summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJoe MacDonald <joe_macdonald@mentor.com>2017-01-06 15:07:23 -0500
committerJoe MacDonald <joe_macdonald@mentor.com>2017-01-06 15:07:23 -0500
commitd85c6734eebbc84e55af467b59bf79afbe8cec31 (patch)
treea77d8d2397f9b941d7fce5f483080a1ac12f0c26
parent68fc3af746701ea10cf8f081dc96a0ee61f1025e (diff)
downloadmeta-selinux-d85c6734eebbc84e55af467b59bf79afbe8cec31.tar.gz
refpolicy-git: Update patches
A number of upstream changes caused patch conflicts or duplication in the final policy. Update the list of git patches appropriately. Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Diffstat
-rw-r--r--recipes-security/refpolicy/refpolicy-git/ftp-add-ftpd_t-to-mlsfilewrite.patch11
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-clock.patch11
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-corecommands.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-dmesg.patch11
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-bind.patch9
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_login.patch20
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_resolv.conf.patch13
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_shadow.patch11
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_su.patch9
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch33
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-ftpwho-dir.patch13
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-iptables.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-mta.patch11
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-netutils.patch13
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-nscd.patch9
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-rpm.patch9
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-screen.patch12
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-ssh.patch15
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-su.patch23
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-subs_dist.patch15
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch23
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-udevd.patch21
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_hostname.patch9
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysklogd.patch20
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysvinit.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-bsdpty_device_t.patch53
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-syslogd_t-symlink.patch13
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-tmp-symlink.patch63
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-cache-symlink.patch11
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch11
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch13
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch81
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-add-syslogd_t-to-trusted-object.patch11
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-allow-nfsd-to-exec-shell-commands.patch21
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch11
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-allow-sysadm-to-run-rpcinfo.patch11
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-don-t-audit-tty_device_t.patch11
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-dmesg-to-use-dev-kmsg.patch17
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-new-SELINUXMNT-in-sys.patch124
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch26
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch11
-rw-r--r--recipes-security/refpolicy/refpolicy-git/poky-policy-fix-seutils-manage-config-files.patch19
-rw-r--r--recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch9
-rw-r--r--recipes-security/refpolicy/refpolicy_common.inc4
-rw-r--r--recipes-security/refpolicy/refpolicy_git.inc3
45 files changed, 501 insertions, 418 deletions
diff --git a/recipes-security/refpolicy/refpolicy-git/ftp-add-ftpd_t-to-mlsfilewrite.patch b/recipes-security/refpolicy/refpolicy-git/ftp-add-ftpd_t-to-mlsfilewrite.patch
index 49da4b6..4830566 100644
--- a/recipes-security/refpolicy/refpolicy-git/ftp-add-ftpd_t-to-mlsfilewrite.patch
+++ b/recipes-security/refpolicy/refpolicy-git/ftp-add-ftpd_t-to-mlsfilewrite.patch
@@ -21,11 +21,11 @@ Signed-off-by: Roy Li <rongqing.li@windriver.com>
21 policy/modules/contrib/ftp.te | 2 ++ 21 policy/modules/contrib/ftp.te | 2 ++
22 1 file changed, 2 insertions(+) 22 1 file changed, 2 insertions(+)
23 23
24diff --git a/policy/modules/contrib/ftp.te b/policy/modules/contrib/ftp.te
25index 544c512..12a31dd 100644
26--- a/policy/modules/contrib/ftp.te 24--- a/policy/modules/contrib/ftp.te
27+++ b/policy/modules/contrib/ftp.te 25+++ b/policy/modules/contrib/ftp.te
28@@ -144,6 +144,8 @@ role ftpdctl_roles types ftpdctl_t; 26@@ -148,10 +148,12 @@ init_system_domain(ftpdctl_t, ftpdctl_ex
27 role ftpdctl_roles types ftpdctl_t;
28
29 type ftpdctl_tmp_t; 29 type ftpdctl_tmp_t;
30 files_tmp_file(ftpdctl_tmp_t) 30 files_tmp_file(ftpdctl_tmp_t)
31 31
@@ -34,6 +34,5 @@ index 544c512..12a31dd 100644
34 type sftpd_t; 34 type sftpd_t;
35 domain_type(sftpd_t) 35 domain_type(sftpd_t)
36 role system_r types sftpd_t; 36 role system_r types sftpd_t;
37-- 37
381.7.10.4 38 type xferlog_t;
39
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-clock.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-clock.patch
index 3ff8f55..b36c209 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-clock.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-clock.patch
@@ -4,19 +4,16 @@ Upstream-Status: Inappropriate [configuration]
4 4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> 5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6--- 6---
7 policy/modules/system/clock.fc | 1 + 7 policy/modules/system/clock.fc | 1 +
8 1 file changed, 1 insertion(+) 8 1 file changed, 1 insertion(+)
9 9
10diff --git a/policy/modules/system/clock.fc b/policy/modules/system/clock.fc
11index c5e05ca..a74c40c 100644
12--- a/policy/modules/system/clock.fc 10--- a/policy/modules/system/clock.fc
13+++ b/policy/modules/system/clock.fc 11+++ b/policy/modules/system/clock.fc
14@@ -2,4 +2,5 @@ 12@@ -1,6 +1,7 @@
13
15 /etc/adjtime -- gen_context(system_u:object_r:adjtime_t,s0) 14 /etc/adjtime -- gen_context(system_u:object_r:adjtime_t,s0)
16 15
17 /sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0) 16 /sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)
18+/sbin/hwclock\.util-linux -- gen_context(system_u:object_r:hwclock_exec_t,s0) 17+/sbin/hwclock\.util-linux -- gen_context(system_u:object_r:hwclock_exec_t,s0)
19 18
20-- 19 /usr/sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)
211.7.11.7
22
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-corecommands.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-corecommands.patch
deleted file mode 100644
index 24b67c3..0000000
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-corecommands.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for corecommands
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/kernel/corecommands.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
11index f051c4a..ab624f3 100644
12--- a/policy/modules/kernel/corecommands.fc
13+++ b/policy/modules/kernel/corecommands.fc
14@@ -153,6 +153,7 @@ ifdef(`distro_gentoo',`
15 /sbin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0)
16 /sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0)
17 /sbin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
18+/usr/sbin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
19
20 #
21 # /opt
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-dmesg.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-dmesg.patch
index db4c4d4..6995bb5 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-dmesg.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-dmesg.patch
@@ -4,17 +4,14 @@ Upstream-Status: Inappropriate [configuration]
4 4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> 5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6--- 6---
7 policy/modules/admin/dmesg.fc | 1 + 7 policy/modules/admin/dmesg.fc | 1 +
8 1 file changed, 1 insertion(+) 8 1 file changed, 1 insertion(+)
9 9
10diff --git a/policy/modules/admin/dmesg.fc b/policy/modules/admin/dmesg.fc
11index d6cc2d9..7f3e5b0 100644
12--- a/policy/modules/admin/dmesg.fc 10--- a/policy/modules/admin/dmesg.fc
13+++ b/policy/modules/admin/dmesg.fc 11+++ b/policy/modules/admin/dmesg.fc
14@@ -1,2 +1,3 @@ 12@@ -1,4 +1,5 @@
15 13
16 /bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0) 14 /bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)
17+/bin/dmesg\.util-linux -- gen_context(system_u:object_r:dmesg_exec_t,s0) 15+/bin/dmesg\.util-linux -- gen_context(system_u:object_r:dmesg_exec_t,s0)
18-- 16
191.7.11.7 17 /usr/bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)
20
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-bind.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-bind.patch
index 59ba5bc..a96b4a7 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-bind.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-bind.patch
@@ -10,11 +10,9 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
10 policy/modules/contrib/bind.fc | 2 ++ 10 policy/modules/contrib/bind.fc | 2 ++
11 1 file changed, 2 insertions(+) 11 1 file changed, 2 insertions(+)
12 12
13diff --git a/policy/modules/contrib/bind.fc b/policy/modules/contrib/bind.fc
14index 2b9a3a1..fd45d53 100644
15--- a/policy/modules/contrib/bind.fc 13--- a/policy/modules/contrib/bind.fc
16+++ b/policy/modules/contrib/bind.fc 14+++ b/policy/modules/contrib/bind.fc
17@@ -1,8 +1,10 @@ 15@@ -1,10 +1,12 @@
18 /etc/rc\.d/init\.d/named -- gen_context(system_u:object_r:named_initrc_exec_t,s0) 16 /etc/rc\.d/init\.d/named -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
19+/etc/rc\.d/init\.d/bind -- gen_context(system_u:object_r:named_initrc_exec_t,s0) 17+/etc/rc\.d/init\.d/bind -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
20 /etc/rc\.d/init\.d/unbound -- gen_context(system_u:object_r:named_initrc_exec_t,s0) 18 /etc/rc\.d/init\.d/unbound -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
@@ -25,6 +23,5 @@ index 2b9a3a1..fd45d53 100644
25 /etc/bind/rndc\.key -- gen_context(system_u:object_r:dnssec_t,s0) 23 /etc/bind/rndc\.key -- gen_context(system_u:object_r:dnssec_t,s0)
26 /etc/dnssec-trigger/dnssec_trigger_server\.key -- gen_context(system_u:object_r:dnssec_t,s0) 24 /etc/dnssec-trigger/dnssec_trigger_server\.key -- gen_context(system_u:object_r:dnssec_t,s0)
27 /etc/named\.rfc1912\.zones -- gen_context(system_u:object_r:named_conf_t,s0) 25 /etc/named\.rfc1912\.zones -- gen_context(system_u:object_r:named_conf_t,s0)
28-- 26 /etc/named\.root\.hints -- gen_context(system_u:object_r:named_conf_t,s0)
291.7.9.5 27 /etc/named\.conf -- gen_context(system_u:object_r:named_conf_t,s0)
30
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_login.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_login.patch
index 427181e..d97d58e 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_login.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_login.patch
@@ -4,14 +4,12 @@ Upstream-Status: Inappropriate [only for Poky]
4 4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> 5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6--- 6---
7 policy/modules/system/authlogin.fc | 7 ++++--- 7 policy/modules/system/authlogin.fc | 5 ++---
8 1 files changed, 4 insertions(+), 3 deletions(-) 8 1 file changed, 2 insertions(+), 3 deletions(-)
9 9
10diff --git a/policy/modules/system/authlogin.fc b/policy/modules/system/authlogin.fc
11index 28ad538..c8dd17f 100644
12--- a/policy/modules/system/authlogin.fc 10--- a/policy/modules/system/authlogin.fc
13+++ b/policy/modules/system/authlogin.fc 11+++ b/policy/modules/system/authlogin.fc
14@@ -1,5 +1,7 @@ 12@@ -1,19 +1,18 @@
15 13
16 /bin/login -- gen_context(system_u:object_r:login_exec_t,s0) 14 /bin/login -- gen_context(system_u:object_r:login_exec_t,s0)
17+/bin/login\.shadow -- gen_context(system_u:object_r:login_exec_t,s0) 15+/bin/login\.shadow -- gen_context(system_u:object_r:login_exec_t,s0)
@@ -19,19 +17,17 @@ index 28ad538..c8dd17f 100644
19 17
20 /etc/\.pwd\.lock -- gen_context(system_u:object_r:shadow_t,s0) 18 /etc/\.pwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
21 /etc/group\.lock -- gen_context(system_u:object_r:shadow_t,s0) 19 /etc/group\.lock -- gen_context(system_u:object_r:shadow_t,s0)
22@@ -9,9 +11,9 @@ 20 /etc/gshadow.* -- gen_context(system_u:object_r:shadow_t,s0)
21 /etc/passwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
22 /etc/shadow.* -- gen_context(system_u:object_r:shadow_t,s0)
23 23
24 /sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0) 24 /sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0)
25 /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0) 25 /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
26-/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) 26-/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
27-/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0) 27-/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
28-/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0) 28-/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
29+/usr/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
30+/usr/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
31+/usr/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
32 ifdef(`distro_suse', ` 29 ifdef(`distro_suse', `
33 /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) 30 /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
34 ') 31 ')
35-- 32
361.7.5.4 33 /usr/bin/login -- gen_context(system_u:object_r:login_exec_t,s0)
37
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_resolv.conf.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_resolv.conf.patch
index 80cca67..c1cd74d 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_resolv.conf.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_resolv.conf.patch
@@ -5,13 +5,13 @@ Upstream-Status: Inappropriate [only for Poky]
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> 5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6--- 6---
7 policy/modules/system/sysnetwork.fc | 1 + 7 policy/modules/system/sysnetwork.fc | 1 +
8 1 files changed, 1 insertions(+), 0 deletions(-) 8 1 file changed, 1 insertion(+)
9 9
10diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
11index 346a7cc..dec8632 100644
12--- a/policy/modules/system/sysnetwork.fc 10--- a/policy/modules/system/sysnetwork.fc
13+++ b/policy/modules/system/sysnetwork.fc 11+++ b/policy/modules/system/sysnetwork.fc
14@@ -24,6 +24,7 @@ ifdef(`distro_debian',` 12@@ -23,10 +23,11 @@ ifdef(`distro_debian',`
13 /etc/ethers -- gen_context(system_u:object_r:net_conf_t,s0)
14 /etc/hosts -- gen_context(system_u:object_r:net_conf_t,s0)
15 /etc/hosts\.deny.* -- gen_context(system_u:object_r:net_conf_t,s0) 15 /etc/hosts\.deny.* -- gen_context(system_u:object_r:net_conf_t,s0)
16 /etc/denyhosts.* -- gen_context(system_u:object_r:net_conf_t,s0) 16 /etc/denyhosts.* -- gen_context(system_u:object_r:net_conf_t,s0)
17 /etc/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0) 17 /etc/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
@@ -19,6 +19,5 @@ index 346a7cc..dec8632 100644
19 /etc/yp\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0) 19 /etc/yp\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
20 20
21 /etc/dhcp3(/.*)? gen_context(system_u:object_r:dhcp_etc_t,s0) 21 /etc/dhcp3(/.*)? gen_context(system_u:object_r:dhcp_etc_t,s0)
22-- 22 /etc/dhcp3?/dhclient.* gen_context(system_u:object_r:dhcp_etc_t,s0)
231.7.5.4 23
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_shadow.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_shadow.patch
index 29ac2c3..d74f524 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_shadow.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_shadow.patch
@@ -7,11 +7,11 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
7 policy/modules/admin/usermanage.fc | 6 ++++++ 7 policy/modules/admin/usermanage.fc | 6 ++++++
8 1 file changed, 6 insertions(+) 8 1 file changed, 6 insertions(+)
9 9
10diff --git a/policy/modules/admin/usermanage.fc b/policy/modules/admin/usermanage.fc
11index f82f0ce..841ba9b 100644
12--- a/policy/modules/admin/usermanage.fc 10--- a/policy/modules/admin/usermanage.fc
13+++ b/policy/modules/admin/usermanage.fc 11+++ b/policy/modules/admin/usermanage.fc
14@@ -4,11 +4,17 @@ ifdef(`distro_gentoo',` 12@@ -6,15 +6,21 @@ ifdef(`distro_debian',`
13 /etc/cron\.daily/cracklib-runtime -- gen_context(system_u:object_r:crack_exec_t,s0)
14 ')
15 15
16 /usr/bin/chage -- gen_context(system_u:object_r:passwd_exec_t,s0) 16 /usr/bin/chage -- gen_context(system_u:object_r:passwd_exec_t,s0)
17 /usr/bin/chfn -- gen_context(system_u:object_r:chfn_exec_t,s0) 17 /usr/bin/chfn -- gen_context(system_u:object_r:chfn_exec_t,s0)
