nfsd_fs_t)
59+files_mountpoint(nfsd_fs_t)
60 genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
61
62 type nsfs_t;
63 fs_type(nsfs_t)
64 genfscon nsfs / gen_context(system_u:object_r:nsfs_t,s0)
65--- a/policy/modules/kernel/kernel.te
66+++ b/policy/modules/kernel/kernel.te
67@@ -324,10 +324,12 @@ mcs_process_set_categories(kernel_t)
68
69 mls_process_read_all_levels(kernel_t)
70 mls_process_write_all_levels(kernel_t)
71 mls_file_write_all_levels(kernel_t)
72 mls_file_read_all_levels(kernel_t)
73+mls_socket_write_all_levels(kernel_t)
74+mls_fd_use_all_levels(kernel_t)
75
76 ifdef(`distro_redhat',`
77 # Bugzilla 222337
78 fs_rw_tmpfs_chr_files(kernel_t)
79 ')
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-setfiles-statvfs-get-file-count.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-setfiles-statvfs-get-file-count.patch
deleted file mode 100644
index 1cfd80b..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-setfiles-statvfs-get-file-count.patch
+++ /dev/null
@@ -1,32 +0,0 @@
1From f4e034d6996c5b1f88a9262828dac2ad6ee09b7b Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 14:38:53 +0800
4Subject: [PATCH] fix setfiles statvfs to get file count
5
6New setfiles will read /proc/mounts and use statvfs in
7file_system_count() to get file count of filesystems.
8
9Upstream-Status: pending
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
13Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
14---
15 policy/modules/system/selinuxutil.te | 2 +-
16 1 file changed, 1 insertion(+), 1 deletion(-)
17
18--- a/policy/modules/system/selinuxutil.te
19+++ b/policy/modules/system/selinuxutil.te
20@@ -556,11 +556,11 @@ files_read_usr_symlinks(setfiles_t)
21 files_dontaudit_read_all_symlinks(setfiles_t)
22
23 # needs to be able to read symlinks to make restorecon on symlink working
24 files_read_all_symlinks(setfiles_t)
25
26-fs_getattr_all_xattr_fs(setfiles_t)
27+fs_getattr_all_fs(setfiles_t)
28 fs_list_all(setfiles_t)
29 fs_search_auto_mountpoints(setfiles_t)
30 fs_relabelfrom_noxattr_fs(setfiles_t)
31
32 mls_file_read_all_levels(setfiles_t)
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-seutils-manage-config-files.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-seutils-manage-config-files.patch
deleted file mode 100644
index fba7759..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-fix-seutils-manage-config-files.patch
+++ /dev/null
@@ -1,45 +0,0 @@
1From be8e015aec19553d3753af132861d24da9ed0265 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 2/2] refpolicy: fix selinux utils to manage config files
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/system/selinuxutil.if | 1 +
12 policy/modules/system/userdomain.if | 4 ++++
13 2 files changed, 5 insertions(+)
14
15--- a/policy/modules/system/selinuxutil.if
16+++ b/policy/modules/system/selinuxutil.if
17@@ -753,10 +753,11 @@ interface(`seutil_manage_config',`
18 gen_require(`
19 type selinux_config_t;
20 ')
21
22 files_search_etc($1)
23+ manage_dirs_pattern($1, selinux_config_t, selinux_config_t)
24 manage_files_pattern($1, selinux_config_t, selinux_config_t)
25 read_lnk_files_pattern($1, selinux_config_t, selinux_config_t)
26 ')
27
28 #######################################
29--- a/policy/modules/system/userdomain.if
30+++ b/policy/modules/system/userdomain.if
31@@ -1327,10 +1327,14 @@ template(`userdom_security_admin_templat
32 logging_read_audit_log($1)
33 logging_read_generic_logs($1)
34 logging_read_audit_config($1)
35
36 seutil_manage_bin_policy($1)
37+ seutil_manage_default_contexts($1)
38+ seutil_manage_file_contexts($1)
39+ seutil_manage_module_store($1)
40+ seutil_manage_config($1)
41 seutil_run_checkpolicy($1, $2)
42 seutil_run_loadpolicy($1, $2)
43 seutil_run_semanage($1, $2)
44 seutil_run_setfiles($1, $2)
45
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/refpolicy-update-for_systemd.patch b/recipes-security/refpolicy/refpolicy-2.20170204/refpolicy-update-for_systemd.patch
deleted file mode 100644
index 41b9c2b..0000000
--- a/recipes-security/refpolicy/refpolicy-2.20170204/refpolicy-update-for_systemd.patch
+++ /dev/null
@@ -1,27 +0,0 @@
1From 07553727dca51631c93bca482442da8d0c50ac94 Mon Sep 17 00:00:00 2001
2From: Shrikant Bobade <shrikant_bobade@mentor.com>
3Date: Fri, 12 Jun 2015 19:37:52 +0530
4Subject: [PATCH] refpolicy: update for systemd related allow rules
5
6It provide, the systemd support related allow rules
7
8Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/system/init.te | 5 +++++
12 1 file changed, 5 insertions(+)
13
14--- a/policy/modules/system/init.te
15+++ b/policy/modules/system/init.te
16@@ -1105,5 +1105,10 @@ optional_policy(`
17 ')
18
19 optional_policy(`
20 zebra_read_config(initrc_t)
21 ')
22+
23+# systemd related allow rules
24+allow kernel_t init_t:process dyntransition;
25+allow devpts_t device_t:filesystem associate;
26+allow init_t self:capability2 block_suspend;
27\ No newline at end of file
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-21 10:18:59 +0000