summaryrefslogtreecommitdiffstats
path: root/recipes-security/refpolicy/refpolicy-2.20190201
diff options
context:
space:
mode:
Diffstat (limited to 'recipes-security/refpolicy/refpolicy-2.20190201')
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch36
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0001-fix-update-alternatives-for-sysvinit.patch53
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0001-refpolicy-minimum-audit-logging-getty-audit-related-.patch68
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch31
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0002-refpolicy-minimum-locallogin-add-allow-rules-for-typ.patch54
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0003-fc-sysklogd-apply-policy-to-sysklogd-symlink.patch57
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0003-refpolicy-minimum-systemd-unconfined-lib-add-systemd.patch121
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0004-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0004-refpolicy-minimum-systemd-mount-logging-authlogin-ad.patch96
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0005-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch30
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0005-refpolicy-minimum-init-fix-reboot-with-systemd-as-in.patch37
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0006-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch30
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0006-refpolicy-minimum-systemd-mount-enable-required-refp.patch92
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0007-fc-login-apply-login-context-to-login.shadow.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0007-refpolicy-minimum-systemd-fix-for-login-journal-serv.patch103
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0008-fc-bind-fix-real-path-for-bind.patch31
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0008-refpolicy-minimum-systemd-fix-for-systemd-tmp-files-.patch109
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0009-fc-hwclock-add-hwclock-alternatives.patch28
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0009-refpolicy-minimum-systemd-fix-for-syslog.patch70
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0010-fc-dmesg-apply-policy-to-dmesg-alternatives.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0011-fc-ssh-apply-policy-to-ssh-alternatives.patch27
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0012-fc-sysnetwork-apply-policy-to-ip-alternatives.patch48
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0013-fc-udev-apply-policy-to-udevadm-in-libexec.patch28
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0014-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch29
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0015-fc-su-apply-policy-to-su-alternatives.patch26
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0016-fc-fstools-fix-real-path-for-fstools.patch76
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0017-policy-module-logging-Add-the-syslogd_t-to-trusted-o.patch33
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0018-policy-module-logging-add-rules-for-the-symlink-of-v.patch100
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0019-policy-module-logging-add-rules-for-syslogd-symlink-.patch33
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0020-policy-module-logging-add-domain-rules-for-the-subdi.patch36
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0021-policy-module-files-add-rules-for-the-symlink-of-tmp.patch100
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0022-policy-module-terminals-add-rules-for-bsdpty_device_.patch123
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0023-policy-module-terminals-don-t-audit-tty_device_t-in-.patch37
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0024-policy-module-rpc-allow-nfsd-to-exec-shell-commands.patch29
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0025-policy-module-rpc-fix-policy-for-nfsserver-to-mount-.patch77
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0026-policy-module-sysfs-fix-for-new-SELINUXMNT-in-sys.patch126
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0027-policy-module-rpc-allow-sysadm-to-run-rpcinfo.patch31
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0028-policy-module-userdomain-fix-selinux-utils-to-manage.patch45
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0029-policy-module-selinuxutil-fix-setfiles-statvfs-to-ge.patch33
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0030-policy-module-admin-fix-dmesg-to-use-dev-kmsg-as-def.patch25
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0031-policy-module-ftp-add-ftpd_t-to-mls_file_write_all_l.patch41
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0032-policy-module-init-update-for-systemd-related-allow-.patch32
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0033-refpolicy-minimum-make-sysadmin-module-optional.patch67
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20190201/0034-policy-module-apache-add-rules-for-the-symlink-of-va.patch33
44 files changed, 2359 insertions, 0 deletions
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch
new file mode 100644
index 0000000..2692ffa
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0001-fc-subs-volatile-alias-common-var-volatile-paths.patch
@@ -0,0 +1,36 @@
1From 49dd08e69938debc792ac9c3ac3e81a38929d11f Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Thu, 28 Mar 2019 16:14:09 -0400
4Subject: [PATCH 01/34] fc/subs/volatile: alias common /var/volatile paths
5
6Ensure /var/volatile paths get the appropriate base file context.
7
8Upstream-Status: Pending
9
10Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
11Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
12---
13 config/file_contexts.subs_dist | 10 ++++++++++
14 1 file changed, 10 insertions(+)
15
16diff --git a/config/file_contexts.subs_dist b/config/file_contexts.subs_dist
17index 346d920e..be532d7f 100644
18--- a/config/file_contexts.subs_dist
19+++ b/config/file_contexts.subs_dist
20@@ -31,3 +31,13 @@
21 # not for refpolicy intern, but for /var/run using applications,
22 # like systemd tmpfiles or systemd socket configurations
23 /var/run /run
24+
25+# volatile aliases
26+# ensure the policy applied to the base filesystem objects are reflected in the
27+# volatile hierarchy.
28+/var/volatile/log /var/log
29+/var/volatile/run /var/run
30+/var/volatile/cache /var/cache
31+/var/volatile/tmp /var/tmp
32+/var/volatile/lock /var/lock
33+/var/volatile/run/lock /var/lock
34--
352.19.1
36
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0001-fix-update-alternatives-for-sysvinit.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0001-fix-update-alternatives-for-sysvinit.patch
new file mode 100644
index 0000000..62e7da1
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0001-fix-update-alternatives-for-sysvinit.patch
@@ -0,0 +1,53 @@
1From 83508f3365277c0ef8c570e744879b904de64cd7 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH] fix update-alternatives for sysvinit
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/admin/shutdown.fc | 1 +
12 policy/modules/kernel/corecommands.fc | 1 +
13 policy/modules/system/init.fc | 1 +
14 3 files changed, 3 insertions(+)
15
16diff --git a/policy/modules/admin/shutdown.fc b/policy/modules/admin/shutdown.fc
17index 03a2230c..2ba049ff 100644
18--- a/policy/modules/admin/shutdown.fc
19+++ b/policy/modules/admin/shutdown.fc
20@@ -5,5 +5,6 @@
21 /usr/lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
22
23 /usr/sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)
24+/usr/sbin/shutdown\.sysvinit -- gen_context(system_u:object_r:shutdown_exec_t,s0)
25
26 /run/shutdown\.pid -- gen_context(system_u:object_r:shutdown_var_run_t,s0)
27diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
28index cf3848db..86920167 100644
29--- a/policy/modules/kernel/corecommands.fc
30+++ b/policy/modules/kernel/corecommands.fc
31@@ -149,6 +149,7 @@ ifdef(`distro_gentoo',`
32 /usr/bin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0)
33 /usr/bin/mksh -- gen_context(system_u:object_r:shell_exec_t,s0)
34 /usr/bin/mountpoint -- gen_context(system_u:object_r:bin_t,s0)
35+/usr/bin/mountpoint\.sysvinit -- gen_context(system_u:object_r:bin_t,s0)
36 /usr/bin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
37 /usr/bin/sash -- gen_context(system_u:object_r:shell_exec_t,s0)
38 /usr/bin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0)
39diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
40index 11a6ce93..93e9d2b4 100644
41--- a/policy/modules/system/init.fc
42+++ b/policy/modules/system/init.fc
43@@ -23,6 +23,7 @@ ifdef(`distro_gentoo',`
44 # /usr
45 #
46 /usr/bin/init(ng)? -- gen_context(system_u:object_r:init_exec_t,s0)
47+/usr/sbin/init\.sysvinit -- gen_context(system_u:object_r:init_exec_t,s0)
48 /usr/bin/open_init_pty -- gen_context(system_u:object_r:initrc_exec_t,s0)
49 /usr/bin/sepg_ctl -- gen_context(system_u:object_r:initrc_exec_t,s0)
50 /usr/bin/systemd -- gen_context(system_u:object_r:init_exec_t,s0)
51--
522.19.1
53
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0001-refpolicy-minimum-audit-logging-getty-audit-related-.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0001-refpolicy-minimum-audit-logging-getty-audit-related-.patch
new file mode 100644
index 0000000..f92ddb8
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0001-refpolicy-minimum-audit-logging-getty-audit-related-.patch
@@ -0,0 +1,68 @@
1From aa79b5e7803232a4e57e2cf60613f6fb7dcfc025 Mon Sep 17 00:00:00 2001
2From: Shrikant Bobade <shrikant_bobade@mentor.com>
3Date: Fri, 26 Aug 2016 17:51:44 +0530
4Subject: [PATCH 1/9] refpolicy-minimum: audit: logging: getty: audit related
5 allow rules
6
7add allow rules for audit.log file & resolve dependent avc denials.
8
9without this change we are getting audit avc denials mixed into bootlog &
10audit other avc denials.
11
12audit: type=1400 audit(): avc: denied { getattr } for pid=217 comm="mount"
13name="/" dev="proc" ino=1 scontext=system_u:system_r:mount_t:s0 tcontext=system_0
14audit: type=1400 audit(): avc: denied { sendto } for pid=310 comm="klogd"
15path="/run/systemd/journal/dev-log" scontext=sy0
16audit: type=1400 audit(): avc: denied { sendto } for pid=310 comm="klogd"
17path="/run/systemd/journal/dev-log" scontext=system_u:system_r:klogd_t:s0
18audit(): avc: denied { open } for pid=540 comm="agetty" path="/var/
19volatile/log/wtmp" dev="tmpfs" ino=9536 scontext=system_u:system_r:getty_t
20:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0
21
22Upstream-Status: Pending
23
24Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
25Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
26---
27 policy/modules/system/getty.te | 3 +++
28 policy/modules/system/logging.te | 8 ++++++++
29 2 files changed, 11 insertions(+)
30
31diff --git a/policy/modules/system/getty.te b/policy/modules/system/getty.te
32index 6d3c4284..423db0cc 100644
33--- a/policy/modules/system/getty.te
34+++ b/policy/modules/system/getty.te
35@@ -129,3 +129,6 @@ optional_policy(`
36 optional_policy(`
37 udev_read_db(getty_t)
38 ')
39+
40+allow getty_t tmpfs_t:dir search;
41+allow getty_t tmpfs_t:file { open write lock };
42diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
43index 63e92a8e..8ab46925 100644
44--- a/policy/modules/system/logging.te
45+++ b/policy/modules/system/logging.te
46@@ -249,6 +249,7 @@ allow audisp_t self:unix_stream_socket create_stream_socket_perms;
47 allow audisp_t self:unix_dgram_socket create_socket_perms;
48
49 allow audisp_t auditd_t:unix_stream_socket rw_socket_perms;
50+allow audisp_t initrc_t:unix_dgram_socket sendto;
51
52 manage_sock_files_pattern(audisp_t, audisp_var_run_t, audisp_var_run_t)
53 files_pid_filetrans(audisp_t, audisp_var_run_t, sock_file)
54@@ -620,3 +621,10 @@ optional_policy(`
55 # log to the xconsole
56 xserver_rw_console(syslogd_t)
57 ')
58+
59+
60+allow auditd_t tmpfs_t:file { getattr setattr create open read append };
61+allow auditd_t tmpfs_t:dir { open read search add_name write getattr search };
62+allow auditd_t initrc_t:unix_dgram_socket sendto;
63+
64+allow klogd_t initrc_t:unix_dgram_socket sendto;
65\ No newline at end of file
66--
672.19.1
68
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch
new file mode 100644
index 0000000..a963751
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0002-fc-subs-busybox-set-aliases-for-bin-sbin-and-usr.patch
@@ -0,0 +1,31 @@
1From c02445a1073ca6fcb42c771c233ab8aa822cbdda Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Thu, 28 Mar 2019 20:48:10 -0400
4Subject: [PATCH 02/34] fc/subs/busybox: set aliases for bin, sbin and usr
5
6The objects in /usr/lib/busybox/* should have the same policy applied as
7the corresponding objects in the / hierarchy.
8
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 config/file_contexts.subs_dist | 7 +++++++
12 1 file changed, 7 insertions(+)
13
14diff --git a/config/file_contexts.subs_dist b/config/file_contexts.subs_dist
15index be532d7f..04fca3c3 100644
16--- a/config/file_contexts.subs_dist
17+++ b/config/file_contexts.subs_dist
18@@ -41,3 +41,10 @@
19 /var/volatile/tmp /var/tmp
20 /var/volatile/lock /var/lock
21 /var/volatile/run/lock /var/lock
22+
23+# busybox aliases
24+# quickly match up the busybox built-in tree to the base filesystem tree
25+/usr/lib/busybox/bin /bin
26+/usr/lib/busybox/sbin /sbin
27+/usr/lib/busybox/usr /usr
28+
29--
302.19.1
31
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0002-refpolicy-minimum-locallogin-add-allow-rules-for-typ.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0002-refpolicy-minimum-locallogin-add-allow-rules-for-typ.patch
new file mode 100644
index 0000000..37423ec
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0002-refpolicy-minimum-locallogin-add-allow-rules-for-typ.patch
@@ -0,0 +1,54 @@
1From d8fe68150ae85657b2091bc193b11bd77f7b1f31 Mon Sep 17 00:00:00 2001
2From: Shrikant Bobade <shrikant_bobade@mentor.com>
3Date: Fri, 26 Aug 2016 17:53:46 +0530
4Subject: [PATCH 2/9] refpolicy-minimum: locallogin: add allow rules for type
5 local_login_t
6
7add allow rules for locallogin module avc denials.