@@ -29,6 +29,5 @@ index f82f0ce..841ba9b 100644
29 29
30 /usr/lib/cracklib_dict.* -- gen_context(system_u:object_r:crack_db_t,s0) 30 /usr/lib/cracklib_dict.* -- gen_context(system_u:object_r:crack_db_t,s0)
31 31
32-- 32 /usr/sbin/crack_[a-z]* -- gen_context(system_u:object_r:crack_exec_t,s0)
331.7.9.5 33 /usr/sbin/cracklib-[a-z]* -- gen_context(system_u:object_r:crack_exec_t,s0)
34
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_su.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_su.patch
index b0392ce..23484de 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_su.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fix-real-path_su.patch
@@ -10,16 +10,13 @@ Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
10 policy/modules/admin/su.fc | 2 ++ 10 policy/modules/admin/su.fc | 2 ++
11 1 file changed, 2 insertions(+) 11 1 file changed, 2 insertions(+)
12 12
13diff --git a/policy/modules/admin/su.fc b/policy/modules/admin/su.fc
14index a563687..0f43827 100644
15--- a/policy/modules/admin/su.fc 13--- a/policy/modules/admin/su.fc
16+++ b/policy/modules/admin/su.fc 14+++ b/policy/modules/admin/su.fc
17@@ -4,3 +4,5 @@ 15@@ -3,5 +3,7 @@
16 /usr/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
18 17
19 /usr/(local/)?bin/ksu -- gen_context(system_u:object_r:su_exec_t,s0) 18 /usr/(local/)?bin/ksu -- gen_context(system_u:object_r:su_exec_t,s0)
20 /usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0) 19 /usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0)
20 /usr/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
21+ 21+
22+/bin/su.shadow -- gen_context(system_u:object_r:su_exec_t,s0) 22+/bin/su.shadow -- gen_context(system_u:object_r:su_exec_t,s0)
23--
241.7.9.5
25
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch
index 9c45694..5d3aa76 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch
@@ -9,14 +9,12 @@ Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> 9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com> 10Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
11--- 11---
12 policy/modules/system/fstools.fc | 9 +++++++++ 12 policy/modules/system/fstools.fc | 7 +++++++
13 1 file changed, 9 insertions(+) 13 1 file changed, 7 insertions(+)
14 14
15diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
16index d10368d..f22761a 100644
17--- a/policy/modules/system/fstools.fc 15--- a/policy/modules/system/fstools.fc
18+++ b/policy/modules/system/fstools.fc 16+++ b/policy/modules/system/fstools.fc
19@@ -1,6 +1,8 @@ 17@@ -1,19 +1,23 @@
20 /sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0) 18 /sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
21 /sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0) 19 /sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
22+/sbin/blkid/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0) 20+/sbin/blkid/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -25,20 +23,24 @@ index d10368d..f22761a 100644
25 /sbin/cfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0) 23 /sbin/cfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
26 /sbin/dosfsck -- gen_context(system_u:object_r:fsadm_exec_t,s0) 24 /sbin/dosfsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
27 /sbin/dump -- gen_context(system_u:object_r:fsadm_exec_t,s0) 25 /sbin/dump -- gen_context(system_u:object_r:fsadm_exec_t,s0)
28@@ -9,9 +11,12 @@ 26 /sbin/dumpe2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
27 /sbin/e2fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
29 /sbin/e4fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0) 28 /sbin/e4fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
30 /sbin/e2label -- gen_context(system_u:object_r:fsadm_exec_t,s0) 29 /sbin/e2label -- gen_context(system_u:object_r:fsadm_exec_t,s0)
31 /sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0) 30 /sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
32+/sbin/fdisk/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0) 31+/sbin/fdisk/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
33 /sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0) 32 /sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
34+/usr/sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
35 /sbin/fsck.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) 33 /sbin/fsck.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
36 /sbin/hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0) 34 /sbin/hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
37+/sbin/hdparm/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0) 35+/sbin/hdparm/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
38 /sbin/install-mbr -- gen_context(system_u:object_r:fsadm_exec_t,s0) 36 /sbin/install-mbr -- gen_context(system_u:object_r:fsadm_exec_t,s0)
39 /sbin/jfs_.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) 37 /sbin/jfs_.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
40 /sbin/losetup.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) 38 /sbin/losetup.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
41@@ -24,6 +29,7 @@ 39 /sbin/lsraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
40 /sbin/make_reiser4 -- gen_context(system_u:object_r:fsadm_exec_t,s0)
41@@ -22,20 +26,22 @@
42 /sbin/mke4fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
43 /sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
42 /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0) 44 /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
43 /sbin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0) 45 /sbin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
44 /sbin/mkswap -- gen_context(system_u:object_r:fsadm_exec_t,s0) 46 /sbin/mkswap -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -46,18 +48,22 @@ index d10368d..f22761a 100644
46 /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0) 48 /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
47 /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0) 49 /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
48 /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) 50 /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
49@@ -32,8 +38,10 @@ 51 /sbin/raidautorun -- gen_context(system_u:object_r:fsadm_exec_t,s0)
52 /sbin/raidstart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
50 /sbin/reiserfs(ck|tune) -- gen_context(system_u:object_r:fsadm_exec_t,s0) 53 /sbin/reiserfs(ck|tune) -- gen_context(system_u:object_r:fsadm_exec_t,s0)
51 /sbin/resize.*fs -- gen_context(system_u:object_r:fsadm_exec_t,s0) 54 /sbin/resize.*fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
52 /sbin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0) 55 /sbin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0)
53+/usr/sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
54 /sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0) 56 /sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
55 /sbin/swapoff -- gen_context(system_u:object_r:fsadm_exec_t,s0) 57 /sbin/swapoff -- gen_context(system_u:object_r:fsadm_exec_t,s0)
56+/sbin/swapoff/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0) 58+/sbin/swapoff/.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
57 /sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) 59 /sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
58 /sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0) 60 /sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
59 /sbin/zdb -- gen_context(system_u:object_r:fsadm_exec_t,s0) 61 /sbin/zdb -- gen_context(system_u:object_r:fsadm_exec_t,s0)
60@@ -45,6 +53,7 @@ 62 /sbin/zhack -- gen_context(system_u:object_r:fsadm_exec_t,s0)
63 /sbin/zinject -- gen_context(system_u:object_r:fsadm_exec_t,s0)
64@@ -43,10 +49,11 @@
65 /sbin/zstreamdump -- gen_context(system_u:object_r:fsadm_exec_t,s0)
66 /sbin/ztest -- gen_context(system_u:object_r:fsadm_exec_t,s0)
61 67
62 /usr/bin/partition_uuid -- gen_context(system_u:object_r:fsadm_exec_t,s0) 68 /usr/bin/partition_uuid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
63 /usr/bin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0) 69 /usr/bin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -65,6 +71,5 @@ index d10368d..f22761a 100644
65 /usr/bin/scsi_unique_id -- gen_context(system_u:object_r:fsadm_exec_t,s0) 71 /usr/bin/scsi_unique_id -- gen_context(system_u:object_r:fsadm_exec_t,s0)
66 /usr/bin/syslinux -- gen_context(system_u:object_r:fsadm_exec_t,s0) 72 /usr/bin/syslinux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
67 73
68-- 74 /usr/sbin/addpart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
691.7.9.5 75 /usr/sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
70
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-ftpwho-dir.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-ftpwho-dir.patch
index a7d434f..b4ba2e2 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-ftpwho-dir.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-ftpwho-dir.patch
@@ -9,19 +9,18 @@ Signed-off-by: Roy Li <rongqing.li@windriver.com>
9 policy/modules/contrib/ftp.fc | 2 +- 9 policy/modules/contrib/ftp.fc | 2 +-
10 1 file changed, 1 insertion(+), 1 deletion(-) 10 1 file changed, 1 insertion(+), 1 deletion(-)
11 11
12diff --git a/policy/modules/contrib/ftp.fc b/policy/modules/contrib/ftp.fc
13index ddb75c1..26fec47 100644
14--- a/policy/modules/contrib/ftp.fc 12--- a/policy/modules/contrib/ftp.fc
15+++ b/policy/modules/contrib/ftp.fc 13+++ b/policy/modules/contrib/ftp.fc
16@@ -9,7 +9,7 @@ 14@@ -10,11 +10,11 @@
17
18 /usr/kerberos/sbin/ftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0) 15 /usr/kerberos/sbin/ftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
19 16
17 /usr/lib/systemd/system/proftpd.*\.service -- gen_context(system_u:object_r:ftpd_unit_t,s0)
18 /usr/lib/systemd/system/vsftpd.*\.service -- gen_context(system_u:object_r:ftpd_unit_t,s0)
19
20-/usr/sbin/ftpwho -- gen_context(system_u:object_r:ftpd_exec_t,s0) 20-/usr/sbin/ftpwho -- gen_context(system_u:object_r:ftpd_exec_t,s0)
21+/usr/bin/ftpwho -- gen_context(system_u:object_r:ftpd_exec_t,s0) 21+/usr/bin/ftpwho -- gen_context(system_u:object_r:ftpd_exec_t,s0)
22 /usr/sbin/in\.ftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0) 22 /usr/sbin/in\.ftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
23 /usr/sbin/muddleftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0) 23 /usr/sbin/muddleftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
24 /usr/sbin/proftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0) 24 /usr/sbin/proftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
25-- 25 /usr/sbin/vsftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
261.7.10.4 26
27
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-iptables.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-iptables.patch
deleted file mode 100644
index 89b1547..0000000
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-iptables.patch
+++ /dev/null
@@ -1,24 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for iptables
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/iptables.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
11index 14cffd2..84ac92b 100644
12--- a/policy/modules/system/iptables.fc
13+++ b/policy/modules/system/iptables.fc
14@@ -13,6 +13,7 @@
15 /sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
16 /sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
17 /sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
18+/usr/sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
19
20 /usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
21 /usr/sbin/iptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-mta.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-mta.patch
index bbd83ec..1a8fbe3 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-mta.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-mta.patch
@@ -10,11 +10,11 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
10 policy/modules/contrib/mta.fc | 1 + 10 policy/modules/contrib/mta.fc | 1 +
11 1 file changed, 1 insertion(+) 11 1 file changed, 1 insertion(+)
12 12
13diff --git a/policy/modules/contrib/mta.fc b/policy/modules/contrib/mta.fc
14index f42896c..0d4bcef 100644
15--- a/policy/modules/contrib/mta.fc 13--- a/policy/modules/contrib/mta.fc
16+++ b/policy/modules/contrib/mta.fc 14+++ b/policy/modules/contrib/mta.fc
17@@ -22,6 +22,7 @@ HOME_DIR/\.maildir(/.*)? gen_context(system_u:object_r:mail_home_rw_t,s0) 15@@ -20,10 +20,11 @@ HOME_DIR/\.maildir(/.*)? gen_context(sys
16 /usr/lib/courier/bin/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
17
18 /usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) 18 /usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
19 /usr/sbin/sendmail\.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0) 19 /usr/sbin/sendmail\.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0)
20 /usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0) 20 /usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0)
@@ -22,6 +22,5 @@ index f42896c..0d4bcef 100644
22 /usr/sbin/ssmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0) 22 /usr/sbin/ssmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
23 23
24 /var/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) 24 /var/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0)
25-- 25
261.7.9.5 26 /var/qmail/bin/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
27
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-netutils.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-netutils.patch
index b45d03e..fea90ad 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-netutils.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-netutils.patch
@@ -4,21 +4,20 @@ Upstream-Status: Inappropriate [configuration]
4 4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> 5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6--- 6---
7 policy/modules/admin/netutils.fc | 1 + 7 policy/modules/admin/netutils.fc | 1 +
8 1 file changed, 1 insertion(+) 8 1 file changed, 1 insertion(+)
9 9
10diff --git a/policy/modules/admin/netutils.fc b/policy/modules/admin/netutils.fc
11index 407078f..f2ed3dc 100644
12--- a/policy/modules/admin/netutils.fc 10--- a/policy/modules/admin/netutils.fc
13+++ b/policy/modules/admin/netutils.fc 11+++ b/policy/modules/admin/netutils.fc
14@@ -3,6 +3,7 @@ 12@@ -1,10 +1,11 @@
13 /bin/ping.* -- gen_context(system_u:object_r:ping_exec_t,s0)
14 /bin/tracepath.* -- gen_context(system_u:object_r:traceroute_exec_t,s0)
15 /bin/traceroute.* -- gen_context(system_u:object_r:traceroute_exec_t,s0) 15 /bin/traceroute.* -- gen_context(system_u:object_r:traceroute_exec_t,s0)
16 16
17 /sbin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0) 17 /sbin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
18+/bin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0) 18+/bin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
19 19
20 /usr/bin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
20 /usr/bin/lft -- gen_context(system_u:object_r:traceroute_exec_t,s0) 21 /usr/bin/lft -- gen_context(system_u:object_r:traceroute_exec_t,s0)
21 /usr/bin/nmap -- gen_context(system_u:object_r:traceroute_exec_t,s0) 22 /usr/bin/nmap -- gen_context(system_u:object_r:traceroute_exec_t,s0)
22-- 23 /usr/bin/ping.* -- gen_context(system_u:object_r:ping_exec_t,s0)
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-nscd.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-nscd.patch
index 1db328c..5fe5062 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-nscd.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-nscd.patch
@@ -10,11 +10,9 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
10 policy/modules/contrib/nscd.fc | 1 + 10 policy/modules/contrib/nscd.fc | 1 +
11 1 file changed, 1 insertion(+) 11 1 file changed, 1 insertion(+)
12 12
13diff --git a/policy/modules/contrib/nscd.fc b/policy/modules/contrib/nscd.fc
14index ba64485..61a6f24 100644
15--- a/policy/modules/contrib/nscd.fc 13--- a/policy/modules/contrib/nscd.fc
16+++ b/policy/modules/contrib/nscd.fc 14+++ b/policy/modules/contrib/nscd.fc
17@@ -1,6 +1,7 @@ 15@@ -1,8 +1,9 @@
18 /etc/rc\.d/init\.d/nscd -- gen_context(system_u:object_r:nscd_initrc_exec_t,s0) 16 /etc/rc\.d/init\.d/nscd -- gen_context(system_u:object_r:nscd_initrc_exec_t,s0)
19 17
20 /usr/sbin/nscd -- gen_context(system_u:object_r:nscd_exec_t,s0) 18 /usr/sbin/nscd -- gen_context(system_u:object_r:nscd_exec_t,s0)
@@ -22,6 +20,5 @@ index ba64485..61a6f24 100644
22 20
23 /var/cache/nscd(/.*)? gen_context(system_u:object_r:nscd_var_run_t,s0) 21 /var/cache/nscd(/.*)? gen_context(system_u:object_r:nscd_var_run_t,s0)
24 22
25-- 23 /var/db/nscd(/.*)? gen_context(system_u:object_r:nscd_var_run_t,s0)
261.7.9.5 24
27
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-rpm.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-rpm.patch
index 7ba3380..8680f19 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-rpm.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-rpm.patch
