From e8d39ffb15b4d78f8b95711bbb509f9afbd46c05 Mon Sep 17 00:00:00 2001 From: Sajjad Ahmed Date: Tue, 9 Jan 2018 16:10:12 +0500 Subject: Fix URL, update refpolicy patches and dependencies * audit_2.7.6.bb : fix error [gzip: stdin: not in gzip format] and checksum * refpolicy-minimum_git.bb : fix [Failed to resolve typeattributeset statement], dependency for "fsadm" in init.pp * refpolicy-targeted_2.20170204.bb : added version dependent patches * patches : separate patches for release 2.20170204 version and 2.20170805+git version Signed-off-by: Sajjad Ahmed Signed-off-by: Joe MacDonald --- .../poky-fc-update-alternatives_bash.patch | 36 ++++++++-------------- ...licy-add-rules-for-var-log-symlink-apache.patch | 29 +++-------------- 2 files changed, 17 insertions(+), 48 deletions(-) (limited to 'recipes-security/refpolicy/refpolicy-git') diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_bash.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_bash.patch index e0fdba1..49136e6 100644 --- a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_bash.patch +++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_bash.patch @@ -1,24 +1,12 @@ -From 845518a6f196e6e8c49ba38791c85e17276920e1 Mon Sep 17 00:00:00 2001 -From: Mark Hatle -Date: Thu, 14 Sep 2017 15:02:23 -0500 -Subject: [PATCH 3/4] fix update-alternatives for hostname - -Upstream-Status: Inappropriate [only for Poky] - -Signed-off-by: Mark Hatle ---- - policy/modules/system/corecommands.fc | 1 + - 1 file changed, 1 insertion(+) - -Index: refpolicy/policy/modules/kernel/corecommands.fc -=================================================================== ---- refpolicy.orig/policy/modules/kernel/corecommands.fc -+++ refpolicy/policy/modules/kernel/corecommands.fc -@@ -6,6 +6,7 @@ - /bin/d?ash -- gen_context(system_u:object_r:shell_exec_t,s0) - /bin/bash -- gen_context(system_u:object_r:shell_exec_t,s0) - /bin/bash2 -- gen_context(system_u:object_r:shell_exec_t,s0) -+/bin/bash\.bash -- gen_context(system_u:object_r:shell_exec_t,s0) - /bin/fish -- gen_context(system_u:object_r:shell_exec_t,s0) - /bin/ksh.* -- gen_context(system_u:object_r:shell_exec_t,s0) - /bin/mksh -- gen_context(system_u:object_r:shell_exec_t,s0) +diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc +index f2e4f51..c39912d 100644 +--- a/policy/modules/kernel/corecommands.fc ++++ b/policy/modules/kernel/corecommands.fc +@@ -141,6 +141,7 @@ ifdef(`distro_gentoo',` + /usr/bin/d?ash -- gen_context(system_u:object_r:shell_exec_t,s0) + /usr/bin/bash -- gen_context(system_u:object_r:shell_exec_t,s0) + /usr/bin/bash2 -- gen_context(system_u:object_r:shell_exec_t,s0) ++/usr/bin\.bash -- gen_context(system_u:object_r:shell_exec_t,s0) + /usr/bin/fish -- gen_context(system_u:object_r:shell_exec_t,s0) + /usr/bin/git-shell -- gen_context(system_u:object_r:shell_exec_t,s0) + /usr/bin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0) diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch index fb912b5..5bd5b2e 100644 --- a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch +++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch @@ -1,31 +1,12 @@ -From ed2b0a00e2fb78056041b03c7e198e8f5adaf939 Mon Sep 17 00:00:00 2001 -From: Xin Ouyang -Date: Thu, 22 Aug 2013 19:36:44 +0800 -Subject: [PATCH 3/6] add rules for the symlink of /var/log - apache2 - -We have added rules for the symlink of /var/log in logging.if, -while apache.te uses /var/log but does not use the interfaces in -logging.if. So still need add a individual rule for apache.te. - -Upstream-Status: Inappropriate [only for Poky] - -Signed-off-by: Xin Ouyang -Signed-off-by: Joe MacDonald ---- - policy/modules/contrib/apache.te | 1 + - 1 file changed, 1 insertion(+) - +diff --git a/policy/modules/contrib/apache.te b/policy/modules/contrib/apache.te +index fcf795f..529057c 100644 --- a/policy/modules/contrib/apache.te +++ b/policy/modules/contrib/apache.te -@@ -407,10 +407,11 @@ allow httpd_t httpd_lock_t:file manage_f - files_lock_filetrans(httpd_t, httpd_lock_t, { file dir }) - - manage_dirs_pattern(httpd_t, httpd_log_t, httpd_log_t) - manage_files_pattern(httpd_t, httpd_log_t, httpd_log_t) +@@ -412,6 +412,7 @@ create_files_pattern(httpd_t, httpd_log_t, httpd_log_t) + read_files_pattern(httpd_t, httpd_log_t, httpd_log_t) + setattr_files_pattern(httpd_t, httpd_log_t, httpd_log_t) read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t) +read_lnk_files_pattern(httpd_t, var_log_t, var_log_t) logging_log_filetrans(httpd_t, httpd_log_t, file) allow httpd_t httpd_modules_t:dir list_dir_perms; - mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) - read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) -- cgit v1.2.3-54-g00ecf