diff options
author | Joe MacDonald <joe@deserted.net> | 2018-10-25 09:57:23 +0100 |
---|---|---|
committer | Joe MacDonald <joe@deserted.net> | 2018-10-30 08:03:09 -0400 |
commit | 67208898cd9e3203528e1e7399f49da9c598eb54 (patch) | |
tree | 576ac99d71f455112151ff972bcb343999e9e5e8 | |
parent | 0da25d103bf305ed26ac6f7a1705e161d9724283 (diff) | |
download | meta-selinux-sumo.tar.gz |
refpolicy: fix up all refpolicy 20170224 builds for sumosumo
Signed-off-by: Joe MacDonald <joe@deserted.net>
4 files changed, 51 insertions, 32 deletions
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch index 2038110..e9a0464 100644 --- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch +++ b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch | |||
@@ -11,13 +11,13 @@ Upstream-Status: Inappropriate [only for Poky] | |||
11 | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> | 11 | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> |
12 | Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> | 12 | Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> |
13 | --- | 13 | --- |
14 | policy/modules/system/logging.fc | 4 ++++ | 14 | policy/modules/system/logging.fc | 3 +++ |
15 | policy/modules/system/logging.te | 1 + | 15 | policy/modules/system/logging.te | 2 ++ |
16 | 2 files changed, 5 insertions(+) | 16 | 2 files changed, 5 insertions(+) |
17 | 17 | ||
18 | --- a/policy/modules/system/logging.fc | 18 | --- a/policy/modules/system/logging.fc |
19 | +++ b/policy/modules/system/logging.fc | 19 | +++ b/policy/modules/system/logging.fc |
20 | @@ -1,22 +1,26 @@ | 20 | @@ -1,9 +1,10 @@ |
21 | /dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) | 21 | /dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) |
22 | 22 | ||
23 | /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) | 23 | /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) |
@@ -26,35 +26,37 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> | |||
26 | /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh) | 26 | /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh) |
27 | /etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0) | 27 | /etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0) |
28 | /etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0) | 28 | /etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0) |
29 | +/etc/rc\.d/init\.d/syslog\.sysklogd -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0) | ||
30 | 29 | ||
31 | /sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0) | 30 | /usr/bin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0) |
32 | /sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0) | 31 | @@ -27,14 +28,16 @@ |
33 | /sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0) | 32 | /usr/sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0) |
34 | /sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0) | 33 | /usr/sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0) |
35 | /sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0) | 34 | /usr/sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0) |
36 | +/sbin/klogd\.sysklogd -- gen_context(system_u:object_r:klogd_exec_t,s0) | 35 | /usr/sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0) |
37 | /sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) | 36 | /usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0) |
38 | /sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0) | 37 | +/usr/sbin/klogd\.sysklogd -- gen_context(system_u:object_r:klogd_exec_t,s0) |
39 | /sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) | 38 | /usr/sbin/metalog -- gen_context(system_u:object_r:syslogd_exec_t,s0) |
40 | /sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) | 39 | /usr/sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) |
41 | +/sbin/syslogd\.sysklogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) | 40 | /usr/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0) |
42 | /sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0) | 41 | /usr/sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) |