@@ -10,16 +10,13 @@ Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
10 policy/modules/contrib/rpm.fc | 1 + 10 policy/modules/contrib/rpm.fc | 1 +
11 1 file changed, 1 insertion(+) 11 1 file changed, 1 insertion(+)
12 12
13diff --git a/policy/modules/contrib/rpm.fc b/policy/modules/contrib/rpm.fc
14index ebe91fc..539063c 100644
15--- a/policy/modules/contrib/rpm.fc 13--- a/policy/modules/contrib/rpm.fc
16+++ b/policy/modules/contrib/rpm.fc 14+++ b/policy/modules/contrib/rpm.fc
17@@ -58,4 +58,5 @@ ifdef(`distro_redhat',` 15@@ -61,6 +61,7 @@ ifdef(`distro_redhat',`
16 /run/yum.* -- gen_context(system_u:object_r:rpm_var_run_t,s0)
17 /run/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_run_t,s0)
18 18
19 ifdef(`enable_mls',` 19 ifdef(`enable_mls',`
20 /usr/sbin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0) 20 /usr/sbin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
21+/bin/cpio.cpio -- gen_context(system_u:object_r:rpm_exec_t,s0) 21+/bin/cpio.cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
22 ') 22 ')
23--
241.7.9.5
25
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-screen.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-screen.patch
index 3218194..a7301e9 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-screen.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-screen.patch
@@ -10,18 +10,16 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
10 policy/modules/contrib/screen.fc | 1 + 10 policy/modules/contrib/screen.fc | 1 +
11 1 file changed, 1 insertion(+) 11 1 file changed, 1 insertion(+)
12 12
13diff --git a/policy/modules/contrib/screen.fc b/policy/modules/contrib/screen.fc
14index e7c2cf7..49ddca2 100644
15--- a/policy/modules/contrib/screen.fc 13--- a/policy/modules/contrib/screen.fc
16+++ b/policy/modules/contrib/screen.fc 14+++ b/policy/modules/contrib/screen.fc
17@@ -3,6 +3,7 @@ HOME_DIR/\.screenrc -- gen_context(system_u:object_r:screen_home_t,s0) 15@@ -1,9 +1,10 @@
16 HOME_DIR/\.screen(/.*)? gen_context(system_u:object_r:screen_home_t,s0)
17 HOME_DIR/\.screenrc -- gen_context(system_u:object_r:screen_home_t,s0)
18 HOME_DIR/\.tmux\.conf -- gen_context(system_u:object_r:screen_home_t,s0) 18 HOME_DIR/\.tmux\.conf -- gen_context(system_u:object_r:screen_home_t,s0)
19 19
20 /usr/bin/screen -- gen_context(system_u:object_r:screen_exec_t,s0) 20 /usr/bin/screen -- gen_context(system_u:object_r:screen_exec_t,s0)
21+/usr/bin/screen-.* -- gen_context(system_u:object_r:screen_exec_t,s0) 21+/usr/bin/screen-.* -- gen_context(system_u:object_r:screen_exec_t,s0)
22 /usr/bin/tmux -- gen_context(system_u:object_r:screen_exec_t,s0) 22 /usr/bin/tmux -- gen_context(system_u:object_r:screen_exec_t,s0)
23 23
24 /var/run/screen(/.*)? gen_context(system_u:object_r:screen_var_run_t,s0) 24 /run/screen(/.*)? gen_context(system_u:object_r:screen_var_run_t,s0)
25-- 25 /run/tmux(/.*)? gen_context(system_u:object_r:screen_var_run_t,s0)
261.7.9.5
27
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-ssh.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-ssh.patch
index 9aeb3a2..35bbc9e 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-ssh.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-ssh.patch
@@ -4,21 +4,20 @@ Upstream-Status: Inappropriate [configuration]
4 4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> 5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6--- 6---
7 policy/modules/services/ssh.fc | 1 + 7 policy/modules/services/ssh.fc | 1 +
8 1 file changed, 1 insertion(+) 8 1 file changed, 1 insertion(+)
9 9
10diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
11index 078bcd7..9717428 100644
12--- a/policy/modules/services/ssh.fc 10--- a/policy/modules/services/ssh.fc
13+++ b/policy/modules/services/ssh.fc 11+++ b/policy/modules/services/ssh.fc
14@@ -6,6 +6,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0) 12@@ -2,10 +2,11 @@ HOME_DIR/\.ssh(/.*)? gen_context(syste
15 /etc/ssh/ssh_host_rsa_key -- gen_context(system_u:object_r:sshd_key_t,s0) 13
14 /etc/ssh/primes -- gen_context(system_u:object_r:sshd_key_t,s0)
15 /etc/ssh/ssh_host.*_key -- gen_context(system_u:object_r:sshd_key_t,s0)
16 16
17 /usr/bin/ssh -- gen_context(system_u:object_r:ssh_exec_t,s0) 17 /usr/bin/ssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
18+/usr/bin/ssh\.openssh -- gen_context(system_u:object_r:ssh_exec_t,s0) 18+/usr/bin/ssh\.openssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
19 /usr/bin/ssh-agent -- gen_context(system_u:object_r:ssh_agent_exec_t,s0) 19 /usr/bin/ssh-agent -- gen_context(system_u:object_r:ssh_agent_exec_t,s0)
20 /usr/bin/ssh-keygen -- gen_context(system_u:object_r:ssh_keygen_exec_t,s0) 20 /usr/bin/ssh-keygen -- gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
21 21
22-- 22 /usr/lib/openssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
231.7.11.7 23 /usr/lib/ssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
24
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-su.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-su.patch
deleted file mode 100644
index 358e4ef..0000000
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-su.patch
+++ /dev/null
@@ -1,23 +0,0 @@
1Subject: [PATCH] refpolicy: fix real path for su
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/su.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/admin/su.fc b/policy/modules/admin/su.fc
11index 688abc2..a563687 100644
12--- a/policy/modules/admin/su.fc
13+++ b/policy/modules/admin/su.fc
14@@ -1,5 +1,6 @@
15
16 /bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
17+/usr/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
18
19 /usr/(local/)?bin/ksu -- gen_context(system_u:object_r:su_exec_t,s0)
20 /usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0)
21--
221.7.11.7
23
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-subs_dist.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-subs_dist.patch
index cfec7d9..f82f359 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-subs_dist.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-subs_dist.patch
@@ -8,15 +8,18 @@ Upstream-Status: Inappropriate [only for Poky]
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> 8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> 9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10--- 10---
11 config/file_contexts.subs_dist | 10 ++++++++++ 11 config/file_contexts.subs_dist | 11 +++++++++++
12 1 file changed, 10 insertions(+) 12 1 file changed, 11 insertions(+)
13 13
14--- a/config/file_contexts.subs_dist 14--- a/config/file_contexts.subs_dist
15+++ b/config/file_contexts.subs_dist 15+++ b/config/file_contexts.subs_dist
16@@ -19,3 +19,13 @@ 16@@ -21,5 +21,16 @@
17 /usr/local/lib64 /usr/lib 17
18 /usr/local/lib /usr/lib 18 # backward compatibility
19 /var/run/lock /var/lock 19 # not for refpolicy intern, but for /var/run using applications,
20 # like systemd tmpfiles or systemd socket configurations
21 /var/run /run
22+
20+/var/volatile/log /var/log 23+/var/volatile/log /var/log
21+/var/volatile/run /var/run 24+/var/volatile/run /var/run
22+/var/volatile/cache /var/cache 25+/var/volatile/cache /var/cache
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch
index 64f497d..7f8f368 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch
@@ -8,14 +8,14 @@ Upstream-Status: Inappropriate [configuration]
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> 8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com> 9Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
10--- 10---
11 policy/modules/system/sysnetwork.fc | 4 ++++ 11 policy/modules/system/sysnetwork.fc | 3 +++
12 1 file changed, 4 insertions(+) 12 1 file changed, 3 insertions(+)
13 13
14diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
15index fbb935c..a194622 100644
16--- a/policy/modules/system/sysnetwork.fc 14--- a/policy/modules/system/sysnetwork.fc
17+++ b/policy/modules/system/sysnetwork.fc 15+++ b/policy/modules/system/sysnetwork.fc
18@@ -4,6 +4,7 @@ 16@@ -2,10 +2,11 @@
17 #
18 # /bin
19 # 19 #
20 /bin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0) 20 /bin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
21 /bin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0) 21 /bin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
@@ -23,17 +23,19 @@ index fbb935c..a194622 100644
23 23
24 # 24 #
25 # /dev 25 # /dev
26@@ -43,7 +44,9 @@ ifdef(`distro_redhat',` 26 #
27 ifdef(`distro_debian',`
28@@ -43,17 +44,19 @@ ifdef(`distro_redhat',`
29 /sbin/dhclient.* -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
27 /sbin/dhcdbd -- gen_context(system_u:object_r:dhcpc_exec_t,s0) 30 /sbin/dhcdbd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
28 /sbin/dhcpcd -- gen_context(system_u:object_r:dhcpc_exec_t,s0) 31 /sbin/dhcpcd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
29 /sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0) 32 /sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
30+/usr/sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
31 /sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0) 33 /sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
32+/sbin/ifconfig\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0) 34+/sbin/ifconfig\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
33 /sbin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0) 35 /sbin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
34 /sbin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0) 36 /sbin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
35 /sbin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0) 37 /sbin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
36@@ -51,6 +54,7 @@ ifdef(`distro_redhat',` 38 /sbin/ipx_internal_net -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
37 /sbin/iw -- gen_context(system_u:object_r:ifconfig_exec_t,s0) 39 /sbin/iw -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
38 /sbin/iwconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0) 40 /sbin/iwconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
39 /sbin/mii-tool -- gen_context(system_u:object_r:ifconfig_exec_t,s0) 41 /sbin/mii-tool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
@@ -41,6 +43,5 @@ index fbb935c..a194622 100644
41 /sbin/pump -- gen_context(system_u:object_r:dhcpc_exec_t,s0) 43 /sbin/pump -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
42 /sbin/tc -- gen_context(system_u:object_r:ifconfig_exec_t,s0) 44 /sbin/tc -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
43 45
44-- 46 #
451.7.9.5 47 # /usr
46
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-udevd.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-udevd.patch
index c6c19be..8e2cb1b 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-udevd.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-udevd.patch
@@ -10,26 +10,29 @@ Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
10 policy/modules/system/udev.fc | 2 ++ 10 policy/modules/system/udev.fc | 2 ++
11 1 file changed, 2 insertions(+) 11 1 file changed, 2 insertions(+)
12 12
13diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc
14index 40928d8..491bb23 100644
15--- a/policy/modules/system/udev.fc 13--- a/policy/modules/system/udev.fc
16+++ b/policy/modules/system/udev.fc 14+++ b/policy/modules/system/udev.fc
17@@ -10,6 +10,7 @@ 15@@ -8,10 +8,11 @@
16
17 /etc/udev/rules.d(/.*)? gen_context(system_u:object_r:udev_rules_t,s0)
18 /etc/udev/scripts/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0) 18 /etc/udev/scripts/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
19 19
20 /lib/udev/udev-acl -- gen_context(system_u:object_r:udev_exec_t,s0) 20 /lib/udev/udev-acl -- gen_context(system_u:object_r:udev_exec_t,s0)
21+/lib/udev/udevd -- gen_context(system_u:object_r:udev_exec_t,s0) 21+/lib/udev/udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
22 22
23 ifdef(`distro_debian',` 23 ifdef(`distro_debian',`
24 /bin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
24 /lib/udev/create_static_nodes -- gen_context(system_u:object_r:udev_exec_t,s0) 25 /lib/udev/create_static_nodes -- gen_context(system_u:object_r:udev_exec_t,s0)
25@@ -27,6 +28,7 @@ ifdef(`distro_redhat',` 26 ')
27@@ -26,10 +27,11 @@ ifdef(`distro_debian',`
28 ifdef(`distro_redhat',`
29 /sbin/start_udev -- gen_context(system_u:object_r:udev_exec_t,s0)
26 ') 30 ')
27 31
28 /usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0) 32 /usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0)
29+/usr/bin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0) 33+/usr/bin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
30 34
31 /usr/lib/systemd/systemd-udevd -- gen_context(system_u:object_r:udev_exec_t,s0) 35 /usr/sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
32 36 /usr/sbin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
33-- 37 /usr/sbin/udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
341.7.9.5 38 /usr/sbin/udevsend -- gen_context(system_u:object_r:udev_exec_t,s0)
35
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_hostname.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_hostname.patch
index cedb5b5..80c40d0 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_hostname.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_hostname.patch
@@ -10,14 +10,11 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
10 policy/modules/system/hostname.fc | 1 + 10 policy/modules/system/hostname.fc | 1 +
11 1 file changed, 1 insertion(+) 11 1 file changed, 1 insertion(+)
12 12
13diff --git a/policy/modules/system/hostname.fc b/policy/modules/system/hostname.fc
14index 9dfecf7..4003b6d 100644
15--- a/policy/modules/system/hostname.fc 13--- a/policy/modules/system/hostname.fc
16+++ b/policy/modules/system/hostname.fc 14+++ b/policy/modules/system/hostname.fc
17@@ -1,2 +1,3 @@ 15@@ -1,4 +1,5 @@
18 16
19 /bin/hostname -- gen_context(system_u:object_r:hostname_exec_t,s0) 17 /bin/hostname -- gen_context(system_u:object_r:hostname_exec_t,s0)
20+/bin/hostname\.net-tools -- gen_context(system_u:object_r:hostname_exec_t,s0) 18+/bin/hostname\.net-tools -- gen_context(system_u:object_r:hostname_exec_t,s0)
21-- 19
221.7.9.5 20 /usr/bin/hostname -- gen_context(system_u:object_r:hostname_exec_t,s0)
23
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysklogd.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysklogd.patch
index 868ee6b..03284cd 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysklogd.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysklogd.patch
@@ -14,11 +14,10 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
14 policy/modules/system/logging.te | 1 + 14 policy/modules/system/logging.te | 1 +
15 2 files changed, 5 insertions(+) 15 2 files changed, 5 insertions(+)
16 16
17diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
18index b50c5fe..c005f33 100644
19--- a/policy/modules/system/logging.fc 17--- a/policy/modules/system/logging.fc
20+++ b/policy/modules/system/logging.fc 18+++ b/policy/modules/system/logging.fc
21@@ -2,19 +2,23 @@ 19@@ -1,22 +1,26 @@
20 /dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
22 21
23 /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) 22 /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
24 /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) 23 /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
@@ -41,12 +40,14 @@ index b50c5fe..c005f33 100644
41+/sbin/syslogd\.sysklogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) 40+/sbin/syslogd\.sysklogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
42 /sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0) 41 /sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
43 42
44 /usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0) 43 /usr/lib/systemd/system/auditd.* -- gen_context(system_u:object_r:auditd_unit_t,s0)
45diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te 44 /usr/lib/systemd/system/[^/]*systemd-journal.* -- gen_context(system_u:object_r:syslogd_unit_t,s0)
46index 87e3db2..2914b0b 100644 45 /usr/lib/systemd/systemd-journald -- gen_context(system_u:object_r:syslogd_exec_t,s0)
47--- a/policy/modules/system/logging.te 46--- a/policy/modules/system/logging.te
48+++ b/policy/modules/system/logging.te 47+++ b/policy/modules/system/logging.te
49@@ -371,6 +371,7 @@ allow syslogd_t self:udp_socket create_socket_perms; 48@@ -386,10 +386,11 @@ allow syslogd_t self:unix_dgram_socket s
49 allow syslogd_t self:fifo_file rw_fifo_file_perms;
50 allow syslogd_t self:udp_socket create_socket_perms;
50 allow syslogd_t self:tcp_socket create_stream_socket_perms; 51 allow syslogd_t self:tcp_socket create_stream_socket_perms;
51 52
52 allow syslogd_t syslog_conf_t:file read_file_perms; 53 allow syslogd_t syslog_conf_t:file read_file_perms;
@@ -54,6 +55,5 @@ index 87e3db2..2914b0b 100644
54 55
55 # Create and bind to /dev/log or /var/run/log. 56 # Create and bind to /dev/log or /var/run/log.