8
9without this change we are getting errors like these:
10
11type=AVC msg=audit(): avc: denied { read write open } for pid=353
12comm="login" path="/var/volatile/log/lastlog" dev="tmpfs" ino=12281 scontext
13=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:
14var_log_t:s0 tclass=file permissive=1
15
16type=AVC msg=audit(): avc: denied { sendto } for pid=353 comm="login"
17path="/run/systemd/journal/dev-log" scontext=system_u:system_r:
18local_login_t:s0-s0:c0.c1023 tcontext=system_u:system_r:initrc_t:s0
19tclass=unix_dgram_socket permissive=1
20
21type=AVC msg=audit(): avc: denied { lock } for pid=353 comm="login" path=
22"/var/volatile/log/lastlog" dev="tmpfs" ino=12281 scontext=system_u:system_r
23:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_log_t:s0 tclass
24=file permissive=1
25
26Upstream-Status: Pending
27
28Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
29Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
30---
31 policy/modules/system/locallogin.te | 10 ++++++++++
32 1 file changed, 10 insertions(+)
33
34diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
35index 4c679ff3..75750e4c 100644
36--- a/policy/modules/system/locallogin.te
37+++ b/policy/modules/system/locallogin.te
38@@ -288,3 +288,13 @@ optional_policy(`
39 optional_policy(`
40 nscd_use(sulogin_t)
41 ')
42+
43+allow local_login_t initrc_t:fd use;
44+allow local_login_t initrc_t:unix_dgram_socket sendto;
45+allow local_login_t initrc_t:unix_stream_socket connectto;
46+allow local_login_t self:capability net_admin;
47+allow local_login_t var_log_t:file { create lock open read write };
48+allow local_login_t var_run_t:file { open read write lock};
49+allow local_login_t var_run_t:sock_file write;
50+allow local_login_t tmpfs_t:dir { add_name write search};
51+allow local_login_t tmpfs_t:file { create open read write lock };
52--
532.19.1
54
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0003-fc-sysklogd-apply-policy-to-sysklogd-symlink.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0003-fc-sysklogd-apply-policy-to-sysklogd-symlink.patch
new file mode 100644
index 0000000..ad94252
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0003-fc-sysklogd-apply-policy-to-sysklogd-symlink.patch
@@ -0,0 +1,57 @@
1From fdbd4461bbd6ce8a7f2b2702f7801ed07c41d5a9 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:39:41 +0800
4Subject: [PATCH 03/34] fc/sysklogd: apply policy to sysklogd symlink
5
6/etc/syslog.conf is a symlink to /etc/syslog.conf.sysklogd, so a allow
7rule for syslogd_t to read syslog_conf_t lnk_file is needed.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13---
14 policy/modules/system/logging.fc | 3 +++
15 policy/modules/system/logging.te | 1 +
16 2 files changed, 4 insertions(+)
17
18diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
19index 6693d87b..0cf108e0 100644
20--- a/policy/modules/system/logging.fc
21+++ b/policy/modules/system/logging.fc
22@@ -2,6 +2,7 @@
23
24 /etc/rsyslog\.conf -- gen_context(system_u:object_r:syslog_conf_t,s0)
25 /etc/syslog\.conf -- gen_context(system_u:object_r:syslog_conf_t,s0)
26+/etc/syslog\.conf\.sysklogd gen_context(system_u:object_r:syslog_conf_t,s0)
27 /etc/rsyslog\.d(/.*)? gen_context(system_u:object_r:syslog_conf_t,s0)
28 /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
29 /etc/systemd/journal.*\.conf -- gen_context(system_u:object_r:syslog_conf_t,s0)
30@@ -32,10 +33,12 @@
31 /usr/sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)
32 /usr/sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
33 /usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
34+/usr/sbin/klogd\.sysklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
35 /usr/sbin/metalog -- gen_context(system_u:object_r:syslogd_exec_t,s0)
36 /usr/sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
37 /usr/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
38 /usr/sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
39+/usr/sbin/syslogd\.sysklogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
40 /usr/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
41 /usr/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
42
43diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
44index adc628f8..07ed546d 100644
45--- a/policy/modules/system/logging.te
46+++ b/policy/modules/system/logging.te
47@@ -399,6 +399,7 @@ allow syslogd_t self:udp_socket create_socket_perms;
48 allow syslogd_t self:tcp_socket create_stream_socket_perms;
49
50 allow syslogd_t syslog_conf_t:file read_file_perms;
51+allow syslogd_t syslog_conf_t:lnk_file read_file_perms;
52 allow syslogd_t syslog_conf_t:dir list_dir_perms;
53
54 # Create and bind to /dev/log or /var/run/log.
55--
562.19.1
57
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0003-refpolicy-minimum-systemd-unconfined-lib-add-systemd.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0003-refpolicy-minimum-systemd-unconfined-lib-add-systemd.patch
new file mode 100644
index 0000000..ed470e4
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0003-refpolicy-minimum-systemd-unconfined-lib-add-systemd.patch
@@ -0,0 +1,121 @@
1From 53aaf2acb8bc3fb115e5d5327f6e7a994cfbf0bd Mon Sep 17 00:00:00 2001
2From: Shrikant Bobade <shrikant_bobade@mentor.com>
3Date: Fri, 26 Aug 2016 17:51:32 +0530
4Subject: [PATCH 3/9] refpolicy-minimum: systemd:unconfined:lib: add systemd
5 services allow rules
6
7systemd allow rules for systemd service file operations: start, stop, restart
8& allow rule for unconfined systemd service.
9
10without this change we are getting these errors:
11:~# systemctl status selinux-init.service
12Failed to get properties: Access denied
13
14:~# systemctl stop selinux-init.service
15Failed to stop selinux-init.service: Access denied
16
17:~# systemctl restart selinux-init.service
18audit: type=1107 audit: pid=1 uid=0 auid=4294967295 ses=4294967295 subj=
19system_u:system_r:init_t:s0 msg='avc: denied { start } for auid=n/a uid=0
20gid=0 path="/lib/systemd/system/selinux-init.service" cmdline="systemctl
21restart selinux-init.service" scontext=unconfined_u:unconfined_r:
22unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=service
23
24Upstream-Status: Pending
25
26Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
27Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
28---
29 policy/modules/system/init.te | 4 +++
30 policy/modules/system/libraries.te | 3 +++
31 policy/modules/system/systemd.if | 39 +++++++++++++++++++++++++++++
32 policy/modules/system/unconfined.te | 6 +++++
33 4 files changed, 52 insertions(+)
34
35diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
36index 8352428a..15745c83 100644
37--- a/policy/modules/system/init.te
38+++ b/policy/modules/system/init.te
39@@ -1425,3 +1425,7 @@ optional_policy(`
40 allow kernel_t init_t:process dyntransition;
41 allow devpts_t device_t:filesystem associate;
42 allow init_t self:capability2 block_suspend;
43+allow init_t self:capability2 audit_read;
44+
45+allow initrc_t init_t:system { start status };
46+allow initrc_t init_var_run_t:service { start status };
47diff --git a/policy/modules/system/libraries.te b/policy/modules/system/libraries.te
48index 422b0ea1..80b0c9a5 100644
49--- a/policy/modules/system/libraries.te
50+++ b/policy/modules/system/libraries.te
51@@ -145,3 +145,6 @@ optional_policy(`
52 optional_policy(`
53 unconfined_domain(ldconfig_t)
54 ')
55+
56+# systemd: init domain to start lib domain service
57+systemd_service_lib_function(lib_t)
58diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
59index 8d2bb8da..8fc61843 100644
60--- a/policy/modules/system/systemd.if
61+++ b/policy/modules/system/systemd.if
62@@ -887,3 +887,42 @@ interface(`systemd_getattr_updated_runtime',`
63
64 getattr_files_pattern($1, systemd_update_run_t, systemd_update_run_t)
65 ')
66+
67+########################################
68+## <summary>
69+## Allow specified domain to start stop reset systemd service
70+## </summary>
71+## <param name="domain">
72+## <summary>
73+## Domain to not audit.
74+## </summary>
75+## </param>
76+#
77+interface(`systemd_service_file_operations',`
78+ gen_require(`
79+ class service { start status stop };
80+ ')
81+
82+ allow $1 lib_t:service { start status stop };
83+
84+')
85+
86+
87+########################################
88+## <summary>
89+## Allow init domain to start lib domain service
90+## </summary>
91+## <param name="domain">
92+## <summary>
93+## Domain to not audit.
94+## </summary>
95+## </param>
96+#
97+interface(`systemd_service_lib_function',`
98+ gen_require(`
99+ class service start;
100+ ')
101+
102+ allow initrc_t $1:service start;
103+
104+')
105diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
106index 12cc0d7c..c09e94a5 100644
107--- a/policy/modules/system/unconfined.te
108+++ b/policy/modules/system/unconfined.te
109@@ -240,3 +240,9 @@ unconfined_domain_noaudit(unconfined_execmem_t)
110 optional_policy(`
111 unconfined_dbus_chat(unconfined_execmem_t)
112 ')
113+
114+
115+# systemd: specified domain to start stop reset systemd service
116+systemd_service_file_operations(unconfined_t)
117+
118+allow unconfined_t init_t:system reload;
119--
1202.19.1
121
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0004-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0004-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch
new file mode 100644
index 0000000..77c6829
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0004-fc-hostname-apply-policy-to-common-yocto-hostname-al.patch
@@ -0,0 +1,27 @@
1From 85f5825111d4c6d6b276ed07fec2292804b97a39 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 04/34] fc/hostname: apply policy to common yocto hostname
5 alternatives
6
7Upstream-Status: Inappropriate [only for Yocto]
8
9Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
10Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
11---
12 policy/modules/system/hostname.fc | 4 ++++
13 1 file changed, 4 insertions(+)
14
15diff --git a/policy/modules/system/hostname.fc b/policy/modules/system/hostname.fc
16index 83ddeb57..653e038d 100644
17--- a/policy/modules/system/hostname.fc
18+++ b/policy/modules/system/hostname.fc
19@@ -1 +1,5 @@
20+/usr/bin/hostname\.net-tools -- gen_context(system_u:object_r:hostname_exec_t,s0)
21+/usr/bin/hostname\.coreutils -- gen_context(system_u:object_r:hostname_exec_t,s0)
22+/usr/lib/busybox/bin/hostname -- gen_context(system_u:object_r:hostname_exec_t,s0)
23+
24 /usr/bin/hostname -- gen_context(system_u:object_r:hostname_exec_t,s0)
25--
262.19.1
27
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0004-refpolicy-minimum-systemd-mount-logging-authlogin-ad.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0004-refpolicy-minimum-systemd-mount-logging-authlogin-ad.patch
new file mode 100644
index 0000000..98b6156
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0004-refpolicy-minimum-systemd-mount-logging-authlogin-ad.patch
@@ -0,0 +1,96 @@
1From 5694d5bdc5ff824c4d5848dcd61cf021305b5e00 Mon Sep 17 00:00:00 2001
2From: Shrikant Bobade <shrikant_bobade@mentor.com>
3Date: Fri, 26 Aug 2016 17:53:37 +0530
4Subject: [PATCH 4/9] refpolicy-minimum: systemd: mount: logging: authlogin:
5 add allow rules
6
7add allow rules for avc denails for systemd, mount, logging & authlogin
8modules.
9
10without this change we are getting avc denial like these:
11
12type=AVC msg=audit(): avc: denied { sendto } for pid=893 comm="systemd-
13tmpfile" path="/run/systemd/journal/socket" scontext=system_u:system_r:
14systemd_tmpfiles_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=
15unix_dgram_socket permissive=0
16
17type=AVC msg=audit(): avc: denied { open } for pid=703 comm="systemd-
18tmpfile" path="/proc/1/environ" dev="proc" ino=8841 scontext=system_u:
19system_r:systemd_tmpfiles_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=
20file permissive=0
21
22type=AVC msg=audit(): avc: denied { read write } for pid=486 comm="mount"
23path="socket:[9717]" dev="sockfs" ino=9717 scontext=system_u:system_r:
24mount_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=udp_socket
25
26type=AVC msg=audit(): avc: denied { unix_read unix_write } for pid=292
27comm="syslogd" key=1095648583 scontext=system_u:system_r:syslogd_t:s0
28tcontext=system_u:system_r:syslogd_t:s0 tclass=shm permissive=1
29
30Upstream-Status: Pending
31
32Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
33Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
34---
35 policy/modules/system/authlogin.te | 2 ++
36 policy/modules/system/logging.te | 7 ++++++-
37 policy/modules/system/mount.te | 3 +++
38 policy/modules/system/systemd.te | 5 +++++
39 4 files changed, 16 insertions(+), 1 deletion(-)
40
41diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
42index 345e07f3..39f860e0 100644
43--- a/policy/modules/system/authlogin.te
44+++ b/policy/modules/system/authlogin.te
45@@ -472,3 +472,5 @@ optional_policy(`
46 samba_read_var_files(nsswitch_domain)
47 samba_dontaudit_write_var_files(nsswitch_domain)
48 ')
49+
50+allow chkpwd_t proc_t:filesystem getattr;
51diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
52index 8ab46925..520f7da6 100644
53--- a/policy/modules/system/logging.te
54+++ b/policy/modules/system/logging.te
55@@ -627,4 +627,9 @@ allow auditd_t tmpfs_t:file { getattr setattr create open read append };
56 allow auditd_t tmpfs_t:dir { open read search add_name write getattr search };
57 allow auditd_t initrc_t:unix_dgram_socket sendto;
58
59-allow klogd_t initrc_t:unix_dgram_socket sendto;
60\ No newline at end of file
61+allow klogd_t initrc_t:unix_dgram_socket sendto;
62+
63+allow syslogd_t self:shm create;
64+allow syslogd_t self:sem { create read unix_write write };
65+allow syslogd_t self:shm { read unix_read unix_write write };
66+allow syslogd_t tmpfs_t:file { read write };
67diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
68index 3dcb8493..a87d0e82 100644
69--- a/policy/modules/system/mount.te
70+++ b/policy/modules/system/mount.te
71@@ -231,3 +231,6 @@ optional_policy(`
72 files_etc_filetrans_etc_runtime(unconfined_mount_t, file)
73 unconfined_domain(unconfined_mount_t)
74 ')
75+
76+allow mount_t proc_t:filesystem getattr;
77+allow mount_t initrc_t:udp_socket { read write };
78diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
79index a6f09dfd..68b80de3 100644
80--- a/policy/modules/system/systemd.te
81+++ b/policy/modules/system/systemd.te
82@@ -993,6 +993,11 @@ allow systemd_tmpfiles_t systemd_journal_t:file { relabelfrom relabelto };
83 allow systemd_tmpfiles_t systemd_tmpfiles_conf_t:dir list_dir_perms;
84 allow systemd_tmpfiles_t systemd_tmpfiles_conf_type:file read_file_perms;
85
86+allow systemd_tmpfiles_t init_t:dir search;
87+allow systemd_tmpfiles_t proc_t:filesystem getattr;
88+allow systemd_tmpfiles_t init_t:file read;
89+allow systemd_tmpfiles_t initrc_t:unix_dgram_socket sendto;
90+
91 kernel_getattr_proc(systemd_tmpfiles_t)
92 kernel_read_kernel_sysctls(systemd_tmpfiles_t)
93 kernel_read_network_state(systemd_tmpfiles_t)
94--
952.19.1
96
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0005-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0005-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch
new file mode 100644
index 0000000..60d585b
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0005-fc-bash-apply-usr-bin-bash-context-to-bin-bash.bash.patch
@@ -0,0 +1,30 @@
1From ed53bb0452aab6aee11c6d6442b8524d3b27fa6f Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Thu, 28 Mar 2019 21:37:32 -0400
4Subject: [PATCH 05/34] fc/bash: apply /usr/bin/bash context to /bin/bash.bash
5
6We include /bin/bash.bash as a valid alias for /bin/bash, so ensure we apply
7the proper context to the target for our policy.
