1 files changed, 48 insertions, 30 deletions

diff --git a/recipes-security/refpolicy/refpolicy-targeted/refpolicy-unconfined_u-default-user.patch b/recipes-security/refpolicy/refpolicy-targeted/refpolicy-unconfined_u-default-user.patch
index ba14851..29d3e2d 100644
--- a/recipes-security/refpolicy/refpolicy-targeted/refpolicy-unconfined_u-default-user.patch
+++ b/recipes-security/refpolicy/refpolicy-targeted/refpolicy-unconfined_u-default-user.patch
@@ -20,33 +20,33 @@ Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
  policy/users                        | 16 +++++--------
  5 files changed, 55 insertions(+), 20 deletions(-)
 
-diff --git a/config/appconfig-mcs/seusers b/config/appconfig-mcs/seusers
-index dc5f1e4..4428da8 100644
 --- a/config/appconfig-mcs/seusers
 +++ b/config/appconfig-mcs/seusers
-@@ -1,3 +1,3 @@
- system_u:system_u:s0-mcs_systemhigh
+@@ -1,2 +1,3 @@
 -root:root:s0-mcs_systemhigh
 -__default__:user_u:s0
 +root:unconfined_u:s0-mcs_systemhigh
 +__default__:unconfined_u:s0
-diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
-index 005afd8..4699d6a 100644
++
 --- a/policy/modules/roles/sysadm.te
 +++ b/policy/modules/roles/sysadm.te
-@@ -34,6 +34,7 @@ ubac_file_exempt(sysadm_t)
+@@ -37,10 +37,11 @@ ubac_process_exempt(sysadm_t)
+ ubac_file_exempt(sysadm_t)
  ubac_fd_exempt(sysadm_t)
  
  init_exec(sysadm_t)
+ init_admin(sysadm_t)
 +init_script_role_transition(sysadm_r)
- init_get_system_status(sysadm_t)
- init_disable(sysadm_t)
- init_enable(sysadm_t)
-diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
-index b68dfc1..35b4141 100644
+ 
+ selinux_read_policy(sysadm_t)
+ 
+ # Add/remove user home directories
+ userdom_manage_user_home_dirs(sysadm_t)
 --- a/policy/modules/system/init.if
 +++ b/policy/modules/system/init.if
-@@ -1234,11 +1234,12 @@ interface(`init_script_file_entry_type',`
+@@ -1394,30 +1394,31 @@ interface(`init_script_file_entry_type',
+ ##     </summary>
+ ## </param>
  #
  interface(`init_spec_domtrans_script',`
         gen_require(`
@@ -61,7 +61,10 @@ index b68dfc1..35b4141 100644
  
         ifdef(`distro_gentoo',`
                 gen_require(`
-@@ -1249,11 +1250,11 @@ interface(`init_spec_domtrans_script',`
+                        type rc_exec_t;
+                ')
+ 
+                domtrans_pattern($1, rc_exec_t, initrc_t)
         ')
  
         ifdef(`enable_mcs',`
@@ -75,7 +78,11 @@ index b68dfc1..35b4141 100644
         ')
  ')
  
-@@ -1269,18 +1270,19 @@ interface(`init_spec_domtrans_script',`
+ ########################################
+ ## <summary>
+@@ -1429,22 +1430,23 @@ interface(`init_spec_domtrans_script',`
+ ##     </summary>
+ ## </param>
  #
  interface(`init_domtrans_script',`
         gen_require(`
@@ -99,9 +106,13 @@ index b68dfc1..35b4141 100644
         ')
  ')
  
-@@ -2504,3 +2506,32 @@ interface(`init_reload_all_units',`
- 
-        allow $1 systemdunit:service reload;
+ ########################################
+ ## <summary>
+@@ -2972,5 +2974,34 @@ interface(`init_admin',`
+        init_stop_all_units($1)
+        init_stop_generic_units($1)
+        init_stop_system($1)
+        init_telinit($1)
  ')
 +
 +########################################
@@ -132,11 +143,11 @@ index b68dfc1..35b4141 100644
 +       role_transition $1 init_script_file_type system_r;
 +')
 +
-diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
-index ad23fce..99cab31 100644
 --- a/policy/modules/system/unconfined.te
 +++ b/policy/modules/system/unconfined.te
-@@ -20,6 +20,11 @@ type unconfined_execmem_t;
+@@ -18,10 +18,15 @@ init_system_domain(unconfined_t, unconfi
+ 
+ type unconfined_execmem_t;
  type unconfined_execmem_exec_t;
  init_system_domain(unconfined_execmem_t, unconfined_execmem_exec_t)
  role unconfined_r types unconfined_execmem_t;
@@ -148,7 +159,11 @@ index ad23fce..99cab31 100644
  
  ########################################
  #
-@@ -50,6 +55,8 @@ userdom_user_home_dir_filetrans_user_home_content(unconfined_t, { dir file lnk_f
+ # Local policy
+ #
+@@ -48,10 +53,12 @@ unconfined_domain(unconfined_t)
+ userdom_user_home_dir_filetrans_user_home_content(unconfined_t, { dir file lnk_file fifo_file sock_file })
+ 
  ifdef(`direct_sysadm_daemon',`
          optional_policy(`
                  init_run_daemon(unconfined_t, unconfined_r)
@@ -157,11 +172,13 @@ index ad23fce..99cab31 100644
          ')
  ',`
          ifdef(`distro_gentoo',`
-diff --git a/policy/users b/policy/users
-index ca20375..ac1ca6c 100644
+                 seutil_run_runinit(unconfined_t, unconfined_r)
+                 seutil_init_script_run_runinit(unconfined_t, unconfined_r)
 --- a/policy/users
 +++ b/policy/users
-@@ -15,7 +15,7 @@
+@@ -13,37 +13,33 @@
+ # system_u is the user identity for system processes and objects.
+ # There should be no corresponding Unix user identity for system,
  # and a user process should never be assigned the system user
  # identity.
  #
@@ -170,7 +187,9 @@ index ca20375..ac1ca6c 100644
  
  #
  # user_u is a generic user identity for Linux users who have no
-@@ -25,14 +25,14 @@ gen_user(system_u,, system_r, s0, s0 - mls_systemhigh, mcs_allcats)
+ # SELinux user identity defined.  The modified daemons will use
+ # this user identity in the security context if there is no matching
+ # SELinux user identity for a Linux user.  If you do not want to
  # permit any access to such users, then remove this entry.
  #
  gen_user(user_u, user, user_r, s0, s0)
@@ -189,7 +208,9 @@ index ca20375..ac1ca6c 100644
  ')
  
  #
-@@ -42,8 +42,4 @@ ifdef(`direct_sysadm_daemon',`
+ # The following users correspond to Unix identities.
+ # These identities are typically assigned as the user attribute
+ # when login starts the user shell.  Users with access to the sysadm_r
  # role should use the staff_r role instead of the user_r role when
  # not in the sysadm_r.
  #
@@ -199,6 +220,3 @@ index ca20375..ac1ca6c 100644
 -       gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
 -')
 +gen_user(root, user, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
--- 
-1.9.1
-