56 allow syslogd_t devlog_t:sock_file manage_sock_file_perms; 57 allow syslogd_t devlog_t:sock_file manage_sock_file_perms;
57-- 58 files_pid_filetrans(syslogd_t, devlog_t, sock_file)
581.7.9.5 59
59
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysvinit.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysvinit.patch
index 3a617d8..0c09825 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysvinit.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-update-alternatives_sysvinit.patch
@@ -12,11 +12,11 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12 policy/modules/system/init.fc | 1 + 12 policy/modules/system/init.fc | 1 +
13 3 files changed, 3 insertions(+) 13 3 files changed, 3 insertions(+)
14 14
15diff --git a/policy/modules/contrib/shutdown.fc b/policy/modules/contrib/shutdown.fc
16index a91f33b..90e51e0 100644
17--- a/policy/modules/contrib/shutdown.fc 15--- a/policy/modules/contrib/shutdown.fc
18+++ b/policy/modules/contrib/shutdown.fc 16+++ b/policy/modules/contrib/shutdown.fc
19@@ -3,6 +3,7 @@ 17@@ -1,10 +1,11 @@
18 /etc/nologin -- gen_context(system_u:object_r:shutdown_etc_t,s0)
19
20 /lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0) 20 /lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
21 21
22 /sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0) 22 /sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
@@ -24,11 +24,13 @@ index a91f33b..90e51e0 100644
24 24
25 /usr/lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0) 25 /usr/lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
26 26
27diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc 27 /usr/sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
28index bcfdba7..87502a3 100644 28
29--- a/policy/modules/kernel/corecommands.fc 29--- a/policy/modules/kernel/corecommands.fc
30+++ b/policy/modules/kernel/corecommands.fc 30+++ b/policy/modules/kernel/corecommands.fc
31@@ -10,6 +10,7 @@ 31@@ -8,10 +8,11 @@
32 /bin/bash2 -- gen_context(system_u:object_r:shell_exec_t,s0)
33 /bin/fish -- gen_context(system_u:object_r:shell_exec_t,s0)
32 /bin/ksh.* -- gen_context(system_u:object_r:shell_exec_t,s0) 34 /bin/ksh.* -- gen_context(system_u:object_r:shell_exec_t,s0)
33 /bin/mksh -- gen_context(system_u:object_r:shell_exec_t,s0) 35 /bin/mksh -- gen_context(system_u:object_r:shell_exec_t,s0)
34 /bin/mountpoint -- gen_context(system_u:object_r:bin_t,s0) 36 /bin/mountpoint -- gen_context(system_u:object_r:bin_t,s0)
@@ -36,11 +38,13 @@ index bcfdba7..87502a3 100644
36 /bin/sash -- gen_context(system_u:object_r:shell_exec_t,s0) 38 /bin/sash -- gen_context(system_u:object_r:shell_exec_t,s0)
37 /bin/tcsh -- gen_context(system_u:object_r:shell_exec_t,s0) 39 /bin/tcsh -- gen_context(system_u:object_r:shell_exec_t,s0)
38 /bin/yash -- gen_context(system_u:object_r:shell_exec_t,s0) 40 /bin/yash -- gen_context(system_u:object_r:shell_exec_t,s0)
39diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc 41 /bin/zsh.* -- gen_context(system_u:object_r:shell_exec_t,s0)
40index bc0ffc8..020b9fe 100644 42
41--- a/policy/modules/system/init.fc 43--- a/policy/modules/system/init.fc
42+++ b/policy/modules/system/init.fc 44+++ b/policy/modules/system/init.fc
43@@ -30,6 +30,7 @@ ifdef(`distro_gentoo', ` 45@@ -30,10 +30,11 @@ ifdef(`distro_gentoo', `
46
47 #
44 # /sbin 48 # /sbin
45 # 49 #
46 /sbin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0) 50 /sbin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0)
@@ -48,6 +52,5 @@ index bc0ffc8..020b9fe 100644
48 # because nowadays, /sbin/init is often a symlink to /sbin/upstart 52 # because nowadays, /sbin/init is often a symlink to /sbin/upstart
49 /sbin/upstart -- gen_context(system_u:object_r:init_exec_t,s0) 53 /sbin/upstart -- gen_context(system_u:object_r:init_exec_t,s0)
50 54
51-- 55 ifdef(`distro_gentoo', `
521.7.9.5 56 /sbin/rc -- gen_context(system_u:object_r:rc_exec_t,s0)
53
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-bsdpty_device_t.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-bsdpty_device_t.patch
index 9a3322f..fee4068 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-bsdpty_device_t.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-bsdpty_device_t.patch
@@ -10,11 +10,11 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
10 policy/modules/kernel/terminal.if | 16 ++++++++++++++++ 10 policy/modules/kernel/terminal.if | 16 ++++++++++++++++
11 1 file changed, 16 insertions(+) 11 1 file changed, 16 insertions(+)
12 12
13diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
14index 771bce1..7519d0e 100644
15--- a/policy/modules/kernel/terminal.if 13--- a/policy/modules/kernel/terminal.if
16+++ b/policy/modules/kernel/terminal.if 14+++ b/policy/modules/kernel/terminal.if
17@@ -531,9 +531,11 @@ interface(`term_dontaudit_manage_pty_dirs',` 15@@ -585,13 +585,15 @@ interface(`term_getattr_generic_ptys',`
16 ## </param>
17 #
18 interface(`term_dontaudit_getattr_generic_ptys',` 18 interface(`term_dontaudit_getattr_generic_ptys',`
19 gen_require(` 19 gen_require(`
20 type devpts_t; 20 type devpts_t;
@@ -26,7 +26,11 @@ index 771bce1..7519d0e 100644
26 ') 26 ')
27 ######################################## 27 ########################################
28 ## <summary> 28 ## <summary>
29@@ -549,11 +551,13 @@ interface(`term_dontaudit_getattr_generic_ptys',` 29 ## ioctl of generic pty devices.
30 ## </summary>
31@@ -603,15 +605,17 @@ interface(`term_dontaudit_getattr_generi
32 #
33 # cjp: added for ppp
30 interface(`term_ioctl_generic_ptys',` 34 interface(`term_ioctl_generic_ptys',`
31 gen_require(` 35 gen_require(`
32 type devpts_t; 36 type devpts_t;
@@ -40,7 +44,11 @@ index 771bce1..7519d0e 100644
40 ') 44 ')
41 45
42 ######################################## 46 ########################################
43@@ -571,9 +575,11 @@ interface(`term_ioctl_generic_ptys',` 47 ## <summary>
48 ## Allow setting the attributes of
49@@ -625,13 +629,15 @@ interface(`term_ioctl_generic_ptys',`
50 #
51 # dwalsh: added for rhgb
44 interface(`term_setattr_generic_ptys',` 52 interface(`term_setattr_generic_ptys',`
45 gen_require(` 53 gen_require(`
46 type devpts_t; 54 type devpts_t;
@@ -52,7 +60,11 @@ index 771bce1..7519d0e 100644
52 ') 60 ')
53 61
54 ######################################## 62 ########################################
55@@ -591,9 +597,11 @@ interface(`term_setattr_generic_ptys',` 63 ## <summary>
64 ## Dontaudit setting the attributes of
65@@ -645,13 +651,15 @@ interface(`term_setattr_generic_ptys',`
66 #
67 # dwalsh: added for rhgb
56 interface(`term_dontaudit_setattr_generic_ptys',` 68 interface(`term_dontaudit_setattr_generic_ptys',`
57 gen_require(` 69 gen_require(`
58 type devpts_t; 70 type devpts_t;
@@ -64,7 +76,11 @@ index 771bce1..7519d0e 100644
64 ') 76 ')
65 77
66 ######################################## 78 ########################################
67@@ -611,11 +619,13 @@ interface(`term_dontaudit_setattr_generic_ptys',` 79 ## <summary>
80 ## Read and write the generic pty
81@@ -665,15 +673,17 @@ interface(`term_dontaudit_setattr_generi
82 ## </param>
83 #
68 interface(`term_use_generic_ptys',` 84 interface(`term_use_generic_ptys',`
69 gen_require(` 85 gen_require(`
70 type devpts_t; 86 type devpts_t;
@@ -78,7 +94,11 @@ index 771bce1..7519d0e 100644
78 ') 94 ')
79 95
80 ######################################## 96 ########################################
81@@ -633,9 +643,11 @@ interface(`term_use_generic_ptys',` 97 ## <summary>
98 ## Dot not audit attempts to read and
99@@ -687,13 +697,15 @@ interface(`term_use_generic_ptys',`
100 ## </param>
101 #
82 interface(`term_dontaudit_use_generic_ptys',` 102 interface(`term_dontaudit_use_generic_ptys',`
83 gen_require(` 103 gen_require(`
84 type devpts_t; 104 type devpts_t;
@@ -90,7 +110,11 @@ index 771bce1..7519d0e 100644
90 ') 110 ')
91 111
92 ####################################### 112 #######################################
93@@ -651,10 +663,12 @@ interface(`term_dontaudit_use_generic_ptys',` 113 ## <summary>
114 ## Set the attributes of the tty device
115@@ -705,14 +717,16 @@ interface(`term_dontaudit_use_generic_pt
116 ## </param>
117 #
94 interface(`term_setattr_controlling_term',` 118 interface(`term_setattr_controlling_term',`
95 gen_require(` 119 gen_require(`
96 type devtty_t; 120 type devtty_t;
@@ -103,7 +127,11 @@ index 771bce1..7519d0e 100644
103 ') 127 ')
104 128
105 ######################################## 129 ########################################
106@@ -671,10 +685,12 @@ interface(`term_setattr_controlling_term',` 130 ## <summary>
131 ## Read and write the controlling
132@@ -725,14 +739,16 @@ interface(`term_setattr_controlling_term
133 ## </param>
134 #
107 interface(`term_use_controlling_term',` 135 interface(`term_use_controlling_term',`
108 gen_require(` 136 gen_require(`
109 type devtty_t; 137 type devtty_t;
@@ -116,6 +144,5 @@ index 771bce1..7519d0e 100644
116 ') 144 ')
117 145
118 ####################################### 146 #######################################
119-- 147 ## <summary>
1201.7.9.5 148 ## Get the attributes of the pty multiplexor (/dev/ptmx).