8
9Upstream-Status: Inappropriate [only for Yocto]
10
11Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
12---
13 policy/modules/kernel/corecommands.fc | 1 +
14 1 file changed, 1 insertion(+)
15
16diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
17index e7415cac..cf3848db 100644
18--- a/policy/modules/kernel/corecommands.fc
19+++ b/policy/modules/kernel/corecommands.fc
20@@ -141,6 +141,7 @@ ifdef(`distro_gentoo',`
21 /usr/bin/d?ash -- gen_context(system_u:object_r:shell_exec_t,s0)
22 /usr/bin/bash -- gen_context(system_u:object_r:shell_exec_t,s0)
23 /usr/bin/bash2 -- gen_context(system_u:object_r:shell_exec_t,s0)
24+/usr/bin/bash.bash -- gen_context(system_u:object_r:shell_exec_t,s0)
25 /usr/bin/fish -- gen_context(system_u:object_r:shell_exec_t,s0)
26 /usr/bin/git-shell -- gen_context(system_u:object_r:shell_exec_t,s0)
27 /usr/bin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0)
28--
292.19.1
30
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0005-refpolicy-minimum-init-fix-reboot-with-systemd-as-in.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0005-refpolicy-minimum-init-fix-reboot-with-systemd-as-in.patch
new file mode 100644
index 0000000..7d7908f
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0005-refpolicy-minimum-init-fix-reboot-with-systemd-as-in.patch
@@ -0,0 +1,37 @@
1From bf8da1fd057ce11e8ce6e445ccd532fde11868a6 Mon Sep 17 00:00:00 2001
2From: Shrikant Bobade <shrikant_bobade@mentor.com>
3Date: Fri, 26 Aug 2016 17:53:53 +0530
4Subject: [PATCH 5/9] refpolicy-minimum: init: fix reboot with systemd as init
5 manager.
6
7add allow rule to fix avc denial during system reboot.
8
9without this change we are getting:
10
11audit: type=1107 audit(): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=
12system_u:system_r:init_t:s0 msg='avc: denied { reboot } for auid=n/a uid=0
13gid=0 cmdline="/bin/systemctl --force reboot" scontext=system_u:system_r:
14initrc_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=system
15
16Upstream-Status: Pending
17
18Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
19Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
20---
21 policy/modules/system/init.te | 2 +-
22 1 file changed, 1 insertion(+), 1 deletion(-)
23
24diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
25index 15745c83..d6a0270a 100644
26--- a/policy/modules/system/init.te
27+++ b/policy/modules/system/init.te
28@@ -1427,5 +1427,5 @@ allow devpts_t device_t:filesystem associate;
29 allow init_t self:capability2 block_suspend;
30 allow init_t self:capability2 audit_read;
31
32-allow initrc_t init_t:system { start status };
33+allow initrc_t init_t:system { start status reboot };
34 allow initrc_t init_var_run_t:service { start status };
35--
362.19.1
37
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0006-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0006-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch
new file mode 100644
index 0000000..f318c23
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0006-fc-resolv.conf-label-resolv.conf-in-var-run-properly.patch
@@ -0,0 +1,30 @@
1From 8614bc85ab13b72f7f83892ffd227c73b3df42bc Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Thu, 4 Apr 2019 10:45:03 -0400
4Subject: [PATCH 06/34] fc/resolv.conf: label resolv.conf in var/run/ properly
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10
11Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
12---
13 policy/modules/system/sysnetwork.fc | 1 +
14 1 file changed, 1 insertion(+)
15
16diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
17index 1e5432a4..ac7c2dd1 100644
18--- a/policy/modules/system/sysnetwork.fc
19+++ b/policy/modules/system/sysnetwork.fc
20@@ -22,6 +22,7 @@ ifdef(`distro_debian',`
21 /etc/denyhosts.* -- gen_context(system_u:object_r:net_conf_t,s0)
22 /etc/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
23 /etc/yp\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
24+/var/run/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
25
26 /etc/dhcp3(/.*)? gen_context(system_u:object_r:dhcp_etc_t,s0)
27 /etc/dhcp3?/dhclient.* gen_context(system_u:object_r:dhcp_etc_t,s0)
28--
292.19.1
30
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0006-refpolicy-minimum-systemd-mount-enable-required-refp.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0006-refpolicy-minimum-systemd-mount-enable-required-refp.patch
new file mode 100644
index 0000000..4f7d916
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0006-refpolicy-minimum-systemd-mount-enable-required-refp.patch
@@ -0,0 +1,92 @@
1From 853b6611e50369b386a77d5bd8a28eeb9ef4cb9b Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Wed, 3 Apr 2019 14:51:29 -0400
4Subject: [PATCH 6/9] refpolicy-minimum: systemd: mount: enable required
5 refpolicy booleans
6
7enable required refpolicy booleans for these modules
8
9i. mount: allow_mount_anyfile
10without enabling this boolean we are getting below avc denial
11
12audit(): avc: denied { mounton } for pid=462 comm="mount" path="/run/media
13/mmcblk2p1" dev="tmpfs" ino=11523 scontext=system_u:system_r:mount_t:s0
14tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=dir permissive=0
15
16This avc can be allowed using the boolean 'allow_mount_anyfile'
17allow mount_t initrc_var_run_t:dir mounton;
18
19ii. systemd : systemd_tmpfiles_manage_all
20without enabling this boolean we are not getting access to mount systemd
21essential tmpfs during bootup, also not getting access to create audit.log
22
23audit(): avc: denied { search } for pid=168 comm="systemd-tmpfile" name=
24"sys" dev="proc" ino=4026531855 scontext=system_u:system_r:systemd_tmpfiles
25_t:s0 tcontext=system_u:object_r:sysctl_t:s0 tclass=dir permissive=0
26
27 ls /var/log
28 /var/log -> volatile/log
29:~#
30
31The old refpolicy included a pre-generated booleans.conf that could be
32patched. That's no longer the case so we're left with a few options,
33tweak the default directly or create a template booleans.conf file which
34will be updated during build time. Since this is intended to be applied
35only for specific configuraitons it seems like the same either way and
36this avoids us playing games to work around .gitignore.
37
38Upstream-Status: Pending
39
40Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
41Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
42---
43 policy/booleans.conf | 9 +++++++++
44 policy/modules/system/mount.te | 2 +-
45 policy/modules/system/systemd.te | 2 +-
46 3 files changed, 11 insertions(+), 2 deletions(-)
47 create mode 100644 policy/booleans.conf
48
49diff --git a/policy/booleans.conf b/policy/booleans.conf
50new file mode 100644
51index 00000000..850f56ed
52--- /dev/null
53+++ b/policy/booleans.conf
54@@ -0,0 +1,9 @@
55+#
56+# Allow the mount command to mount any directory or file.
57+#
58+allow_mount_anyfile = true
59+
60+#
61+# Enable support for systemd-tmpfiles to manage all non-security files.
62+#
63+systemd_tmpfiles_manage_all = true
64diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
65index a87d0e82..868052b7 100644
66--- a/policy/modules/system/mount.te
67+++ b/policy/modules/system/mount.te
68@@ -10,7 +10,7 @@ policy_module(mount, 1.20.0)
69 ## Allow the mount command to mount any directory or file.
70 ## </p>
71 ## </desc>
72-gen_tunable(allow_mount_anyfile, false)
73+gen_tunable(allow_mount_anyfile, true)
74
75 attribute_role mount_roles;
76 roleattribute system_r mount_roles;
77diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
78index 68b80de3..a1ef6990 100644
79--- a/policy/modules/system/systemd.te
80+++ b/policy/modules/system/systemd.te
81@@ -10,7 +10,7 @@ policy_module(systemd, 1.7.0)
82 ## Enable support for systemd-tmpfiles to manage all non-security files.
83 ## </p>
84 ## </desc>
85-gen_tunable(systemd_tmpfiles_manage_all, false)
86+gen_tunable(systemd_tmpfiles_manage_all, true)
87
88 ## <desc>
89 ## <p>
90--
912.19.1
92
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0007-fc-login-apply-login-context-to-login.shadow.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0007-fc-login-apply-login-context-to-login.shadow.patch
new file mode 100644
index 0000000..8c71c90
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0007-fc-login-apply-login-context-to-login.shadow.patch
@@ -0,0 +1,27 @@
1From c1f7e3033057dfb613bd92d723094b06c00e82f8 Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Thu, 28 Mar 2019 21:43:53 -0400
4Subject: [PATCH 07/34] fc/login: apply login context to login.shadow
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
9---
10 policy/modules/system/authlogin.fc | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/policy/modules/system/authlogin.fc b/policy/modules/system/authlogin.fc
14index e22945cd..a42bc0da 100644
15--- a/policy/modules/system/authlogin.fc
16+++ b/policy/modules/system/authlogin.fc
17@@ -5,6 +5,7 @@
18 /etc/shadow.* -- gen_context(system_u:object_r:shadow_t,s0)
19
20 /usr/bin/login -- gen_context(system_u:object_r:login_exec_t,s0)
21+/usr/bin/login\.shadow -- gen_context(system_u:object_r:login_exec_t,s0)
22 /usr/bin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0)
23 /usr/bin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
24 /usr/bin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
25--
262.19.1
27
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0007-refpolicy-minimum-systemd-fix-for-login-journal-serv.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0007-refpolicy-minimum-systemd-fix-for-login-journal-serv.patch
new file mode 100644
index 0000000..27cbc9f
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0007-refpolicy-minimum-systemd-fix-for-login-journal-serv.patch
@@ -0,0 +1,103 @@
1From 34630eecb211199c60c9b01fd77f0ede6e182712 Mon Sep 17 00:00:00 2001
2From: Shrikant Bobade <shrikant_bobade@mentor.com>
3Date: Fri, 26 Aug 2016 17:54:09 +0530
4Subject: [PATCH 7/9] refpolicy-minimum: systemd: fix for login & journal
5 service
6
71. fix for systemd services: login & journal wile using refpolicy-minimum and
8systemd as init manager.
92. fix login duration after providing root password.
10
11without these changes we are getting avc denails like these and below
12systemd services failure:
13
14audit[]: AVC avc: denied { write } for pid=422 comm="login" path="/run/
15systemd/sessions/c1.ref" dev="tmpfs" ino=13455 scontext=system_u:system_r:
16local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_var_run_t:s0
17tclass=fifo_file permissive=0
18
19audit[]: AVC avc: denied { open } for pid=216 comm="systemd-tmpfile" path
20="/proc/1/environ" dev="proc" ino=9221 scontext=system_u:system_r:
21systemd_tmpfiles_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=file
22
23audit[]: USER_AVC pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:
24system_r:init_t:s0 msg='avc: denied { stop } for auid=n/a uid=0 gid=0 path
25="/lib/systemd/system/systemd-journald.service" cmdline="/bin/journalctl
26--flush" scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:
27lib_t:s0 tclass=service
28
29[FAILED] Failed to start Flush Journal to Persistent Storage.
30See 'systemctl status systemd-journal-flush.service' for details.
31
32[FAILED] Failed to start Login Service.
33See 'systemctl status systemd-logind.service' for details.
34
35[FAILED] Failed to start Avahi mDNS/DNS-SD Stack.
36See 'systemctl status avahi-daemon.service' for details.
