summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorYi Zhao <yi.zhao@windriver.com>2022-05-24 23:52:53 +0800
committerJoe MacDonald <joe@deserted.net>2022-07-06 14:00:49 -0400
commita74e89404f961aeb90f854344280406cade79352 (patch)
tree21430a7961863bfc130465e741b2a2dcaa4337e9
parent26655dfdf6a607811cc61612e91bd9f7beb55b8a (diff)
downloadmeta-selinux-a74e89404f961aeb90f854344280406cade79352.tar.gz
refpolicy: backport patches to fix policy issues for systemd 250
Backport the following patches to fix systemd-resolved and systemd-netowrkd policy issues: systemd-systemd-resolved-is-linked-to-libselinux.patch sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch term-init-allow-systemd-to-watch-and-watch-reads-on-.patch systemd-add-file-transition-for-systemd-networkd-run.patch systemd-add-missing-file-context-for-run-systemd-net.patch systemd-add-file-contexts-for-systemd-network-genera.patch systemd-udev-allow-udev-to-read-systemd-networkd-run.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
Diffstat
-rw-r--r--recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch33
-rw-r--r--recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch63
-rw-r--r--recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch94
-rw-r--r--recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch32
-rw-r--r--recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch29
-rw-r--r--recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch38
-rw-r--r--recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch34
-rw-r--r--recipes-security/refpolicy/refpolicy_common.inc7
8 files changed, 330 insertions, 0 deletions
diff --git a/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch b/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch
new file mode 100644
index 0000000..e0db7d3
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch
@@ -0,0 +1,33 @@
1From 52a4222397f5d3b28ca15a45bb2ace209a4afc3e Mon Sep 17 00:00:00 2001
2From: Kenton Groombridge <me@concord.sh>
3Date: Thu, 31 Mar 2022 13:09:10 -0400
4Subject: [PATCH] systemd: systemd-resolved is linked to libselinux
5
6systemd-resolved as of systemd 250 fails to start with this error:
7
8Failed to initialize SELinux labeling handle: No such file or directory
9
10Upstream-Status: Backport
11[https://github.com/SELinuxProject/refpolicy/commit/3a22db2410de479e5baa88f3f668a7a4ac198950]
12
13Signed-off-by: Kenton Groombridge <me@concord.sh>
14Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
15---
16 policy/modules/system/systemd.te | 1 +
17 1 file changed, 1 insertion(+)
18
19diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
20index 8cea6baa1..beb301cc6 100644
21--- a/policy/modules/system/systemd.te
22+++ b/policy/modules/system/systemd.te
23@@ -1261,6 +1261,7 @@ fs_getattr_cgroup(systemd_resolved_t)
24
25 init_dgram_send(systemd_resolved_t)
26
27+seutil_libselinux_linked(systemd_resolved_t)
28 seutil_read_file_contexts(systemd_resolved_t)
29
30 systemd_log_parse_environment(systemd_resolved_t)
31--
322.25.1
33
diff --git a/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch b/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch
new file mode 100644
index 0000000..63da7cd
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch
@@ -0,0 +1,63 @@
1From 1ba0911e157c64ea15636c5707f38f1bdc9a46c8 Mon Sep 17 00:00:00 2001
2From: Kenton Groombridge <me@concord.sh>
3Date: Wed, 27 Apr 2022 01:09:52 -0400
4Subject: [PATCH] sysnetwork, systemd: allow DNS resolution over
5 io.systemd.Resolve
6
7Upstream-Status: Backport
8[https://github.com/SELinuxProject/refpolicy/commit/1a0acc9c0d8c7c49ad4ca2cabd44bc66450f45e0]
9
10Signed-off-by: Kenton Groombridge <me@concord.sh>
11Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
12---
13 policy/modules/system/sysnetwork.if | 1 +
14 policy/modules/system/systemd.if | 21 +++++++++++++++++++++
15 2 files changed, 22 insertions(+)
16
17diff --git a/policy/modules/system/sysnetwork.if b/policy/modules/system/sysnetwork.if
18index 8664a67c8..140d48508 100644
19--- a/policy/modules/system/sysnetwork.if
20+++ b/policy/modules/system/sysnetwork.if
21@@ -844,6 +844,7 @@ interface(`sysnet_dns_name_resolve',`
22 ifdef(`init_systemd',`
23 optional_policy(`
24 systemd_dbus_chat_resolved($1)
25+ systemd_stream_connect_resolved($1)
26 ')
27 # This seems needed when the mymachines NSS module is used
28 optional_policy(`
29diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
30index 5f2038f22..9143fb4c0 100644
31--- a/policy/modules/system/systemd.if
32+++ b/policy/modules/system/systemd.if
33@@ -1835,6 +1835,27 @@ interface(`systemd_tmpfilesd_managed',`
34 ')
35 ')
36
37+#######################################
38+## <summary>
39+## Connect to systemd resolved over
40+## /run/systemd/resolve/io.systemd.Resolve .