121
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-syslogd_t-symlink.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-syslogd_t-symlink.patch
index aa9734a..d3aa705 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-syslogd_t-symlink.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-syslogd_t-symlink.patch
@@ -9,14 +9,14 @@ Upstream-Status: Inappropriate [only for Poky]
9 9
10Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> 10Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
11--- 11---
12 policy/modules/system/logging.te | 2 ++ 12 policy/modules/system/logging.te | 2 ++
13 1 file changed, 2 insertions(+) 13 1 file changed, 2 insertions(+)
14 14
15diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
16index 2ad9ea5..70427d8 100644
17--- a/policy/modules/system/logging.te 15--- a/policy/modules/system/logging.te
18+++ b/policy/modules/system/logging.te 16+++ b/policy/modules/system/logging.te
19@@ -384,6 +384,8 @@ rw_fifo_files_pattern(syslogd_t, var_log_t, var_log_t) 17@@ -402,10 +402,12 @@ rw_fifo_files_pattern(syslogd_t, var_log
18 files_search_spool(syslogd_t)
19
20 # Allow access for syslog-ng 20 # Allow access for syslog-ng
21 allow syslogd_t var_log_t:dir { create setattr }; 21 allow syslogd_t var_log_t:dir { create setattr };
22 22
@@ -25,6 +25,5 @@ index 2ad9ea5..70427d8 100644
25 # manage temporary files 25 # manage temporary files
26 manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t) 26 manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
27 manage_files_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t) 27 manage_files_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
28-- 28 files_tmp_filetrans(syslogd_t, syslogd_tmp_t, { dir file })
291.7.11.7 29
30
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-tmp-symlink.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-tmp-symlink.patch
index 210c297..7a30460 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-tmp-symlink.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-tmp-symlink.patch
@@ -12,13 +12,13 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12--- 12---
13 policy/modules/kernel/files.fc | 1 + 13 policy/modules/kernel/files.fc | 1 +
14 policy/modules/kernel/files.if | 8 ++++++++ 14 policy/modules/kernel/files.if | 8 ++++++++
15 2 files changed, 9 insertions(+), 0 deletions(-) 15 2 files changed, 9 insertions(+)
16 16
17diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
18index 8796ca3..a0db748 100644
19--- a/policy/modules/kernel/files.fc 17--- a/policy/modules/kernel/files.fc
20+++ b/policy/modules/kernel/files.fc 18+++ b/policy/modules/kernel/files.fc
21@@ -185,6 +185,7 @@ ifdef(`distro_debian',` 19@@ -191,10 +191,11 @@ ifdef(`distro_debian',`
20
21 #
22 # /tmp 22 # /tmp
23 # 23 #
24 /tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh) 24 /tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
@@ -26,11 +26,13 @@ index 8796ca3..a0db748 100644
26 /tmp/.* <<none>> 26 /tmp/.* <<none>>
27 /tmp/\.journal <<none>> 27 /tmp/\.journal <<none>>
28 28
29diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if 29 /tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
30index e1e814d..a7384b0 100644 30 /tmp/lost\+found/.* <<none>>
31--- a/policy/modules/kernel/files.if 31--- a/policy/modules/kernel/files.if
32+++ b/policy/modules/kernel/files.if 32+++ b/policy/modules/kernel/files.if
33@@ -4199,6 +4199,7 @@ interface(`files_search_tmp',` 33@@ -4471,10 +4471,11 @@ interface(`files_search_tmp',`
34 gen_require(`
35 type tmp_t;
34 ') 36 ')
35 37
36 allow $1 tmp_t:dir search_dir_perms; 38 allow $1 tmp_t:dir search_dir_perms;
@@ -38,7 +40,11 @@ index e1e814d..a7384b0 100644
38 ') 40 ')
39 41
40 ######################################## 42 ########################################
41@@ -4235,6 +4236,7 @@ interface(`files_list_tmp',` 43 ## <summary>
44 ## Do not audit attempts to search the tmp directory (/tmp).
45@@ -4507,10 +4508,11 @@ interface(`files_list_tmp',`
46 gen_require(`
47 type tmp_t;
42 ') 48 ')
43 49
44 allow $1 tmp_t:dir list_dir_perms; 50 allow $1 tmp_t:dir list_dir_perms;
@@ -46,7 +52,11 @@ index e1e814d..a7384b0 100644
46 ') 52 ')
47 53
48 ######################################## 54 ########################################
49@@ -4271,6 +4273,7 @@ interface(`files_delete_tmp_dir_entry',` 55 ## <summary>
56 ## Do not audit listing of the tmp directory (/tmp).
57@@ -4543,10 +4545,11 @@ interface(`files_delete_tmp_dir_entry',`
58 gen_require(`
59 type tmp_t;
50 ') 60 ')
51 61
52 allow $1 tmp_t:dir del_entry_dir_perms; 62 allow $1 tmp_t:dir del_entry_dir_perms;
@@ -54,7 +64,11 @@ index e1e814d..a7384b0 100644
54 ') 64 ')
55 65
56 ######################################## 66 ########################################
57@@ -4289,6 +4292,7 @@ interface(`files_read_generic_tmp_files',` 67 ## <summary>
68 ## Read files in the tmp directory (/tmp).
69@@ -4561,10 +4564,11 @@ interface(`files_read_generic_tmp_files'
70 gen_require(`
71 type tmp_t;
58 ') 72 ')
59 73
60 read_files_pattern($1, tmp_t, tmp_t) 74 read_files_pattern($1, tmp_t, tmp_t)
@@ -62,7 +76,11 @@ index e1e814d..a7384b0 100644
62 ') 76 ')
63 77
64 ######################################## 78 ########################################
65@@ -4307,6 +4311,7 @@ interface(`files_manage_generic_tmp_dirs',` 79 ## <summary>
80 ## Manage temporary directories in /tmp.
81@@ -4579,10 +4583,11 @@ interface(`files_manage_generic_tmp_dirs
82 gen_require(`
83 type tmp_t;
66 ') 84 ')
67 85
68 manage_dirs_pattern($1, tmp_t, tmp_t) 86 manage_dirs_pattern($1, tmp_t, tmp_t)
@@ -70,7 +88,11 @@ index e1e814d..a7384b0 100644
70 ') 88 ')
71 89
72 ######################################## 90 ########################################
73@@ -4325,6 +4330,7 @@ interface(`files_manage_generic_tmp_files',` 91 ## <summary>
92 ## Manage temporary files and directories in /tmp.
93@@ -4597,10 +4602,11 @@ interface(`files_manage_generic_tmp_file
94 gen_require(`
95 type tmp_t;
74 ') 96 ')
75 97
76 manage_files_pattern($1, tmp_t, tmp_t) 98 manage_files_pattern($1, tmp_t, tmp_t)
@@ -78,7 +100,11 @@ index e1e814d..a7384b0 100644
78 ') 100 ')
79 101
80 ######################################## 102 ########################################
81@@ -4361,6 +4367,7 @@ interface(`files_rw_generic_tmp_sockets',` 103 ## <summary>
104 ## Read symbolic links in the tmp directory (/tmp).
105@@ -4633,10 +4639,11 @@ interface(`files_rw_generic_tmp_sockets'
106 gen_require(`
107 type tmp_t;
82 ') 108 ')
83 109
84 rw_sock_files_pattern($1, tmp_t, tmp_t) 110 rw_sock_files_pattern($1, tmp_t, tmp_t)
@@ -86,7 +112,11 @@ index e1e814d..a7384b0 100644
86 ') 112 ')
87 113
88 ######################################## 114 ########################################
89@@ -4550,6 +4557,7 @@ interface(`files_tmp_filetrans',` 115 ## <summary>
116 ## Mount filesystems in the tmp directory (/tmp)
117@@ -4840,10 +4847,11 @@ interface(`files_tmp_filetrans',`
118 gen_require(`
119 type tmp_t;
90 ') 120 ')
91 121
92 filetrans_pattern($1, tmp_t, $2, $3, $4) 122 filetrans_pattern($1, tmp_t, $2, $3, $4)
@@ -94,6 +124,5 @@ index e1e814d..a7384b0 100644
94 ') 124 ')
95 125
96 ######################################## 126 ########################################
97-- 127 ## <summary>
981.7.5.4 128 ## Delete the contents of /tmp.
99
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-cache-symlink.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-cache-symlink.patch
index 18a92dd..fc6dea0 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-cache-symlink.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-cache-symlink.patch
@@ -15,11 +15,11 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
15 policy/modules/kernel/domain.te | 3 +++ 15 policy/modules/kernel/domain.te | 3 +++
16 1 file changed, 3 insertions(+) 16 1 file changed, 3 insertions(+)
17 17
18diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
19index cf04cb5..9ffe6b0 100644
20--- a/policy/modules/kernel/domain.te 18--- a/policy/modules/kernel/domain.te
21+++ b/policy/modules/kernel/domain.te 19+++ b/policy/modules/kernel/domain.te
22@@ -104,6 +104,9 @@ term_use_controlling_term(domain) 20@@ -108,10 +108,13 @@ dev_rw_zero(domain)
21 term_use_controlling_term(domain)
22
23 # list the root directory 23 # list the root directory
24 files_list_root(domain) 24 files_list_root(domain)
25 25
@@ -29,6 +29,5 @@ index cf04cb5..9ffe6b0 100644
29 ifdef(`hide_broken_symptoms',` 29 ifdef(`hide_broken_symptoms',`
30 # This check is in the general socket 30 # This check is in the general socket
31 # listen code, before protocol-specific 31 # listen code, before protocol-specific
32-- 32 # listen function is called, so bad calls
331.7.9.5 33 # to listen on UDP sockets should be silenced
34
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch
index 8bc40c4..d907095 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-apache.patch
@@ -14,11 +14,11 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
14 policy/modules/contrib/apache.te | 1 + 14 policy/modules/contrib/apache.te | 1 +
15 1 file changed, 1 insertion(+) 15 1 file changed, 1 insertion(+)
16 16
17diff --git a/policy/modules/contrib/apache.te b/policy/modules/contrib/apache.te
18index ec8bd13..06f2e95 100644
19--- a/policy/modules/contrib/apache.te 17--- a/policy/modules/contrib/apache.te
20+++ b/policy/modules/contrib/apache.te 18+++ b/policy/modules/contrib/apache.te
21@@ -400,6 +400,7 @@ create_files_pattern(httpd_t, httpd_log_t, httpd_log_t) 19@@ -409,10 +409,11 @@ allow httpd_t httpd_log_t:dir setattr_di
20 create_dirs_pattern(httpd_t, httpd_log_t, httpd_log_t)
21 create_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
22 append_files_pattern(httpd_t, httpd_log_t, httpd_log_t) 22 append_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
23 read_files_pattern(httpd_t, httpd_log_t, httpd_log_t) 23 read_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
24 read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t) 24 read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
@@ -26,6 +26,5 @@ index ec8bd13..06f2e95 100644
26 logging_log_filetrans(httpd_t, httpd_log_t, file) 26 logging_log_filetrans(httpd_t, httpd_log_t, file)
27 27
28 allow httpd_t httpd_modules_t:dir list_dir_perms; 28 allow httpd_t httpd_modules_t:dir list_dir_perms;
29-- 29 mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
301.7.9.5 30 read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
31
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch
index cbf0f7d..90c8f36 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink-audisp_remote_t.patch
@@ -9,14 +9,14 @@ Upstream-Status: Inappropriate [only for Poky]
9 9
10Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> 10Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
11--- 11---
12 policy/modules/system/logging.te | 1 + 12 policy/modules/system/logging.te | 1 +
13 1 file changed, 1 insertion(+) 13 1 file changed, 1 insertion(+)
14 14
15diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
16index 8426a49..2ad9ea5 100644
17--- a/policy/modules/system/logging.te 15--- a/policy/modules/system/logging.te
18+++ b/policy/modules/system/logging.te 16+++ b/policy/modules/system/logging.te
19@@ -262,6 +262,7 @@ allow audisp_remote_t self:capability { setuid setpcap }; 17@@ -276,10 +276,11 @@ optional_policy(`
18
19 allow audisp_remote_t self:capability { setuid setpcap };
20 allow audisp_remote_t self:process { getcap setcap }; 20 allow audisp_remote_t self:process { getcap setcap };
21 allow audisp_remote_t self:tcp_socket create_socket_perms; 21 allow audisp_remote_t self:tcp_socket create_socket_perms;
22 allow audisp_remote_t var_log_t:dir search_dir_perms; 22 allow audisp_remote_t var_log_t:dir search_dir_perms;
@@ -24,6 +24,5 @@ index 8426a49..2ad9ea5 100644
24 24
25 manage_dirs_pattern(audisp_remote_t, audit_spool_t, audit_spool_t) 25 manage_dirs_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
26 manage_files_pattern(audisp_remote_t, audit_spool_t, audit_spool_t) 26 manage_files_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
27-- 27 files_spool_filetrans(audisp_remote_t, audit_spool_t, { dir file })
281.7.11.7 28
29
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch
index b06f3ef..a9ae381 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch
@@ -15,11 +15,11 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
15 policy/modules/system/logging.te | 1 + 15 policy/modules/system/logging.te | 1 +
16 3 files changed, 15 insertions(+), 1 deletion(-) 16 3 files changed, 15 insertions(+), 1 deletion(-)
17 17
18diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
19index c005f33..9529e40 100644
20--- a/policy/modules/system/logging.fc 18--- a/policy/modules/system/logging.fc
21+++ b/policy/modules/system/logging.fc 19+++ b/policy/modules/system/logging.fc
22@@ -41,6 +41,7 @@ ifdef(`distro_suse', ` 20@@ -49,10 +49,11 @@ ifdef(`distro_suse', `
21
22 /var/axfrdns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
23 /var/dnscache/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) 23 /var/dnscache/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
24 24
25 /var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh) 25 /var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
@@ -27,11 +27,13 @@ index c005f33..9529e40 100644
27 /var/log/.* gen_context(system_u:object_r:var_log_t,s0) 27 /var/log/.* gen_context(system_u:object_r:var_log_t,s0)
28 /var/log/boot\.log -- gen_context(system_u:object_r:var_log_t,mls_systemhigh) 28 /var/log/boot\.log -- gen_context(system_u:object_r:var_log_t,mls_systemhigh)
29 /var/log/messages[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) 29 /var/log/messages[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
30diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if 30 /var/log/secure[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
31index 4e94884..9a6f599 100644 31 /var/log/maillog[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
32--- a/policy/modules/system/logging.if 32--- a/policy/modules/system/logging.if
33+++ b/policy/modules/system/logging.if 33+++ b/policy/modules/system/logging.if
34@@ -136,12 +136,13 @@ interface(`logging_set_audit_parameters',` 34@@ -134,16 +134,17 @@ interface(`logging_set_audit_parameters'
35 ## </param>
36 ## <rolecap/>
35 # 37 #
36 interface(`logging_read_audit_log',` 38 interface(`logging_read_audit_log',`
37 gen_require(` 39 gen_require(`
@@ -46,7 +48,11 @@ index 4e94884..9a6f599 100644
46 ') 48 ')
47 49
48 ######################################## 50 ########################################
49@@ -626,6 +627,7 @@ interface(`logging_search_logs',` 51 ## <summary>
52 ## Execute auditctl in the auditctl domain.