37
38Upstream-Status: Pending
39
40Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
41Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
42---
43 policy/modules/system/init.te | 2 ++
44 policy/modules/system/locallogin.te | 3 +++
45 policy/modules/system/systemd.if | 6 ++++--
46 policy/modules/system/systemd.te | 2 +-
47 4 files changed, 10 insertions(+), 3 deletions(-)
48
49diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
50index d6a0270a..035c7ad2 100644
51--- a/policy/modules/system/init.te
52+++ b/policy/modules/system/init.te
53@@ -1429,3 +1429,5 @@ allow init_t self:capability2 audit_read;
54
55 allow initrc_t init_t:system { start status reboot };
56 allow initrc_t init_var_run_t:service { start status };
57+
58+allow initrc_t init_var_run_t:service stop;
59diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
60index 75750e4c..2c2cfc7d 100644
61--- a/policy/modules/system/locallogin.te
62+++ b/policy/modules/system/locallogin.te
63@@ -298,3 +298,6 @@ allow local_login_t var_run_t:file { open read write lock};
64 allow local_login_t var_run_t:sock_file write;
65 allow local_login_t tmpfs_t:dir { add_name write search};
66 allow local_login_t tmpfs_t:file { create open read write lock };
67+allow local_login_t init_var_run_t:fifo_file write;
68+allow local_login_t initrc_t:dbus send_msg;
69+allow initrc_t local_login_t:dbus send_msg;
70diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
71index 8fc61843..1166505f 100644
72--- a/policy/modules/system/systemd.if
73+++ b/policy/modules/system/systemd.if
74@@ -920,9 +920,11 @@ interface(`systemd_service_file_operations',`
75 #
76 interface(`systemd_service_lib_function',`
77 gen_require(`
78- class service start;
79+ class service { start status stop };
80+ class file { execmod open };
81 ')
82
83- allow initrc_t $1:service start;
84+ allow initrc_t $1:service { start status stop };
85+ allow initrc_t $1:file execmod;
86
87 ')
88diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
89index a1ef6990..a62c3c38 100644
90--- a/policy/modules/system/systemd.te
91+++ b/policy/modules/system/systemd.te
92@@ -995,7 +995,7 @@ allow systemd_tmpfiles_t systemd_tmpfiles_conf_type:file read_file_perms;
93
94 allow systemd_tmpfiles_t init_t:dir search;
95 allow systemd_tmpfiles_t proc_t:filesystem getattr;
96-allow systemd_tmpfiles_t init_t:file read;
97+allow systemd_tmpfiles_t init_t:file { open getattr read };
98 allow systemd_tmpfiles_t initrc_t:unix_dgram_socket sendto;
99
100 kernel_getattr_proc(systemd_tmpfiles_t)
101--
1022.19.1
103
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0008-fc-bind-fix-real-path-for-bind.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0008-fc-bind-fix-real-path-for-bind.patch
new file mode 100644
index 0000000..7a9f3f2
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0008-fc-bind-fix-real-path-for-bind.patch
@@ -0,0 +1,31 @@
1From 878b005462f7b2208427af60ed6b670dca697b6c Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Thu, 28 Mar 2019 21:58:53 -0400
4Subject: [PATCH 08/34] fc/bind: fix real path for bind
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/services/bind.fc | 2 ++
12 1 file changed, 2 insertions(+)
13
14diff --git a/policy/modules/services/bind.fc b/policy/modules/services/bind.fc
15index b4879dc1..59498e25 100644
16--- a/policy/modules/services/bind.fc
17+++ b/policy/modules/services/bind.fc
18@@ -1,8 +1,10 @@
19 /etc/rc\.d/init\.d/named -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
20+/etc/rc\.d/init\.d/bind -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
21 /etc/rc\.d/init\.d/unbound -- gen_context(system_u:object_r:named_initrc_exec_t,s0)
22
23 /etc/bind(/.*)? gen_context(system_u:object_r:named_zone_t,s0)
24 /etc/bind/named\.conf.* -- gen_context(system_u:object_r:named_conf_t,s0)
25+/etc/bind/rndc\.conf -- gen_context(system_u:object_r:named_conf_t,s0)
26 /etc/bind/rndc\.key -- gen_context(system_u:object_r:dnssec_t,s0)
27 /etc/dnssec-trigger/dnssec_trigger_server\.key -- gen_context(system_u:object_r:dnssec_t,s0)
28 /etc/named\.rfc1912\.zones -- gen_context(system_u:object_r:named_conf_t,s0)
29--
302.19.1
31
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0008-refpolicy-minimum-systemd-fix-for-systemd-tmp-files-.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0008-refpolicy-minimum-systemd-fix-for-systemd-tmp-files-.patch
new file mode 100644
index 0000000..efe81a4
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0008-refpolicy-minimum-systemd-fix-for-systemd-tmp-files-.patch
@@ -0,0 +1,109 @@
1From 6ac3c261a7cfc3a5d38ccc420f1ea371258c49fa Mon Sep 17 00:00:00 2001
2From: Shrikant Bobade <shrikant_bobade@mentor.com>
3Date: Fri, 26 Aug 2016 17:54:17 +0530
4Subject: [PATCH 8/9] refpolicy-minimum: systemd: fix for systemd tmp-files
5 services
6
7fix for systemd tmp files setup service while using refpolicy-minimum and
8systemd as init manager.
9
10these allow rules require kernel domain & files access, so added interfaces
11at systemd.te to merge these allow rules.
12
13without these changes we are getting avc denails like these and below
14systemd services failure:
15
16audit[]: AVC avc: denied { getattr } for pid=232 comm="systemd-tmpfile"
17path="/var/tmp" dev="mmcblk2p2" ino=4993 scontext=system_u:system_r:systemd
18_tmpfiles_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=lnk_file
19
20audit[]: AVC avc: denied { search } for pid=232 comm="systemd-tmpfile"
21name="kernel" dev="proc" ino=9341 scontext=system_u:system_r:
22systemd_tmpfiles_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0
23tclass=dir permissive=0
24
25[FAILED] Failed to start Create Static Device Nodes in /dev.
26See 'systemctl status systemd-tmpfiles-setup-dev.service' for details.
27
28[FAILED] Failed to start Create Volatile Files and Directories.
29See 'systemctl status systemd-tmpfiles-setup.service' for details.
30
31Upstream-Status: Pending
32
33Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
34Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
35---
36 policy/modules/kernel/files.if | 19 +++++++++++++++++++
37 policy/modules/kernel/kernel.if | 21 +++++++++++++++++++++
38 policy/modules/system/systemd.te | 2 ++
39 3 files changed, 42 insertions(+)
40
41diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
42index eb067ad3..ff74f55a 100644
43--- a/policy/modules/kernel/files.if
44+++ b/policy/modules/kernel/files.if
45@@ -7076,3 +7076,22 @@ interface(`files_unconfined',`
46
47 typeattribute $1 files_unconfined_type;
48 ')
49+
50+########################################
51+## <summary>
52+## systemd tmp files access to kernel tmp files domain
53+## </summary>
54+## <param name="domain">
55+## <summary>
56+## Domain allowed access.
57+## </summary>
58+## </param>
59+#
60+interface(`systemd_service_allow_kernel_files_domain_to_tmp_t',`
61+ gen_require(`
62+ type tmp_t;
63+ class lnk_file getattr;
64+ ')
65+
66+ allow $1 tmp_t:lnk_file getattr;
67+')
68diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
69index 1ad282aa..342eb033 100644
70--- a/policy/modules/kernel/kernel.if
71+++ b/policy/modules/kernel/kernel.if
72@@ -3584,3 +3584,24 @@ interface(`kernel_ib_manage_subnet_unlabeled_endports',`
73 allow $1 unlabeled_t:infiniband_endport manage_subnet;
74 ')
75
76+########################################
77+## <summary>
78+## systemd tmp files access to kernel sysctl domain
79+## </summary>
80+## <param name="domain">
81+## <summary>
82+## Domain allowed access.
83+## </summary>
84+## </param>
85+#
86+interface(`systemd_service_allow_kernel_domain_access_to_sysctl_kernel_t',`
87+ gen_require(`
88+ type sysctl_kernel_t;
89+ class dir search;
90+ class file { open read };
91+ ')
92+
93+ allow $1 sysctl_kernel_t:dir search;
94+ allow $1 sysctl_kernel_t:file { open read };
95+
96+')
97diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
98index a62c3c38..9b696823 100644
99--- a/policy/modules/system/systemd.te
100+++ b/policy/modules/system/systemd.te
101@@ -1121,3 +1121,5 @@ files_var_filetrans(systemd_update_done_t, systemd_update_run_t, file, ".updated
102
103 kernel_read_system_state(systemd_update_done_t)
104
105+systemd_service_allow_kernel_domain_access_to_sysctl_kernel_t(systemd_tmpfiles_t)
106+systemd_service_allow_kernel_files_domain_to_tmp_t(systemd_tmpfiles_t)
107--
1082.19.1
109
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0009-fc-hwclock-add-hwclock-alternatives.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0009-fc-hwclock-add-hwclock-alternatives.patch
new file mode 100644
index 0000000..6039f49
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0009-fc-hwclock-add-hwclock-alternatives.patch
@@ -0,0 +1,28 @@
1From d21287d2c0b63e19e1004f098a1934b6b02a0c05 Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Thu, 28 Mar 2019 21:59:18 -0400
4Subject: [PATCH 09/34] fc/hwclock: add hwclock alternatives
5
6Upstream-Status: Pending
7
8Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
9---
10 policy/modules/system/clock.fc | 5 ++++-
11 1 file changed, 4 insertions(+), 1 deletion(-)
12
13diff --git a/policy/modules/system/clock.fc b/policy/modules/system/clock.fc
14index 30196589..e0dc4b6f 100644
15--- a/policy/modules/system/clock.fc
16+++ b/policy/modules/system/clock.fc
17@@ -2,4 +2,7 @@
18
19 /usr/bin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)
20
21-/usr/sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)
22+/usr/sbin/hwclock\.util-linux -- gen_context(system_u:object_r:hwclock_exec_t,s0)
23+/usr/sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)
24+/usr/lib/busybox/sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)
25+/sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)
26--
272.19.1
28
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0009-refpolicy-minimum-systemd-fix-for-syslog.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0009-refpolicy-minimum-systemd-fix-for-syslog.patch
new file mode 100644
index 0000000..f67221a
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0009-refpolicy-minimum-systemd-fix-for-syslog.patch
@@ -0,0 +1,70 @@
1From 57d554187619e32ecf925ecb015a60f1fca26fb8 Mon Sep 17 00:00:00 2001
2From: Shrikant Bobade <shrikant_bobade@mentor.com>
3Date: Fri, 26 Aug 2016 17:54:29 +0530
4Subject: [PATCH 9/9] refpolicy-minimum: systemd: fix for syslog
5
6syslog & getty related allow rules required to fix the syslog mixup with
7boot log, while using systemd as init manager.