41+## </summary>
42+## <param name="domain">
43+## <summary>
44+## Domain allowed access.
45+## </summary>
46+## </param>
47+#
48+interface(`systemd_stream_connect_resolved',`
49+ gen_require(`
50+ type systemd_resolved_t;
51+ type systemd_resolved_runtime_t;
52+ ')
53+
54+ files_search_runtime($1)
55+ stream_connect_pattern($1, systemd_resolved_runtime_t, systemd_resolved_runtime_t, systemd_resolved_t)
56+')
57+
58 ########################################
59 ## <summary>
60 ## Send and receive messages from
61--
622.25.1
63
diff --git a/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch b/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch
new file mode 100644
index 0000000..88f070d
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch
@@ -0,0 +1,94 @@
1From 50670946f04257cc2110facbc61884e2cf0d8327 Mon Sep 17 00:00:00 2001
2From: Kenton Groombridge <me@concord.sh>
3Date: Fri, 6 May 2022 21:16:29 -0400
4Subject: [PATCH] term, init: allow systemd to watch and watch reads on
5 unallocated ttys
6
7As of systemd 250, systemd needs to be able to add a watch on and watch
8reads on unallocated ttys in order to start getty.
9
10systemd[55548]: getty@tty1.service: Failed to set up standard input: Permission denied
11systemd[55548]: getty@tty1.service: Failed at step STDIN spawning /sbin/agetty: Permission denied
12
13time->Fri May 6 21:17:58 2022
14type=PROCTITLE msg=audit(1651886278.452:1770): proctitle="(agetty)"
15type=PATH msg=audit(1651886278.452:1770): item=0 name="/dev/tty1" inode=18 dev=00:05 mode=020620 ouid=0 ogid=5 rdev=04:01 obj=system_u:object_r:tty_device_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
16type=CWD msg=audit(1651886278.452:1770): cwd="/"
17type=SYSCALL msg=audit(1651886278.452:1770): arch=c000003e syscall=254 success=no exit=-13 a0=3 a1=60ba5c21e020 a2=18 a3=23 items=1 ppid=1 pid=55551 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="(agetty)" exe="/lib/systemd/systemd" subj=system_u:system_r:init_t:s0 key=(null)
18type=AVC msg=audit(1651886278.452:1770): avc: denied { watch watch_reads } for pid=55551 comm="(agetty)" path="/dev/tty1" dev="devtmpfs" ino=18 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:tty_device_t:s0 tclass=chr_file permissive=0
19
20Upstream-Status: Backport
21[https://github.com/SELinuxProject/refpolicy/commit/308ab9f69a4623f5dace8da151e70c6316f055a8]
22
23Signed-off-by: Kenton Groombridge <me@concord.sh>
24Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
25---
26 policy/modules/kernel/terminal.if | 38 +++++++++++++++++++++++++++++++
27 policy/modules/system/init.te | 2 ++
28 2 files changed, 40 insertions(+)
29
30diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
31index e8c0735eb..6e9f654ac 100644
32--- a/policy/modules/kernel/terminal.if
33+++ b/policy/modules/kernel/terminal.if
34@@ -1287,6 +1287,44 @@ interface(`term_dontaudit_use_unallocated_ttys',`
35 dontaudit $1 tty_device_t:chr_file rw_chr_file_perms;
36 ')
37
38+########################################
39+## <summary>
40+## Watch unallocated ttys.
41+## </summary>
42+## <param name="domain">
43+## <summary>
44+## Domain allowed access.
45+## </summary>
46+## </param>
47+#
48+interface(`term_watch_unallocated_ttys',`
49+ gen_require(`
50+ type tty_device_t;
51+ ')
52+
53+ dev_list_all_dev_nodes($1)
54+ allow $1 tty_device_t:chr_file watch;
55+')
56+
57+########################################
58+## <summary>
59+## Watch reads on unallocated ttys.
60+## </summary>
61+## <param name="domain">
62+## <summary>
63+## Domain allowed access.
64+## </summary>
65+## </param>
66+#
67+interface(`term_watch_reads_unallocated_ttys',`
68+ gen_require(`
69+ type tty_device_t;
70+ ')
71+
72+ dev_list_all_dev_nodes($1)
73+ allow $1 tty_device_t:chr_file watch_reads;
74+')
75+
76 ########################################
77 ## <summary>
78 ## Get the attributes of all tty device nodes.
79diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
80index 5a19f0e43..24cef0924 100644
81--- a/policy/modules/system/init.te
82+++ b/policy/modules/system/init.te
83@@ -518,6 +518,8 @@ ifdef(`init_systemd',`
84 term_create_devpts_dirs(init_t)
85 term_create_ptmx(init_t)
86 term_create_controlling_term(init_t)
87+ term_watch_unallocated_ttys(init_t)
88+ term_watch_reads_unallocated_ttys(init_t)
89
90 # udevd is a "systemd kobject uevent socket activated daemon"
91 udev_create_kobject_uevent_sockets(init_t)
92--
932.25.1
94
diff --git a/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch b/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch
new file mode 100644
index 0000000..1029490
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch
@@ -0,0 +1,32 @@
1From 6f8a8ecd8bafd6e8a3515b53db2a2982a02ff254 Mon Sep 17 00:00:00 2001
2From: Kenton Groombridge <me@concord.sh>
3Date: Thu, 31 Mar 2022 13:22:37 -0400
4Subject: [PATCH] systemd: add file transition for systemd-networkd runtime
5
6systemd-networkd creates the /run/systemd/network directory which should
7be labeled appropriately.
8
9Upstream-Status: Backport
10[https://github.com/SELinuxProject/refpolicy/commit/663b62f27cb12c22f056eba9326cf3f7f78d8a9e]
11
12Signed-off-by: Kenton Groombridge <me@concord.sh>
13Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
14---
15 policy/modules/system/systemd.te | 1 +
16 1 file changed, 1 insertion(+)
17
18diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
19index beb301cc6..654c6a42a 100644
20--- a/policy/modules/system/systemd.te
21+++ b/policy/modules/system/systemd.te
22@@ -917,6 +917,7 @@ auth_use_nsswitch(systemd_networkd_t)
23
24 init_dgram_send(systemd_networkd_t)
25 init_read_state(systemd_networkd_t)
26+init_runtime_filetrans(systemd_networkd_t, systemd_networkd_runtime_t, dir)
27
28 logging_send_syslog_msg(systemd_networkd_t)
29
30--
312.25.1
32
diff --git a/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch b/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch
new file mode 100644
index 0000000..f84eb4a
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch
@@ -0,0 +1,29 @@
1From 2e3f371b59bee343c42e4c69495df0f3719b6e24 Mon Sep 17 00:00:00 2001
2From: Kenton Groombridge <me@concord.sh>
3Date: Sat, 2 Apr 2022 15:44:01 -0400
4Subject: [PATCH] systemd: add missing file context for /run/systemd/network
5
6Upstream-Status: Backport
7[https://github.com/SELinuxProject/refpolicy/commit/f2fe1ae15485da7b6269b7d0d7dbed9a834f1876]
8
9Signed-off-by: Kenton Groombridge <me@concord.sh>
10Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
11---
12 policy/modules/system/systemd.fc | 1 +
13 1 file changed, 1 insertion(+)
14
15diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
16index 34db8c034..d21914227 100644
17--- a/policy/modules/system/systemd.fc
18+++ b/policy/modules/system/systemd.fc
19@@ -85,6 +85,7 @@ HOME_DIR/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_data
20
21 /run/systemd/ask-password(/.*)? gen_context(system_u:object_r:systemd_passwd_runtime_t,s0)
22 /run/systemd/ask-password-block(/.*)? gen_context(system_u:object_r:systemd_passwd_runtime_t,s0)
23+/run/systemd/network(/.*)? gen_context(system_u:object_r:systemd_networkd_runtime_t,s0)
24 /run/systemd/resolve(/.*)? gen_context(system_u:object_r:systemd_resolved_runtime_t,s0)
25 /run/systemd/seats(/.*)? gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
26 /run/systemd/sessions(/.*)? gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
27--
282.25.1
29
diff --git a/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch b/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch
new file mode 100644
index 0000000..0aaf096
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch
@@ -0,0 +1,38 @@
1From 143d339b2e6611c56cd0210279757ebee9632731 Mon Sep 17 00:00:00 2001
2From: Kenton Groombridge <me@concord.sh>
3Date: Thu, 19 May 2022 11:42:51 -0400
4Subject: [PATCH] systemd: add file contexts for systemd-network-generator
5
6Upstream-Status: Backport
7[https://github.com/SELinuxProject/refpolicy/commit/73adba0a39b7409bc4bbfa0e962108c2b1e5f2a5]
8
9Thanks-To: Zhao Yi
10Signed-off-by: Kenton Groombridge <me@concord.sh>
11Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
12---
13 policy/modules/system/systemd.fc | 2 ++
14 1 file changed, 2 insertions(+)