53@@ -665,10 +666,11 @@ interface(`logging_search_logs',`
54 type var_log_t;
55 ')
50 56
51 files_search_var($1) 57 files_search_var($1)
52 allow $1 var_log_t:dir search_dir_perms; 58 allow $1 var_log_t:dir search_dir_perms;
@@ -54,7 +60,11 @@ index 4e94884..9a6f599 100644
54 ') 60 ')
55 61
56 ####################################### 62 #######################################
57@@ -663,6 +665,7 @@ interface(`logging_list_logs',` 63 ## <summary>
64 ## Do not audit attempts to search the var log directory.
65@@ -702,10 +704,11 @@ interface(`logging_list_logs',`
66 type var_log_t;
67 ')
58 68
59 files_search_var($1) 69 files_search_var($1)
60 allow $1 var_log_t:dir list_dir_perms; 70 allow $1 var_log_t:dir list_dir_perms;
@@ -62,7 +72,11 @@ index 4e94884..9a6f599 100644
62 ') 72 ')
63 73
64 ####################################### 74 #######################################
65@@ -682,6 +685,7 @@ interface(`logging_rw_generic_log_dirs',` 75 ## <summary>
76 ## Read and write the generic log directory (/var/log).
77@@ -721,10 +724,11 @@ interface(`logging_rw_generic_log_dirs',
78 type var_log_t;
79 ')
66 80
67 files_search_var($1) 81 files_search_var($1)
68 allow $1 var_log_t:dir rw_dir_perms; 82 allow $1 var_log_t:dir rw_dir_perms;
@@ -70,7 +84,11 @@ index 4e94884..9a6f599 100644
70 ') 84 ')
71 85
72 ####################################### 86 #######################################
73@@ -793,10 +797,12 @@ interface(`logging_append_all_logs',` 87 ## <summary>
88 ## Search through all log dirs.
89@@ -832,14 +836,16 @@ interface(`logging_append_all_logs',`
90 ## <rolecap/>
91 #
74 interface(`logging_read_all_logs',` 92 interface(`logging_read_all_logs',`
75 gen_require(` 93 gen_require(`
76 attribute logfile; 94 attribute logfile;
@@ -83,7 +101,11 @@ index 4e94884..9a6f599 100644
83 read_files_pattern($1, logfile, logfile) 101 read_files_pattern($1, logfile, logfile)
84 ') 102 ')
85 103
86@@ -815,10 +821,12 @@ interface(`logging_read_all_logs',` 104 ########################################
105 ## <summary>
106@@ -854,14 +860,16 @@ interface(`logging_read_all_logs',`
107 # cjp: not sure why this is needed. This was added
108 # because of logrotate.
87 interface(`logging_exec_all_logs',` 109 interface(`logging_exec_all_logs',`
88 gen_require(` 110 gen_require(`
89 attribute logfile; 111 attribute logfile;
@@ -96,7 +118,11 @@ index 4e94884..9a6f599 100644
96 can_exec($1, logfile) 118 can_exec($1, logfile)
97 ') 119 ')
98 120
99@@ -880,6 +888,7 @@ interface(`logging_read_generic_logs',` 121 ########################################
122 ## <summary>
123@@ -919,10 +927,11 @@ interface(`logging_read_generic_logs',`
124 type var_log_t;
125 ')
100 126
101 files_search_var($1) 127 files_search_var($1)
102 allow $1 var_log_t:dir list_dir_perms; 128 allow $1 var_log_t:dir list_dir_perms;
@@ -104,7 +130,11 @@ index 4e94884..9a6f599 100644
104 read_files_pattern($1, var_log_t, var_log_t) 130 read_files_pattern($1, var_log_t, var_log_t)
105 ') 131 ')
106 132
107@@ -900,6 +909,7 @@ interface(`logging_write_generic_logs',` 133 ########################################
134 ## <summary>
135@@ -939,10 +948,11 @@ interface(`logging_write_generic_logs',`
136 type var_log_t;
137 ')
108 138
109 files_search_var($1) 139 files_search_var($1)
110 allow $1 var_log_t:dir list_dir_perms; 140 allow $1 var_log_t:dir list_dir_perms;
@@ -112,7 +142,11 @@ index 4e94884..9a6f599 100644
112 write_files_pattern($1, var_log_t, var_log_t) 142 write_files_pattern($1, var_log_t, var_log_t)
113 ') 143 ')
114 144
115@@ -938,6 +948,7 @@ interface(`logging_rw_generic_logs',` 145 ########################################
146 ## <summary>
147@@ -977,10 +987,11 @@ interface(`logging_rw_generic_logs',`
148 type var_log_t;
149 ')
116 150
117 files_search_var($1) 151 files_search_var($1)
118 allow $1 var_log_t:dir list_dir_perms; 152 allow $1 var_log_t:dir list_dir_perms;
@@ -120,7 +154,11 @@ index 4e94884..9a6f599 100644
120 rw_files_pattern($1, var_log_t, var_log_t) 154 rw_files_pattern($1, var_log_t, var_log_t)
121 ') 155 ')
122 156
123@@ -960,6 +971,7 @@ interface(`logging_manage_generic_logs',` 157 ########################################
158 ## <summary>
159@@ -999,10 +1010,11 @@ interface(`logging_manage_generic_logs',
160 type var_log_t;
161 ')
124 162
125 files_search_var($1) 163 files_search_var($1)
126 manage_files_pattern($1, var_log_t, var_log_t) 164 manage_files_pattern($1, var_log_t, var_log_t)
@@ -128,11 +166,13 @@ index 4e94884..9a6f599 100644
128 ') 166 ')
129 167
130 ######################################## 168 ########################################
131diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te 169 ## <summary>
132index 2ab0a49..2795d89 100644 170 ## All of the rules required to administrate
133--- a/policy/modules/system/logging.te 171--- a/policy/modules/system/logging.te
134+++ b/policy/modules/system/logging.te 172+++ b/policy/modules/system/logging.te
135@@ -139,6 +139,7 @@ allow auditd_t auditd_etc_t:file read_file_perms; 173@@ -149,10 +149,11 @@ allow auditd_t auditd_etc_t:dir list_dir
174 allow auditd_t auditd_etc_t:file read_file_perms;
175
136 manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t) 176 manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
137 manage_lnk_files_pattern(auditd_t, auditd_log_t, auditd_log_t) 177 manage_lnk_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
138 allow auditd_t var_log_t:dir search_dir_perms; 178 allow auditd_t var_log_t:dir search_dir_perms;
@@ -140,6 +180,5 @@ index 2ab0a49..2795d89 100644
140 180
141 manage_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t) 181 manage_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
142 manage_sock_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t) 182 manage_sock_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
143-- 183 files_pid_filetrans(auditd_t, auditd_var_run_t, { file sock_file })
1441.7.9.5 184
145
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-syslogd_t-to-trusted-object.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-syslogd_t-to-trusted-object.patch
index 92b1592..c2cba9a 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-syslogd_t-to-trusted-object.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-syslogd_t-to-trusted-object.patch
@@ -14,11 +14,11 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
14 policy/modules/system/logging.te | 1 + 14 policy/modules/system/logging.te | 1 +
15 1 file changed, 1 insertion(+) 15 1 file changed, 1 insertion(+)
16 16
17diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
18index 2914b0b..2ab0a49 100644
19--- a/policy/modules/system/logging.te 17--- a/policy/modules/system/logging.te
20+++ b/policy/modules/system/logging.te 18+++ b/policy/modules/system/logging.te
21@@ -450,6 +450,7 @@ fs_getattr_all_fs(syslogd_t) 19@@ -475,10 +475,11 @@ files_var_lib_filetrans(syslogd_t, syslo
20
21 fs_getattr_all_fs(syslogd_t)
22 fs_search_auto_mountpoints(syslogd_t) 22 fs_search_auto_mountpoints(syslogd_t)
23 23
24 mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories 24 mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
@@ -26,6 +26,5 @@ index 2914b0b..2ab0a49 100644
26 26
27 term_write_console(syslogd_t) 27 term_write_console(syslogd_t)
28 # Allow syslog to a terminal 28 # Allow syslog to a terminal
29-- 29 term_write_unallocated_ttys(syslogd_t)
301.7.9.5 30
31
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-nfsd-to-exec-shell-commands.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-nfsd-to-exec-shell-commands.patch
index e77a730..189dc6e 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-nfsd-to-exec-shell-commands.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-nfsd-to-exec-shell-commands.patch
@@ -9,13 +9,13 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9--- 9---
10 policy/modules/contrib/rpc.te | 2 +- 10 policy/modules/contrib/rpc.te | 2 +-
11 policy/modules/kernel/kernel.if | 18 ++++++++++++++++++ 11 policy/modules/kernel/kernel.if | 18 ++++++++++++++++++
12 2 files changed, 19 insertions(+), 1 deletions(-) 12 2 files changed, 19 insertions(+), 1 deletion(-)
13 13
14diff --git a/policy/modules/contrib/rpc.te b/policy/modules/contrib/rpc.te
15index 9566932..5605205 100644
16--- a/policy/modules/contrib/rpc.te 14--- a/policy/modules/contrib/rpc.te
17+++ b/policy/modules/contrib/rpc.te 15+++ b/policy/modules/contrib/rpc.te
18@@ -203,7 +203,7 @@ kernel_read_network_state(nfsd_t) 16@@ -222,11 +222,11 @@ allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir
17
18 kernel_read_network_state(nfsd_t)
19 kernel_dontaudit_getattr_core_if(nfsd_t) 19 kernel_dontaudit_getattr_core_if(nfsd_t)
20 kernel_setsched(nfsd_t) 20 kernel_setsched(nfsd_t)
21 kernel_request_load_module(nfsd_t) 21 kernel_request_load_module(nfsd_t)
@@ -24,11 +24,13 @@ index 9566932..5605205 100644
24 24
25 corenet_sendrecv_nfs_server_packets(nfsd_t) 25 corenet_sendrecv_nfs_server_packets(nfsd_t)
26 corenet_tcp_bind_nfs_port(nfsd_t) 26 corenet_tcp_bind_nfs_port(nfsd_t)
27diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if 27 corenet_udp_bind_nfs_port(nfsd_t)
28index 649e458..8a669c5 100644 28
29--- a/policy/modules/kernel/kernel.if 29--- a/policy/modules/kernel/kernel.if
30+++ b/policy/modules/kernel/kernel.if 30+++ b/policy/modules/kernel/kernel.if
31@@ -804,6 +804,24 @@ interface(`kernel_unmount_proc',` 31@@ -844,10 +844,28 @@ interface(`kernel_unmount_proc',`
32 allow $1 proc_t:filesystem unmount;
33 ')
32 34
33 ######################################## 35 ########################################
34 ## <summary> 36 ## <summary>
@@ -53,6 +55,5 @@ index 649e458..8a669c5 100644
53 ## Get the attributes of the proc filesystem. 55 ## Get the attributes of the proc filesystem.
54 ## </summary> 56 ## </summary>
55 ## <param name="domain"> 57 ## <param name="domain">
56-- 58 ## <summary>
571.7.5.4 59 ## Domain allowed access.