42 | +/usr/sbin/syslogd\.sysklogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) | ||
43 | /usr/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0) | ||
44 | /usr/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) | ||
43 | 45 | ||
44 | /usr/lib/systemd/system/auditd.* -- gen_context(system_u:object_r:auditd_unit_t,s0) | 46 | /var/lib/misc/syslog-ng.persist-? -- gen_context(system_u:object_r:syslogd_var_lib_t,s0) |
45 | /usr/lib/systemd/system/[^/]*systemd-journal.* -- gen_context(system_u:object_r:syslogd_unit_t,s0) | 47 | /var/lib/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0) |
46 | /usr/lib/systemd/systemd-journald -- gen_context(system_u:object_r:syslogd_exec_t,s0) | ||
47 | --- a/policy/modules/system/logging.te | 48 | --- a/policy/modules/system/logging.te |
48 | +++ b/policy/modules/system/logging.te | 49 | +++ b/policy/modules/system/logging.te |
49 | @@ -388,10 +388,11 @@ allow syslogd_t self:unix_dgram_socket s | 50 | @@ -390,10 +390,12 @@ allow syslogd_t self:unix_dgram_socket s |
50 | allow syslogd_t self:fifo_file rw_fifo_file_perms; | 51 | allow syslogd_t self:fifo_file rw_fifo_file_perms; |
51 | allow syslogd_t self:udp_socket create_socket_perms; | 52 | allow syslogd_t self:udp_socket create_socket_perms; |
52 | allow syslogd_t self:tcp_socket create_stream_socket_perms; | 53 | allow syslogd_t self:tcp_socket create_stream_socket_perms; |
53 | 54 | ||
54 | allow syslogd_t syslog_conf_t:file read_file_perms; | 55 | allow syslogd_t syslog_conf_t:file read_file_perms; |
55 | +allow syslogd_t syslog_conf_t:lnk_file read_file_perms; | 56 | +allow syslogd_t syslog_conf_t:lnk_file read_file_perms; |
57 | +allow syslogd_t syslog_conf_t:dir list_dir_perms; | ||
56 | 58 | ||
57 | # Create and bind to /dev/log or /var/run/log. | 59 | # Create and bind to /dev/log or /var/run/log. |
58 | allow syslogd_t devlog_t:sock_file manage_sock_file_perms; | 60 | allow syslogd_t devlog_t:sock_file manage_sock_file_perms; |
59 | files_pid_filetrans(syslogd_t, devlog_t, sock_file) | 61 | files_pid_filetrans(syslogd_t, devlog_t, sock_file) |
60 | 62 | init_pid_filetrans(syslogd_t, devlog_t, sock_file, "dev-log") | |
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch index 8d22c21..fb912b5 100644 --- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch +++ b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch | |||
@@ -17,11 +17,11 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> | |||
17 | 17 | ||
18 | --- a/policy/modules/contrib/apache.te | 18 | --- a/policy/modules/contrib/apache.te |
19 | +++ b/policy/modules/contrib/apache.te | 19 | +++ b/policy/modules/contrib/apache.te |
20 | @@ -409,10 +409,11 @@ allow httpd_t httpd_log_t:dir setattr_di | 20 | @@ -407,10 +407,11 @@ allow httpd_t httpd_lock_t:file manage_f |
21 | create_dirs_pattern(httpd_t, httpd_log_t, httpd_log_t) | 21 | files_lock_filetrans(httpd_t, httpd_lock_t, { file dir }) |
22 | create_files_pattern(httpd_t, httpd_log_t, httpd_log_t) | 22 | |
23 | append_files_pattern(httpd_t, httpd_log_t, httpd_log_t) | 23 | manage_dirs_pattern(httpd_t, httpd_log_t, httpd_log_t) |
24 | read_files_pattern(httpd_t, httpd_log_t, httpd_log_t) | 24 | manage_files_pattern(httpd_t, httpd_log_t, httpd_log_t) |
25 | read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t) | 25 | read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t) |
26 | +read_lnk_files_pattern(httpd_t, var_log_t, var_log_t) | 26 | +read_lnk_files_pattern(httpd_t, var_log_t, var_log_t) |
27 | logging_log_filetrans(httpd_t, httpd_log_t, file) | 27 | logging_log_filetrans(httpd_t, httpd_log_t, file) |
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch index 5bd5b2e..8d22c21 100644 --- a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch +++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch | |||
@@ -1,12 +1,31 @@ | |||
1 | diff --git a/policy/modules/contrib/apache.te b/policy/modules/contrib/apache.te | 1 | From ed2b0a00e2fb78056041b03c7e198e8f5adaf939 Mon Sep 17 00:00:00 2001 |