8
9without this change we are getting these avc denials:
10
11audit: avc: denied { search } for pid=484 comm="syslogd" name="/"
12dev="tmpfs" ino=7269 scontext=system_u:system_r:syslogd_t:s0 tcontext=
13system_u:object_r:tmpfs_t:s0 tclass=dir permissive=0
14
15audit: avc: denied { write } for pid=372 comm="syslogd" name="log" dev=
16"tmpfs" ino=954 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:
17object_r:tmpfs_t:s0 tclass=dir permissive=0
18
19audit: avc: denied { add_name } for pid=390 comm="syslogd" name=
20"messages" scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r
21:tmpfs_t:s0 tclass=dir permissive=0
22
23audit: avc: denied { sendto } for pid=558 comm="agetty" path="/run/systemd
24/journal/dev-log" scontext=system_u:system_r:getty_t:s0 tcontext=system_u:
25system_r:initrc_t:s0 tclass=unix_dgram_socket permissive=0
26
27audit: avc: denied { create } for pid=374 comm="syslogd" name="messages"
28scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:tmpfs_t:
29s0 tclass=file permissive=0
30
31audit: avc: denied { append } for pid=423 comm="syslogd" name="messages"
32dev="tmpfs" ino=7995 scontext=system_u:system_r:syslogd_t:s0 tcontext=
33system_u:object_r:tmpfs_t:s0 tclass=file permissive=0
34
35audit: avc: denied { getattr } for pid=425 comm="syslogd" path="/var/
36volatile/log/messages" dev="tmpfs" ino=8857 scontext=system_u:system_r:
37syslogd_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0
38
39Upstream-Status: Pending
40
41Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
42Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
43---
44 policy/modules/system/getty.te | 1 +
45 policy/modules/system/logging.te | 3 ++-
46 2 files changed, 3 insertions(+), 1 deletion(-)
47
48diff --git a/policy/modules/system/getty.te b/policy/modules/system/getty.te
49index 423db0cc..9ab03956 100644
50--- a/policy/modules/system/getty.te
51+++ b/policy/modules/system/getty.te
52@@ -132,3 +132,4 @@ optional_policy(`
53
54 allow getty_t tmpfs_t:dir search;
55 allow getty_t tmpfs_t:file { open write lock };
56+allow getty_t initrc_t:unix_dgram_socket sendto;
57diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
58index 520f7da6..4e02dab8 100644
59--- a/policy/modules/system/logging.te
60+++ b/policy/modules/system/logging.te
61@@ -632,4 +632,5 @@ allow klogd_t initrc_t:unix_dgram_socket sendto;
62 allow syslogd_t self:shm create;
63 allow syslogd_t self:sem { create read unix_write write };
64 allow syslogd_t self:shm { read unix_read unix_write write };
65-allow syslogd_t tmpfs_t:file { read write };
66+allow syslogd_t tmpfs_t:file { read write create getattr append open };
67+allow syslogd_t tmpfs_t:dir { search write add_name };
68--
692.19.1
70
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0010-fc-dmesg-apply-policy-to-dmesg-alternatives.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0010-fc-dmesg-apply-policy-to-dmesg-alternatives.patch
new file mode 100644
index 0000000..dc715c4
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0010-fc-dmesg-apply-policy-to-dmesg-alternatives.patch
@@ -0,0 +1,24 @@
1From 0ee40e0a68645e23f59842929629a94ebe9873b4 Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Fri, 29 Mar 2019 08:26:55 -0400
4Subject: [PATCH 10/34] fc/dmesg: apply policy to dmesg alternatives
5
6Upstream-Status: Pending
7
8Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
9---
10 policy/modules/admin/dmesg.fc | 4 +++-
11 1 file changed, 3 insertions(+), 1 deletion(-)
12
13diff --git a/policy/modules/admin/dmesg.fc b/policy/modules/admin/dmesg.fc
14index e52fdfcf..85d15127 100644
15--- a/policy/modules/admin/dmesg.fc
16+++ b/policy/modules/admin/dmesg.fc
17@@ -1 +1,3 @@
18-/usr/bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)
19+/usr/bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)
20+/usr/bin/dmesg\.util-linux -- gen_context(system_u:object_r:dmesg_exec_t,s0)
21+/usr/lib/busybox/bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)
22--
232.19.1
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0011-fc-ssh-apply-policy-to-ssh-alternatives.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0011-fc-ssh-apply-policy-to-ssh-alternatives.patch
new file mode 100644
index 0000000..09576fa
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0011-fc-ssh-apply-policy-to-ssh-alternatives.patch
@@ -0,0 +1,27 @@
1From 10548eeaba694ff4320fdcbddc9e6cbb71856280 Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Fri, 29 Mar 2019 09:20:58 -0400
4Subject: [PATCH 11/34] fc/ssh: apply policy to ssh alternatives
5
6Upstream-Status: Pending
7
8Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
9---
10 policy/modules/services/ssh.fc | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
14index 4ac3e733..1f453091 100644
15--- a/policy/modules/services/ssh.fc
16+++ b/policy/modules/services/ssh.fc
17@@ -4,6 +4,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
18 /etc/ssh/ssh_host.*_key -- gen_context(system_u:object_r:sshd_key_t,s0)
19
20 /usr/bin/ssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
21+/usr/bin/ssh\.openssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
22 /usr/bin/ssh-agent -- gen_context(system_u:object_r:ssh_agent_exec_t,s0)
23 /usr/bin/ssh-keygen -- gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
24 /usr/bin/sshd -- gen_context(system_u:object_r:sshd_exec_t,s0)
25--
262.19.1
27
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0012-fc-sysnetwork-apply-policy-to-ip-alternatives.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0012-fc-sysnetwork-apply-policy-to-ip-alternatives.patch
new file mode 100644
index 0000000..f02bd3a
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0012-fc-sysnetwork-apply-policy-to-ip-alternatives.patch
@@ -0,0 +1,48 @@
1From 457f278717ef53e19392c40ea8645ca216c0ae83 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Tue, 9 Jun 2015 21:22:52 +0530
4Subject: [PATCH 12/34] fc/sysnetwork: apply policy to ip alternatives
5
6Upstream-Status: Pending
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
10Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
11---
12 policy/modules/system/sysnetwork.fc | 10 ++++++++++
13 1 file changed, 10 insertions(+)
14
15diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
16index ac7c2dd1..4e441503 100644
17--- a/policy/modules/system/sysnetwork.fc
18+++ b/policy/modules/system/sysnetwork.fc
19@@ -60,6 +60,8 @@ ifdef(`distro_redhat',`
20 /usr/sbin/dhcpcd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
21 /usr/sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
22 /usr/sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
23+/usr/sbin/ifconfig\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
24+/usr/sbin/ip\.iproute2 -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
25 /usr/sbin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
26 /usr/sbin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
27 /usr/sbin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
28@@ -67,9 +69,17 @@ ifdef(`distro_redhat',`
29 /usr/sbin/iw -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
30 /usr/sbin/iwconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
31 /usr/sbin/mii-tool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
32+/usr/sbin/mii-tool\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
33 /usr/sbin/pump -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
34 /usr/sbin/tc -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
35
36+#
37+# /usr/lib/busybox
38+#
39+/usr/lib/busybox/bin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
40+/usr/lib/busybox/bin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
41+/usr/lib/busybox/sbin/mii-tool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
42+
43 #
44 # /var
45 #
46--
472.19.1
48
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0013-fc-udev-apply-policy-to-udevadm-in-libexec.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0013-fc-udev-apply-policy-to-udevadm-in-libexec.patch
new file mode 100644
index 0000000..495b82f
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0013-fc-udev-apply-policy-to-udevadm-in-libexec.patch
@@ -0,0 +1,28 @@
1From e38e269b172ec75dcd218cfeac64271fbb3d17db Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Fri, 29 Mar 2019 09:36:08 -0400
4Subject: [PATCH 13/34] fc/udev: apply policy to udevadm in libexec
5
6Upstream-Status: Pending
7
8Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
9---
10 policy/modules/system/udev.fc | 2 ++
11 1 file changed, 2 insertions(+)
12
13diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc
14index 009d821a..cc438609 100644
15--- a/policy/modules/system/udev.fc
16+++ b/policy/modules/system/udev.fc
17@@ -28,6 +28,8 @@ ifdef(`distro_debian',`
18 /usr/sbin/udevstart -- gen_context(system_u:object_r:udev_exec_t,s0)
19 /usr/sbin/wait_for_sysfs -- gen_context(system_u:object_r:udev_exec_t,s0)
20
21+/usr/libexec/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
22+
23 ifdef(`distro_redhat',`
24 /usr/sbin/start_udev -- gen_context(system_u:object_r:udev_exec_t,s0)
25 ')
26--
272.19.1
28
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0014-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0014-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch
new file mode 100644
index 0000000..6ffabe4
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0014-fc-rpm-apply-rpm_exec-policy-to-cpio-binaries.patch
@@ -0,0 +1,29 @@
1From 8d730316e752601949346c9ebd4aff8a3cb2b1bf Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Fri, 29 Mar 2019 09:54:07 -0400
4Subject: [PATCH 14/34] fc/rpm: apply rpm_exec policy to cpio binaries
5
6Upstream-Status: Pending
7
8Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
9---
10 policy/modules/admin/rpm.fc | 5 ++++-
11 1 file changed, 4 insertions(+), 1 deletion(-)
12
13diff --git a/policy/modules/admin/rpm.fc b/policy/modules/admin/rpm.fc
14index 578d465c..f2b8003a 100644
15--- a/policy/modules/admin/rpm.fc
16+++ b/policy/modules/admin/rpm.fc
17@@ -65,5 +65,8 @@ ifdef(`distro_redhat',`
18 /run/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_run_t,s0)
19
20 ifdef(`enable_mls',`
21-/usr/sbin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
22+/usr/sbin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
23+/usr/bin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
24+/usr/bin/cpio.cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
25 ')
26+
27--
282.19.1
29
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0015-fc-su-apply-policy-to-su-alternatives.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0015-fc-su-apply-policy-to-su-alternatives.patch
new file mode 100644
index 0000000..c0fbb69
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0015-fc-su-apply-policy-to-su-alternatives.patch
@@ -0,0 +1,26 @@
1From d9f2d5857c1d558fa09f7e7864bba8427437bea6 Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Thu, 13 Feb 2014 00:33:07 -0500
4Subject: [PATCH 15/34] fc/su: apply policy to su alternatives
5
6Upstream-Status: Pending
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/admin/su.fc | 2 ++
12 1 file changed, 2 insertions(+)
13
14diff --git a/policy/modules/admin/su.fc b/policy/modules/admin/su.fc
15index 3375c969..435a6892 100644
16--- a/policy/modules/admin/su.fc
17+++ b/policy/modules/admin/su.fc
18@@ -1,3 +1,5 @@
19 /usr/(local/)?bin/ksu -- gen_context(system_u:object_r:su_exec_t,s0)
20 /usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0)
21 /usr/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
22+/usr/bin/su\.shadow -- gen_context(system_u:object_r:su_exec_t,s0)
23+/usr/bin/su\.util-linux -- gen_context(system_u:object_r:su_exec_t,s0)
24--
252.19.1
26
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0016-fc-fstools-fix-real-path-for-fstools.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0016-fc-fstools-fix-real-path-for-fstools.patch
new file mode 100644
index 0000000..34e9830
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0016-fc-fstools-fix-real-path-for-fstools.patch
@@ -0,0 +1,76 @@
1From 5d8f2e090c9dbb270156c2f76f1614b03f3b0191 Mon Sep 17 00:00:00 2001
2From: Wenzong Fan <wenzong.fan@windriver.com>
3Date: Mon, 27 Jan 2014 03:54:01 -0500
4Subject: [PATCH 16/34] fc/fstools: fix real path for fstools
5
6Upstream-Status: Pending
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
10Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
11---
12 policy/modules/system/fstools.fc | 12 ++++++++++++
13 1 file changed, 12 insertions(+)
14
15diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
16index 8fbd5ce4..d719e22c 100644
17--- a/policy/modules/system/fstools.fc
18+++ b/policy/modules/system/fstools.fc
19@@ -58,6 +58,7 @@
20 /usr/sbin/addpart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
21 /usr/sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
22 /usr/sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
23+/usr/sbin/blkid\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
24 /usr/sbin/blockdev -- gen_context(system_u:object_r:fsadm_exec_t,s0)
25 /usr/sbin/cfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
26 /usr/sbin/clubufflush -- gen_context(system_u:object_r:fsadm_exec_t,s0)
27@@ -72,10 +73,12 @@
28 /usr/sbin/efibootmgr -- gen_context(system_u:object_r:fsadm_exec_t,s0)
29 /usr/sbin/fatsort -- gen_context(system_u:object_r:fsadm_exec_t,s0)
30 /usr/sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
31+/usr/sbin/fdisk\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
32 /usr/sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
33 /usr/sbin/fsck.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
34 /usr/sbin/gdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
35 /usr/sbin/hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
36+/usr/sbin/hdparm\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
37 /usr/sbin/install-mbr -- gen_context(system_u:object_r:fsadm_exec_t,s0)
38 /usr/sbin/jfs_.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
39 /usr/sbin/losetup.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
40@@ -88,17 +91,20 @@
41 /usr/sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
42 /usr/sbin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
43 /usr/sbin/mkswap -- gen_context(system_u:object_r:fsadm_exec_t,s0)
44+/usr/sbin/mkswap\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
45 /usr/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
46 /usr/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
47 /usr/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
48 /usr/sbin/raidautorun -- gen_context(system_u:object_r:fsadm_exec_t,s0)
49 /usr/sbin/raidstart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
50+/usr/sbin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0)
51 /usr/sbin/reiserfs(ck|tune) -- gen_context(system_u:object_r:fsadm_exec_t,s0)
52 /usr/sbin/resize.*fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
53 /usr/sbin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0)
54 /usr/sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
55 /usr/sbin/smartctl -- gen_context(system_u:object_r:fsadm_exec_t,s0)
56 /usr/sbin/swapoff -- gen_context(system_u:object_r:fsadm_exec_t,s0)
57+/usr/sbin/swapoff\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
58 /usr/sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
59 /usr/sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
60 /usr/sbin/zdb -- gen_context(system_u:object_r:fsadm_exec_t,s0)
61@@ -108,6 +114,12 @@
62 /usr/sbin/zstreamdump -- gen_context(system_u:object_r:fsadm_exec_t,s0)
63 /usr/sbin/ztest -- gen_context(system_u:object_r:fsadm_exec_t,s0)
64
65+/usr/lib/busybox/sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
66+/usr/lib/busybox/sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
67+/usr/lib/busybox/sbin/mkswap -- gen_context(system_u:object_r:fsadm_exec_t,s0)
68+/usr/lib/busybox/sbin/swapoff -- gen_context(system_u:object_r:fsadm_exec_t,s0)
69+/usr/lib/busybox/sbin/swapon -- gen_context(system_u:object_r:fsadm_exec_t,s0)
70+
71 /var/swap -- gen_context(system_u:object_r:swapfile_t,s0)
72
73 /var/log/fsck(/.*)? gen_context(system_u:object_r:fsadm_log_t,s0)
74--
752.19.1
76
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0017-policy-module-logging-Add-the-syslogd_t-to-trusted-o.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0017-policy-module-logging-Add-the-syslogd_t-to-trusted-o.patch
new file mode 100644
index 0000000..8455c08
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0017-policy-module-logging-Add-the-syslogd_t-to-trusted-o.patch
@@ -0,0 +1,33 @@
1From 628281e2e192269468cbe2c2818b6cab40975532 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 17/34] policy/module/logging: Add the syslogd_t to trusted
5 object
6
7We add the syslogd_t to trusted object, because other process need
8to have the right to connectto/sendto /dev/log.
9
10Upstream-Status: Inappropriate [only for Poky]
11
12Signed-off-by: Roy.Li <rongqing.li@windriver.com>
13Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
14Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
15---
16 policy/modules/system/logging.te | 1 +
17 1 file changed, 1 insertion(+)
18
19diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
20index 07ed546d..a7b69932 100644
21--- a/policy/modules/system/logging.te
22+++ b/policy/modules/system/logging.te
23@@ -501,6 +501,7 @@ fs_getattr_all_fs(syslogd_t)
24 fs_search_auto_mountpoints(syslogd_t)
25
26 mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
27+mls_trusted_object(syslogd_t) # Other process need to have the right to connectto/sendto /dev/log
28
29 term_write_console(syslogd_t)
30 # Allow syslog to a terminal
31--
322.19.1
33
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0018-policy-module-logging-add-rules-for-the-symlink-of-v.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0018-policy-module-logging-add-rules-for-the-symlink-of-v.patch
new file mode 100644
index 0000000..b253f84
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0018-policy-module-logging-add-rules-for-the-symlink-of-v.patch
@@ -0,0 +1,100 @@
1From 0036dfb42db831e2dd6c6dc71c093e983a30dbd6 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 18/34] policy/module/logging: add rules for the symlink of
5 /var/log
6
7/var/log is a symlink in poky, so we need allow rules for files to read
8lnk_file while doing search/list/delete/rw... in /var/log/ directory.