58
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch
index 9ef61b4..766b3df 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch
@@ -11,11 +11,11 @@ Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
11 policy/modules/system/selinuxutil.te | 3 +++ 11 policy/modules/system/selinuxutil.te | 3 +++
12 1 file changed, 3 insertions(+) 12 1 file changed, 3 insertions(+)
13 13
14diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
15index 9058dd8..f998491 100644
16--- a/policy/modules/system/selinuxutil.te 14--- a/policy/modules/system/selinuxutil.te
17+++ b/policy/modules/system/selinuxutil.te 15+++ b/policy/modules/system/selinuxutil.te
18@@ -552,6 +552,9 @@ files_relabel_all_files(setfiles_t) 16@@ -553,10 +553,13 @@ files_read_etc_files(setfiles_t)
17 files_list_all(setfiles_t)
18 files_relabel_all_files(setfiles_t)
19 files_read_usr_symlinks(setfiles_t) 19 files_read_usr_symlinks(setfiles_t)
20 files_dontaudit_read_all_symlinks(setfiles_t) 20 files_dontaudit_read_all_symlinks(setfiles_t)
21 21
@@ -25,6 +25,5 @@ index 9058dd8..f998491 100644
25 fs_getattr_all_xattr_fs(setfiles_t) 25 fs_getattr_all_xattr_fs(setfiles_t)
26 fs_list_all(setfiles_t) 26 fs_list_all(setfiles_t)
27 fs_search_auto_mountpoints(setfiles_t) 27 fs_search_auto_mountpoints(setfiles_t)
28-- 28 fs_relabelfrom_noxattr_fs(setfiles_t)
291.7.9.5 29
30
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-sysadm-to-run-rpcinfo.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-sysadm-to-run-rpcinfo.patch
index ec3dbf4..8ce2f62 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-sysadm-to-run-rpcinfo.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-sysadm-to-run-rpcinfo.patch
@@ -13,11 +13,11 @@ Signed-off-by: Roy Li <rongqing.li@windriver.com>
13 policy/modules/roles/sysadm.te | 4 ++++ 13 policy/modules/roles/sysadm.te | 4 ++++
14 1 file changed, 4 insertions(+) 14 1 file changed, 4 insertions(+)
15 15
16diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
17index 1767217..5502c6a 100644
18--- a/policy/modules/roles/sysadm.te 16--- a/policy/modules/roles/sysadm.te
19+++ b/policy/modules/roles/sysadm.te 17+++ b/policy/modules/roles/sysadm.te
20@@ -413,6 +413,10 @@ optional_policy(` 18@@ -1169,10 +1169,14 @@ optional_policy(`
19 virt_admin(sysadm_t, sysadm_r)
20 virt_stream_connect(sysadm_t)
21 ') 21 ')
22 22
23 optional_policy(` 23 optional_policy(`
@@ -28,6 +28,5 @@ index 1767217..5502c6a 100644
28 vmware_role(sysadm_r, sysadm_t) 28 vmware_role(sysadm_r, sysadm_t)
29 ') 29 ')
30 30
31-- 31 optional_policy(`
321.7.10.4 32 vnstatd_admin(sysadm_t, sysadm_r)
33
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-don-t-audit-tty_device_t.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-don-t-audit-tty_device_t.patch
index 82370d8..998bfa0 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-don-t-audit-tty_device_t.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-don-t-audit-tty_device_t.patch
@@ -13,11 +13,11 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
13 policy/modules/kernel/terminal.if | 3 +++ 13 policy/modules/kernel/terminal.if | 3 +++
14 1 file changed, 3 insertions(+) 14 1 file changed, 3 insertions(+)
15 15
16diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
17index 7519d0e..45de1ac 100644
18--- a/policy/modules/kernel/terminal.if 16--- a/policy/modules/kernel/terminal.if
19+++ b/policy/modules/kernel/terminal.if 17+++ b/policy/modules/kernel/terminal.if
20@@ -299,9 +299,12 @@ interface(`term_use_console',` 18@@ -297,13 +297,16 @@ interface(`term_use_console',`
19 ## </param>
20 #
21 interface(`term_dontaudit_use_console',` 21 interface(`term_dontaudit_use_console',`
22 gen_require(` 22 gen_require(`
23 type console_device_t; 23 type console_device_t;
@@ -30,6 +30,5 @@ index 7519d0e..45de1ac 100644
30 ') 30 ')
31 31
32 ######################################## 32 ########################################
33-- 33 ## <summary>
341.7.9.5 34 ## Set the attributes of the console
35
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-dmesg-to-use-dev-kmsg.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-dmesg-to-use-dev-kmsg.patch
index d6c8dbf..131a9bb 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-dmesg-to-use-dev-kmsg.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-dmesg-to-use-dev-kmsg.patch
@@ -9,21 +9,21 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9 policy/modules/admin/dmesg.te | 2 ++ 9 policy/modules/admin/dmesg.te | 2 ++
10 2 files changed, 3 insertions(+) 10 2 files changed, 3 insertions(+)
11 11
12diff --git a/policy/modules/admin/dmesg.if b/policy/modules/admin/dmesg.if
13index e1973c7..739a4bc 100644
14--- a/policy/modules/admin/dmesg.if 12--- a/policy/modules/admin/dmesg.if
15+++ b/policy/modules/admin/dmesg.if 13+++ b/policy/modules/admin/dmesg.if
16@@ -37,4 +37,5 @@ interface(`dmesg_exec',` 14@@ -35,6 +35,7 @@ interface(`dmesg_exec',`
15 type dmesg_exec_t;
16 ')
17 17
18 corecmd_search_bin($1) 18 corecmd_search_bin($1)
19 can_exec($1, dmesg_exec_t) 19 can_exec($1, dmesg_exec_t)
20+ dev_read_kmsg($1) 20+ dev_read_kmsg($1)
21 ') 21 ')
22diff --git a/policy/modules/admin/dmesg.te b/policy/modules/admin/dmesg.te
23index 72bc6d8..c591aea 100644
24--- a/policy/modules/admin/dmesg.te 22--- a/policy/modules/admin/dmesg.te
25+++ b/policy/modules/admin/dmesg.te 23+++ b/policy/modules/admin/dmesg.te
26@@ -28,6 +28,8 @@ kernel_read_proc_symlinks(dmesg_t) 24@@ -28,10 +28,12 @@ kernel_read_proc_symlinks(dmesg_t)
25 # for when /usr is not mounted:
26 kernel_dontaudit_search_unlabeled(dmesg_t)
27 27
28 dev_read_sysfs(dmesg_t) 28 dev_read_sysfs(dmesg_t)
29 29
@@ -32,6 +32,5 @@ index 72bc6d8..c591aea 100644
32 fs_search_auto_mountpoints(dmesg_t) 32 fs_search_auto_mountpoints(dmesg_t)
33 33
34 term_dontaudit_use_console(dmesg_t) 34 term_dontaudit_use_console(dmesg_t)
35-- 35
361.7.9.5 36 domain_use_interactive_fds(dmesg_t)
37
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-new-SELINUXMNT-in-sys.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-new-SELINUXMNT-in-sys.patch
index 005e28f..f3adc70 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-new-SELINUXMNT-in-sys.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-new-SELINUXMNT-in-sys.patch
@@ -11,14 +11,14 @@ Upstream-Status: Inappropriate [only for Poky]
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> 11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> 12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13--- 13---
14 policy/modules/kernel/selinux.if | 34 ++++++++++++++++++++++++++++++++-- 14 policy/modules/kernel/selinux.if | 26 ++++++++++++++++++++++++++
15 1 file changed, 32 insertions(+), 2 deletions(-) 15 1 file changed, 26 insertions(+)
16 16
17Index: refpolicy/policy/modules/kernel/selinux.if 17--- a/policy/modules/kernel/selinux.if
18=================================================================== 18+++ b/policy/modules/kernel/selinux.if
19--- refpolicy.orig/policy/modules/kernel/selinux.if 19@@ -56,10 +56,14 @@ interface(`selinux_labeled_boolean',`
20+++ refpolicy/policy/modules/kernel/selinux.if 20 interface(`selinux_get_fs_mount',`
21@@ -58,6 +58,10 @@ interface(`selinux_get_fs_mount',` 21 gen_require(`
22 type security_t; 22 type security_t;
23 ') 23 ')
24 24
@@ -29,7 +29,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
29 # starting in libselinux 2.0.5, init_selinuxmnt() will 29 # starting in libselinux 2.0.5, init_selinuxmnt() will
30 # attempt to short circuit by checking if SELINUXMNT 30 # attempt to short circuit by checking if SELINUXMNT
31 # (/selinux) is already a selinuxfs 31 # (/selinux) is already a selinuxfs
32@@ -88,6 +92,7 @@ interface(`selinux_dontaudit_get_fs_moun 32 allow $1 security_t:filesystem getattr;
33
34@@ -86,10 +90,11 @@ interface(`selinux_get_fs_mount',`
35 interface(`selinux_dontaudit_get_fs_mount',`
36 gen_require(`
33 type security_t; 37 type security_t;
34 ') 38 ')
35 39
@@ -37,7 +41,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
37 # starting in libselinux 2.0.5, init_selinuxmnt() will 41 # starting in libselinux 2.0.5, init_selinuxmnt() will
38 # attempt to short circuit by checking if SELINUXMNT 42 # attempt to short circuit by checking if SELINUXMNT
39 # (/selinux) is already a selinuxfs 43 # (/selinux) is already a selinuxfs
40@@ -117,6 +122,8 @@ interface(`selinux_mount_fs',` 44 dontaudit $1 security_t:filesystem getattr;
45
46@@ -115,10 +120,12 @@ interface(`selinux_dontaudit_get_fs_moun
47 interface(`selinux_mount_fs',`
48 gen_require(`
41 type security_t; 49 type security_t;
42 ') 50 ')
43 51
@@ -46,7 +54,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
46 allow $1 security_t:filesystem mount; 54 allow $1 security_t:filesystem mount;
47 ') 55 ')
48 56
49@@ -136,6 +143,8 @@ interface(`selinux_remount_fs',` 57 ########################################
58 ## <summary>
59@@ -134,10 +141,12 @@ interface(`selinux_mount_fs',`
60 interface(`selinux_remount_fs',`
61 gen_require(`
50 type security_t; 62 type security_t;
51 ') 63 ')
52 64
@@ -55,7 +67,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
55 allow $1 security_t:filesystem remount; 67 allow $1 security_t:filesystem remount;
56 ') 68 ')
57 69
58@@ -154,6 +163,8 @@ interface(`selinux_unmount_fs',` 70 ########################################
71 ## <summary>
72@@ -152,10 +161,12 @@ interface(`selinux_remount_fs',`
73 interface(`selinux_unmount_fs',`
74 gen_require(`
59 type security_t; 75 type security_t;
60 ') 76 ')
61 77
@@ -64,7 +80,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
64 allow $1 security_t:filesystem unmount; 80 allow $1 security_t:filesystem unmount;
65 ') 81 ')
66 82
67@@ -172,6 +183,8 @@ interface(`selinux_getattr_fs',` 83 ########################################
84 ## <summary>
85@@ -170,10 +181,12 @@ interface(`selinux_unmount_fs',`
86 interface(`selinux_getattr_fs',`
87 gen_require(`
68 type security_t; 88 type security_t;
69 ') 89 ')
70 90
@@ -73,7 +93,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
73 allow $1 security_t:filesystem getattr; 93 allow $1 security_t:filesystem getattr;
74 94
75 dev_getattr_sysfs($1) 95 dev_getattr_sysfs($1)
76@@ -194,6 +207,7 @@ interface(`selinux_dontaudit_getattr_fs' 96 dev_search_sysfs($1)
97 ')
98@@ -192,10 +205,11 @@ interface(`selinux_getattr_fs',`
99 interface(`selinux_dontaudit_getattr_fs',`
100 gen_require(`
77 type security_t; 101 type security_t;
78 ') 102 ')
79 103
@@ -81,7 +105,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
81 dontaudit $1 security_t:filesystem getattr; 105 dontaudit $1 security_t:filesystem getattr;
82 106
83 dev_dontaudit_getattr_sysfs($1) 107 dev_dontaudit_getattr_sysfs($1)
84@@ -216,6 +230,7 @@ interface(`selinux_dontaudit_getattr_dir 108 dev_dontaudit_search_sysfs($1)
109 ')
110@@ -214,10 +228,11 @@ interface(`selinux_dontaudit_getattr_fs'
111 interface(`selinux_dontaudit_getattr_dir',`
112 gen_require(`
85 type security_t; 113 type security_t;
86 ') 114 ')
87 115
@@ -89,7 +117,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
89 dontaudit $1 security_t:dir getattr; 117 dontaudit $1 security_t:dir getattr;
90 ') 118 ')
91 119
92@@ -234,6 +249,7 @@ interface(`selinux_search_fs',` 120 ########################################
121 ## <summary>
122@@ -232,10 +247,11 @@ interface(`selinux_dontaudit_getattr_dir
123 interface(`selinux_search_fs',`
124 gen_require(`
93 type security_t; 125 type security_t;
94 ') 126 ')
95 127
@@ -97,7 +129,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
97 dev_search_sysfs($1) 129 dev_search_sysfs($1)
98 allow $1 security_t:dir search_dir_perms; 130 allow $1 security_t:dir search_dir_perms;
99 ') 131 ')
100@@ -253,6 +269,7 @@ interface(`selinux_dontaudit_search_fs', 132
133 ########################################
134@@ -251,10 +267,11 @@ interface(`selinux_search_fs',`
135 interface(`selinux_dontaudit_search_fs',`
136 gen_require(`
101 type security_t; 137 type security_t;
102 ') 138 ')
103 139
@@ -105,7 +141,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
105 dontaudit $1 security_t:dir search_dir_perms; 141 dontaudit $1 security_t:dir search_dir_perms;
106 ') 142 ')
107 143
108@@ -272,6 +289,7 @@ interface(`selinux_dontaudit_read_fs',` 144 ########################################
145 ## <summary>
146@@ -270,10 +287,11 @@ interface(`selinux_dontaudit_search_fs',
147 interface(`selinux_dontaudit_read_fs',`
148 gen_require(`
109 type security_t; 149 type security_t;
110 ') 150 ')
111 151
@@ -113,7 +153,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
113 dontaudit $1 security_t:dir search_dir_perms; 153 dontaudit $1 security_t:dir search_dir_perms;
114 dontaudit $1 security_t:file read_file_perms; 154 dontaudit $1 security_t:file read_file_perms;
115 ') 155 ')
116@@ -293,6 +311,7 @@ interface(`selinux_get_enforce_mode',` 156
157 ########################################
158@@ -291,10 +309,11 @@ interface(`selinux_dontaudit_read_fs',`
159 interface(`selinux_get_enforce_mode',`
160 gen_require(`
117 type security_t; 161 type security_t;
118 ') 162 ')
119 163
@@ -121,7 +165,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
121 dev_search_sysfs($1) 165 dev_search_sysfs($1)
122 allow $1 security_t:dir list_dir_perms; 166 allow $1 security_t:dir list_dir_perms;
123 allow $1 security_t:file read_file_perms; 167 allow $1 security_t:file read_file_perms;
124@@ -361,6 +380,7 @@ interface(`selinux_read_policy',` 168 ')
169
170@@ -359,10 +378,11 @@ interface(`selinux_load_policy',`
171 interface(`selinux_read_policy',`
172 gen_require(`
125 type security_t; 173 type security_t;
126 ') 174 ')
127 175
@@ -129,7 +177,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
129 dev_search_sysfs($1) 177 dev_search_sysfs($1)