15
16diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
17index d21914227..1a35bd65c 100644
18--- a/policy/modules/system/systemd.fc
19+++ b/policy/modules/system/systemd.fc
20@@ -35,6 +35,7 @@
21 /usr/lib/systemd/systemd-machined -- gen_context(system_u:object_r:systemd_machined_exec_t,s0)
22 /usr/lib/systemd/systemd-modules-load -- gen_context(system_u:object_r:systemd_modules_load_exec_t,s0)
23 /usr/lib/systemd/systemd-networkd -- gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
24+/usr/lib/systemd/systemd-network-generator -- gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
25 /usr/lib/systemd/systemd-pstore -- gen_context(system_u:object_r:systemd_pstore_exec_t,s0)
26 /usr/lib/systemd/systemd-resolved -- gen_context(system_u:object_r:systemd_resolved_exec_t,s0)
27 /usr/lib/systemd/systemd-rfkill -- gen_context(system_u:object_r:systemd_rfkill_exec_t,s0)
28@@ -60,6 +61,7 @@ HOME_DIR/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_data
29 /usr/lib/systemd/system/systemd-backlight.* -- gen_context(system_u:object_r:systemd_backlight_unit_t,s0)
30 /usr/lib/systemd/system/systemd-binfmt.* -- gen_context(system_u:object_r:systemd_binfmt_unit_t,s0)
31 /usr/lib/systemd/system/systemd-networkd.* gen_context(system_u:object_r:systemd_networkd_unit_t,s0)
32+/usr/lib/systemd/system/systemd-network-generator.* gen_context(system_u:object_r:systemd_networkd_unit_t,s0)
33 /usr/lib/systemd/system/systemd-rfkill.* -- gen_context(system_u:object_r:systemd_rfkill_unit_t,s0)
34 /usr/lib/systemd/system/systemd-socket-proxyd\.service -- gen_context(system_u:object_r:systemd_socket_proxyd_unit_file_t,s0)
35
36--
372.25.1
38
diff --git a/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch b/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch
new file mode 100644
index 0000000..259863c
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch
@@ -0,0 +1,34 @@
1From 6508bc8a3440525384fcfcd8ad55a4cd5c79b912 Mon Sep 17 00:00:00 2001
2From: Kenton Groombridge <me@concord.sh>
3Date: Thu, 19 May 2022 11:43:44 -0400
4Subject: [PATCH] systemd, udev: allow udev to read systemd-networkd runtime
5
6udev searches for .link files and applies custom udev rules to devices
7as they come up.
8
9Upstream-Status: Backport
10[https://github.com/SELinuxProject/refpolicy/commit/998ef975f38c70d57e7220b88ae5e62c88ebb770]
11
12Thanks-To: Zhao Yi
13Signed-off-by: Kenton Groombridge <me@concord.sh>
14Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
15---
16 policy/modules/system/udev.te | 2 ++
17 1 file changed, 2 insertions(+)
18
19diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
20index 4c5a690fb..8e243c0f2 100644
21--- a/policy/modules/system/udev.te
22+++ b/policy/modules/system/udev.te
23@@ -270,6 +270,8 @@ ifdef(`init_systemd',`
24 systemd_read_hwdb(udev_t)
25 systemd_read_logind_sessions_files(udev_t)
26 systemd_read_logind_runtime_files(udev_t)
27+ # udev searches for .link files and applies custom udev rules
28+ systemd_read_networkd_runtime(udev_t)
29
30 optional_policy(`
31 init_dbus_chat(udev_t)
32--
332.25.1
34
diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index 96d0da1..1d5a5c0 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -77,6 +77,13 @@ SRC_URI += " \
77 file://0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \ 77 file://0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \
78 file://0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \ 78 file://0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \
79 file://0061-policy-modules-system-logging-make-syslogd_runtime_t.patch \ 79 file://0061-policy-modules-system-logging-make-syslogd_runtime_t.patch \
80 file://0062-systemd-systemd-resolved-is-linked-to-libselinux.patch \
81 file://0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch \
82 file://0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch \
83 file://0065-systemd-add-file-transition-for-systemd-networkd-run.patch \
84 file://0066-systemd-add-missing-file-context-for-run-systemd-net.patch \
85 file://0067-systemd-add-file-contexts-for-systemd-network-genera.patch \
86 file://0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch \
80 " 87 "
81 88
82S = "${WORKDIR}/refpolicy" 89S = "${WORKDIR}/refpolicy"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-09 05:35:08 +0000