9
10Upstream-Status: Inappropriate [only for Poky]
11
12Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
13Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
14---
15 policy/modules/system/logging.fc | 1 +
16 policy/modules/system/logging.if | 6 ++++++
17 policy/modules/system/logging.te | 2 ++
18 3 files changed, 9 insertions(+)
19
20diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
21index 0cf108e0..5bec7e99 100644
22--- a/policy/modules/system/logging.fc
23+++ b/policy/modules/system/logging.fc
24@@ -55,6 +55,7 @@ ifdef(`distro_suse', `
25 /var/dnscache/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
26
27 /var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
28+/var/log -l gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
29 /var/log/.* gen_context(system_u:object_r:var_log_t,s0)
30 /var/log/dmesg -- gen_context(system_u:object_r:var_log_t,s0)
31 /var/log/syslog -- gen_context(system_u:object_r:var_log_t,s0)
32diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
33index 16091eb6..e83cb5b5 100644
34--- a/policy/modules/system/logging.if
35+++ b/policy/modules/system/logging.if
36@@ -948,10 +948,12 @@ interface(`logging_append_all_inherited_logs',`
37 interface(`logging_read_all_logs',`
38 gen_require(`
39 attribute logfile;
40+ type var_log_t;
41 ')
42
43 files_search_var($1)
44 allow $1 logfile:dir list_dir_perms;
45+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
46 read_files_pattern($1, logfile, logfile)
47 ')
48
49@@ -970,10 +972,12 @@ interface(`logging_read_all_logs',`
50 interface(`logging_exec_all_logs',`
51 gen_require(`
52 attribute logfile;
53+ type var_log_t;
54 ')
55
56 files_search_var($1)
57 allow $1 logfile:dir list_dir_perms;
58+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
59 can_exec($1, logfile)
60 ')
61
62@@ -1075,6 +1079,7 @@ interface(`logging_read_generic_logs',`
63
64 files_search_var($1)
65 allow $1 var_log_t:dir list_dir_perms;
66+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
67 read_files_pattern($1, var_log_t, var_log_t)
68 ')
69
70@@ -1176,6 +1181,7 @@ interface(`logging_manage_generic_logs',`
71
72 files_search_var($1)
73 manage_files_pattern($1, var_log_t, var_log_t)
74+ allow $1 var_log_t:lnk_file read_lnk_file_perms;
75 ')
76
77 ########################################
78diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
79index a7b69932..fa5664b0 100644
80--- a/policy/modules/system/logging.te
81+++ b/policy/modules/system/logging.te
82@@ -161,6 +161,7 @@ manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
83 allow auditd_t auditd_log_t:dir setattr;
84 manage_lnk_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
85 allow auditd_t var_log_t:dir search_dir_perms;
86+allow auditd_t var_log_t:lnk_file read_lnk_file_perms;
87
88 manage_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
89 manage_sock_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
90@@ -288,6 +289,7 @@ allow audisp_remote_t self:capability { setpcap setuid };
91 allow audisp_remote_t self:process { getcap setcap };
92 allow audisp_remote_t self:tcp_socket create_socket_perms;
93 allow audisp_remote_t var_log_t:dir search_dir_perms;
94+allow audisp_remote_t var_log_t:lnk_file read_lnk_file_perms;
95
96 manage_dirs_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
97 manage_files_pattern(audisp_remote_t, audit_spool_t, audit_spool_t)
98--
992.19.1
100
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0019-policy-module-logging-add-rules-for-syslogd-symlink-.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0019-policy-module-logging-add-rules-for-syslogd-symlink-.patch
new file mode 100644
index 0000000..588c5c6
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0019-policy-module-logging-add-rules-for-syslogd-symlink-.patch
@@ -0,0 +1,33 @@
1From 51e282aa2730e4c6e038d42a84a561c080f41187 Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Fri, 29 Mar 2019 10:33:18 -0400
4Subject: [PATCH 19/34] policy/module/logging: add rules for syslogd symlink of
5 /var/log
6
7We have added rules for the symlink of /var/log in logging.if, while
8syslogd_t uses /var/log but does not use the interfaces in logging.if. So
9still need add a individual rule for syslogd_t.
10
11Upstream-Status: Inappropriate [only for Poky]
12
13Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
14Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
15---
16 policy/modules/system/logging.te | 1 +
17 1 file changed, 1 insertion(+)
18
19diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
20index fa5664b0..63e92a8e 100644
21--- a/policy/modules/system/logging.te
22+++ b/policy/modules/system/logging.te
23@@ -417,6 +417,7 @@ files_search_spool(syslogd_t)
24
25 # Allow access for syslog-ng
26 allow syslogd_t var_log_t:dir { create setattr };
27+allow syslogd_t var_log_t:lnk_file read_lnk_file_perms;
28
29 # for systemd but can not be conditional
30 files_pid_filetrans(syslogd_t, syslogd_tmp_t, dir, "log")
31--
322.19.1
33
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0020-policy-module-logging-add-domain-rules-for-the-subdi.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0020-policy-module-logging-add-domain-rules-for-the-subdi.patch
new file mode 100644
index 0000000..3d55476
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0020-policy-module-logging-add-domain-rules-for-the-subdi.patch
@@ -0,0 +1,36 @@
1From 6a0b9c735253a2596bfb2a453694e620a1fdc50b Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 11:20:00 +0800
4Subject: [PATCH 20/34] policy/module/logging: add domain rules for the subdir
5 symlinks in /var/
6
7Except /var/log,/var/run,/var/lock, there still other subdir symlinks in
8/var for poky, so we need allow rules for all domains to read these
9symlinks. Domains still need their practical allow rules to read the
10contents, so this is still a secure relax.
11
12Upstream-Status: Inappropriate [only for Poky]
13
14Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
15Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
16---
17 policy/modules/kernel/domain.te | 3 +++
18 1 file changed, 3 insertions(+)
19
20diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
21index 1a55e3d2..babb794f 100644
22--- a/policy/modules/kernel/domain.te
23+++ b/policy/modules/kernel/domain.te
24@@ -110,6 +110,9 @@ term_use_controlling_term(domain)
25 # list the root directory
26 files_list_root(domain)
27
28+# Yocto/oe-core use some var volatile links
29+files_read_var_symlinks(domain)
30+
31 ifdef(`hide_broken_symptoms',`
32 # This check is in the general socket
33 # listen code, before protocol-specific
34--
352.19.1
36
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0021-policy-module-files-add-rules-for-the-symlink-of-tmp.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0021-policy-module-files-add-rules-for-the-symlink-of-tmp.patch
new file mode 100644
index 0000000..2546457
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0021-policy-module-files-add-rules-for-the-symlink-of-tmp.patch
@@ -0,0 +1,100 @@
1From 437bb5a3318fd0fb268f6e015564b006135368d1 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 21/34] policy/module/files: add rules for the symlink of /tmp
5
6/tmp is a symlink in poky, so we need allow rules for files to read
7lnk_file while doing search/list/delete/rw.. in /tmp/ directory.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13---
14 policy/modules/kernel/files.fc | 1 +
15 policy/modules/kernel/files.if | 8 ++++++++
16 2 files changed, 9 insertions(+)
17
18diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
19index c3496c21..05b1734b 100644
20--- a/policy/modules/kernel/files.fc
21+++ b/policy/modules/kernel/files.fc
22@@ -176,6 +176,7 @@ HOME_ROOT/lost\+found/.* <<none>>
23 # /tmp
24 #
25 /tmp -d gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
26+/tmp -l gen_context(system_u:object_r:tmp_t,s0-mls_systemhigh)
27 /tmp/.* <<none>>
28 /tmp/\.journal <<none>>
29
30diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
31index f1c94411..eb067ad3 100644
32--- a/policy/modules/kernel/files.if
33+++ b/policy/modules/kernel/files.if
34@@ -4350,6 +4350,7 @@ interface(`files_search_tmp',`
35 ')
36
37 allow $1 tmp_t:dir search_dir_perms;
38+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
39 ')
40
41 ########################################
42@@ -4386,6 +4387,7 @@ interface(`files_list_tmp',`
43 ')
44
45 allow $1 tmp_t:dir list_dir_perms;
46+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
47 ')
48
49 ########################################
50@@ -4422,6 +4424,7 @@ interface(`files_delete_tmp_dir_entry',`
51 ')
52
53 allow $1 tmp_t:dir del_entry_dir_perms;
54+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
55 ')
56
57 ########################################
58@@ -4440,6 +4443,7 @@ interface(`files_read_generic_tmp_files',`
59 ')
60
61 read_files_pattern($1, tmp_t, tmp_t)
62+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
63 ')
64
65 ########################################
66@@ -4458,6 +4462,7 @@ interface(`files_manage_generic_tmp_dirs',`
67 ')
68
69 manage_dirs_pattern($1, tmp_t, tmp_t)
70+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
71 ')
72
73 ########################################
74@@ -4476,6 +4481,7 @@ interface(`files_manage_generic_tmp_files',`
75 ')
76
77 manage_files_pattern($1, tmp_t, tmp_t)
78+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
79 ')
80
81 ########################################
82@@ -4512,6 +4518,7 @@ interface(`files_rw_generic_tmp_sockets',`
83 ')
84
85 rw_sock_files_pattern($1, tmp_t, tmp_t)
86+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
87 ')
88
89 ########################################
90@@ -4719,6 +4726,7 @@ interface(`files_tmp_filetrans',`
91 ')
92
93 filetrans_pattern($1, tmp_t, $2, $3, $4)
94+ allow $1 tmp_t:lnk_file read_lnk_file_perms;
95 ')
96
97 ########################################
98--
992.19.1
100
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0022-policy-module-terminals-add-rules-for-bsdpty_device_.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0022-policy-module-terminals-add-rules-for-bsdpty_device_.patch
new file mode 100644
index 0000000..3281ae8
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0022-policy-module-terminals-add-rules-for-bsdpty_device_.patch
@@ -0,0 +1,123 @@
1From 2512a367f4c16d4af6dd90d5f93f223466595d86 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 22/34] policy/module/terminals: add rules for bsdpty_device_t
5 to complete pty devices.
6
7Upstream-Status: Pending
8
9Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
10Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
11---
12 policy/modules/kernel/terminal.if | 16 ++++++++++++++++
13 1 file changed, 16 insertions(+)
14
15diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
16index 61308843..a84787e6 100644
17--- a/policy/modules/kernel/terminal.if
18+++ b/policy/modules/kernel/terminal.if
19@@ -623,9 +623,11 @@ interface(`term_getattr_generic_ptys',`
20 interface(`term_dontaudit_getattr_generic_ptys',`
21 gen_require(`
22 type devpts_t;
23+ type bsdpty_device_t;
24 ')
25
26 dontaudit $1 devpts_t:chr_file getattr;
27+ dontaudit $1 bsdpty_device_t:chr_file getattr;
28 ')
29 ########################################
30 ## <summary>
31@@ -641,11 +643,13 @@ interface(`term_dontaudit_getattr_generic_ptys',`
32 interface(`term_ioctl_generic_ptys',`
33 gen_require(`
34 type devpts_t;
35+ type bsdpty_device_t;
36 ')
37
38 dev_list_all_dev_nodes($1)
39 allow $1 devpts_t:dir search;
40 allow $1 devpts_t:chr_file ioctl;
41+ allow $1 bsdpty_device_t:chr_file ioctl;
42 ')
43
44 ########################################
45@@ -663,9 +667,11 @@ interface(`term_ioctl_generic_ptys',`
46 interface(`term_setattr_generic_ptys',`
47 gen_require(`
48 type devpts_t;
49+ type bsdpty_device_t;
50 ')
51
52 allow $1 devpts_t:chr_file setattr;
53+ allow $1 bsdpty_device_t:chr_file setattr;
54 ')
55
56 ########################################
57@@ -683,9 +689,11 @@ interface(`term_setattr_generic_ptys',`
58 interface(`term_dontaudit_setattr_generic_ptys',`
59 gen_require(`
60 type devpts_t;
61+ type bsdpty_device_t;
62 ')
63
64 dontaudit $1 devpts_t:chr_file setattr;
65+ dontaudit $1 bsdpty_device_t:chr_file setattr;
66 ')
67
68 ########################################
69@@ -703,11 +711,13 @@ interface(`term_dontaudit_setattr_generic_ptys',`
70 interface(`term_use_generic_ptys',`
71 gen_require(`
72 type devpts_t;
73+ type bsdpty_device_t;
74 ')
75
76 dev_list_all_dev_nodes($1)
77 allow $1 devpts_t:dir list_dir_perms;
78 allow $1 devpts_t:chr_file { rw_term_perms lock append };
79+ allow $1 bsdpty_device_t:chr_file { rw_term_perms lock append };
80 ')
81
82 ########################################
83@@ -725,9 +735,11 @@ interface(`term_use_generic_ptys',`
84 interface(`term_dontaudit_use_generic_ptys',`
85 gen_require(`
86 type devpts_t;
87+ type bsdpty_device_t;
88 ')
89
90 dontaudit $1 devpts_t:chr_file { getattr read write ioctl };
91+ dontaudit $1 bsdpty_device_t:chr_file { getattr read write ioctl };
92 ')
93
94 #######################################
95@@ -743,10 +755,12 @@ interface(`term_dontaudit_use_generic_ptys',`
96 interface(`term_setattr_controlling_term',`
97 gen_require(`
98 type devtty_t;
99+ type bsdpty_device_t;
100 ')
101
102 dev_list_all_dev_nodes($1)
103 allow $1 devtty_t:chr_file setattr;
104+ allow $1 bsdpty_device_t:chr_file setattr;
105 ')
106
107 ########################################
108@@ -763,10 +777,12 @@ interface(`term_setattr_controlling_term',`
109 interface(`term_use_controlling_term',`
110 gen_require(`
111 type devtty_t;
112+ type bsdpty_device_t;
113 ')
114
115 dev_list_all_dev_nodes($1)
116 allow $1 devtty_t:chr_file { rw_term_perms lock append };
117+ allow $1 bsdpty_device_t:chr_file { rw_term_perms lock append };
118 ')
119
120 #######################################
121--
1222.19.1
123
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0023-policy-module-terminals-don-t-audit-tty_device_t-in-.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0023-policy-module-terminals-don-t-audit-tty_device_t-in-.patch
new file mode 100644
index 0000000..887af46
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0023-policy-module-terminals-don-t-audit-tty_device_t-in-.patch
@@ -0,0 +1,37 @@
1From fcf756e6906bba50d09224184d64ac56f40b6424 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 23/34] policy/module/terminals: don't audit tty_device_t in
5 term_dontaudit_use_console.