2 | index fcf795f..529057c 100644 | 2 | From: Xin Ouyang <Xin.Ouyang@windriver.com> |
3 | Date: Thu, 22 Aug 2013 19:36:44 +0800 | ||
4 | Subject: [PATCH 3/6] add rules for the symlink of /var/log - apache2 | ||
5 | |||
6 | We have added rules for the symlink of /var/log in logging.if, | ||
7 | while apache.te uses /var/log but does not use the interfaces in | ||
8 | logging.if. So still need add a individual rule for apache.te. | ||
9 | |||
10 | Upstream-Status: Inappropriate [only for Poky] | ||
11 | |||
12 | Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> | ||
13 | Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> | ||
14 | --- | ||
15 | policy/modules/contrib/apache.te | 1 + | ||
16 | 1 file changed, 1 insertion(+) | ||
17 | |||
3 | --- a/policy/modules/contrib/apache.te | 18 | --- a/policy/modules/contrib/apache.te |
4 | +++ b/policy/modules/contrib/apache.te | 19 | +++ b/policy/modules/contrib/apache.te |
5 | @@ -412,6 +412,7 @@ create_files_pattern(httpd_t, httpd_log_t, httpd_log_t) | 20 | @@ -409,10 +409,11 @@ allow httpd_t httpd_log_t:dir setattr_di |
21 | create_dirs_pattern(httpd_t, httpd_log_t, httpd_log_t) | ||
22 | create_files_pattern(httpd_t, httpd_log_t, httpd_log_t) | ||
23 | append_files_pattern(httpd_t, httpd_log_t, httpd_log_t) | ||
6 | read_files_pattern(httpd_t, httpd_log_t, httpd_log_t) | 24 | read_files_pattern(httpd_t, httpd_log_t, httpd_log_t) |
7 | setattr_files_pattern(httpd_t, httpd_log_t, httpd_log_t) | ||
8 | read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t) | 25 | read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t) |
9 | +read_lnk_files_pattern(httpd_t, var_log_t, var_log_t) | 26 | +read_lnk_files_pattern(httpd_t, var_log_t, var_log_t) |
10 | logging_log_filetrans(httpd_t, httpd_log_t, file) | 27 | logging_log_filetrans(httpd_t, httpd_log_t, file) |
11 | 28 | ||
12 | allow httpd_t httpd_modules_t:dir list_dir_perms; | 29 | allow httpd_t httpd_modules_t:dir list_dir_perms; |
30 | mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) | ||
31 | read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) | ||
diff --git a/recipes-security/refpolicy/refpolicy_git.inc b/recipes-security/refpolicy/refpolicy_git.inc index 6c318ab..b2fd638 100644 --- a/recipes-security/refpolicy/refpolicy_git.inc +++ b/recipes-security/refpolicy/refpolicy_git.inc | |||
@@ -12,7 +12,6 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/refpolicy-git:" | |||
12 | # Fix file contexts for Poky | 12 | # Fix file contexts for Poky |
13 | SRC_URI += "file://poky-fc-subs_dist.patch \ | 13 | SRC_URI += "file://poky-fc-subs_dist.patch \ |
14 | file://poky-fc-update-alternatives_sysvinit.patch \ | 14 | file://poky-fc-update-alternatives_sysvinit.patch \ |
15 | file://poky-fc-update-alternatives_sysklogd.patch \ | ||
16 | file://poky-fc-update-alternatives_hostname.patch \ | 15 | file://poky-fc-update-alternatives_hostname.patch \ |
17 | file://poky-fc-update-alternatives_bash.patch \ | 16 | file://poky-fc-update-alternatives_bash.patch \ |
18 | file://poky-fc-fix-real-path_resolv.conf.patch \ | 17 | file://poky-fc-fix-real-path_resolv.conf.patch \ |
@@ -35,7 +34,6 @@ SRC_URI += "file://poky-fc-subs_dist.patch \ | |||
35 | # Specific policy for Poky | 34 | # Specific policy for Poky |
36 | SRC_URI += "file://poky-policy-add-syslogd_t-to-trusted-object.patch \ | 35 | SRC_URI += "file://poky-policy-add-syslogd_t-to-trusted-object.patch \ |
37 | file://poky-policy-add-rules-for-var-log-symlink.patch \ | 36 | file://poky-policy-add-rules-for-var-log-symlink.patch \ |
38 | file://poky-policy-add-rules-for-var-log-symlink-apache.patch \ | ||
39 | file://poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch \ | 37 | file://poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch \ |
40 | file://poky-policy-add-rules-for-syslogd_t-symlink.patch \ | 38 | file://poky-policy-add-rules-for-syslogd_t-symlink.patch \ |
41 | file://poky-policy-add-rules-for-var-cache-symlink.patch \ | 39 | file://poky-policy-add-rules-for-var-cache-symlink.patch \ |