1 files changed, 67 insertions, 0 deletions

diff --git a/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch b/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch
new file mode 100644
index 0000000..deb27c0
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0001-refpolicy-minimum-make-sysadmin-module-optional.patch
@@ -0,0 +1,67 @@
+From efe4d5472fde3d4f043f4e8660c6cc73c7fc1542 Mon Sep 17 00:00:00 2001
+From: Joe MacDonald <joe_macdonald@mentor.com>
+Date: Fri, 5 Apr 2019 11:53:28 -0400
+Subject: [PATCH] refpolicy-minimum: make sysadmin module optional
+
+The init and locallogin modules have a depend for sysadm module
+because they have called sysadm interfaces(sysadm_shell_domtrans).
+Since sysadm is not a core module, we could make the
+sysadm_shell_domtrans calls optionally by optional_policy.
+
+So, we could make the minimum policy without sysadm module.
+
+Upstream-Status: Inappropriate [embedded specific]
+
+Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
+Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
+Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ policy/modules/system/init.te       | 14 ++++++++------
+ policy/modules/system/locallogin.te |  4 +++-
+ 2 files changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
+index feed5af5f..6b6b723b8 100644
+--- a/policy/modules/system/init.te
++++ b/policy/modules/system/init.te
+@@ -515,13 +515,15 @@ ifdef(`init_systemd',`
+                unconfined_write_keys(init_t)
+        ')
+ ',`
+-       tunable_policy(`init_upstart',`
+-               corecmd_shell_domtrans(init_t, initrc_t)
++       optional_policy(`
++               tunable_policy(`init_upstart',`
++                       corecmd_shell_domtrans(init_t, initrc_t)
+        ',`
+-               # Run the shell in the sysadm role for single-user mode.
+-               # causes problems with upstart
+-               ifndef(`distro_debian',`
+-                       sysadm_shell_domtrans(init_t)
++                       # Run the shell in the sysadm role for single-user mode.
++                       # causes problems with upstart
++                       ifndef(`distro_debian',`
++                               sysadm_shell_domtrans(init_t)
++                       ')
+                ')
+        ')
+ ')
+diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
+index f629b0040..971ca40e5 100644
+--- a/policy/modules/system/locallogin.te
++++ b/policy/modules/system/locallogin.te
+@@ -267,7 +267,9 @@ userdom_use_unpriv_users_fds(sulogin_t)
+ userdom_search_user_home_dirs(sulogin_t)
+ userdom_use_user_ptys(sulogin_t)
+ 
+-sysadm_shell_domtrans(sulogin_t)
++optional_policy(`
++       sysadm_shell_domtrans(sulogin_t)
++')
+ 
+ # by default, sulogin does not use pam...
+ # sulogin_pam might need to be defined otherwise
+-- 
+2.17.1
+