6
7We should also not audit terminal to rw tty_device_t and fds in
8term_dontaudit_use_console.
9
10Upstream-Status: Inappropriate [only for Poky]
11
12Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
13Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
14---
15 policy/modules/kernel/terminal.if | 3 +++
16 1 file changed, 3 insertions(+)
17
18diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
19index a84787e6..cf66da2f 100644
20--- a/policy/modules/kernel/terminal.if
21+++ b/policy/modules/kernel/terminal.if
22@@ -335,9 +335,12 @@ interface(`term_use_console',`
23 interface(`term_dontaudit_use_console',`
24 gen_require(`
25 type console_device_t;
26+ type tty_device_t;
27 ')
28
29+ init_dontaudit_use_fds($1)
30 dontaudit $1 console_device_t:chr_file rw_chr_file_perms;
31+ dontaudit $1 tty_device_t:chr_file rw_chr_file_perms;
32 ')
33
34 ########################################
35--
362.19.1
37
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0024-policy-module-rpc-allow-nfsd-to-exec-shell-commands.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0024-policy-module-rpc-allow-nfsd-to-exec-shell-commands.patch
new file mode 100644
index 0000000..0188fa9
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0024-policy-module-rpc-allow-nfsd-to-exec-shell-commands.patch
@@ -0,0 +1,29 @@
1From 85d5fc695ae69956715b502a8f1d95e9070dfbcc Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 24/34] policy/module/rpc: allow nfsd to exec shell commands.
5
6Upstream-Status: Inappropriate [only for Poky]
7
8Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
9Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
10---
11 policy/modules/services/rpc.te | 2 +-
12 1 file changed, 1 insertion(+), 1 deletion(-)
13
14diff --git a/policy/modules/services/rpc.te b/policy/modules/services/rpc.te
15index 47fa2fd0..d4209231 100644
16--- a/policy/modules/services/rpc.te
17+++ b/policy/modules/services/rpc.te
18@@ -227,7 +227,7 @@ kernel_read_network_state(nfsd_t)
19 kernel_dontaudit_getattr_core_if(nfsd_t)
20 kernel_setsched(nfsd_t)
21 kernel_request_load_module(nfsd_t)
22-# kernel_mounton_proc(nfsd_t)
23+kernel_mounton_proc(nfsd_t)
24
25 corenet_sendrecv_nfs_server_packets(nfsd_t)
26 corenet_tcp_bind_nfs_port(nfsd_t)
27--
282.19.1
29
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0025-policy-module-rpc-fix-policy-for-nfsserver-to-mount-.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0025-policy-module-rpc-fix-policy-for-nfsserver-to-mount-.patch
new file mode 100644
index 0000000..b4befdd
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0025-policy-module-rpc-fix-policy-for-nfsserver-to-mount-.patch
@@ -0,0 +1,77 @@
1From 97a6eec0d2ea437b5155090ba880a88666f40059 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 12:01:53 +0800
4Subject: [PATCH 25/34] policy/module/rpc: fix policy for nfsserver to mount
5 nfsd_fs_t.
6
7Upstream-Status: Pending
8
9Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
10Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
11---
12 policy/modules/kernel/filesystem.te | 1 +
13 policy/modules/kernel/kernel.te | 2 ++
14 policy/modules/services/rpc.te | 5 +++++
15 policy/modules/services/rpcbind.te | 5 +++++
16 4 files changed, 13 insertions(+)
17
18diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
19index 1db0c652..bf1c0173 100644
20--- a/policy/modules/kernel/filesystem.te
21+++ b/policy/modules/kernel/filesystem.te
22@@ -129,6 +129,7 @@ genfscon mvfs / gen_context(system_u:object_r:mvfs_t,s0)
23
24 type nfsd_fs_t;
25 fs_type(nfsd_fs_t)
26+files_mountpoint(nfsd_fs_t)
27 genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
28
29 type nsfs_t;
30diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
31index e971c533..ad7c823a 100644
32--- a/policy/modules/kernel/kernel.te
33+++ b/policy/modules/kernel/kernel.te
34@@ -334,6 +334,8 @@ mls_process_read_all_levels(kernel_t)
35 mls_process_write_all_levels(kernel_t)
36 mls_file_write_all_levels(kernel_t)
37 mls_file_read_all_levels(kernel_t)
38+mls_socket_write_all_levels(kernel_t)
39+mls_fd_use_all_levels(kernel_t)
40
41 ifdef(`distro_redhat',`
42 # Bugzilla 222337
43diff --git a/policy/modules/services/rpc.te b/policy/modules/services/rpc.te
44index d4209231..a2327b44 100644
45--- a/policy/modules/services/rpc.te
46+++ b/policy/modules/services/rpc.te
47@@ -280,6 +280,11 @@ tunable_policy(`nfs_export_all_ro',`
48
49 optional_policy(`
50 mount_exec(nfsd_t)
51+ # Should domtrans to mount_t while mounting nfsd_fs_t.
52+ mount_domtrans(nfsd_t)
53+ # nfsd_t need to chdir to /var/lib/nfs and read files.
54+ files_list_var(nfsd_t)
55+ rpc_read_nfs_state_data(nfsd_t)
56 ')
57
58 ########################################
59diff --git a/policy/modules/services/rpcbind.te b/policy/modules/services/rpcbind.te
60index 5914af99..2055c114 100644
61--- a/policy/modules/services/rpcbind.te
62+++ b/policy/modules/services/rpcbind.te
63@@ -75,6 +75,11 @@ logging_send_syslog_msg(rpcbind_t)
64
65 miscfiles_read_localization(rpcbind_t)
66
67+# nfsd_t would not be allowed to send unix_stream_socket to rpcbind_t,
68+# because the are running in different level. So add rules to allow this.
69+mls_socket_read_all_levels(rpcbind_t)
70+mls_socket_write_all_levels(rpcbind_t)
71+
72 ifdef(`distro_debian',`
73 term_dontaudit_use_unallocated_ttys(rpcbind_t)
74 ')
75--
762.19.1
77
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0026-policy-module-sysfs-fix-for-new-SELINUXMNT-in-sys.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0026-policy-module-sysfs-fix-for-new-SELINUXMNT-in-sys.patch
new file mode 100644
index 0000000..94b7dd3
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0026-policy-module-sysfs-fix-for-new-SELINUXMNT-in-sys.patch
@@ -0,0 +1,126 @@
1From 00d81a825519cac67d88e513d75e82ab3269124c Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Fri, 29 Mar 2019 11:16:37 -0400
4Subject: [PATCH 26/34] policy/module/sysfs: fix for new SELINUXMNT in /sys
5
6SELINUXMNT is now from /selinux to /sys/fs/selinux, so we should
7add rules to access sysfs.
8
9Upstream-Status: Inappropriate [only for Poky]
10
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13---
14 policy/modules/kernel/selinux.if | 19 +++++++++++++++++++
15 1 file changed, 19 insertions(+)
16
17diff --git a/policy/modules/kernel/selinux.if b/policy/modules/kernel/selinux.if
18index 6790e5d0..2c95db81 100644
19--- a/policy/modules/kernel/selinux.if
20+++ b/policy/modules/kernel/selinux.if
21@@ -117,6 +117,9 @@ interface(`selinux_mount_fs',`
22 type security_t;
23 ')
24
25+ dev_getattr_sysfs($1)
26+ dev_search_sysfs($1)
27+
28 allow $1 security_t:filesystem mount;
29 ')
30
31@@ -136,6 +139,9 @@ interface(`selinux_remount_fs',`
32 type security_t;
33 ')
34
35+ dev_getattr_sysfs($1)
36+ dev_search_sysfs($1)
37+
38 allow $1 security_t:filesystem remount;
39 ')
40
41@@ -155,6 +161,9 @@ interface(`selinux_unmount_fs',`
42 ')
43
44 allow $1 security_t:filesystem unmount;
45+
46+ dev_getattr_sysfs($1)
47+ dev_search_sysfs($1)
48 ')
49
50 ########################################
51@@ -217,6 +226,8 @@ interface(`selinux_dontaudit_getattr_dir',`
52 ')
53
54 dontaudit $1 security_t:dir getattr;
55+ dev_dontaudit_getattr_sysfs($1)
56+ dev_dontaudit_search_sysfs($1)
57 ')
58
59 ########################################
60@@ -253,6 +264,7 @@ interface(`selinux_dontaudit_search_fs',`
61 type security_t;
62 ')
63
64+ dev_dontaudit_search_sysfs($1)
65 dontaudit $1 security_t:dir search_dir_perms;
66 ')
67
68@@ -272,6 +284,7 @@ interface(`selinux_dontaudit_read_fs',`
69 type security_t;
70 ')
71
72+ dev_dontaudit_getattr_sysfs($1)
73 dontaudit $1 security_t:dir search_dir_perms;
74 dontaudit $1 security_t:file read_file_perms;
75 ')
76@@ -361,6 +374,7 @@ interface(`selinux_read_policy',`
77 type security_t;
78 ')
79
80+ dev_getattr_sysfs($1)
81 dev_search_sysfs($1)
82 allow $1 security_t:dir list_dir_perms;
83 allow $1 security_t:file read_file_perms;
84@@ -394,6 +408,7 @@ interface(`selinux_set_generic_booleans',`
85 type security_t;
86 ')
87
88+ dev_getattr_sysfs($1)
89 dev_search_sysfs($1)
90
91 allow $1 security_t:dir list_dir_perms;
92@@ -431,6 +446,7 @@ interface(`selinux_set_all_booleans',`
93 bool secure_mode_policyload;
94 ')
95
96+ dev_getattr_sysfs($1)
97 dev_search_sysfs($1)
98
99 allow $1 security_t:dir list_dir_perms;
100@@ -512,6 +528,7 @@ interface(`selinux_dontaudit_validate_context',`
101 type security_t;
102 ')
103
104+ dev_dontaudit_search_sysfs($1)
105 dontaudit $1 security_t:dir list_dir_perms;
106 dontaudit $1 security_t:file rw_file_perms;
107 dontaudit $1 security_t:security check_context;
108@@ -533,6 +550,7 @@ interface(`selinux_compute_access_vector',`
109 type security_t;
110 ')
111
112+ dev_getattr_sysfs($1)
113 dev_search_sysfs($1)
114 allow $1 self:netlink_selinux_socket create_socket_perms;
115 allow $1 security_t:dir list_dir_perms;
116@@ -629,6 +647,7 @@ interface(`selinux_compute_user_contexts',`
117 type security_t;
118 ')
119
120+ dev_getattr_sysfs($1)
121 dev_search_sysfs($1)
122 allow $1 security_t:dir list_dir_perms;
123 allow $1 security_t:file rw_file_perms;
124--
1252.19.1
126
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0027-policy-module-rpc-allow-sysadm-to-run-rpcinfo.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0027-policy-module-rpc-allow-sysadm-to-run-rpcinfo.patch
new file mode 100644
index 0000000..c20dd5f
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0027-policy-module-rpc-allow-sysadm-to-run-rpcinfo.patch
@@ -0,0 +1,31 @@
1From fbb7431a4288c7dd2739bc3adfa521d427e6375a Mon Sep 17 00:00:00 2001
2From: Roy Li <rongqing.li@windriver.com>
3Date: Sat, 15 Feb 2014 09:45:00 +0800
4Subject: [PATCH 27/34] policy/module/rpc: allow sysadm to run rpcinfo
5
6Upstream-Status: Pending
7
8type=AVC msg=audit(1392427946.976:264): avc: denied { connectto } for pid=2111 comm="rpcinfo" path="/run/rpcbind.sock" scontext=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 tcontext=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 tclass=unix_stream_socket
9type=SYSCALL msg=audit(1392427946.976:264): arch=c000003e syscall=42 success=no exit=-13 a0=3 a1=7fff3aa20000 a2=17 a3=22 items=0 ppid=2108 pid=2111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts0 comm="rpcinfo" exe="/usr/sbin/rpcinfo" subj=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 key=(null)
10
11Signed-off-by: Roy Li <rongqing.li@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13---
14 policy/modules/roles/sysadm.te | 1 +
15 1 file changed, 1 insertion(+)
16
17diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
18index e411d4fd..f326d1d7 100644
19--- a/policy/modules/roles/sysadm.te
20+++ b/policy/modules/roles/sysadm.te
21@@ -939,6 +939,7 @@ optional_policy(`
22 ')
23
24 optional_policy(`
25+ rpcbind_stream_connect(sysadm_t)
26 rpcbind_admin(sysadm_t, sysadm_r)
27 ')
28
29--
302.19.1
31
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0028-policy-module-userdomain-fix-selinux-utils-to-manage.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0028-policy-module-userdomain-fix-selinux-utils-to-manage.patch
new file mode 100644
index 0000000..e0208aa
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0028-policy-module-userdomain-fix-selinux-utils-to-manage.patch
@@ -0,0 +1,45 @@
1From 8a3c685c1f868f04cb4a7953d14443527b920310 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 13:37:23 +0800
4Subject: [PATCH 28/34] policy/module/userdomain: fix selinux utils to manage
5 config files
6
7Upstream-Status: Pending
8
9Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
10Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
11---
12 policy/modules/system/selinuxutil.if | 1 +
13 policy/modules/system/userdomain.if | 4 ++++
14 2 files changed, 5 insertions(+)
15
16diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
17index 20024993..0fdc8c10 100644
18--- a/policy/modules/system/selinuxutil.if
19+++ b/policy/modules/system/selinuxutil.if
20@@ -674,6 +674,7 @@ interface(`seutil_manage_config',`
21 ')
22
23 files_search_etc($1)
24+ manage_dirs_pattern($1, selinux_config_t, selinux_config_t)
25 manage_files_pattern($1, selinux_config_t, selinux_config_t)
26 read_lnk_files_pattern($1, selinux_config_t, selinux_config_t)
27 ')
28diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
29index 5221bd13..4cf987d1 100644
30--- a/policy/modules/system/userdomain.if
31+++ b/policy/modules/system/userdomain.if
32@@ -1431,6 +1431,10 @@ template(`userdom_security_admin_template',`
33 logging_read_audit_config($1)
34
35 seutil_manage_bin_policy($1)
36+ seutil_manage_default_contexts($1)
37+ seutil_manage_file_contexts($1)
38+ seutil_manage_module_store($1)
39+ seutil_manage_config($1)
40 seutil_run_checkpolicy($1, $2)
41 seutil_run_loadpolicy($1, $2)
42 seutil_run_semanage($1, $2)
43--
442.19.1
45
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0029-policy-module-selinuxutil-fix-setfiles-statvfs-to-ge.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0029-policy-module-selinuxutil-fix-setfiles-statvfs-to-ge.patch
new file mode 100644
index 0000000..e62c81e
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0029-policy-module-selinuxutil-fix-setfiles-statvfs-to-ge.patch
@@ -0,0 +1,33 @@
1From 524f823bb07e0eb763683b72f18999ef29ae43c9 Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Fri, 29 Mar 2019 11:30:27 -0400
4Subject: [PATCH 29/34] policy/module/selinuxutil: fix setfiles statvfs to get
5 file count
6
7New setfiles will read /proc/mounts and use statvfs in
8file_system_count() to get file count of filesystems.