130 allow $1 security_t:dir list_dir_perms; 178 allow $1 security_t:dir list_dir_perms;
131 allow $1 security_t:file read_file_perms; 179 allow $1 security_t:file read_file_perms;
132@@ -426,6 +446,7 @@ interface(`selinux_set_generic_booleans' 180 allow $1 security_t:security read_policy;
181 ')
182@@ -424,10 +444,11 @@ interface(`selinux_set_boolean',`
183 interface(`selinux_set_generic_booleans',`
184 gen_require(`
133 type security_t; 185 type security_t;
134 ') 186 ')
135 187
@@ -137,7 +189,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
137 dev_search_sysfs($1) 189 dev_search_sysfs($1)
138 190
139 allow $1 security_t:dir list_dir_perms; 191 allow $1 security_t:dir list_dir_perms;
140@@ -463,6 +484,7 @@ interface(`selinux_set_all_booleans',` 192 allow $1 security_t:file rw_file_perms;
193
194@@ -461,10 +482,11 @@ interface(`selinux_set_all_booleans',`
195 type security_t, secure_mode_policyload_t;
196 attribute boolean_type;
141 bool secure_mode_policyload; 197 bool secure_mode_policyload;
142 ') 198 ')
143 199
@@ -145,7 +201,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
145 dev_search_sysfs($1) 201 dev_search_sysfs($1)
146 202
147 allow $1 security_t:dir list_dir_perms; 203 allow $1 security_t:dir list_dir_perms;
148@@ -522,6 +544,7 @@ interface(`selinux_validate_context',` 204 allow $1 { boolean_type -secure_mode_policyload_t }:file rw_file_perms;
205 allow $1 secure_mode_policyload_t:file read_file_perms;
206@@ -520,10 +542,11 @@ interface(`selinux_set_parameters',`
207 interface(`selinux_validate_context',`
208 gen_require(`
149 type security_t; 209 type security_t;
150 ') 210 ')
151 211
@@ -153,7 +213,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
153 dev_search_sysfs($1) 213 dev_search_sysfs($1)
154 allow $1 security_t:dir list_dir_perms; 214 allow $1 security_t:dir list_dir_perms;
155 allow $1 security_t:file rw_file_perms; 215 allow $1 security_t:file rw_file_perms;
156@@ -544,6 +567,7 @@ interface(`selinux_dontaudit_validate_co 216 allow $1 security_t:security check_context;
217 ')
218@@ -542,10 +565,11 @@ interface(`selinux_validate_context',`
219 interface(`selinux_dontaudit_validate_context',`
220 gen_require(`
157 type security_t; 221 type security_t;
158 ') 222 ')
159 223
@@ -161,7 +225,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
161 dontaudit $1 security_t:dir list_dir_perms; 225 dontaudit $1 security_t:dir list_dir_perms;
162 dontaudit $1 security_t:file rw_file_perms; 226 dontaudit $1 security_t:file rw_file_perms;
163 dontaudit $1 security_t:security check_context; 227 dontaudit $1 security_t:security check_context;
164@@ -565,6 +589,7 @@ interface(`selinux_compute_access_vector 228 ')
229
230@@ -563,10 +587,11 @@ interface(`selinux_dontaudit_validate_co
231 interface(`selinux_compute_access_vector',`
232 gen_require(`
165 type security_t; 233 type security_t;
166 ') 234 ')
167 235
@@ -169,7 +237,11 @@ Index: refpolicy/policy/modules/kernel/selinux.if
169 dev_search_sysfs($1) 237 dev_search_sysfs($1)
170 allow $1 security_t:dir list_dir_perms; 238 allow $1 security_t:dir list_dir_perms;
171 allow $1 security_t:file rw_file_perms; 239 allow $1 security_t:file rw_file_perms;
172@@ -660,6 +685,7 @@ interface(`selinux_compute_user_contexts 240 allow $1 security_t:security compute_av;
241 ')
242@@ -658,10 +683,11 @@ interface(`selinux_compute_relabel_conte
243 interface(`selinux_compute_user_contexts',`
244 gen_require(`
173 type security_t; 245 type security_t;
174 ') 246 ')
175 247
@@ -177,3 +249,5 @@ Index: refpolicy/policy/modules/kernel/selinux.if
177 dev_search_sysfs($1) 249 dev_search_sysfs($1)
178 allow $1 security_t:dir list_dir_perms; 250 allow $1 security_t:dir list_dir_perms;
179 allow $1 security_t:file rw_file_perms; 251 allow $1 security_t:file rw_file_perms;
252 allow $1 security_t:security compute_user;
253 ')
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch
index f04ebec..016685c 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-nfsd_t-to-mount_nfsd_fs_t.patch
@@ -16,7 +16,9 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
16 16
17--- a/policy/modules/contrib/rpc.te 17--- a/policy/modules/contrib/rpc.te
18+++ b/policy/modules/contrib/rpc.te 18+++ b/policy/modules/contrib/rpc.te
19@@ -263,6 +263,11 @@ tunable_policy(`nfs_export_all_ro',` 19@@ -275,10 +275,15 @@ tunable_policy(`nfs_export_all_ro',`
20 files_read_non_auth_files(nfsd_t)
21 ')
20 22
21 optional_policy(` 23 optional_policy(`
22 mount_exec(nfsd_t) 24 mount_exec(nfsd_t)
@@ -28,9 +30,13 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
28 ') 30 ')
29 31
30 ######################################## 32 ########################################
33 #
34 # GSSD local policy
31--- a/policy/modules/contrib/rpcbind.te 35--- a/policy/modules/contrib/rpcbind.te
32+++ b/policy/modules/contrib/rpcbind.te 36+++ b/policy/modules/contrib/rpcbind.te
33@@ -70,6 +70,11 @@ logging_send_syslog_msg(rpcbind_t) 37@@ -71,8 +71,13 @@ auth_use_nsswitch(rpcbind_t)
38
39 logging_send_syslog_msg(rpcbind_t)
34 40
35 miscfiles_read_localization(rpcbind_t) 41 miscfiles_read_localization(rpcbind_t)
36 42
@@ -44,18 +50,24 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
44 ') 50 ')
45--- a/policy/modules/kernel/filesystem.te 51--- a/policy/modules/kernel/filesystem.te
46+++ b/policy/modules/kernel/filesystem.te 52+++ b/policy/modules/kernel/filesystem.te
47@@ -119,6 +119,7 @@ genfscon mvfs / gen_context(system_u:obj 53@@ -127,10 +127,11 @@ fs_noxattr_type(mvfs_t)
54 allow mvfs_t self:filesystem associate;
55 genfscon mvfs / gen_context(system_u:object_r:mvfs_t,s0)
48 56
49 type nfsd_fs_t; 57 type nfsd_fs_t;
50 fs_type(nfsd_fs_t) 58 fs_type(nfsd_fs_t)
51+files_mountpoint(nfsd_fs_t) 59+files_mountpoint(nfsd_fs_t)
52 genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0) 60 genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
53 61
54 type oprofilefs_t; 62 type nsfs_t;
63 fs_type(nsfs_t)
64 genfscon nsfs / gen_context(system_u:object_r:nsfs_t,s0)
55--- a/policy/modules/kernel/kernel.te 65--- a/policy/modules/kernel/kernel.te
56+++ b/policy/modules/kernel/kernel.te 66+++ b/policy/modules/kernel/kernel.te
57@@ -293,6 +293,8 @@ mls_process_read_up(kernel_t) 67@@ -324,10 +324,12 @@ mcs_process_set_categories(kernel_t)
58 mls_process_write_down(kernel_t) 68
69 mls_process_read_all_levels(kernel_t)
70 mls_process_write_all_levels(kernel_t)
59 mls_file_write_all_levels(kernel_t) 71 mls_file_write_all_levels(kernel_t)
60 mls_file_read_all_levels(kernel_t) 72 mls_file_read_all_levels(kernel_t)
61+mls_socket_write_all_levels(kernel_t) 73+mls_socket_write_all_levels(kernel_t)
@@ -63,3 +75,5 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
63 75
64 ifdef(`distro_redhat',` 76 ifdef(`distro_redhat',`
65 # Bugzilla 222337 77 # Bugzilla 222337
78 fs_rw_tmpfs_chr_files(kernel_t)
79 ')
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch
index 0b8cc5d..950f525 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch
@@ -14,11 +14,11 @@ Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
14 policy/modules/system/selinuxutil.te | 2 +- 14 policy/modules/system/selinuxutil.te | 2 +-
15 1 file changed, 1 insertion(+), 1 deletion(-) 15 1 file changed, 1 insertion(+), 1 deletion(-)
16 16
17diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
18index f998491..1a4e565 100644
19--- a/policy/modules/system/selinuxutil.te 17--- a/policy/modules/system/selinuxutil.te
20+++ b/policy/modules/system/selinuxutil.te 18+++ b/policy/modules/system/selinuxutil.te
21@@ -555,7 +555,7 @@ files_dontaudit_read_all_symlinks(setfiles_t) 19@@ -556,11 +556,11 @@ files_read_usr_symlinks(setfiles_t)
20 files_dontaudit_read_all_symlinks(setfiles_t)
21
22 # needs to be able to read symlinks to make restorecon on symlink working 22 # needs to be able to read symlinks to make restorecon on symlink working
23 files_read_all_symlinks(setfiles_t) 23 files_read_all_symlinks(setfiles_t)
24 24
@@ -27,6 +27,5 @@ index f998491..1a4e565 100644
27 fs_list_all(setfiles_t) 27 fs_list_all(setfiles_t)
28 fs_search_auto_mountpoints(setfiles_t) 28 fs_search_auto_mountpoints(setfiles_t)
29 fs_relabelfrom_noxattr_fs(setfiles_t) 29 fs_relabelfrom_noxattr_fs(setfiles_t)
30-- 30
311.7.9.5 31 mls_file_read_all_levels(setfiles_t)
32
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-seutils-manage-config-files.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-seutils-manage-config-files.patch
index be33bf1..c9a877b 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-seutils-manage-config-files.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-seutils-manage-config-files.patch
@@ -11,11 +11,11 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
11 policy/modules/system/userdomain.if | 4 ++++ 11 policy/modules/system/userdomain.if | 4 ++++
12 2 files changed, 5 insertions(+) 12 2 files changed, 5 insertions(+)
13 13
14diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
15index 3822072..db03ca1 100644
16--- a/policy/modules/system/selinuxutil.if 14--- a/policy/modules/system/selinuxutil.if
17+++ b/policy/modules/system/selinuxutil.if 15+++ b/policy/modules/system/selinuxutil.if
18@@ -680,6 +680,7 @@ interface(`seutil_manage_config',` 16@@ -753,10 +753,11 @@ interface(`seutil_manage_config',`
17 gen_require(`
18 type selinux_config_t;
19 ') 19 ')
20 20
21 files_search_etc($1) 21 files_search_etc($1)
@@ -23,11 +23,13 @@ index 3822072..db03ca1 100644
23 manage_files_pattern($1, selinux_config_t, selinux_config_t) 23 manage_files_pattern($1, selinux_config_t, selinux_config_t)
24 read_lnk_files_pattern($1, selinux_config_t, selinux_config_t) 24 read_lnk_files_pattern($1, selinux_config_t, selinux_config_t)
25 ') 25 ')
26diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if 26
27index b4a691d..20c8bf8 100644 27 #######################################
28--- a/policy/modules/system/userdomain.if 28--- a/policy/modules/system/userdomain.if
29+++ b/policy/modules/system/userdomain.if 29+++ b/policy/modules/system/userdomain.if
30@@ -1277,6 +1277,10 @@ template(`userdom_security_admin_template',` 30@@ -1327,10 +1327,14 @@ template(`userdom_security_admin_templat
31 logging_read_audit_log($1)
32 logging_read_generic_logs($1)
31 logging_read_audit_config($1) 33 logging_read_audit_config($1)
32 34
33 seutil_manage_bin_policy($1) 35 seutil_manage_bin_policy($1)
@@ -38,6 +40,5 @@ index b4a691d..20c8bf8 100644
38 seutil_run_checkpolicy($1, $2) 40 seutil_run_checkpolicy($1, $2)
39 seutil_run_loadpolicy($1, $2) 41 seutil_run_loadpolicy($1, $2)
40 seutil_run_semanage($1, $2) 42 seutil_run_semanage($1, $2)
41-- 43 seutil_run_setfiles($1, $2)
421.7.9.5 44
43
diff --git a/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch b/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch
index 9693345..86ff0d2 100644
--- a/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch
+++ b/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch
@@ -12,11 +12,11 @@ Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
12 policy/modules/system/init.te | 5 +++++ 12 policy/modules/system/init.te | 5 +++++
13 1 file changed, 5 insertions(+) 13 1 file changed, 5 insertions(+)
14 14
15diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
16index c8f007d..a9675f6 100644
17--- a/policy/modules/system/init.te 15--- a/policy/modules/system/init.te
18+++ b/policy/modules/system/init.te 16+++ b/policy/modules/system/init.te
19@@ -929,3 +929,8 @@ optional_policy(` 17@@ -1105,5 +1105,10 @@ optional_policy(`
18 ')
19
20 optional_policy(` 20 optional_policy(`
21 zebra_read_config(initrc_t) 21 zebra_read_config(initrc_t)
22 ') 22 ')
@@ -26,6 +26,3 @@ index c8f007d..a9675f6 100644
26+allow devpts_t device_t:filesystem associate; 26+allow devpts_t device_t:filesystem associate;
27+allow init_t self:capability2 block_suspend; 27+allow init_t self:capability2 block_suspend;
28\ No newline at end of file 28\ No newline at end of file
29--
301.7.9.5
31
diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index ea98139..58152a8 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -29,6 +29,10 @@ FILES_${PN}-dev =+ " \
29 29
30DEPENDS += "checkpolicy-native policycoreutils-native m4-native" 30DEPENDS += "checkpolicy-native policycoreutils-native m4-native"
31 31
32RDEPENDS-${PN}-dev =+ " \
33 python \
34"
35
32PACKAGE_ARCH = "${MACHINE_ARCH}" 36PACKAGE_ARCH = "${MACHINE_ARCH}"
33 37
34inherit pythonnative 38inherit pythonnative
diff --git a/recipes-security/refpolicy/refpolicy_git.inc b/recipes-security/refpolicy/refpolicy_git.inc
index d031f81..e6e63c9 100644
--- a/recipes-security/refpolicy/refpolicy_git.inc
+++ b/recipes-security/refpolicy/refpolicy_git.inc
@@ -17,16 +17,13 @@ SRC_URI += "file://poky-fc-subs_dist.patch \
17 file://poky-fc-fix-real-path_shadow.patch \ 17 file://poky-fc-fix-real-path_shadow.patch \
18 file://poky-fc-fix-bind.patch \ 18 file://poky-fc-fix-bind.patch \
19 file://poky-fc-clock.patch \ 19 file://poky-fc-clock.patch \
20 file://poky-fc-corecommands.patch \
21 file://poky-fc-dmesg.patch \ 20 file://poky-fc-dmesg.patch \
22 file://poky-fc-fstools.patch \ 21 file://poky-fc-fstools.patch \
23 file://poky-fc-iptables.patch \
24 file://poky-fc-mta.patch \ 22 file://poky-fc-mta.patch \
25 file://poky-fc-netutils.patch \ 23 file://poky-fc-netutils.patch \
26 file://poky-fc-nscd.patch \ 24 file://poky-fc-nscd.patch \
27 file://poky-fc-screen.patch \ 25 file://poky-fc-screen.patch \
28 file://poky-fc-ssh.patch \ 26 file://poky-fc-ssh.patch \
29 file://poky-fc-su.patch \
30 file://poky-fc-sysnetwork.patch \ 27 file://poky-fc-sysnetwork.patch \
31 file://poky-fc-udevd.patch \ 28 file://poky-fc-udevd.patch \
32 file://poky-fc-rpm.patch \ 29 file://poky-fc-rpm.patch \
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-11-26 14:45:46 +0000