9
10Upstream-Status: Pending
11
12Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
13Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
14Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
15---
16 policy/modules/system/selinuxutil.te | 1 +
17 1 file changed, 1 insertion(+)
18
19diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
20index db6bb368..98fed2d0 100644
21--- a/policy/modules/system/selinuxutil.te
22+++ b/policy/modules/system/selinuxutil.te
23@@ -607,6 +607,7 @@ files_relabel_all_files(setfiles_t)
24 files_read_usr_symlinks(setfiles_t)
25 files_dontaudit_read_all_symlinks(setfiles_t)
26
27+fs_getattr_all_fs(setfiles_t)
28 fs_getattr_all_xattr_fs(setfiles_t)
29 fs_getattr_cgroup(setfiles_t)
30 fs_getattr_nfs(setfiles_t)
31--
322.19.1
33
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0030-policy-module-admin-fix-dmesg-to-use-dev-kmsg-as-def.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0030-policy-module-admin-fix-dmesg-to-use-dev-kmsg-as-def.patch
new file mode 100644
index 0000000..88c94c5
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0030-policy-module-admin-fix-dmesg-to-use-dev-kmsg-as-def.patch
@@ -0,0 +1,25 @@
1From 78210f371391ccfad1d18b89a91ffb5a83f451e0 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Fri, 23 Aug 2013 16:36:09 +0800
4Subject: [PATCH 30/34] policy/module/admin: fix dmesg to use /dev/kmsg as
5 default input
6
7Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
8Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
9---
10 policy/modules/admin/dmesg.if | 1 +
11 1 file changed, 1 insertion(+)
12
13diff --git a/policy/modules/admin/dmesg.if b/policy/modules/admin/dmesg.if
14index e1973c78..739a4bc5 100644
15--- a/policy/modules/admin/dmesg.if
16+++ b/policy/modules/admin/dmesg.if
17@@ -37,4 +37,5 @@ interface(`dmesg_exec',`
18
19 corecmd_search_bin($1)
20 can_exec($1, dmesg_exec_t)
21+ dev_read_kmsg($1)
22 ')
23--
242.19.1
25
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0031-policy-module-ftp-add-ftpd_t-to-mls_file_write_all_l.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0031-policy-module-ftp-add-ftpd_t-to-mls_file_write_all_l.patch
new file mode 100644
index 0000000..d002830
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0031-policy-module-ftp-add-ftpd_t-to-mls_file_write_all_l.patch
@@ -0,0 +1,41 @@
1From a406bcd2838772573e2cdde1a408ea52a60adc87 Mon Sep 17 00:00:00 2001
2From: Roy Li <rongqing.li@windriver.com>
3Date: Mon, 10 Feb 2014 18:10:12 +0800
4Subject: [PATCH 31/34] policy/module/ftp: add ftpd_t to
5 mls_file_write_all_levels
6
7Proftpd will create file under /var/run, but its mls is in high, and
8can not write to lowlevel
9
10Upstream-Status: Pending
11
12type=AVC msg=audit(1392347709.621:15): avc: denied { write } for pid=545 comm="proftpd" name="/" dev="tmpfs" ino=5853 scontext=system_u:system_r:ftpd_t:s15:c0.c1023 tcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 tclass=dir
13type=AVC msg=audit(1392347709.621:15): avc: denied { add_name } for pid=545 comm="proftpd" name="proftpd.delay" scontext=system_u:system_r:ftpd_t:s15:c0.c1023 tcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 tclass=dir
14type=SYSCALL msg=audit(1392347709.621:15): arch=c000003e syscall=2 success=yes exit=3 a0=471910 a1=42 a2=1b6 a3=8 items=0 ppid=539 pid=545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s15:c0.c1023 key=(null)
15
16root@localhost:~# sesearch --allow -s ftpd_t -t var_run_t|grep dir|grep add_name
17 allow ftpd_t var_run_t : dir { ioctl read write getattr lock add_name remove_name search open } ;
18root@localhost:~#
19
20Signed-off-by: Roy Li <rongqing.li@windriver.com>
21Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
22---
23 policy/modules/services/ftp.te | 2 ++
24 1 file changed, 2 insertions(+)
25
26diff --git a/policy/modules/services/ftp.te b/policy/modules/services/ftp.te
27index 29bc077c..d582cf80 100644
28--- a/policy/modules/services/ftp.te
29+++ b/policy/modules/services/ftp.te
30@@ -150,6 +150,8 @@ role ftpdctl_roles types ftpdctl_t;
31 type ftpdctl_tmp_t;
32 files_tmp_file(ftpdctl_tmp_t)
33
34+mls_file_write_all_levels(ftpd_t)
35+
36 type sftpd_t;
37 domain_type(sftpd_t)
38 role system_r types sftpd_t;
39--
402.19.1
41
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0032-policy-module-init-update-for-systemd-related-allow-.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0032-policy-module-init-update-for-systemd-related-allow-.patch
new file mode 100644
index 0000000..37d180c
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0032-policy-module-init-update-for-systemd-related-allow-.patch
@@ -0,0 +1,32 @@
1From dfbda15401f92e5d1b9b55c7ba24a543deea18e8 Mon Sep 17 00:00:00 2001
2From: Shrikant Bobade <shrikant_bobade@mentor.com>
3Date: Fri, 12 Jun 2015 19:37:52 +0530
4Subject: [PATCH 32/34] policy/module/init: update for systemd related allow
5 rules
6
7It provide, the systemd support related allow rules
8
9Upstream-Status: Pending
10
11Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13---
14 policy/modules/system/init.te | 5 +++++
15 1 file changed, 5 insertions(+)
16
17diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
18index eabba1ed..5da25cd6 100644
19--- a/policy/modules/system/init.te
20+++ b/policy/modules/system/init.te
21@@ -1418,3 +1418,8 @@ optional_policy(`
22 userdom_dontaudit_rw_all_users_stream_sockets(systemprocess)
23 userdom_dontaudit_write_user_tmp_files(systemprocess)
24 ')
25+
26+# systemd related allow rules
27+allow kernel_t init_t:process dyntransition;
28+allow devpts_t device_t:filesystem associate;
29+allow init_t self:capability2 block_suspend;
30--
312.19.1
32
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0033-refpolicy-minimum-make-sysadmin-module-optional.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0033-refpolicy-minimum-make-sysadmin-module-optional.patch
new file mode 100644
index 0000000..644c2cd
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0033-refpolicy-minimum-make-sysadmin-module-optional.patch
@@ -0,0 +1,67 @@
1From 937924e34c516c4a18d183084958b2612439ba52 Mon Sep 17 00:00:00 2001
2From: Joe MacDonald <joe_macdonald@mentor.com>
3Date: Fri, 5 Apr 2019 11:53:28 -0400
4Subject: [PATCH 33/34] refpolicy/minimum: make sysadmin module optional
5
6init and locallogin modules have a depend for sysadm module because
7they have called sysadm interfaces(sysadm_shell_domtrans). Since
8sysadm is not a core module, we could make the sysadm_shell_domtrans
9calls optionally by optional_policy.
10
11So, we could make the minimum policy without sysadm module.
12
13Upstream-Status: pending
14
15Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
16Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
17Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
18---
19 policy/modules/system/init.te | 16 +++++++++-------
20 policy/modules/system/locallogin.te | 4 +++-
21 2 files changed, 12 insertions(+), 8 deletions(-)
22
23diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
24index 5da25cd6..8352428a 100644
25--- a/policy/modules/system/init.te
26+++ b/policy/modules/system/init.te
27@@ -446,13 +446,15 @@ ifdef(`init_systemd',`
28 modutils_domtrans(init_t)
29 ')
30 ',`
31- tunable_policy(`init_upstart',`
32- corecmd_shell_domtrans(init_t, initrc_t)
33- ',`
34- # Run the shell in the sysadm role for single-user mode.
35- # causes problems with upstart
36- ifndef(`distro_debian',`
37- sysadm_shell_domtrans(init_t)
38+ optional_policy(`
39+ tunable_policy(`init_upstart',`
40+ corecmd_shell_domtrans(init_t, initrc_t)
41+ ',`
42+ # Run the shell in the sysadm role for single-user mode.
43+ # causes problems with upstart
44+ ifndef(`distro_debian',`
45+ sysadm_shell_domtrans(init_t)
46+ ')
47 ')
48 ')
49 ')
50diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
51index a56f3d1f..4c679ff3 100644
52--- a/policy/modules/system/locallogin.te
53+++ b/policy/modules/system/locallogin.te
54@@ -266,7 +266,9 @@ userdom_use_unpriv_users_fds(sulogin_t)
55 userdom_search_user_home_dirs(sulogin_t)
56 userdom_use_user_ptys(sulogin_t)
57
58-sysadm_shell_domtrans(sulogin_t)
59+optional_policy(`
60+ sysadm_shell_domtrans(sulogin_t)
61+')
62
63 # by default, sulogin does not use pam...
64 # sulogin_pam might need to be defined otherwise
65--
662.19.1
67
diff --git a/recipes-security/refpolicy/refpolicy-2.20190201/0034-policy-module-apache-add-rules-for-the-symlink-of-va.patch b/recipes-security/refpolicy/refpolicy-2.20190201/0034-policy-module-apache-add-rules-for-the-symlink-of-va.patch
new file mode 100644
index 0000000..c374384
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20190201/0034-policy-module-apache-add-rules-for-the-symlink-of-va.patch
@@ -0,0 +1,33 @@
1From bbad13d008ab4df827ac2ba8dfc6dd3e430f6dd6 Mon Sep 17 00:00:00 2001
2From: Xin Ouyang <Xin.Ouyang@windriver.com>
3Date: Thu, 22 Aug 2013 19:36:44 +0800
4Subject: [PATCH 34/34] policy/module/apache: add rules for the symlink of
5 /var/log - apache2
6
7We have added rules for the symlink of /var/log in logging.if,
8while apache.te uses /var/log but does not use the interfaces in
9logging.if. So still need add a individual rule for apache.te.
10
11Upstream-Status: Pending
12
13Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
14Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
15---
16 policy/modules/services/apache.te | 1 +
17 1 file changed, 1 insertion(+)
18
19diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
20index 15c4ea53..596370b1 100644
21--- a/policy/modules/services/apache.te
22+++ b/policy/modules/services/apache.te
23@@ -412,6 +412,7 @@ create_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
24 read_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
25 setattr_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
26 read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
27+read_lnk_files_pattern(httpd_t, var_log_t, var_log_t)
28 logging_log_filetrans(httpd_t, httpd_log_t, file)
29
30 allow httpd_t httpd_modules_t:dir list_dir_perms;
31--
322.19.1
33
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-06-12 07:55:32 +0000